Download presentation

Presentation is loading. Please wait.

Published byJamel Clayson Modified about 1 year ago

1
Satisfiability Modulo Theories (An introduction) Magnus Madsen

2
Todays Talk What are SMT solvers? How are they used in practice?

3
Motivation Solution Knowledge of prop. logic Knowledge of integers

4
What is SMT? SatisfiabilityModulo Theories +

5
What is a SMT instance? k-SAT theory of integers theory of bitwise operators theory of uninterpreted functions

6
Recall k-SAT clause literal or negated literal

7
Q: Why not encode every formula in SAT? A: Theory solvers have very efficient algorithms Graph Problems: Shortest-Path Minimum Spanning Tree Optimization: Max-Flow Linear Programming (just to name a few)

8
Q: But then, Why not get rid of the SAT solver? A: SAT solvers are very good at case analysis

9
SAT Theory Formula NO YES NO YES SMT Solver

10
Important Properties Efficiency of both SAT and Theory solver! SAT Solver – Incremental (supports adding new clauses) Theory Solver – Ability to construct blocking clauses – Ability to create so-called "theory lemmas"

11
Theories Theory of: – Difference Arithemetic – Linear Arithmetic – Arrays – Bit Vectors – Algebraic Datatypes – Uninterpreted Functions

12
SMT-LIB A modeling language for SMT instances – A declarative language with Lisp-like syntax – Defines common/shared terminology e.g. LRA = Closed linear formulas in linear real arithmetic e.g. QF_BC = Closed quantifier-free formulas over the theory of fixed-size bitvectors. –

13
Example 1 Solution

14
Example 2

15
Applications Dynamic Symbolic Execution Program Verification Extended Static Checking Model Checking Termination Analysis See Also: Tapas: Theory Combinations and Practical Applications

16
Dynamic Symbolic Execution combines dynamic and symbolic execution – step 1: execute the program recording the branches taken and their symbolic constraints – step 2: negate one constraint – step 3: solve the constraints to generate new input to the program (e.g. by using a SMT solver) – step 4: if a solution exists then execute the program on the new input

17
Program Path Run SMT Solver

18
New Program Path

19
Example: Greatest Common Divisor Original program int gcd(int x, int y) { while (true) { int m = x % y; if (m == 0) return y; x = y; y = m; } int result = gcd(2, 4) SSA unfolding int gcd(int x 0, int y 0 ) { while (true) { int m 0 = x 0 % y 0 ; assert(m 0 != 0) if (m 0 == 0) return y 0 ; x 1 = y 0 ; y 1 = m 0 ; int m 1 = x 1 % y 1 ; assert(m 1 == 0) if (m 1 == 0) return y 1 ; } }

20
Collecting Constraints Collected constraints int result = gcd(2, 4) (assert (= m0 (mod x0 y0))) (assert (not (= m0 0))) (assert (= x1 y0)) (assert (= y1 m0)) (assert (= m1 (mod x1 y1))) (assert (= m1 0)) SSA unfolding int gcd(int x 0, int y 0 ) { while (true) { int m 0 = x 0 % y 0 ; assert(m 0 != 0) if (m 0 == 0) return y 0 ; x 1 = y 0 ; y 1 = m 0 ; int m 1 = x 1 % y 1 ; assert(m 1 == 1) if (m 1 == 0) return y 1 ; } (assert (not (= m1 0)))

21
Computing a new path int gcd(int x, int y) { while (true) { int m = x % y; if (m == 0) return y; x = y; y = m; } Solution: x = 2 and y = 3 Solution: x = 2 and y = 3 Iteration 1: x = 2 & y = 3 Iteration 2: x = 3 & y = 2 Iteration 3: x = 2 & y = 1 Iteration 1: x = 2 & y = 3 Iteration 2: x = 3 & y = 2 Iteration 3: x = 2 & y = 1

22
Program Verification int binary_search(int[] arr, int low, int height, int key) { assert(low > high || 0 <= < high); while (low <= high) { // Find middle value int mid = (low + high) / 2; assert(0 <= mid < high); int val = arr[mid]; // Refine range if (key == val) return mid; if (val > key) low = mid + 1; else high = mid – 1; } return -1; } Assertion Violation: low = 2 30, high = Assertion Violation: low = 2 30, high =

23
SMT Solvers Z3 – Microsoft Research MathSAT5 – University of Trento CVC4 – New York University Many more

24
SMT-COMP A yearly competition between SMT solvers Z3

25
Research Directions in SMT Improving the efficiency of SAT/Theory solvers Improving the interplay between the SAT solver and the theory solver – e.g. "online" solvers (partial truth assignment) Developing solvers for new theories Combining different theories

26
With Thanks to Evan Driscoll

27
References Satisfiability Modulo Theories: Introduction and Applications – Leonardo De Moura & Nikolaj Bjørner Tapas: Theory Combinations and Practical Applications – Leonardo De Moura & Nikolaj Bjørner Z3 Tutorial Guide –

28
Summary Satisfiability Modulo Theory (SMT): – constraint systems involving SAT + Theory SMT solvers combine the best of: – SAT solvers and theory solvers SMTs have applications in program analysis

29
More Work To Be Done?

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google