DPLLTBased SMT Solvers Guy Katz Clark Barrett Cesare Tinelli Andrew Reynolds Liana Hadarean Stanford University The University of Iowa Synopsys Producing Checkable Artifacts ID: 547507
Download Presentation The PPT/PDF document "Lazy Proofs for" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
Lazy Proofs for DPLL(T)-Based SMT Solvers
Guy Katz, Clark Barrett, Cesare Tinelli, Andrew Reynolds, Liana Hadarean
Stanford
University
The University
of Iowa
SynopsysSlide2
Producing Checkable ArtifactsSMT solvers used in verification & analysis toolsVerifying
safety-critical systems Increase reliability by producing checkable artifacts2
SMT Solver
Input Query
Result
SAT
Model:
CheckSlide3
The UNSAT CaseNo satisfying model exists
3
SMT Solver
Input Query
Result
UNSAT
?
Proof
CheckSlide4
Proofs are UsefulInterpolant generationSkeptical Proof-Assistants (Coq, Isabelle/HOL)
Discharge goals using SMT-SolverReconstruct internal proof from certificate4Slide5
Our Contributions5
Proof production in DPLL(T)-based solversProofs are fine-grainedExtensible: add support for additional theoriesSupports combinations of theoriesProofs for the theory of arraysLazy proof generationSolve now, prove laterMore efficient Evaluation in CVC4, available onlineSlide6
AgendaBackground: Proofs in SATProofs in DPLL(T)-Based SMT Solvers
Lazy Proof ProductionTheory-Specific ProofsExperimental Results6Slide7
AgendaBackground: Proofs in SATProofs in DPLL(T)-Based SMT Solvers
Lazy Proof ProductionTheory-Specific ProofsExperimental Results7Slide8
Boolean Resolution8
The Boolean Resolution rule:A proof of unsatisfiability:
Start with input clauses
Apply resolutionDerive empty clauseCan always do this for UNSAT formulas
Slide9
The DPLL Architecture9
An abstract algorithm for solving SATIncrementally assign variables to true/falseDecide assignments Deduce assignmentsIf formula is satisfied, doneIf a conflict is found, backjumpUndo previous decisions, try something elseSlide10
Input clauses (CNF):
, ,
,
DPLL: Example
10
Propagate
,
Propagate
,
,
Conflict
,
,
Explain
,
,
Explain
,
,
Learn
,
,
Backjump
Backjump
Propagate
Decide
Decide
Partial Assignment
Formula
Conflict
Rule Being Applied
Clause:
is true
is false
Conflict:
Not satisfied by assignment
Slide11
DPLL: Example (cnt’d)11
Propagate
Partial Assignment
Formula
Conflict
Rule Being Applied
Propagate
Conflict
Explain
Explain
Explain
Fail
Fail
Slide12
Input clauses:
, ,
,
Constructing a Proof
12
Explain
Explain
Explain
Fail
Fail
,
,
Explain
,
,
Explain
,
,
Learn
Slide13
AgendaBackground: Proofs in SATProofs in DPLL(T
)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results13Slide14
Adding the Theory SolversDPLL(T): DPLL + Background theory TTheory atoms mapped to Boolean atoms
SAT solver constructs (partial) assignmentTheory solver checks if it is T-consistentTheory solvers can:Report conflicts (T-conflict)Propagate literals (T-propagate)Learn new clauses (T-Learn)14
Justified by
Theory LemmasSlide15
Example: Uninterpreted Functions15
,
,
,
,
,
Decide
Decide
,
,
Propagate
,
Partial Assignment
Formula
Conflict
Rule Being Applied
,
,
,
,
T-Conflict (
,
,
,
,
Explain
,
,
,
,
,
Propagate
,
,
,
,
,
,
T-Conflict
,
,
,
,
,
,
Fail
Fail
,
,
,
,
Learn
,
,
,
,
,
Backjump
Backjump
Explain
is true:
Congruence:
Contradicts
is true:
is true:
is false:
Slide16
Example: Uninterpreted Functions16
,
,
,
,
,
,
T-Conflict (
,
,
,
,
,
,
T-Conflict
Theory Proof
Theory ProofSlide17
Proofs with Theory LemmasConstruct refutation tree as before
Leaves may be theory lemmasT-solver needs to support a produceProof() methodUse sub-proof to justify the lemmaEach theory-lemma owned by a specific T-solverComplex lemmas may have multiple stepsInvoke produceProof() for each stepCombine with Boolean resolution
17Slide18
AgendaBackground: Proofs in SAT
Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results18Slide19
The Eager ApproachWhen should we prove theory lemmas?Eagerly: when lemma is generated
Easy to produce a proofMany lemmas generated during searchNot all are needed!19Slide20
The Lazy ApproachNo proof production during searchProduce proofs on demand
When theory lemma encountered in refutation treeFewer theory proofs generated But, need to redo some theory reasoning20Slide21
So, Eager or Lazy?Eager: more lemmas, less work for each lemmaLazy: fewer lemmas, each lemma more expensive
Can differ between theory solvers!Evaluation: For uninterpreted functions: LazyFor arrays: Lazy21Slide22
Lazily Proving Lemmas
Theory lemmas: Lemmas are disjunctions:
To prove a previous lemma:
Create a
fresh
theory solverAssert:
When
is derived, call
produceProof
()
22
T-Propagation
T-Conflict
T-Learn
T-Propagation
T-Conflict
T-LearnSlide23
Handling RewritesArray solver generates a lemma:
Bitvector
solver performs a rewrite:
Later: ask array solver to prove
Error!
23
-valid
not
-valid
Slide24
Handling Rewrites (cnt’d)
Solution: track rewritesRemember a recipe for proving :Prove
Prove rewrite:
Prove rewrites lazily, with lemmas
24Slide25
AgendaBackground: Proofs in SAT
Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results25Slide26
For SAT proofs, Boolean Resolution is enoughFor background theories, need additional rulesProof rules correspond to theory solver’s decision procedure
Theory-Specific Proofs26Slide27
Decision procedure: congruence closureProof generation proposed by Fontaine et al., 2006
Use Transitivity, Congruence and Symmetry rulesUninterpreted Functions27Slide28
Example:
Negated:
,
,
Uninterpreted Functions (
cnt’d
)
28
Congruence
Symmetry
TransitivitySlide29
Decision procedure: congruence closure, plusRead-over-Write axioms
Extensionality:
Example:
Arrays with Extensionality
29
Read-over-Write 1
Slide30
Decision procedure: bitblastingBoolean variables represent
individual bitsProof generation: previous work (LPAR’15)Example:
Fixed-Width
Bitvectors
30
BB
BB
Transitivity
BBSlide31
AgendaBackground: Proofs in SAT
Proofs in DPLL(T)-Based SMT SolversLazy Proof ProductionTheory-Specific ProofsExperimental Results
31Slide32
Implementation: CVC4Currently supported theories:Uninterpreted functionsArrays with extensionality
Fixed-width BitvectorsAnd combinations thereof…Proofs generated in LFSC format32Slide33
Evaluation on SMT-LIBTested relevant families from SMT-LIB:QF_UF, QF_AX, QF_BV
QF_UFBV, QF_ABV, QF_AUFBV33BenchmarkCategory
Default
Solved TimeGenerate Proof
Solved TimeGenerate and Check Proof Solved Time
QF_UF408375234067
19097
4029
61650QF_AX277450
2643170
2603193QF_BV
20517
49884
20430
67072
17602
132975
QF_UFBV
121391122623
4170QF_ABV
448716223
441019900
412722768QF_AUFBV
3193
3124530
1751Symbolic Execution941735894364
712348Total Solved100%
99%88%Slide34
On average, the lazy approach is:
faster for
uninterpreted
functions
faster for arrays
Bitvectors
:
work in progress
Eager VS Lazy
34Slide35
Conclusion35
Proof production increases confidence in SMT solversExtend DPLL(T) with proof productionExtensible, modular and robustThe lazy approach: prove only as neededCVC4 supports proofs for uninterpreted functions, arrays and bitvectorsSlide36
Future Work36
Support additional theory solvers:arithmetic, stringsSupport quantified formulasRewrites and preprocessingSlide37
Questions37
Thank You!