Semantics of the Expressions

The semantics of expressions are defined by interpretation functions which range over the sets of values, labels and names. The value and label expressions have the same interpretation, a label expression is constrained by its syntax to result in a label (in Labels). The interpretation of a value expression

e

in a state

s

results in a value. If

e

is a variable name then it is the value of the variable in state

s

. The interpretation of a name expression

n

as a name is either

n

, if

n

is a constant (in Names), or the result of applying a name function to arguments interpreted as values. The difference in the interpretation of value expressions and name expressions corresponds to the difference between r-expressions and l-expressions in program analysis (Aho et al., 1986).

Definition 3.6 Interpretation of expressions

The interpretation functions Ie, In andIl, on expressions, name expressions and label expres- sions respectively, have types:

Ie :E !State!Values In :En!State!Names Il :El !State!Labels

3.1 Expressions ofL 44

The interpretation as a value of expression

e

2Ein state

s

is defined by functionIe.

Ie(

e

)(

s

) def = 8 > > < > > :

e

if

e

2Values

f

(

s

) if

e

=subst(

f

)

s

(In(

e

)(

s

)) if

e

2En If(

f

)(Ie(

a

1 )(

s

)

;::: ;

Ie(

a

m)(

s

)) if

e

=

f

(

a

1

;::: ;a

m ) where

m

=arity(

f

)

The interpretation as a name of the name expression

e

2En in state

s

is defined by functionIn. In(

e

)(

s

) def =

e

if

e

2Names If(

f

)(Ie(

a

1 )(

s

)

;::: ;

Ie(

a

m)(

s

)) if

e

=

f

(

a

1

;::: ;a

m ) where

m

=arity(

f

)

The interpretation of the label expressions,Il, is the interpretation of the expressions:Il def

= Ie. The Boolean interpretation of an expression is defined by the functionIb.

Ib :Eb !State!boolean Ib(

e

)(

s

)

def

= B(Ie(

e

)(

s

))

2 When the interpretation functionIe is applied to an expression

e

, in a state

s

, any name ex- pression

x

occurring in

e

is interpreted as a name

x

0

and replaced with the value

s

(

x

0

). When the interpretation of name expressions,In, is applied to the name expression

f

(

a

1

;::: ;a

n

)in state

s

, the arguments

a

1

;::: ;a

n are interpreted as values and evaluated in state

s

. The interpretation of the name functionIf(

f

)is applied to the resulting values to obtain the result of the expression. When either interpretation function is applied to a constant

e

, the result is

e

. However, the notion of a constant differs, a name

x

2 Names is a constant only under the interpretation as a name, In. The value of

x

under interpretationIe depends on the state in which it is interpreted.

Example 3.4 Using the expressions of Example (3.3), the interpretations in a state

s

of the value expressions are:

Ie(1)(

s

)=1 Ie(2+a3)(

s

)=If(plus)(2

;

3) Ie(

x

)(

s

)=

s

(In(

x

))=

s

(

x

) Ie(

x

+a1)(

s

)=If(plus)(

s

(

x

)

;

1) Ie(ref(

x

))=

s

(In(ref(

x

))(

s

))

The interpretations as names (using functionIn) of the name expressions are: In(

x

)(

s

)=

x

In(ref(

x

))(

s

)=If(ref)(Ie(

x

)(

s

))=If(ref)(

s

(

x

)) In(ref(

x

+a1))(

s

)=If(ref)(Ie(

x

+a1)(

s

))

3.1 Expressions ofL 45

The expressions of L are based on standard definitions for programming languages (see Loeckx & Sieber, 1987) extended with the name expressions, which provide both pointers and arrays. In Example (3.4), the expression ref(

x

)is a pointer:

x

is a name which is interpreted as a value

e

. This is the argument to the name function ref and if

e

identifies a memory variable,

e

2 Vars, then the interpretation of ref(

e

)is also a name. Arrays can be modelled in a similar way. An array

a

is a name function inFn. If

e

is an expression, then the expression

a

(

e

)will be a name expression (identifying variables).

Boolean Expressions

The value expressions model the tests on program data performed by a processor instruction. This uses the Boolean interpretation Ib of the value expressions. For example, the equality of values

v

1

;v

2

2Ein a state

s

is tested by the expression,Ib(

v

1

=a

v

2

)(

s

). Since the Boolean con- stants are represented by values true and false, the Boolean negation and conjunction operators can be defined as value functions. This allows Boolean expressions ofLto include formulas of a propositional (quantifier-free) logic.

Definition 3.7 Boolean operators

The negation and conjunction operators of Eb are defined as the value functions not and and, with arities 1 and 2 respectively.

not2Fv If(not)(

v

) def = false ifB(

e

) true otherwise and2Fv If(and)(

v

1

;v

2 ) def = true ifB(

v

1 )^B(

v

2 ) false otherwise

For any

x;y

, and(

x;y

)will be written

x

and

y

. 2

Since both the negation and conjunction operators are value functions, any expression formed by their application to arguments will be a value expression (in E) and therefore in Eb. Other Boolean operators can be defined in terms of negation and conjunction. For example, the dis- junction of Boolean expressions or is also a Boolean expression ofL.

or :(EbEb)!Eb

x

or

y

def

= not(not

x

and not

y

)

The Boolean operators allow comparison functions to be derived from a small number of ba- sic operations. For example, the greater than or equal, written

e

1

a

e

2, is defined

e

1 a

e

1 def = not(

e

2

<

a

e

1

). Operatora will have typeEE ! E, constructing an expression ofE.

Example 3.5 Data and memory operations

For an example of the use of expressions ofLto model data operations, consider the arithmetic operations of a processor which manipulates data items as bit-vectors (called quad-words), rep- resenting numbers in the range0

;::: ;

2

64

3.1 Expressions ofL 46 Arithmetic:

e

1 = 64

e

2 def = (

e

1 moda 2 64 )=a (

e

2 moda 2 64 )

e

1

<

64

e

2 def = (

e

1 moda 2 64 )

<

a (

e

2 moda 2 64 )

e

1 + 64

e

2 def = (

e

1 +a

e

2 )moda 2 64

e

1 64

e

2 def =(

e

1 a

e

2 )moda2 64

e

1 64

e

2 def =(

e

1 a

e

2 )moda2 64 mkQuad(

e

) def =

e

moda2 64 Memory: Mem(

e

) def

=ref(mkQuad(

a

a(

a

moda4)))

Inst(

e

) def

=loc(mkQuad(

a

a(

a

moda 4))) where

e;e

1

;e

2

2E

Figure 3.2: Example of Expressions Modelling Data Operations

be performed within this range. The model of the basic arithmetic operations, as expressions of L, is given in Figure (3.2). The arithmetic operations are written in the infix notation and for bit-vectors of size64. e.g.

e

1 =

64

e

2is the equality between values less than 2

64

and is defined in terms of the value function equal 2 Fv ofL. Since all arithmetic operators of Figure (3.2) are defined in terms ofE, the type of each operator is(E E) ! E. The function mkQuad is the conversion of an arbitrary value to value in the range which can be represented by the processor. A processor can restrict the memory locations which can be accessed by an instruction; a com- mon restriction is to require the address of a location to be a multiple of a constant. This can be modelled by name and label expressions (of En and El). Figure (3.2) defines name expres- sion Mem(

e

)2En and label expression Inst2El which restrict memory access to the locations whose address is a multiple of4, rounding down if necessary. e.g. Mem(0)and Mem(4)identify distinct names ref(0)and ref(4)respectively while Mem(0)and Mem(1)are both name ref(0). The addressing modes of a processor can be described in terms of the name expressions ref or Mem. Consider the addressing modes described in Chapter (2) (with r0

;

r1 2 Regs and

v

2 Values): In immediate addressing, the value

v

is an expression

v

2 E (by definition). In direct addressing, the name identified by address

v

is Mem(

v

). For indirect addressing, the name identified by the value stored in r0 is Mem(r0). Furthermore, the name identified by the value stored in this variable is Mem(Mem(r0)). In indexed addressing, the variable identified by the sum of r0 and

v

is Mem(r0+

64

v

). Since

v

is a value expression, it can be replaced with any other value expressions. e.g. Indexed addressing can be defined with two registers,

Mem(r0+ 64r1

). Relative addressing is a form of indexed addressing which uses the program counter: Mem(pc +

64

e

) (for any

e

2 E). Similar expressions can be built up for the label expressions. For example, the label identified by the value stored in register r0 is Inst(r0). 2

3.1 Expressions ofL 47

In document Object code verification (Page 61-65)