Presentation is loading. Please wait.

Presentation is loading. Please wait.

Satisfiability Modulo Theories (An introduction) Magnus Madsen.

Similar presentations


Presentation on theme: "Satisfiability Modulo Theories (An introduction) Magnus Madsen."— Presentation transcript:

1 Satisfiability Modulo Theories (An introduction) Magnus Madsen

2 Todays Talk What are SMT solvers? How are they used in practice?

3 Motivation Solution Knowledge of prop. logic Knowledge of integers

4 What is SMT? SatisfiabilityModulo Theories +

5 What is a SMT instance? k-SAT theory of integers theory of bitwise operators theory of uninterpreted functions

6 Recall k-SAT clause literal or negated literal

7 Q: Why not encode every formula in SAT? A: Theory solvers have very efficient algorithms Graph Problems: Shortest-Path Minimum Spanning Tree Optimization: Max-Flow Linear Programming (just to name a few)

8 Q: But then, Why not get rid of the SAT solver? A: SAT solvers are very good at case analysis

9 SAT Theory Formula NO YES NO YES SMT Solver

10 Important Properties Efficiency of both SAT and Theory solver! SAT Solver – Incremental (supports adding new clauses) Theory Solver – Ability to construct blocking clauses – Ability to create so-called "theory lemmas"

11 Theories Theory of: – Difference Arithemetic – Linear Arithmetic – Arrays – Bit Vectors – Algebraic Datatypes – Uninterpreted Functions

12 SMT-LIB A modeling language for SMT instances – A declarative language with Lisp-like syntax – Defines common/shared terminology e.g. LRA = Closed linear formulas in linear real arithmetic e.g. QF_BC = Closed quantifier-free formulas over the theory of fixed-size bitvectors. –

13 Example 1 Solution

14 Example 2

15 Applications Dynamic Symbolic Execution Program Verification Extended Static Checking Model Checking Termination Analysis See Also: Tapas: Theory Combinations and Practical Applications

16 Dynamic Symbolic Execution combines dynamic and symbolic execution – step 1: execute the program recording the branches taken and their symbolic constraints – step 2: negate one constraint – step 3: solve the constraints to generate new input to the program (e.g. by using a SMT solver) – step 4: if a solution exists then execute the program on the new input

17 Program Path Run SMT Solver

18 New Program Path

19 Example: Greatest Common Divisor Original program int gcd(int x, int y) { while (true) { int m = x % y; if (m == 0) return y; x = y; y = m; } int result = gcd(2, 4) SSA unfolding int gcd(int x 0, int y 0 ) { while (true) { int m 0 = x 0 % y 0 ; assert(m 0 != 0) if (m 0 == 0) return y 0 ; x 1 = y 0 ; y 1 = m 0 ; int m 1 = x 1 % y 1 ; assert(m 1 == 0) if (m 1 == 0) return y 1 ; } }

20 Collecting Constraints Collected constraints int result = gcd(2, 4) (assert (= m0 (mod x0 y0))) (assert (not (= m0 0))) (assert (= x1 y0)) (assert (= y1 m0)) (assert (= m1 (mod x1 y1))) (assert (= m1 0)) SSA unfolding int gcd(int x 0, int y 0 ) { while (true) { int m 0 = x 0 % y 0 ; assert(m 0 != 0) if (m 0 == 0) return y 0 ; x 1 = y 0 ; y 1 = m 0 ; int m 1 = x 1 % y 1 ; assert(m 1 == 1) if (m 1 == 0) return y 1 ; } (assert (not (= m1 0)))

21 Computing a new path int gcd(int x, int y) { while (true) { int m = x % y; if (m == 0) return y; x = y; y = m; } Solution: x = 2 and y = 3 Solution: x = 2 and y = 3 Iteration 1: x = 2 & y = 3 Iteration 2: x = 3 & y = 2 Iteration 3: x = 2 & y = 1 Iteration 1: x = 2 & y = 3 Iteration 2: x = 3 & y = 2 Iteration 3: x = 2 & y = 1

22 Program Verification int binary_search(int[] arr, int low, int height, int key) { assert(low > high || 0 <= < high); while (low <= high) { // Find middle value int mid = (low + high) / 2; assert(0 <= mid < high); int val = arr[mid]; // Refine range if (key == val) return mid; if (val > key) low = mid + 1; else high = mid – 1; } return -1; } Assertion Violation: low = 2 30, high = Assertion Violation: low = 2 30, high =

23 SMT Solvers Z3 – Microsoft Research MathSAT5 – University of Trento CVC4 – New York University Many more

24 SMT-COMP A yearly competition between SMT solvers Z3

25 Research Directions in SMT Improving the efficiency of SAT/Theory solvers Improving the interplay between the SAT solver and the theory solver – e.g. "online" solvers (partial truth assignment) Developing solvers for new theories Combining different theories

26 With Thanks to Evan Driscoll

27 References Satisfiability Modulo Theories: Introduction and Applications – Leonardo De Moura & Nikolaj Bjørner Tapas: Theory Combinations and Practical Applications – Leonardo De Moura & Nikolaj Bjørner Z3 Tutorial Guide –

28 Summary Satisfiability Modulo Theory (SMT): – constraint systems involving SAT + Theory SMT solvers combine the best of: – SAT solvers and theory solvers SMTs have applications in program analysis

29 More Work To Be Done?


Download ppt "Satisfiability Modulo Theories (An introduction) Magnus Madsen."

Similar presentations


Ads by Google