/
Lazy Proofs for Lazy Proofs for

Lazy Proofs for - PowerPoint Presentation

cheryl-pisano
cheryl-pisano . @cheryl-pisano
Follow
411 views
Uploaded On 2017-05-12

Lazy Proofs for - PPT Presentation

DPLLTBased SMT Solvers Guy Katz Clark Barrett Cesare Tinelli Andrew Reynolds Liana Hadarean Stanford University The University of Iowa Synopsys Producing Checkable Artifacts ID: 547507

theory proof dpll proofs proof theory proofs dpll smt explain lemmas conflict propagate solver specific lazy uninterpreted prove solvers

Share:

Link:

Embed:

Download Presentation from below link

Download Presentation The PPT/PDF document "Lazy Proofs for" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.


Presentation Transcript

Slide1

Lazy Proofs for DPLL(T)-Based SMT Solvers

Guy Katz, Clark Barrett, Cesare Tinelli, Andrew Reynolds, Liana Hadarean

Stanford

University

The University

of Iowa

SynopsysSlide2

Producing Checkable ArtifactsSMT solvers used in verification & analysis toolsVerifying

safety-critical systems Increase reliability by producing checkable artifacts2

SMT Solver

 

Input Query

Result

SAT

Model:

 

CheckSlide3

The UNSAT CaseNo satisfying model exists

3

SMT Solver

 

Input Query

Result

UNSAT

 

 

 

?

Proof

CheckSlide4

Proofs are UsefulInterpolant generationSkeptical Proof-Assistants (Coq, Isabelle/HOL)

Discharge goals using SMT-SolverReconstruct internal proof from certificate4Slide5

Our Contributions5

Proof production in DPLL(T)-based solversProofs are fine-grainedExtensible: add support for additional theoriesSupports combinations of theoriesProofs for the theory of arraysLazy proof generationSolve now, prove laterMore efficient Evaluation in CVC4, available onlineSlide6

AgendaBackground: Proofs in SATProofs in DPLL(T)-Based SMT Solvers

Lazy Proof ProductionTheory-Specific ProofsExperimental Results6Slide7

AgendaBackground: Proofs in SATProofs in DPLL(T)-Based SMT Solvers

Lazy Proof ProductionTheory-Specific ProofsExperimental Results7Slide8

Boolean Resolution8

The Boolean Resolution rule:A proof of unsatisfiability:

Start with input clauses

Apply resolutionDerive empty clauseCan always do this for UNSAT formulas

 

 

 Slide9

The DPLL Architecture9

An abstract algorithm for solving SATIncrementally assign variables to true/falseDecide assignments Deduce assignmentsIf formula is satisfied, doneIf a conflict is found, backjumpUndo previous decisions, try something elseSlide10

Input clauses (CNF):

, ,

,

 

DPLL: Example

10

Propagate

,

Propagate

,

,

Conflict

,

,

Explain

,

,

Explain

,

,

Learn

,

,

Backjump

Backjump

Propagate

Decide

Decide

Partial Assignment

Formula

Conflict

Rule Being Applied

Clause:

is true

is false

 

Conflict:

Not satisfied by assignment

 

 

 

 Slide11

DPLL: Example (cnt’d)11

Propagate

Partial Assignment

Formula

Conflict

Rule Being Applied

Propagate

Conflict

Explain

Explain

Explain

Fail

Fail

 

 

 Slide12

Input clauses:

, ,

,

 

Constructing a Proof

12

 

 

 

 

 

 

 

 

 

 

 

 

Explain

Explain

Explain

Fail

Fail

,

,

Explain

,

,

Explain

,

,

Learn

Slide13

AgendaBackground: Proofs in SATProofs in DPLL(T

)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results13Slide14

Adding the Theory SolversDPLL(T): DPLL + Background theory TTheory atoms mapped to Boolean atoms

SAT solver constructs (partial) assignmentTheory solver checks if it is T-consistentTheory solvers can:Report conflicts (T-conflict)Propagate literals (T-propagate)Learn new clauses (T-Learn)14

Justified by

Theory LemmasSlide15

Example: Uninterpreted Functions15

,

,

 

 

 

 

 

,

,

,

Decide

Decide

,

,

Propagate

,

Partial Assignment

Formula

Conflict

Rule Being Applied

,

,

,

,

T-Conflict (

,

,

,

,

Explain

,

,

,

,

,

Propagate

,

,

,

,

,

,

T-Conflict

,

,

,

,

,

,

Fail

Fail

,

,

,

,

Learn

,

,

,

,

,

Backjump

Backjump

Explain

is true:

Congruence:

Contradicts

 

is true:

is true:

is false:

 Slide16

Example: Uninterpreted Functions16

,

,

 

 

 

 

 

,

,

,

,

T-Conflict (

,

,

,

,

,

,

T-Conflict

 

 

 

 

 

 

 

 

 

 

 

 

Theory Proof

Theory ProofSlide17

Proofs with Theory LemmasConstruct refutation tree as before

Leaves may be theory lemmasT-solver needs to support a produceProof() methodUse sub-proof to justify the lemmaEach theory-lemma owned by a specific T-solverComplex lemmas may have multiple stepsInvoke produceProof() for each stepCombine with Boolean resolution

17Slide18

AgendaBackground: Proofs in SAT

Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results18Slide19

The Eager ApproachWhen should we prove theory lemmas?Eagerly: when lemma is generated

Easy to produce a proofMany lemmas generated during searchNot all are needed!19Slide20

The Lazy ApproachNo proof production during searchProduce proofs on demand

When theory lemma encountered in refutation treeFewer theory proofs generated But, need to redo some theory reasoning20Slide21

So, Eager or Lazy?Eager: more lemmas, less work for each lemmaLazy: fewer lemmas, each lemma more expensive

Can differ between theory solvers!Evaluation: For uninterpreted functions: LazyFor arrays: Lazy21Slide22

Lazily Proving Lemmas

Theory lemmas: Lemmas are disjunctions:

To prove a previous lemma:

Create a

fresh

theory solverAssert:

When

is derived, call

produceProof

()

 

22

T-Propagation

T-Conflict

T-Learn

T-Propagation

T-Conflict

T-LearnSlide23

Handling RewritesArray solver generates a lemma:

Bitvector

solver performs a rewrite:

Later: ask array solver to prove

Error!

 

23

 

 

-valid

 

not

-valid

 Slide24

Handling Rewrites (cnt’d)

Solution: track rewritesRemember a recipe for proving :Prove

Prove rewrite:

Prove rewrites lazily, with lemmas

 

24Slide25

AgendaBackground: Proofs in SAT

Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results25Slide26

For SAT proofs, Boolean Resolution is enoughFor background theories, need additional rulesProof rules correspond to theory solver’s decision procedure

Theory-Specific Proofs26Slide27

Decision procedure: congruence closureProof generation proposed by Fontaine et al., 2006

Use Transitivity, Congruence and Symmetry rulesUninterpreted Functions27Slide28

Example:

Negated:

,

,

 

Uninterpreted Functions (

cnt’d

)

28

 

 

 

 

 

 

 

Congruence

Symmetry

TransitivitySlide29

Decision procedure: congruence closure, plusRead-over-Write axioms

Extensionality:

Example:

 

Arrays with Extensionality

29

 

 

 

 

Read-over-Write 1

 Slide30

Decision procedure: bitblastingBoolean variables represent

individual bitsProof generation: previous work (LPAR’15)Example:

 

Fixed-Width

Bitvectors

30

 

 

 

BB

 

 

BB

 

Transitivity

 

 

BBSlide31

AgendaBackground: Proofs in SAT

Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results

31Slide32

Implementation: CVC4Currently supported theories:Uninterpreted functionsArrays with extensionality

Fixed-width BitvectorsAnd combinations thereof…Proofs generated in LFSC format32Slide33

Evaluation on SMT-LIBTested relevant families from SMT-LIB:QF_UF, QF_AX, QF_BV

QF_UFBV, QF_ABV, QF_AUFBV33BenchmarkCategory

Default

Solved TimeGenerate Proof

Solved TimeGenerate and Check Proof Solved Time

QF_UF408375234067

19097

4029

61650QF_AX277450

2643170

2603193QF_BV

20517

49884

20430

67072

17602

132975

QF_UFBV

121391122623

4170QF_ABV

448716223

441019900

412722768QF_AUFBV

3193

3124530

1751Symbolic Execution941735894364

712348Total Solved100%

99%88%Slide34

On average, the lazy approach is:

faster for

uninterpreted

functions

faster for arrays

Bitvectors

:

work in progress

 

Eager VS Lazy

34Slide35

Conclusion35

Proof production increases confidence in SMT solversExtend DPLL(T) with proof productionExtensible, modular and robustThe lazy approach: prove only as neededCVC4 supports proofs for uninterpreted functions, arrays and bitvectorsSlide36

Future Work36

Support additional theory solvers:arithmetic, stringsSupport quantified formulasRewrites and preprocessingSlide37

Questions37

Thank You!