Differences

This shows you the differences between two versions of the page.

--- sav07_lecture_3_skeleton [2007/03/21 10:15]
vkuncak
+++ sav07_lecture_3_skeleton [2007/03/21 11:01]
vkuncak
@@ Line 2: / Line 2: @@
 ===== Converting programs (with simple values) to formulas =====
@@ Line 11: / Line 12: @@
   * we can represent relations using set comprehensions; if our program c has two state components, we can represent its meaning R( c ) as $\{((x_0,y_0),(x,y)) \mid F  \}$, where F is some formula that has x,y,x_0,y_0 as free variables.
-  * this is what I mean by ''simple values'': later we will talk about modeling pointers and arrays, but we will still use this as a starting point.
+  * simple values: variables are integers.  Later we will talk about modeling pointers and arrays, but what we say now applies
 Our goal is to find rules for computing R( c ) that are
@@ Line 102: / Line 103: @@
 This idea is important in static analysis.
@@ Line 107: / Line 113: @@
 ==== Symbolic execution ====
-Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.  It is based on the notion of strongest postcondition.
+Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.
+Avoid renaming all the time.
+  SE(F,k, c1; c2) = SE(F & R(c1), k+1, c2)             (update formula)
+  SE(F,k,(c1 [] c2); c2) = SE(F, k, c1) | SE(F,k,c2)   (explore both branches)
+Note: how many branches do we get?
+Strongest postcondition:
+\begin{equation*}
+  sp(P,r) = \{ s_2 \mid \exists s_1.\ s_1 \in P \land (s_1,s_2) \in r \}
+\end{equation*}
+Like composition of a set with a relation.  It's called ''relational image'' of set $P$ under relation $r$.
+Note: when proving our verification condition, instead of proving that semantics of relation implies error=false, it's same as proving that the formula for set sp(U,r) implies error=false, where U is the universal relation, or, in terms of formulas, computing the strongest postcondition of formula 'true'.
 ==== Weakest preconditions ====
 While symbolic execution computes formula by going forward along the program syntax tree, weakest precondition computes formula by going backward.
+  wp(Q, x=t) =
+  wp(Q, assume F) =
+  wp(Q, assert F) =
+  wp(Q, c1 [] c2) =
+  wp(Q, c1 ; c2) =
 ==== Inferring Loop Invariants ====
@@ Line 127: / Line 153: @@
 Alternative:
   * decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week)
@@ Line 132: / Line 160: @@
 Suppose that we obtain (one or more) verification conditions of the form
+\begin{equation*}
+ F\ \rightarrow\ (\mbox{error}=\mbox{false})
+\end{equation*}
+whose validity we need to prove.  We here assume that F contains only
+Note: we can check satisfiability of $F\ \land\ (\mbox{error}=\mbox{true})$.
 ==== Quantifier Presburger arithmetic ====
@@ Line 150: / Line 185: @@
 Proof: small model theorem.
@@ Line 161: / Line 199: @@
 Next: reduce to integer linear programming:
 \begin{equation*}
-  Ax = b, x \geq 0
+  A\vec x = \vec b, \qquad \vec x \geq \vec 0
 \end{equation*}
 where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$.
@@ Line 175: / Line 213: @@
   * solution of Ax=b (A regular) has as components rationals of form p/q with bounded p,q
   * duality of linear programming
-  * obtains bound $M = n(ma)^{2m+1}$.
+  * obtains bound $M = n(ma)^{2m+1}$, which needs $(2m+1)(\log n + \log m + \log a)$ bits
+  * we could encode the problem into SAT: use circuits for addition, comparison etc.
+Note: if small model theorem applies to conjunctions, it also applies to arbitrary QFPA formulas.
-Note: if small model theorem applies to conjunctions, it also applies to arbitrary QFPA formulas.  Moreover, one can improve these bounds.  One tool based on these ideas is [[http://www.cs.cmu.edu/~uclid/|UCLID]].
+Moreover, one can improve these bounds.  One tool based on these ideas is [[http://www.cs.cmu.edu/~uclid/|UCLID]].
-Alternative: enumerate disjuncts of DNF on demand, each disjunct is a conjunction, then use ILP techniques (often first solve the underlying linear programming problem over reals).  Most SMT tools are based on this idea (along with Nelson-Oppen combination: next class).
+Alternative: enumerate disjuncts of DNF on demand, each disjunct is a conjunction, then use ILP techniques (often first solve the underlying linear programming problem over reals).  Many SMT tools are based on this idea (along with Nelson-Oppen combination: next class).
   * [[http://www.cs.nyu.edu/acsys/cvc3/download.html|CVC3]] (successor of CVC Lite)
   * [[http://combination.cs.uiowa.edu/smtlib/|SMT-LIB]] Standard for formulas, competition