Basics of Analyzing Programs Propositional Logic Applications of SAT Solvers SMT Solvers ...

133 Pages·2015·1.08 MB·English

Basics of Analyzing Programs
Propositional Logic
Applications of SAT Solvers
SMT Solvers Overview
SMT Bit-Vector Logic
Applying SMT Solvers to Code
X86 Assembly Language
Intermediate Representations
IR Framework Components
X86-to-IR Translation
IR Translator Synthesis
X86-Specific Considerations
Framework Applications
Basics of Analyzing Programs
EvalPrint
(cid:73) We illustrate basic concepts in the analysis of computer
programs using a toy language called EvalPrint.
(cid:73) The language supports:
(cid:73) 16- and 32-bit integer constants and variables.
(cid:73) The two binary operators + and *.
(cid:73) Two statement types:
1. Assign a value to a variable
2. Print the value of an expression
(cid:73) This program prints 3:
y.32 = 1.32; // Assign 1 to y
x.32 = 1.32 + (2.32 * y.32);
print x.32; // Print the value of x
Class Hierarchy
class Binop(Expr):
class Const(Expr):
def __init__(me,l,o,r): class Var(Expr):
def __init__(me,v,s):
me.left = l def __init__(me,v):
me.val = v
me.binop = o me.var = v
me.size = s
me.right = r
class Expr(object):
pass
class Assign(Stmt):
class Print(Stmt):
def __init__(me,v,e):
def __init__(me,e):
me.var = v
me.expr = e
me.expr = e
class Stmt(object):
pass
expr := Binop expr binop expr
| Const int size
| Var var
stmt := Assign var expr
| Print expr
(cid:73) The class hierarchy mirrors the grammar exactly.
Abstract Syntax Tree
1.32 + (y.32 * 2.32); c1pe
Binop(c1,ADD,c2ty)
Parser
c1 c2ty
c2 = Const(2,S32) Const(1,S32) Binop(vary,MUL,c2)
vary = Variable("y",S32)
c2ty = Binop(vary,MUL,c2)
c1 = Const(1,S32) vary c2
c1pe = Binop(c1,ADD,c2ty) Variable("y",S32) Const(2,S32)
(cid:73) The data structure returned by a parser is commonly called an
abstract syntax tree representation of the program.
Program Analysis in Practice
Code specific to Const
isinisstiannscet(axn,cCeon(sxt,)Var) Code specific to Var
algorithm(x) isinstance(x,Binop) Code specific to Binop
iissiinnssttanacnec(ex(,xPr,iAnsts)ign) Code specific to Assign
Code specific to Print
(cid:73) Program analysis algorithms usually have separate logic for
each grammatical element. We show several useful examples.
(cid:73) Interpreter
(cid:73) Type-checker
Basics of Analyzing Programs
Propositional Logic
Applications of SAT Solvers
SMT Solvers Overview
SMT Bit-Vector Logic
Applying SMT Solvers to Code
X86 Assembly Language
Intermediate Representations
IR Framework Components
X86-to-IR Translation
IR Translator Synthesis
X86-Specific Considerations
Framework Applications
Propositional Logic
Correspondence Between C and Propositional Logic
Most of the concepts from propositional logic have direct
analogues in common programming languages such as C.
C concept Propositional logic concept
boolean variables a,b,c,... propositional variables a,b,c,...
constants false, true truth values ⊥,(cid:62)
type, e.g. bool sort, e.g. Boolean
logical negation operator !/~ negation connective ¬
AND operator && conjunction connective ∧
OR operator || disjunction connective ∨
a ? b : true implication connective a ⇒ b
equals operator == if-and-only-if connective ⇔
ternary operator b ? c : d if-then-else operator ITE(b,c,d)
Solution Space for a Propositional Formula
a
⊥ (cid:62)
b b
⊥ (cid:62) ⊥ (cid:62)
c c c c
⊥ (cid:62) ⊥ (cid:62) ⊥ (cid:62) ⊥ (cid:62)
X (cid:88) X X (cid:88) X X X
Figure: Solutions to (a⇒b)⇔(¬b∧c)
(cid:73) The thick path corresponds to the assignment
(cid:73) [a(cid:55)→⊥,b (cid:55)→(cid:62),c (cid:55)→⊥]
Satisfiability (SAT) Solvers
(cid:73) SAT solver, (n). An algorithm that finds satisfying
assignments to propositional formulae, and reports
unsatisfiability if no such assignment is possible.
(cid:73) Also known as a decision procedure for propositional logic.
Solving SAT with Truth Tables
(cid:73) Enumerate every variable assignment and stop when one
causes the formula to evaluate to true.
(cid:73) Corresponds to traversing each path in the solution tree.
void sat(Formula *phi)
{
Assignment cur = /*all false*/;
while(!is_last_assignment(cur))
{
// You coded evaluate already
if(evaluate(phi,cur))
{
printf("Satisfiable\n");
print_assignment(cur);
return;
}
cur = next_assignment(cur);
}
printf("Unsatisfiable\n");
}