210 likes | 314 Vues
Explore the advanced features of Z3 tool including support for Non-linear arithmetic, Quantifier Elimination, and Fixed-points. Learn about key concepts such as LRA, LIA, and algebraic data types. Dive into the practical applications of quantifier elimination procedures, virtual substitutions, and domain closure for efficient decision-making and logic analysis. Discover the powerful fixed-point solver in Z3 and how it enhances abstract interpretation and logic programming. Engage with tools like BDD, Datalog, and Havoc for precise abstraction and refinement. Develop your expertise in predicate-based modeling and symbolic reasoning techniques within the Z3 environment. Experience the enhanced capabilities of Z3 through various examples and methodologies for effective problem-solving.
E N D
Quantifiers, Arithmetic and Fixed-points • Quantifier Elimination Procedures in Z3 • Support for Non-linear arithmetic • Fixed-points – features and a preview
Quantifier Elimination • Option: ELIM_QUANTIFIERS=true • LRA – Linear real arithmetic • LIA – Linear integer arithemtic • D – Algebraic Datatypes • Booleans & Bit-vectors – (All-SAT) • NRA2 – Quadratic (using virtual substitutions) • Arrays – ad hoc
LRA Terms Atoms Formulas
LIA Terms Atoms Formulas
D – algebraic data-types • Domain Closure: • Eliminate accessors: • Solve equalities: • Virtual substitution:
NRA • Virtual substitutions for second-degree polynomials • Method by Weispfenning et.al. (Redlog) • Used both as quantifier elimination (all SAT) and ground decision procedure (first SAT) • ….
Analysis Tool Logic Engine Z3
Tool Encodings Methodology Fixed-Point SLAyer Sep. Logic Abstract Interpretation Logic Programming GateKeeper Simulation Relation Predicate Based MC Summaries SAGE BDD MC Abstraction Refinement Datalog Havoc Houdini Interpolating MC
The Z Tool • Ships with Z3 • Online demo • BDD tablesample in distribution • Mostly developed by Krystof Hoder
Why fixed-points Variant for Connoisseurs: Recall the basic sausage* rule: In a nutshell: Aim of Satisfiability Modulo Fixed-points and Theories. Is valid? Is satisfiable? *“sausage” terminology by AndreyRybalchenko
Portfolio approach to fix-points • Efficient Datalog Engine • Finite Tables • Symbolic Tables • ComposableAbstract Relations: • Use abstract interpretation domains. • Use SMT as a domain. • Reduced product operators for sharing • Efficient Algorithms from Symbolic MC Modulo Theories • I will give a taste of this later. Is satisfiable? BDD packages Abstract Domains Interpolation Tools
Core Engine Compilation Restarts Relational Algebra Abstract Machine
Core Engine Plugin architecture: New domains added using plugins implementing Relational Algebra operations. Restarts
Relation representation x 0 1 y z 0 1 Bounds Intervals + = + Pentagons =
Relation representation x 0 1 y z 0 1 Bounds Intervals • Product: Table x Table • Indexed Relation: Table x Relation • Reduced Product: Relation x Relation
Preview – Generalized PDR Is valid? Is satisfiable? • PDR: Property Directed ReachabilityA new Algorithm For Symbolic Model Checking of Hardware • by Aaron Bradley. • In • Lift it to proceduresmultiple operators, non-linear • Lift beyond propositional logic Theories, non-ground
Generalizations • PDR works for linearTransformers • Generalize to non-linear • PDR works with a singleTransformer • Work with multipletransformers. • A Solver for Datalog/Boolean Programs • PDR is for propositionallogic • Search Modulo Theories (with McMillan’s FociZ3 and other methods)