q      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~                             B portable experimentalerkokl@gmail.com   portable experimentalerkokl@gmail.com!""If selected, runs the computation m, and prints the time it took 5 to run it. The return type should be an instance of # to ensure & the correct elapsed time is printed. ""portable experimentalerkokl@gmail.com$%&'($%&'($&%%&'(portable experimentalerkokl@gmail.com7A Test-suite, parameterized by the gold-check generator/checker  Wrap over #, avoids exporting the constructor )Checks that a particular result shows as s 'Run an IO computation and check that it's result shows as s %Create a gold file for the test case )*+,-./0portable experimentalerkokl@gmail.comThe # class: a generalization of Haskell's 1 type  Haskell 1 and SBV's SBoolH are instances of this class, unifying the treatment of boolean values. Minimal complete definition: ,  ,    However, it's advisable to define , and  # as well (typically), for clarity.  logical true logical false  complement and or nand nor xor implies  equivalence cast from Bool Generalization of 2 Generalization of 3 Generalization of 4 Generalization of 5     portable experimentalerkokl@gmail.com678NArrays implemented internally as functions, and rendered as SMT-Lib functions 9:+Arrays implemented in terms of SMT-arrays:  8http://goedel.cs.uiowa.edu/smtlib/theories/ArraysEx.smt2 ;Flat arrays of symbolic values  An  array a b! is an array indexed by the type 21 a, with elements of type 21 b ( If an initial value is not provided in  and  methods, then the elements ] are left unspecified, i.e., the solver is free to choose any value. This is the right thing W to do if arrays are used as inputs to functions to be verified, typically. Reading an ! uninitilized entry is an error.  While it'5s certainly possible for user to create instances of , the   and 8 instances already provided should cover most use cases  in practice. DMinimal complete definition: All methods are required, no defaults. 3Create a new array, with an optional initial value >Create a named new array with, with an optional initial value Read the array element at a 1Reset all the elements of the array to the value b Update the element at a to be b 1Merge two given arrays on the symbolic condition  Intuitively: ,mergeArrays cond a b = if cond then a else b. < Merging pushes the if-then-else choice down on to elements A D is a potential symbolic bitvector that can be created instances of S to be fed to a symbolic program. Note that these methods are typically not needed  in casual uses with prove, sat, allSat) etc, as default instances automatically  provide the necessary bits. Create a user named input !$Create an automatically named input "$Turn a literal constant to symbolic #,Extract a literal, if the value is concrete $,Extract a literal, from a CW representation %Is the symbolic word concrete? &&Is the symbolic word really symbolic? 'CA Symbolic computation. Represented by a reader monad carrying the D state of the computation, layered on top of IO for creating unique / references to hold onto intermediate results. <(64-bit signed symbolic value, 2's complement representation )32-bit signed symbolic value, 2's complement representation *16-bit signed symbolic value, 2's complement representation +8-bit signed symbolic value, 2's complement representation ,64-bit unsigned symbolic value -32-bit unsigned symbolic value .16-bit unsigned symbolic value /8-bit unsigned symbolic value 0A symbolic boolean/bit 1The Symbolic value. Either a constant (Left) or a symbolic  value ( Right Cached-). Note that caching is essential for making * sure sharing is preserved. The parameter a is phantom, but is C extremely important in keeping the user interface strongly typed. 2=>?@ABCDEFGHIJKLMNOPQR3)Result of running a symbolic computation STT$ pairs symbolic words and user given/automatically generated names U'A program is a sequence of assignments VWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~~- represents a concrete word of a fixed size:  The unsigned variants are: , , , , and   The signed variants are : , , , I64' * Endianness is mostly irrelevant (see the FromBits class). K For signed words, the most significant digit is considered to be the sign 4PMark an interim result as an output. Useful when constructing Symbolic programs O that return multiple values, or when the result is programmatically computed. 5(Run a symbolic computation and return a 3 t89; !"#$%&'()*+,-./012=JNOPQR3STUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~45t899;; !"#$%& !"#$%&'()*+,-./0122=JNRQPOOPQR3SSTUVWXYWXYZ[[\vutsrqponmlkjihgfedcba`_^]]^_`abcdefghijklmnopqrstuvwxxyzz{||}~45portable experimentalerkokl@gmail.com%6DUninterpreted constants and functions. An uninterpreted constant is K a value that is indexed by its name. The only property the prover assumes K about these values are that they are equivalent to themselves; i.e., (for I functions) they return the same results when applied to same arguments. C We support uninterpreted-functions as a general means of black-box'ing  operations that are  irrelevant+ for the purposes of the proof; i.e., when N the proofs can be performed without any knowledge about the function itself. Minimal complete definition: 7. However, most instances in T practice are already provided by SBV, so end-users should not need to define their  own instances. 784Symbolic choice operator, parameterized via a class  ;1 is a total-indexing function, with the default. Minimal complete definition: 9 9(Merge two values based on the condition :9Choose one or the other element, based on the condition.  This is similar to 9, but it has a default " implementation that makes sure it')s short-cut if the condition is concrete ;Total indexing operation. select xs default index is intuitively  the same as  xs !! index, except it evaluates to default if index  overflows <The <2 class captures the essence of division of words. $ Unfortunately we cannot use Haskell's  class since the   and > superclasses are not implementable for symbolic bit-vectors.  However,  makes perfect sense, and the < class captures J this operation. One issue is how division by 0 behaves. The verification K technology requires total functions, and there are several design choices  here. We follow Isabelle/3HOL approach of assigning the value 0 for division / by 0. Therefore, we impose the following law:   x = 0 = (0, x)5Note that our instances implement this law even when x is 0 itself. Minimal complete definition: = =>!Symbolic Comparisons. Similar to , we cannot implement Haskell's  class $ since there is no way to return an # value from a symbolic comparison.  Furthermore, > requires 8$ to implement if-then-else, for the . benefit of implementing symbolic versions of  and  functions. Minimal complete definition: ? ?@ABCDE#Symbolic Equality. Note that we can' t use Haskell's / class since Haskell insists on returning Bool E Comparing symbolic values will necessarily return a symbolic value. Minimal complete definition: F FGHLReturns (symbolic) true if all the elements of the given list are different IKReturns (symbolic) true if all the elements of the given list are the same J.Returns 1 if the boolean is true, otherwise 0 KReplacement for . Since  requires a 1 to be returned, R we cannot implement it for symbolic words. Index 0 is the least-significant bit. LGeneralization of ( based on a symbolic boolean. Note that  and  H are still available on Symbolic words, this operation comes handy when  the condition to set/clear happens to be symbolic M=Little-endian blasting of a word into its bits. Also see the FromBits class N:Big-endian blasting of a word into its bits. Also see the FromBits class O:Least significant bit of a word, always stored at index 0 PCMost significant bit of a word, always stored at the last position 6789:;<=>?@ABCDEFGHIJKLMNOP67789:;9:;<==>?@ABCD?@ABCDEFGFGHIJKLMNOPportable experimentalerkokl@gmail.com QjPrettyNum class captures printing of numbers in hex and binary formats; also supporting negative numbers. Minimal complete definition: R and S R,Show a number in hexadecimal (starting with 0x) S'Show a number in binary (starting with 0b) TIO version of R UIO version of S VWA more convenient interface for reading binary numbers, also supports negative numbers QRSTUVQRSTURSTUVportable experimentalerkokl@gmail.com WKUnblasting a value from symbolic-bits. The bits can be given little-endian R or big-endian. For a signed number in little-endian, we assume the very last bit N is the sign digit. This is a bit awkward, but it is more consistent with the reverse view of # little-big-endian representations Minimal complete definiton: X XYZ Splitting an a into two b's and joining back.  Intuitively, a is a larger bit-size word than b, typically double.  The ]# operation captures embedding of a b value into an a & without changing its semantic value. /Minimal complete definition: All, no defaults. [\]?Construct a symbolic word from its bits given in little-endian APerform a sanity check that we should receive precisely the same E number of bits as required by the resulting type. Unsigned version, $ the input is assumed little-endian Same as , but for signed words WXYZ[\]WXYXYZ[\][\]portable experimentalerkokl@gmail.com^QImplements polynomial addition, multiplication, division, and modulus operations  over GF(2^n). NB. Similar to =, division by 0 is interpreted as follows:  x d 0 = (0, x)for all x (including 0) Minimal complete definiton: a, d, e _3Given bit-positions to be set, create a polynomial  For instance  polynomial [0, 1, 3] :: SWord8will evaluate to 11, since it sets the bits 0, 1, and 3,. Mathematicans would write this polynomial  as  x^3 + x + 1. And in fact, e will show it like that. `Add two polynomials in GF(2^n) aSMultiply two polynomials in GF(2^n), and reduce it by the irreducible specified by X the polynomial as specified by coefficients of the third argument. Note that the third j argument is specifically left in this form as it is usally in GF(2^(n+1)), which is not available in our e formalism. (That is, we would need SWord9 for SWord8 multiplication, etc.) Also note that we do not F support symbolic irreducibles, which is a minor shortcoming. (Most GF'%s will come with fixed irreducibles, / so this should not be a problem in practice.)  Passing []^ for the third argument will multiply the polynomials and then ignore the higher bits that won't  fit into the resulting size. bDDivide two polynomials in GF(2^n), see above note for division by 0 cOCompute modulus of two polynomials in GF(2^n), see above note for modulus by 0 d%Division and modulus packed together eCDisplay a polynomial like a mathematician would (over the monomial x) Pretty print as a polynomial Add two polynomials dMultiply two polynomials and reduce by the third (concrete) irreducible, given by its coefficients.  See the remarks for the a! function for this design choice ^_`abcde^_`abcde_`abcdeportable experimentalerkokl@gmail.com)*+,-./01235 3512portable experimentalerkokl@gmail.com#f Instances of f< can be automatically extracted from models returned by the G solvers. The idea is that the sbv infrastructure provides a stream of CW's (constant-words) & coming from the solver, and the type a7 is interpreted based on these constants. Many typical V instances are already provided, so new instances can be declared with relative ease. Minimum complete definition: g gEGiven a sequence of constant-words, extract one instance of the type a , returning B the remaining elements untouched. If the next element is not what's expected for this  type you should return  h2Given a parsed model instance, transform it using f, and return the result. P The default definition for this method should be sufficient in most use cases. iAn allSat call results in a ji jkA sat call results in a lk " The reason for having a separate lk is to have a more meaningful  instance. lmA prove call results in a nm noBThe result of an SMT solver call. Each constructor is tagged with  the |{6 that created it so that further tools can inspect it K and build layers of results, if needed. For ordinary uses of the library, G this type should not be needed, instead use the accessor functions on 3 it. (Custom Show instances and model extractors.) pComputation timed out (see the timeout combinator) qProver errored out rAProver returned unknown, with a potential (possibly bogus) model sSatisfiable with model tUnsatisfiable uAn SMT solver vwPrintable name of the solver xThe path to its executable y!Options to provide to the solver z>The solver engine, responsible for interpreting solver output {Solver configuration |} Debug mode ~YPrint timing information on how long different phases took (construction, solving, etc.) Print literals in this base The actual SMT solver  Given an o6, extract an arbitrarily typed model from it, given a f instance  Given an allSatS call, we typically want to iterate over it and print the results in sequence. The  ) function automates this task by calling disp* on each result, consecutively. The first   argument to disp 'is the current model number. #fghijklmnopqrstuvwxyz{|}~#fghghijjkllmnnotsrqppqrstuvwxyzvwxyz{|}~|}~portable experimentalerkokl@gmail.comportable experimentalerkokl@gmail.com(The description of the Yices SMT solver  The default executable is "yices"., which must be in your path. You can use the  SBV_YICESA environment variable to point to the executable on your system.  The default options are "-m -f"5, which is valid for Yices 2 series. You can use the SBV_YICES_OPTIONS/ environment variable to override the options. portable experimentalerkokl@gmail.com'Equality as a proof method. Allows for K very concise construction of equivalence proofs, which is very typical in  bit-precise proofs. A type a1 is provable if we can turn it into a predicate. U Note that a predicate can be made from a curried function of arbitrary arity, where Q each element is either a symbolic type or up-to a 7-tuple of symbolic-types. So [ predicates can be constructed from almost arbitrary Haskell functions that have arbitrary 0 shapes. (See the instance declarations below.) >Turns a value into a predicate, internally naming the inputs. 9 In this case the sbv library will use names of the form s1, s2, etc. to name these variables  Example:  1 forAll_ $ \(x::SWord8) y -> x `shiftL` 2 .== y \is a predicate with two arguments, captured using an ordinary Haskell function. Internally,  x will be named s0 and y will be named s1. PTurns a value into a predicate, allowing users to provide names for the inputs. ` If the user does not provide enough number of names for the free variables, the remaining ones ` will be internally generated. Note that the names are only used for printing models and has no S other significance; in particular, we do not check that they are unique. Example:  ; forAll ["x", "y"] $ \(x::SWord8) y -> x `shiftL` 2 .== y >This is the same as above, except the variables will be named x and y respectively, 9 simplifying the counter-examples when they are printed. _A predicate is a symbolic program that returns a (symbolic) boolean value. For all intents and Y purposes, it can be treated as an n-ary function from symbolic-values to a boolean. The ' 6 monad captures the underlying representation, and can//should be ignored by the users of the library, Y unless you are building further utilities on top of SBV itself. Instead, simply use the   type when necessary. gDefault configuration for the SMT solver. Non-verbose, non-timing, prints results in base 10, and uses  the Yices SMT solver. Same as , except verbose Same as , except prints timing info Same as &, except both verbose and timing info Adds a time out of n) seconds to a given solver configuration !Prove a predicate, equivalent to   <Find a satisfying assignment for a predicate, equivalent to   AReturn all satisfying assignments for a predicate, equivalent to  . d Satisfying assignments are constructed lazily, so they will be available as returned by the solver  and on demand. 2Checks theoremhood within the given time limit of i seconds.  Returns Nothing* if times out, or the result wrapped in a Just otherwise. 5Checks satisfiability within the given time limit of i seconds.  Returns Nothing* if times out, or the result wrapped in a Just otherwise. Checks theoremhood Checks satisfiability EReturns the number of models that satisfy the predicate, as it would  be returned by -. Note that the number of models is always a G finite number, and hence this will always return a result. Of course, J computing it might take quite long, as it literally generates and counts " the number of satisfying models. 0Proves the predicate using the given SMT-solver 8Find a satisfying assignment using the given SMT-solver ;Find all satisfying assignments using the given SMT-solver 4fghijklmnopqrstuvwxyz{|}~portable experimentalerkokl@gmail.com     !"#$%&'()*+,-./046789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~0/.-,+*)(KLJOPIHNMWXYZ[\]^_`abcde89:;EFG>?@ABCD<= QRSTUV67mnklijotsrqpfgh{|}~uvwxyz'4 !"#$%&portable experimentalerkokl@gmail.com Formalizes  Chttp://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax  Formalizes  Chttp://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax  Formalizes  Ghttp://graphics.stanford.edu/~seander/bithacks.html#DetectOppositeSigns  Formalizes  ]http://graphics.stanford.edu/~seander/bithacks.html#ConditionalSetOrClearBitsWithoutBranching  Formalizes  Ghttp://graphics.stanford.edu/~seander/bithacks.html#DetermineIfPowerOf2 Collection of queries portable experimentalerkokl@gmail.com+LChoose the appropriate array model to be used for modeling the memory. (See .)  The  is the function based model.  is the SMT-Lib array's based model. 5Helper synonym for capturing relevant bits of Mostek An instruction is modeled as a  transformer. We model 7 mostek programs in direct continuation passing style. CPrograms are essentially state transformers (on the machine state) 1Given a machine state, compute a value out of it NAbstraction of the machine: The CPU consists of memory, registers, and flags. ] Unlike traditional hardware, we assume the program is stored in some other memory area that 2 we need not model. (No self modifying programs!) 2The memory maps 32-bit words to 8-bit words. (The  data-type is ; defined later, depending on the verification model used.)  Flag bank Register bank .Convenient synonym for symbolic machine bits. Mostek was an 8-bit machine. The carry flag () and the zero flag () YWe model only two registers of Mostek that is used in the above algorithm, can add more. )The memory is addressed by 32-bit words. "Get the value of a given register "Set the value of a given register Get the value of a flag Set the value of a flag  Read memory Write to memory LDX: Set register X to value v LDA: Set register A to value v CLC: Clear the carry flag 9ROR, memory version: Rotate the value at memory location a E to the right by 1 bit, using the carry flag as a transfer position. E That is, the final bit of the memory location becomes the new carry B and the carry moves over to the first bit. This very instruction ! is one of the reasons why Legato')s multiplier is quite hard to understand 9 and is typically presented as a verification challenge. ROR, register version: Same as , except through register r. BCC: branch to label l if the carry flag is false %ADC: Increment the value of register A! by the value of memory contents  at address a8, using the carry-bit as the carry-in for the addition. %DEX: Decrement the value of register X &BNE: Branch if the zero-flag is false The  combinator stops/ our program, providing the final continuation  that does nothing. <Parameterized by the addresses of locations of the factors (F1 and F2), K the following program multiplies them, storing the low-byte of the result  in the memory location lowAddr , and the high-byte in register A. The 5 implementation is a direct transliteration of Legato's algorithm given ! at the top, using our notation.  Given address/Bvalue pairs for F1 and F2, and the location of where the low-byte  of the result should go,  runLegato" takes an arbitrary machine state m and 7 returns the high and low bytes of the multiplication. UCreate an instance of the Mostek machine, initialized by the memory and the relevant ' values of the registers and the flags NThe correctness theorem. For all possible memory configurations, the factors (x and y below), the location r of the low-byte result and the initial-values of registers and the flags, this function will return True only if  running Legato'/s algorithm does indeed compute the product of x and y correctly. The correctness theorem. C On a decent MacBook Pro, this proof takes about 30 seconds with  memory model above ! and about 30 minutes with the  memory model +++portable experimentalerkokl@gmail.comXHelper synonym for representing GF(2^8); which are merely 8-bit unsigned words. Largest ) term in such a polynomial has degree 7. Multiplication in Rijndael'?s field; usual polynomial multiplication followed by reduction A by the irreducible polynomial. The irreducible used by Rijndael's field is the polynomial  x^8 + x^4 + x^3 + x + 1, which we write by giving it's  exponents in SBV.  See:  Nhttp://en.wikipedia.org/wiki/Finite_field_arithmetic#Rijndael.27s_finite_field. H Note that the irreducible itself is not in GF28! It has a degree of 8. NB. You can use the eG function to print polynomials nicely, as a mathematician would write.  States that the unit polynomial 1, is the unit element *States that multiplication is commutative CStates that multiplication is associative, note that associativity $ proofs are notoriously hard for SAT/ SMT solvers IStates that the usual multiplication rule holds over GF(2^n) polynomials  Checks:    if (a, b) = x d y then x = y a a + b being careful about y = 0&. When divisor is 0, then quotient is 5 defined to be 0 and the remainder is the numerator.  (Note that addition is simply  in GF(2^8).) Queries portable experimentalerkokl@gmail.comZUse 16-bit words to represent the counts, much larger than we actually need, but no harm. =Codes the puzzle statement, more or less directly using SBV. prints the only solution:   dog = 3 :: SWord16  cat = 41 :: SWord16  mouse = 56 :: SWord16 portable experimentalerkokl@gmail.com#The puzzle board is a list of rows A row is a list of elements Use 32-bit words for elements. 5Checks that all elements in a list are within bounds $Get the diagonal of a square matrix (Test if a given board is a magic square 3Group a list of elements in the sublists of length i Given n, magic n prints all solutions to the nxn magic square problem portable experimentalerkokl@gmail.comFA solution is a sequence of row-numbers where queens should be placed  Checks that a given solution of n!-queens is valid, i.e., no queen  captures any other. Given n, it solves the n-queens* puzzle, printing all possible solutions.  portable experimentalerkokl@gmail.comDA puzzle is a pair: First is the number of missing elements, second F is a function that given that many elements returns the final board. 'A Sudoku board is a sequence of 9 rows ]A row is a sequence of 8-bit words, too large indeed for representing 1-9, but does not harm =Given a series of elements, make sure they are all different * and they all are numbers between 1 and 9 2Given a full Sudoku board, check that it is valid +Solve a given puzzle and print the results UHelper function to display results nicely, not really needed, but helps presentation Find all solutions to a puzzle Find an arbitrary good board )A random puzzle, found on the internet.. /Another random puzzle, found on the internet.. /Another random puzzle, found on the internet.. ,According to the web, this is the toughest 7 sudoku puzzle ever.. It even has a name: Al Escargot:   Jhttp://zonkedyak.blogspot.com/2006/11/worlds-hardest-sudoku-puzzle-al.html 0This one has been called diabolical, apparently (The following is nefarious according to   %http://haskell.org/haskellwiki/Sudoku GSolve them all, this takes a fraction of a second to run for each case  portable experimentalerkokl@gmail.com(LA move action is a sequence of triples. The first component is symbolically P True if only one member crosses. (In this case the third element of the triple S is irrelevant.) If the first component is (symbolically) False, then both members  move together 0A puzzle move is modeled as a state-transformer )The status of the puzzle after each move  elapsed time location of the flash location of Bono location of Edge location of Adam location of Larry Location of the flash Each member gets an 8-bit id Model time using 32 bits U2 band members Bono's ID Edge's ID Adam's ID Larry's ID Is this a valid person? +Crossing times for each member of the band (We represent this side of the bridge as , and arbitrarily as   )We represent other side of the bridge as  , and arbitrarily as   8Start configuration, time elapsed is 0 and everybody is   (Read the state via an accessor function  /Given an arbitrary member, return his location  )Transferring the flash to the other side (Transferring a person to the other side 1Increment the time, when only one person crosses 3Increment the time, when two people cross together Symbolic version of when /Move one member, remembering to take the flash 'Move two members, again with the flash !Run a sequence of given actions. CCheck if a given sequence of actions is valid, i.e., they must all E cross the bridge according to the rules and in less than 17 seconds .See if there is a solution that has precisely n steps HSolve the U2-bridge crossing puzzle, starting by testing solutions with B increasing number of steps, until we find one. This call prints:   % Checking for solutions with 1 move. & Checking for solutions with 2 moves. & Checking for solutions with 3 moves. & Checking for solutions with 4 moves. & Checking for solutions with 5 moves.  Solution #1:  0 --> Edge, Bono  2 <-- Edge  4 --> Larry, Adam  14 <-- Bono  15 --> Edge, Bono  Total time: 17  Solution #2:  0 --> Edge, Bono  2 <-- Bono  3 --> Larry, Adam  13 <-- Edge  15 --> Edge, Bono  Total time: 17 ! Found: 2 solutions with 5 moves 4Finding the all 2 possible solutions to the puzzle. (     (     (      portable experimentalerkokl@gmail.com7The array type, takes symbolic 32-bit unsigned indexes , and stores 32-bit unsigned symbolic values &Uninterpreted function in the theorem 3Correctness theorem. We state it for all values of x, y, and  the array a7. We also take an arbitrary initializer for the array. $Prints Q.E.D. when run, as expected portable experimentalerkokl@gmail.com  <read-after-write: If you write a value and read it back, you' ll get it Zwrite-after-write: If you write to the same location twice, then the first one is ignored JTwo writes to different locations commute, i.e., can be done in any order CTwo writes do not commute if they can be done to the same location     portable experimentalerkokl@gmail.com   portable experimentalerkokl@gmail.comportable experimentalerkokl@gmail.com  !"#$%&'(  !"#$%&'(  !"#$%&'(portable experimentalerkokl@gmail.com)*+,)*+,)*+,portable experimentalerkokl@gmail.com--- portable experimentalerkokl@gmail.com ./0123456 ./0123456 ./0123456!portable experimentalerkokl@gmail.com787878"portable experimentalerkokl@gmail.com 9:;<=>?@A 9:;<=>?@A 9:;<=>?@A#portable experimentalerkokl@gmail.comBBB$portable experimentalerkokl@gmail.comCDEFGHIJCDEFGHIJCDEFGHIJ%portable experimentalerkokl@gmail.com KLMNOPQRS KLMNOPQRS KLMNOPQRS&portable experimentalerkokl@gmail.com TUVWXYZ[\] TUVWXYZ[\] TUVWXYZ[\]'portable experimentalerkokl@gmail.com^_`a^_`a^_`a(portable experimentalerkokl@gmail.combcdefghibcdefghibccdefghi)portable experimentalerkokl@gmail.com jklmnopqr jklmnopqr jklmnopqr*portable experimentalerkokl@gmail.comststst+portable experimentalerkokl@gmail.comuvwxuvwxuvwx,portable experimentalerkokl@gmail.comyz{|}yz{|}yz{|}-portable experimentalerkokl@gmail.com~~~.portable experimentalerkokl@gmail.com/portable experimentalerkokl@gmail.com0portable experimentalerkokl@gmail.com1portable experimentalerkokl@gmail.com2portable experimentalerkokl@gmail.com3portable experimentalerkokl@gmail.com4portable experimentalerkokl@gmail.com5portable experimentalerkokl@gmail.com6portable experimentalerkokl@gmail.com7portable experimentalerkokl@gmail.com8portable experimentalerkokl@gmail.com9portable experimentalerkokl@gmail.com:portable experimentalerkokl@gmail.com;portable experimentalerkokl@gmail.com<portable experimentalerkokl@gmail.com=portable experimentalerkokl@gmail.com>portable experimentalerkokl@gmail.com?portable experimentalerkokl@gmail.com@portable experimentalerkokl@gmail.comAportable experimentalerkokl@gmail.comBportable experimentalerkokl@gmail.comCCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrsstuvwxyz{|}~                ! " # $ % & ' ( ) ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I  J K L M N O P Q R S T U VWXYZ[\]^_`^_a^_b^_c^_d^_e^_f^ghijklmnlmolmplmqrrsXtYiuuvwxyz{|}~twllllllilllll lli      !"#$%&'()l*+l*,l*-l*.l/0l/1l/2l/3l/4l5l6l7l8l9l:l;l<l=l>l?l@lAlBlCDEFGHIJKLMNOPQRSTUVWXYZ[\]JKLHT O P Q R ^ _ ` a !b!"U"V"W"X"Y"Z"["\"]#T$c$d$e$f$g$h$i$j%c%d%e%f%g%k%l%m%n&c&d&e&f&g&h&o&p&q&r's't'u'v(w(x(y(d(e(f(g(z){)|)})~)))))**++++,M,,,,-T.T/T0T1T2T3T4T5T6T7T8T9T:T;T<T=T>T?T@TATBT sbv-0.9.4Data.SBV.InternalsData.SBV&Data.SBV.Examples.BitPrecise.BitTricks#Data.SBV.Examples.BitPrecise.Legato)Data.SBV.Examples.Polynomials.Polynomials%Data.SBV.Examples.Puzzles.DogCatMouse%Data.SBV.Examples.Puzzles.MagicSquare!Data.SBV.Examples.Puzzles.NQueens Data.SBV.Examples.Puzzles.Sudoku"Data.SBV.Examples.Puzzles.U2Bridge#Data.SBV.Examples.Uninterpreted.AUFData.SBV.Provers.SExprData.SBV.Utils.TDiffData.SBV.BitVectors.BitData.SBV.Utils.SBVTestData.SBV.Utils.BooleanData.SBV.BitVectors.DataData.SBV.BitVectors.ModelData.SBV.BitVectors.PrettyNumData.SBV.BitVectors.SplittableData.SBV.BitVectors.PolynomialData.SBV.SMT.SMTData.SBV.SMT.SMTLibData.SBV.Provers.YicesData.SBV.Provers.ProverData.SBV.Examples.Arrays.Memory#Data.SBV.Examples.Basics.BasicTests$Data.SBV.TestSuite.Basics.BasicTestsData.SBV.Examples.Basics.HigherData.SBV.Examples.Basics.IndexData.SBV.TestSuite.Basics.Index#Data.SBV.Examples.Basics.ProofTestsData.SBV.Examples.Basics.QRem/Data.SBV.Examples.Basics.UnsafeFunctionEquality0Data.SBV.TestSuite.Basics.UnsafeFunctionEqualityData.SBV.Examples.CRC.CCITT"Data.SBV.Examples.CRC.CCITT_UnidirData.SBV.Examples.CRC.GenPolyData.SBV.Examples.CRC.ParityData.SBV.Examples.CRC.USB5%Data.SBV.Examples.PrefixSum.PrefixSum"Data.SBV.Examples.Puzzles.PowerSet%Data.SBV.Examples.Puzzles.Temperature-Data.SBV.Examples.Uninterpreted.Uninterpreted Data.SBV.TestSuite.Arrays.Memory Data.SBV.TestSuite.Basics.Higher$Data.SBV.TestSuite.Basics.ProofTestsData.SBV.TestSuite.Basics.QRem'Data.SBV.TestSuite.BitPrecise.BitTricks$Data.SBV.TestSuite.BitPrecise.LegatoData.SBV.TestSuite.CRC.CCITT#Data.SBV.TestSuite.CRC.CCITT_UnidirData.SBV.TestSuite.CRC.GenPolyData.SBV.TestSuite.CRC.ParityData.SBV.TestSuite.CRC.USB5&Data.SBV.TestSuite.PrefixSum.PrefixSum*Data.SBV.TestSuite.Polynomials.Polynomials&Data.SBV.TestSuite.Puzzles.DogCatMouse&Data.SBV.TestSuite.Puzzles.MagicSquare"Data.SBV.TestSuite.Puzzles.NQueens#Data.SBV.TestSuite.Puzzles.PowerSet!Data.SBV.TestSuite.Puzzles.Sudoku#Data.SBV.TestSuite.Puzzles.U2Bridge&Data.SBV.TestSuite.Puzzles.Temperature$Data.SBV.TestSuite.Uninterpreted.AUF.Data.SBV.TestSuite.Uninterpreted.Uninterpreted SBVTestSuite mkTestSuiteshowsAs ioShowsAsgenerateGoldCheckBooleantruefalsebnot&&&|||~&~|<+>==><=>fromBoolbAndbOrbAnybAll SFunArraySArraySymArray newArray_newArray readArray resetArray writeArray mergeArraysSymWordfreefree_literal unliteralfromCW isConcrete isSymbolicSymbolicSInt64SInt32SInt16SInt8SWord64SWord32SWord16SWord8SBoolSBVResultoutput runSymbolic Uninterpreted uninterpret Mergeable symbolicMergeiteselect BVDivisible bvQuotRem OrdSymbolic.<.>=.>.<=sminsmax EqSymbolic.==./= allDifferentallEqualoneIfbitValuesetBitToblastLEblastBElsbmsb PrettyNumhexSbinShexbinreadBinFromBits fromBitsLE fromBitsBE Splittablesplit#extend Polynomial polynomialpAddpMultpDivpModpDivModshowPolySatModelparseCWscvtModel AllSatResult SatResult ThmResult SMTResultTimeOut ProofErrorUnknown Satisfiable Unsatisfiable SMTSolvername executableoptionsengine SMTConfigverbosetiming printBasesolvergetModel displayModelsyicesEquality===ProvableforAll_forAll Predicate defaultSMTCfg verboseSMTCfg timingSMTCfgverboseTimingSMTCfgtimeoutprovesatallSatisTheoremWithinisSatisfiableWithin isTheorem isSatisfiablenumberOfModels proveWithsatWith allSatWithfastMinCorrectfastMaxCorrectoppositeSignsCorrectconditionalSetClearCorrectpowerOfTwoCorrectqueriesModelInitVals InstructionProgramExtractMostekmemory registersflagsMemoryFlags RegistersBitValueFlagFlagZFlagCRegisterRegARegXAddressgetRegsetReggetFlagsetFlagpeekpokeldxldaclcrorMrorRbccadcdexbneendlegato runLegato initMachinelegatoIsCorrectcorrectnessTheoremGF28<*>multUnitmultComm multAssoc polyDivModtestGF28CountpuzzlesolveBoardRowElemcheckdiagisMagicchunkmagicSolutionisValidnQueensPuzzlevalid dispSolutionsolveAllpuzzle0puzzle1puzzle2puzzle3puzzle4puzzle5puzzle6 allPuzzlesActionsMoveStatustimeflashlBonolEdgelAdamlLarryLocation SU2MemberTimeU2MemberLarryAdamEdgeBonobonoedgeadamlarry isU2Member crossTimeheretherestartwhereIs xferFlash xferPerson bumpTime1 bumpTime2whenSmove1move2runsolveNsolveU2AfthmproveThmSExprS_AppS_NumS_Con parseSExpr showTDifftimeIfdeepseq-1.1.0.2Control.DeepSeqNFDataOneZerobool2Bitbit2Bool HUnit-1.2.2.3Test.HUnit.Base~:assertTestCaseTestList TestLabelTesttestTest.HUnit.Lang Assertionghc-primGHC.BoolBoolbaseGHC.ListandoranyallCacheduncache ArrayIndexStaterctrrinpsroutsrtblMapspgm rconstMaprexprMap rArrayMaprUIMapUIMapArrayMap ArrayInfoTableMapCnstMapExprMap ArrayContext ArrayMerge ArrayMutate ArrayInit ArrayFree NamedSymVarPgmHasSignAndSizesizeOfhasSignshowTypeSBVExprSBVAppOpArrReadArrEqLkUpJoinRorRolShrShlNotXOrOrAndIte GreaterEqLessEq GreaterThanLessThanNotEqualEqualRemQuotMinusTimesPlusSBVTypeSWNodeIdSizeCWW1W8W16W32W64I8I16I32I64wcToI64wcToI32wcToI16wcToI8wcToW64wcToW32wcToW16wcToW8wcToW1falseSWtrueSWliftCWliftCW2mapCWmapCW2reorderincCtrnewUninterpretednewConst getTableIndex mkConstCWnewExprsbvToSWmkSymSBV declNewSArraycacheGHC.RealIntegralRealGHC.EnumEnumquotRem GHC.ClassesEqOrd GHC.OrderingOrderingmaxminliftSym1liftSym2 liftSym2B liftSym1Bool liftSym2Bool mkSymOpSCmkSymOp mkSymOp1SCmkSymOp1 Data.BitstestBitsetBitclearBitliftQRemshexsbinpads2s16genSplitgenJoin fromBinLEcheckAndConvertcheckAndConvertSignedliftliftCliftSspaddPolyitespolyMultdegreemdpidxdivx Data.MaybeNothingGHC.ShowShow SMTEngine resultConfig GHC.TypesInt showSMTResultshM pipeProcessstandardSolver SMTLibPgmaddNonEqConstraintstoSMTLibmkTable declArraydeclUI mkFormulanonEqsnonEqdeclcvtAsgncvtCnstcvtCWnegIf mkMinBoundrotshftcvtExpcvtType sortByNodeId interpretgetCounterExample isComment checkTheoremcheckSatisfiable callSolver generateTraceGHC.IntInt8Int16Int32Int64GHC.WordWordWord8Word16Word32Word64rotateRrotateLshiftRshiftLisSignedbitSize complementBitbitrotateshift complementxor.|..&.Bitsrawwaw wcommutesGood wcommutesBadteststest0test1test2test3test4test5f1f2f3f4f5 testSuiteBf11f12f21f22f31f32f33tf1eqf2f1eqf3f3eqf4f1SingleqremSWord48 extendDatamkFramecrc diffCountcrcGoodhw4has84Inhabitantshw4 nonUnidir crcUniGood ccitHDis3 ccitHDis4mkPolywaitForgenPolyfindHD3PolynomialsparityisOddcountparityOKSWord11S11 mkSWord11usbGood PowerListtiePLzipPLunzipPLpsfl flIsCorrectthm1thm2 genPowerSetpowerSetTempd2frevOfgp0p1p2