motivation
play

Motivation SMT-solvers are routinely used in program analysis: - PowerPoint PPT Presentation

Extending the Theory of Arrays: st , , and Beyond Stephan Falke , Florian Merz, and Carsten Sinz INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI) 0 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of


  1. Extending the Theory of Arrays: ♠❡♠s❡t , ♠❡♠❝♣② , and Beyond Stephan Falke , Florian Merz, and Carsten Sinz INSTITUTE FOR THEORETICAL COMPUTER SCIENCE (ITI) 0 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI KIT – University of the State of Baden-Wuerttemberg and www.kit.edu National Research Center of the Helmholtz Association

  2. Motivation SMT-solvers are routinely used in program analysis: Deductive program verification Symbolic execution Software bounded model checking . . . 1 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  3. Motivation SMT-solvers are routinely used in program analysis: Deductive program verification Symbolic execution Software bounded model checking . . . Prominent theory: T A (theory of arrays) Model arrays/structures/objects in the program Model main memory 1 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  4. r❡❛❞ ✇r✐t❡ r❡❛❞ ✇r✐t❡ r❡❛❞ T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  5. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  6. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms a write modifies the position written to . . . p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  7. T A : The Theory of Arrays index terms t I :: = . . . element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms a write modifies the position written to . . . p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) . . . and nothing else 2 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  8. Motivation How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣② ? ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀ 3 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  9. Motivation How to model standard library functions such as ♠❡♠s❡t and ♠❡♠❝♣② ? might not be constant! ✈♦✐❞ ✯♠❡♠s❡t✭✈♦✐❞ ✯❞st✱ ✐♥t ❝✱ s✐③❡❴t ♥✮❀ might not be constant! ✈♦✐❞ ✯♠❡♠❝♣②✭✈♦✐❞ ✯❞st✱ ❝♦♥st ✈♦✐❞ ✯sr❝✱ s✐③❡❴t ♥✮❀ 3 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  10. Motivation ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  11. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  12. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  13. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  14. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ a ′ = ✇r✐t❡ ( a 3 , 3 , r❡❛❞ ( b , 3 )) 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  15. Motivation a 1 = ✇r✐t❡ ( a , 0 , r❡❛❞ ( b , 0 )) a 2 = ✇r✐t❡ ( a 1 , 1 , r❡❛❞ ( b , 1 )) ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ✹✮❀ a 3 = ✇r✐t❡ ( a 2 , 2 , r❡❛❞ ( b , 2 )) ✳✳✳ a ′ = ✇r✐t❡ ( a 3 , 3 , r❡❛❞ ( b , 3 )) Does not scale well for large constants 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  16. Motivation ✳✳✳ ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  17. Motivation ✳✳✳ ??? ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  18. Motivation ✳✳✳ a ′ = copy ( a , 0 , b , 0 , n ) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  19. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , r❡❛❞ ( b , i ) , r❡❛❞ ( a , i )) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  20. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , r❡❛❞ ( b , i ) , r❡❛❞ ( a , i )) ♠❡♠❝♣②✭❛✱ ❜✱ ♥✮❀ ✳✳✳ = ⇒ Extend T A by λ -terms that describe arrays 4 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  21. Motivation ✳✳✳ ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳ 5 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  22. Motivation ✳✳✳ a ′ = λ i . ITE ( 0 ≤ i < n , v , r❡❛❞ ( a , i )) ♠❡♠s❡t✭❛✱ ✈✱ ♥✮❀ ✳✳✳ 5 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  23. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  24. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ a ′ = λ i . ITE ( 0 ≤ i < n , i + 1 , r❡❛❞ ( a , i )) 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  25. Motivation ✐♥t ✐✱ ❥✱ ♥ ❂ ✳✳✳❀ ✐♥t ✯❛ ❂ ♠❛❧❧♦❝✭✷ ✯ ♥ ✯ s✐③❡♦❢✭✐♥t✮✮❀ ❢♦r ✭✐ ❂ ✵❀ ✐ ❁ ♥❀ ✰✰✐✮ ④ ❛❬✐❪ ❂ ✐ ✰ ✶❀ ⑥ ❢♦r ✭❥ ❂ ♥❀ ❥ ❁ ✷ ✯ ♥❀ ✰✰❥✮ ④ ❛❬❥❪ ❂ ✷ ✯ ❥❀ ⑥ a ′ = λ i . ITE ( 0 ≤ i < n , i + 1 , r❡❛❞ ( a , i )) a ′′ = λ j . ITE ( n ≤ j < 2 ∗ n , 2 ∗ j , r❡❛❞ ( a ′ , j )) 6 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  26. Contributions 1 T λ A : an extension of T A with λ -terms 7 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  27. Contributions 1 T λ A : an extension of T A with λ -terms 2 Satisfiability checking for T λ A 7 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  28. ✇r✐t❡ r❡❛❞ T λ A : The Theory of Arrays with λ -Terms t I :: = . . . index terms element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 8 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

  29. ✇r✐t❡ r❡❛❞ T λ A : The Theory of Arrays with λ -Terms t I :: = . . . index terms element terms t E :: = . . . | r❡❛❞ ( t A , t I ) t A :: = a | ✇r✐t❡ ( t A , t I , t E ) | λ i . t E array terms p = r = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = v ¬ ( p = r ) = ⇒ r❡❛❞ ( ✇r✐t❡ ( a , p , v ) , r ) = r❡❛❞ ( a , r ) 8 08.07.2013 S. Falke , F. Merz, C. Sinz - Extending the Theory of Arrays ITI

Recommend


More recommend