motivation
play

Motivation SMT-solvers are routinely used in program analysis: - PowerPoint PPT Presentation

Extending the Theory of Arrays: st , , and Beyond Stephan Falke , Florian Merz, and Carsten Sinz INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI) 0 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of


  1. Extending the Theory of Arrays: ♠❡♠s❡t , ♠❡♠❝♣② , and Beyond Stephan Falke , Florian Merz, and Carsten Sinz INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI) 0 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI KIT – University of the State of Baden-Wuerttemberg and www.kit.edu National Research Center of the Helmholtz Association

  2. Motivation SMT-solvers are routinely used in program analysis: Deductive program verification Symbolic execution Software bounded model checking . . . 1 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  3. Motivation SMT-solvers are routinely used in program analysis: Deductive program verification Symbolic execution Software bounded model checking . . . Prominent theory: T A (theory of arrays) Model arrays/structures/objects in the program Model main memory 1 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  4. r❡❛❞ ✇r✐t❡ r❡❛❞ ✇r✐t❡ r❡❛❞ T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  5. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  6. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms a write modifies the position written to . . . p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  7. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms a write modifies the position written to . . . p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) . . . and nothing else 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  8. Motivation How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣② ? ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀ 3 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  9. Motivation How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣② ? might not be constant! ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ might not be constant! ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀ 3 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  10. Motivation ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  11. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  12. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  13. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  14. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ a ′ = ✇r✐t❡ ( a 3 , 3 , r❡❛❞ ( b , 3 )) 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  15. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ a ′ = ✇r✐t❡ ( a 3 , 3 , r❡❛❞ ( b , 3 )) Does not scale well for large constants 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  16. Motivation ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  17. Motivation ✳✳✳ ??? ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  18. Motivation ✳✳✳ a ′ = copy ( a , 0 , b , 0 , n ) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  19. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , r❡❛❞ ( b , i ) , r❡❛❞ ( a , i )) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  20. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , r❡❛❞ ( b , i ) , r❡❛❞ ( a , i )) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ = ⇒ Extend T A by λ -terms that describe arrays 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  21. Motivation ✳✳✳ ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳ 5 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  22. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , v , r❡❛❞ ( a , i )) ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳ 5 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  23. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  24. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ a ′ = λ i . ITE ( 0 ≤ i < n , i + 1 , r❡❛❞ ( a , i )) 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  25. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ a ′ = λ i . ITE ( 0 ≤ i < n , i + 1 , r❡❛❞ ( a , i )) a ′′ = λ j . ITE ( n ≤ j < 2 ∗ n , 2 ∗ j , r❡❛❞ ( a ′ , j )) 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  26. Contributions 1 T λ A : an extension of T A with λ -terms 7 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  27. Contributions 1 T λ A : an extension of T A with λ -terms 2 Satisfiability checking for T λ A 7 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  28. ✇r✐t❡ r❡❛❞ T λ A : The Theory of Arrays with λ -Terms t I :: = . . . index terms element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 8 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  29. ✇r✐t❡ r❡❛❞ T λ A : The Theory of Arrays with λ -Terms t I :: = . . . index terms element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) | λ i . t E array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 8 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend