List of lectures. Lecture content. Symbolic Programming. TDDA69 Data and Program Structure Symbolic and Logic Programming Cyrille Berger

Transcription

1 List of lectures TDDA69 Data and Program Structure Symbolic and Logic Programming Cyrille Berger 1Introduction and Functional Programming 2Imperative Programming and Data Structures 3Parsing 4Evaluation 5Object Oriented Programming 6Macros and decorators 7Virtual Machines and Bytecode 8Garbage Collection and Native Code 9Concurrent Computing 10Declarative Programming 11Symbolic and Logic Programming 12Summary 2 / 44 Lecture content Symbolic Programming Static Program Analysis Data-flow analysis Symbolic Execution Logic Programming Symbolic Programming 3 / 44

2 Symbolic Programming A program can manipulate its own formulas and components as if they are data From John McCarthy, Recursive Functions of Symbolic Expressions, 1958: 1People manipulate numbers You do it all the time... 2People write formulas that say how to manipulate numbers 2+3, f(x)=2*x/3 3People manipulate formulas In algebra/calculus courses: (x+2)/2 -> x/2+1, diff(x²) = 2*x 4People write formulas that say how to manipulate formulas Example of algebraic formulas (+2 3) 5 (- (- x y) (- y x) (^ (+ x y) 2) (+ (^ x 2) (* 2 x y) (^ y 2) (diff x) 1 (diff (^ x 2)) (* 2 x) Symbolic vs Imperative Programming In imperative programming, computations are evaluated in order as soon as they are expressed: import numpy as np a = np.ones(10) b = np.ones(10) * 2 c = b * a d = c + 1 In symbolic programming, expressions are not evaluated until it is necesserary: A = Variable('A') B = Variable('B') C = B * A D = C + Constant(1) compiles the function and evaluate it: f = compile(d) d = f(a=np.ones(10), B=np.ones(10)*2) Symbolic graph The following symbolic program: A = Variable('A') B = Variable('B') C = B * A D = C + Constant(1) Correspond to this symbolic graph: 7 8

3 Symbolic interpreter Compilers are symbolic interpreters Transformation rules are applied on the formula, until none apply Examples: op folding: Differentiation x = Variable('x') f = x^2 + 1 d = diff(f) r = compile(d) r == 2*x Computation v = subst(d,x=2) r= compile(v) r == 4 In some sense, source code of an imperative programming language is a symbol program Compiler optimizers are often defined as a set of transformation rules applied on the symbols of the program 9 10 Software Verification Static Program Analysis The goal of Software Verification is to verify that a program satisfies the expected requirements Dynamic program analysis and verification: testing and experimentation Static program analysis and verification: analysis, used to prove correctness 12

4 Static program analysis It is an analysis of computer software performed without executing programs The analysis is either performed on source code or on object code The analysis is performed by an automated tool Static program analysis techniques Model checking Check that the program conform to a specified model, for program that have finite states Data-flow analysis Determine which part of a program use a specific variable and possible values Abstract interpretation Model the effect of each statement on the state Hoare logic Symbolic execution Use of static analysis Optimization Debugging Validation Data-flow analysis 15

5 Data-flow analysis Data-flow analysis: Example (1/2 Determine where a variable is used and modified Compute the possible values for variables at different location Example: How many register do we need for this program? a = 0; L1: b = a + 1; c = c + b; a = b * 2 if a < 9 goto L1 return c minimum is the number of variables for(var i = 0; ; + +i) { console.log(i); if(i < 0) break; } Control flow graph Data-flow analysis: Example (2/2 Remember, deadlocks: var a = 0; var b = 2; var ma = new Mutex(); var mb = new Mutex(); thread1 = new Thread( function() { ma.lock(); mb.lock(); b = b - 1; a = a - 1; ma.unlock(); mb.unlock(); }); thread2 = new Thread( function() { mb.lock(); ma.lock(); b = b - 1; a = a + b; mb.unlock(); ma.unlock(); }); thread1.start(); thread2.start(); thread1 waits for mb, thread2 waits for ma Data-flow analysis can be used to detect the multiple locks and use Symbolic Execution 19

6 Symbolic Execution Testing works But each tests, only explore one possible execution: assert(f(3) == 5) We hope that test cases generalize... Symbolic execution generalize testing Allow unknown variable in evaluation y = Variable('y'); assert(f(y) == 2*y - 1) Symbolic Execution Example int a = α, b = β, c = γ; // symbolic int x = 0, y = 0, z = 0; if (a) { x = -2; } if (b < 5) { if (!a && c) { y = 1; } z = 2; } assert(x+y+z!=3) Insight Symbolic Execution Find Bug (1/2) Each symbolic path corresponds to many actual program runs The one that satisfies the path conditions Symbolic execution cover more of the program execution space than testing 23 24

7 Symbolic Execution Find Bug (2/2) Problems with symbolic execution Scalability: there are many program path Problem with loops and library calls Solution More powerful computers and cluster Mixing concrete and symbolic execution KLEE Internal of Symbolic Executors: KLEE KLEE is an open source symbolic executor Runs on top of LLVM Has founds lot of problems in open-source software 27 28

8 Benefits/Drawbacks of symbolic programming Benefits: Use in optimisation, static analysis... Computer Algebra Systems Drawbacks Scalability, performance... Logic Programming 29 Logic Programming Based on Formal logic: expressing facts and rules Examples: Prolog Predicate logic Predicate logic can be used to capture facts and rules: declare facts as ground clauses. E.g., Son(Gustaf, Carl), Daughter (Carl, Victoria),... rules as horn clauses: x,y, z Son(x, y) ^ Daughter (y, z) GrandFather (x, z) One can then submit queries and retrieve further facts: x GrandFather (Gustaf, x) 31 32

9 List in prolog () is the empty list (b,c) is a list of two symbols b and c If H is a symbol and T is a list then (H T) is a list with a head H and tail T (a,b,c) is the same as (a (b,c)) Example: append (1/2) A declarative description of the append relation in Prolog append is a relation from tuples (X,Y,Z) such as Z = (X Y) appending the empty list to any list y gives the same list y (fact append ()?Y?Y). for any lists H, T, Y and Z we have that the result of appending Y to (H T) is a list that start with H, followed by the result of appending Y to T: (fact (append (?H?T)?Y (?H?Z)) (append?t?y?z)) Example: append (2/2) Queries: (query (append (a b c) (1 2 3) (a b c 1 2 3))). (query (append (a b c) (1 2 3) (1 2 3 a b c))). Definitions: (query (append (a b c) (1 2 3)?L3)). (query (append (a b c)?l2 (a b c 1 2 3))). Operational and Declarative Meanings An assertion: (fact (eats?p?f) (hungry?p) (has?p?f) (likes?p?f)) means that for any replacement of?p (e.g., brian ) and?f (e.g., potstickers ) throughout the rule: Declarative Meaning If brian is hungry and has potstickers and likes potstickers, then brian will eat potstickers. Operational Meaning To show that brian will eat potstickers, show that brian is hungry, then that brian has potstickers, and then that brian likes potstickers. The declarative meaning allows us to look at our Scheme-Prolog program as a logical specification of a problem for which the system is to find a solution. The operational meaning allows us to look at our Scheme-Prolog specification as an executable program for searching for a solution. Closed Universe Assumption: We make only positive statements. The closest we come to saying that something is false is to say that we can t prove it

10 Why logic programming? A declarative style, as opposed to a procedural one: allows to easier solve problems by describing how solutions look like instead of describing how to compute them. permit to faster build prototypes and tackle complex problems makes it easier to show that a program satisfies a specification as the program is closer to the specification Queries answering systems are well suited for databases, interfaces with natural language Logic programming with constraint solving (CLP) has proven to be very powerful 37 Query answering system Knowledge is stored in a database and is represented: explicitly as facts or implicitly as rules An inference machine infers new facts from known ones Programs submit queries A query is simple or composed of simple queries and the connectives and, or, not Queries are compared against the knowledge in the database by pattern matching for the facts and by unification for the rules 38 Pattern matching and unification Pattern matching Match a query with variables to facts without variables (query (parent abraham?child)) (fact (parent abraham barack)) In Unification: Unification is a generalization of pattern matching. Unification finds bindings for variables. A variable occurring several times will be bound to the same value In unification, a variable can be bound to another expression or variable 39 Unification algorithm Unification is a generalization of pattern matching that attempts to find a mapping between two expressions that may both contain variables. Example: (?x?x) can match ((a?y c) (a b?z)) ((a b c) (a b c)) Unification identifies this solution via the following steps: To match the first element of each pattern, the variable?x is bound to the expression (a?y c). To match the second element of each pattern, first the variable?x is replaced by its value. Then, (a?y c) is matched to (a b?z) by binding?y to b and?z to c. 40

11 Unification Algorithm unify(e, f, env) 1) Both inputs e and f are replaced by their values if they are variables. 2) If e and f are equal, unification succeeds. 3) If e is a variable, unification succeeds and e is bound to f. 4) If f is a variable, unification succeeds and f is bound to e. 5) If neither is a variable, both are not lists, and they are not equal, then e and f cannot be unified, and so unification fails. 6) If none of these cases holds, then e and f are both pairs, and so unification is performed on both their first and second corresponding elements. Query interpreter The query interpreter performs a search in the space of all possible facts Unification is the primitive operation that pattern matches two expressions It is a recursive algorithm Search Algorithm The process of attempting to demonstrate an assertion (answer a query) is a systematic depth-first search of facts. def search(clauses, env): if clauses is nil: yield env for fact in facts: fact = rename_variables(fact, get_unique_id()) env_head = new environment that extends env if unify(fact.first, clauses.first, env_head): for env_rule in search(fact.second, env_head, depth+1): for result in search(clauses.second, env_rule, depth+1): yield result Summary Symbolic programming and its use for static code analysis Logic programming and how to infer new facts / 44