Nikolaj Bjørner Microsoft Research Lecture 4. DayTopicsLab 1Overview of SMT and applications. SAT solving, Z3 Encoding combinatorial problems with Z3.

Slides:



Advertisements
Similar presentations
Combining Abstract Interpreters Sumit Gulwani Microsoft Research Redmond, Group Ashish Tiwari SRI RADRAD.
Advertisements

Automated Theorem Proving
Automated Theorem Proving Lecture 1. Program verification is undecidable! Given program P and specification S, does P satisfy S?
Completeness and Expressiveness
Linked List Implementation class List { private List next; private Object data; private static List root; private static int size; public static void addNew(Object.
UIUC CS 497: Section EA Lecture #2 Reasoning in Artificial Intelligence Professor: Eyal Amir Spring Semester 2004.
Propositional and First Order Reasoning. Terminology Propositional variable: boolean variable (p) Literal: propositional variable or its negation p 
CPSC 422, Lecture 21Slide 1 Intelligent Systems (AI-2) Computer Science cpsc422, Lecture 21 Mar, 4, 2015 Slide credit: some slides adapted from Stuart.
The Theory of NP-Completeness
© The McGraw-Hill Companies, Inc., Chapter 8 The Theory of NP-Completeness.
Computability and Complexity 9-1 Computability and Complexity Andrei Bulatov Logic Reminder (Cnt’d)
Plan for today Proof-system search ( ` ) Interpretation search ( ² ) Quantifiers Equality Decision procedures Induction Cross-cutting aspectsMain search.
Constraint Logic Programming Ryan Kinworthy. Overview Introduction Logic Programming LP as a constraint programming language Constraint Logic Programming.
Nikolaj Bjørner Microsoft Research Lecture 3. DayTopicsLab 1Overview of SMT and applications. SAT solving, Z3 Encoding combinatorial problems with Z3.
1 Satisfiability Modulo Theories Sinan Hanay. 2 Boolean Satisfiability (SAT) Is there an assignment to the p 1, p 2, …, p n variables such that  evaluates.
Automated Theorem Proving Lecture 4.   Formula := A |  |    A  Atom := b | t = 0 | t < 0 | t  0 t  Term := c | x | t + t | t – t | ct | Select(m,t)
Yeting Ge Leonardo de Moura New York University Microsoft Research.
Restricted Satisfiability (SAT) Problem
Search in the semantic domain. Some definitions atomic formula: smallest formula possible (no sub- formulas) literal: atomic formula or negation of an.
Last time Proof-system search ( ` ) Interpretation search ( ² ) Quantifiers Equality Decision procedures Induction Cross-cutting aspectsMain search strategy.
ECI 2007: Specification and Verification of Object- Oriented Programs Lecture 4.
1 A propositional world Ofer Strichman School of Computer Science, Carnegie Mellon University.
1 A Combination Method for Generating Interpolants by G. Yorsh and M. Masuvathi Presentation by: Emilia Katz.
Restricted Satisfiability (SAT) Problem
On Solving Presburger and Linear Arithmetic with SAT Ofer Strichman Carnegie Mellon University.
Ofer Strichman, Technion Deciding Combined Theories.
1 First order theories. 2 Satisfiability The classic SAT problem: given a propositional formula , is  satisfiable ? Example:  Let x 1,x 2 be propositional.
Leonardo de Moura Microsoft Research. Many approaches Graph-based for difference logic: a – b  3 Fourier-Motzkin elimination: Standard Simplex General.
Relations Chapter 9.
Deciding a Combination of Theories - Decision Procedure - Changki pswlab Combination of Theories Daniel Kroening, Ofer Strichman Presented by Changki.
The Theory of NP-Completeness 1. Nondeterministic algorithms A nondeterminstic algorithm consists of phase 1: guessing phase 2: checking If the checking.
The Theory of NP-Completeness 1. What is NP-completeness? Consider the circuit satisfiability problem Difficult to answer the decision problem in polynomial.
Nikolaj Bjørner, Leonardo de Moura Microsoft Research Bruno Dutertre SRI International.
1 The Theory of NP-Completeness 2012/11/6 P: the class of problems which can be solved by a deterministic polynomial algorithm. NP : the class of decision.
1 Decision Procedures for Linear Arithmetic Presented By Omer Katz 01/04/14 Based on slides by Ofer Strichman.
CMU, Oct 4 DPLL-based Checkers for Satisfiability Modulo Theories Cesare Tinelli Department of Computer Science The University of Iowa Joint work with.
From SAT to SMT A Tutorial Nikolaj Bjørner Microsoft Research Dagstuhl April 23, 2015.
1 A Combination Method for Generating Interpolants Greta Yorsh Madan Musuvathi Tel Aviv University, Israel Microsoft Research, Redmond, US CAV’05.
SAT and SMT solvers Ayrat Khalimov (based on Georg Hofferek‘s slides) AKDV 2014.
Solvers for the Problem of Boolean Satisfiability (SAT) Will Klieber Aug 31, 2011 TexPoint fonts used in EMF. Read the TexPoint manual before you.
Introduction to Satisfiability Modulo Theories
Leonardo de Moura Microsoft Research. Is formula F satisfiable modulo theory T ? SMT solvers have specialized algorithms for T.
Advanced Topics in Propositional Logic Chapter 17 Language, Proof and Logic.
Unification Algorithm Input: a finite set Σ of simple expressions Output: a mgu for Σ (if Σ is unifiable) 1. Set k = 0 and  0 = . 2. If Σ  k is a singleton,
1 The Theory of NP-Completeness 2 Cook ’ s Theorem (1971) Prof. Cook Toronto U. Receiving Turing Award (1982) Discussing difficult problems: worst case.
CS6133 Software Specification and Verification
First-Order Logic and Inductive Logic Programming.
Leonardo de Moura and Nikolaj Bjørner Microsoft Research.
CPSC 422, Lecture 21Slide 1 Intelligent Systems (AI-2) Computer Science cpsc422, Lecture 21 Oct, 30, 2015 Slide credit: some slides adapted from Stuart.
Nikolaj Bjørner Microsoft Research DTU Winter course January 2 nd 2012 Organized by Flemming Nielson & Hanne Riis Nielson.
1 First order theories (Chapter 1, Sections 1.4 – 1.5) From the slides for the book “Decision procedures” by D.Kroening and O.Strichman.
Daniel Kroening and Ofer Strichman Decision Procedures An Algorithmic Point of View Deciding Combined Theories.
AN INTERPOLATING THEOREM PROVER K.L. McMillan Cadence Berkley Labs.
CS357 Lecture 13: Symbolic model checking without BDDs Alex Aiken David Dill 1.
Logical Agents Chapter 7. Outline Knowledge-based agents Propositional (Boolean) logic Equivalence, validity, satisfiability Inference rules and theorem.
Daniel Kroening and Ofer Strichman 1 Decision Procedures An Algorithmic Point of View Basic Concepts and Background.
Selected Decision Procedures and Techniques for SMT More on combination – theories sharing sets – convex theory Un-interpreted function symbols (quantifier-free.
The Theory of NP-Completeness 1. Nondeterministic algorithms A nondeterminstic algorithm consists of phase 1: guessing phase 2: checking If the checking.
Deciding Combined Theories Presented by Adi Sosnovich Based on presentation from: Decision Procedures An Algorithmic Point of View Daniel Kroening and.
Dana Nau: Lecture slides for Automated Planning Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike License:
1 The Theory of NP-Completeness 2 Review: Finding lower bound by problem transformation Problem X reduces to problem Y (X  Y ) iff X can be solved by.
1 Section 7.1 First-Order Predicate Calculus Predicate calculus studies the internal structure of sentences where subjects are applied to predicates existentially.
Satisfiability Modulo Theories and DPLL(T) Andrew Reynolds March 18, 2015.
Relations Chapter 9 Copyright © McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill.
The Theory of NP-Completeness
Propositional Logic Resolution
First-Order Logic and Inductive Logic Programming
Lecture 2 Propositional Logic
Satisfiability Modulo Theories
Advanced consistency methods Chapter 8
Presentation transcript:

Nikolaj Bjørner Microsoft Research Lecture 4

DayTopicsLab 1Overview of SMT and applications. SAT solving, Z3 Encoding combinatorial problems with Z3 2Congruence closureProgram exploration with Pex 3A solver for arithmetic.Encoding arithmetic problems 4Theory combination. Arrays (part 1) Arrays. 5Arrays, (part 2) and quantifiers Build a theory solver on top of Z3

Theory combination methods for combining decision procedures A decision procedure for Arrays Lab: Encode queues using arrays

Previous lectures covered: DPLL – pure propositional satisfiability DPLL(E) – Propositional + Equations + functions. DPLL(LA) – Propositional + Linear arithmetic How can we combine DPLL(E + LA)? DPLL(T 1 + T 2 )?

Quiz: Who invented the SMT Solver Super-Highway? What information to share?

Examples: Given:  F =  1   2 T 1, T 2 : Theories over  1,  2 T = DC(T 1  T 2 ) – deductive closure Is T consistent? Given separate solvers for T 1 and T 2 produce combined solver for T.

Disjoint signatures  1   2 =  { +, -,.. }  { read, write} =  Stably-Infinite Theories. Convex Theories.

Theorem: The union of two consistent, disjoint, stably- infinite theories is consistent.

A theory is stably-infinite if every satisfiable QFF is satisfiable in an infinite model. We can glue together models M 1 and M 2 from stably infinite theories: we can extend the size of models M 1 and M 2 to each have |M 1 | + |M 2 | elements.

A theory is stably-infinite if every satisfiable QFF is satisfiable in an infinite model. Theories with only finite models are not stably infinite: T = DC(  x,y,z. (x = y)  (x = z)  (y = z) ) has only models with at most 2 elements Is this a problem in practice? We want to support finite types found in programming languages.

Are finite domains a problem in practice? Not really. Add a type predicate, to scope finite sorts. T’ = DC(  x,y,z. in 2 (x)  in 2 (y)  in 2 (z)  (x = y)  (x = z)  (y = z) ) T’ is stably infinite.

Theorem: The union of two convex theories can be solved in time O(n 4 x T 1 (n) x T 2 (n)). The combination of a non-convex theory with another can incur exponential cost.

A theory T is convex iff: for all finite sets L of literals and for all non-empty disjunctions L ⊨ T iff L ⊨ T for some i  I Every convex theory T with non-trivial models (i.e., ⊨ T  x,y. x  y) is stably-infinite All Horn theories are convex – this includes all (conditional) equational theories. Linear rational arithmetic is convex

Suppose H is a set of horn axioms. H |= P(t)  Q(t’) Then there is a resolution proof of [] given: H   P(t)   Q(t’) Horn resolution maintains invariant: Every clause has at most one positive literal. Either P(t) or Q(t’) consume the only available positive literal.

Suppose A is a matrix, b is a vector, f 1 (x) and f 2 (x) are linear functions and that Ax  b |= f 1 (x) = c 1 or f 2 (x) = c 2 for every x. Let Ax 1  b and Ax 2  b and f 1 (x 1 ) = c 1 and f 2 (x 2 ) = c 2. We show that either f 1 (x 2 ) = c 1 or f 2 (x 1 ) = c 2. Proof: let y = (x 1 +x 2 )/2, then Ay = A(x 1 +x 2 )/2 = Ax 1 /2 + Ax 2 /2  b/2 + b/2 = b, so either f 1 (y) = c 1 or f 2 (y) = c2. Assume wlog f 1 (y) = c 1, then c 1 = 2*c 1 – c 1 = 2*f 1 (y) – f 1 (x 1 ) = f 1 (2y-x 1 ) = f 1 (2(x 1 +x 2 )/2 – x 1 ) = f 1 (x 2 ).

Linear integer arithmetic 1  x  2 ⊨ x = 1  x = 2 Non-linear arithmetic x 2 = 1, y = 1, z = -1 ⊨ x = y  x = z Theory of bit-vectors ch : BitVec[8] ⊨ ch = 0  …  ch = 255 Theory of arrays v = read(write(a,i,w),j) ⊨ v = w  v = read(a,j)

Let T = T 1  T 2 where T 1 is E, O(nlog(n)), and T 2 is Integer Difference Logic, O(nm). T 1 is convex, but T 2 is not. Satisfiability of T is NP-complete: Reduce 3CNF satisfiability to T-satisfiability For each Boolean variable p i add the atomic formulas 0  x i  1 For a clause p 1  -p 2  p 3 add the atomic formula: f(x 1,x 2,x 3 )  f(0,1,0)

Let T 1 and T 2 be consistent, stably infinite theories over disjoint (countable) signatures. Assume satisfiability of conjunction of literals can be decided in time T 1 (n), respectively T 2 (n). Then, The combined theory T is consistent and stably infinite. Satisfiability of quantifier-free conjunction of literals in T can be decided in O(2 n*n x T 1 (n) x T 2 (n)). If T 1 and T 2 are convex, then so is T. Satisfiability is in O(n 4 x T 1 (n) x T 2 (n)).

Initial state: L is set of literals over  1   2 Purify: Preserving satisfiability, convert L into L’ = L 1  L 2 such that L 1  T(  1,V), L 2  T(  2,V) So L 1  L 2 = V shared  V Interaction: Guess a partition of V shared Express the partition as a conjunction of equalities. Example, { x 1 }, { x 2, x 3 }, { x 4 } is represented as:  : x 1  x 2  x 1  x 4  x 2  x 4  x 2 = x 3 Component Procedures: Use solver 1 to check satisfiability of L 1   Use solver 2 to check satisfiability of L 2  

Use  [t] for a sub-term t in  Purify:  [f(t,g(s))]   [f(t,x)]  x = g(s) whenever f   1, g   2, x is fresh Purification terminates. Purification preserves satisfiability.

Purify:  [f(t,g(s))]   [f(t,x)]  x = g(s) Example: f(x – 1) – 1 = x  f(y) + 1 = y  f(z) – 1 = x  f(y) + 1 = y  z = x - 1  u – 1 = x  f(y) + 1 = y  z = x - 1  u = f(z)  u – 1 = x  v + 1 = y  z = x - 1  u = f(z)  v = f(y) L 1 = u – 1 = x  v + 1 = y  z = x - 1 L 2 = u = f(z)  v = f(y)

Just color each sub-term by the theory of the function symbol. Each solver treats sub-terms colored by the wrong color as a variable.

Each step is satisfiability preserving Say L is satisfiable (in the combination). Purification: L 1  L 2 is satisfiable by M. Interaction: M induces a partition    L 1  L 2 is satisfiable Component: Each   L 1 and   L 2 are satisfiable. Therefore, if the procedures return unsatisfiable, then L is unsatisfiable.

Suppose both procedures return satisfiable: A ⊨   L 1 B ⊨   L 2 A, B are models. Each theory is stably-infinite. So assume A, B have infinite domains S A, S B (of same cardinality). Let h be a bijection S A  S B such that h(x A ) = x B for each shared variable. Extend B to B’ to interpret functions in  1 : f B’ (b 1.. b n ) = h(f A (h -1 (b 1 ),…, h -1 (b n )) B’ is a model.

Instead of guessing, we can often deduce the equalities to be shared. Interaction: T 1  L 1 ⊨ x = y then add equality to . If theories are convex, then we can: Deduce all equalities. Assume every thing not deduced is distinct. Complexity: O(n 4 x T 1 (n) x T 2 (n)).

Assume the theories are convex. Suppose L 1 is satisfiable Let E be the set of pairs x j, x k, such that M 1 ⊨ L 1  x j = x k By convexity: M 1 ⊨ L 1   E x j = x k So L 1   E x j  x k is satisfiable

Reduced guessing is only complete for convex theories. Deducing all implied equalities may be expensive. Example: Simplex – no direct way to extract from just bounds and  But: backtracking is pretty cheap nowadays: If  (x) =  (y), then x, y are equal in arithmetical component.

Backjumping is cheap with modern DPLL: If  (x) =  (y), then x, y are equal in arithmetical model. So let’s add x = y to , but allow to backtrack from guess. In general: if M 1 is the current model M 1 ⊨ x = y then add literal (x = y) d

def swap(a, i, j): tmp = a[i]; tmp = a[i]; a[i] = a[j]; a[i] = a[j]; a[j] = tmp; a[j] = tmp; def swap(a, i, j): tmp = a[i]; tmp = a[i]; a[i] = a[j]; a[i] = a[j]; a[j] = tmp; a[j] = tmp; new(a)[i] = a[j] new(a)[j] = a[i] k  i, k  j  a[k] = new(a)[k] new(a)[i] = a[j] new(a)[j] = a[i] k  i, k  j  a[k] = new(a)[k] def swap(a, i, j): tmp = a[i]; tmp = a[i]; a = write(a,i,a[j]); a = write(a,i,a[j]); a= write(a,j,tmp); a= write(a,j,tmp); def swap(a, i, j): tmp = a[i]; tmp = a[i]; a = write(a,i,a[j]); a = write(a,i,a[j]); a= write(a,j,tmp); a= write(a,j,tmp); def swap(a, i, j): tmp = a[i]; tmp = a[i]; a1= write(a,i,a[j]); a1= write(a,i,a[j]); a2= write(a1,j,tmp); new(a) = a2 a2= write(a1,j,tmp); new(a) = a2 def swap(a, i, j): tmp = a[i]; tmp = a[i]; a1= write(a,i,a[j]); a1= write(a,i,a[j]); a2= write(a1,j,tmp); new(a) = a2 a2= write(a1,j,tmp); new(a) = a2 new(a) = let tmp = a[i] let tmp = a[i] a1= write(a,i,a[j]); a1= write(a,i,a[j]); a2= write(a1,j,tmp); in a2 a2= write(a1,j,tmp); in a2 new(a) = let tmp = a[i] let tmp = a[i] a1= write(a,i,a[j]); a1= write(a,i,a[j]); a2= write(a1,j,tmp); in a2 a2= write(a1,j,tmp); in a2 new(a) = write(write(a,i,a[j]),j,a[i]) new(a)[j] = write(write(a,i,a[j]),j,a[i])[j] = a[i] new(a)[i] = write(write(a,i,a[j]),j,a[i])[i] = if i = j then a[i] else write(a,i,a[j])[i] = if i = j then a[i] else a[j] = a[j] new(a)[i] = write(write(a,i,a[j]),j,a[i])[i] = if i = j then a[i] else write(a,i,a[j])[i] = if i = j then a[i] else a[j] = a[j]

Functions:  F = { read, write } Predicates:  P = { = } Convention a[i] means: read(a,i) Non-extensional arrays T A :  a, i, v. write(a,i,v)[i] = v  a, i, j, v. i  j  write(a,i,v)[j] = a[j] Extensional arrays: T EA = T A +  a, b. ((  i. a[i] = b[i])  a = b)

Let L be literals over  F = { read, write } Find M such that: M ⊨ T A L Basic algorithm, reduce to E: for every sub-term read(a,i), write(b,j,v) in L i  j  a = b  read(write(b,j,v),i) = read(a,i) read(write(b,j,v),j) = v Find M E, such that M E ⊨ E L  AssertedAxioms

Correctness of basic algorithm: M E satisfies array axioms on terms in L. To show that M E can be extended to model for arrays: From Congurence Closure C * build model: a M = [| * d1  * r1, * d2  * r2, * d3 .., else  v root(a) |] Where read M (a M, * di ) = * r1 e.g., * r1 = root(read(root(a),root(i)) under C * Model satisfies array axioms. For every store(a,i,v) the model satisfies store(a,i,v)[j] = a[j] whenever i M  j M (first axiom) and also store(a,i,v)[i] = v (second axiom). v root(a) was added to make arrays different unless they were forced to be (no extensionality)

A non-theorem a and b need not be equal even if the array axioms hold.

To enforce:  a, b. ((  i. a[i]= b[i])  a = b For every pair a, b in L, Add fresh constant i ab Add axiom a  b  a[i ab ]  b[i ab ]

Arrays may be more than just read/write. The constant array:  v, i. const(v)[i] = v Generalized store:  a,b,c, i. a[i] = b[i]  store  (a,b,c)[i] = c[i]  a,b,c, i. a[i]  b[i]  store  (a,b,c)[i] = b[i] We now have sets:  = const(false), T = const(true), A  B = store  ( ,A,B)[i] A  B = store  (T,A,B)[i] Ranges:  l,u, x. range(l,u)[x]  l  x  u