Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
sav07_lecture_3_skeleton [2007/03/21 10:39] vkuncak |
sav07_lecture_3_skeleton [2007/03/21 10:53] vkuncak |
||
---|---|---|---|
Line 102: | Line 102: | ||
This idea is important in static analysis. | This idea is important in static analysis. | ||
+ | |||
+ | |||
+ | |||
Line 107: | Line 110: | ||
==== Symbolic execution ==== | ==== Symbolic execution ==== | ||
- | Symbolic execution converts programs into formulas by going forward. It is therefore somewhat analogous to the way an [[interpreter]] for the language would work. It is based on the notion of strongest postcondition. | + | Symbolic execution converts programs into formulas by going forward. It is therefore somewhat analogous to the way an [[interpreter]] for the language would work. |
+ | Strongest postcondition: | ||
+ | \begin{equation*} | ||
+ | sp(P,r) = \{ s_2 \mid \exists s_1.\ s_1 \in P \land (s_1,s_2) \in r \} | ||
+ | \end{equation*} | ||
+ | Like composition of a set with a relation. It's called ''relational image'' of set $P$ under relation $r$. | ||
+ | |||
+ | Note: when proving our verification condition, instead of proving that semantics of relation implies error=false, it's same as proving that the formula for set sp(U,r) implies error=false, where U is the universal relation. | ||
==== Weakest preconditions ==== | ==== Weakest preconditions ==== | ||
Line 127: | Line 137: | ||
Alternative: | Alternative: | ||
* decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week) | * decide that you will only loop for formulas of restricted form, as in abstract interpretation and data flow analysis (next week) | ||
+ | |||
+ | |||
Line 132: | Line 144: | ||
Suppose that we obtain (one or more) verification conditions of the form | Suppose that we obtain (one or more) verification conditions of the form | ||
+ | \begin{equation*} | ||
+ | F\ \rightarrow\ (\mbox{error}=\mbox{false}) | ||
+ | \end{equation*} | ||
+ | |||
+ | whose validity we need to prove. We here assume that F contains only | ||
+ | |||
+ | Note: we can check satisfiability of $F\ \land\ (\mbox{error}=\mbox{true})$. | ||
==== Quantifier Presburger arithmetic ==== | ==== Quantifier Presburger arithmetic ==== | ||
Line 150: | Line 169: | ||
Proof: small model theorem. | Proof: small model theorem. | ||
+ | |||
Line 163: | Line 183: | ||
Next: reduce to integer linear programming: | Next: reduce to integer linear programming: | ||
\begin{equation*} | \begin{equation*} | ||
- | A\vec x = \vec b, \vec x \geq \vec 0 | + | A\vec x = \vec b, \qquad \vec x \geq \vec 0 |
\end{equation*} | \end{equation*} | ||
where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$. | where $A \in {\cal Z}^{m,n}$ and $x \in {\cal Z}^n$. |