Differences

This shows you the differences between two versions of the page.

--- sav07_lecture_3_skeleton [2007/03/21 10:42]
vkuncak
+++ sav07_lecture_3_skeleton [2007/03/21 10:58]
vkuncak
@@ Line 102: / Line 102: @@
 This idea is important in static analysis.
@@ Line 107: / Line 111: @@
 ==== Symbolic execution ====
-Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.  It is based on the notion of strongest postcondition.
+Symbolic execution converts programs into formulas by going forward.  It is therefore somewhat analogous to the way an [[interpreter]] for the language would work.
+Avoid renaming all the time.
+  SE(F,k, c1; c2) = SE(F & R(c1), k+1, c2)             (update formula)
+  SE(F,k,(c1 [] c2); c2) = SE(F, k, c1) | SE(F,k,c2)   (explore both branches)
+Note: how many branches do we get?
+Strongest postcondition:
+\begin{equation*}
+  sp(P,r) = \{ s_2 \mid \exists s_1.\ s_1 \in P \land (s_1,s_2) \in r \}
+\end{equation*}
+Like composition of a set with a relation.  It's called ''relational image'' of set $P$ under relation $r$.
+Note: when proving our verification condition, instead of proving that semantics of relation implies error=false, it's same as proving that the formula for set sp(U,r) implies error=false, where U is the universal relation.
@@ Line 114: / Line 133: @@
 While symbolic execution computes formula by going forward along the program syntax tree, weakest precondition computes formula by going backward.
+  wp(Q, x=t) =
+  wp(Q, assume F) =
+  wp(Q, assert F) =
+  wp(Q, c1 [] c2) =
+  wp(Q, c1 ; c2) =
 ==== Inferring Loop Invariants ====