Motivation SMT-solvers are routinely used in program analysis: - - PowerPoint PPT Presentation

motivation
SMART_READER_LITE
LIVE PREVIEW

Motivation SMT-solvers are routinely used in program analysis: - - PowerPoint PPT Presentation

Extending the Theory of Arrays: st , , and Beyond Stephan Falke , Florian Merz, and Carsten Sinz INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI) 0 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of


slide-1
SLIDE 1

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI)

Extending the Theory of Arrays:

♠❡♠s❡t, ♠❡♠❝♣②, and Beyond

Stephan Falke, Florian Merz, and Carsten Sinz

KIT – University of the State of Baden-Wuerttemberg and National Research Center of the Helmholtz Association

www.kit.edu

slide-2
SLIDE 2

Motivation

1

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

SMT-solvers are routinely used in program analysis:

Deductive program verification Symbolic execution Software bounded model checking . . .

slide-3
SLIDE 3

Motivation

1

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

SMT-solvers are routinely used in program analysis:

Deductive program verification Symbolic execution Software bounded model checking . . .

Prominent theory: TA (theory of arrays)

Model arrays/structures/objects in the program Model main memory

slide-4
SLIDE 4

TA: The Theory of Arrays

2

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE)

r❡❛❞ ✇r✐t❡ r❡❛❞ ✇r✐t❡ r❡❛❞

slide-5
SLIDE 5

TA: The Theory of Arrays

2

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) p = r = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = v

¬(p = r) = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

slide-6
SLIDE 6

TA: The Theory of Arrays

2

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) p = r = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = v

¬(p = r) = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

a write modifies the position written to . . .

slide-7
SLIDE 7

TA: The Theory of Arrays

2

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) p = r = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = v

¬(p = r) = ⇒

r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

a write modifies the position written to . . . . . . and nothing else

slide-8
SLIDE 8

Motivation

3

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣②? ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀

slide-9
SLIDE 9

Motivation

3

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣②? ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀

might not be constant! might not be constant!

slide-10
SLIDE 10

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

slide-11
SLIDE 11

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

a1 = ✇r✐t❡(a, 0,r❡❛❞(b, 0))

slide-12
SLIDE 12

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

a1 = ✇r✐t❡(a, 0,r❡❛❞(b, 0)) a2 = ✇r✐t❡(a1, 1,r❡❛❞(b, 1))

slide-13
SLIDE 13

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

a1 = ✇r✐t❡(a, 0,r❡❛❞(b, 0)) a2 = ✇r✐t❡(a1, 1,r❡❛❞(b, 1)) a3 = ✇r✐t❡(a2, 2,r❡❛❞(b, 2))

slide-14
SLIDE 14

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

a1 = ✇r✐t❡(a, 0,r❡❛❞(b, 0)) a2 = ✇r✐t❡(a1, 1,r❡❛❞(b, 1)) a3 = ✇r✐t❡(a2, 2,r❡❛❞(b, 2)) a′ = ✇r✐t❡(a3, 3,r❡❛❞(b, 3))

slide-15
SLIDE 15

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳

a1 = ✇r✐t❡(a, 0,r❡❛❞(b, 0)) a2 = ✇r✐t❡(a1, 1,r❡❛❞(b, 1)) a3 = ✇r✐t❡(a2, 2,r❡❛❞(b, 2)) a′ = ✇r✐t❡(a3, 3,r❡❛❞(b, 3)) Does not scale well for large constants

slide-16
SLIDE 16

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳

slide-17
SLIDE 17

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳

???

slide-18
SLIDE 18

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳

a′ = copy(a, 0, b, 0, n)

slide-19
SLIDE 19

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳

a′ = λi. ITE(0 ≤ i < n, r❡❛❞(b, i), r❡❛❞(a, i))

slide-20
SLIDE 20

Motivation

4

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳

a′ = λi. ITE(0 ≤ i < n, r❡❛❞(b, i), r❡❛❞(a, i)) = ⇒ Extend TA by λ-terms that describe arrays

slide-21
SLIDE 21

Motivation

5

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳

slide-22
SLIDE 22

Motivation

5

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✳✳✳ ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳

a′ = λi. ITE(0 ≤ i < n, v, r❡❛❞(a, i))

slide-23
SLIDE 23

Motivation

6

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥

slide-24
SLIDE 24

Motivation

6

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥

a′ = λi. ITE(0 ≤ i < n, i + 1, r❡❛❞(a, i))

slide-25
SLIDE 25

Motivation

6

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥

a′ = λi. ITE(0 ≤ i < n, i + 1, r❡❛❞(a, i)) a′′ = λj. ITE(n ≤ j < 2 ∗ n, 2 ∗ j, r❡❛❞(a′, j))

slide-26
SLIDE 26

Contributions

7

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

1 TλA: an extension of TA with λ-terms

slide-27
SLIDE 27

Contributions

7

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

1 TλA: an extension of TA with λ-terms 2 Satisfiability checking for TλA

slide-28
SLIDE 28

TλA: The Theory of Arrays with λ-Terms

8

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) p = r = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = v ¬(p = r) = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

✇r✐t❡ r❡❛❞

slide-29
SLIDE 29

TλA: The Theory of Arrays with λ-Terms

8

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) | λi. tE p = r = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = v ¬(p = r) = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

✇r✐t❡ r❡❛❞

slide-30
SLIDE 30

TλA: The Theory of Arrays with λ-Terms

8

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) | λi. tE p = r = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = v ¬(p = r) = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

r❡❛❞(λi. s, r) = s[i/r] ✇r✐t❡ r❡❛❞

slide-31
SLIDE 31

TλA: The Theory of Arrays with λ-Terms

8

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) | λi. tE p = r = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = v ¬(p = r) = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

r❡❛❞(λi. s, r) = s[i/r]

β-reduction

✇r✐t❡ r❡❛❞

slide-32
SLIDE 32

TλA: The Theory of Arrays with λ-Terms

8

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

index terms tI ::= . . . element terms tE ::= . . . | r❡❛❞(tA, tI) array terms tA ::= a | ✇r✐t❡(tA, tI, tE) | λi. tE p = r = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = v ¬(p = r) = ⇒ r❡❛❞(✇r✐t❡(a, p, v), r) = r❡❛❞(a, r)

r❡❛❞(λi. s, r) = s[i/r]

β-reduction

✇r✐t❡(a, p, v) could be simulated using λi. ITE(p = i, v, r❡❛❞(a, i))

slide-33
SLIDE 33

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣②

slide-34
SLIDE 34

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops

slide-35
SLIDE 35

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops Zero initialization of global variables

slide-36
SLIDE 36

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops Zero initialization of global variables Zero initialization of fresh memory pages

slide-37
SLIDE 37

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops Zero initialization of global variables Zero initialization of fresh memory pages “Havoc” memory regions (volatile variables)

slide-38
SLIDE 38

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops Zero initialization of global variables Zero initialization of fresh memory pages “Havoc” memory regions (volatile variables) Model memory mapped I/O

slide-39
SLIDE 39

Uses of TλA

9

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Precisely model ♠❡♠s❡t and ♠❡♠❝♣② Summarize loops Zero initialization of global variables Zero initialization of fresh memory pages “Havoc” memory regions (volatile variables) Model memory mapped I/O Attaching metadata to memory regions (allocated, de-allocated, . . . )

slide-40
SLIDE 40

Loop Summarization Using TλA

10

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Broadly speaking:

loop iterations do not depend on earlier iterations consecutive iterations update consecutive array locations

slide-41
SLIDE 41

Loop Summarization Using TλA

10

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Broadly speaking:

loop iterations do not depend on earlier iterations consecutive iterations update consecutive array locations

More precisely:

Induction variable i is incremented by one in each iteration ith iteration unconditionally updates only a[i] No other variable declared outside the loop is modified ith iteration of the loop may not use elements of a that have been modified in earlier iterations

slide-42
SLIDE 42

Loop Summarization Using TλA

10

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Broadly speaking:

loop iterations do not depend on earlier iterations consecutive iterations update consecutive array locations

More precisely:

Induction variable i is incremented by one in each iteration ith iteration unconditionally updates only a[i] No other variable declared outside the loop is modified ith iteration of the loop may not use elements of a that have been modified in earlier iterations

Loops can often be automatically transformed into loops that satisfy these requirements

slide-43
SLIDE 43

Satisfiability Checking

11

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Based on reductions to theories supported by SMT-solvers

slide-44
SLIDE 44

Satisfiability Checking

11

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Based on reductions to theories supported by SMT-solvers One quantifier-based approach

slide-45
SLIDE 45

Satisfiability Checking

11

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Based on reductions to theories supported by SMT-solvers One quantifier-based approach Two quantifier-free approaches

Eager reduction Instantiation-based approach

slide-46
SLIDE 46

Quantifier-Based Approach

12

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as

r❡❛❞

slide-47
SLIDE 47

Quantifier-Based Approach

12

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add the constraint ∀r. r❡❛❞(as, r) = s[i/r] to the formula

slide-48
SLIDE 48

Quantifier-Based Approach

12

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add the constraint ∀r. r❡❛❞(as, r) = s[i/r] to the formula Requires an SMT-solver that supports quantifiers

slide-49
SLIDE 49

Quantifier-Based Approach

12

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add the constraint ∀r. r❡❛❞(as, r) = s[i/r] to the formula Requires an SMT-solver that supports quantifiers Does not provide a decision procedure in general

slide-50
SLIDE 50

Eager Reduction

13

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace

r❡❛❞(✇r✐t❡(a, p, v), r)

by ITE(p = r, v, r❡❛❞(a, r))

r❡❛❞

slide-51
SLIDE 51

Eager Reduction

13

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace

r❡❛❞(✇r✐t❡(a, p, v), r)

by ITE(p = r, v, r❡❛❞(a, r)) Replace

r❡❛❞(λi. s, r)

by s[i/r]

slide-52
SLIDE 52

Eager Reduction

13

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace

r❡❛❞(✇r✐t❡(a, p, v), r)

by ITE(p = r, v, r❡❛❞(a, r)) Replace

r❡❛❞(λi. s, r)

by s[i/r] TλA axioms are applied eagerly

slide-53
SLIDE 53

Eager Reduction

13

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace

r❡❛❞(✇r✐t❡(a, p, v), r)

by ITE(p = r, v, r❡❛❞(a, r)) Replace

r❡❛❞(λi. s, r)

by s[i/r] TλA axioms are applied eagerly Can be used in combination with any solver that supports TA and the index and element theories

slide-54
SLIDE 54

Instantiation-Based Approach

14

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as

r❡❛❞ r❡❛❞

slide-55
SLIDE 55

Instantiation-Based Approach

14

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add needed instantiations of ∀r. r❡❛❞(as, r) = s[i/r] to the formula

r❡❛❞

slide-56
SLIDE 56

Instantiation-Based Approach

14

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add needed instantiations of ∀r. r❡❛❞(as, r) = s[i/r] to the formula Needed instantiations are determined by r❡❛❞s that “depend” on as

slide-57
SLIDE 57

Instantiation-Based Approach

14

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Replace λi. s by a fresh constant as Add needed instantiations of ∀r. r❡❛❞(as, r) = s[i/r] to the formula Needed instantiations are determined by r❡❛❞s that “depend” on as Can be used in combination with any solver that supports TA and the index and element theories

slide-58
SLIDE 58

Evaluation

15

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Done in the software bounded model checker ▲▲❇▼❈

♠❡♠s❡t ♠❡♠❝♣② ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹

slide-59
SLIDE 59

Evaluation

15

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Done in the software bounded model checker ▲▲❇▼❈ Uses bitvectors as index and element theories

♠❡♠s❡t ♠❡♠❝♣② ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹

slide-60
SLIDE 60

Evaluation

15

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Done in the software bounded model checker ▲▲❇▼❈ Uses bitvectors as index and element theories Applied on 81 benchmark programs

67 programs produce λ-terms obtained from ♠❡♠s❡t or ♠❡♠❝♣② 14 program contain loops that can be summarized using λ-terms

❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹

slide-61
SLIDE 61

Evaluation

15

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Done in the software bounded model checker ▲▲❇▼❈ Uses bitvectors as index and element theories Applied on 81 benchmark programs

67 programs produce λ-terms obtained from ♠❡♠s❡t or ♠❡♠❝♣② 14 program contain loops that can be summarized using λ-terms

Of the resulting formulas, 20 are satisfiable and 61 are unsatisfiable

❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹ ❙❚P ❇♦♦❧❡❝t♦r ❩✸ ❈❱❈✹

slide-62
SLIDE 62

Evaluation

15

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

Done in the software bounded model checker ▲▲❇▼❈ Uses bitvectors as index and element theories Applied on 81 benchmark programs

67 programs produce λ-terms obtained from ♠❡♠s❡t or ♠❡♠❝♣② 14 program contain loops that can be summarized using λ-terms

Of the resulting formulas, 20 are satisfiable and 61 are unsatisfiable Evaluated three reductions and loop unrolling

Quantifier-based approach using ❩✸ and ❈❱❈✹ Eager reduction and instantiation-based approach using ❙❚P,

❇♦♦❧❡❝t♦r, ❩✸, and ❈❱❈✹

Loop unrolling approach using ❙❚P, ❇♦♦❧❡❝t♦r, ❩✸, and ❈❱❈✹

slide-63
SLIDE 63

Results

16

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

SMT solver Approach Total Time # Solved Formulas # Timeouts # Aborts

❙❚P

Instantiation 206.034 80 1 –

❙❚P

Eager 779.544 70 11 –

❙❚P

Loops 670.526 70 6 5

❇♦♦❧❡❝t♦r

Instantiation 818.782 71 10 –

❇♦♦❧❡❝t♦r

Eager 986.751 70 11 –

❇♦♦❧❡❝t♦r

Loops 1139.483 61 15 5

❩✸

Instantiation 948.365 67 13 1

❩✸

Eager 1043.632 66 15 –

❩✸

Quantifiers 1122.489 65 16 –

❩✸

Loops 1619.583 53 23 5

❈❱❈✹

Instantiation 928.079 67 14 –

❈❱❈✹

Eager 1119.748 65 16 –

❈❱❈✹

Quantifiers 1407.118 54 21 6

❈❱❈✹

Loops 1552.698 56 19 6

slide-64
SLIDE 64

Results

17

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

10 20 30 40 50 60 10 20 30 40 50 60 70 80 Instantiation (STP) Eager (STP) Loops (STP) Quantifiers (Z3)

slide-65
SLIDE 65

Conclusion and Future Work

18

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

TλA is a useful, decidable extension of TA ♠❡♠s❡t ♠❡♠❝♣②

❩✸ ❈❱❈✹

slide-66
SLIDE 66

Conclusion and Future Work

18

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

TλA is a useful, decidable extension of TA Performs better than unrolling for ♠❡♠s❡t and ♠❡♠❝♣②

summarizable loops

❩✸ ❈❱❈✹

slide-67
SLIDE 67

Conclusion and Future Work

18

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

TλA is a useful, decidable extension of TA Performs better than unrolling for ♠❡♠s❡t and ♠❡♠❝♣②

summarizable loops

Quantifier-free reductions perform better than ❩✸’s and ❈❱❈✹’s reasoning involving quantifiers

slide-68
SLIDE 68

Conclusion and Future Work

18

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

TλA is a useful, decidable extension of TA Performs better than unrolling for ♠❡♠s❡t and ♠❡♠❝♣②

summarizable loops

Quantifier-free reductions perform better than ❩✸’s and ❈❱❈✹’s reasoning involving quantifiers Integration into an SMT-solver using “Lemmas-on-demand”/“lazy instantiation” is the next step

slide-69
SLIDE 69

19

08.07.2013

  • S. Falke, F. Merz, C. Sinz - Extending the Theory of Arrays

ITI

❤tt♣✿✴✴❧❧❜♠❝✳♦r❣