Deciding Bit-Vector Formulas with mcSAT Aleksandar Zelji c Uppsala - PowerPoint PPT Presentation

Deciding Bit-Vector Formulas with mcSAT Aleksandar Zelji´ c Uppsala University Philipp R¨ ummer Christoph Wintersteiger Uppsala University Microsoft Research SMT Workshop July 1 st , 2016

We present... A novel decision procedure for the theory of bit-vectors based on mcSAT[Jovanovi´ c, de Moura, VMCAI2013] avoids bit-blasting preserves word-level structure using tailor-made conflict driven learning Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 2

A trivial benchmark (set-logic QF_BV) (declare-fun x () (_ BitVec 29980)) (declare-fun y () (_ BitVec 29980)) (assert (and (bvuge x y) (bvule (bvadd x (_ bv1 29980)) y))) One model: x = 111 . . . 111 , y = 000 . . . 000 Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 3

A trivial benchmark (set-logic QF_BV) (declare-fun x () (_ BitVec 29980)) (declare-fun y () (_ BitVec 29980)) (assert (and (bvuge x y) (bvule (bvadd x (_ bv1 29980)) y))) One model: x = 111 . . . 111 , y = 000 . . . 000 Challenging for bit-blasting! Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 3

Motivating example Factorial computation in C unsigned int f a c t o r i a l = 1u ; i , n ; unsigned int for ( int i = n ; i > 0u ; i −− ) { f a c t o r i a l = f a c t o r i a l ∗ i ; } a s s e r t ( n < = 1 | | f % 2u == 0u) Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 4

Motivating example Factorial computation in C unsigned int f a c t o r i a l = 1u ; i , n ; unsigned int for ( int i = n ; i > 0u ; i −− ) { f a c t o r i a l = f a c t o r i a l ∗ i ; } a s s e r t ( n < = 1 | | f % 2u == 0u) Prove that factorial of any number greater than 2 is even. Use BMC to generate formulas of increasing complexity Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 4

Performance M / O • • • • • • • • • • • • T / O Time [sec] 100 × × × × ∗ ∗ ∗ ∗ • × ∗ 10 × ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ × × × × • × × × 1 0 10 20 30 50 100 150 Iterations × • ∗ mcBV Z3 4.4.2 Boolector 2.2.0 Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 5

Example x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example y �→ 1111 x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example y �→ 1111 z �→ ? x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example y �→ 1110 z �→ 1111 x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example y �→ 1110 z �→ 1111 x �→ 1101 x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example ¬ ( y ≥ u 14) ∨ ¬ ( y < u z ) ∨ ¬ ( x = z + y ) ∨ ¬ ( x < u y + y ) Valid ¬ ( y ≥ u 0) ∨ ¬ ( y < u z ) ∨ ¬ ( x = z + y ) ∨ ¬ ( x < u y + y ) (0 , 1 , 15) ¬ ( y ≥ u 7) ∨ ¬ ( y < u z ) ∨ ¬ ( x = z + y ) ∨ ¬ ( x < u y + y ) (0 , 7 , 9) ¬ ( y ≥ u 10) ∨ ¬ ( y < u z ) ∨ ¬ ( x = z + y ) ∨ ¬ ( x < u y + y ) Valid ¬ ( y ≥ u 8) ∨ ¬ ( y < u z ) ∨ ¬ ( x = z + y ) ∨ ¬ ( x < u y + y ) Valid Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 ∧ y � u z ∨ x � u y + y y � u 1000 ) ( x � = y + z ∨ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 ∧ y � u z ∨ x � u y + y y � u 1000 ) ( x � = y + z ∨ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Example y �→ 0111 z �→ 1111 x �→ 0110 x = y + z y < u z ( x ≤ u y + y y ⊕ z > u 1000 ) ∧ ∧ ∨ ∧ y � = 1111 ∧ y � u z ∨ x � u y + y y � u 1000 ) ( x � = y + z ∨ ∨ Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 6

Existing methods Bit-blasting encoding of BVA into propositional logic leverages the efficiency of SAT solvers scales poorly destroys word-level structure Other approaches: preprocessing combining lazy and eager solvers encoding into arithmetic Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 7

About mcSAT Allows concrete variable assignments Flexible learning (not only in terms of literals on the trail) Model is readily available The partial model philosophy Literals on the trail are justified by model assignments Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 8

mcSAT The problem is a collection of clauses C to be satisfied. Trail represents the model M being constructed. Abstract transition system a search state — � M , C � . a conflict state — � M , C � | = c Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 9

Propositional Search Rules Propagate c = ( l 1 ∨ . . . ∨ l m ∨ l ) ∈ C ∀ i : value ( l i , M ) = false � M, C � − → � [ M, c → l ] , c � if value ( l, M ) = undef Decide � M, C � − → � [ M, l ] , C � if l ∈ B , value ( l, M ) = undef Conflict � M, C � − → � M, C � ⊢ e if c ∈ C, value ( c, M ) = false Sat if M is complete � M, C � − → sat value ( c, M ) = true for all c ∈ C Forget � M, C � − → � M, C \{ c }� if c ∈ C is a learned clause Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 10

Propositional Conflict Analysis Rules Resolve ¬ l ∈ c � [ M, d → l ] , C � ⊢ c − → � M, C � ⊢ r if r = resolve ( c, d, l ) Consume � [ M, d → l ] , C � ⊢ c − → � M, C � ⊢ c if ¬ l ∈ c � [ M, l ] , C � ⊢ c − → � M, C � ⊢ c if ¬ l ∈ c Backjump c = l 1 ∨ . . . ∨ l m ∨ l ∀ i : value ( L i , M ) = false � [ M, N ] , C � ⊢ c − → � [ M, c → l ] , C � if value ( l, M ) = undef N starts with a decision Unsat � M, C � ⊢ false − → unsat Learn � M, C � ⊢ c − → � M, C ∪ { c }� ⊢ c if c / ∈ C Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 11

Theory Rules T-Propagate l ∈ B , value ( l, M ) = undef [ M, ¬ l ] is infeasible � M, C � − → � [ M, e → l ] , C � if e = explain ([ M, ¬ l ]) T-Decide x is a (theory) variable � M, C � − → � [ M, π ( x ) �→ α ] , C � v [ M ]( x ) = undef if [ M, x �→ α ] is consistent T-Conflict M is infeasible � M, C � − → � M, C � ⊢ e if e = explain ( M ) T-Consume M is infeasible � [ M, x �→ α ] , C � ⊢ e − → � M, C � ⊢ e if e = explain ( M ) T-Backjump-Decide c = l 1 ∨ . . . ∨ l m ∨ l � [ M, x �→ α, N ] , C � ⊢ e − → � [ M, l ] , C � ∃ i : value ( l i , M ) = undef if value ( l, M ) = undef Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 12

Ingredients to instantiate mcSAT a finite basis of literals, B required for termination explain function returns a valid clause which evaluates to false under the trail literals are not necessarily on the trail, but must be from B value function used to evaluate literals under a trail affects strength of propagation propagation cheap infeasability detection detect model propagations bit-pattern-based interval-based Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 13

Model assignments for Bit-Vectors Partial assignments π ( x ) �→ α mutually consistent Projection functions π complete extract n m are a natural choice for bit-vectors Finite basis B remains finite. Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 14

Modifying the Calculus T-Decide x is a (theory) variable in C Domain ( x, [ M, π ( x ) �→ α ]) � = � M, C � − → � [ M, π ( x ) �→ α ] , C � if Domain ( x, M ) [ M, π ( x ) �→ α ] is consistent Deciding Bit-Vector Formulas with MCSAT - Zelji´ c, Wintersteiger, R¨ ummer 15