h&FD      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    !!!!!!!!!""######$$$$$%%%&&&&&'''((((((((((((((((((((((((((((((((((((((((((((()))))))))))))**************************************+,,,,,--------.....................////0012223333444444444444444444445555556678888888888888888888888888999:::::::;<==>>>>>>>>>>>>>>>>>>>>>>>>>>>>>?@ABCCCCCCCCCCCCCDDDDDDDDDDDDDDEEEEEEEEEEEEEEEEEEFFFFFFFFFFFFFGGGGGGGGGGGGGGGGGGGGGGGGGGGHHHHHHHHHHHHHIIIIIIIIIIJJJJKLLLLLLLLLLLMMMNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNOOOOOOOOOOOOOOOOOOOOOOPPPPPPPPPPPPPPPPPPPPPPPPQQQQQQQQQQQRSSSSSSSSTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTUUUVWWWWWWWWWWWWWWWWXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXYYZZ[[[[[[[[\\\\\\\\\\\\\\\\\\\\\\\\\]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]^^__``aaaabbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccdddeeeeeeeeeeeeeeeffgghhhhhhhhhhhhiiiiiiiiiiijjjjjjjjjjkkkkkkkkkkkkkkkkklllllllllllllllllllmmmmmmmmmmmmmmmmmmmmmmmnnnnnnnnnnnnnnnnnnnnnnnooooooooooooooooooooooopppppppppppppppppppppppqqqqqqqqqqqqqqqqqqqqqrrrrrrrrrrrrrrrrrrrrs(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredOM/sbvSMT-Lib logics. If left unspecified SBV will pick the logic based on what it determines is needed. However, the user can override this choice using a call to t This is especially handy if one is experimenting with custom logics that might be supported on new solvers. See  'http://smtlib.cs.uiowa.edu/logics.shtml for the official list.sbvFormulas over the theory of linear integer arithmetic and arrays extended with free sort and function symbols but restricted to arrays with integer indices and values.sbvLinear formulas with free sort and function symbols over one- and two-dimentional arrays of integer index and real value.sbvFormulas with free function and predicate symbols over a theory of arrays of arrays of integer index and real value.sbv*Linear formulas in linear real arithmetic.sbvQuantifier-free formulas over the theory of bitvectors and bitvector arrays.sbvQuantifier-free formulas over the theory of bitvectors and bitvector arrays extended with free sort and function symbols.sbvQuantifier-free linear formulas over the theory of integer arrays extended with free sort and function symbols.sbvQuantifier-free formulas over the theory of arrays with extensionality. sbvQuantifier-free formulas over the theory of fixed-size bitvectors. sbvDifference Logic over the integers. Boolean combinations of inequations of the form x - y < b where x and y are integer variables and b is an integer constant. sbvUnquantified linear integer arithmetic. In essence, Boolean combinations of inequations between linear polynomials over integer variables. sbvUnquantified linear real arithmetic. In essence, Boolean combinations of inequations between linear polynomials over real variables. sbv#Quantifier-free integer arithmetic.sbv Quantifier-free real arithmetic.sbvDifference Logic over the reals. In essence, Boolean combinations of inequations of the form x - y < b where x and y are real variables and b is a rational constant.sbvUnquantified formulas built over a signature of uninterpreted (i.e., free) sort and function symbols.sbvUnquantified formulas over bitvectors with uninterpreted sort function and symbols.sbvDifference Logic over the integers (in essence) but with uninterpreted sort and function symbols.sbvUnquantified linear integer arithmetic with uninterpreted sort and function symbols.sbvUnquantified linear real arithmetic with uninterpreted sort and function symbols.sbvUnquantified non-linear real arithmetic with uninterpreted sort and function symbols.sbvUnquantified non-linear real integer arithmetic with uninterpreted sort and function symbols.sbvLinear real arithmetic with uninterpreted sort and function symbols.sbvNon-linear integer arithmetic with uninterpreted sort and function symbols.sbvQuantifier-free formulas over the theory of floating point numbers, arrays, and bit-vectors.sbvQuantifier-free formulas over the theory of floating point numbers.sbvQuantifier-free finite domains.sbv4Quantifier-free formulas over the theory of strings.sbvThe catch-all value.sbv=Use this value when you want SBV to simply not set the logic.sbv(In case you need a really custom string! sbvOption values that can be set in the solver, following the SMTLib specification  )http://smtlib.cs.uiowa.edu/language.shtml.3Note that not all solvers may support all of these!Furthermore, SBV doesn't support the following options allowed by SMTLib.:interactive-mode+ (Deprecated in SMTLib, use " instead.):print-success (SBV critically needs this to be True in query mode.):produce-models (SBV always sets this option so it can extract models.):regular-output-channel (SBV always requires regular output to come on stdout for query purposes.):global-declarations (SBV always uses global declarations since definitions are accumulative.) Note that , and - are, strictly speaking, not SMTLib options. However, we treat it as such here uniformly, as it fits better with how options work..sbv(Collectable information from the solver.8sbvReason for reporting unknown.=sbv"Behavior of the solver for errors.@sbv(Collectable information from the solver.Isbv Result of a u or v call.Jsbv=Satisfiable: A model is available, which can be queried with w.KsbvDelta-satisfiable: A delta-sat model is available. String is the precision info, if available.LsbvUnsatisfiable: No model is available. Unsat cores might be obtained via x.Msbv Unknown: Use y5 to obtain an explanation why this might be the case.sbv7Can this command only be run at the very beginning? If  then we will reject setting these options in the query mode. Note that this classification follows the SMTLib document.sbvCan this option be set multiple times? I'm only making a guess here. If this returns True, then we'll only send the last instance we see. We might need to update as necessary.sbvTranslate an option setting to SMTLib. Note the SetLogic/SetInfo discrepancy.sbvShow instance for unknownsbvTrivial rnf instance  !"#$%&'()*+,-./0123456789:;<=>?@GEABCDFHIJKLMz(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredXNsbv4Conversion from internal rationals to Haskell valuesOsbv'Root of a polynomial, cannot be reducedPsbvAn exact rationalQsbvAn approximated valueRsbv*Interval. Can be open/closed on both ends.SsbvA univariate polynomial, represented simply as a coefficient list. For instance, "5x^3 + 2x - 5" is represented as [(5, 3), (2, 1), (-5, 0)]UsbvAlgebraic reals. Note that the representation is left abstract. We represent rational results explicitly, while the roots-of-polynomials are represented implicitly by their defining equationVsbvbool says it's exact (i.e., SMT-solver did not return it with ? at the end.)Wsbvwhich root of this polynomial and an approximate decimal representation with given precision, if availableXsbv"interval, with low and high boundsYsbv)Is the endpoint included in the interval?Zsbv%open: i.e., doesn't include the point[sbv closed: i.e., includes the point\sbv7Extract the point associated with the open-closed pointsbv3Check whether a given argument is an exact rationalsbvConstruct a poly-root real with a given approximate value (either as a decimal, or polynomial-root)sbvStructural equality for AlgReal; used when constants are Map keyssbvStructural comparisons for AlgReal; used when constants are Map keyssbv Render an U as an SMTLib2 value. Only supports rationals for the time being.sbv Render an U as a Haskell value. Only supports rationals, since there is no corresponding standard Haskell type that can represent root-of-polynomial variety.]sbv Convert an U to a  . If the U is exact, then you get a  value. Otherwise, you get a ( value which is simply an approximation.sbvMerge the representation of two algebraic reals, one assumed to be in polynomial form, the other in decimal. Arguments can be the same kind, so long as they are both rationals and equivalent; if not there must be one that is precise. It's an error to pass anything else to this function! (Used in reconstructing SMT counter-example values with reals).sbvNB: Following the other types we have, we require `a/0` to be `0` for all a.NOPQRSTUVWXYZ[\]{(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredY^sbvNames reserved by SMTLib. This list is current as of Dec 6 2015; but of course there's no guarantee it'll stay that way.^|(c) Brian SchroederBSD3erkokl@gmail.com experimental Safe-Inferred\_sbvMonads which support  operations and can extract all 2 behavior for interoperation with functions like }~, which takes an  action in negative position. This function can not be implemented for transformers like  ReaderT r or StateT s, whose resultant 6 actions are a function of some environment or state.`sbv Law: the m a yielded by  is pure with respect to .sbvIO extraction for strict .sbvIO extraction for lazy .sbvIO extraction for .sbvIO extraction for .sbvTrivial IO extraction for ._`(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferreda sbvWe have a nasty issue with the usual String/List confusion in Haskell. However, we can do a simple dynamic trick to determine where we are. The ice is thin here, but it seems to work.sbvMonadic lift over 2-tuplessbvMonadic lift over 3-tuplessbvMonadic lift over 4-tuplessbvMonadic lift over 5-tuplessbvMonadic lift over 6-tuplessbvMonadic lift over 7-tuplessbvMonadic lift over 8-tuplessbvGiven a sequence of arguments, join them together in a manner that could be used on the command line, giving preference to the Windows cmd shell quoting conventions.For an alternative version, intended for actual running the result in a shell, see "System.Process.showCommandForUser"sbvGiven a string, split into the available arguments. The inverse of #. Courtesy of the cmdargs package.sbvGiven an SMTLib string (i.e., one that works in the string theory), convert it to a Haskell equivalentsbvGiven a Haskell string, convert it to SMTLib. if ord is 0x00020 to 0x0007E, then we print it as is to cover the printable ASCII range. (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred(16<oasbvRounding mode to be used for the IEEE floating-point operations. Note that Haskell's default is b. If you use a different rounding mode, then the counter-examples you get may not match what you observe in Haskell.bsbvRound to nearest representable floating point value. If precisely at half-way, pick the even number. (In this context, even% means the lowest-order bit is zero.)csbvRound to nearest representable floating point value. If precisely at half-way, pick the number further away from 0. (That is, for positive values, pick the greater; for negative values, pick the smaller.)dsbvRound towards positive infinity. (Also known as rounding-up or ceiling.)esbvRound towards negative infinity. (Also known as rounding-down or floor.)fsbv/Round towards zero. (Also known as truncation.)gsbvA valid float has restrictions on eb/sb values. NB. In the below encoding, I found that CPP is very finicky about substitution of the machine-dependent macros. If you try to put the conditionals in the same line, it fails to substitute for some reason. Hence the awkward spacing. Filed this as a bug report for CPPHS at  1https://github.com/malcolmwallace/cpphs/issues/25.sbvCatch an invalid FP.hsbv9Type family to create the appropriate non-zero constraintsbvCatch 0-width casesisbvA class for capturing values that have a sign and a size (finite or infinite) minimal complete definition: kindOf, unless you can take advantage of the default signature: This class can be automatically derived for data-types that have a  instance; this is useful for creating uninterpreted sorts. So, in reality, end users should almost never need to define any methods.~sbvKind of symbolic valuesbv;A version of show for kinds that says Bool instead of SBoolsbvPut parens if necessary. This test is rather crummy, but seems to work oksbvHow the type maps to SMT landsbv+Does this kind represent a signed quantity?sbvConstruct an uninterpreted/enumerated kind from a piece of data; we distinguish simple enumerations as those are mapped to proper SMT-Lib2 data-types; while others go completely uninterpretedsbvGrab the bit-size from the proxy. If the nat is too large to fit in an int, we throw an error. (This would mean too big of a bit-size, that we can't really deal with in any practical realm.) In fact, even the range allowed by this conversion (i.e., the entire range of a 64-bit int) is just impractical, but it's hard to come up with a better bound.sbvDo we have a completely uninterpreted sort lying around anywhere?sbvShould we ask the solver to flatten the output? This comes in handy so output is parseable Essentially, we're being conservative here and simply requesting flattening anything that has some structure to it.sbv;Convert a rounding mode to the format SMT-Lib2 understands.sbvThe interesting about the show instance is that it can tell apart two kinds nicely; since it conveniently ignores the enumeration constructors. Also, when we construct a <, we make sure we don't use any of the reserved names; see  for details.sbvThis instance allows us to use the `kindOf (Proxy @a)` idiom instead of the `kindOf (undefined :: a)`, which is safer and looks more idiomatic.sbva kind5abcdefghijklmnopqrstuvwxyz{|}~(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredwi sbvThe SMT-Lib (in particular Z3) implementation for min/max for floats does not agree with Haskell's; and also it does not agree with what the hardware does. Sigh.. See:  ,http://ghc.haskell.org/trac/ghc/ticket/10378  'http://github.com/Z3Prover/z3/issues/68 So, we codify here what the Z3 (SMTLib) is implementing for fpMax. The discrepancy with Haskell is that the NaN propagation doesn't work in Haskell The discrepancy with x86 is that given +0/-0, x86 returns the second argument; SMTLib is non-deterministicsbv SMTLib compliant definition for . See the comments for .sbv.Convert double to float and back. Essentially fromRational . toRational, except careful on NaN, Infinities, and -0.sbvCompute the "floating-point" remainder function, the float/double value that remains from the division of x and y. There are strict rules around 0's, Infinities, and NaN's as coded below.sbvConvert a float to the nearest integral representable in that typesbvCheck that two floats are the exact same values, i.e., +0/-0 does not compare equal, and NaN's compare equal to themselves.sbv$Ordering for floats, avoiding the +0-0NaN issues. Note that this is essentially used for indexing into a map, so we need to be total. Thus, the order we pick is: NaN -oo -0 +0 +oo The placement of NaN here is questionable, but immaterial.sbvCheck if a number is "normal." Note that +0/-0 is not considered a normal-number and also this is not simply the negation of isDenormalized!sbvReinterpret-casts a  to a .sbvReinterpret-casts a  to a .sbvReinterpret-casts a  to a .sbvReinterpret-casts a  to a . (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred 1\ sbv1Internal representation of a parameterized float.A note on cardinality: If we have eb exponent bits, and sb significand bits, then the total number of floats is 2^sb*(2^eb-1) + 3: All exponents except 11..11 is allowed. So we get, 2^eb-1, different combinations, each with a sign, giving us 2^sb*(2^eb-1) totals. Then we have two infinities, and one NaN, adding 3 more.sbvAbbreviation for IEEE quadruble precision float, bit width 128 = 15 + 113.sbvAbbreviation for IEEE double precision float, bit width 64 = 11 + 53.sbvAbbreviation for IEEE single precision float, bit width 32 = 8 + 24.sbvAbbreviation for brain-float precision float, bit width 16 = 8 + 8.sbvAbbreviation for IEEE half precision float, bit width 16 = 5 + 11.sbvA floating point value, indexed by its exponent and significand sizes.An IEEE SP is FloatingPoint 8 24 DP is FloatingPoint 11 53 etc.sbvRemove redundant p+0 etc.sbvShow a big float in the base given. NB. Do not be tempted to use BF.showFreeMin below; it produces arguably correct but very confusing results. See  0https://github.com/GaloisInc/cryptol/issues/1089! for a discussion of the issues.sbvDefault options for BF options.sbv,Construct a float, by appropriately roundingsbvConvert from an signexponentmantissa representation to a float. The values are the integers representing the bit-patterns of these values, i.e., the raw representation. We assume that these integers fit into the ranges given, i.e., no overflow checking is done here.sbvMake NaN. Exponent is all 1s. Significand is non-zero. The sign is irrelevant.sbv4Make Infinity. Exponent is all 1s. Significand is 0.sbvMake a signed zero.sbvMake from an integer value.sbv/Make a generalized floating-point value from a .sbv"Represent the FP in SMTLib2 formatsbv4Structural comparison only, for internal map indexessbv!Compute the signum of a big floatsbvEncode from exponent/mantissa form to a float representation. Corresponds to  in Haskell.sbvLift a unary operation, simple case of function with no status. Here, we call fpFromBigFloat since the big-float isn't size aware.sbvConvert from a IEEE float.sbvConvert from a IEEE double.sbvReal-frac instance for big-floats. Beware, not that well tested!sbv;Real instance for big-floats. Beware, not that well tested!sbvReal-float instance for big-floats. Beware! Some of these aren't really all that well tested.sbv Floating instance for big-floatssbv"Fractional instance for big-floatssbvNum instance for big-floatssbvNum instance for FloatingPointsbvShow instance for Floats. By default we print in base 10, with standard scientific notation.(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred.sbvA simple expression type over extended values, covering infinity, epsilon and intervals.sbvA generalized CV allows for expressions involving infinite and epsilon values/intervals Used in optimization problems.sbv represents a concrete word of a fixed size: For signed words, the most significant digit is considered to be the sign.sbvA constant valuesbvAlgebraic realsbvBit-vector/unbounded integersbvFloatsbvDoublesbvArbitrary floatsbvRationalsbv CharactersbvStringsbvListsbv$Set. Can be regular or complemented.sbvValue of an uninterpreted/user kind. The Maybe Int shows index position for enumerationssbvTuplesbvMaybesbvDisjoint unionsbvA  is either a regular set or a set given by its complement from the corresponding universal set.sbvStructural equality for  . We need EqOrd instances for $ because we want to put them in mapstables. But we don't want to derive these, nor make it an instance! Why? Because the same set can have multiple representations if the underlying type is finite. For instance, {True} = U - {False} for boolean sets! Instead, we use the following two functions, which are equivalent to Eq/Ord instances and work for our purposes, but we do not export these to the user.sbv Comparing  values. See comments for  on why we don't define the  instance.sbvAssign a rank to constant values, this is structural and helps with orderingsbv*Show an extended CV, with kind if requiredsbvIs this a regular CV?sbvAre two CV's of the same type?sbvConvert a CV to a Haskell boolean (NB. Assumes input is well-kinded)sbvNormalize a CV. Essentially performs modular arithmetic to make sure the value can fit in the given bit-size. Note that this is rather tricky for negative values, due to asymmetry. (i.e., an 8-bit negative number represents values in the range -128 to 127; thus we have to be careful on the negative side.)sbvConstant False as a ,. We represent it using the integer value 0.sbvConstant True as a ,. We represent it using the integer value 1.sbv Lift a unary function through a .sbv!Lift a binary function through a .sbvMap a unary function through a .sbv Map a binary function through a .sbv)Show a CV, with kind info if bool is Truesbv(Create a constant word from an integral.sbv"Generate a random constant value () of the correct kind.sbv"Generate a random constant value () of the correct kind.sbvShow instance. Regular sets are shown as usual. Complements are shown "U -" notation.sbv-Ord instance for VWVal. Same comments as the % instance why this cannot be derived.sbvEq instance for CVVal. Note that we cannot simply derive Eq/Ord, since CVAlgReal doesn't have proper instances for these when values are infinitely precise reals. However, we do need a structural eq/ord for Map indexes; so define custom ones here:sbvShow instance for .sbv~ instance for CVsbv"Show instance, shows with the kindsbvKind instance for Extended CVsbvShow instance for Generalized sbv~ instance for generalized CV2(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredsbv2Specify how to save timing information, if at all.sbvShow  in human readable form.  is essentially picoseconds (10^-12 seconds). We show it so that it's represented at the day:hour:minute:second.XXX granularity.(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred"'()*68;<sbvQuery execution contextsbvTriggered from inside SBVsbvTriggered from user codesbv An SMT solversbvThe solver in usesbvThe path to its executablesbvEach line sent to the solver will be passed through this function (typically id)sbv Options to provide to the solversbv=The solver engine, responsible for interpreting solver outputsbv"Various capabilities of the solversbvSolvers that SBV is aware ofsbv An SMT enginesbv%A script, to be passed to the solver.sbv Initial feedsbv'Continuation script, to extract resultssbvThe result of an SMT solver call. Each constructor is tagged with the  that created it so that further tools can inspect it and build layers of results, if needed. For ordinary uses of the library, this type should not be needed, instead use the accessor functions on it. (Custom Show instances and model extractors.)sbvUnsatisfiable. If unsat-cores are enabled, they will be returned in the second parameter.sbvSatisfiable with modelsbv= NaN, and so-forth. So, we have to make sure we don't optimize floats and doubles, in case the argument turns out to be NaN.sbv)Predicate to check if a value is concretesbvPredicate for optimizing word operations like (+) and (*). NB. We specifically do *not* match for Double/Float; because FP-arithmetic doesn't obey traditional rules. For instance, 0 * x = 0 fails if x happens to be NaN or +/- Infinity. So, we merely return False when given a floating-point value here.sbvPredicate for optimizing word operations like (+) and (*). NB. See comment on 6 for why we don't match for Float/Double values here.sbvPredicate for optimizing bitwise operations. The unbounded integer case of checking against -1 might look dubious, but that's how Haskell treats % as a member of the Bits class, try (-1 :: Integer)  i for any i and you'll get .sbv%Predicate for optimizing comparisons.sbv%Predicate for optimizing comparisons.sbvMost operations on concrete rationals require a compatibility check to avoid faulting on algebraic reals.sbv;Quot/Rem operations require a nonzero check on the divisor.sbv'Same as rationalCheck, except for SBV'ssbvGiven a composite structure, figure out how to compare for less thansbvStructural less-than for tuplessbvStructural less-than for maybessbvStructural less-than for eithersbv Convert an  to an , preserving the bit-correspondence. Note that since the representation for NaNs are not unique, this function will return a symbolic value when given a concrete NaN.Implementation note: Since there's no corresponding function in SMTLib for conversion to bit-representation due to partiality, we use a translation trick by allocating a new word variable, converting it to float, and requiring it to be equivalent to the input. In code-generation mode, we simply map it to a simple conversion.sbv Convert an  to an , preserving the bit-correspondence. Note that since the representation for NaNs are not unique, this function will return a symbolic value when given a concrete NaN.Implementation note: Since there's no corresponding function in SMTLib for conversion to bit-representation due to partiality, we use a translation trick by allocating a new word variable, converting it to float, and requiring it to be equivalent to the input. In code-generation mode, we simply map it to a simple conversion.sbvConvert a float to the word containing the corresponding bit pattern(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred12;<=Jsbv+Arrays implemented in terms of SMT-arrays: 2http://smtlib.cs.uiowa.edu/theories-ArraysEx.shtmlMaps directly to SMT-lib arraysReading from an uninitialized value is OK. If the default value is given in , it will be the result. Otherwise, the read yields an uninterpreted constant.&Can check for equality of these arrays:Cannot be used in code-generation (i.e., compilation to C)"Cannot quick-check theorems using SArray valuessbvArrays of symbolic values An  array a b! is an array indexed by the type  a, with elements of type  b.If a default value is supplied, then all the array elements will be initialized to this value. Otherwise, they will be left unspecified, i.e., a read from an unwritten location will produce an uninterpreted constant.The reason for this class is rather historic. In the past, SBV provided two different kinds of arrays: an  abstraction that mapped directly to SMTLib arrays (which is still available today), and a functional notion of arrays that used internal caching, called  SFunArray. The latter has been removed as the code turned out to be rather tricky and hard to maintain; so we only have one instance of this class. But end users can add their own instances, if needed.NB.  insists on a concrete initializer, because not having one would break referential transparency. See  -https://github.com/LeventErkok/sbv/issues/553 for details.sbvGeneralization of sbvGeneralization of sbvCreate a literal arraysbvRead the array element at asbvUpdate the element at a to be bsbv?Merge two given arrays on the symbolic condition Intuitively: ,mergeArrays cond a b = if cond then a else b=. Merging pushes the if-then-else choice down on to elementssbv+Internal function, not exported to the usersbvA  is a potential symbolic value that can be created instances of to be fed to a symbolic program.sbvGeneralization of sbv#Turn a literal constant to symbolicsbv+Extract a literal, from a CV representationsbv/Does it concretely satisfy the given predicate?sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbv+Extract a literal, if the value is concretesbvIs the symbolic word concrete?sbv%Is the symbolic word really symbolic?sbvA class representing what can be returned from a symbolic computation.sbvGeneralization of sbvActions we can do in a context: Either at problem description time or while we are dynamically querying.  and  are two instances of this class. Note that we use this mechanism internally and do not export it from SBV.sbvAdd a constraint, any satisfying instance must satisfy this condition.sbvAdd a soft constraint. The solver will try to satisfy this condition if possible, but won't if it cannot.sbvAdd a named constraint. The name is used in unsat-core extraction.sbv,Add a constraint, with arbitrary attributes.sbvSet info. Example: setInfo ":status" ["unsat"].sbvSet an option.sbvSet the logic.sbvAdd a user specified axiom to the generated SMT-Lib file. The first argument is a mere string, use for commenting purposes. The second argument is intended to hold the multiple-lines of the axiom text as expressed in SMT-Lib notation. Note that we perform no checks on the axiom itself, to see whether it's actually well-formed or is sensible by any means. A separate formalization of SMT-Lib would be very useful here.sbvAdd a user-defined SMTLib function. You should define the name given here as an uninterpreted value as well. SBV performs no checks on the SMTLib definition you give, so if it doesn't match the required type, or is malformed in any way, the call will fail at run-time.sbvSet a solver time-out value, in milli-seconds. This function essentially translates to the SMTLib call (set-info :timeout val), and your backend solver may or may not support it! The amount given is in milliseconds. Also see the function : for finer level control of time-outs, directly from SBV.sbv*Get the state associated with this contextsbvThe symbolic variant of asbv7Internal representation of a symbolic simulation resultsbv'SMTLib representation, given the configsbvSymbolic 8-tuple.sbvSymbolic 7-tuple.sbvSymbolic 6-tuple.sbvSymbolic 5-tuple.sbvSymbolic 4-tuple.sbvSymbolic 3-tuple.sbvSymbolic 2-tuple. NB.  and  are equivalent.sbvSymbolic 2-tuple. NB.  and  are equivalent.sbv Symbolic . Note that we use , which supports both regular sets and complements, i.e., those obtained from the universal set (of the right type) by removing elements.sbv Symbolic sbv Symbolic sbv7A symbolic list of items. Note that a symbolic list is not= a list of symbolic items, that is, it is not the case that  SList a = [a], unlike what one might expect following haskell lists/sequences. An  is a symbolic value of its own, of possibly arbitrary but finite length, and internally processed as one unit as opposed to a fixed-length list of items. Note that lists can be nested, i.e., we do allow lists of lists of ... items.sbvA symbolic rational value.sbv2A symbolic string. Note that a symbolic string is not a list of symbolic characters, that is, it is not the case that SString = [SChar]>, unlike what one might expect following Haskell strings. An  is a symbolic value of its own, of possibly arbitrary but finite length, and internally processed as one unit as opposed to a fixed-length list of characters.sbvA symbolic character. Note that this is the full unicode character set. see:  8http://smtlib.cs.uiowa.edu/theories-UnicodeStrings.shtml for details.sbvA symbolic quad-precision floatsbv!A symbolic double-precision floatsbv!A symbolic single-precision floatsbv&A symbolic brain-float precision floatsbvA symbolic half-precision floatsbv3A symbolic arbitrary precision floating point valuesbv0IEEE-754 double-precision floating point numberssbv0IEEE-754 single-precision floating point numberssbv0Infinite precision symbolic algebraic real valuesbv(Infinite precision signed symbolic valuesbv;64-bit signed symbolic value, 2's complement representationsbv;32-bit signed symbolic value, 2's complement representationsbv;16-bit signed symbolic value, 2's complement representationsbv:8-bit signed symbolic value, 2's complement representationsbv64-bit unsigned symbolic valuesbv32-bit unsigned symbolic valuesbv16-bit unsigned symbolic valuesbv8-bit unsigned symbolic valuesbvA symbolic boolean/bitsbvThe Symbolic value. The parameter a is phantom, but is extremely important in keeping the user interface strongly typed.sbvGet the current path conditionsbv4Extend the path condition with the given test value.sbvNot-A-Number for  and . Surprisingly, Haskell Prelude doesn't have this value defined, so we provide it here.sbv Infinity for  and . Surprisingly, Haskell Prelude doesn't have this value defined, so we provide it here.sbv;Symbolic variant of Not-A-Number. This value will inhabit ,  and . types.sbvSync-up the external solver with new context we have generatedsbvRetrieve the query contextsbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbv#Creating arrays, internal use only.sbvGeneralization of sbvGeneralization of sbvSend a string to the solver, and return the response. Except, if the response is one of the "ignore" ones, keep querying.sbvGeneralization of sbvGeneralization of sbvGeneralization of wsbvRegistering an uninterpreted SMT function. This is typically not necessary as uses of the UI function itself will register it automatically. But there are cases where doing this explicitly can come in handy.sbvPointwise function value extraction. If we get unlucky and can't parse z3's output (happens when we have all booleans and z3 decides to spit out an expression), just brute force our way out of it. Note that we only do this if we have a pure boolean type, as otherwise we'd blow up. And I think it'll only be necessary then, I haven't seen z3 try anything smarter in other scenarios.sbvFor saturation purposes, get a proper argument. The forall quantification is safe here since we only use in smtFunSaturate calls, which looks at the kind stored inside only.sbvGeneralization of sbvGeneralization of sbvGet the value of a term, but in CV form. Used internally. The model-index, in particular is extremely Z3 specific!sbv5"Make up" a CV for this type. Like zero, but smarter.sbv$Go from an SExpr directly to a valuesbvRecover a given solver-printed value with a possible interpretationsbvGeneralization of sbvRetrieve value from the solversbvGeneralization of sbvGeneralization of sbvGeneralization of usbvGeneralization of sbvWhat are the top level inputs? Trackers are returned as top level existentialssbvGet observables, i.e., those explicitly labeled by the user with a call to .sbvGet UIs, both constants and functions. This call returns both the before and after query ones. Generalization of . Note that if we have an defined axiom, then it is not really a UI, so we drop those.sbvReturn all satisfying models.sbvGeneralization of sbvGeneralization of sbvBail out if a parse goes badsbvGeneralization of sbv(Convert a query result to an SMT ProblemsbvGeneralization of sbvGeneric  instance for things that are  and look like containers:sbvGeneric  instance for  valuessbv as a .sbvFunctions of arity 8sbvFunctions of arity 7sbvFunctions of arity 6sbvFunctions of arity 5sbvFunctions of arity 4sbvFunctions of arity 3sbvFunctions of arity 2sbvFunctions of arity 1+(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred'(."sbv An Assignment of a model bindingsbvGeneralization of sbvGeneralization of sbvGeneralization of ysbvGeneralization of sbvGeneralization of sbvClassify a model based on whether it has unbound objectives or not.sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGet a model stored at an index. This is likely very Z3 specific!sbvJust after a check-sat is issued, collect objective values. Used internally only, not exposed to the user.sbvGeneralization of vsbvGeneralization of sbvHelper for the two variants of checkSatAssuming we have. Internal only.sbvGeneralization of sbv;Upon a pop, we need to restore all arrays and tables. See: ,http://github.com/LeventErkok/sbv/issues/374sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of xsbvRetrieve the unsat core if it was asked for in the configurationsbvGeneralization of sbvGeneralization of  . Use this version with MathSAT.sbvGeneralization of . Use this version with Z3.sbvGeneralization of sbvGeneralization of sbvMake an assignment. The type 1 is abstract, the result is typically passed to :  mkSMTResult [ a |-> 332 , b |-> 2.3 , c |-> True ] End users should use  for automatically constructing models from the current solver state. However, an explicit  might be handy in complex scenarios where a model needs to be created manually.sbvGeneralization of  NB. This function does not allow users to create interpretations for UI-Funs. But that's probably not a good idea anyhow. Also, if you use the  or ? features, SBV will fail on models returned via this function.  !"#$%&'()*+,-./0123456789:;<=>?@GEABCDFHIJKLM11(c) Brian Schroeder Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredxsbvRun a custom query. !"#$%&'()*+,-./01234567=>?@GEABCDFHIJKLM_`_`IJKLM@GEABCDFH=>?./01234567 !"#$%&'()*+,-(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred '/x<sbvSymbolically executable program fragments. This class is mainly used for  calls, and is sufficiently populated internally to cover most use cases. Users can extend it as they wish to allow  checks for SBV programs that return/take types that are user-defined.sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbv is specialization of  to the  monad. Unless you are using transformers explicitly, this is the type you should prefer.sbvA type a is provable if we can turn it into a predicate. Note that a predicate can be made from a curried function of arbitrary arity, where each element is either a symbolic type or up-to a 7-tuple of symbolic-types. So predicates can be constructed from almost arbitrary Haskell functions that have arbitrary shapes. (See the instance declarations below.)sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbv)Validate a model obtained from the solversbvA goal is a symbolic program that returns no values. The idea is that the constraints/min-max goals will serve as appropriate directives for sat/prove calls.sbvA predicate is a symbolic program that returns a (symbolic) boolean value. For all intents and purposes, it can be treated as an n-ary function from symbolic-values to a boolean. The  monad captures the underlying representation, and can/should be ignored by the users of the library, unless you are building further utilities on top of SBV itself. Instead, simply use the  type when necessary.sbvIf supported, this makes all output go to stdout, which works better with SBV Alas, not all solvers support it..sbvDefault configuration for the ABC synthesis and verification tool.sbv2Default configuration for the Boolector SMT solversbv1Default configuration for the Bitwuzla SMT solversbv.Default configuration for the CVC4 SMT Solver.sbv.Default configuration for the CVC5 SMT Solver.sbv/Default configuration for the Yices SMT Solver.sbv0Default configuration for the MathSAT SMT solversbv/Default configuration for the Yices SMT Solver.sbv+Default configuration for the Z3 SMT solversbvMinimal complete definition: None, if the type is instance of Generic . Otherwise . Note that most types subject to merging are likely to be trivial instances of Generic.sbvMerge two values based on the condition. The first argument states whether we force the then-and-else branches before the merging, at the word level. This is an efficiency concern; one that we'd rather not make but unfortunately necessary for getting symbolic simulation working efficiently.sbvTotal indexing operation. select xs default index is intuitively the same as  xs !! index, except it evaluates to default if index underflows/overflows.sbvThe  class captures the essence of division. Unfortunately we cannot use Haskell's  class since the  and  superclasses are not implementable for symbolic bit-vectors. However,  and " both make perfect sense, and the  class captures this operation. One issue is how division by 0 behaves. The verification technology requires total functions, and there are several design choices here. We follow Isabelle/HOL approach of assigning the value 0 for division by 0. Therefore, we impose the following pair of laws:  x  0 = (0, x) x  0 = (0, x) 5Note that our instances implement this law even when x is 0 itself.NB.  truncates toward zero, while $ truncates toward negative infinity.(C code generation of division operationsIn the case of division or modulo of a minimal signed value (e.g. -128 for ) by -1, SMTLIB and Haskell agree on what the result should be. Unfortunately the result in C code depends on CPU architecture and compiler settings, as this is undefined behaviour in C. **SBV does not guarantee** what will happen in generated C code in this corner case.sbv;Finite bit-length symbolic values. Essentially the same as , but further leaves out . Loosely based on Haskell's  FiniteBits class, but with more methods defined and structured differently to fit into the symbolic world view. Minimal complete definition: .sbv Bit size.sbv:Least significant bit of a word, always stored at index 0.sbvMost significant bit of a word, always stored at the last position.sbv,Big-endian blasting of a word into its bits.sbv/Little-endian blasting of a word into its bits.sbv4Reconstruct from given bits, given in little-endian.sbv4Reconstruct from given bits, given in little-endian.sbvReplacement for  , returning  instead of .sbv Variant of 2, where we want to extract multiple bit positions.sbv Variant of , returning a symbolic value.sbv A combo of  and %, when the bit to be set is symbolic.sbvFull adder, returns carry-out from the addition. Only for unsigned quantities.sbvFull multiplier, returns both high and low-order bits. Only for unsigned quantities.sbv9Count leading zeros in a word, big-endian interpretation.sbv:Count trailing zeros in a word, big-endian interpretation.sbvSymbolic Numbers. This is a simple class that simply incorporates all number like base types together, simplifying writing polymorphic type-signatures that work for all symbolic numbers, such as ,  etc. For instance, we can write a generic list-minimum function as follows:  mm :: SIntegral a => [SBV a] -> SBV a mm = foldr1 (a b -> ite (a .<= b) a b) It is similar to the standard / class, except ranging over symbolic instances.sbv!Symbolic Comparisons. Similar to  , we cannot implement Haskell's + class since there is no way to return an 1 value from a symbolic comparison. Furthermore,  requires  to implement if-then-else, for the benefit of implementing symbolic versions of  and  functions.sbvSymbolic less than.sbvSymbolic less than or equal to.sbvSymbolic greater than.sbv"Symbolic greater than or equal to.sbvSymbolic minimum.sbvSymbolic maximum.sbv Is the value within the allowed  inclusive range?sbv4Symbolic Equality. Note that we can't use Haskell's  class since Haskell insists on returning Bool Comparing symbolic values will necessarily return a symbolic value.sbvSymbolic equality.sbvSymbolic inequality.sbvStrong equality. On floats (/0), strong equality is object equality; that is  NaN == NaN holds, but +0 == -0 doesn't. On other types, (.===) is simply (.==). Note that (.==) is the right notion of equality for floats per IEEE754 specs, since by definition +0 == -0 and NaN equals no other value including itself. But occasionally we want to be stronger and state NaN equals NaN and +0 and -0 are different from each other. In a context where your type is concrete, simply use . But in a polymorphic context, use the strong equality instead.NB. If you do not care about or work with floats, simply use (.==) and (./=).sbvNegation of strong equality. Equaivalent to negation of (.===) on all types.sbvReturns (symbolic) 5 if all the elements of the given list are different.sbvReturns (symbolic)  if all the elements of the given list are different. The second list contains exceptions, i.e., if an element belongs to that set, it will be considered distinct regardless of repetition.sbvReturns (symbolic) 4 if all the elements of the given list are the same.sbvSymbolic membership test.sbv!Symbolic negated membership test.sbvIdentify tuple like things. Note that there are no methods, just instances to control type inferencesbv+Generate a finite symbolic bitvector, namedsbv-Generate a finite symbolic bitvector, unnamedsbv$Generate a finite constant bitvectorsbv'Convert a constant to an integral valuesbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvGeneralization of sbvConvert an SReal to an SInteger. That is, it computes the largest integer n that satisfies sIntegerToSReal n <= r essentially giving us the floor.For instance, 1.3 will be 1, but -1.3 will be -2.sbvlabel: Label the result of an expression. This is essentially a no-op, but useful as it generates a comment in the generated C/SMT-Lib code. Note that if the argument is a constant, then the label is dropped completely, per the usual constant folding strategy. Compare this to . which is good for printing counter-examples.sbv$Check if an observable name is good.sbvObserve the value of an expression, if the given condition holds. Such values are useful in model construction, as they are printed part of a satisfying model, or a counter-example. The same works for quick-check as well. Useful when we want to see intermediate values, or expected/obtained pairs in a particular run. Note that an observed expression is always symbolic, i.e., it won't be constant folded. Compare this to  which is used for putting a label in the generated SMTLib-C code.sbv9Observe the value of an expression, unconditionally. See  for a generalized version.sbvA variant of observe that you can use at the top-level. This is useful with quick-check, for instance.sbvReturns 1 if the boolean is , otherwise 0.sbv+Lift a pseudo-boolean op, performing checkssbv if at most k of the input arguments are sbv if at least k of the input arguments are sbv if exactly k of the input arguments are sbv if the sum of coefficients for  elements is at most k. Generalizes .sbv if the sum of coefficients for  elements is at least k. Generalizes .sbv if the sum of coefficients for  elements is exactly least k. Useful for coding exactly K-of-N2 constraints, and in particular mutex constraints.sbv if there is at most one set bitsbv if there is exactly one set bitsbvConvert a concrete pseudo-boolean to given int; converting to integersbv:Predicate for optimizing word operations like (+) and (*).sbv:Predicate for optimizing word operations like (+) and (*).sbvSymbolic exponentiation using bit blasting and repeated squaring.N.B. The exponent must be unsigned/bounded if symbolic. Signed exponents will be rejected.sbv&Lift a 1 arg FP-op, using sRNE defaultsbv7Lift a float/double unary function, only over constantssbv8Lift a float/double binary function, only over constantssbvLift an sreal unary functionsbvLift an sreal binary functionsbv?Conversion between integral-symbolic values, akin to Haskell's sbvLift a binary operation thru it's dynamic counterpart. Note that we still want the actual functions here as differ in their type compared to their dynamic counterparts, but the implementations are the same.sbvGeneralization of 6, when the shift-amount is symbolic. Since Haskell's  only takes an  as the shift amount, it cannot be used when we have a symbolic amount to shift with.sbvGeneralization of 6, when the shift-amount is symbolic. Since Haskell's  only takes an  as the shift amount, it cannot be used when we have a symbolic amount to shift with.NB. If the shiftee is signed, then this is an arithmetic shift; otherwise it's logical, following the usual Haskell convention. See  for a variant that explicitly uses the msb as the sign bit, even for unsigned underlying types.sbvArithmetic shift-right with a symbolic unsigned shift amount. This is equivalent to  when the argument is signed. However, if the argument is unsigned, then it explicitly treats its msb as a sign-bit, and uses it as the bit that gets shifted in. Useful when using the underlying unsigned bit representation to implement custom signed operations. Note that there is no direct Haskell analogue of this function.sbvGeneralization of 6, when the shift-amount is symbolic. Since Haskell's  only takes an  as the shift amount, it cannot be used when we have a symbolic amount to shift with. The first argument should be a bounded quantity.sbvAn implementation of rotate-left, using a barrel shifter like design. Only works when both arguments are finite bitvectors, and furthermore when the second argument is unsigned. The first condition is enforced by the type, but the second is dynamically checked. We provide this implementation as an alternative to  since SMTLib logic does not support variable argument rotates (as opposed to shifts), and thus this implementation can produce better code for verification compared to .sbvGeneralization of 6, when the shift-amount is symbolic. Since Haskell's  only takes an  as the shift amount, it cannot be used when we have a symbolic amount to shift with. The first argument should be a bounded quantity.sbvAn implementation of rotate-right, using a barrel shifter like design. See comments for  for details.sbv*Helper function for use in enum operationssbvLift 2 to symbolic words. Division by 0 is defined s.t. x/0 = 0; which holds even when x is 0 itself.sbvLift 2 to symbolic words. Division by 0 is defined s.t. x/0 = 0; which holds even when x is 0 itself. Essentially, this is conversion from quotRem (truncate to 0) to divMod (truncate towards negative infinity)sbv$If-then-else. This is by definition  with both branches forced. This is typically the desired behavior, but also see  should you need more laziness.sbvA Lazy version of ite, which does not force its arguments. This might cause issues for symbolic simulation with large thunks around, so use with care.sbvSymbolic assert. Check that the given boolean condition is always  in the given path. The optional first argument can be used to provide call-stack info via GHC's location facilities.sbv#Merge two symbolic values, at kind k , possibly force'ing the branches to make sure they do not evaluate to the same result. This should only be used for internal purposes; as default definitions provided should suffice in many cases. (i.e., End users should only need to define 2 when needed; which should be rare to start with.)sbv?Construct a useful error message if we hit an unmergeable case.sbv6Merge concrete values that can be checked for equalitysbvNot exported. Symbolic merge using the generic representation provided by .sbv(Add an axiom. Only used internally, use  from user programs which works over both regular and query modes of usage.sbvGeneralization of sbvGeneralization of sbvGeneralization of sbv1Quick check an SBV property. Note that a regular  quickCheck call will work just as well. Use this variant if you want to receive the boolean result.sbvExplicit sharing combinator. The SBV library has internal caching/hash-consing mechanisms built in, based on Andy Gill's type-safe observable sharing technique (see:  =http://ku-fpg.github.io/files/Gill-09-TypeSafeReification.pdf). However, there might be times where being explicit on the sharing can help, especially in experimental code. The  combinator ensures that its first argument is computed once and passed on to its continuation, explicitly indicating the intent of sharing. Most use cases of the SBV library should simply use Haskell's let construct for this purpose.sbvSymbolic computations provide a context for writing symbolic programs.sbvUsing  or 6 on non-concrete values will result in an error. Use  or  instead.sbvSReal Floating instance, used in conjunction with the dReal solver for delta-satisfiability. Note that we do not constant fold these values (except for pi), as Haskell doesn't really have any means of computing them for arbitrary rationals.sbv We give a specific instance for , because the underlying floating-point type doesn't support fromRational directly. The overlap with the above instance is unfortunate.sbvDefine Floating instance on SBV's; only for base types that are already floating; i.e., , , and *. (See the separate definition below for +.) Note that unless you use delta-sat via  on , most of the fields are "undefined" for symbolic values. We will add methods as they are supported by SMTLib. Currently, the only symbolically available function in this class is  for ,  and .sbvSymVal for 8-tuplessbvSymVal for 7-tuplessbvSymVal for 6-tuplessbvSymVal for 5-tuplessbvSymVal for 4-tuplessbvSymVal for 3-tuplessbvSymVal for 2-tuplessbvSymVal for 0-tuple (i.e., unit)sbvRegular expressions can be compared for equality. Note that we diverge here from the equality in the concrete sense; i.e., the Eq instance does not match the symbolic case. This is a bit unfortunate, but unavoidable with the current design of how we "distinguish" operators. Hopefully shouldn't be a big deal, though one should be careful.sbvIf comparison is over something SMTLib can handle, just translate it. Otherwise desugar. 444444444 -(c) Joel Burget Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred 1<sbv tuple @(Integer, Bool, (String, Char)) (untuple p) .== pQ.E.D.sbvConstructing a tuple from its parts. Forms an isomorphism pair with :prove $ \p -> untuple @(Integer, Bool, (String, Char)) (tuple p) .== pQ.E.D.sbv The class 4 captures the notion that a type has a certain fieldsbv Field labelssbvField access, inspired by the lens library. This is merely reverse application, but allows us to write things like  (1, 2)^._1 which is likely to be familiar to most Haskell programmers out there. Note that this is precisely equivalent to  _1 (1, 2)', but perhaps it reads a little nicer.sbvDynamic interface to exporting tuples, this function is not exported on purpose; use it only via the field functions , , etc.sbvAccess the 1st element of an STupleN,  2 <= N <= 8 . Also see .sbvAccess the 2nd element of an STupleN,  2 <= N <= 8 . Also see .sbvAccess the 3rd element of an STupleN,  3 <= N <= 8 . Also see .sbvAccess the 4th element of an STupleN,  4 <= N <= 8 . Also see .sbvAccess the 5th element of an STupleN,  5 <= N <= 8 . Also see .sbvAccess the 6th element of an STupleN,  6 <= N <= 8 . Also see .sbvAccess the 7th element of an STupleN,  7 <= N <= 8 . Also see .sbvAccess the 8th element of an STupleN,  8 <= N <= 8 . Also see .  8 (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred@sbvA symbolic tree containing values of type e, indexed by elements of type i. Note that these are full-trees, and their their shapes remain constant. There is no API provided that can change the shape of the tree. These structures are useful when dealing with data-structures that are indexed with symbolic values where access time is important. 7 structures provide logarithmic time reads and writes.sbvReading a value. We bit-blast the index and descend down the full tree according to bit-values.sbvWriting a value, similar to how reads are done. The important thing is that the tree representation keeps updates to a minimum.sbvConstruct the fully balanced initial tree using the given values. -(c) Joel Burget Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred"Z>#sbvLength of a string.sat $ \s -> length s .== 2Satisfiable. Model: s0 = "BA" :: Stringsat $ \s -> length s .< 0 Unsatisfiable=prove $ \s1 s2 -> length s1 + length s2 .== length (s1 ++ s2)Q.E.D.sbv s is True iff the string is empty(prove $ \s -> null s .<=> length s .== 0Q.E.D."prove $ \s -> null s .<=> s .== ""Q.E.D.sbv returns the head of a string. Unspecified if the string is empty.&prove $ \c -> head (singleton c) .== cQ.E.D.sbv returns the tail of a string. Unspecified if the string is empty.-prove $ \h s -> tail (singleton h ++ s) .== sQ.E.D.prove $ \s -> length s .> 0 .=> length (tail s) .== length s - 1Q.E.D.prove $ \s -> sNot (null s) .=> singleton (head s) ++ tail s .== sQ.E.D.sbv@ returns the pair of the first character and tail. Unspecified if the string is empty.sbv returns all but the last element of the list. Unspecified if the string is empty.-prove $ \c t -> init (t ++ singleton c) .== tQ.E.D.sbv c is the string of length 1 that contains the only character whose value is the 8-bit value c.7prove $ \c -> c .== literal 'A' .=> singleton c .== "A"Q.E.D.(prove $ \c -> length (singleton c) .== 1Q.E.D.sbv s offset. Substring of length 1 at offset in s*. Unspecified if offset is out of bounds.prove $ \s1 s2 -> strToStrAt (s1 ++ s2) (length s1) .== strToStrAt s2 0Q.E.D.sat $ \s -> length s .>= 2 .&& strToStrAt s 0 ./= strToStrAt s (length s - 1)Satisfiable. Model: s0 = "AB" :: Stringsbv s i' is the 8-bit value stored at location i). Unspecified if index is out of bounds.prove $ \i -> i .>= 0 .&& i .<= 4 .=> "AAAAA" `strToCharAt` i .== literal 'A'Q.E.D.>>> prove $ s i c -> i  (0, length s - 1) .&& s 2 i .== c .=> indexOf s (singleton c) .<= i Q.E.D.sbvShort cut for sbv cs is the string of length |cs| containing precisely those characters. Note that there is no corresponding function explode:, since we wouldn't know the length of a symbolic string.8prove $ \c1 c2 c3 -> length (implode [c1, c2, c3]) .== 3Q.E.D.prove $ \c1 c2 c3 -> map (strToCharAt (implode [c1, c2, c3])) (map literal [0 .. 2]) .== [c1, c2, c3]Q.E.D.sbv$Prepend an element, the traditional cons.sbvAppend an elementsbvEmpty string. This value has the property that it's the only string with length 0:+prove $ \l -> length l .== 0 .<=> l .== nilQ.E.D.sbv"Concatenate two strings. See also .sbvShort cut for .sat $ \x y z -> length x .== 5 .&& length y .== 1 .&& x ++ y ++ z .== "Hello world!"Satisfiable. Model: s0 = "Hello" :: String s1 = " " :: String s2 = "world!" :: Stringsbv sub s. Does s contain the substring sub?4prove $ \s1 s2 s3 -> s2 `isInfixOf` (s1 ++ s2 ++ s3)Q.E.D.prove $ \s1 s2 -> s1 `isInfixOf` s2 .&& s2 `isInfixOf` s1 .<=> s1 .== s2Q.E.D.sbv pre s. Is pre a prefix of s?,prove $ \s1 s2 -> s1 `isPrefixOf` (s1 ++ s2)Q.E.D.prove $ \s1 s2 -> s1 `isPrefixOf` s2 .=> subStr s2 0 (length s1) .== s1Q.E.D.sbv suf s. Is suf a suffix of s?,prove $ \s1 s2 -> s2 `isSuffixOf` (s1 ++ s2)Q.E.D.prove $ \s1 s2 -> s1 `isSuffixOf` s2 .=> subStr s2 (length s2 - length s1) (length s1) .== s1Q.E.D.sbv len s. Corresponds to Haskell's  on symbolic-strings.3prove $ \s i -> i .>= 0 .=> length (take i s) .<= iQ.E.D.sbv len s. Corresponds to Haskell's  on symbolic-strings..prove $ \s i -> length (drop i s) .<= length sQ.E.D.*prove $ \s i -> take i s ++ drop i s .== sQ.E.D.sbv s offset len is the substring of s at offset offset with length len. This function is under-specified when the offset is outside the range of positions in s or len is negative or  offset+len exceeds the length of s.prove $ \s i -> i .>= 0 .&& i .< length s .=> subStr s 0 i ++ subStr s i (length s - i) .== sQ.E.D.+sat $ \i j -> subStr "hello" i j .== "ell"Satisfiable. Model: s0 = 1 :: Integer s1 = 3 :: Integer)sat $ \i j -> subStr "hell" i j .== "no" Unsatisfiablesbv s src dst". Replace the first occurrence of src by dst in sprove $ \s -> replace "hello" s "world" .== "world" .=> s .== "hello"Q.E.D.prove $ \s1 s2 s3 -> length s2 .> length s1 .=> replace s1 s2 s3 .== s1Q.E.D.sbv s sub. Retrieves first position of sub in s, -1- if there are no occurrences. Equivalent to  s sub 0.!>>> prove $ s i -> i .> 0 .&& i . lengths .=' indexOf s (subStr s i 1) .<= i Q.E.D.prove $ \s1 s2 -> length s2 .> length s1 .=> indexOf s1 s2 .== -1Q.E.D.sbv s sub offset. Retrieves first position of sub at or after offset in s, -1 if there are no occurrences.9prove $ \s sub -> offsetIndexOf s sub 0 .== indexOf s subQ.E.D.prove $ \s sub i -> i .>= length s .&& length sub .> 0 .=> offsetIndexOf s sub i .== -1Q.E.D.prove $ \s sub i -> i .> length s .=> offsetIndexOf s sub i .== -1Q.E.D.sbv s reverses the string. >>> sat $ s -> reverse s .== "abc" Satisfiable. Model: s0 = "cba" :: String >>> prove $ s -> reverse s .== "" . = null s Q.E.D.sbv s%. Retrieve integer encoded by string s (ground rewriting only). Note that by definition this function only works when s only contains digits, that is, if it encodes a natural number. Otherwise, it returns '-1'.prove $ \s -> let n = strToNat s in length s .== 1 .=> (-1) .<= n .&& n .<= 9Q.E.D.sbv i%. Retrieve string encoded by integer i (ground rewriting only). Again, only naturals are supported, any input that is not a natural number produces empty string, even though we take an integer as an argument.5prove $ \i -> length (natToStr i) .== 3 .=> i .<= 999Q.E.D.sbv#Lift a unary operator over strings.sbv$Lift a binary operator over strings.sbv%Lift a ternary operator over strings.sbv!Concrete evaluation for unary opssbv"Concrete evaluation for binary opssbv#Concrete evaluation for ternary opssbv%Is the string concretely known empty?55 (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredy_sbv Empty set.empty :: SSet Integer{} :: {SInteger}sbv Full set.full :: SSet IntegerU :: {SInteger}Note that the universal set over a type is represented by the letter U.sbv Synonym for .sbvSingleton list.singleton 2 :: SSet Integer{2} :: {SInteger}sbvConversion from a list.fromList ([] :: [Integer]){} :: {SInteger}fromList [1,2,3]{1,2,3} :: {SInteger}fromList [5,5,5,12,12,3]{3,5,12} :: {SInteger}sbv Complement.+empty .== complement (full :: SSet Integer)True2Complementing twice gets us back the original set:?prove $ \(s :: SSet Integer) -> complement (complement s) .== sQ.E.D.sbvInsert an element into a set.Insertion is order independent:prove $ \x y (s :: SSet Integer) -> x `insert` (y `insert` s) .== y `insert` (x `insert` s)Q.E.D.5Deletion after insertion is not necessarily identity:prove $ \x (s :: SSet Integer) -> x `delete` (x `insert` s) .== sFalsifiable. Counter-example: s0 = 2 :: Integer s1 = {2} :: {Integer}But the above is true if the element isn't in the set to start with:prove $ \x (s :: SSet Integer) -> x `notMember` s .=> x `delete` (x `insert` s) .== sQ.E.D.'Insertion into a full set does nothing:6prove $ \x -> insert x full .== (full :: SSet Integer)Q.E.D.sbvDelete an element from a set.Deletion is order independent:prove $ \x y (s :: SSet Integer) -> x `delete` (y `delete` s) .== y `delete` (x `delete` s)Q.E.D.5Insertion after deletion is not necessarily identity:prove $ \x (s :: SSet Integer) -> x `insert` (x `delete` s) .== sFalsifiable. Counter-example: s0 = 2 :: Integer s1 = {} :: {Integer}But the above is true if the element is in the set to start with:prove $ \x (s :: SSet Integer) -> x `member` s .=> x `insert` (x `delete` s) .== sQ.E.D.(Deletion from an empty set does nothing:8prove $ \x -> delete x empty .== (empty :: SSet Integer)Q.E.D.sbvTest for membership.2prove $ \x -> x `member` singleton (x :: SInteger)Q.E.D.;prove $ \x (s :: SSet Integer) -> x `member` (x `insert` s)Q.E.D./prove $ \x -> x `member` (full :: SSet Integer)Q.E.D.sbvTest for non-membership.prove $ \x -> x `notMember` observe "set" (singleton (x :: SInteger))Falsifiable. Counter-example: set = {0} :: {Integer} s0 = 0 :: Integer>prove $ \x (s :: SSet Integer) -> x `notMember` (x `delete` s)Q.E.D.3prove $ \x -> x `notMember` (empty :: SSet Integer)Q.E.D.sbvIs this the empty set?null (empty :: SSet Integer)True9prove $ \x -> null (x `delete` singleton (x :: SInteger))Q.E.D.#prove $ null (full :: SSet Integer) FalsifiableNote how we have to call  in the last case since dealing with infinite sets requires a call to the solver and cannot be constant folded. sbv Synonym for . sbvIs this the full set?&prove $ isFull (empty :: SSet Integer) Falsifiableprove $ \x -> isFull (observe "set" (x `delete` (full :: SSet Integer)))Falsifiable. Counter-example: set = U - {2} :: {Integer} s0 = 2 :: IntegerisFull (full :: SSet Integer)TrueNote how we have to call  in the first case since dealing with infinite sets requires a call to the solver and cannot be constant folded. sbv Synonym for  . sbvDoes the set have the given size? It implicitly asserts that the set it is operating on is finite. NB. Only z3 supported this call, and as discussed in  )http://github.com/Z3Prover/z3/issues/3854, recent versions of z3 doesn't support size calls either. So, you can only use this if you have a sufficiently old version of z3.=prove $ \i -> hasSize (empty :: SSet Integer) i .== (i .== 0)Q.E.D.,sat $ \i -> hasSize (full :: SSet Integer) i UnsatisfiableThe following tests are commented out since z3 no longer supports size: >>> prove $ \a b i j k -> hasSize (a :: SSet Integer) i .&& hasSize (b :: SSet Integer) j .&& hasSize (a `union` b) k .=> k .>= i `smax` j Q.E.D. >>> prove $ \a b i j k -> hasSize (a :: SSet Integer) i .&& hasSize (b :: SSet Integer) j .&& hasSize (a `intersection` b) k .=> k .<= i `smin` j Q.E.D. >>> prove $ \a k -> hasSize (a :: SSet Integer) k .=> k .>= 0 Q.E.D. sbv Subset test.1prove $ empty `isSubsetOf` (full :: SSet Integer)Q.E.D.?prove $ \x (s :: SSet Integer) -> s `isSubsetOf` (x `insert` s)Q.E.D.?prove $ \x (s :: SSet Integer) -> (x `delete` s) `isSubsetOf` sQ.E.D. sbvProper subset test.7prove $ empty `isProperSubsetOf` (full :: SSet Integer)Q.E.D.prove $ \x (s :: SSet Integer) -> s `isProperSubsetOf` (x `insert` s)Falsifiable. Counter-example: s0 = 2 :: Integer s1 = U :: {Integer}prove $ \x (s :: SSet Integer) -> x `notMember` s .=> s `isProperSubsetOf` (x `insert` s)Q.E.D.prove $ \x (s :: SSet Integer) -> (x `delete` s) `isProperSubsetOf` sFalsifiable. Counter-example: s0 = 2 :: Integer s1 = U - {2,3} :: {Integer}prove $ \x (s :: SSet Integer) -> x `member` s .=> (x `delete` s) `isProperSubsetOf` sQ.E.D. sbvDisjoint test..disjoint (fromList [2,4,6]) (fromList [1,3])True2disjoint (fromList [2,4,6,8]) (fromList [2,3,5,7])False2disjoint (fromList [1,2]) (fromList [1,2,3,4])False9prove $ \(s :: SSet Integer) -> s `disjoint` complement sQ.E.D./allSat $ \(s :: SSet Integer) -> s `disjoint` s Solution #1: s0 = {} :: {Integer}This is the only solution.The last example is particularly interesting: The empty set is the only set where   is not reflexive!Note that disjointness of a set from its complement is guaranteed by the fact that all types are inhabited; an implicit assumption we have in classic logic which is also enjoyed by Haskell due to the presence of bottom! sbvUnion.union (fromList [1..10]) (fromList [5..15]) .== (fromList [1..15] :: SSet Integer)True=prove $ \(a :: SSet Integer) b -> a `union` b .== b `union` aQ.E.D.prove $ \(a :: SSet Integer) b c -> a `union` (b `union` c) .== (a `union` b) `union` cQ.E.D.7prove $ \(a :: SSet Integer) -> a `union` full .== fullQ.E.D.5prove $ \(a :: SSet Integer) -> a `union` empty .== aQ.E.D.?prove $ \(a :: SSet Integer) -> a `union` complement a .== fullQ.E.D. sbvUnions. Equivalent to    .-prove $ unions [] .== (empty :: SSet Integer)Q.E.D. sbv Intersection.intersection (fromList [1..10]) (fromList [5..15]) .== (fromList [5..10] :: SSet Integer)Trueprove $ \(a :: SSet Integer) b -> a `intersection` b .== b `intersection` aQ.E.D.prove $ \(a :: SSet Integer) b c -> a `intersection` (b `intersection` c) .== (a `intersection` b) `intersection` cQ.E.D.;prove $ \(a :: SSet Integer) -> a `intersection` full .== aQ.E.D.prove $ \(a :: SSet Integer) -> a `intersection` empty .== emptyQ.E.D.prove $ \(a :: SSet Integer) -> a `intersection` complement a .== emptyQ.E.D.prove $ \(a :: SSet Integer) b -> a `disjoint` b .=> a `intersection` b .== emptyQ.E.D. sbvIntersections. Equivalent to    . Note that Haskell's  does not support this operation as it does not have a way of representing universal sets.3prove $ intersections [] .== (full :: SSet Integer)Q.E.D. sbv Difference.>prove $ \(a :: SSet Integer) -> empty `difference` a .== emptyQ.E.D.:prove $ \(a :: SSet Integer) -> a `difference` empty .== aQ.E.D.prove $ \(a :: SSet Integer) -> full `difference` a .== complement aQ.E.D.:prove $ \(a :: SSet Integer) -> a `difference` a .== emptyQ.E.D. sbv Synonym for  .   9 (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred{ sbvConstruct a symbolic rational from a given numerator and denominator. Note that it is not possible to deconstruct a rational by taking numerator and denominator fields, since we do not represent them canonically. (This is due to the fact that SMTLib has no functions to compute the GCD. One can use the maximization engine to compute the GCD of numbers, but not as a function.)   7-(c) Joel Burget Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredc sbv The symbolic .sNothing :: SMaybe IntegerNothing :: SMaybe Integer sbv'Check if the symbolic value is nothing.&isNothing (sNothing :: SMaybe Integer)True"isNothing (sJust (literal "nope"))False sbv Construct an SMaybe a from an SBV a.sJust (3 :: SInteger)Just 3 :: SMaybe Integer sbv+Check if the symbolic value is not nothing.#isJust (sNothing :: SMaybe Integer)FalseisJust (sJust (literal "yep"))True,prove $ \x -> isJust (sJust (x :: SInteger))Q.E.D. sbvReturn the value of an optional value. The default is returned if Nothing. Compare to  .(fromMaybe 2 (sNothing :: SMaybe Integer) 2 :: SInteger'fromMaybe 2 (sJust 5 :: SMaybe Integer) 5 :: SInteger fromMaybe x (sNothing :: SMaybe Integer) .== xQ.E.D.?prove $ \x -> fromMaybe (x+1) (sJust x :: SMaybe Integer) .== xQ.E.D. sbvReturn the value of an optional value. The behavior is undefined if passed Nothing, i.e., it can return any value. Compare to  .fromJust (sJust (literal 'a')) 'a' :: SChar1prove $ \x -> fromJust (sJust x) .== (x :: SChar)Q.E.D..sat $ \x -> x .== (fromJust sNothing :: SChar)Satisfiable. Model: s0 = 'A' :: CharNote how we get a satisfying assignment in the last case: The behavior is unspecified, thus the SMT solver picks whatever satisfies the constraints, if there is one. sbv Construct an SMaybe a from a  Maybe (SBV a). liftMaybe (Just (3 :: SInteger))Just 3 :: SMaybe Integer%liftMaybe (Nothing :: Maybe SInteger)Nothing :: SMaybe Integer sbv Map over the  side of a .?prove $ \x -> fromJust (map (+1) (sJust x)) .== x+(1::SInteger)Q.E.D.,let f = uninterpret "f" :: SInteger -> SBool-prove $ \x -> map f (sJust x) .== sJust (f x)Q.E.D.map f sNothing .== sNothingTrue sbvMap over two maybe values. sbvCase analysis for symbolic s. If the value  #, return the default value; if it  , apply the function.*maybe 0 (`sMod` 2) (sJust (3 :: SInteger)) 1 :: SInteger/maybe 0 (`sMod` 2) (sNothing :: SMaybe Integer) 0 :: SInteger,let f = uninterpret "f" :: SInteger -> SBool+prove $ \x d -> maybe d f (sJust x) .== f xQ.E.D.&prove $ \d -> maybe d f sNothing .== dQ.E.D. sbvCustom  instance over  -(c) Joel Burget Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred#;# sbvLength of a list.,sat $ \(l :: SList Word16) -> length l .== 2Satisfiable. Model: s0 = [0,0] :: [Word16]+sat $ \(l :: SList Word16) -> length l .< 0 Unsatisfiableprove $ \(l1 :: SList Word16) (l2 :: SList Word16) -> length l1 + length l2 .== length (l1 ++ l2)Q.E.D. sbv  s is True iff the list is empty:prove $ \(l :: SList Word16) -> null l .<=> length l .== 0Q.E.D.4prove $ \(l :: SList Word16) -> null l .<=> l .== []Q.E.D. sbv  returns the first element of a list. Unspecified if the list is empty.4prove $ \c -> head (singleton c) .== (c :: SInteger)Q.E.D. sbv > returns the tail of a list. Unspecified if the list is empty.;prove $ \(h :: SInteger) t -> tail (singleton h ++ t) .== tQ.E.D.prove $ \(l :: SList Integer) -> length l .> 0 .=> length (tail l) .== length l - 1Q.E.D.prove $ \(l :: SList Integer) -> sNot (null l) .=> singleton (head l) ++ tail l .== lQ.E.D. sbv  returns the pair of the head and tail. Unspecified if the list is empty. sbv  returns all but the last element of the list. Unspecified if the list is empty.;prove $ \(h :: SInteger) t -> init (t ++ singleton h) .== tQ.E.D. sbv  x6 is the list of length 1 that contains the only value x.4prove $ \(x :: SInteger) -> head (singleton x) .== xQ.E.D.6prove $ \(x :: SInteger) -> length (singleton x) .== 1Q.E.D. sbv  l offset. List of length 1 at offset in l). Unspecified if index is out of bounds.prove $ \(l1 :: SList Integer) l2 -> listToListAt (l1 ++ l2) (length l1) .== listToListAt l2 0Q.E.D.sat $ \(l :: SList Word16) -> length l .>= 2 .&& listToListAt l 0 ./= listToListAt l (length l - 1)Satisfiable. Model: s0 = [0,32] :: [Word16] sbv  l i! is the value stored at location i). Unspecified if index is out of bounds.prove $ \i -> i `inRange` (0, 4) .=> [1,1,1,1,1] `elemAt` i .== (1::SInteger)Q.E.D.*>>> prove $ (l :: SList Integer) i e -> i  (0, length l - 1) .&& l  2 i .== e .=> indexOf l (singleton e) .<= i Q.E.D. sbvShort cut for  sbv  es is the list of length |es| containing precisely those elements. Note that there is no corresponding function explode8, since we wouldn't know the length of a symbolic list.prove $ \(e1 :: SInteger) e2 e3 -> length (implode [e1, e2, e3]) .== 3Q.E.D.prove $ \(e1 :: SInteger) e2 e3 -> map (elemAt (implode [e1, e2, e3])) (map literal [0 .. 2]) .== [e1, e2, e3]Q.E.D. sbv Concatenate two lists. See also  . sbv$Prepend an element, the traditional cons. sbvAppend an element sbvEmpty list. This value has the property that it's the only list with length 0:>prove $ \(l :: SList Integer) -> length l .== 0 .<=> l .== nilQ.E.D. sbvShort cut for  .sat $ \x y z -> length x .== 5 .&& length y .== 1 .&& x ++ y ++ z .== [1 .. 12]Satisfiable. Model:$ s0 = [1,2,3,4,5] :: [Integer]$ s1 = [6] :: [Integer]$ s2 = [7,8,9,10,11,12] :: [Integer] sbv  e l. Does l contain the element e? sbv  e l. Does l not contain the element e? sbv  sub l. Does l contain the subsequence sub?prove $ \(l1 :: SList Integer) l2 l3 -> l2 `isInfixOf` (l1 ++ l2 ++ l3)Q.E.D.prove $ \(l1 :: SList Integer) l2 -> l1 `isInfixOf` l2 .&& l2 `isInfixOf` l1 .<=> l1 .== l2Q.E.D. sbv  pre l. Is pre a prefix of l??prove $ \(l1 :: SList Integer) l2 -> l1 `isPrefixOf` (l1 ++ l2)Q.E.D.prove $ \(l1 :: SList Integer) l2 -> l1 `isPrefixOf` l2 .=> subList l2 0 (length l1) .== l1Q.E.D. sbv  suf l. Is suf a suffix of l?>prove $ \(l1 :: SList Word16) l2 -> l2 `isSuffixOf` (l1 ++ l2)Q.E.D.prove $ \(l1 :: SList Word16) l2 -> l1 `isSuffixOf` l2 .=> subList l2 (length l2 - length l1) (length l1) .== l1Q.E.D. sbv  len l. Corresponds to Haskell's   on symbolic lists.prove $ \(l :: SList Integer) i -> i .>= 0 .=> length (take i l) .<= iQ.E.D. sbv  len s. Corresponds to Haskell's   on symbolic-lists.prove $ \(l :: SList Word16) i -> length (drop i l) .<= length lQ.E.D. take i l ++ drop i l .== lQ.E.D. sbv  s offset len is the sublist of s at offset offset with length len. This function is under-specified when the offset is outside the range of positions in s or len is negative or  offset+len exceeds the length of s.prove $ \(l :: SList Integer) i -> i .>= 0 .&& i .< length l .=> subList l 0 i ++ subList l i (length l - i) .== lQ.E.D.?sat $ \i j -> subList [1..5] i j .== ([2..4] :: SList Integer)Satisfiable. Model: s0 = 1 :: Integer s1 = 3 :: Integer?sat $ \i j -> subList [1..5] i j .== ([6..7] :: SList Integer) Unsatisfiable sbv  l src dst". Replace the first occurrence of src by dst in sprove $ \l -> replace [1..5] l [6..10] .== [6..10] .=> l .== ([1..5] :: SList Word8)Q.E.D.prove $ \(l1 :: SList Integer) l2 l3 -> length l2 .> length l1 .=> replace l1 l2 l3 .== l1Q.E.D. sbv  l sub. Retrieves first position of sub in l, -1- if there are no occurrences. Equivalent to   l sub 0.1>>> prove $ (l :: SList Int8) i -> i .> 0 .&& i . lengthl .=( indexOf l (subList l i 1) .<= i Q.E.D.prove $ \(l1 :: SList Word16) l2 -> length l2 .> length l1 .=> indexOf l1 l2 .== -1Q.E.D. sbv  l sub offset. Retrieves first position of sub at or after offset in l, -1 if there are no occurrences.prove $ \(l :: SList Int8) sub -> offsetIndexOf l sub 0 .== indexOf l subQ.E.D.prove $ \(l :: SList Int8) sub i -> i .>= length l .&& length sub .> 0 .=> offsetIndexOf l sub i .== -1Q.E.D.prove $ \(l :: SList Int8) sub i -> i .> length l .=> offsetIndexOf l sub i .== -1Q.E.D. sbv  s reverses the sequence. >>> sat $ (l :: SList Integer) -> reverse l .== literal [3, 2, 1] Satisfiable. Model: s0 = [1,2,3] :: [Integer] >>> prove $ (l :: SList Word32) -> reverse l .== [] . = null l Q.E.D.sbv!Lift a unary operator over lists.sbv"Lift a binary operator over lists.sbv#Lift a ternary operator over lists.sbv!Concrete evaluation for unary opssbv"Concrete evaluation for binary opssbv#Concrete evaluation for ternary opssbv#Is the list concretely known empty?   5 5-(c) Joel Burget Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred sbv Construct an  SEither a b from an SBV asLeft 3 :: SEither Integer BoolLeft 3 :: SEither Integer Bool sbvReturn  if the given symbolic value is ,  otherwise(isLeft (sLeft 3 :: SEither Integer Bool)True-isLeft (sRight sTrue :: SEither Integer Bool)False sbv Construct an  SEither a b from an SBV b%sRight sFalse :: SEither Integer Bool#Right False :: SEither Integer Bool sbvReturn  if the given symbolic value is ,  otherwise)isRight (sLeft 3 :: SEither Integer Bool)False.isRight (sRight sTrue :: SEither Integer Bool)True sbv Construct an  SEither a b from an Either (SBV a) (SBV b),liftEither (Left 3 :: Either SInteger SBool)Left 3 :: SEither Integer Bool1liftEither (Right sTrue :: Either SInteger SBool)"Right True :: SEither Integer Bool sbvCase analysis for symbolic s. If the value  #, apply the first function; if it  , apply the second function.either (*2) (*3) (sLeft 3) 6 :: SIntegereither (*2) (*3) (sRight 3) 9 :: SInteger/let f = uninterpret "f" :: SInteger -> SInteger/let g = uninterpret "g" :: SInteger -> SInteger*prove $ \x -> either f g (sLeft x) .== f xQ.E.D.+prove $ \x -> either f g (sRight x) .== g xQ.E.D. sbv"Map over both sides of a symbolic  at the same time/let f = uninterpret "f" :: SInteger -> SInteger/let g = uninterpret "g" :: SInteger -> SInteger4prove $ \x -> fromLeft (bimap f g (sLeft x)) .== f xQ.E.D.6prove $ \x -> fromRight (bimap f g (sRight x)) .== g xQ.E.D. sbvMap over the left side of an /let f = uninterpret "f" :: SInteger -> SIntegerprove $ \x -> first f (sLeft x :: SEither Integer Integer) .== sLeft (f x)Q.E.D.prove $ \x -> first f (sRight x :: SEither Integer Integer) .== sRight xQ.E.D. sbvMap over the right side of an /let f = uninterpret "f" :: SInteger -> SIntegerprove $ \x -> second f (sRight x :: SEither Integer Integer) .== sRight (f x)Q.E.D.prove $ \x -> second f (sLeft x :: SEither Integer Integer) .== sLeft xQ.E.D. sbvReturn the value from the left component. The behavior is undefined if passed a right value, i.e., it can return any value.6fromLeft (sLeft (literal 'a') :: SEither Char Integer) 'a' :: SCharprove $ \x -> fromLeft (sLeft x :: SEither Char Integer) .== (x :: SChar)Q.E.D.?sat $ \x -> x .== (fromLeft (sRight 4 :: SEither Char Integer))Satisfiable. Model: s0 = 'A' :: CharNote how we get a satisfying assignment in the last case: The behavior is unspecified, thus the SMT solver picks whatever satisfies the constraints, if there is one. sbvReturn the value from the right component. The behavior is undefined if passed a left value, i.e., it can return any value.8fromRight (sRight (literal 'a') :: SEither Integer Char) 'a' :: SCharprove $ \x -> fromRight (sRight x :: SEither Char Integer) .== (x :: SInteger)Q.E.D.sat $ \x -> x .== (fromRight (sLeft (literal 'a') :: SEither Char Integer))Satisfiable. Model: s0 = 0 :: IntegerNote how we get a satisfying assignment in the last case: The behavior is unspecified, thus the SMT solver picks whatever satisfies the constraints, if there is one. (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred 1, sbv3A symbolic signed bit-vector carrying its size info sbv*A signed bit-vector carrying its size info sbv5A symbolic unsigned bit-vector carrying its size info sbv-An unsigned bit-vector carrying its size info sbvGeneralization of sbvGeneralization of  sbvGeneralization of  sbvGeneralization of sbvGeneralization of  sbvGeneralization of  sbv7Extract a portion of bits to form a smaller bit-vector. sbvJoin two bitvectors. sbvZero extend a bit-vector. sbvSign extend a bit-vector. sbv'Drop bits from the top of a bit-vector. sbv'Take bits from the top of a bit-vector.sbv Optimizing  sbvConstructing models for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv  has a kindsbvShow instance for  sbv instance for  sbv Optimizing  sbvConstructing models for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv instance for  sbv  has a kindsbvShow instance for  sbv instance for   sbvi : Start position, numbered from n-1 to 0sbvj: End position, numbered from n-1 to 0, j <= i must holdsbvInput bit vector of size nsbvOutput is of size  i - j + 1 sbvFirst input, of size n, becomes the left sidesbvSecond input, of size m, becomes the right sidesbvConcatenation, of size n+m sbvInput, of size nsbvOutput, of size m. n < m must hold sbvInput, of size nsbvOutput, of size m. n < m must hold sbvi: Number of bits to drop. i < n must hold.sbvInput, of size nsbvOutput, of size m.  m = n - i holds. sbvi: Number of bits to take.  0 < i <= n must hold.sbvInput, of size nsbvOutput, of size i    5(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred 1 sbvImplements polynomial addition, multiplication, division, and modulus operations over GF(2^n). NB. Similar to , division by 0 is interpreted as follows: x   0 = (0, x)for all x (including 0)Minimal complete definition:  ,  ,  sbvGiven bit-positions to be set, create a polynomial For instance polynomial [0, 1, 3] :: SWord8will evaluate to 11, since it sets the bits 0, 1, and 31. Mathematicians would write this polynomial as  x^3 + x + 1. And in fact,   will show it like that. sbvAdd two polynomials in GF(2^n). sbvMultiply two polynomials in GF(2^n), and reduce it by the irreducible specified by the polynomial as specified by coefficients of the third argument. Note that the third argument is specifically left in this form as it is usually in GF(2^(n+1)), which is not available in our formalism. (That is, we would need SWord9 for SWord8 multiplication, etc.) Also note that we do not support symbolic irreducibles, which is a minor shortcoming. (Most GF's will come with fixed irreducibles, so this should not be a problem in practice.)Passing [] for the third argument will multiply the polynomials and then ignore the higher bits that won't fit into the resulting size. sbvDivide two polynomials in GF(2^n), see above note for division by 0. sbvCompute modulus of two polynomials in GF(2^n), see above note for modulus by 0. sbv%Division and modulus packed together. sbvDisplay a polynomial like a mathematician would (over the monomial x), with a type. sbvDisplay a polynomial like a mathematician would (over the monomial x), the first argument controls if the final type is shown as well.sbvPretty print as a polynomial sbvAdd two polynomials sbvRun down a boolean condition over two lists. Note that this is different than zipWith as shorter list is assumed to be filled with sFalse at the end (i.e., zero-bits); which nicely pads it when considered as an unsigned number in little-endian form.sbvMultiply two polynomials and reduce by the third (concrete) irreducible, given by its coefficients. See the remarks for the   function for this design choice sbv8Compute modulus/remainder of polynomials on bit-vectors. sbv(Compute CRCs over bit-vectors. The call  crcBV n m p" computes the CRC of the message m with respect to polynomial p. The inputs are assumed to be blasted big-endian. The number n5 specifies how many bits of CRC is needed. Note that n+ is actually the degree of the polynomial p, and thus it seems redundant to pass it in. However, in a typical proof context, the polynomial can be symbolic, so we cannot compute the degree easily. While this can be worked-around by generating code that accounts for all possible degrees, the resulting code would be unnecessarily big and complicated, and much harder to reason with. (Also note that a CRC is just the remainder from the polynomial division, but this routine is much faster in practice.)NB. The nth bit of the polynomial p must be set for the CRC to be computed correctly. Note that the polynomial argument p will not even have this bit present most of the time, as it will typically contain bits 0 through n-13 as usual in the CRC literature. The higher order nth bit is simply assumed to be set, as it does not make sense to use a polynomial of a lesser degree. This is usually not a problem since CRC polynomials are designed and expressed this way.NB. The literature on CRC's has many variants on how CRC's are computed. We follow the following simple procedure:Extend the message m by adding n 0 bits on the right+Divide the polynomial thus obtained by the pThe remainder is the CRC value.There are many variants on final XOR's, reversed polynomials etc., so it is essential to double check you use the correct  algorithm. sbvCompute CRC's over polynomials, i.e., symbolic words. The first 0 argument plays the same role as the one in the   function.  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred ٝ! sbvA class of checked-arithmetic operations. These follow the usual arithmetic, except make calls to  to ensure no overflow/underflow can occur. Use them in conjunction with " to ensure no overflow can happen. sbvDetecting underflow/overflow conditions. For each function, the first result is the condition under which the computation underflows, and the second is the condition under which it overflows. sbvBit-vector addition. Unsigned addition can only overflow. Signed addition can underflow and overflow.A tell tale sign of unsigned addition overflow is when the sum is less than minimum of the arguments.prove $ \x y -> snd (bvAddO x (y::SWord16)) .<=> x + y .< x `smin` yQ.E.D. sbvBit-vector subtraction. Unsigned subtraction can only underflow. Signed subtraction can underflow and overflow. sbvBit-vector multiplication. Unsigned multiplication can only overflow. Signed multiplication can underflow and overflow. sbvSame as  , except instead of doing the computation internally, it simply sends it off to z3 as a primitive. Obviously, only use if you have the z3 backend! Note that z3 provides this operation only when no logic is set, so make sure to call setLogic Logic_NONE in your program! sbvBit-vector division. Unsigned division neither underflows nor overflows. Signed division can only overflow. In fact, for each signed bitvector type, there's precisely one pair that overflows, when x is minBound and y is -1:,allSat $ \x y -> snd (x `bvDivO` (y::SInt8)) Solution #1: s0 = -128 :: Int8 s1 = -1 :: Int8This is the only solution. sbvBit-vector negation. Unsigned negation neither underflows nor overflows. Signed negation can only overflow, when the argument is minBound::prove $ \x -> x .== minBound .<=> snd (bvNegO (x::SInt16))Q.E.D.sbvZero-extend to given bitssbvSign-extend to given bits. Note that we keep the signedness of the argument.sbvGet the sign-bitsbvIs the sign-bit high?sbvIs the sign-bit low?sbvDo these have the same sign?sbvDo these have opposing signs?sbvCheck all truesbv.Are all the bits between a b (inclusive) zero?sbv-Are all the bits between a b (inclusive) one?sbv%Unsigned addition. Can only overflow.sbvSigned addition.sbv)Unsigned subtraction. Can only underflow.sbvSigned subtraction.sbv+Unsigned multiplication. Can only overflow.sbvSigned multiplication.sbvIs this a concrete value?sbv:Unsigned multiplication, fast version using z3 primitives.sbv8Signed multiplication, fast version using z3 primitives.sbv5Unsigned division. Neither underflows, nor overflows.sbv#Signed division. Can only overflow.sbv5Unsigned negation. Neither underflows, nor overflows.sbv#Signed negation. Can only overflow. sbvDetecting underflow/overflow conditions for casting between bit-vectors. The first output is the result, the second component itself is a pair with the first boolean indicating underflow and the second indicating overflow.:sFromIntegralO (256 :: SInt16) :: (SWord8, (SBool, SBool))(0 :: SWord8,(False,True))9sFromIntegralO (-2 :: SInt16) :: (SWord8, (SBool, SBool))(254 :: SWord8,(True,False))8sFromIntegralO (2 :: SInt16) :: (SWord8, (SBool, SBool))(2 :: SWord8,(False,False))prove $ \x -> sFromIntegralO (x::SInt32) .== (sFromIntegral x :: SInteger, (sFalse, sFalse))Q.E.D.)As the last example shows, converting to - never underflows or overflows for any value. sbv Version of  that has calls to > for checking no overflow/underflow can happen. Use it with a  call.   6 6 7 7(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred< sbvConversion to and from floats sbv.Convert from an IEEE74 single precision float. sbv.Convert to an IEEE-754 Single-precision float. sbv.Convert from an IEEE74 double precision float. sbv.Convert to an IEEE-754 Double-precision float. sbv)Convert from an arbitrary floating point. sbv'Convert to an arbitrary floating point. sbvA class of floating-point (IEEE754) operations, some of which behave differently based on rounding modes. Note that unless the rounding mode is concretely RoundNearestTiesToEven, we will not concretely evaluate these, but rather pass down to the SMT solver. sbv*Compute the floating point absolute value. sbv&Compute the unary negation. Note that 0 - x is not equivalent to -x for floating-point, since -0 and 0 are different. sbv c `elem` singleton cQ.E.D. prove $ \c -> sNot (c `elem` "")Q.E.D. sbv#Is the character not in the string?4prove $ \c s -> c `elem` s .<=> sNot (c `notElem` s)Q.E.D. sbvThe   of a character. sbv*Conversion from an integer to a character.8prove $ \x -> 0 .<= x .&& x .< 256 .=> ord (chr x) .== xQ.E.D.prove $ \x -> chr (ord x) .== xQ.E.D.sbvLift a char function to a symbolic version. If the given char is not in the class recognized by predicate, the output is the same as the input. Only works for the Latin1 set, i.e., the first 256 characters. If the given character is outside this range, it's returned unchanged.sbvLift a char predicate to a symbolic version. Only works for the Latin1 set, i.e., the first 256 characters. sbvConvert to lower-case. Only works for the Latin1 subset, otherwise returns its argument unchanged.5prove $ \c -> toLowerL1 (toLowerL1 c) .== toLowerL1 cQ.E.D.prove $ \c -> isLowerL1 c .&& c `notElem` "\181\255" .=> toLowerL1 (toUpperL1 c) .== cQ.E.D. sbvConvert to upper-case. Only works for the Latin1 subset, otherwise returns its argument unchanged.5prove $ \c -> toUpperL1 (toUpperL1 c) .== toUpperL1 cQ.E.D.;prove $ \c -> isUpperL1 c .=> toUpperL1 (toLowerL1 c) .== cQ.E.D. sbvConvert a digit to an integer. Works for hexadecimal digits too. If the input isn't a digit, then return -1.prove $ \c -> isDigit c .|| isHexDigit c .=> digitToInt c .>= 0 .&& digitToInt c .<= 15Q.E.D.prove $ \c -> sNot (isDigit c .|| isHexDigit c) .=> digitToInt c .== -1Q.E.D. sbv*Convert an integer to a digit, inverse of  . If the integer is out of bounds, we return the arbitrarily chosen space character. Note that for hexadecimal letters, we return the corresponding lowercase letter.prove $ \i -> i .>= 0 .&& i .<= 15 .=> digitToInt (intToDigit i) .== iQ.E.D.prove $ \i -> i .< 0 .|| i .> 15 .=> digitToInt (intToDigit i) .== -1Q.E.D.prove $ \c -> digitToInt c .== -1 .<=> intToDigit (digitToInt c) .== literal ' 'Q.E.D. sbvIs this a control character? Control characters are essentially the non-printing characters. Only works for the Latin1 subset, otherwise returns . sbvIs this white-space? Only works for the Latin1 subset, otherwise returns . sbvIs this a lower-case character? Only works for the Latin1 subset, otherwise returns .5prove $ \c -> isUpperL1 c .=> isLowerL1 (toLowerL1 c)Q.E.D. sbvIs this an upper-case character? Only works for the Latin1 subset, otherwise returns .0prove $ \c -> sNot (isLowerL1 c .&& isUpperL1 c)Q.E.D. sbvIs this an alphabet character? That is lower-case, upper-case and title-case letters, plus letters of caseless scripts and modifiers letters. Only works for the Latin1 subset, otherwise returns . sbvIs this an alphabetical character or a digit? Only works for the Latin1 subset, otherwise returns .>prove $ \c -> isAlphaNumL1 c .<=> isAlphaL1 c .|| isNumberL1 cQ.E.D. sbvIs this a printable character? Only works for the Latin1 subset, otherwise returns . sbv%Is this an ASCII digit, i.e., one of 0..9 . Note that this is a subset of   (prove $ \c -> isDigit c .=> isNumberL1 cQ.E.D. sbv%Is this an Octal digit, i.e., one of 0..7. sbv!Is this a Hex digit, i.e, one of 0..9, a..f, A..F.-prove $ \c -> isHexDigit c .=> isAlphaNumL1 cQ.E.D. sbvIs this an alphabet character. Only works for the Latin1 subset, otherwise returns .+prove $ \c -> isLetterL1 c .<=> isAlphaL1 cQ.E.D. sbvIs this a mark? Only works for the Latin1 subset, otherwise returns .Note that there are no marks in the Latin1 set, so this function always returns false!prove $ sNot . isMarkL1Q.E.D. sbvIs this a number character? Only works for the Latin1 subset, otherwise returns . sbvIs this a punctuation mark? Only works for the Latin1 subset, otherwise returns . sbvIs this a symbol? Only works for the Latin1 subset, otherwise returns . sbvIs this a separator? Only works for the Latin1 subset, otherwise returns .-prove $ \c -> isSeparatorL1 c .=> isSpaceL1 cQ.E.D. sbv;Is this an ASCII character, i.e., the first 128 characters. sbvIs this a Latin1 character? sbv*Is this an ASCII Upper-case letter? i.e., A thru Zprove $ \c -> isAsciiUpper c .<=> ord c .>= ord (literal 'A') .&& ord c .<= ord (literal 'Z')Q.E.D.;prove $ \c -> isAsciiUpper c .<=> isAscii c .&& isUpperL1 cQ.E.D. sbv*Is this an ASCII Lower-case letter? i.e., a thru zprove $ \c -> isAsciiLower c .<=> ord c .>= ord (literal 'a') .&& ord c .<= ord (literal 'z')Q.E.D.;prove $ \c -> isAsciiLower c .<=> isAscii c .&& isLowerL1 cQ.E.D.  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred"# sbv/Matchable class. Things we can match against a .For instance, you can generate valid-looking phone numbers like this::set -XOverloadedStringslet dig09 = Range '0' '9'let dig19 = Range '1' '9'"let pre = dig19 * Loop 2 2 dig09"let post = dig19 * Loop 3 3 dig09let phone = pre * "-" * post(sat $ \s -> (s :: SString) `match` phoneSatisfiable. Model: s0 = "200-8000" :: String sbv  s r checks whether s! is in the language generated by r. sbv%Match everything, universal acceptor./prove $ \(s :: SString) -> s `match` everythingQ.E.D. sbv"Match nothing, universal rejector.3prove $ \(s :: SString) -> sNot (s `match` nothing)Q.E.D. sbv.Match any character, i.e., strings of length 1prove $ \(s :: SString) -> s `match` anyChar .<=> length s .== 1Q.E.D. sbvA literal regular-expression, matching the given string exactly. Note that with OverloadedStrings extension, you can simply use a Haskell string to mean the same thing, so this function is rarely needed.prove $ \(s :: SString) -> s `match` exactly "LITERAL" .<=> s .== "LITERAL"Q.E.D. sbv#Helper to define a character class.prove $ \(c :: SChar) -> c `match` oneOf "ABCD" .<=> sAny (c .==) (map literal "ABCD")Q.E.D. sbvRecognize a newline. Also includes carriage-return and form-feed.newline=(re.union (str.to.re "\n") (str.to.re "\r") (str.to.re "\f"))/prove $ \c -> c `match` newline .=> isSpaceL1 cQ.E.D. sbvRecognize a tab.tab(str.to.re "\t")2prove $ \c -> c `match` tab .=> c .== literal '\t'Q.E.D.sbvLift a char function to a regular expression that recognizes it. sbv.Recognize white-space, but without a new line.prove $ \c -> c `match` whiteSpaceNoNewLine .=> c `match` whiteSpace .&& c ./= literal '\n'Q.E.D. sbvRecognize white space.2prove $ \c -> c `match` whiteSpace .=> isSpaceL1 cQ.E.D. sbv"Recognize a punctuation character.9prove $ \c -> c `match` punctuation .=> isPunctuationL1 cQ.E.D. sbv$Recognize an alphabet letter, i.e., A..Z, a..z. sbv$Recognize an ASCII lower case letter asciiLower(re.range "a" "z")prove $ \c -> (c :: SChar) `match` asciiLower .=> c `match` asciiLetterQ.E.D.prove $ \c -> c `match` asciiLower .=> toUpperL1 c `match` asciiUpperQ.E.D.prove $ \c -> c `match` asciiLetter .=> toLowerL1 c `match` asciiLowerQ.E.D. sbvRecognize an upper case letter asciiUpper(re.range "A" "Z")prove $ \c -> (c :: SChar) `match` asciiUpper .=> c `match` asciiLetterQ.E.D.prove $ \c -> c `match` asciiUpper .=> toLowerL1 c `match` asciiLowerQ.E.D.prove $ \c -> c `match` asciiLetter .=> toUpperL1 c `match` asciiUpperQ.E.D. sbvRecognize a digit. One of 0..9.digit(re.range "0" "9")prove $ \c -> c `match` digit .<=> let v = digitToInt c in 0 .<= v .&& v .< 10Q.E.D.7prove $ \c -> sNot ((c::SChar) `match` (digit - digit))Q.E.D. sbv!Recognize an octal digit. One of 0..7.octDigit(re.range "0" "7")prove $ \c -> c `match` octDigit .<=> let v = digitToInt c in 0 .<= v .&& v .< 8Q.E.D.?prove $ \(c :: SChar) -> c `match` octDigit .=> c `match` digitQ.E.D. sbv&Recognize a hexadecimal digit. One of 0..9, a..f, A..F.hexDigit(re.union (re.range "0" "9") (re.range "a" "f") (re.range "A" "F"))prove $ \c -> c `match` hexDigit .<=> let v = digitToInt c in 0 .<= v .&& v .< 16Q.E.D.?prove $ \(c :: SChar) -> c `match` digit .=> c `match` hexDigitQ.E.D. sbvRecognize a decimal number.decimal(re.+ (re.range "0" "9"))prove $ \s -> (s::SString) `match` decimal .=> sNot (s `match` KStar asciiLetter)Q.E.D. sbv:Recognize an octal number. Must have a prefix of the form 0o/0O.octal(re.++ (re.union (str.to.re "0o") (str.to.re "0O")) (re.+ (re.range "0" "7")))prove $ \s -> s `match` octal .=> sAny (.== take 2 s) ["0o", "0O"]Q.E.D. sbv?Recognize a hexadecimal number. Must have a prefix of the form 0x/0X. hexadecimal(re.++ (re.union (str.to.re "0x") (str.to.re "0X")) (re.+ (re.union (re.range "0" "9") (re.range "a" "f") (re.range "A" "F"))))prove $ \s -> s `match` hexadecimal .=> sAny (.== take 2 s) ["0x", "0X"]Q.E.D. sbvRecognize a floating point number. The exponent part is optional if a fraction is present. The exponent may or may not have a sign.3prove $ \s -> s `match` floating .=> length s .>= 3Q.E.D. sbvFor the purposes of this regular expression, an identifier consists of a letter followed by zero or more letters, digits, underscores, and single quotes. The first letter must be lowercase. s `match` identifier .=> isAsciiLower (head s)Q.E.D.5prove $ \s -> s `match` identifier .=> length s .>= 1Q.E.D.sbv#Lift a unary operator over strings.sbv!Concrete evaluation for unary opssbv$Quiet GHC about testing only imports sbvMatching symbolic strings. sbvMatching a character simply means the singleton string matches the regex.' ' (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred5'+ sbvCheck whether the given solver is installed and is ready to go. This call does a simple call to the solver to ensure all is well. sbv:The default configs corresponding to supported SMT solvers sbvReturn the known available solver configs, installed on your machine.sbvTurn a name into a symbolic type. If first argument is true, we'll also derive Eq and Ord instances. sbv$Make an enumeration a symbolic type. sbvMake an uninterpred sort.sbv*Make sure the given type is an enumerationsbv)Make sure the given type is an empty data 1(c) Brian Schroeder Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredj3 sbvAsk solver for info.NB. For a version which generalizes over the underlying monad, see  sbvRetrieve the value of an 'SMTOption.' The curious function argument is on purpose here, simply pass the constructor name. Example: the call    will return either Nothing or Just (ProduceUnsatCores True) or Just (ProduceUnsatCores False).Result will be , if the solver does not support this option.NB. For a version which generalizes over the underlying monad, see  sbv-Get the reason unknown. Only internally used.NB. For a version which generalizes over the underlying monad, see y sbv0Get the observables recorded during a query run.NB. For a version which generalizes over the underlying monad, see sbvGet the uninterpreted constants/functions recorded during a run.NB. For a version which generalizes over the underlying monad, see  sbv*Issue check-sat and get an SMT Result out.NB. For a version which generalizes over the underlying monad, see sbvIssue check-sat and get results of a lexicographic optimization.NB. For a version which generalizes over the underlying monad, see sbvIssue check-sat and get results of an independent (boxed) optimization.NB. For a version which generalizes over the underlying monad, see sbv,Construct a pareto-front optimization resultNB. For a version which generalizes over the underlying monad, see  sbvCollect model values. It is implicitly assumed that we are in a check-sat context. See  = for a variant that issues a check-sat first and returns an .NB. For a version which generalizes over the underlying monad, see  sbvCheck for satisfiability, under the given conditions. Similar to u except it allows making further assumptions as captured by the first argument of booleans. (Also see   for a variant that returns the subset of the given assumptions that led to the  conclusion.)NB. For a version which generalizes over the underlying monad, see v sbvCheck for satisfiability, under the given conditions. Returns the unsatisfiable set of assumptions. Similar to u except it allows making further assumptions as captured by the first argument of booleans. If the result is , the user will also receive a subset of the given assumptions that led to the  conclusion. Note that while this set will be a subset of the inputs, it is not necessarily guaranteed to be minimal.You must have arranged for the production of unsat assumptions first via   $   for this call to not error out! Usage note:   is usually easier to use than  <, as it allows the use of named assertions, as obtained by . If  9 fills your needs, you should definitely prefer it over  .NB. For a version which generalizes over the underlying monad, see  sbvThe current assertion stack depth, i.e., #push - #pops after start. Always non-negative.NB. For a version which generalizes over the underlying monad, see  sbvRun the query in a new assertion stack. That is, we push the context, run the query commands, and pop it back.NB. For a version which generalizes over the underlying monad, see  sbvPush the context, entering a new one. Pushes multiple levels if n > 1.NB. For a version which generalizes over the underlying monad, see  sbv 1. It's an error to pop levels that don't exist.NB. For a version which generalizes over the underlying monad, see  sbvSearch for a result via a sequence of case-splits, guided by the user. If one of the conditions lead to a satisfiable result, returns Just+ that result. If none of them do, returns Nothing. Note that we automatically generate a coverage case and search for it automatically as well. In that latter case, the string returned will be Coverage?. The first argument controls printing progress messages See ,Documentation.SBV.Examples.Queries.CaseSplit for an example use case.NB. For a version which generalizes over the underlying monad, see  sbvReset the solver, by forgetting all the assertions. However, bindings are kept as is, as opposed to a full reset of the solver. Use this variant to clean-up the solver state while leaving the bindings intact. Pops all assertion levels. Declarations and definitions resulting from the t command are unaffected. Note that SBV implicitly uses global-declarations, so bindings will remain intact.NB. For a version which generalizes over the underlying monad, see  sbvEcho a string. Note that the echoing is done by the solver, not by SBV.NB. For a version which generalizes over the underlying monad, see  sbvExit the solver. This action will cause the solver to terminate. Needless to say, trying to communicate with the solver after issuing "exit" will simply fail.NB. For a version which generalizes over the underlying monad, see  sbvRetrieve the unsat-core. Note you must have arranged for unsat cores to be produced first via   $   for this call to not error out!NB. There is no notion of a minimal unsat-core, in case unsatisfiability can be derived in multiple ways. Furthermore, Z3 does not guarantee that the generated unsat core does not have any redundant assertions either, as doing so can incur a performance penalty. (There might be assertions in the set that is not needed.) To ensure all the assertions in the core are relevant, use:   $  ":smt.core.minimize" ["true"] "Note that this only works with Z3.NB. For a version which generalizes over the underlying monad, see x sbvRetrieve the proof. Note you must have arranged for proofs to be produced first via   $   for this call to not error out!A proof is simply a , as returned by the solver. In the future, SBV might provide a better datatype, depending on the use cases. Please get in touch if you use this function and can suggest a better API.NB. For a version which generalizes over the underlying monad, see  sbv1Interpolant extraction for MathSAT. Compare with  , which performs similar function (but with a different use model) in Z3.!Retrieve an interpolant after an  result is obtained. Note you must have arranged for interpolants to be produced first via   $   for this call to not error out!-To get an interpolant for a pair of formulas A and B, use a ( call to attach interplation groups to A and B . Then call   ["A"], assuming those are the names you gave to the formulas in the A group.An interpolant for A and B is a formula I such that: # A .=> I and B .=> sNot I That is, it's evidence that A and B cannot be true together since A implies I but B implies not I; establishing that A and B5 cannot be satisfied at the same time. Furthermore, I0 will have only the symbols that are common to A and B.NB. Interpolant extraction isn't standardized well in SMTLib. Currently both MathSAT and Z3 support them, but with slightly differing APIs. So, we support two APIs with slightly differing types to accommodate both. See /Documentation.SBV.Examples.Queries.Interpolants& for example usages in these solvers.NB. For a version which generalizes over the underlying monad, see  sbv,Interpolant extraction for z3. Compare with  , which performs similar function (but with a different use model) in MathSAT.3Unlike the MathSAT variant, you should simply call   on symbolic booleans to retrieve the interpolant. Do not call   or create named constraints. This makes it harder to identify formulas, but the current state of affairs in interpolant API requires this kludge.An interpolant for A and B is a formula I such that: " A ==> I and B ==> not I That is, it's evidence that A and B cannot be true together since A implies I but B implies not I; establishing that A and B5 cannot be satisfied at the same time. Furthermore, I0 will have only the symbols that are common to A and B.In Z3, interpolants generalize to sequences: If you pass more than two formulas, then you will get a sequence of interpolants. In general, for N formulas that are not satisfiable together, you will be returned N-1 interpolants. If formulas are A1 .. An, then interpolants will be  I1 .. I(N-1) , such that  A1 ==> I1, A2 /\ I1 ==> I2, A3 /\ I2 ==> I3, ..., and finally AN ===> not I(N-1).Currently, SBV only returns simple and sequence interpolants, and does not support tree-interpolants. If you need these, please get in touch. Furthermore, the result will be a list of mere strings representing the interpolating formulas, as opposed to a more structured type. Please get in touch if you use this function and can suggest a better API.NB. Interpolant extraction isn't standardized well in SMTLib. Currently both MathSAT and Z3 support them, but with slightly differing APIs. So, we support two APIs with slightly differing types to accommodate both. See /Documentation.SBV.Examples.Queries.Interpolants& for example usages in these solvers.NB. For a version which generalizes over the underlying monad, see  sbvRetrieve assertions. Note you must have arranged for assertions to be available first via   $   for this call to not error out!Note that the set of assertions returned is merely a list of strings, just like the case for  . In the future, SBV might provide a better datatype, depending on the use cases. Please get in touch if you use this function and can suggest a better API.NB. For a version which generalizes over the underlying monad, see  sbv:Retrieve the assignment. This is a lightweight version of  , where the solver returns the truth value for all named subterms of type .?You must have first arranged for assignments to be produced via   $   for this call to not error out!NB. For a version which generalizes over the underlying monad, see  sbv,Produce the query result from an assignment.NB. For a version which generalizes over the underlying monad, see  sbvPerform an arbitrary IO action.NB. For a version which generalizes over the underlying monad, see sbvModify the query stateNB. For a version which generalizes over the underlying monad, see sbv$Execute in a new incremental contextNB. For a version which generalizes over the underlying monad, see  sbv Similar to  ", except creates unnamed variable.NB. For a version which generalizes over the underlying monad, see  sbvCreate a fresh variable in query mode. You should prefer creating input variables using , , etc., which act as primary inputs to the model and can be existential or universal. Use   only in query mode for anonymous temporary variables. Such variables are always existential. Note that   should hardly be needed: Your input variables and symbolic expressions should suffice for most major use cases.NB. For a version which generalizes over the underlying monad, see  sbv Similar to  , except creates unnamed array.NB. For a version which generalizes over the underlying monad, see  sbvCreate a fresh array in query mode. Again, you should prefer creating arrays before the queries start using , but this method can come in handy in occasional cases where you need a new array after you start the query based interaction.NB. For a version which generalizes over the underlying monad, see  sbvIf  is , print the message, useful for debugging messages in custom queries. Note that  will be respected: If a file redirection is given, the output will go to the file.NB. For a version which generalizes over the underlying monad, see sbv4Send a string to the solver, and return the responseNB. For a version which generalizes over the underlying monad, see sbv6Send a string to the solver. If the first argument is , we will require a "success" response as well. Otherwise, we'll fire and forget.NB. For a version which generalizes over the underlying monad, see sbvRetrieve a responses from the solver until it produces a synchronization tag. We make the tag unique by attaching a time stamp, so no need to worry about getting the wrong tag unless it happens in the very same picosecond! We return multiple valid s-expressions till the solver responds with the tag. Should only be used for internal tasks or when we want to synchronize communications, and not on a regular basis! Use / for that purpose. This comes in handy, however, when solvers respond multiple times as in optimization for instance, where we both get a check-sat answer and some objective values.NB. For a version which generalizes over the underlying monad, see  sbvGet the value of a term.NB. For a version which generalizes over the underlying monad, see w sbv3Get the value of an uninterpreted sort, as a StringNB. For a version which generalizes over the underlying monad, see  sbvGet the value of an uninterpreted function, as a list of domain, value pairs. The final value is the "else" clause, i.e., what the function maps values outside of the domain of the first list.sbvGet the value of a term. If the kind is Real and solver supports decimal approximations, we will "squash" the representations.NB. For a version which generalizes over the underlying monad, see sbv'Get the value of an uninterpreted valuesbvGet the value of an uninterpreted function as an association listNB. For a version which generalizes over the underlying monad, see  sbvCheck for satisfiability.NB. For a version which generalizes over the underlying monad, see u sbvEnsure that the current context is satisfiable. If not, this function will throw an error.NB. For a version which generalizes over the underlying monad, see  sbv?Check for satisfiability with a custom check-sat-using command.NB. For a version which generalizes over the underlying monad, see sbvRetrieve the set of unsatisfiable assumptions, following a call to . Note that this function isn't exported to the user, but rather used internally. The user simple calls .NB. For a version which generalizes over the underlying monad, see  sbvTimeout a query action, typically a command call to the underlying SMT solver. The duration is in microseconds (1/10^6 seconds). If the duration is negative, then no timeout is imposed. When specifying long timeouts, be careful not to exceed maxBound :: Int. (On a 64 bit machine, this bound is practically infinite. But on a 32 bit machine, it corresponds to about 36 minutes!)Semantics: The call  timeout n q causes the timeout value to be applied to all interactive calls that take place as we execute the query q:. That is, each call that happens during the execution of q gets a separate time-out value, as opposed to one timeout value that limits the whole query. This is typically the intended behavior. It is advisable to apply this combinator to calls that involve a single call to the solver for finer control, as opposed to an entire set of interactions. However, different use cases might call for different scenarios.If the solver responds within the time-out specified, then we continue as usual. However, if the backend solver times-out using this mechanism, there is no telling what the state of the solver will be. Thus, we raise an error in this case.NB. For a version which generalizes over the underlying monad, see sbv)Bail out if we don't get what we expectedNB. For a version which generalizes over the underlying monad, see sbvExecute a query.NB. For a version which generalizes over the underlying monad, see 3       (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred/k sbvRun a custom query !"#$%&'()*+,-./01234567=>?@GEABCDFHIJKLM_` _` IJKLM  @GEABCDFH=>?./01234567   !"#$%&'()*+,-(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred)4 sbvDifferent kinds of "files" we can produce. Currently this is quite C specific. sbv5Representation of a collection of generated programs. sbvPossible mappings for the  type when translated to C. Used in conjunction with the function  . Note that the particular characteristics of the mapped types depend on the platform and the compiler used for compiling the generated C program. See  )http://en.wikipedia.org/wiki/C_data_types for details. sbv float sbv double sbv  long double sbvThe code-generation monad. Allows for precise layout of input values reference parameters (for returning composite values in languages such as C), and return values. sbvCode-generation state sbv%Abstraction of target language values sbvOptions for code-generation. sbvIf , perform run-time-checks for index-out-of-bounds or shifting-by-large values etc. sbv2Bit-size to use for representing SInteger (if any) sbv+Type to use for representing SReal (if any) sbvValues to use for the driver program generated, useful for generating non-random drivers. sbvIf  , will generate a driver program sbvIf , will generate a makefile sbvIf , will ignore  calls sbvIf 7, will overwrite the generated files without prompting. sbvIf , then 8-bit unsigned values will be shown in hex as well, otherwise decimal. (Other types always shown in hex.) sbv5Abstract over code generation for different languages sbvDefault options for code generation. The run-time checks are turned-off, and the driver values are completely random. sbv)Initial configuration for code-generation sbv.Reach into symbolic monad from code-generation sbvSets RTC (run-time-checks) for index-out-of-bounds, shift-with-large value etc. on/off. Default: . sbv4Sets number of bits to be used for representing the < type in the generated C code. The argument must be one of 8, 16, 32, or 64. Note that this is essentially unsafe as the semantics of unbounded Haskell integers becomes reduced to the corresponding bit size, as typical in most C implementations. sbv0Sets the C type to be used for representing the > type in the generated C code. The setting can be one of C's "float", "double", or  "long double", types, depending on the precision needed. Note that this is essentially unsafe as the semantics of infinite precision SReal values becomes reduced to the corresponding floating point type in C, and hence it is subject to rounding errors. sbv.Should we generate a driver program? Default: . When a library is generated, it will have a driver if any of the constituent functions has a driver. (See .) sbv(Should we generate a Makefile? Default: . sbvSets driver program run time values, useful for generating programs with fixed drivers for testing. Default: None, i.e., use random values. sbv&Ignore assertions (those generated by  calls) in the generated C code sbvAdds the given lines to the header file generated, useful for generating programs with uninterpreted functions. sbv If passed , then we will not ask the user if we're overwriting files as we generate the C code. Otherwise, we'll prompt. sbv If passed , then we will show 'SWord 8' type in hex. Otherwise we'll show it in decimal. All signed types are shown decimal, and all unsigned larger types are shown hexadecimal otherwise. sbvAdds the given lines to the program file generated, useful for generating programs with uninterpreted functions. sbvAdds the given words to the compiler options in the generated Makefile, useful for linking extra stuff in. sbv.Creates an atomic input in the generated code. sbv-Creates an array input in the generated code. sbv/Creates an atomic output in the generated code. sbv.Creates an array output in the generated code. sbv9Creates a returned (unnamed) value in the generated code. sbv?Creates a returned (unnamed) array value in the generated code. sbv.Creates an atomic input in the generated code. sbv-Creates an array input in the generated code. sbv/Creates an atomic output in the generated code. sbv.Creates an array output in the generated code. sbv9Creates a returned (unnamed) value in the generated code. sbv?Creates a returned (unnamed) array value in the generated code. sbvIs this a driver program? sbvIs this a make file? sbvGenerate code for a symbolic program, returning a Code-gen bundle, i.e., collection of makefiles, source code, headers, etc. sbv4Render a code-gen bundle to a directory or to stdoutsbvAn alternative to Pretty's render, which might have "leading" white-space in empty lines. This version eliminates such whitespace. (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred sbvGiven a symbolic computation, render it as an equivalent collection of files that make up a C program:The first argument is the directory name under which the files will be saved. To save files in the current directory pass  ".". Use  for printing to stdout.>The second argument is the name of the C function to generate.2The final argument is the function to be compiled.!Compilation will also generate a Makefile, a header file, and a driver (test) program, etc. As a result, we return whatever the code-gen function returns. Most uses should simply have () as the return type here, but the value can be useful if you want to chain the result of one compilation act to the next. sbvLower level version of  , producing a  sbvCreate code to generate a library archive (.a) from given symbolic functions. Useful when generating code from multiple functions that work together as a library.The first argument is the directory name under which the files will be saved. To save files in the current directory pass  ".". Use  for printing to stdout.;The second argument is the name of the archive to generate.The third argument is the list of functions to include, in the form of function-name/code pairs, similar to the second and third arguments of  , except in a list. sbvLower level version of  , producing a  sbvPretty print a functions type. If there is only one output, we compile it as a function that returns that value. Otherwise, we compile it as a void function that takes return values as pointers to be updated.sbvRenders as "const SWord8 s0", etc. the first parameter is the width of the typefieldsbvReturn the proper declaration and the result as a pair. No constssbv3Renders as "s0", etc, or the corresponding constantsbv!Words as it would map to a C wordsbvAlmost a "show", but map SWord1 to SBool- which is used for extracting one-bit words.sbv!The printf specifier for the typesbvMake a constant value of the given type. We don't check for out of bounds here, as it should not be needed. There are many options here, using binary, decimal, etc. We simply use decimal for values 8-bits or less, and hex otherwise.sbvGenerate a makefile. The first argument is True if we have a driver.sbvGenerate the headersbv"Generate an example driver programsbvGenerate the C programsbvMerge a bunch of bundles to generate code for a library. For the final config, we simply return the first config we receive, or the default if none.sbv!Create a Makefile for the librarysbvCreate a driver for a library (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredw  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred sbvSend an arbitrary string to the solver in a query. Note that this is inherently dangerous as it can put the solver in an arbitrary state and confuse SBV. If you use this feature, you are on your own! sbvRetrieve multiple responses from the solver, until it responds with a user given tag that we shall arrange for internally. The optional timeout is in milliseconds. If the time-out is exceeded, then we will raise an error. Note that this is inherently dangerous as it can put the solver in an arbitrary state and confuse SBV. If you use this feature, you are on your own! sbvSend an arbitrary string to the solver in a query, and return a response. Note that this is inherently dangerous as it can put the solver in an arbitrary state and confuse SBV. sbvInverse transformation to  0. Note that this isn't a perfect inverse, since -0 maps to 0 and back to 0. Otherwise, it's faithful:prove $ \x -> let f = sComparableSWord32AsSFloat x in fpIsNaN f .|| fpIsNegativeZero f .|| sFloatAsComparableSWord32 f .== xQ.E.D.prove $ \x -> fpIsNegativeZero x .|| sComparableSWord32AsSFloat (sFloatAsComparableSWord32 x) `fpIsEqualObject` xQ.E.D. sbvInverse transformation to  0. Note that this isn't a perfect inverse, since -0 maps to 0 and back to 0. Otherwise, it's faithful:prove $ \x -> let d = sComparableSWord64AsSDouble x in fpIsNaN d .|| fpIsNegativeZero d .|| sDoubleAsComparableSWord64 d .== xQ.E.D.prove $ \x -> fpIsNegativeZero x .|| sComparableSWord64AsSDouble (sDoubleAsComparableSWord64 x) `fpIsEqualObject` xQ.E.D. sbvInverse transformation to  0. Note that this isn't a perfect inverse, since -0 maps to 0 and back to 0. Otherwise, it's faithful:prove $ \x -> let d = sComparableSWordAsSFloatingPoint x in fpIsNaN d .|| fpIsNegativeZero d .|| sFloatingPointAsComparableSWord (d :: SFPHalf) .== xQ.E.D.prove $ \x -> fpIsNegativeZero x .|| sComparableSWordAsSFloatingPoint (sFloatingPointAsComparableSWord x) `fpIsEqualObject` (x :: SFPHalf)Q.E.D.STUXVW^afedbci}|{zyxwvutsrqponmljk~ abcdefUVWXSTijklmnopqrstuvwxyz{|}~^   1(c) Brian Schroeder Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred 1<?sbv7Conversion from a fixed-sized BV to a sized bit-vector. sbvConvert a fixed-sized bit-vector to the corresponding sized bit-vector, for instance  to 'SWord 16'. See also  .sbv3Capture the correspondence in terms of a constraint sbv x `shiftL` 2 .== yis a predicate with two arguments, captured using an ordinary Haskell function. Internally, x will be named s0 and y will be named s1.Remember that SBV assumes that the input is in prenex-normal form. That is, all quantifiers are at the beginning of the predicate. See Data.SBV#noteOnNested1note on reasoning in the presence of quantifiers for more information.NB. For a version which generalizes over the underlying monad, see  sbvTurns a value into a predicate, allowing users to provide names for the inputs. If the user does not provide enough number of names for the variables, the remaining ones will be internally generated. Note that the names are only used for printing models and has no other significance; in particular, we do not check that they are unique. Example: < universal ["x", "y"] $ \(x::SWord8) y -> x `shiftL` 2 .== y>This is the same as above, except the variables will be named x and y respectively, simplifying the counter-examples when they are printed.Remember that SBV assumes that the input is in prenex-normal form. That is, all quantifiers are at the beginning of the predicate. See Data.SBV#noteOnNested1note on reasoning in the presence of quantifiers for more information.NB. For a version which generalizes over the underlying monad, see  sbv9Turns a value into an existentially quantified predicate.Remember that SBV assumes that the input is in prenex-normal form. That is, all quantifiers are at the beginning of the predicate. See Data.SBV#noteOnNested1note on reasoning in the presence of quantifiers for more information.NB. For a version which generalizes over the underlying monad, see  sbv Version of   that allows user defined names.Remember that SBV assumes that the input is in prenex-normal form. That is, all quantifiers are at the beginning of the predicate. See Data.SBV#noteOnNested1note on reasoning in the presence of quantifiers for more information.NB. For a version which generalizes over the underlying monad, see  sbv,Prove a predicate, using the default solver.NB. For a version which generalizes over the underlying monad, see  sbv/Prove the predicate using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbvProve a predicate with delta-satisfiability, using the default solver.NB. For a version which generalizes over the underlying monad, see  sbvProve the predicate with delta-satisfiability using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbvFind a satisfying assignment for a predicate, using the default solver.NB. For a version which generalizes over the underlying monad, see  sbv8Find a satisfying assignment using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbvFind a delta-satisfying assignment for a predicate, using the default solver for delta-satisfiability.NB. For a version which generalizes over the underlying monad, see  sbv8Find a satisfying assignment using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbvFind all satisfying assignments, using the default solver. Equivalent to   . See   for details.NB. For a version which generalizes over the underlying monad, see  sbvReturn all satisfying assignments for a predicate. Note that this call will block until all satisfying assignments are found. If you have a problem with infinitely many satisfying models (consider ) or a very large number of them, you might have to wait for a long time. To avoid such cases, use the ! parameter in the configuration.NB. Uninterpreted constant/function values and counter-examples for array values are ignored for the purposes of  . That is, only the satisfying assignments modulo uninterpreted functions and array inputs will be returned. This is due to the limitation of not having a robust means of getting a function counter-example back from the SMT solver. Find all satisfying assignments using the given SMT-solverNB. For a version which generalizes over the underlying monad, see  sbvOptimize a given collection of s.NB. For a version which generalizes over the underlying monad, see  sbv4Optimizes the objectives using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbvCheck if the constraints given are consistent, using the default solver.NB. For a version which generalizes over the underlying monad, see  sbvDetermine if the constraints are vacuous using the given SMT-solver.NB. For a version which generalizes over the underlying monad, see  sbv,Checks theoremhood using the default solver.NB. For a version which generalizes over the underlying monad, see  sbv,Check whether a given property is a theorem.NB. For a version which generalizes over the underlying monad, see  sbv/Checks satisfiability using the default solver.NB. For a version which generalizes over the underlying monad, see  sbv.Check whether a given property is satisfiable.NB. For a version which generalizes over the underlying monad, see  sbv5Run an arbitrary symbolic computation, equivalent to   NB. For a version which generalizes over the underlying monad, see  sbvRuns an arbitrary symbolic computation, exposed to the user in SAT modeNB. For a version which generalizes over the underlying monad, see  sbvNB. For a version which generalizes over the underlying monad, see  sbvNB. For a version which generalizes over the underlying monad, see  sbv&Check safety using the default solver.NB. For a version which generalizes over the underlying monad, see  sbvCheck if any of the  calls can be violated.NB. For a version which generalizes over the underlying monad, see sbvCreate a symbolic variable.NB. For a version which generalizes over the underlying monad, see sbv 5, y + z .< x] NB. For a version which generalizes over the underlying monad, see  sbv4Introduce a soft assertion, with an optional penaltyNB. For a version which generalizes over the underlying monad, see  sbvMinimize a named metricNB. For a version which generalizes over the underlying monad, see  sbvMaximize a named metricNB. For a version which generalizes over the underlying monad, see sbv toBytes ((fromBytes [a, b, c, d]) :: SWord 32) .== [a, b, c, d]Q.E.D. sbv Convert from a sequence of bytes7prove $ \r -> fromBytes (toBytes r) .== (r :: SWord 64)Q.E.D. sbvShow a value in detailed (cracked) form, if possible. This makes most sense with numbers, and especially floating-point types. sbvAn implementation of rotate-left, using a barrel shifter like design. Only works when both arguments are finite bitvectors, and furthermore when the second argument is unsigned. The first condition is enforced by the type, but the second is dynamically checked. We provide this implementation as an alternative to  since SMTLib logic does not support variable argument rotates (as opposed to shifts), and thus this implementation can produce better code for verification compared to .prove $ \x y -> (x `sBarrelRotateLeft` y) `sBarrelRotateRight` (y :: SWord32) .== (x :: SWord64)Q.E.D. sbvAn implementation of rotate-right, using a barrel shifter like design. See comments for   for details.prove $ \x y -> (x `sBarrelRotateRight` y) `sBarrelRotateLeft` (y :: SWord32) .== (x :: SWord64)Q.E.D. sbv7Extract a portion of bits to form a smaller bit-vector.prove $ \x -> bvExtract (Proxy @7) (Proxy @3) (x :: SWord 12) .== bvDrop (Proxy @4) (bvTake (Proxy @9) x)Q.E.D. sbvJoin two bitvectors.prove $ \x y -> x .== bvExtract (Proxy @79) (Proxy @71) ((x :: SWord 9) # (y :: SWord 71))Q.E.D. sbvZero extend a bit-vector.prove $ \x -> bvExtract (Proxy @20) (Proxy @12) (zeroExtend (x :: SInt 12) :: SInt 21) .== 0Q.E.D. sbvSign extend a bit-vector.prove $ \x -> sNot (msb x) .=> bvExtract (Proxy @20) (Proxy @12) (signExtend (x :: SInt 12) :: SInt 21) .== 0Q.E.D.prove $ \x -> msb x .=> bvExtract (Proxy @20) (Proxy @12) (signExtend (x :: SInt 12) :: SInt 21) .== complement 0Q.E.D. sbv'Drop bits from the top of a bit-vector.5prove $ \x -> bvDrop (Proxy @0) (x :: SWord 43) .== xQ.E.D.prove $ \x -> bvDrop (Proxy @20) (x :: SWord 21) .== ite (lsb x) 1 (0 :: SWord 1)Q.E.D. sbv'Take bits from the top of a bit-vector.6prove $ \x -> bvTake (Proxy @13) (x :: SWord 13) .== xQ.E.D.prove $ \x -> bvTake (Proxy @1) (x :: SWord 13) .== ite (msb x) 1 0Q.E.D.prove $ \x -> bvTake (Proxy @4) x # bvDrop (Proxy @4) x .== (x :: SWord 23)Q.E.D. sbv  1024 instance for  sbv  512 instance for  sbv  256 instance for  sbv  128 instance for  sbv  64 instance for  sbv  32 instance for  sbv  16 instance for  sbv  8 instance for   sbvi : Start position, numbered from n-1 to 0sbvj: End position, numbered from n-1 to 0, j <= i must holdsbvInput bit vector of size nsbvOutput is of size  i - j + 1 sbvFirst input, of size n, becomes the left sidesbvSecond input, of size m, becomes the right sidesbvConcatenation, of size n+m sbvInput, of size nsbvOutput, of size m. n < m must hold sbvInput, of size nsbvOutput, of size m. n < m must hold sbvi: Number of bits to drop. i < n must hold.sbvInput, of size nsbvOutput, of size m.  m = n - i holds. sbvi: Number of bits to take.  0 < i <= n must hold.sbvInput, of size nsbvOutput, of size i 89:; sFalse)[]"ranges (\(_ :: SInteger) -> sTrue) [(-oo,oo)]ranges (\(x :: SInteger) -> sAnd [x .<= 120, x .>= -12, x ./= 3])[[-12,3),(3,120]]ranges (\(x :: SInteger) -> sAnd [x .<= 75, x .>= 5, x ./= 6, x ./= 67])[[5,6),(6,67),(67,75]]?ranges (\(x :: SInteger) -> sAnd [x .<= 75, x ./= 3, x ./= 67])[(-oo,3),(3,67),(67,75]]6ranges (\(x :: SReal) -> sAnd [x .>= 3.2, x .<= 12.7]) [[3.2,12.7]]4ranges (\(x :: SReal) -> sAnd [x .<= 12.7, x ./= 8])[(-oo,8.0),(8.0,12.7]]5ranges (\(x :: SReal) -> sAnd [x .>= 12.7, x ./= 15])[[12.7,15.0),(15.0,oo)]1ranges (\(x :: SInt8) -> sAnd [x .<= 7, x ./= 6])[[-128,6),(6,7]]ranges $ \x -> x .>= (0::SReal) [[0.0,oo)]ranges $ \x -> x .<= (0::SReal) [(-oo,0.0]]$ranges $ \(x :: SWord8) -> 2*x .== 4[[2,3),(129,130]] sbv5Compute ranges, using the given solver configuration. sbvShow instance for    (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredA7 sbvResult of an inductive proof, with a counter-example in case of failure.$If a proof is found (indicated by a   result), then the invariant holds and the goal is established once the termination condition holds. If it fails, then it can fail either in an initiation step or in a consecution step:A   result in an  $ step means that the invariant does not hold for the initial state, and thus indicates a true failure.A   result in a   step will return a state s. This state is known as a CTI (counterexample to inductiveness): It will lead to a violation of the invariant in one step. However, this does not mean the property is invalid: It could be the case that it is simply not inductive. In this case, human intervention---or a smarter algorithm like IC3 for certain domains---is needed to see if one can strengthen the invariant so an inductive proof can be found. How this strengthening can be done remains an art, but the science is improving with algorithms like IC3.A   result in a   step means that the invariant holds, but assuming the termination condition the goal still does not follow. That is, the partial correctness does not hold. sbv;A step in an inductive proof. If the tag is present (i.e., Just nm), then the step belongs to the subproof that establishes the strengthening named nm. sbv0Induction engine, using the default solver. See 0Documentation.SBV.Examples.ProofTools.Strengthen and )Documentation.SBV.Examples.ProofTools.Sum for examples. sbv.Induction engine, configurable with the solver sbvShow instance for  , diagnostic purposes only. sbvShow instance for  , diagnostic purposes only. sbv Verbose modesbv.Setup code, if necessary. (Typically used for  calls. Pass  return () if not needed.)sbvInitial conditionsbvTransition relationsbvStrengthenings, if any. The String is a simple tag.sbv0Invariant that ensures the goal upon terminationsbv/Termination condition and the goal to establishsbvEither proven, or a concrete state value that, if reachable, fails the invariant. (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred#Dsbv1Case analysis on a symbolic list. (Not exported.) sbvBounded fold from the right. sbv$Bounded monadic fold from the right. sbvBounded fold from the left. sbv#Bounded monadic fold from the left. sbv Bounded sum. sbvBounded product. sbv Bounded map. sbvBounded monadic map. sbvBounded filter. sbvBounded logical and sbvBounded logical or sbv Bounded any sbv Bounded all sbv,Bounded maximum. Undefined if list is empty. sbv,Bounded minimum. Undefined if list is empty. sbvBounded zipWith sbvBounded element check sbvBounded reversesbv$Bounded paramorphism (not exported).sbv4Insert an element into a sorted list (not exported). sbvBounded insertion sort  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredO sbv(Bounded fixed-point operation. The call  bfix bnd nm f unrolls the recursion in f at most bnd5 times, and uninterprets the function (with the name nm) after the bound is reached.This combinator is handy for dealing with recursive definitions that are not symbolically terminating and when the property we are interested in does not require an infinite unrolling, or when we are happy with a bounded proof. In particular, this operator can be used as a basis of software-bounded model checking algorithms built on top of SBV. The bound can be successively refined in a CEGAR like loop as necessary, by analyzing the counter-examples and rejecting them if they are false-negatives.For instance, we can define the factorial function using the bounded fixed-point operator like this:  bfac :: SInteger -> SInteger bfac = bfix 10 "fac" fact where fact f n = ite (n .== 0) 1 (n * f (n-1)) This definition unrolls the recursion in factorial at most 10 times before uninterpreting the result. We can now prove:?prove $ \n -> n .>= 1 .&& n .<= 9 .=> bfac n .== n * bfac (n-1)Q.E.D.And we would get a bogus counter-example if the proof of our property needs a larger bound:-prove $ \n -> n .== 10 .=> bfac n .== 3628800Falsifiable. Counter-example: s0 = 10 :: Integer fac :: Integer -> Integer fac _ = 2The counter-example is telling us how it instantiated the function fac< when the recursion bottomed out: It simply made it return 2 for all arguments at that point, which provides the (unintended) counter-example.%By design, if a function defined via   is given a concrete argument, it will unroll the recursion as much as necessary to complete the call (which can of course diverge). The bound only applies if the given argument is symbolic. This fact can be used to observe concrete values to see where the bounded-model-checking approach fails:prove $ \n -> n .== 10 .=> observe "bfac_n" (bfac n) .== observe "bfac_10" (bfac 10)Falsifiable. Counter-example: bfac_10 = 3628800 :: Integer bfac_n = 7257600 :: Integer s0 = 10 :: Integer fac :: Integer -> Integer fac _ = 2Here, we see further evidence that the SMT solver must have decided to assign the value 2 in the final call just as it was reaching the base case, and thus got the final result incorrect. (Note that 7257600 = 2 * 3628800<.) A wrapper algorithm can then assert the actual value of bfac 10? here as an extra constraint and can search for "deeper bugs."  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredS9 sbv6Bounded model checking, using the default solver. See )Documentation.SBV.Examples.ProofTools.BMC for an example use case.Note that the BMC engine does *not* guarantee that the solution is unique. However, if it does find a solution at depth i7, it is guaranteed that there are no shorter solutions. sbv4Bounded model checking, configurable with the solver sbvOptional boundsbvVerbose: prints iteration countsbv.Setup code, if necessary. (Typically used for  calls. Pass  return () if not needed.)sbvInitial conditionsbvTransition relationsbvGoal to cover, i.e., we find a set of transitions that satisfy this predicate.sbvEither a result, or a satisfying path of given length and intermediate observations.  (c) Brian HuffmanBSD3erkokl@gmail.com experimental Safe-Inferred_D sbvDynamic variant of quick-check sbvCreate SMT-Lib benchmarks. The first argument is the basename of the file, we will automatically add ".smt2" per SMT-Lib2 convention. The  argument controls whether this is a SAT instance, i.e., translate the query directly, or a PROVE instance, i.e., translate the negated query. sbv/Proves the predicate using the given SMT-solver sbv7Find a satisfying assignment using the given SMT-solver sbv'Check safety using the given SMT-solver sbv:Find all satisfying assignments using the given SMT-solver sbvProve a property with multiple solvers, running them in separate threads. The results will be returned in the order produced. sbvProve a property with multiple solvers, running them in separate threads. Only the result of the first one to finish will be returned, remaining threads will be killed. sbvProve a property with query mode using multiple threads. Each query computation will spawn a thread and a unique instance of your solver to run asynchronously. The   is duplicated for each thread. This function will block until all child threads return. sbvProve a property with query mode using multiple threads. Each query computation will spawn a thread and a unique instance of your solver to run asynchronously. The   is duplicated for each thread. This function will return the first query computation that completes, killing the others. sbvFind a satisfying assignment to a property with multiple solvers, running them in separate threads. The results will be returned in the order produced. sbvFind a satisfying assignment to a property with multiple solvers, running them in separate threads. Only the result of the first one to finish will be returned, remaining threads will be killed. sbvFind a satisfying assignment to a property with multiple threads in query mode. The   represents what is known to all child query threads. Each query thread will spawn a unique instance of the solver. Only the first one to finish will be returned and the other threads will be killed. sbvFind a satisfying assignment to a property with multiple threads in query mode. The   represents what is known to all child query threads. Each query thread will spawn a unique instance of the solver. This function will block until all child threads have completed. sbvExtract a model, the result is a tuple where the first argument (if True) indicates whether the model was "probable". (i.e., if the solver returned unknown.) sbvExtract a model dictionary. Extract a dictionary mapping the variables to their respective values as returned by the SMT solver. Also see . sbvCreate a named fresh existential variable in the current context sbvCreate an unnamed fresh existential variable in the current contextijklmnopqrstuvwxyz{|}~ ijklmnopqrstuvwxyz{|}~      (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferrede sbv Formalizes http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax sbv Formalizes http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax sbv Formalizes http://graphics.stanford.edu/~seander/bithacks.html#DetectOppositeSigns sbv Formalizes http://graphics.stanford.edu/~seander/bithacks.html#ConditionalSetOrClearBitsWithoutBranching sbv Formalizes http://graphics.stanford.edu/~seander/bithacks.html#DetermineIfPowerOf2 sbvCollection of queries  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredk sbvModel the mid-point computation of the binary search, which is broken due to arithmetic overflow. Note how we use the overflow checking variants of the arithmetic operators. We have:!checkArithOverflow midPointBroken./Documentation/SBV/Examples/BitPrecise/BrokenSearch.hs:39:32:+!: SInt32 addition overflows: Violated. Model: low = 2147475456 :: Int32 high = 2147483646 :: Int32Indeed:*(2147475456 + 2147483646) `div` (2::Int32)-4097%giving us a negative mid-point value! sbvThe correct version of how to compute the mid-point. As expected, this version doesn't have any underflow or overflow issues: checkArithOverflow midPointFixedNo violations detected.1As expected, the value is computed correctly too:"checkCorrectMidValue midPointFixedQ.E.D. sbvShow that the variant suggested by the blog post is good as well: 4mid = ((unsigned int)low + (unsigned int)high) >> 1;In this case the overflow is eliminated by doing the computation at a wider range:&checkArithOverflow midPointAlternativeNo violations detected.)And the value computed is indeed correct:(checkCorrectMidValue midPointAlternativeQ.E.D. sbv=A helper predicate to check safety under the conditions that low is at least 0 and high is at least low. sbvAnother helper to show that the result is actually the correct value, if it was done over 64-bit integers, which is sufficiently large enough.  (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred1;={l( sbv4Helper synonym for capturing relevant bits of Mostek sbvAn instruction is modeled as a   transformer. We model mostek programs in direct continuation passing style. sbvPrograms are essentially state transformers (on the machine state) sbv0Given a machine state, compute a value out of it sbvAbstraction of the machine: The CPU consists of memory, registers, and flags. Unlike traditional hardware, we assume the program is stored in some other memory area that we need not model. (No self modifying programs!) + is equipped with an automatically derived ! instance because each field is . sbv2Memory is simply an array from locations to valuessbv?We have three memory locations, sufficient to model our problemsbv multiplicandsbv multipliersbv'low byte of the result gets stored heresbv Flag banksbv Register banksbv-Convenient synonym for symbolic machine bits.sbvMostek was an 8-bit machine.sbvThe carry flag () and the zero flag ()sbvWe model only two registers of Mostek that is used in the above algorithm, can add more.sbv!Get the value of a given registersbv!Set the value of a given registersbvGet the value of a flagsbvSet the value of a flagsbv Read memorysbvWrite to memorysbv.Checking overflow. In Legato's multiplier the ADC instruction needs to see if the expression x + y + c overflowed, as checked by this function. Note that we verify the correctness of this check separately below in .sbvCorrectness theorem for our  implementation.We have:checkOverflowCorrectQ.E.D.sbvLDX: Set register X to value vsbvLDA: Set register A to value vsbvCLC: Clear the carry flagsbv9ROR, memory version: Rotate the value at memory location a to the right by 1 bit, using the carry flag as a transfer position. That is, the final bit of the memory location becomes the new carry and the carry moves over to the first bit. This very instruction is one of the reasons why Legato's multiplier is quite hard to understand and is typically presented as a verification challenge.sbvROR, register version: Same as , except through register r.sbvBCC: branch to label l if the carry flag is sFalsesbv%ADC: Increment the value of register A. by the value of memory contents at location a7, using the carry-bit as the carry-in for the addition.sbv%DEX: Decrement the value of register Xsbv&BNE: Branch if the zero-flag is sFalsesbvThe  combinator "stops" our program, providing the final continuation that does nothing.sbvMultiplies the contents of F1 and F2), storing the low byte of the result in LO% and the high byte of it in register A. The implementation is a direct transliteration of Legato's algorithm given at the top, using our notation.sbvGiven values for F1 and F2,  runLegato" takes an arbitrary machine state m; and returns the high and low bytes of the multiplication.sbvCreate an instance of the Mostek machine, initialized by the memory and the relevant values of the registers and the flagssbvThe correctness theorem. For all possible memory configurations, the factors (x and y below), the location of the low-byte result and the initial-values of registers and the flags, this function will return True only if running Legato's algorithm does indeed compute the product of x and y correctly.sbvThe correctness theorem.sbvGenerate a C program that implements Legato's algorithm automatically.0 0   (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredsbvElement type of lists we'd like to sort. For simplicity, we'll just use ) here, but we can pick any symbolic type.sbv5Merging two given sorted lists, preserving the order.sbvSimple merge-sort implementation. We simply divide the input list in two halves so long as it has at least two elements, sort each half on its own, and then merge.sbv1Check whether a given sequence is non-decreasing.sbvCheck whether two given sequences are permutations. We simply check that each sequence is a subset of the other, when considered as a set. The check is slightly complicated for the need to account for possibly duplicated elements.sbvAsserting correctness of merge-sort for a list of the given size. Note that we can only check correctness for fixed-size lists. Also, the proof will get more and more complicated for the backend SMT solver as the list size increases. A value around 5 or 6 should be fairly easy to prove. For instance, we have: correctness 5Q.E.D.sbv3Generate C code for merge-sorting an array of size n. Again, we're restricted to fixed size inputs. While the output is not how one would code merge sort in C by hand, it's a faithful rendering of all the operations merge-sort would do as described by its Haskell counterpart. (c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredsbv7Find the multiplier and the mask as described. We have: maskAndMultSatisfiable. Model:% mask = 0x8080808080808080 :: Word64% mult = 0x0002040810204081 :: Word64That is, any 64 bit value masked by the first and multiplied by the second value above will have its bits at positions [7,15,23,31,39,47,55,63] moved to positions [56,57,58,59,60,61,62,63] respectively.NB. Depending on your z3 version, you might also get the following multiplier as the result: 0x8202040810204081. That value works just fine as well!NB. Note the custom call to z3 with a specific tactic. A simple call to z3 unfortunately does not terminate quickly.!(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred sbvA poor man's representation of powerlists and basic operations on them:  (http://dl.acm.org/citation.cfm?id=1973564 We merely represent power-lists by ordinary lists.sbv The tie operator, concatenation.sbvThe zip operator, zips the power-lists of the same size, returns a powerlist of double the size.sbvInverse of zipping.sbvReference prefix sum (ps) is simply Haskell's scanl1 function.sbvThe Ladner-Fischer (lf$) implementation of prefix-sum. See  http://www.cs.utexas.edu/~plaxton/c/337/05f/slides/ParallelRecursion-4.pdf or pg. 16 of (http://dl.acm.org/citation.cfm?id=197356sbvCorrectness theorem, for a powerlist of given size, an associative operator, and its left-unit element.sbvProves Ladner-Fischer is equivalent to reference specification for addition. 0; is the left-unit element, and we use a power-list of size 8 . We have:thm1Q.E.D.sbvProves Ladner-Fischer is equivalent to reference specification for the function max. 0; is the left-unit element, and we use a power-list of size 16 . We have:thm2Q.E.D.  "(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferredsbv,Simple function that returns add/sum of argssbvGenerate C code for addSub. Here's the output showing the generated C code: genAddSub%== BEGIN: "Makefile" ================# Makefile for addSub. Automatically generated by SBV. Do not edit!=# include any user-defined .mk file in the current directory. -include *.mkCC?=gcc0CCFLAGS?=-Wall -O3 -DNDEBUG -fomit-frame-pointerall: addSub_driveraddSub.o: addSub.c addSub.h ${CC} ${CCFLAGS} -c $< -o $@ addSub_driver.o: addSub_driver.c ${CC} ${CCFLAGS} -c $< -o $@'addSub_driver: addSub.o addSub_driver.o ${CC} ${CCFLAGS} $^ -o $@clean: rm -f *.overyclean: clean rm -f addSub_driver%== END: "Makefile" ==================%== BEGIN: "addSub.h" ================/* Header file for addSub. Automatically generated by SBV. Do not edit! */##ifndef __addSub__HEADER_INCLUDED__##define __addSub__HEADER_INCLUDED__#include #include #include #include #include #include #include /* The boolean type */typedef bool SBool;/* The float type */typedef float SFloat;/* The double type */typedef double SDouble;/* Unsigned bit-vectors */typedef uint8_t SWord8;typedef uint16_t SWord16;typedef uint32_t SWord32;typedef uint64_t SWord64;/* Signed bit-vectors */typedef int8_t SInt8;typedef int16_t SInt16;typedef int32_t SInt32;typedef int64_t SInt64;/* Entry point prototype: */8void addSub(const SWord8 x, const SWord8 y, SWord8 *sum, SWord8 *dif);(#endif /* __addSub__HEADER_INCLUDED__ */%== END: "addSub.h" ==================,== BEGIN: "addSub_driver.c" ================(/* Example driver program for addSub. */:/* Automatically generated by SBV. Edit as you see fit! */#include #include "addSub.h"int main(void){ SWord8 sum; SWord8 dif; addSub(132, 241, &sum, &dif);. printf("addSub(132, 241, &sum, &dif) ->\n");$ printf(" sum = %"PRIu8"\n", sum);$ printf(" dif = %"PRIu8"\n", dif); return 0;},== END: "addSub_driver.c" ==================%== BEGIN: "addSub.c" ================/* File: "addSub.c". Automatically generated by SBV. Do not edit! */#include "addSub.h"8void addSub(const SWord8 x, const SWord8 y, SWord8 *sum, SWord8 *dif){ const SWord8 s0 = x; const SWord8 s1 = y; const SWord8 s2 = s0 + s1; const SWord8 s3 = s0 - s1; *sum = s2; *dif = s3;}%== END: "addSub.c" ==================#(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred|sbvThe USB CRC polynomial:  x^5 + x^2 + 1. Although this polynomial needs just 6 bits to represent (5 if higher order bit is implicitly assumed to be set), we'll simply use a 16 bit number for its representation to keep things simple for code generation purposes.sbvGiven an 11 bit message, compute the CRC of it using the USB polynomial, which is 5 bits, and then append it to the msg to get a 16-bit word. Again, the incoming 11-bits is represented as a 16-bit word, with 5 highest bits essentially ignored for input purposes.sbv(Alternate method for computing the CRC, mathematically. We shift the number to the left by 5, and then compute the remainder from the polynomial division by the USB polynomial. The result is then appended to the end of the message.sbvProve that the custom   function is equivalent to the mathematical definition of CRC's for 11 bit messages. We have:crcGoodQ.E.D.sbvGenerate a C function to compute the USB CRC, using the internal CRC function.sbvGenerate a C function to compute the USB CRC, using the mathematical definition of the CRCs. While this version generates functionally equivalent C code, it's less efficient; it has about 30% more code. So, the above version is preferable for code generation purposes.$*(c) Lee Pike Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredSsbvThis is a naive implementation of fibonacci, and will work fine (albeit slow) for concrete inputs:map fib0 [0..6][0 :: SWord64,1 :: SWord64,1 :: SWord64,2 :: SWord64,3 :: SWord64,5 :: SWord64,8 :: SWord64]However, it is not suitable for doing proofs or generating code, as it is not symbolically terminating when it is called with a symbolic value n. When we recursively call fib0 on n-1 (or n-2), the test against 0 will always explore both branches since the result will be symbolic, hence will not terminate. (An integrated theorem prover can establish termination after a certain number of unrollings, but this would be quite expensive to implement, and would be impractical.)sbvThe recursion-depth limited version of fibonacci. Limiting the maximum number to be 20, we can say:map (fib1 20) [0..6][0 :: SWord64,1 :: SWord64,1 :: SWord64,2 :: SWord64,3 :: SWord64,5 :: SWord64,8 :: SWord64]The function will work correctly, so long as the index we query is at most top*, and otherwise will return the value at top. Note that we also use accumulating parameters here for efficiency, although this is orthogonal to the termination concern.A note on modular arithmetic: The 64-bit word we use to represent the values will of course eventually overflow, beware! Fibonacci is a fast growing function..sbvWe can generate code for  using the  action. Note that the generated code will grow larger as we pick larger values of top, but only linearly, thanks to the accumulating parameter trick used by . The following is an excerpt from the code generated for the call  genFib1 10;, where the code will work correctly for indexes up to 10:  SWord64 fib1(const SWord64 x) { const SWord64 s0 = x; const SBool s2 = s0 == 0x0000000000000000ULL; const SBool s4 = s0 == 0x0000000000000001ULL; const SBool s6 = s0 == 0x0000000000000002ULL; const SBool s8 = s0 == 0x0000000000000003ULL; const SBool s10 = s0 == 0x0000000000000004ULL; const SBool s12 = s0 == 0x0000000000000005ULL; const SBool s14 = s0 == 0x0000000000000006ULL; const SBool s17 = s0 == 0x0000000000000007ULL; const SBool s19 = s0 == 0x0000000000000008ULL; const SBool s22 = s0 == 0x0000000000000009ULL; const SWord64 s25 = s22 ? 0x0000000000000022ULL : 0x0000000000000037ULL; const SWord64 s26 = s19 ? 0x0000000000000015ULL : s25; const SWord64 s27 = s17 ? 0x000000000000000dULL : s26; const SWord64 s28 = s14 ? 0x0000000000000008ULL : s27; const SWord64 s29 = s12 ? 0x0000000000000005ULL : s28; const SWord64 s30 = s10 ? 0x0000000000000003ULL : s29; const SWord64 s31 = s8 ? 0x0000000000000002ULL : s30; const SWord64 s32 = s6 ? 0x0000000000000001ULL : s31; const SWord64 s33 = s4 ? 0x0000000000000001ULL : s32; const SWord64 s34 = s2 ? 0x0000000000000000ULL : s33; return s34; }sbv,Compute the fibonacci numbers statically at code-generation0 time and put them in a table, accessed by the  call. sbv Once we have , we can generate the C code straightforwardly. Below is an excerpt from the code that SBV generates for the call  genFib2 64. Note that this code is a constant-time look-up table implementation of fibonacci, with no run-time overhead. The index can be made arbitrarily large, naturally. (Note that this function returns 0> if the index is larger than 64, as specified by the call to  with default 0.) SWord64 fibLookup(const SWord64 x) { const SWord64 s0 = x; static const SWord64 table0[] = { 0x0000000000000000ULL, 0x0000000000000001ULL, 0x0000000000000001ULL, 0x0000000000000002ULL, 0x0000000000000003ULL, 0x0000000000000005ULL, 0x0000000000000008ULL, 0x000000000000000dULL, 0x0000000000000015ULL, 0x0000000000000022ULL, 0x0000000000000037ULL, 0x0000000000000059ULL, 0x0000000000000090ULL, 0x00000000000000e9ULL, 0x0000000000000179ULL, 0x0000000000000262ULL, 0x00000000000003dbULL, 0x000000000000063dULL, 0x0000000000000a18ULL, 0x0000000000001055ULL, 0x0000000000001a6dULL, 0x0000000000002ac2ULL, 0x000000000000452fULL, 0x0000000000006ff1ULL, 0x000000000000b520ULL, 0x0000000000012511ULL, 0x000000000001da31ULL, 0x000000000002ff42ULL, 0x000000000004d973ULL, 0x000000000007d8b5ULL, 0x00000000000cb228ULL, 0x0000000000148addULL, 0x0000000000213d05ULL, 0x000000000035c7e2ULL, 0x00000000005704e7ULL, 0x00000000008cccc9ULL, 0x0000000000e3d1b0ULL, 0x0000000001709e79ULL, 0x0000000002547029ULL, 0x0000000003c50ea2ULL, 0x0000000006197ecbULL, 0x0000000009de8d6dULL, 0x000000000ff80c38ULL, 0x0000000019d699a5ULL, 0x0000000029cea5ddULL, 0x0000000043a53f82ULL, 0x000000006d73e55fULL, 0x00000000b11924e1ULL, 0x000000011e8d0a40ULL, 0x00000001cfa62f21ULL, 0x00000002ee333961ULL, 0x00000004bdd96882ULL, 0x00000007ac0ca1e3ULL, 0x0000000c69e60a65ULL, 0x0000001415f2ac48ULL, 0x000000207fd8b6adULL, 0x0000003495cb62f5ULL, 0x0000005515a419a2ULL, 0x00000089ab6f7c97ULL, 0x000000dec1139639ULL, 0x000001686c8312d0ULL, 0x000002472d96a909ULL, 0x000003af9a19bbd9ULL, 0x000005f6c7b064e2ULL, 0x000009a661ca20bbULL }; const SWord64 s65 = s0 >= 65 ? 0x0000000000000000ULL : table0[s0]; return s65; }%(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredYsbv>The symbolic GCD algorithm, over two 8-bit numbers. We define sgcd a 0 to be a for all a, which implies  sgcd 0 0 = 0. Note that this is essentially Euclid's algorithm, except with a recursion depth counter. We need the depth counter since the algorithm is not symbolically terminating, as we don't have a means of determining that the second argument (b) will eventually reach 0 in a symbolic context. Hence we stop after 12 iterations. Why 12? We've empirically determined that this algorithm will recurse at most 12 times for arbitrary 8-bit numbers. Of course, this is a claim that we shall prove below.sbvWe have:prove sgcdIsCorrectQ.E.D.sbvThis call will generate the required C files. The following is the function body generated for ,. (We are not showing the generated header, Makefile, and the driver programs for brevity.) Note that the generated function is a constant time algorithm for GCD. It is not necessarily fastest, but it will take precisely the same amount of time for all values of x and y. /* File: "sgcd.c". Automatically generated by SBV. Do not edit! */ #include #include #include #include #include #include "sgcd.h" SWord8 sgcd(const SWord8 x, const SWord8 y) { const SWord8 s0 = x; const SWord8 s1 = y; const SBool s3 = s1 == 0; const SWord8 s4 = (s1 == 0) ? s0 : (s0 % s1); const SWord8 s5 = s3 ? s0 : s4; const SBool s6 = 0 == s5; const SWord8 s7 = (s5 == 0) ? s1 : (s1 % s5); const SWord8 s8 = s6 ? s1 : s7; const SBool s9 = 0 == s8; const SWord8 s10 = (s8 == 0) ? s5 : (s5 % s8); const SWord8 s11 = s9 ? s5 : s10; const SBool s12 = 0 == s11; const SWord8 s13 = (s11 == 0) ? s8 : (s8 % s11); const SWord8 s14 = s12 ? s8 : s13; const SBool s15 = 0 == s14; const SWord8 s16 = (s14 == 0) ? s11 : (s11 % s14); const SWord8 s17 = s15 ? s11 : s16; const SBool s18 = 0 == s17; const SWord8 s19 = (s17 == 0) ? s14 : (s14 % s17); const SWord8 s20 = s18 ? s14 : s19; const SBool s21 = 0 == s20; const SWord8 s22 = (s20 == 0) ? s17 : (s17 % s20); const SWord8 s23 = s21 ? s17 : s22; const SBool s24 = 0 == s23; const SWord8 s25 = (s23 == 0) ? s20 : (s20 % s23); const SWord8 s26 = s24 ? s20 : s25; const SBool s27 = 0 == s26; const SWord8 s28 = (s26 == 0) ? s23 : (s23 % s26); const SWord8 s29 = s27 ? s23 : s28; const SBool s30 = 0 == s29; const SWord8 s31 = (s29 == 0) ? s26 : (s26 % s29); const SWord8 s32 = s30 ? s26 : s31; const SBool s33 = 0 == s32; const SWord8 s34 = (s32 == 0) ? s29 : (s29 % s32); const SWord8 s35 = s33 ? s29 : s34; const SBool s36 = 0 == s35; const SWord8 s37 = s36 ? s32 : s35; const SWord8 s38 = s33 ? s29 : s37; const SWord8 s39 = s30 ? s26 : s38; const SWord8 s40 = s27 ? s23 : s39; const SWord8 s41 = s24 ? s20 : s40; const SWord8 s42 = s21 ? s17 : s41; const SWord8 s43 = s18 ? s14 : s42; const SWord8 s44 = s15 ? s11 : s43; const SWord8 s45 = s12 ? s8 : s44; const SWord8 s46 = s9 ? s5 : s45; const SWord8 s47 = s6 ? s1 : s46; const SWord8 s48 = s3 ? s0 : s47; return s48; }&(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredGsbvGiven a 64-bit quantity, the simplest (and obvious) way to count the number of bits that are set in it is to simply walk through all the bits and add 1 to a running count. This is slow, as it requires 64 iterations, but is simple and easy to convince yourself that it is correct. For instance:popCountSlow 0x0123456789ABCDEF 32 :: SWord8sbvFaster version. This is essentially the same algorithm, except we go 8 bits at a time instead of one by one, by using a precomputed table of population-count values for each byte. This algorithm loops= only 8 times, and hence is at least 8 times more efficient.sbvLook-up table, containing population counts for all possible 8-bit value, from 0 to 255. Note that we do not "hard-code" the values, but merely use the slow version to compute them.sbvStates the correctness of faster population-count algorithm, with respect to the reference slow version. Turns out Z3's default solver is rather slow for this one, but there's a magic incantation to make it go fast. See  )http://github.com/Z3Prover/z3/issues/1150 for details.let cmd = "(check-sat-using (then (using-params ackermannize_bv :div0_ackermann_limit 1000000) simplify bit-blast sat))"0proveWith z3{satCmd = cmd} fastPopCountIsCorrectQ.E.D.sbvNot only we can prove that faster version is correct, but we can also automatically generate C code to compute population-counts for us. This action will generate all the C files that you will need, including a driver program for test purposes.'Below is the generated header file for :genPopCountInC%== BEGIN: "Makefile" ================# Makefile for popCount. Automatically generated by SBV. Do not edit!=# include any user-defined .mk file in the current directory. -include *.mkCC?=gcc0CCFLAGS?=-Wall -O3 -DNDEBUG -fomit-frame-pointerall: popCount_driver!popCount.o: popCount.c popCount.h ${CC} ${CCFLAGS} -c $< -o $@$popCount_driver.o: popCount_driver.c ${CC} ${CCFLAGS} -c $< -o $@-popCount_driver: popCount.o popCount_driver.o ${CC} ${CCFLAGS} $^ -o $@clean: rm -f *.overyclean: clean rm -f popCount_driver%== END: "Makefile" =================='== BEGIN: "popCount.h" ================/* Header file for popCount. Automatically generated by SBV. Do not edit! */%#ifndef __popCount__HEADER_INCLUDED__%#define __popCount__HEADER_INCLUDED__#include #include #include #include #include #include #include /* The boolean type */typedef bool SBool;/* The float type */typedef float SFloat;/* The double type */typedef double SDouble;/* Unsigned bit-vectors */typedef uint8_t SWord8;typedef uint16_t SWord16;typedef uint32_t SWord32;typedef uint64_t SWord64;/* Signed bit-vectors */typedef int8_t SInt8;typedef int16_t SInt16;typedef int32_t SInt32;typedef int64_t SInt64;/* Entry point prototype: */!SWord8 popCount(const SWord64 x);*#endif /* __popCount__HEADER_INCLUDED__ */'== END: "popCount.h" ==================.== BEGIN: "popCount_driver.c" ================*/* Example driver program for popCount. */:/* Automatically generated by SBV. Edit as you see fit! */#include #include "popCount.h"int main(void){: const SWord8 __result = popCount(0x1b02e143e4f0e0e5ULL); printf("popCount(0x1b02e143e4f0e0e5ULL) = %"PRIu8"\n", __result); return 0;}.== END: "popCount_driver.c" =================='== BEGIN: "popCount.c" ================/* File: "popCount.c". Automatically generated by SBV. Do not edit! */#include "popCount.h" SWord8 popCount(const SWord64 x){ const SWord64 s0 = x;" static const SWord8 table0[] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7, 1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7, 2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6, 3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7, 3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7, 4, 5,. 5, 6, 5, 6, 6, 7, 5, 6, 6, 7, 6, 7, 7, 8 };1 const SWord64 s11 = s0 & 0x00000000000000ffULL;" const SWord8 s12 = table0[s11]; const SWord64 s14 = s0 >> 8;2 const SWord64 s15 = 0x00000000000000ffULL & s14;" const SWord8 s16 = table0[s15]; const SWord8 s17 = s12 + s16; const SWord64 s18 = s14 >> 8;2 const SWord64 s19 = 0x00000000000000ffULL & s18;" const SWord8 s20 = table0[s19]; const SWord8 s21 = s17 + s20; const SWord64 s22 = s18 >> 8;2 const SWord64 s23 = 0x00000000000000ffULL & s22;" const SWord8 s24 = table0[s23]; const SWord8 s25 = s21 + s24; const SWord64 s26 = s22 >> 8;2 const SWord64 s27 = 0x00000000000000ffULL & s26;" const SWord8 s28 = table0[s27]; const SWord8 s29 = s25 + s28; const SWord64 s30 = s26 >> 8;2 const SWord64 s31 = 0x00000000000000ffULL & s30;" const SWord8 s32 = table0[s31]; const SWord8 s33 = s29 + s32; const SWord64 s34 = s30 >> 8;2 const SWord64 s35 = 0x00000000000000ffULL & s34;" const SWord8 s36 = table0[s35]; const SWord8 s37 = s33 + s36; const SWord64 s38 = s34 >> 8;2 const SWord64 s39 = 0x00000000000000ffULL & s38;" const SWord8 s40 = table0[s39]; const SWord8 s41 = s37 + s40; return s41;}'== END: "popCount.c" =================='(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredsbvA definition of shiftLeft that can deal with variable length shifts. (Note that the  method from the  class requires an  shift amount.) Unfortunately, this'll generate rather clumsy C code due to the use of tables etc., so we uninterpret it for code generation purposes using the  function.sbvTest function that uses shiftLeft defined above. When used as a normal Haskell function or in verification the definition is fully used, i.e., no uninterpretation happens. To wit, we have:tstShiftLeft 3 4 5224 :: SWord32,prove $ \x y -> tstShiftLeft x y 0 .== x + yQ.E.D.sbvGenerate C code for "tstShiftLeft". In this case, SBV will *use* the user given definition verbatim, instead of generating code for it. (Also see the functions  ,  , and  .)((c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred1-sbvThe key schedule. AES executes in rounds, and it treats first and last round keys slightly differently than the middle ones. We reflect that choice by being explicit about it in our type. The length of the middle list of keys depends on the key-size, which in turn determines the number of rounds.sbvThe key, which can be 128, 192, or 256 bits. Represented as a sequence of 32-bit words.sbvAES state. The state consists of four 32-bit words, each of which is in turn treated as four GF28's, i.e., 4 bytes. The T-Box implementation keeps the four-bytes together for efficient representation.sbvAn element of the Galois Field 2^8, which are essentially polynomials with maximum degree 7. They are conveniently represented as values between 0 and 255.sbvMultiplication in GF(2^8). This is simple polynomial multiplication, followed by the irreducible polynomial x^8+x^4+x^3+x^1+1. We simply use the  0 function exported by SBV to do the operation. sbvExponentiation by a constant in GF(2^8). The implementation uses the usual square-and-multiply trick to speed up the computation.sbvComputing inverses in GF(2^8). By the mathematical properties of GF(2^8) and the particular irreducible polynomial used x^8+x^5+x^3+x^1+1, it turns out that raising to the 254 power gives us the multiplicative inverse. Of course, we can prove this using SBV::prove $ \x -> x ./= 0 .=> x `gf28Mult` gf28Inverse x .== 1Q.E.D.Note that we exclude 0? in our theorem, as it does not have a multiplicative inverse.sbv4Rotating a state row by a fixed amount to the right.sbvDefinition of round-constants, as specified in Section 5.2 of the AES standard.sbvThe  InvMixColumns transformation, as described in Section 5.3.3 of the standard. Note that this transformation is only used explicitly during key-expansion in the T-Box implementation of AES.sbvKey expansion. Starting with the given key, returns an infinite sequence of words, as described by the AES standard, Section 5.2, Figure 11.sbvThe values of the AES S-box table. Note that we describe the S-box programmatically using the mathematical construction given in Section 5.1.1 of the standard. However, the code-generation will turn this into a mere look-up table, as it is just a constant table, all computation being done at "compile-time".sbvThe sbox transformation. We simply select from the sbox table. Note that we are obliged to give a default value (here 0) to be used if the index is out-of-bounds as required by SBV's  function. However, that will never happen since the table has all 256 elements in it.sbvThe values of the inverse S-box table. Again, the construction is programmatic.sbv!The inverse s-box transformation.sbvProve that the  and  are inverses. We have:prove sboxInverseCorrectQ.E.D.sbvAdding the round-key to the current state. We simply exploit the fact that addition is just xor in implementing this transformation.sbv.T-box table generation function for encryptionsbv&First look-up table used in encryptionsbv'Second look-up table used in encryptionsbv&Third look-up table used in encryptionsbv'Fourth look-up table used in encryptionsbv.T-box table generating function for decryptionsbv&First look-up table used in decryptionsbv'Second look-up table used in decryptionsbv&Third look-up table used in decryptionsbv'Fourth look-up table used in decryptionsbvGeneric round function. Given the function to perform one round, a key-schedule, and a starting state, it performs the AES rounds.sbvOne encryption round. The first argument indicates whether this is the final round or not, in which case the construction is slightly different.sbvOne decryption round. Similar to the encryption round, the first argument indicates whether this is the final round or not.sbvKey schedule. Given a 128, 192, or 256 bit key, expand it to get key-schedules for encryption and decryption. The key is given as a sequence of 32-bit words. (4 elements for 128-bits, 6 for 192, and 8 for 256.)sbvBlock encryption. The first argument is the plain-text, which must have precisely 4 elements, for a total of 128-bits of input. The second argument is the key-schedule to be used, obtained by a call to . The output will always have 4 32-bit words, which is the cipher-text.sbv3Block decryption. The arguments are the same as in , except the first argument is the cipher-text and the output is the corresponding plain-text.sbv?128-bit encryption test, from Appendix C.1 of the AES standard:map hex8 t128Enc-["69c4e0d8","6a7b0430","d8cdb780","70b4c55a"]sbv?128-bit decryption test, from Appendix C.1 of the AES standard:map hex8 t128Dec-["00112233","44556677","8899aabb","ccddeeff"]sbv?192-bit encryption test, from Appendix C.2 of the AES standard:map hex8 t192Enc-["dda97ca4","864cdfe0","6eaf70a0","ec0d7191"]sbv?192-bit decryption test, from Appendix C.2 of the AES standard:map hex8 t192Dec-["00112233","44556677","8899aabb","ccddeeff"]sbv:256-bit encryption, from Appendix C.3 of the AES standard:map hex8 t256Enc-["8ea2b7ca","516745bf","eafc4990","4b496089"]sbv:256-bit decryption, from Appendix C.3 of the AES standard:map hex8 t256Dec-["00112233","44556677","8899aabb","ccddeeff"]sbv;Correctness theorem for 128-bit AES. Ideally, we would run:  prove aes128IsCorrect to get a proof automatically. Unfortunately, while SBV will successfully generate the proof obligation for this theorem and ship it to the SMT solver, it would be naive to expect the SMT-solver to finish that proof in any reasonable time with the currently available SMT solving technologies. Instead, we can issue:  quickCheck aes128IsCorrect and get some degree of confidence in our code. Similar predicates can be easily constructed for 192, and 256 bit cases as well.sbv+Code generation for 128-bit AES encryption.The following sample from the generated code-lines show how T-Boxes are rendered as C arrays:  static const SWord32 table1[] = { 0xc66363a5UL, 0xf87c7c84UL, 0xee777799UL, 0xf67b7b8dUL, 0xfff2f20dUL, 0xd66b6bbdUL, 0xde6f6fb1UL, 0x91c5c554UL, 0x60303050UL, 0x02010103UL, 0xce6767a9UL, 0x562b2b7dUL, 0xe7fefe19UL, 0xb5d7d762UL, 0x4dababe6UL, 0xec76769aUL, ... } The generated program has 5 tables (one sbox table, and 4-Tboxes), all converted to fast C arrays. Here is a sample of the generated straightline C-code:  const SWord8 s1915 = (SWord8) s1912; const SWord8 s1916 = table0[s1915]; const SWord16 s1917 = (((SWord16) s1914) << 8) | ((SWord16) s1916); const SWord32 s1918 = (((SWord32) s1911) << 16) | ((SWord32) s1917); const SWord32 s1919 = s1844 ^ s1918; const SWord32 s1920 = s1903 ^ s1919; The GNU C-compiler does a fine job of optimizing this straightline code to generate a fairly efficient C implementation.sbvComponents of the AES implementation that the library is generated fromsbv8Generate code for AES functionality; given the key size.sbvGenerate a C library, containing functions for performing 128-bit encdeckey-expansion. A note on performance: In a very rough speed test, the generated code was able to do 6.3 million block encryptions per second on a decent MacBook Pro. On the same machine, OpenSSL reports 8.2 million block encryptions per second. So, the generated code is about 25% slower as compared to the highly optimized OpenSSL implementation. (Note that the speed test was done somewhat simplistically, so these numbers should be considered very rough estimates.)sbvFor doctest purposes onlysbvplain-text wordssbv key-wordssbv+True if round-trip gives us plain-text back--)(c) Austin SeippBSD3erkokl@gmail.com experimental Safe-Inferred sbv:Represents the current state of the RC4 stream: it is the S array along with the i and j index values used by the PRGA.sbvThe key is a stream of  values.sbvRC4 State contains 256 8-bit values. We use the symbolically accessible full-binary type  to represent the state, since RC4 needs access to the array via a symbolic index and it's important to minimize access time.sbvConstruct the fully balanced initial tree, where the leaves are simply the numbers 0 through 255.sbv$Swaps two elements in the RC4 array.sbvImplements the PRGA used in RC4. We return the new state and the next key value generated.sbvConstructs the state to be used by the PRGA using the given key.sbvThe key-schedule. Note that this function returns an infinite list.sbv0Generate a key-schedule from a given key-string.sbvRC4 encryption. We generate key-words and xor it with the input. The following test-vectors are from Wikipedia  http://en.wikipedia.org/wiki/RC4:*concatMap hex2 $ encrypt "Key" "Plaintext""bbf316e8d940af0ad3"'concatMap hex2 $ encrypt "Wiki" "pedia" "1021bf0420"2concatMap hex2 $ encrypt "Secret" "Attack at dawn""45a01f645fc35b383552544b9bf5"sbvRC4 decryption. Essentially the same as decryption. For the above test vectors we have:decrypt "Key" [0xbb, 0xf3, 0x16, 0xe8, 0xd9, 0x40, 0xaf, 0x0a, 0xd3] "Plaintext"-decrypt "Wiki" [0x10, 0x21, 0xbf, 0x04, 0x20]"pedia"decrypt "Secret" [0x45, 0xa0, 0x1f, 0x64, 0x5f, 0xc3, 0x5b, 0x38, 0x35, 0x52, 0x54, 0x4b, 0x9b, 0xf5]"Attack at dawn"sbvProve that round-trip encryption/decryption leaves the plain-text unchanged. The theorem is stated parametrically over key and plain-text sizes. The expression performs the proof for a 40-bit key (5 bytes) and 40-bit plaintext (again 5 bytes).Note that this theorem is trivial to prove, since it is essentially establishing xor'in the same value twice leaves a word unchanged (i.e., x  y  y = x). However, the proof takes quite a while to complete, as it gives rise to a fairly large symbolic trace.sbvFor doctest purposes only  *(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred'1 $sbv5 is a synonym for lists, but makes the intent clear.sbvParameterized SHA representation, that captures all the differences between variants of the algorithm. w is the word-size type.sbv/Section 1 : Word size we operate withsbv-Section 1 : Block size for messagessbv7Section 4.1.2-3 : Coefficients of the Sum0 functionsbv7Section 4.1.2-3 : Coefficients of the Sum1 functionsbv9Section 4.1.2-3 : Coefficients of the sigma0 functionsbv9Section 4.1.2-3 : Coefficients of the sigma1 functionsbv)Section 4.2.2-3 : Magic SHA constantssbv(Section 5.3.2-6 : Initial hash valuesbvSection 6.2.2, 6.4.2: How many iterations are there in the inner loopsbvThe choose function.sbvThe majority function.sbvThe sum-0 function. We parameterize over the rotation amounts as different variants of SHA use different rotation amounts.sbv)The sum-1 function. Again, parameterized.sbv#The sigma0 function. Parameterized.sbv#The sigma1 function. Parameterized.sbvParameterization for SHA224.sbv9Parameterization for SHA256. Inherits mostly from SHA224.sbvParameterization for SHA384.sbv9Parameterization for SHA512. Inherits mostly from SHA384.sbv 2^64 (or 2^128), and you'd run out of memory first!sbvHash one block of message, starting from a previous hash. This function corresponds to body of the for-loop in the spec. This function always produces a list of length 8, corresponding to the final 8 values of the H.sbvCompute the hash of a given string using the specified parameterized hash algorithm.sbvSHA224 digest.sbvSHA256 digest.sbvSHA384 digest.sbvSHA512 digest.sbvSHA512_224 digest.sbvSHA512_256 digest.sbvCollection of known answer tests for SHA. Since these tests take too long during regular regression runs, we pass as an argument how many to run. Increase the below number to 24 to run all tests. We have:knownAnswerTests 1TruesbvGenerate code for one block of SHA256 in action, starting from an arbitrary hash value.sbvHelper for chunking a list by given lengths and combining each chunk with a functionsbv'Nicely lay out a hash value as a string&&+(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred msbv)Encode the delta-sat problem as given in  http://dreal.github.io/ We have:flyspeck Unsatisfiable,(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred1sbvCompute the 16 bit CRC of a 48 bit message, using the given polynomialsbvCount the differing bits in the message and the corresponding CRCsbvGiven a hamming distance value hd,  returns true if the 16 bit polynomial can distinguish all messages that has at most hd? different bits. Note that we express this conversely: If the sent and received messages are different, then it must be the case that that must differ from each other (including CRCs), in more than hd bits.sbvGenerate good CRC polynomials for 48-bit words, given the hamming distance hd.sbvFind and display all degree 16 polynomials with hamming distance at least 4, for 48 bit messages.When run, this function prints:  Polynomial #1. x^16 + x^3 + x^2 + 1 Polynomial #2. x^16 + x^3 + x^2 + x + 1 Polynomial #3. x^16 + x^3 + x + 1 Polynomial #4. x^16 + x^15 + x^2 + 1 Polynomial #5. x^16 + x^15 + x^2 + x + 1 Found: 5 polynomial(s). Note that different runs can produce different results, depending on the random numbers used by the solver, solver version, etc. (Also, the solver will take some time to generate these results. On my machine, the first five polynomials were generated in about 5 minutes.)-(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-InferredsbvFor a homogeneous problem, the solution is any linear combination of the resulting vectors. For a non-homogeneous problem, the solution is any linear combination of the vectors in the second component plus one of the vectors in the first component.sbvldn: Solve a (L)inear (D)iophantine equation, returning minimal solutions over (N)aturals. The input is given as a rows of equations, with rhs values separated into a tuple. The first parameter limits the search to bound: In case there are too many solutions, you might want to limit your search space.sbvFind the basis solution. By definition, the basis has all non-trivial (i.e., non-0) solutions that cannot be written as the sum of two other solutions. We use the mathematically equivalent statement that a solution is in the basis if it's least according to the natural partial order using the ordinary less-than relation.sbvSolve the equation: 2x + y - z = 2We have:test2NonHomogeneous [[0,2,0],[1,0,0]] [[0,1,1],[1,0,2]]/which means that the solutions are of the form: 9(0, 2, 0) + k (0, 1, 1) + k' (1, 0, 2) = (k', 2+k, k+2k')OR 9(1, 0, 0) + k (0, 1, 1) + k' (1, 0, 2) = (1+k', k, k+2k')for arbitrary k, k'. It's easy to see that these are really solutions to the equation given. It's harder to see that they cover all possibilities, but a moments thought reveals that is indeed the case.sbvA puzzle: Five sailors and a monkey escape from a naufrage and reach an island with coconuts. Before dawn, they gather a few of them and decide to sleep first and share the next day. At night, however, one of them awakes, counts the nuts, makes five parts, gives the remaining nut to the monkey, saves his share away, and sleeps. All other sailors do the same, one by one. When they all wake up in the morning, they again make 5 shares, and give the last remaining nut to the monkey. How many nuts were there at the beginning?7We can model this as a series of diophantine equations:  x_0 = 5 x_1 + 1 4 x_1 = 5 x_2 + 1 4 x_2 = 5 x_3 + 1 4 x_3 = 5 x_4 + 1 4 x_4 = 5 x_5 + 1 4 x_5 = 5 x_6 + 1 We need to solve for x_0, over the naturals. If you run this program, z3 takes its time (quite long!) but, it eventually computes: [15621,3124,2499,1999,1599,1279,1023] as the answer.That is:  * There was a total of 15621 coconuts * 1st sailor: 15621 = 3124*5+1, leaving 15621-3124-1 = 12496 * 2nd sailor: 12496 = 2499*5+1, leaving 12496-2499-1 = 9996 * 3rd sailor: 9996 = 1999*5+1, leaving 9996-1999-1 = 7996 * 4th sailor: 7996 = 1599*5+1, leaving 7996-1599-1 = 6396 * 5th sailor: 6396 = 1279*5+1, leaving 6396-1279-1 = 5116 * In the morning, they had: 5116 = 1023*5+1. Note that this is the minimum solution, that is, we are guaranteed that there's no solution with less number of coconuts. In fact, any member of [15625*k-4 | k <- [1..]] is a solution, i.e., so are 31246, 46871, 62496, 78121, etc.Note that we iteratively deepen our search by requesting increasing number of solutions to avoid the all-sat pitfall..(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred#56=*n sbv,Each agent can be in one of the three statessbv Regular worksbv!Intention to enter critical statesbvIn the critical statesbvSymbolic version of the type .sbv$Symbolic version of the constructor .sbv$Symbolic version of the constructor .sbv$Symbolic version of the constructor .sbvA bounded mutex property holds for two sequences of state transitions, if they are not in their critical section at the same time up to that given bound.sbv1A sequence is valid upto a bound if it starts at ', and follows the mutex rules. That is:From  it can switch to  or stay From  it can switch to  if it's its turnFrom  it can either stay in  or go back to  The variable me identifies the agent id.sbvThe mutex algorithm, coded implicitly as an assignment to turns. Turns start at 1, and at each stage is either 1 or 2; giving preference to that process. The only condition is that if either process is in its critical section, then the turn value stays the same. Note that this is sufficient to satisfy safety (i.e., mutual exclusion), though it does not guarantee liveness.sbv1Check that we have the mutex property so long as  and  holds; i.e., so long as both the agents and the arbiter act according to the rules. The check is bounded up-to-the given concrete bound; so this is an example of a bounded-model-checking style proof. We have: checkMutex 20 All is good!sbvOur algorithm is correct, but it is not fair. It does not guarantee that a process that wants to enter its critical-section will always do so eventually. Demonstrate this by trying to show a bounded trace of length 10, such that the second process is ready but never transitions to critical. We have: ghci> notFair 10 Fairness is violated at bound: 10 P1: [Idle,Idle,Ready,Critical,Idle,Idle,Ready,Critical,Idle,Idle] P2: [Idle,Ready,Ready,Ready,Ready,Ready,Ready,Ready,Ready,Ready] Ts: [1,2,1,1,1,1,1,1,1,1]As expected, P2 gets ready but never goes critical since the arbiter keeps picking P1 unfairly. (You might get a different trace depending on what z3 happens to produce!)$Exercise for the reader: Change the  function so that it alternates the turns from the previous value if neither process is in critical. Show that this makes the  function below no longer exhibits the issue. Is this sufficient? Concurrent programming is tricky!  /(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred.sbvA deck is simply a list of integers. Note that a regular deck will have distinct cards, we do not impose this in our proof. That is, the proof works regardless whether we put duplicates into the deck, which generalizes the theorem.sbv$Count-out-and-transfer (COAT): Take k cards from top, reverse it, and put it at the bottom of a deck.sbv COAT 4 times.sbv4Key property of COATing. If you take a deck of size n, and COAT it 4 times, then the deck remains in the same order. The COAT factor, k6, must be greater than half the size of the deck size.6Note that the proof time increases significantly with n.. Here's a proof for deck size of 6, for all k >= 3. coatCheck 6Q.E.D.It's interesting to note that one can also express this theorem by making n symbolic as well. However, doing so definitely requires an inductive proof, and the SMT-solver doesn't handle this case out-of-the-box, running forever.0(c) Joel BurgetBSD3erkokl@gmail.com experimental Safe-Inferred0'sbv3Compute a prefix of the fibonacci numbers. We have: mkFibs 10[1,1,2,3,5,8,13,21,34,55]sbvGenerate fibonacci numbers as a sequence. Note that we constrain only the first 200 entries.1(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred#1Tsbv>Simple example demonstrating the use of nested lists. We have:Turned off. See:  *https://github.com/Z3Prover/z3/issues/28208 nestedExample [[1,2,3],[4,5,6,7],[8,9,10],[11,12,13]]2(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred"5sbv+A simple predicate, based on two variables x and y , true when  0 <= x <= 1 and  x - abs y is 0.sbv=Generate all satisfying assignments for our problem. We have: allModels Solution #1: x = 1 :: Integer y = -1 :: Integer Solution #2: x = 1 :: Integer y = 1 :: Integer Solution #3: x = 0 :: Integer y = 0 :: IntegerFound 3 different solutions.Note that solutions 2 and 3 share the value x = 1&, since there are multiple values of y% that make this particular choice of x satisfy our constraint.sbvGenerate all satisfying assignments, but we first tell SBV that y should not be considered as a model problem, i.e., it's auxiliary. We have:modelsWithYAux Solution #1: x = 1 :: Integer Solution #2: x = 0 :: IntegerFound 2 different solutions.Note that we now have only two solutions, one for each unique value of x that satisfy our constraint.3(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred9sbvSum of numbers from 0 to the given number. Note that this cannot be defined as a regular Haskell function, as it wouldn't terminate as it recurses on a symbolic argument.sbvAdd the definition of sum to the SMT solver. Note that SBV performs no checks on your definition, neither that it is well formed, or even has the correct type!sbvA simple proof using . We get a failure, because we haven't given the solver the definition, and thus it goes completely uninterpreted.We have: badExampleFalsifiable. Counter-example: sumToN :: Integer -> Integer sumToN _ = 0Since  remains uninterpreted, the solver gave us a model that obviously fails the property.sbvSame example, except this time we give the solver the definition of the function, and thus the proof goes through.We have: goodExampleQ.E.D.In this case, the solver has the definition, and proves the predicate as expected.4(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred56=?% sbvA simple enumerated type, that we'd like to translate to SMT-Lib intact; i.e., this type will not be uninterpreted but rather preserved and will be just like any other symbolic type SBV provides.-Also note that we need to have the following LANGUAGE options defined: TemplateHaskell, StandaloneDeriving, DeriveDataTypeable, DeriveAnyClass for this to work.sbvSymbolic version of the type .sbv$Symbolic version of the constructor .sbv$Symbolic version of the constructor .sbv$Symbolic version of the constructor .sbvHave the SMT solver enumerate the elements of the domain. We have:elts Solution #1: s0 = C :: E Solution #2: s0 = B :: E Solution #3: s0 = A :: EFound 3 different solutions.sbv9Shows that if we require 4 distinct elements of the type , we shall fail; as the domain only has three elements. We have:four UnsatisfiablesbvEnumerations are automatically ordered, so we can ask for the maximum element. Note the use of quantification. We have:maxESatisfiable. Model: maxE = C :: Esbv/Similarly, we get the minimum element. We have:minESatisfiable. Model: minE = A :: E  5(c) Levent ErkokBSD3erkokl@gmail.com experimental Safe-Inferred1TsbvProve that floating point addition is not associative. For illustration purposes, we will require one of the inputs to be a NaN . We have:prove $ assocPlus (0/0)Falsifiable. Counter-example: s0 = 0.0 :: Float s1 = 0.0 :: FloatIndeed:let i = 0/0 :: Floati + (0.0 + 0.0)NaN((i + 0.0) + 0.0)NaNBut keep in mind that NaN< does not equal itself in the floating point world! We have:$let nan = 0/0 :: Float in nan == nanFalsesbv:Prove that addition is not associative, even if we ignore NaN/Infinity+ values. To do this, we use the predicate  -, which is true of a floating point number ( or ) if it is neither NaN nor Infinity. (That is, it's a representable point in the real-number line.)We have:assocPlusRegularFalsifiable. Counter-example: x = 1.5652655e23 :: Float y = -1.3279453e22 :: Float z = 1.8019954e20 :: FloatIndeed, we have:let x = 1.5652655e23 :: Floatlet y = -1.3279453e22 :: Floatlet z = 1.8019954e20 :: Float x + (y + z) 1.434273e23 (x + y) + z 1.4342729e23#Note the difference in the results!sbvDemonstrate that a+b = a does not necessarily mean b is 0 in the floating point world, even when we disallow the obvious solution when a and b are  Infinity. We have:nonZeroAdditionFalsifiable. Counter-example: a = 9.072796e16 :: Float b = 1.7942292e-24 :: FloatIndeed, we have:let a = 9.072796e16 :: Floatlet b = 1.7942292e-24 :: Float a + b == aTrueb == 0FalsesbvThis example illustrates that  a * (1/a) does not necessarily equal 1). Again, we protect against division by 0 and NaN/Infinity.We have: multInverseFalsifiable. Counter-example: a = -13539.329 :: FloatIndeed, we have:let a = -13539.329 :: Float a * (1/a) 0.99999994sbvOne interesting aspect of floating-point is that the chosen rounding-mode can effect the results of a computation if the exact result cannot be precisely represented. SBV exports the functions  ,  ,  ,  ,   and  2 which allows users to specify the IEEE supported a for the operation. This example illustrates how SBV can be used to find rounding-modes where, for instance, addition can produce different results. We have: roundingAddSatisfiable. Model:& rm = RoundTowardZero :: RoundingMode x = 4.0564797e31 :: Float y = 2.055174e25 :: Float(Note that depending on your version of Z3, you might get a different result.) Unfortunately Haskell floats do not allow computation with arbitrary rounding modes, but SBV's  type does. We have:fpAdd sRoundNearestTiesToEven 4.0564797e31 2.055174e25 :: SFPSingle$4.05648192e31 :: SFloatingPoint 8 24