04
4 Applications Strongest post-condition
Useful for abstract interpretation on logical formulas
Existential quantification of dead variables
SP(, x := e) = 9 x’ ([x’/x] Æ x = e[x’/x])
Image computation
Useful for reachability analysis in symbolic model checking
Existential quantification of old state variables
Ri+1(S) = 9S’(Ri[S’/S] Æ T(S’,S)) Ç Ri(S)<br>
05
5 Applications Procedure summaries
Existential quantification of local variables
Useful for interprocedural analysis
Interpolants
Suppose A ) B. Then I is the Interpolant(A,B) if
A ) I ) B
I only contains variables common to A and B
Cover(A, VA) is most precise Interpolant(A,B)
:Cover(:B, VB) is least precise Interpolant(A,B)<br>
06
6 Outline Symbolic model checking using Cover
Cover algorithm for uninterpreted functions
Cover algorithm for the combination of uninterpreted functions and linear arithmetic<br>
07
Symbolic Model Checking Algorithm I(S) : initial states, E(S) : error states
T(S’,S) : transition from old state S’ to new state S
R(S): reachable states
R0(S) = I(S)
Ri+1(S) = 9S’(Ri[S’/S] Æ T(S’,S)) Ç Ri(S)
Error found if Rn+1(S) Æ E(S) is satisfiable 7<br>
08
Symbolic Model Checking Using Cover I(S) : initial states, E(S) : error states
T(S’,S) : transition from old state S’ to new state S
R(S): reachable states
R0(S) = I(S)
Ri+1(S) = Cover(Ri[S’/S] Æ T(S’,S), S’) Ç Ri(S) 8<br>
09
Symbolic Model Checking Using Cover I(S) : initial states, E(S) : error states
T(S’,S) : transition from old state S’ to new state S
R(S): reachable states
R0(S) = I(S)
Ri+1(S) = Cover(Ri[S’/S] Æ T(S’,S), S’) Ç Ri(S)
This algorithm can find false errors
As Cover over-approximates the set of reachable states 9<br>
10
Symbolic Model Checking Using Cover I(S) : initial states, E(S) : error states
T(S’,S) : transition from old state S’ to new state S
R(S): reachable states
R0(S) = I(S)
Ri+1(S) = Cover(Ri[S’/S] Æ T(S’,S), S’) Ç Ri(S)
Theorem: If the transition system is described using quantifier-free formulas, symbolic model checking using cover is sound and precise 10<br>
11
11 Outline Symbolic model checking using Cover
Cover algorithm for uninterpreted functions
Cover algorithm for the combination of uninterpreted functions and linear arithmetic<br>
12
12 Cover Algorithm for Unary Uninterpreted Functions Cover(, V) = Erase V from congruence closure of
Example: Let be x=f(v1) Æ y=f(v2) Æ v1 = v2
Cover(, {v1,v2}) is x=y v1 f v2 f y x<br>
13
13 Cover Algorithm for Binary Uninterpreted Functions The erasure technique does not work
Let be x=f(a,v) Æ y=f(b,v)
Erasure(, {v}) is true
Cover(, {v}) is a=b ) x=y
Cover(, V) is:
For all partitions E of congruence classes in
E ) Erasure( Æ E, V)<br>
14
14 Example Cover(,{v}) Cover(, {v}) can be exponential in <br>
15
15 Outline Cover algorithm for linear arithmetic
Cover algorithm for uninterpreted functions
Cover algorithm for combination of theories<br>
16
16 Combining Cover Algorithms: Idea 1 CoverT1 [ T2(1Æ2, V):
Return CoverT1(1,V) Æ CoverT2(2,V)
Fails on x=v1+1 Æ y=v2+1 Æ v1=f(z) Æ v2=f(z)
Algorithm returns true
Cover is x=y
Solution: Share variable equalities<br>
17
17 Combining Cover Algorithms: Idea 2 CoverT1 [ T2(1Æ2, V):
E Ã Saturate(1,2)
Return CoverT1(1ÆE,V) Æ CoverT2(2ÆE,V)
Fails on v=x+1 Æ y=f(v)
Algorithm returns true
Cover is y=f(x+1)
Solution: Share equalities between variables and “simple” terms<br>
18
18 Combining Cover Algorithms: Idea 3 CoverT1 [ T2(1Æ2, V):
E Ã Saturate(1,2)
Return CoverT1(1ÆE,V) Æ CoverT2(2ÆE,V)
Fails on x·v Æ v·y Æ v=f(z,v)
Algorithm returns x·y
Cover is x·y Æ (x=y ) x=f(z,x))
Solution: Share conditional equalities<br>
19
19 Example Cover(y=f(a+v)–f(b+v), {v}) v1 = a+v
v2 = b+v
y = v3-v4 v3 = f(v1)
v4 = f(v2) a=b ) v1=v2 a=b ) v3=v4 a=b ) y=0 true<br>
20
20 Conclusion Cover is the most-precise quantifier-free approximation to quantifier elimination
Cover algorithm for uninterpreted functions
Cover algorithm for combination of theories
Exchange equalities between variables and good terms
Exchange conditional equalities<br>
