1. Global Value Numbering Using Random Interpretation OSQ Retreat, May 2003 Sumit Gulwani George Necula EECS Department University of California, Berkeley

2. May 15, 2003OSQ Retreat 2003 Outline Value numbering on linear arithmetic (POPL ’03) How can we handle other operators ? –Program Analysis How can we handle multiple occurrences of a conditional ? –Model Checking How can we interpret conditionals ? (CADE ’03) –Theorem Proving

3. a := 0; b := 1;a := 1; b := 0; c := b – a; d := 1 – 2b; assert (c + d = 0); assert (c = a + 1) c := 2a + b; d := b – 2; T T F F Example 1 Random testing: test the program for random inputs ¾ probability of unsoundness here 1 – (½) n in worst case Want the same simplicity, with better odds We will execute the program once, in a way that it captures the “effect” of all the paths

4. May 15, 2003OSQ Retreat 2003 The Affine Join Operation Execute both the branches Combine the values of the variables at joins using the affine join operation © w for some randomly chosen w v 1 © w v 2 ´ w £ v 1 + (1-w) £ v 2 a := 2; b := 3; a := 4; b := 6; a = 2 © 7 4 b = 3 © 7 6 (w = 7)

5. a := 0; b := 1;a := 1; b := 0; c := b – a; d := 1 – 2b; assert (c + d = 0); assert (c = a + 1) a = -4, b = 5 c = -39, d = 39 c := 2a + b; d := b – 2; a = 1, b = 0a = 0, b = 1 a = -4, b = 5 c = -3, d = 3 a = -4, b = 5 c = 9, d = -9 T T F F w 1 = 5 w 2 = -3 Example 1 Choose a random weight for each join independently. All choices of random weights verify the first assertion Almost all choices contradict the second assertion.

6. May 15, 2003OSQ Retreat 2003 Outline Value numbering on linear arithmetic (POPL ’03) How can we handle other operators ? –Program Analysis How can we handle multiple occurrences of a conditional ? –Model Checking How can we interpret conditionals ? (CADE ’03) –Theorem Proving

7. May 15, 2003OSQ Retreat 2003 Uninterpreted Functions Choose random interpretations Non-linear interpretation –Works for basic blocks –Loss of completeness at join points Naïve linear interpretation –Works for join points –Loss of soundness in basic blocks k linear interpretations –Fixes the above problems

8. May 15, 2003OSQ Retreat 2003 Non-linear interpretation Model F(e) as e 2 Works for basic blocks But, incomplete for joins a := y; b := F(y); c := F(a); assert (b = c) a := z; b := F(z); a = w(y) + (1-w)(z) b = w(y 2 ) + (1-w)(z 2 ) c = [w(y)+(1-w)(z)] 2 = w 2 (y 2 ) + (1-w) 2 (z 2 ) + w(1-w)(2yz) = b [only if w=w 2 and (1-w)=(1-w) 2 and w(1-w)=0]

9. May 15, 2003OSQ Retreat 2003 Naïve linear interpretation Encode F(e 1,e 2 ) = r 1 e 1 + r 2 e 2 Complete for affine joins But, unsound for basic blocks F FF abcd e =e = F FF acbd e’ = V(e) = V(e’) even though e  e’ too few random coefficients! V(e) = r 1 (r 1 a+r 2 b)+r 2 (r 1 c+r 2 d) = r 1 2 (a) + r 1 r 2 (b+c) + r 2 2 (d) V(e’) = r 1 (r 1 a+r 2 c)+r 2 (r 1 b+r 2 d) = r 1 2 (a) + r 1 r 2 (b+c) + r 2 2 (d)

10. May 15, 2003OSQ Retreat 2003 k linear interpretations Perform k runs in parallel Encode F i (e 1,e 2 ) =  r i,j e 1 j +  r’ i,j e 2 j Each linear interpretation is linear in 2k terms Choose k linear random interpretations ) 2k 2 random variables We believe that k = n 0.5 ; perhaps log(n) 0.5 F1F1 FkFk e11e11 e12e12 …e1ke1k e21e21 …e2ke2k … j=1 kk

11. May 15, 2003OSQ Retreat 2003 k linear interpretations: Example (with k=2) V(e 1 1 ) = r 1 (a) + r 2 (a) + r 3 (b)+ r 4 (b) V(e 1 2 ) = r 5 (a) + r 6 (a) + r 7 (b)+ r 8 (b) V(e 2 1 ) = r 1 (c) + r 2 (c) + r 3 (d)+ r 4 (d) V(e 2 2 ) = r 5 (c) + r 6 (c) + r 7 (d)+ r 8 (d) V(e 1 ) = r 1 [r 1 (a) + r 2 (a) + r 3 (b)+ r 4 (b)] + r 2 [r 5 (a) + r 6 (a) + r 7 (b)+ r 8 (b)] + r 3 [r 1 (c) + r 2 (c) + r 3 (d)+ r 4 (d)] + r 4 [r 5 (c) + r 6 (c) + r 7 (d)+ r 8 (d)] V(e 2 ) = r 5 [r 1 (a) + r 2 (a) + r 3 (b)+ r 4 (b)] + r 6 [r 5 (a) + r 6 (a) + r 7 (b)+ r 8 (b)] + r 7 [r 1 (c) + r 2 (c) + r 3 (d)+ r 4 (d)] + r 8 [ r 5 (c) + r 6 (c) + r 7 (d)+ r 8 (d)] F FF abcd e = e 1 = = e 2

12. May 15, 2003OSQ Retreat 2003 Outline Value numbering on linear arithmetic (POPL ’03) How can we handle other operators ? –Program Analysis How can we handle repeated multiple occurrences of a conditional ? –Model Checking How can we interpret conditionals ? (CADE ’03) –Theorem Proving

13. May 15, 2003OSQ Retreat 2003 Repeated Conditionals a := 1;a := 4; b := 2; assert (b - a – 1 = 0) b := 5; T TF F B B a = w 1 + 4(1-w 1 ) = 4 – 3w 1 w1w1 w2w2 b = 2w 2 + 5(1-w 2 ) = 5 – 3w 2 b-a-1 = 3w 1 – 3w 2 Choose same random weights for equivalent conditionals Can’t really be so easy as SAT can be encoded as such a problem!

14. May 15, 2003OSQ Retreat 2003 Repeated Conditionals a := 1;a := 4; b := a+1; assert (b - a – 1 = 0) b := 5; T TF F B B w w b = (4-3w+1)w + 5(1-w) = 5 – 3w 2 b-a-1 = 3w - 3w 2 a = w + 4(1-w) = 4 – 3w Lost Completeness –We can verify the assert only if w = w 2, but we choose w from a large set for soundness Idea: Simplify the polynomial so that it does not contain terms like w 2 –Need to maintain symbolic expressions

15. May 15, 2003OSQ Retreat 2003 Repeated Conditionals A state maps a variable to a expression: E ::= n | E 1 + E 2 | if B then E 1 else E B ::= c | : c | B 1 Æ B 2 | B 1 Ç B 2 Representation for expressions must satisfy: –Easy to construct representation of E from representations of its subexpressions –Easy to verify equivalence of two expressions How about Multi-valued ROBDDs ? Free Conditional Expression DAGs (FCEDs) – Our representation

16. May 15, 2003OSQ Retreat 2003 Multi-valued ROBDDs c1 23 a =c2 z6 b = a := 2;a := 3; b := z; y := b + a; b := 6; T T F F c2 c1 c2 z+283+z9 y = |D(y)| = |D(a)| * |D(b)| D(y) does not share nodes with D(a) and D(b) Need a normal form for leaves

17. May 15, 2003OSQ Retreat 2003 FCEDs: Free Conditional Expression DAGs c1 23 a =c2 z6 b = a := 2;a := 3; b := z; y := b + a; b := 6; T T F F c2 c1 |D(y)| = |D(a)| + |D(b)| D(y) does share nodes with D(a) and D(b) No need for normal form for arithmetic +y =

18. FCED Construction c1 23 c2 z6 + choose guard choose guard Plus R(c1) 2 R( : c1) 3 R(c2) z R( : c2) 6 D(x) = Leaf(x) D(n) = Leaf(n) D(e 1 +e 2 ) = Plus (D(e 1 ), D(e 2 )) D(if b then e 1 else e 2 ) = Choose(||R(b),D(e 1 )||, ||NOT R(b), D(e 2 )||) Formalization

19. May 15, 2003OSQ Retreat 2003 Normalize Guard Operator ||g,f|| = Guard(g,f), if BV(g) Å BV(f) = ; ||g, Plus(f 1,f 2 ) = Plus(||g,f 1 ||, ||g, f 2 ||) ||g, Choose(f1,f2) = Choose(||g,f1||, ||g, f2||) ||g 1, Guard(g 2,f)|| = Guard(g 1,||g 2,f||), if BV(g 1 ) Å BV(g 2 ) = ; ||g 1, Guard(g 2,f )|| = Guard(|| INTERSECT(g 1,g 2 ),f ||)

20. May 15, 2003OSQ Retreat 2003 Example: Normalize Guard Operator choose guard choose guard Plus R(c1)R( : c1) 3 R(c2) z R( : c2) 6 2 guard R(c1) guard R(c1) R(c1 Æ c1) R( : c1 Æ c1 ) Given f, construct ||c 1,f||

21. May 15, 2003OSQ Retreat 2003 Randomized Equivalence testing for FCEDs V(Leaf(n)) = n V(Leaf(x)) = r x V(Plus(f 1,f 2 )) = V(f 1 ) + V(f 2 ) V(Choose(f 1,f 2 )) = V(f 1 ) + V(f 2 ) V(Guard(g,f)) = V(g)*V(f) V(c(g 1,g 2 ) = r c *V(g 1 ) + (1-r c )*V(g 2 ) V(0) = 0, V(1) = 1 V(and(g 1,g 2 )) = V(g 1 )*V(g 2 ) V(or(g 1,g 2 )) = V(g 1 )+V(g 2 ) V(c) = r c, V( : c) = 1 – r c

22. May 15, 2003OSQ Retreat 2003 Outline Value numbering on linear arithmetic (POPL ’03) How can we handle other operators ? –Program Analysis How can we handle multiple occurrences of a conditional ? –Model Checking How can we interpret conditionals ? (CADE ’03) –Theorem Proving

23. May 15, 2003OSQ Retreat 2003 Example a := x + y b := ab := 2 * x assert (b = 2x) TF If (x = y) Affine join is not enough We need to make use of the conditional x = y on the true branch

24. May 15, 2003OSQ Retreat 2003 The Adjust Operation Execute multiple runs of the program in parallel Sample = Collection of states at each program point “Adjust” the sample before a conditional (by taking affine joins of the states in the sample) such that –Adjustment preserves original relationships –Adjustment satisfies the equality in the conditional Use adjusted sample on the true branch

25. May 15, 2003OSQ Retreat 2003 Experience We built a randomized satisfiability procedure for linear equalities E.g., show that z = x + y Æ x = y ) z = 2x –Encode it as a program with “if … then … else” –We use Adjust but no Join here Compared with ICS (from SRI) on randomly- generated examples –Randomized algorithm 60-100 times faster (for arith.) –Simple algorithm –Simple data structure: an array of states (Caveat: our tool is written in C and ICS in Ocaml)

26. May 15, 2003OSQ Retreat 2003 Conclusion and Future Work Randomization can help achieve simplicity and efficiency at the expense of making soundness probabilistic Other interesting possible extensions: –Combination of uninterpreted functions with arithmetic –Partially interpreted functions like associative functions –Memory –Inequalities