Automated Formal Static Analysis and Retrieval of Source Code - JKU

2.2. FORWARD SYMBOLIC EXECUTION IN THE THEOREMA SYSTEM 15
Here f is a new (second order) symbol – a name for the function defined by the program. In
the case of recursive programs, f may occur in some p i ’s and g i ’s.
Each of the n paths of the program has associated a object–level formula p i [x] – the accumulated
If–conditions on that path, and the object–level term g i [x] – the symbolic expression of the
return value obtained by composing all the assignments (symbolic execution). Note that p i [x] and
g i [x] do not contain other free variables than x.
The computing idea for the program semantics Σ is as follows: Σ works by forward symbolic
execution on all branches of the program, using as state the current substitution for the active
variables. Σ produces a conjunction of clauses – conditional definitions for f[x]. Each clause depends
on the accumulated [negated] conditions of the If statements leading to a certain Return
statement, whose argument (symbolically evaluated) represents the corresponding value of f[x].
Definition 2.2.2.
( )
1. Σ[P ] = Σ[{¯x → ¯x0 }, P ] { ¯x0 →¯x}
∀¯x
2. Σ[σ, 〈Return[t]〉 ⌣ P ] = (f[ ¯x 0 ] = tσ)
3. Σ[σ, 〈v := t〉 ⌣ P ] = Σ[σ ◦ {v → tσ}, P ]
4. Σ[σ, 〈If[ϕ, P T , P F ]〉 ⌣ P ] = ∧ { ϕσ =⇒ Σ[σ, P T ⌣ P ]
¬ϕσ =⇒ Σ[σ, P F ⌣ P ]
When the execution of the program starts, all the input variables become active by instantiating
them with corresponding symbolic values. After the program is processed all the input variables
become universally quantified (Definition 2.2.2.1).
A Return statement (Definition 2.2.2.2) determines the computation of the output state. From
this state we are interested in the program function and its computed values (the argument t of the
Return statement).
The assignment statement (Definition 2.2.2.3) updates the current state.
For a conditional (Definition 2.2.2.4), there are two different expressions for the program
function to be computed: one when the symbolic formula ϕσ might hold and one in the opposite
case.
Remarks.
1. The way Σ handles the If statement ensures:
covered) and ∀
i≠j
p i ∧ p j = F (branches are mutually disjoint).
∨
i=1,n
p i = I f (all branches are
2. The program function Σ effectively translates an imperative program into a functional program.
From this point on, one could reason about the program using the Scott fixpoint
theory ([LSS84], pag. 86), however we prefer a purely logical approach.