1 / 117

Satisfiability Modulo Theories: An Appetizer SBMF 2009 - Gramado

Satisfiability Modulo Theories: An Appetizer SBMF 2009 - Gramado. Leonardo de Moura Microsoft Research. Symbolic Reasoning. Verification/Analysis tools need some form of Symbolic Reasoning. Symbolic Reasoning. Logic is “The Calculus of Computer Science” (Z. Manna).

israel
Télécharger la présentation

Satisfiability Modulo Theories: An Appetizer SBMF 2009 - Gramado

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Satisfiability Modulo Theories: An AppetizerSBMF 2009 - Gramado Leonardo de Moura Microsoft Research

  2. Symbolic Reasoning • Verification/Analysis tools need some form of Symbolic Reasoning Satisfiability Modulo Theories: An Appetizer

  3. Symbolic Reasoning • Logic is “The Calculus of Computer Science” (Z. Manna). • High computational complexity Undecidable (FOL + LA) Semi-decidable (First-order logic) NEXPTime-complete (EPR) PSpace-complete (QBF) NP-complete (Propositional logic) P-time (Equality) Satisfiability Modulo Theories: An Appetizer

  4. Applications Satisfiability Modulo Theories: An Appetizer

  5. Some Applications @ Microsoft HAVOC Terminator T-2 Hyper-V VCC NModel Vigilante SpecExplorer F7 SAGE Satisfiability Modulo Theories: An Appetizer

  6. Test case generation unsigned GCD(x, y) { requires(y > 0); while (true) { unsigned m = x % y; if (m == 0) return y; x = y; y = m; } } (y0 > 0) and (m0 = x0 % y0) and not (m0 = 0) and (x1 = y0) and (y1 = m0) and (m1 = x1 % y1) and (m1 = 0) • x0 = 2 • y0 = 4 • m0 = 2 • x1 = 4 • y1 = 2 • m1 = 0 SSA Solver We want a trace where the loop is executed twice. Satisfiability Modulo Theories: An Appetizer

  7. Type checking Signature: div : int, { x : int | x  0 }  int Subtype Call site: • if a  1 and a  b then • return div(a, b) Verification condition • a  1 and a  b implies b  0 Satisfiability Modulo Theories: An Appetizer

  8. Satisfiability Modulo Theories (SMT) • Is formula Fsatisfiable modulo theory T ? SMT solvers have specialized algorithms for T Satisfiability Modulo Theories: An Appetizer

  9. Satisfiability Modulo Theories (SMT) • b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1) Satisfiability Modulo Theories: An Appetizer

  10. Satisfiability Modulo Theories (SMT) • b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1) Arithmetic Satisfiability Modulo Theories: An Appetizer

  11. Satisfiability Modulo Theories (SMT) • b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1) Array Theory Arithmetic Satisfiability Modulo Theories: An Appetizer

  12. Satisfiability Modulo Theories (SMT) • b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1) Uninterpreted Functions Array Theory Arithmetic Satisfiability Modulo Theories: An Appetizer

  13. Theories • A Theory is a set of sentences • Alternative definition: A Theory is a class of structures Satisfiability Modulo Theories: An Appetizer

  14. SMT@Microsoft: Solver • Z3 is a new solver developed at Microsoft Research. • Development/Research driven by internal customers. • Free for academic research. • Interfaces: • http://research.microsoft.com/projects/z3 Satisfiability Modulo Theories: An Appetizer

  15. Ground formulas For most SMT solvers: F is a set of ground formulas • Many Applications • Bounded Model Checking • Test-Case Generation Satisfiability Modulo Theories: An Appetizer

  16. Deciding Equality a = b, b = c, d = e, b = s, d = t, a e, a s a b c d e s t Satisfiability Modulo Theories: An Appetizer

  17. Deciding Equality a = b, b = c, d = e, b = s, d = t, a e, a s a,b a b c d e s t Satisfiability Modulo Theories: An Appetizer

  18. Deciding Equality a = b, b = c, d = e, b = s, d = t, a e, a s a,b,c a,b c d e s t Satisfiability Modulo Theories: An Appetizer

  19. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e, a s a,b,c d,e d e s t Satisfiability Modulo Theories: An Appetizer

  20. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e, a s a,b,c,s a,b,c d,e s t Satisfiability Modulo Theories: An Appetizer

  21. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e, a s a,b,c,s d,e,t d,e t Satisfiability Modulo Theories: An Appetizer

  22. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e, a s a,b,c,s d,e,t Satisfiability Modulo Theories: An Appetizer

  23. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e, a s a,b,c,s d,e,t Unsatisfiable Satisfiability Modulo Theories: An Appetizer

  24. Deciding Equality a = b,b = c, d = e, b = s, d = t, a e a,b,c,s d,e,t Model |M| = { 0, 1 } M(a) = M(b) = M(c) = M(s) = 0 M(d) = M(e) = M(t) = 1 Satisfiability Modulo Theories: An Appetizer

  25. Deciding Equality + (uninterpreted) Functions a = b,b = c, d = e, b = s, d = t, f(a, g(d))  f(b, g(e)) f(b,g(e)) f(a,g(d)) a,b,c,s d,e,t g(e) g(d) Congruence Rule: • x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn) Satisfiability Modulo Theories: An Appetizer

  26. Deciding Equality + (uninterpreted) Functions a = b,b = c, d = e, b = s, d = t, f(a, g(d))  f(b, g(e)) f(b,g(e)) f(a,g(d)) g(d),g(e) a,b,c,s d,e,t g(e) g(d) Congruence Rule: • x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn) Satisfiability Modulo Theories: An Appetizer

  27. Deciding Equality + (uninterpreted) Functions a = b,b = c, d = e, b = s, d = t, f(a, g(d))  f(b, g(e)) f(a,g(d)),f(b,g(e)) f(b,g(e)) f(a,g(d)) g(d),g(e) a,b,c,s d,e,t Congruence Rule: • x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn) Satisfiability Modulo Theories: An Appetizer

  28. Deciding Equality + (uninterpreted) Functions a = b,b = c, d = e, b = s, d = t, f(a, g(d))  f(b, g(e)) f(a,g(d)),f(b,g(e)) g(d),g(e) a,b,c,s d,e,t Unsatisfiable Satisfiability Modulo Theories: An Appetizer

  29. Deciding Equality + (uninterpreted) Functions (fully shared) DAGs for representing terms Union-find data-structure + Congruence Closure O(n log n) Satisfiability Modulo Theories: An Appetizer

  30. Deciding Polynomial Equations (over C) x2y – 1 = 0, xy2 – y = 0, xz – z + 1 = 0 Tool:Gröbner Basis Satisfiability Modulo Theories: An Appetizer

  31. Deciding Polynomial Equations (over C) Polynomial Ideals: Algebraic generalization of zeroness 0  I p  I, q  I implies p + q  I p  I implies pq  I Satisfiability Modulo Theories: An Appetizer

  32. Deciding Polynomial Equations (over C) The ideal generated by a finite collection of polynomials P = { p1, …, pn} is defined as: I(P) = {p1 q1 + … + pnqn| q1 , …, qn are polynomials} P is called a basis for I(P). Intuition: For all s  I(P), p1 = 0, …, pn= 0 implies s = 0 Satisfiability Modulo Theories: An Appetizer

  33. Deciding Polynomial Equations (over C) Hilbert’s Weak Nullstellensatz p1 = 0, …, pn= 0 is unsatisfiable over C iff I({p1, …, pn}) contains all polynomials 1  I({p1, …, pn}) Satisfiability Modulo Theories: An Appetizer

  34. Deciding Polynomial Equations (over C) 1st Key Idea: polynomials as rewrite rules. xy2 – y = 0 Becomes xy2 y The rewriting system is terminating but it is not confluent. xy2 y, x2y  1 • xy • x2y2 • y Satisfiability Modulo Theories: An Appetizer

  35. Deciding Polynomial Equations (over C) 2nd Key Idea: Completion. xy2 y, x2y  1 • xy • x2y2 • y Add polynomial: xy – y = 0 • xy y Satisfiability Modulo Theories: An Appetizer

  36. Deciding Polynomial Equations (over C) x2y – 1 = 0, xy2 – y = 0, xz – z + 1 = 0 • x2y  1, xy2 y, xz z – 1 • x2y  1, xy2 y, xz z – 1, xy y • x2y 1, xy2 y, xz z – 1, xy y • xy 1, xy2 y, xz z – 1, xy y • y 1, xy2y, xz z – 1, xy y • y  1, x1, xz z – 1, xy y • y  1, x 1, 1 = 0, xy y Satisfiability Modulo Theories: An Appetizer

  37. In practice, we need a combination of theory solvers. Nelson-Oppen combination method. Reduction techniques. Model-based theory combination. Combining Solvers Satisfiability Modulo Theories: An Appetizer

  38. M | F SAT (propositional checkers): DPLL Partial model Set of clauses Satisfiability Modulo Theories: An Appetizer

  39. Guessing (case-splitting) DPLL • p | p  q, q  r p, q | p  q, q  r Satisfiability Modulo Theories: An Appetizer

  40. Deducing DPLL • p | p  q, p  s p, s| p  q, p  s Satisfiability Modulo Theories: An Appetizer

  41. Backtracking DPLL • p, s, q | p  q, s  q, p q p, s| p  q, s  q, p q Satisfiability Modulo Theories: An Appetizer

  42. Efficient indexing (two-watch literal) Non-chronological backtracking (backjumping) Lemma learning … Modern DPLL Satisfiability Modulo Theories: An Appetizer

  43. Efficient decision procedures for conjunctions of ground literals. Solvers = DPLL + Decision Procedures • a=b, a<5 | a=b  f(a)=f(b), a < 5  a > 10 Satisfiability Modulo Theories: An Appetizer

  44. Theory Conflicts • a=b, a > 0, c > 0, a + c < 0 | F • backtrack Satisfiability Modulo Theories: An Appetizer

  45. Naïve recipe? SMT Solver = DPLL + Decision Procedure Standard question: Why don’t you use CPLEX for handling linear arithmetic? Satisfiability Modulo Theories: An Appetizer

  46. Efficient SMT solvers Decision Procedures must be: Incremental & Backtracking Theory Propagation • a=b, a<5 | … a<6  f(a) = a • a=b, a<5, a<6 | … a<6  f(a) = a Satisfiability Modulo Theories: An Appetizer

  47. Efficient SMT solvers Decision Procedures must be: Incremental & Backtracking Theory Propagation Precise (theory) lemma learning • a=b, a > 0, c > 0, a + c < 0 | F • Learn clause: • (a=b)  (a > 0)  (c > 0)  (a + c < 0) • Imprecise! • Precise clause: • a > 0  c > 0  a + c < 0 Satisfiability Modulo Theories: An Appetizer

  48. SMT x SAT • For some theories, SMT can be reduced to SAT • Higher level of abstraction • bvmul32(a,b) = bvmul32 (b,a) Satisfiability Modulo Theories: An Appetizer

  49. SMT x First-order provers T may not have a finite axiomatization Satisfiability Modulo Theories: An Appetizer

  50. Test case generation

More Related