CSE507 Computer-Aided Reasoning for Software Finite Model Finding - PowerPoint PPT Presentation

CSE507 Computer-Aided Reasoning for Software Finite Model Finding courses.cs.washington.edu/courses/cse507/14au/ Emina Torlak emina@cs.washington.edu

Today 2

Today Last lecture • The DPPL(T) framework for deciding quantifier-free SMT formulas 2

Today Last lecture • The DPPL(T) framework for deciding quantifier-free SMT formulas Today • Finite model finding for quantified FOL and beyond 2

Today Last lecture • The DPPL(T) framework for deciding quantifier-free SMT formulas Today • Finite model finding for quantified FOL and beyond Announcements • Due date for Homework 2 moved to October 30 at 11pm 2

Finite model finding a finite universe U ⋀ • a model ⟨ U, I ⟩ ⊨ F x if one exists ∃ f(a) finite • a minimal unsat ∨ model core (or “unsat”) ¬ finder otherwise ∀ p(y, z) a formula F in FOL 3

Finite model finding a finite universe U ⋀ • a model ⟨ U, I ⟩ ⊨ F x if one exists ∃ f(a) finite • a minimal unsat ∨ model core (or “unsat”) ¬ finder otherwise ∀ p(y, z) • custom search (SEM, CVC4) a formula F in FOL • reduction to SAT (Paradox, Kodkod) 3

Some applications of finite model finding Proving theorems in finite algebras (Finder, SEM, MACE) 4

Some applications of finite model finding Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) 4

Some applications of finite model finding Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) 4

Some applications of finite model finding Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) MemSAT Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) 4

Some applications of finite model finding Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) MemSAT Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) S QUANDER Declarative configuration and execution (ConfigAssure, Margrave, Squander, PBnJ) 4

Some applications of finite model finding Checking lightweight formal specifications (Alloy, ProB, ExUML) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) KODKOD Declarative configuration and execution (ConfigAssure, Margrave, Squander, PBnJ) 4

Overview of Kodkod formula in relational logic (FOL, relations, bit vectors, transitive translator closure) SAT solver model symmetry bounds (partial breaker model and types) core minimal extractor unsat core finite universe 5

Overview of Kodkod formula in relational logic (FOL, relations, bit vectors, transitive translator closure) bounds (partial model and types) finite universe 5

Relational logic by example a minimalistic formal specification of a filesystem 6

Relational logic by example Root ⊆ Dir • The root of a filesystem hierarchy is a directory. 6

Relational logic by example Root ⊆ Dir • The root of a filesystem hierarchy is a directory. contents ⊆ Dir × (File ∪ Dir) • Directories may contain files or directories. 6

Relational logic by example Root ⊆ Dir • The root of a filesystem hierarchy is a directory. contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents • Directories may contain files or directories. • All directories and files are reachable from the root. 6

Relational logic by example Root ⊆ Dir • The root of a filesystem hierarchy is a directory. contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents • Directories may contain files or directories. ∀ d: Dir | ¬ (d ⊆ d.^contents) • All directories and files are reachable from the root. • The contents relation is acyclic. 6

Bounded relational logic by example Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) Finite universe of interpretation. { R , D 1 , D 2 , F 1 , F 2 } { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } 7

Bounded relational logic by example Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) Finite universe of interpretation. { R , D 1 , D 2 , F 1 , F 2 } { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } Bounds for each relation: {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } • Tuples it must contain (partial model). {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } • Tuples it may contain (type). {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } 7

Bounded relational logic by example Root Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) R (File ∪ Dir) ⊆ Root.*contents contents Dir ∀ d: Dir | ¬ (d ⊆ d.^contents) F 1 D 1 { R , D 1 , D 2 , F 1 , F 2 } File { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } F 2 {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } 7

Translation by example Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R , D 1 , D 2 , F 1 , F 2 } { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } 8

Translation by example Root ⊆ Dir Encode contents ⊆ Dir × (File ∪ Dir) • relational constants as boolean (File ∪ Dir) ⊆ Root.*contents matrices ∀ d: Dir | ¬ (d ⊆ d.^contents) • relational expressions as matrix operations { R , D 1 , D 2 , F 1 , F 2 } • formulas as constraints over matrix entries { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } 8

Relational constants as boolean matrices 9

Relational constants as boolean matrices R D 1 D 2 F 1 F 2 { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } 1 0 0 0 0 9

Relational constants as boolean matrices R D 1 D 2 F 1 F 2 { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } 1 0 0 0 0 {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } d 0 d 1 d 2 0 0 9

Relational constants as boolean matrices R D 1 D 2 F 1 F 2 { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } 1 0 0 0 0 {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } d 0 d 1 d 2 0 0 {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } 0 0 0 f 0 f 1 9

Relational constants as boolean matrices R D 1 D 2 F 1 F 2 { ⟨ R ⟩ } ⊆ Root ⊆ { ⟨ R ⟩ } 1 0 0 0 0 {} ⊆ Dir ⊆ { ⟨ R ⟩ , ⟨ D 1 ⟩ , ⟨ D 2 ⟩ } d 0 d 1 d 2 0 0 {} ⊆ File ⊆ { ⟨ F 1 ⟩ , ⟨ F 2 ⟩ } 0 0 0 f 0 f 1 {} ⊆ contents ⊆ { R , D 1 , D 2 } × { R , D 1 , D 2 , F 1 , F 2 } R c 0 c 1 c 2 c 3 c 4 D 1 c 5 c 6 c 7 c 8 c 9 D 2 c 10 c 11 c 12 c 13 c 14 F 1 0 0 0 0 0 F 2 0 0 0 0 0 9

Relational expressions as matrix operations File Dir File ∪ Dir = d 0 d 1 d 2 f 0 f 1 0 0 0 f 0 f 1 d 0 d 1 d 2 0 0 ∨ Dir Dir × (File ∪ Dir) d 0 d 0 ∧ d 0 d 0 ∧ d 1 d 0 ∧ d 2 d 0 ∧ f 0 d 0 ∧ f 1 File ∪ Dir d 1 d 1 ∧ d 0 d 1 ∧ d 1 d 1 ∧ d 2 d 1 ∧ f 0 d 1 ∧ f 1 = × d 2 d 0 d 1 d 2 f 0 f 1 d 2 ∧ d 0 d 2 ∧ d 1 d 2 ∧ d 2 d 2 ∧ f 0 d 2 ∧ f 1 0 0 0 0 0 0 0 0 0 0 0 0 10

⇒ Formulas as constraints over matrix entries contents Dir × (File ∪ Dir) contents ⊆ Dir × (File ∪ Dir) (c 0 ⇒ d 0 ∧ d 0 ) ∧ c 0 c 1 c 2 c 3 c 4 d 0 ∧ d 0 d 0 ∧ d 1 d 0 ∧ d 2 d 0 ∧ f 0 d 0 ∧ f 1 (c 1 ⇒ d 0 ∧ d 1 ) ∧ c 5 c 6 c 7 c 8 c 9 d 1 ∧ d 0 d 1 ∧ d 1 d 1 ∧ d 2 d 1 ∧ f 0 d 1 ∧ f 1 (c 2 ⇒ d 0 ∧ d 2 ) ∧ c 10 c 11 c 12 c 13 c 14 d 2 ∧ d 0 d 2 ∧ d 1 d 2 ∧ d 2 d 2 ∧ f 0 d 2 ∧ f 1 = 0 0 0 0 0 0 0 0 0 0 (c 3 ⇒ d 0 ∧ f 0 ) ∧ 0 0 0 0 0 0 0 0 0 0 (c 4 ⇒ d 0 ∧ f 1 ) ∧ (c 5 ⇒ d 1 ∧ d 0 ) ∧ … (c 14 ⇒ d 2 ∧ f 1 ) 11

Dealing with sparseness and redundancy Dir × (File ∪ Dir) d 0 ∧ d 0 d 0 ∧ d 1 d 0 ∧ d 2 d 0 ∧ f 0 d 0 ∧ f 1 d 1 ∧ d 0 d 1 ∧ d 1 d 1 ∧ d 2 d 1 ∧ f 0 d 1 ∧ f 1 d 2 ∧ d 0 d 2 ∧ d 1 d 2 ∧ d 2 d 2 ∧ f 0 d 2 ∧ f 1 0 0 0 0 0 0 0 0 0 0 12

Dealing with sparseness and redundancy Dir × (File ∪ Dir) d 0 ∧ d 0 d 0 ∧ d 1 d 0 ∧ d 2 d 0 ∧ f 0 d 0 ∧ f 1 d 1 ∧ d 0 d 1 ∧ d 1 d 1 ∧ d 2 d 1 ∧ f 0 d 1 ∧ f 1 d 2 ∧ d 0 d 2 ∧ d 1 d 2 ∧ d 2 d 2 ∧ f 0 d 2 ∧ f 1 0 0 0 0 0 0 0 0 0 0 Empty regions in matrices (exponential w.r.t. relation arity). 12