Synthesis using Variable Elimination

Slides:



Advertisements
Similar presentations
Automated Theorem Proving Lecture 1. Program verification is undecidable! Given program P and specification S, does P satisfy S?
Advertisements

Lecture 24 MAS 714 Hartmut Klauck
Linked List Implementation class List { private List next; private Object data; private static List root; private static int size; public static void addNew(Object.
Propositional and First Order Reasoning. Terminology Propositional variable: boolean variable (p) Literal: propositional variable or its negation p 
On Solving Presburger and Linear Arithmetic with SAT Ofer Strichman Carnegie Mellon University.
Timed Automata.
SAT and Model Checking. Bounded Model Checking (BMC) A.I. Planning problems: can we reach a desired state in k steps? Verification of safety properties:
Complexity 15-1 Complexity Andrei Bulatov Hierarchy Theorem.
Constraint Logic Programming Ryan Kinworthy. Overview Introduction Logic Programming LP as a constraint programming language Constraint Logic Programming.
On the Use of Automata Techniques to Decide Satisfiability Mia Minnes May 3, 2005.
Discrete Mathematics Lecture 4 Harper Langston New York University.
The Theory of NP-Completeness
Copyright © 2006 The McGraw-Hill Companies, Inc. Programming Languages 2nd edition Tucker and Noonan Chapter 18 Program Correctness To treat programming.
Describing Syntax and Semantics
On Solving Presburger and Linear Arithmetic with SAT Ofer Strichman Carnegie Mellon University.
Regular Model Checking Ahmed Bouajjani,Benget Jonsson, Marcus Nillson and Tayssir Touili Moran Ben Tulila
Invariant Inference for Many-Object Systems Viktor Kuncak Swiss Federal Institute of Technology, Lausanne joint work with:
DECIDABILITY OF PRESBURGER ARITHMETIC USING FINITE AUTOMATA Presented by : Shubha Jain Reference : Paper by Alexandre Boudet and Hubert Comon.
Towards Implicit Programming Viktor Kuncak EPF Lausanne
The Complexity of Optimization Problems. Summary -Complexity of algorithms and problems -Complexity classes: P and NP -Reducibility -Karp reducibility.
Synthesis using Variable Elimination Viktor Kuncak EPF Lausanne
Implicit Programming Viktor Kuncak EPF Lausanne
Synthesis, Analysis, and Verification Lecture 01c Lectures: Viktor Kuncak Exercises and Labs: Eva Darulová Giuliano Losa About Synthesis General Background.
ISBN Chapter 3 Describing Semantics -Attribute Grammars -Dynamic Semantics.
CS 363 Comparative Programming Languages Semantics.
MA/CSSE 474 Theory of Computation Decision Problems DFSMs.
1 The Theory of NP-Completeness 2 Cook ’ s Theorem (1971) Prof. Cook Toronto U. Receiving Turing Award (1982) Discussing difficult problems: worst case.
Ruzica Piskac Max Planck Institute for Software Systems, Germany.
Integrating high-level constructs into programming languages Language extensions to make programming more productive Underspecified programs –give assertions,
Chapter 3 Part II Describing Syntax and Semantics.
Examples and Sets. Synthesize each of These choose((x,y) =>10 x + 14 y == a) choose((x,y) =>10 x + 14 y == a&& x < y) choose((x,y) =>10 x + 14 y == a.
Random Interpretation Sumit Gulwani UC-Berkeley. 1 Program Analysis Applications in all aspects of software development, e.g. Program correctness Compiler.
Strings Basic data type in computational biology A string is an ordered succession of characters or symbols from a finite set called an alphabet Sequence.
Daniel Kroening and Ofer Strichman Decision Procedures An Algorithmic Point of View Deciding Combined Theories.
Chapter 11 Introduction to Computational Complexity Copyright © 2011 The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 1.
Complexity 24-1 Complexity Andrei Bulatov Interactive Proofs.
Approximation Algorithms based on linear programming.
Logical Agents. Outline Knowledge-based agents Logic in general - models and entailment Propositional (Boolean) logic Equivalence, validity, satisfiability.
Functional Programming
Computational Complexity Theory
From Classical Proof Theory to P vs. NP
Probabilistic Algorithms
Integer Programming An integer linear program (ILP) is defined exactly as a linear program except that values of variables in a feasible solution have.
Control Flow Testing Handouts
On the Size of Pairing-based Non-interactive Arguments
Computability and Complexity
Representation, Syntax, Paradigms, Types
Reasoning about code CSE 331 University of Washington.
Outline of the Chapter Basic Idea Outline of Control Flow Testing
Arithmetic Constraints and Automata
Relatively Complete Refinement Type System for Verification of Higher-Order Non-deterministic Programs Hiroshi Unno (University of Tsukuba) Yuki Satake.
Chap 9. General LP problems: Duality and Infeasibility
LPSAT: A Unified Approach to RTL Satisfiability
Complexity 6-1 The Class P Complexity Andrei Bulatov.
Objective of This Course
Programming Languages 2nd edition Tucker and Noonan
Representation, Syntax, Paradigms, Types
Resolution Proofs for Combinational Equivalence
Representation, Syntax, Paradigms, Types
Complete Program Synthesis for Linear Arithmetics
Representation, Syntax, Paradigms, Types
NP-Completeness Reference: Computers and Intractability: A Guide to the Theory of NP-Completeness by Garey and Johnson, W.H. Freeman and Company, 1979.
Methods of Proof Chapter 7, second half.
Program correctness Axiomatic semantics
Major Design Strategies
Instructor: Aaron Roth
Programming Languages 2nd edition Tucker and Noonan
Major Design Strategies
Sharing Set Operations
Presentation transcript:

Synthesis using Variable Elimination Viktor Kuncak EPF Lausanne http://lara.epfl.ch/w/impro

Implicit Programming at All Levels Opportunities for implicit programming in Development within an IDE InSynth tool Compilation Comfusy and RegSy tools Execution Scala^Z3, UDITA, Kaplan 

a. pre(a)  P(a,f(a)) pre(a) constraint (relation): P(a,x) between inputs and outputs a. pre(a)  pre(a) precondition: P(a,f(a)) function: x = f(a) from inputs to outputs

Compilation in Comfusy def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 )) def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = val t1 = val t2 = val t3 = val t4 = (t1, t3, t4) An actual example that works in our system. ? Mikaël Mayer Ruzica Piskac Philippe Suter, PLDI’10

Todays Approach:

Equations Use one equation to reduce the number of variables by one: choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 ))

One equation where no coefficient is 1 choose((x,y) => 10 x + 14 y == a ) Find one possible pair x,y, as a function of a.

Constructive (Extended) Euclid’s Algorithm: gcd(10,14) 10 14 10 4 6 4 4 2 2 2 0 10 x + 14 y == 10 x + 14 y == a

Result of Synthesis for one Equation choose((x,y) => 10 x + 14 y == a ) assert ( ) val x = val y = check the solution: Change in requirements! Customer also wants: x < y does our solution work for e.g. a=2

Idea: Eliminate Variables choose((x,y) => 10 x + 14 y == a && x < y) Cannot easily eliminate one of the x,y. Eliminate both x,y, get one free - z x = 3/2 a + c1 z y = -a + c2 z c1 = ? c2 = ? Find general form, characterize all solutions, parametric solution

Idea: Eliminate Variables choose((x,y) => 10 x + 14 y == a && x < y) x = 3/2 a + c1 z y = -a + c2 z c1 = ? c2 = ? 10 x0 + 14 y0 + (10 c1 + 14 c2) == a 10 c1 + 14 c2 == 0

choose((x,y) => 10 x + 14 y == a && x < y) x = 3/2 a + 5 z y = -a - 7 z

I forgot to say, we also wish: 0 < x choose((x,y) => 10 x + 14 y == a && 0 < x && x < y)

Compilation in Comfusy def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 )) def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = val t1 = val t2 = val t3 = val t4 = (t1, t3, t4) An actual example that works in our system. ? Mikaël Mayer Ruzica Piskac Philippe Suter, PLDI’10

Synthesis Procedure on Example process every equality: take an equality Ei, compute a parametric description of the solution set and insert those values in the rest of formula CODE: <further code will come here> val h = lambda val m = mu val s = (-3600) * lambda + (-60) * mu + totalSeconds

Synthesis Procedure by Example process every equality: take an equality Ei, compute a parametric description of the solution set and insert those values in the rest of formula Formula (remain specification): 0 ≤ λ, 0 ≤ μ, μ ≤ 59, 0 ≤ totalSeconds – 3600λ - 60μ, totalSeconds – 3600λ - 60μ ≤ 59

Processing Inequalities process output variables one by one 0 ≤ λ, 0 ≤ μ, μ ≤ 59, 0 ≤ totalSeconds – 3600λ - 60μ, totalSeconds – 3600λ - 60μ ≤ 59 expressing constraints as bounds on μ 0 ≤ λ, 0 ≤ μ, μ ≤ 59, μ ≤ ⌊(totalSeconds – 3600λ)/60⌋ , ⌈(totalSeconds – 3600λ – 59)/60⌉ ≤ μ Code: val mu = min(59, (totalSeconds -3600* lambda) div 60)

Fourier-Motzkin-Style Elimination 0 ≤ λ, 0 ≤ μ, μ ≤ 59, μ ≤ ⌊(totalSeconds – 3600λ)/60⌋ , ⌈(totalSeconds – 3600λ – 59)/60⌉ ≤ μ combine each lower and upper bound 0 ≤ λ, 0 ≤ 59, 0 ≤ ⌊(totalSeconds – 3600λ)/60⌋ , ⌈(totalSeconds – 3600λ – 59)/60⌉ ≤ ⌊(totalSeconds – 3600λ)/60⌋ , ⌈(totalSeconds – 3600λ – 59)/60⌉ ≤ 59 basic simplifications Code: val lambda = totalSeconds div 3600 Preconditions: 0 ≤ totalSeconds 0 ≤ λ, 60λ ≤ ⌊totalSeconds /60⌋, ⌈(totalSeconds –59)/60⌉ – 59 ≤ 60λ

Compilation in Comfusy def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 )) def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = val t1 = totalSeconds div 3600 val t2 = totalSeconds -3600 * t1 val t3 = t2 div 60 val t4 = totalSeconds - 3600 * t1 - 60 * t3 (t1, t3, t4) An actual example that works in our system. Mikaël Mayer Ruzica Piskac Philippe Suter, PLDI’10

Handling of Inequalities Solve for one by one variable: separate inequalities depending on polarity of x: Ai ≤ αix βjx ≤ Bj define values a = maxi⌈Ai/αi⌉ and b = minj⌈Bj/ βj⌉ if b is defined, return x = b else return x = a further continue with the conjunction of all formulas ⌈Ai/αi⌉ ≤ ⌈Bj/ βj⌉

2y − b ≤ 3x + a ∧ 2x − a ≤ 4y + b 2y − b − a ≤ 3x ∧ 2x ≤ 4y + a + b 4y − 2b − 2a ≤ 6x ≤ 12y + 3a + 3b (4y − 2b − 2a) / 6 ≤ x ≤ (12y + 3a + 3b) / 6 (4y − 2b − 2a) / 6 ≤ ⌊(12y + 3a + 3b) / 6⌋ two extra variables: (4y − 2b − 2a) / 6 ≤ l ∧ 12y + 3a + 3b = 6 ∗ l + k ∧ 0 ≤ k ≤ 5 4y − 2b − 2a ≤ 6 * l ∧ 12y + 3a + 3b = 6 ∗ l + k pre: 6|3a + 3b − k 4y − 2b − 2a ≤ 12y + 3a + 3b – k − 5b − 5a +k ≤ 8y  y = ⌈(k − 5a − 5b)/8⌉

Generated Code Contains Loops val (x1, y1) = choose(x: Int, y: Int => 2*y − b =< 3*x + a && 2*x − a =< 4*y + b) val kFound = false for k = 0 to 5 do { val v1 = 3 * a + 3 * b − k if (v1 mod 6 == 0) { val alpha = ((k − 5 * a − 5 * b)/8).ceiling val l = (v1 / 6) + 2 * alpha val y = alpha val kFound = true break } } if (kFound) val x = ((4 * y + a + b)/2).floor else throw new Exception(”No solution exists”)

NP-Hard Constructs Divisibility combined with inequalities: corresponding to big disjunction in q.e. , we will generate a for loop with constant bounds (could be expanded if we wish) Disjunctions Synthesis of a formula computes program and exact precondition of when output exists Given disjunctive normal form, use preconditions to generate if-then-else expressions (try one by one)

Synthesis for Disjunctions

General Form of Synthesized Functions for Presburger Arithmetic choose x such that F(x,a)  x = t(a) Result t(a) is expressed in terms of +, -, C*, /C, if Need arithmetic for solving equations Need conditionals for disjunctions in input formula divisibility and inequalities (find a witness meeting bounds and divisibility by constants) t(a) = if P1(a) t1(a) elseif … elseif Pn(a) tn(a) else error(“No solution exists for input”,a)

Methodology QE  Synthesis Each quantifier elimination ‘trick’ we found corresponds to a synthesis trick Find the corresponding terms Key techniques: one point rule immediately gives a term change variables, using a computable function strengthen formula while preserving realizability recursively eliminate variables one-by one Example use transform formula into disjunction strengthen each disjunct using equality apply one-point rule

Synthesis for non-linear arithmetic def decomposeOffset(offset: Int, dimension: Int) : (Int, Int) = choose((x: Int, y: Int) ⇒ ( offset == x + dimension * y && 0 ≤ x && x < dimension )) The predicate becomes linear at run-time Synthesized program must do case analysis on the sign of the input variables Some coefficients are computed at run-time

Generated Code May Contain Loops val (x1, y1) = choose(x: Int, y: Int => 2*y − b =< 3*x + a && 2*x − a =< 4*y + b) val kFound = false for k = 0 to 5 do { val v1 = 3 * a + 3 * b − k if (v1 mod 6 == 0) { val alpha = ((k − 5 * a − 5 * b)/8).ceiling val l = (v1 / 6) + 2 * alpha val y = alpha val kFound = true break } } if (kFound) val x = ((4 * y + a + b)/2).floor else throw new Exception(”No solution exists”)

Basic Compile-Time Analysis

Compile-time warnings def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && h < 24 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 )) Warning: Synthesis predicate is not satisfiable for variable assignment: totalSeconds = 86400

Compile-time warnings def secondsToTime(totalSeconds: Int) : (Int, Int, Int) = choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m ≤ 60 && s ≥ 0 && s < 60 )) Warning: Synthesis predicate has multiple solutions for variable assignment: totalSeconds = 60 Solution 1: h = 0, m = 0, s = 60 Solution 2: h = 0, m = 1, s = 0

Handling Data Structures

Synthesis for sets def splitBalanced[T](s: Set[T]) : (Set[T], Set[T]) = choose((a: Set[T], b: Set[T]) ⇒ ( a union b == s && a intersect b == empty && a.size – b.size ≤ 1 && b.size – a.size ≤ 1 )) def splitBalanced[T](s: Set[T]) : (Set[T], Set[T]) = val k = ((s.size + 1)/2).floor val t1 = k val t2 = s.size – k val s1 = take(t1, s) val s2 = take(t2, s minus s1) (s1, s2) a b s

From Data Structures to Numbers Observation: Reasoning about collections reduces to reasoning about linear integer arithmetic! a.size == b.size && a union b == bigSet && a intersect b == empty a b bigSet

From Data Structures to Numbers Observation: Reasoning about collections reduces to reasoning about linear integer arithmetic! a.size == b.size && a union b == bigSet && a intersect b == empty a b bigSet

From Data Structures to Numbers Observation: Reasoning about collections reduces to reasoning about linear integer arithmetic! a.size == b.size && a union b == bigSet && a intersect b == empty a b bigSet

From Data Structures to Numbers Observation: Reasoning about collections reduces to reasoning about linear integer arithmetic! a.size == b.size && a union b == bigSet && a intersect b == empty New specification: kA = kB a b bigSet

From Data Structures to Numbers Observation: Reasoning about collections reduces to reasoning about linear integer arithmetic! a.size == b.size && a union b == bigSet && a intersect b == empty New specification: kA = kB && kA +kB = |bigSet| a b bigSet

Experience with Comfusy  Works well for examples we encountered Needed: synthesis for more expressive logics, to handle more examples seems ideal for domain-specific languages Efficient for conjunctions of equations (could be made polynomial) Extends to synthesis with parametric coefficients Extends to logics that reduce to Presburger arithmetic (implemented for BAPA)

Comfusy for Arithmetic  Limitations of Comfusy for arithmetic: Naïve handling of disjunctions Blowup in elimination, divisibility constraints Complexity of running synthesized code (from QE): doubly exponential in formula size Not tested on modular arithmetic, or on synthesis with optimization objectives Arbitrary-precision arithmetic with multiple operations generates time-inefficient code Cannot do bitwise operations (not in PA)

Arithmetic Synthesis using Automata

RegSy Synthesis for regular specifications over unbounded domains J. Hamza, B. Jobstmann, V. Kuncak FMCAD 2010

Automata-Based Synthesis Disjunctions not a problem Result not depends on the syntax of input formula Complexity of running synthesized code: ALWAYS LINEAR IN THE NUMBER OF BITS Modular arithmetic and bitwise operators: synthesize bit tricks for unbounded number of bits, uniformly without skeletons Supports quantified constraints including optimization constraints

Expressiveness of Spec Language Non-negative integer constants and variables Boolean operators Linear arithmetic operator Bitwise operators Quantifiers over numbers and bit positions PAbit = Presburger arithmetic with bitwise operators WS1S= weak monadic second-order logic of one successor

010001101010101010101010101101111111110101010101100000000010101010100011010101 Basic Idea View integers as finite (unbounded) bit-streams (binary representation starting with LSB) Specification in WS1S (PAbit) Synthesis approach: Step 1: Compile specification to automaton over combined input/output alphabet (automaton specifying relation) Step 2: Use automaton to generate efficient function from inputs to outputs realizing relation

Inefficient but Correct Method Run over a deterministic automaton over inputs and outputs Becomes run of a non-deterministic if we look only at outputs Simulate all branches until the end of input Successful branches indicate outputs that work

Our Approach: Precompute without losing backward information Synthesis: Det. automaton for spec over joint alphabet Project, determinize, extract lookup table WS1S spec Mona Synthesized program: Automaton + lookup table Execution: Run A on input w and record trace Use table to run backwards and output Input word Output word

Experiments Linear scaling observed in length of input No Example MONA (ms) Syn (ms) |A| |A’| 512b 1024b 2048b 4096b 1 addition 318 132 4 9 509 995 1967 3978 2 approx 719 670 27 35 470 932 1821 3641 3 company 8291 1306 58 177 608 1312 2391 4930 parity 346 108 5 336 1310 2572 mod-6 341 242 23 460 917 1765 3567 6 3-weights-min 26963 640 22 13 438 875 1688 3391 7 4-weights 2707 1537 55 19 458 903 1781 3605 8 smooth-4b 51578 1950 955 637 1271 2505 4942 smooth-f-2b 569 331 73 67 531 989 1990 3905 10 smooth-b-2b 1241 342 169 347 628 1304 11 6-3n+1 834 1007 233 79 556 953 1882 4022 Linear scaling observed in length of input In 3 seconds solve constraint, minimizing the output; Inputs and outputs are of order 24000

Thought: A quantifier not to forget Automatically synthesized and only automatically tested code is great But probably even less likely to be correct Synthesizing programs that are guaranteed to be correct by construction will remain important.

Implicit Programming at All Levels requirements def f(x : Int) = { choose y st ... } iload_0 iconst_1 call Z3 42 Opportunities for implicit programming in Development within an IDE InSynth tool Compilation Comfusy and RegSy tools Execution Scala^Z3 and UDITA tools  

Example all : SequenceInputStream =  tool

Code Synthesis inside IDE Create clauses: - encode in FOL - assign weights Find all visible symbols ………………………………………………………………………………………………………………………………………………………………………………………………………………………………… Resolution algorithm with weights Program point Input: a partial Scala program a program point maximum number of resolution steps traverse program syntax tree create the clauses (Encode them in FOL) assign the weights a minimal weight clause and resolve it with all applicable clauses If we derive a contradiction (empty clause), extract its proof tree until the clause set becomes saturated or the given threshold on the resolution steps is exceeded. Finally, we reconstruct terms from the proof trees, and create the code snippets. snippets are further tested by invoking a test case Max steps Code snippets

Curry-Howard Correspondence def map[A,B](x : List[T], f : A -> B) : List[B] = {...}

Features Parametric polymorphism Branching expressions with multiple arguments (not just chains of calls) Mining API usage frequencies but can still synthesize previously unseen code Distance to program point heuristics Filtering based on test-cases

Wrapping Up

Synthesis and Verification Some functionality is best synthesized from specs other: better implemented, verified (and put into library) Currently, no choice –must always implement specifications and verification are viewed as overhead Goal: make specifications intrinsic part of programs, with clear benefits to programmers – they run! Example: write an assertion, not how to establish it This will help both verifiability: document, not reverse-engineer the invariants productivity: avoid writing messy implementation

Conclusion: Implicit Programming Development within an IDE InSynth tool – theorem proving as code completion Compilation Comfusy : decision procedure  synthesis procedure Scala implementation for integer arithmetic, BAPA RegSy : solving WS1S constraints Execution UDITA: Java + choice as test generation language Scala^Z3 : invoking Z3 Kaplan: constraint programming in Scala http://lara.epfl.ch/w/impro

RegSy Synthesis for regular specifications over unbounded domains J. Hamza, B. Jobstmann, V. Kuncak FMCAD 2010

Synthesize Functions over Integers w 9 1 3 Given weight w, balance beam using weights 1kg, 3kg, and 9kg Where to put weights if w=7kg?

Synthesize Functions over Integers 3 1 7 9 Given weight w, balance beam using weights 1kg, 3kg, and 9kg Where to put weights if w=7kg? Synthesize program that computes correct positions of 1kg, 3kg, and 9kg for any w?

Synthesize Functions over Integers 3 1 7 9 Assumption: Integers are non-negative

Expressiveness of Spec Language Non-negative integer constants and variables Boolean operators Linear arithmetic operator Bitwise operators Quantifiers over numbers and bit positions PAbit = Presburger arithmetic with bitwise operators WS1S= weak monadic second-order logic of one successor

Problem Formulation Given relation R over bit-stream (integer) variables in WS1S (PAbit) partition of variables into inputs and outputs Constructs program that, given inputs, computes correct output values, whenever they exist. Unlike Church synthesis problem, we do not require causality (but if spec has it, it helps us)

010001101010101010101010101101111111110101010101100000000010101010100011010101 Basic Idea View integers as finite (unbounded) bit-streams (binary representation starting with LSB) Specification in WS1S (PAbit) Synthesis approach: Step 1: Compile specification to automaton over combined input/output alphabet (automaton specifying relation) Step 2: Use automaton to generate efficient function from inputs to outputs realizing relation

Inefficient but Correct Method Run over a deterministic automaton over inputs and outputs Becomes run of a non-deterministic if we look only at outputs Simulate all branches until the end of input Successful branches indicate outputs that work

Our Approach: Precompute without losing backward information Synthesis: Det. automaton for spec over joint alphabet Project, determinize, extract lookup table WS1S spec Mona Synthesized program: Automaton + lookup table Execution: Run A on input w and record trace Use table to run backwards and output Input word Output word

Experiments Linear scaling observed in length of input No Example MONA (ms) Syn (ms) |A| |A’| 512b 1024b 2048b 4096b 1 addition 318 132 4 9 509 995 1967 3978 2 approx 719 670 27 35 470 932 1821 3641 3 company 8291 1306 58 177 608 1312 2391 4930 parity 346 108 5 336 1310 2572 mod-6 341 242 23 460 917 1765 3567 6 3-weights-min 26963 640 22 13 438 875 1688 3391 7 4-weights 2707 1537 55 19 458 903 1781 3605 8 smooth-4b 51578 1950 955 637 1271 2505 4942 smooth-f-2b 569 331 73 67 531 989 1990 3905 10 smooth-b-2b 1241 342 169 347 628 1304 11 6-3n+1 834 1007 233 79 556 953 1882 4022 Linear scaling observed in length of input In 3 seconds solve constraint, minimizing the output; Inputs and outputs are of order 24000

More on Compilation Essence: partial evaluation Recent work: partially evaluate Simplex repeatedly solve same formula (with different parameters) obtaining orders of magnitude speedups Work by Sebastien Vasey

Implicit Programming at All Levels requirements def f(x : Int) = { choose y st ... } iload_0 iconst_1 call Z3 42 Opportunities for implicit programming in Development within an IDE InSynth tool Compilation Comfusy and RegSy tools Execution Scala^Z3 and UDITA tools  

Example all : SequenceInputStream =  tool

InSynth - Interactive Synthesis of Code Snippets joint work with: Tihomir Gvero, Ruzica Piskac InSynth - Interactive Synthesis of Code Snippets def map[A,B](f:A => B, l:List[A]): List[B] = { ... } def stringConcat(lst : List[String]): String = { ... } ... def printInts(intList:List[Int], prn: Int => String): String =  Returned value: stringConcat(map (prn, intList)) Is there a term of given type in given environment? Monorphic: decidable. Polymorphic: undecidable

Code Synthesis inside IDE Create clauses: - encode in FOL - assign weights Find all visible symbols ………………………………………………………………………………………………………………………………………………………………………………………………………………………………… Resolution algorithm with weights Program point Input: a partial Scala program a program point maximum number of resolution steps traverse program syntax tree create the clauses (Encode them in FOL) assign the weights a minimal weight clause and resolve it with all applicable clauses If we derive a contradiction (empty clause), extract its proof tree until the clause set becomes saturated or the given threshold on the resolution steps is exceeded. Finally, we reconstruct terms from the proof trees, and create the code snippets. snippets are further tested by invoking a test case Max steps Code snippets

Relationship to Verification Some functionality is best synthesized from specs other: better implemented, verified (and put into library) Currently, no choice –must always implement specifications and verification are viewed as overhead Goal: make specifications intrinsic part of programs, with clear benefits to programmers – they run! Example: write an assertion, not how to establish it This will help both verifiability: document, not reverse-engineer the invariants productivity: avoid writing messy implementation

choose((x, y) ⇒ 5 * x + 7 * y == a && x ≤ y) Corresponding quantifier elimination problem: ∃ x ∃ y . 5x + 7y = a ∧ x ≤ y x = 3a y = -2a Use extended Euclid’s algorithm to find particular solution to 5x + 7y = a: (5,7 are mutually prime, else we get divisibility pre.) Express general solution of equations for x, y using a new variable z: x = -7z + 3a y = 5z - 2a Rewrite inequations x ≤ y in terms of z: 5a ≤ 12z z ≥ ceil(5a/12) Obtain synthesized program: val z = ceil(5*a/12) val x = -7*z + 3*a val y = 5*z + -2*a z = ceil(5*31/12) = 13 x = -7*13 + 3*31 = 2 y = 5*13 – 2*31 = 3 For a = 31:

choose((x, y) ⇒ 5 * x + 7 * y == a && x ≤ y && x ≥ 0) Express general solution of equations for x, y using a new variable z: x = -7z + 3a y = 5z - 2a Rewrite inequations x ≤ y in terms of z: z ≥ ceil(5a/12) z ≤ floor(3a/7) Rewrite x ≥ 0: ceil(5a/12) ≤ floor(3a/7) Precondition on a: (exact precondition) assert(ceil(5*a/12) ≤ floor(3*a/7)) val z = ceil(5*a/12) val x = -7*z + 3*a val y = 5*z + -2*a Obtain synthesized program: With more inequalities and divisibility: generate ‘for’ loop

Synthesis for Time Conversion choose((h: Int, m: Int, s: Int) ⇒ ( h * 3600 + m * 60 + s == totalSeconds && h ≥ 0 && m ≥ 0 && m < 60 && s ≥ 0 && s < 60 )) Returned code: assert (totalSeconds ≥ 0) val h = totalSeconds div 3600 val temp = totalSeconds + (-3600) * h val m = min(temp div 60, 59) val s = totalSeconds + (-3600) * h + (-60) * m

Finding any Solution (2 variables) based on Extended Euclidean Algorithm (EEA) for every two integers n and m finds numbers p and q such that n*p + m*q = gcd(n, m) problem: 1x1 + 2x2 = C solution: apply EEA to compute p and q such that 1p + 2q = gcd(1, 2) solution: x1 = p*C/ gcd(1, 2) x2 = q*C/ gcd(1, 2)

Finding any Solution (n variables) Inductive approach 1x1 + 2x2 +... + nxn = C 1x1 + gcd(2,...,n )[λ2x2 +... + λnxn] = C 1x1 +  xF = C find values for x1 (w1) and xF (wF) and then solve inductively: λ2x2 +... + λnxn = wF

Parametric Solution of Equation Theorem For an equation with S we denote the set of solutions. Let SH be a set of solutions of the homogeneous equality: SH = { y | } SH is an “almost linear” set, i.e. can be represented as a linear combination of vectors: SH = λ1s1 + ... λn-1sn-1 Let w be one solution of the original equation  S = {w} + { λ1s1 + ... λn-1sn-1|λ1>=0} +preconditions: gcd(i)| C

Solution of a Homogenous Equation Theorem For an equation with SH we denote the set of solutions. where values Kij are computed as follows: if i < j, Kij = 0 (the matrix K is lower triangular) if i =j for remaining Kij values, find any solution of the equation