CBMC
goto_symex_property_decider.cpp
Go to the documentation of this file.
1 /*******************************************************************\
2 
3 Module: Property Decider for Goto-Symex
4 
5 Author: Daniel Kroening, Peter Schrammel
6 
7 \*******************************************************************/
8 
11 
13 
14 #include <util/ui_message.h>
15 
16 #include <solvers/prop/prop.h>
17 
19  const optionst &options,
20  ui_message_handlert &ui_message_handler,
21  symex_target_equationt &equation,
22  const namespacet &ns)
23  : options(options), ui_message_handler(ui_message_handler), equation(equation)
24 {
25  solver_factoryt solvers(
26  options,
27  ns,
30  solver = solvers.get_solver();
31 }
32 
34 {
35  exprt::operandst conjuncts;
36  conjuncts.reserve(instances.size());
37  for(const auto &inst : instances)
38  conjuncts.push_back(inst->cond_handle);
39  return conjunction(conjuncts);
40 }
41 
44 {
45  goal_map.clear();
46 
47  for(symex_target_equationt::SSA_stepst::iterator it =
48  equation.SSA_steps.begin();
49  it != equation.SSA_steps.end();
50  ++it)
51  {
52  if(it->is_assert())
53  {
54  irep_idt property_id = it->get_property_id();
55  CHECK_RETURN(!property_id.empty());
56 
57  // consider goal instance if it is in the given properties
58  auto property_pair_it = properties.find(property_id);
59  if(
60  property_pair_it != properties.end() &&
61  is_property_to_check(property_pair_it->second.status))
62  {
63  // it's going to be checked, but we don't know the status yet
64  property_pair_it->second.status |= property_statust::UNKNOWN;
65  goal_map[property_id].instances.push_back(it);
66  }
67  }
68  }
69 }
70 
72 {
73  for(auto &goal_pair : goal_map)
74  {
75  // Our goal is to falsify a property, i.e., we will
76  // add the negation of the property as goal.
77  goal_pair.second.condition = solver->decision_procedure().handle(
78  not_exprt(goal_pair.second.as_expr()));
79  }
80 }
81 
83  std::function<bool(const irep_idt &)> select_property)
84 {
85  exprt::operandst disjuncts;
86 
87  for(const auto &goal_pair : goal_map)
88  {
89  if(
90  select_property(goal_pair.first) &&
91  !goal_pair.second.condition.is_false())
92  {
93  disjuncts.push_back(goal_pair.second.condition);
94  }
95  }
96 
97  // this is 'false' if there are no disjuncts
98  solver->decision_procedure().set_to_true(disjunction(disjuncts));
99 }
100 
102 {
103  return solver->decision_procedure()();
104 }
105 
108 {
109  return solver->decision_procedure();
110 }
111 
114 {
115  return solver->stack_decision_procedure();
116 }
117 
119 {
120  return equation;
121 }
122 
124  propertiest &properties,
125  std::unordered_set<irep_idt> &updated_properties,
126  decision_proceduret::resultt dec_result,
127  bool set_pass) const
128 {
129  switch(dec_result)
130  {
132  for(auto &goal_pair : goal_map)
133  {
134  auto &status = properties.at(goal_pair.first).status;
135  if(
136  solver->decision_procedure()
137  .get(goal_pair.second.condition)
138  .is_true() &&
139  status != property_statust::FAIL)
140  {
141  status |= property_statust::FAIL;
142  updated_properties.insert(goal_pair.first);
143  }
144  }
145  break;
147  if(!set_pass)
148  break;
149 
150  for(auto &property_pair : properties)
151  {
152  if(property_pair.second.status == property_statust::UNKNOWN)
153  {
154  property_pair.second.status |= property_statust::PASS;
155  updated_properties.insert(property_pair.first);
156  }
157  }
158  break;
160  for(auto &property_pair : properties)
161  {
162  if(property_pair.second.status == property_statust::UNKNOWN)
163  {
164  property_pair.second.status |= property_statust::ERROR;
165  updated_properties.insert(property_pair.first);
166  }
167  }
168  break;
169  }
170 }
dstringt
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
Definition: dstring.h:36
property_statust::FAIL
@ FAIL
The property was violated.
conjunction
exprt conjunction(const exprt::operandst &op)
1) generates a conjunction for two or more operands 2) for one operand, returns the operand 3) return...
Definition: std_expr.cpp:62
ui_message_handlert
Definition: ui_message.h:21
property_statust::ERROR
@ ERROR
An error occurred during goto checking.
ui_message_handlert::uit::XML_UI
@ XML_UI
optionst
Definition: options.h:22
CHECK_RETURN
#define CHECK_RETURN(CONDITION)
Definition: invariant.h:495
goto_symex_property_decidert::ui_message_handler
ui_message_handlert & ui_message_handler
Definition: goto_symex_property_decider.h:70
goto_symex_property_decidert::solver
std::unique_ptr< solver_factoryt::solvert > solver
Definition: goto_symex_property_decider.h:72
decision_proceduret
Definition: decision_procedure.h:20
decision_proceduret::resultt::D_UNSATISFIABLE
@ D_UNSATISFIABLE
goto_symex_property_decider.h
exprt
Base class for all expressions.
Definition: expr.h:55
propertiest
std::map< irep_idt, property_infot > propertiest
A map of property IDs to property infos.
Definition: properties.h:76
goto_symex_property_decidert::solve
decision_proceduret::resultt solve()
Calls solve() on the solver instance.
Definition: goto_symex_property_decider.cpp:101
stack_decision_proceduret
Definition: stack_decision_procedure.h:57
solver_factoryt
Definition: solver_factory.h:27
goto_symex_property_decidert::get_equation
symex_target_equationt & get_equation() const
Return the equation associated with this instance.
Definition: goto_symex_property_decider.cpp:118
ui_message_handlert::get_ui
virtual uit get_ui() const
Definition: ui_message.h:33
decision_proceduret::resultt::D_SATISFIABLE
@ D_SATISFIABLE
namespacet
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition: namespace.h:90
disjunction
exprt disjunction(const exprt::operandst &op)
1) generates a disjunction for two or more operands 2) for one operand, returns the operand 3) return...
Definition: std_expr.cpp:50
goto_symex_property_decidert::goalt::as_expr
exprt as_expr() const
Definition: goto_symex_property_decider.cpp:33
goto_symex_property_decidert::equation
symex_target_equationt & equation
Definition: goto_symex_property_decider.h:71
goto_symex_property_decidert::goto_symex_property_decidert
goto_symex_property_decidert(const optionst &options, ui_message_handlert &ui_message_handler, symex_target_equationt &equation, const namespacet &ns)
Definition: goto_symex_property_decider.cpp:18
goto_symex_property_decidert::convert_goals
void convert_goals()
Convert the instances of a property into a goal variable.
Definition: goto_symex_property_decider.cpp:71
goto_symex_property_decidert::goal_map
std::map< irep_idt, goalt > goal_map
Maintains the relation between a property ID and the corresponding goal variable that encodes the neg...
Definition: goto_symex_property_decider.h:88
prop.h
is_property_to_check
bool is_property_to_check(property_statust status)
Return true if the status is NOT_CHECKED or UNKNOWN.
Definition: properties.cpp:175
goto_symex_property_decidert::get_decision_procedure
decision_proceduret & get_decision_procedure() const
Returns the solver instance.
Definition: goto_symex_property_decider.cpp:107
goto_symex_property_decidert::get_stack_decision_procedure
stack_decision_proceduret & get_stack_decision_procedure() const
Returns the solver instance.
Definition: goto_symex_property_decider.cpp:113
decision_proceduret::resultt::D_ERROR
@ D_ERROR
exprt::operandst
std::vector< exprt > operandst
Definition: expr.h:58
dstringt::empty
bool empty() const
Definition: dstring.h:88
goto_symex_property_decidert::add_constraint_from_goals
void add_constraint_from_goals(std::function< bool(const irep_idt &property_id)> select_property)
Add disjunction of negated selected properties to the equation.
Definition: goto_symex_property_decider.cpp:82
decision_proceduret::resultt
resultt
Result of running the decision procedure.
Definition: decision_procedure.h:43
solver_factoryt::get_solver
virtual std::unique_ptr< solvert > get_solver()
Returns a solvert object.
Definition: solver_factory.cpp:134
symex_target_equationt
Inheriting the interface of symex_targett this class represents the SSA form of the input program as ...
Definition: symex_target_equation.h:33
property_statust::UNKNOWN
@ UNKNOWN
The checker was unable to determine the status of the property.
goto_symex_property_decidert::update_properties_goals_from_symex_target_equation
void update_properties_goals_from_symex_target_equation(propertiest &properties)
Get the conditions for the properties from the equation and collect all 'instances' of the properties...
Definition: goto_symex_property_decider.cpp:43
goto_symex_property_decidert::goalt::instances
std::vector< symex_target_equationt::SSA_stepst::iterator > instances
A property holds if all instances of it are true.
Definition: goto_symex_property_decider.h:77
goto_symex_property_decidert::update_properties_status_from_goals
void update_properties_status_from_goals(propertiest &properties, std::unordered_set< irep_idt > &updated_properties, decision_proceduret::resultt dec_result, bool set_pass=true) const
Update the property status from the truth value of the goal variable.
Definition: goto_symex_property_decider.cpp:123
symex_target_equationt::SSA_steps
SSA_stepst SSA_steps
Definition: symex_target_equation.h:250
property_statust::PASS
@ PASS
The property was not violated.
goto_symex_property_decidert::options
const optionst & options
Definition: goto_symex_property_decider.h:69
ui_message.h
not_exprt
Boolean negation.
Definition: std_expr.h:2277