Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
sav07_lecture_3_skeleton [2007/03/21 10:01] vkuncak |
sav07_lecture_3_skeleton [2007/03/21 10:59] vkuncak |
||
|---|---|---|---|
| Line 102: | Line 102: | ||
| This idea is important in static analysis. | This idea is important in static analysis. | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| Line 107: | Line 112: | ||
| ==== Symbolic execution ==== | ==== Symbolic execution ==== | ||
| - | Symbolic execution converts programs into formulas by going forward. It is therefore somewhat analogous to the way an [[interpreter]] for the language would work. It is based on the notion of strongest postcondition. | + | Symbolic execution converts programs into formulas by going forward. It is therefore somewhat analogous to the way an [[interpreter]] for the language would work. |
| + | Avoid renaming all the time. | ||
| + | |||
| + | SE(F,k, c1; c2) = SE(F & R(c1), k+1, c2) (update formula) | ||
| + | |||
| + | SE(F,k,(c1 [] c2); c2) = SE(F, k, c1) | SE(F,k,c2) (explore both branches) | ||
| + | |||
| + | Note: how many branches do we get? | ||
| + | |||
| + | Strongest postcondition: | ||
| + | \begin{equation*} | ||
| + | sp(P,r) = \{ s_2 \mid \exists s_1.\ s_1 \in P \land (s_1,s_2) \in r \} | ||
| + | \end{equation*} | ||
| + | Like composition of a set with a relation. It's called ''relational image'' of set $P$ under relation $r$. | ||
| + | Note: when proving our verification condition, instead of proving that semantics of relation implies error=false, it's same as proving that the formula for set sp(U,r) implies error=false, where U is the universal relation, or, in terms of formulas, computing the strongest postcondition of formula 'true'. | ||
| ==== Weakest preconditions ==== | ==== Weakest preconditions ==== | ||
| While symbolic execution computes formula by going forward along the program syntax tree, weakest precondition computes formula by going backward. | While symbolic execution computes formula by going forward along the program syntax tree, weakest precondition computes formula by going backward. | ||
| + | |||
| + | wp(Q, x=t) = | ||
| + | wp(Q, assume F) = | ||
| + | wp(Q, assert F) = | ||
| + | wp(Q, c1 [] c2) = | ||
| + | wp(Q, c1 ; c2) = | ||
| ==== Inferring Loop Invariants ==== | ==== Inferring Loop Invariants ==== | ||
| Line 127: | Line 152: | ||
| Alternative: | Alternative: | ||
| * decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week) | * decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week) | ||
| + | |||
| + | |||
| Line 132: | Line 159: | ||
| Suppose that we obtain (one or more) verification conditions of the form | Suppose that we obtain (one or more) verification conditions of the form | ||
| + | \begin{equation*} | ||
| + | F\ \rightarrow\ (\mbox{error}=\mbox{false}) | ||
| + | \end{equation*} | ||
| + | |||
| + | whose validity we need to prove. We here assume that F contains only | ||
| + | |||
| + | Note: we can check satisfiability of $F\ \land\ (\mbox{error}=\mbox{true})$. | ||
| ==== Quantifier Presburger arithmetic ==== | ==== Quantifier Presburger arithmetic ==== | ||
| Line 150: | Line 184: | ||
| Proof: small model theorem. | Proof: small model theorem. | ||
| + | |||
| + | |||
| + | |||
| + | |||
| Line 160: | Line 198: | ||
| Next: reduce to integer linear programming: | Next: reduce to integer linear programming: | ||
| \begin{equation*} | \begin{equation*} | ||
| - | Ax = b, x \geq 0 | + | A\vec x = \vec b, \qquad \vec x \geq \vec 0 |
| \end{equation*} | \end{equation*} | ||
| where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$. | where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$. | ||
| Line 171: | Line 209: | ||
| We can prove small model theorem for ILP - gives bound on search. | We can prove small model theorem for ILP - gives bound on search. | ||
| - | Short proof by {{papadimitriou81complexityintegerprogramming.pdf|Papadimitriou}}. | + | Short proof by {{papadimitriou81complexityintegerprogramming.pdf|Papadimitriou}}: |
| + | * solution of Ax=b (A regular) has as components rationals of form p/q with bounded p,q | ||
| + | * duality of linear programming | ||
| + | * obtains bound $M = n(ma)^{2m+1}$, which needs $(2m+1)(\log n + \log m + \log a)$ bits | ||
| + | * we could encode the problem into SAT: use circuits for addition, comparison etc. | ||
| + | |||
| + | Note: if small model theorem applies to conjunctions, it also applies to arbitrary QFPA formulas. | ||
| - | Note: if small model theorem applies to conjunctions, it also applies to arbitrary QFPA formulas. Moreover, one can improve these bounds. One tool based on these ideas is [[http://www.cs.cmu.edu/~uclid/|UCLID]]. | + | Moreover, one can improve these bounds. One tool based on these ideas is [[http://www.cs.cmu.edu/~uclid/|UCLID]]. |
| - | Alternative: enumerate disjuncts of DNF on demand, each disjunct is a conjunction, then use ILP techniques (often first solve the underlying linear programming problem over reals). Most SMT tools are based on this idea (along with Nelson-Oppen combination: next class). | + | Alternative: enumerate disjuncts of DNF on demand, each disjunct is a conjunction, then use ILP techniques (often first solve the underlying linear programming problem over reals). Many SMT tools are based on this idea (along with Nelson-Oppen combination: next class). |
| * [[http://www.cs.nyu.edu/acsys/cvc3/download.html|CVC3]] (successor of CVC Lite) | * [[http://www.cs.nyu.edu/acsys/cvc3/download.html|CVC3]] (successor of CVC Lite) | ||
| * [[http://combination.cs.uiowa.edu/smtlib/|SMT-LIB]] Standard for formulas, competition | * [[http://combination.cs.uiowa.edu/smtlib/|SMT-LIB]] Standard for formulas, competition | ||