overapproximating program paths using fol formula€¦overapproximating program paths using fol...
TRANSCRIPT
Overapproximating Program Paths using FOL Formula
Jan Strejcek and Marek Trtık
1/10
1 Motivation
2 Our heuristic
3 Z3 performance
4 Experimental Results
2/10
Motivation
1
2
a = 0
3
i = 0
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
7
i >= n
8
a > 12
> 2232
paths
(1) Relax exact interleaving of paths through a loop.(2) Express variables as functions of path counters.
3/10
Motivation
1
2
a = 0
3
i = 0
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
7
i >= n
8
a > 12
> 2232
paths
(1) Relax exact interleaving of paths through a loop.(2) Express variables as functions of path counters.
3/10
Motivation
1
2
a = 0
3
i = 0
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
7
i >= n
8
a > 12
> 2232
paths
(1) Relax exact interleaving of paths through a loop.(2) Express variables as functions of path counters.
3/10
Motivation
1
2
a = 0
3
i = 0
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
7
i >= n
8
a > 12
> 2232
paths
(1) Relax exact interleaving of paths through a loop.
(2) Express variables as functions of path counters.
3/10
Motivation
1
2
a = 0
3
i = 0
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
7
i >= n
8
a > 12
> 2232
paths
(1) Relax exact interleaving of paths through a loop.(2) Express variables as functions of path counters.
3/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i→ i i→ i + 1a→ a a→ a + 1
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i→ i i→ i + 1a→ a a→ a + 1
i(κ1) = κ1 + i
i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i→ i i→ i + 1a→ a a→ a + 1
i(κ1) = κ1 + i
i(κ2) = κ2 + i
a(κ1) = κ1 + a
a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i→ i i→ i + 1a→ a a→ a
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
Merging counter functions.
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + i
a(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
Merging counter functions.
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
3
4
i < n
5
A[i]==1
6
A[i]!=1
++a
++i
i(κ1) = κ1 + i i(κ2) = κ2 + ia(κ1) = κ1 + a a(κ2) = a
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + a
ϕ~κ ≡ ∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧
τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) = 1)) ∧∀τ2 (0 ≤ τ2 < κ2 →
∃τ1 (0 ≤ τ1 ≤ κ1 ∧τ1 + τ2 + i < n ∧ A(τ1 + τ2 + i) 6= 1))
4/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + aϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2 + ia(κ1) = κ1 + aϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1 + aϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1 + aϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ
[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Our heuristic
1
2
a = 0
3
i = 0
7
i >= n
8
a > 12
i(κ1, κ2) = κ1 + κ2a(κ1) = κ1ϕ~κ[i/0, a/0]
ϕ ≡ ∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
ϕ~κ[i/0, a/0] ∧κ1 + κ2 ≥ n ∧κ1 > 12))
5/10
Usage of the heuristic
Symbolic execution:
PC ← true
DART:
Initialization =Next input =
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization =Next input =
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization = random
Next input =
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization = model of ϕ
Next input =
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization = model of ϕNext input = model of ϕ
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization = model of ϕNext input = model of ϕ ∧ ϕ
Tools:
Klee, Exe, Pex, Sage
6/10
Usage of the heuristic
Symbolic execution:
PC ← ϕ
DART:
Initialization = model of ϕNext input = model of ϕ ∧ ϕ
Tools:
Klee, Exe, Pex, Sage
6/10
Z3 performance
∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) = 1)) ∧
∀τ2 (0 ≤ τ2 < κ2 →∃τ1 (0 ≤ τ1 ≤ κ1 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
(1) ϕ −→ true | ϕ(∅) ∨ ϕ(2) ϕ(V ) −→ γ(V ) | ∃x (0 ≤ x ∧ ψ(V ∪ {x}) ∧ ϕ(V ∪ {x}))
(3) ψ(V ∪{y}) −→ true | ∀x (0 ≤ x < y → ρ(V ∪{x , y}))∧ψ(V ∪{y})(4) ρ(V ∪ {y}) −→ ϕ(V ∪ {y}) | ∃x (0 ≤ x ≤ y ∧ ρ(V ∪ {x , y}))
7/10
Z3 performance
∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) = 1)) ∧
∀τ2 (0 ≤ τ2 < κ2 →∃τ1 (0 ≤ τ1 ≤ κ1 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
(1) ϕ −→ true | ϕ(∅) ∨ ϕ(2) ϕ(V ) −→ γ(V ) | ∃x (0 ≤ x ∧ ψ(V ∪ {x}) ∧ ϕ(V ∪ {x}))
(3) ψ(V ∪{y}) −→ true | ∀x (0 ≤ x < y → ρ(V ∪{x , y}))∧ψ(V ∪{y})(4) ρ(V ∪ {y}) −→ ϕ(V ∪ {y}) | ∃x (0 ≤ x ≤ y ∧ ρ(V ∪ {x , y}))
7/10
Z3 performance
∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) = 1)) ∧
∀τ2 (0 ≤ τ2 < κ2 →∃τ1 (0 ≤ τ1 ≤ κ1 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
(1) ϕ −→ true | ϕ(∅) ∨ ϕ(2) ϕ(V ) −→ γ(V ) | ∃x (0 ≤ x ∧ ψ(V ∪ {x}) ∧ ϕ(V ∪ {x}))
(3) ψ(V ∪{y}) −→ true | ∀x (0 ≤ x < y → ρ(V ∪{x , y}))∧ψ(V ∪{y})(4) ρ(V ∪ {y}) −→ ϕ(V ∪ {y}) | ∃x (0 ≤ x ≤ y ∧ ρ(V ∪ {x , y}))
7/10
Z3 performance
∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) = 1)) ∧
∀τ2 (0 ≤ τ2 < κ2 →∃τ1 (0 ≤ τ1 ≤ κ1 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
(1) ϕ −→ true | ϕ(∅) ∨ ϕ(2) ϕ(V ) −→ γ(V ) | ∃x (0 ≤ x ∧ ψ(V ∪ {x}) ∧ ϕ(V ∪ {x}))
(3) ψ(V ∪{y}) −→ true | ∀x (0 ≤ x < y → ρ(V ∪{x , y}))∧ψ(V ∪{y})(4) ρ(V ∪ {y}) −→ ϕ(V ∪ {y}) | ∃x (0 ≤ x ≤ y ∧ ρ(V ∪ {x , y}))
7/10
Z3 performance
∃κ1 (κ1 ≥ 0 ∧∃κ2 (κ2 ≥ 0 ∧
∀τ1 (0 ≤ τ1 < κ1 →∃τ2 (0 ≤ τ2 ≤ κ2 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) = 1)) ∧
∀τ2 (0 ≤ τ2 < κ2 →∃τ1 (0 ≤ τ1 ≤ κ1 ∧ τ1 + τ2 < n ∧ A(τ1 + τ2) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
(1) ϕ −→ true | ϕ(∅) ∨ ϕ(2) ϕ(V ) −→ γ(V ) | ∃x (0 ≤ x ∧ ψ(V ∪ {x}) ∧ ϕ(V ∪ {x}))
(3) ψ(V ∪{y}) −→ true | ∀x (0 ≤ x < y → ρ(V ∪{x , y}))∧ψ(V ∪{y})(4) ρ(V ∪ {y}) −→ ϕ(V ∪ {y}) | ∃x (0 ≤ x ≤ y ∧ ρ(V ∪ {x , y}))
7/10
Z3 performance
(κ1 ≥ 0 ∧ κ1 ≤ 25 ∧(κ2 ≥ 0 ∧ κ2 ≤ 25 ∧
(0 ≤ 0 < κ1)→(0 ≤ τ2,0 ≤ κ2 ∧ 0 + τ2,0 < n ∧ A(0 + τ2,0) = 1)) ∧
· · ·(0 ≤ 24 < κ1)→
(0 ≤ τ2,24 ≤ κ2 ∧ 24 + τ2,24 < n ∧ A(24 + τ2,24) = 1)) ∧
(0 ≤ 0 < κ2)→(0 ≤ τ1,0 ≤ κ1 ∧ τ1,0 + 0 < n ∧ A(τ1,0 + 0) 6= 1)) ∧
· · ·(0 ≤ 24 < κ2)→
(0 ≤ τ1,24 ≤ κ1 ∧ τ1,24 + 24 < n ∧ A(τ1,24 + 24) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
8/10
Z3 performance
(κ1 ≥ 0 ∧ κ1 ≤ 25 ∧(κ2 ≥ 0 ∧ κ2 ≤ 25 ∧
(0 ≤ 0 < κ1)→(0 ≤ τ2,0 ≤ κ2 ∧ 0 + τ2,0 < n ∧ A(0 + τ2,0) = 1)) ∧
· · ·(0 ≤ 24 < κ1)→
(0 ≤ τ2,24 ≤ κ2 ∧ 24 + τ2,24 < n ∧ A(24 + τ2,24) = 1)) ∧
(0 ≤ 0 < κ2)→(0 ≤ τ1,0 ≤ κ1 ∧ τ1,0 + 0 < n ∧ A(τ1,0 + 0) 6= 1)) ∧
· · ·(0 ≤ 24 < κ2)→
(0 ≤ τ1,24 ≤ κ1 ∧ τ1,24 + 24 < n ∧ A(τ1,24 + 24) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
8/10
Z3 performance
(κ1 ≥ 0 ∧ κ1 ≤ 25 ∧(κ2 ≥ 0 ∧ κ2 ≤ 25 ∧
(0 ≤ 0 < κ1)→(0 ≤ τ2,0 ≤ κ2 ∧ 0 + τ2,0 < n ∧ A(0 + τ2,0) = 1)) ∧
· · ·(0 ≤ 24 < κ1)→
(0 ≤ τ2,24 ≤ κ2 ∧ 24 + τ2,24 < n ∧ A(24 + τ2,24) = 1)) ∧
(0 ≤ 0 < κ2)→(0 ≤ τ1,0 ≤ κ1 ∧ τ1,0 + 0 < n ∧ A(τ1,0 + 0) 6= 1)) ∧
· · ·(0 ≤ 24 < κ2)→
(0 ≤ τ1,24 ≤ κ1 ∧ τ1,24 + 24 < n ∧ A(τ1,24 + 24) 6= 1)) ∧
κ1 + κ2 ≥ n ∧ κ1 > 12))
8/10
Experimental Results
APCTest Pex Total Build Full QF
Hello 5.257 0.614 0.091 0.433 0.09HW 25.05 1.608 0.400 0.998 0.21
HWM fail 11.00 7.338 2.748 0.92MatrIR 95.00 1.435 0.105 1.330 -
WinDriver 35.53 0.382 0.089 0.143 0.150
- Intel R© CoreTM i7 CPU 920 @ 2.67GHz 2.67GHz, 6GB RAM, Windows 7 Professional 64-bit- MS Pex 0.92.50603.1, MS Moles 1.0.0.0, MS Visual Studio 2008, MS .NET Framework v3.5 SP1- MS Z3 SMT solver v3.2, and boost v1.42.0.
9/10
Conclusion
The heuristic computes a formula that is a necessary condition forreaching the target. We build the formula according to the followingtwo relaxations:
We relax an exact interleaving of paths through a loop.And we expresses variables as functions of path counters.
Computed formulae belong to a fragment of FOL expressible by asimple grammar. In this fragment each universally quantified variableis bound to an interval with a path counter as the upper bound.
Z3 often performs purely on computed formulae, because ofquantifiers. But structure of formulae allows to generate boundedquantifier free formulae, where Z3 performs very well.
We showed that results of the heuristic can be easily and directly usedin tools based on either original symbolic execution or DARTalgorithm. And experimental results show a potential to improveperformance of such tools.
10/10
Conclusion
The heuristic computes a formula that is a necessary condition forreaching the target. We build the formula according to the followingtwo relaxations:
We relax an exact interleaving of paths through a loop.And we expresses variables as functions of path counters.
Computed formulae belong to a fragment of FOL expressible by asimple grammar. In this fragment each universally quantified variableis bound to an interval with a path counter as the upper bound.
Z3 often performs purely on computed formulae, because ofquantifiers. But structure of formulae allows to generate boundedquantifier free formulae, where Z3 performs very well.
We showed that results of the heuristic can be easily and directly usedin tools based on either original symbolic execution or DARTalgorithm. And experimental results show a potential to improveperformance of such tools.
10/10
Conclusion
The heuristic computes a formula that is a necessary condition forreaching the target. We build the formula according to the followingtwo relaxations:
We relax an exact interleaving of paths through a loop.And we expresses variables as functions of path counters.
Computed formulae belong to a fragment of FOL expressible by asimple grammar. In this fragment each universally quantified variableis bound to an interval with a path counter as the upper bound.
Z3 often performs purely on computed formulae, because ofquantifiers. But structure of formulae allows to generate boundedquantifier free formulae, where Z3 performs very well.
We showed that results of the heuristic can be easily and directly usedin tools based on either original symbolic execution or DARTalgorithm. And experimental results show a potential to improveperformance of such tools.
10/10
Conclusion
The heuristic computes a formula that is a necessary condition forreaching the target. We build the formula according to the followingtwo relaxations:
We relax an exact interleaving of paths through a loop.And we expresses variables as functions of path counters.
Computed formulae belong to a fragment of FOL expressible by asimple grammar. In this fragment each universally quantified variableis bound to an interval with a path counter as the upper bound.
Z3 often performs purely on computed formulae, because ofquantifiers. But structure of formulae allows to generate boundedquantifier free formulae, where Z3 performs very well.
We showed that results of the heuristic can be easily and directly usedin tools based on either original symbolic execution or DARTalgorithm. And experimental results show a potential to improveperformance of such tools.
10/10