leonardo de moura microsoft research verification
play

Leonardo de Moura Microsoft Research Verification/Analysis tools - PowerPoint PPT Presentation

Aug 28, 2023 •173 likes •1.35k views

Leonardo de Moura Microsoft Research Verification/Analysis tools need some form of Symbolic Reasoning Satisfiability Modulo Theories: An Appetizer Logic is The Calculus of Computer Science (Z. Manna). High computational complexity

  1. Decision Procedures must be: Incremental & Backtracking Theory Propagation Precise (theory) lemma learning a=b, a > 0, c > 0, a + c < 0 | F Learn clause:  (a=b)   (a > 0)   (c > 0)   (a + c < 0) Imprecise! Precise clause:  a > 0   c > 0   a + c < 0 Satisfiability Modulo Theories: An Appetizer

  2. For some theories, SMT can be reduced to SAT Higher level of abstraction bvmul 32 (a,b) = bvmul 32 (b,a) Satisfiability Modulo Theories: An Appetizer

  3. First-order F  T Theorem Prover T may not have a finite axiomatization Satisfiability Modulo Theories: An Appetizer

  5. Test (correctness + usability) is 95% of the deal: Dev/Test is 1-1 in products. Developers are responsible for unit tests. Tools: Annotations and static analysis (SAL + ESP) File Fuzzing Unit test case generation Satisfiability Modulo Theories: An Appetizer

  6. Security is critical Security bugs can be very expensive: Cost of each MS Security Bulletin: $600k to $Millions. Cost due to worms: $Billions. The real victim is the customer. Most security exploits are initiated via files or packets. Ex: Internet Explorer parses dozens of file formats. Security testing: hunting for million dollar bugs Write A/V Read A/V Null pointer dereference Division by zero Satisfiability Modulo Theories: An Appetizer

  7. Two main techniques used by “black hats” : Code inspection (of binaries). Black box fuzz testing. Black box fuzz testing: A form of black box random testing. Randomly fuzz (=modify) a well formed input. Grammar-based fuzzing: rules to encode how to fuzz. Heavily used in security testing At MS: several internal tools. Conceptually simple yet effective in practice Satisfiability Modulo Theories: An Appetizer

  8. Run Test and Monitor Path Condition Execution Path Test seed Known Inputs Paths New input Constraint System Solve Satisfiability Modulo Theories: An Appetizer

  9. PEX Implements DART for .NET. SAGE Implements DART for x86 binaries. Implements DART to check the feasibility YOGI of program paths generated statically. Partially implements DART to dynamically Vigilante generate worm filters. Satisfiability Modulo Theories: An Appetizer

  10. Test input generator Pex starts from parameterized unit tests Generated tests are emitted as traditional unit tests Satisfiability Modulo Theories: An Appetizer

  11. Satisfiability Modulo Theories: An Appetizer

  12. class ArrayListTest { [PexMethod] void AddItem(int c, object item) { var list = new ArrayList(c); list.Add(item); Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  13. Inputs class ArrayListTest { [PexMethod] void AddItem(int c, object item) { var list = new ArrayList(c); list.Add(item); Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  14. Inputs class ArrayListTest { [PexMethod] (0,null) void AddItem( int c, object item ) { var list = new ArrayList(c); list.Add(item); Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  15. Inputs Observed class ArrayListTest { [PexMethod] Constraints void AddItem( int c, object item ) { (0,null) !(c<0) var list = new ArrayList(c); list.Add(item); Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { c < 0  if ( capacity < 0 ) throw ...; false items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  16. Inputs Observed class ArrayListTest { [PexMethod] Constraints void AddItem( int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { 0 == c  if ( count == items.Length ) true ResizeArray(); items[this.count++] = item; } ...

  17. Inputs Observed class ArrayListTest { [PexMethod] Constraints void AddItem( int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); Assert( list[0] == item ); } item == item  true } class ArrayList { This is a tautology , object[] items; i.e. a constraint that is always true, int count; regardless of the chosen values. ArrayList(int capacity) { if (capacity < 0) throw ...; We can ignore such constraints. items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  18. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem(int c, object item) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  19. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem(int c, object item) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length) ResizeArray(); items[this.count++] = item; } ...

  20. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem (int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) !(c<0) && 0!=c Assert(list[0] == item); } } class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { 0 == c  if (count == items.Length) false ResizeArray(); items[this.count++] = item; } ...

  21. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem (int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) !(c<0) && 0!=c Assert(list[0] == item); } } c<0 class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if ( count == items.Length ) ResizeArray(); items[this.count++] = item; } ...

  22. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem (int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) !(c<0) && 0!=c Assert(list[0] == item); } } c<0 (-1,null) class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length ) ResizeArray(); items[this.count++] = item; } ...

  23. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem (int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) !(c<0) && 0!=c Assert(list[0] == item); } } c<0 (-1,null) c<0 class ArrayList { object[] items; int count; ArrayList(int capacity) { c < 0  if (capacity < 0) throw ...; true items = new object[capacity]; } void Add(object item) { if (count == items.Length ) ResizeArray(); items[this.count++] = item; } ...

  24. Constraints to Inputs Observed class ArrayListTest { [PexMethod] solve Constraints void AddItem (int c, object item ) { (0,null) !(c<0) && 0==c var list = new ArrayList(c); list.Add(item); !(c<0) && 0!=c (1,null) !(c<0) && 0!=c Assert(list[0] == item); } } c<0 (-1,null) c<0 class ArrayList { object[] items; int count; ArrayList(int capacity) { if (capacity < 0) throw ...; items = new object[capacity]; } void Add(object item) { if (count == items.Length ) ResizeArray(); items[this.count++] = item; } ...

  25. Free Linear Rich Bitvector Arrays Combination arithmetic Functions Model used as test inputs Models Used to model custom theories (e.g., .NET type  -Quantifier system) Huge number of small problems. Textual interface is API too inefficient. Satisfiability Modulo Theories: An Appetizer

  26. Apply DART to large applications (not units). Start with well-formed input (not random). Combine with generational search (not DFS). Negate 1-by-1 each constraint in a path constraint. Generate many children for each parent run. generation 1 parent Satisfiability Modulo Theories: An Appetizer

  27. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 0 – seed file Satisfiability Modulo Theories: An Appetizer

  28. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 00 00 00 00 00 00 00 00 00 00 00 00 ; RIFF............ 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 1 Satisfiability Modulo Theories: An Appetizer

  29. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 00 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF....*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ ` 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 2 SMT@Microsoft

  30. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 3 Satisfiability Modulo Theories: An Appetizer

  31. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 00 00 00 00 ; ....strh........ 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 4 Satisfiability Modulo Theories: An Appetizer

  32. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 5 Satisfiability Modulo Theories: An Appetizer

  33. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 00 00 00 00 ; ....strf........ 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 6 Satisfiability Modulo Theories: An Appetizer

  34. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 7 Satisfiability Modulo Theories: An Appetizer

  35. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 C9 9D E4 4E ; ............É� äN 00000060h: 00 00 00 00 ; .... Generation 8 Satisfiability Modulo Theories: An Appetizer

  36. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 9 Satisfiability Modulo Theories: An Appetizer

  37. Starting with 100 zero bytes … SAGE generates a crashing test for Media1 parser 00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** .... 00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................ 00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids 00000040h: 00 00 00 00 73 74 72 66 B2 75 76 3A 28 00 00 00 ; ....strf²uv:(... 00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................ 00000060h: 00 00 00 00 ; .... Generation 10 – CRASH Satisfiability Modulo Theories: An Appetizer

  38. SAGE is very effective at finding bugs. Works on large applications. Fully automated Easy to deploy (x86 analysis – any language) Used in various groups inside Microsoft Powered by Z3. Satisfiability Modulo Theories: An Appetizer

  39. Formulas are usually big conjunctions. SAGE uses only the bitvector and array theories. Pre-processing step has a huge performance impact. Eliminate variables. Simplify formulas. Early unsat detection. Satisfiability Modulo Theories: An Appetizer

  40. Annotated Verification Program Condition F pre/post conditions invariants and other annotations

  41. class C { private int a, z; invariant z > 0 public void M() requires a != 0 { z = 100/a; } }

  42. State Cartesian product of variables (x: int, y: int, z: bool) Execution trace Nonempty finite sequence of states Infinite sequence of states … Nonempty finite sequence of states followed by special error state

  43. x := E assert P x := x + 1 assume P x := 10 S ฀ T havoc x S ; T

  44. Hoare triple { P } S { Q } says that every terminating execution trace of S that starts in a state satisfying P does not go wrong, and terminates in a state satisfying Q

  45. Hoare triple { P } S { Q } says that every terminating execution trace of S that starts in a state satisfying P does not go wrong, and terminates in a state satisfying Q Given S and Q, what is the weakest P’ satisfying { P’ } S {Q} ? P' is called the weakest precondition of S with respect to Q, written wp(S, Q) to check {P} S {Q}, check P  P’

  46. Q[ E / x ] wp( x := E, Q ) = (  x  Q ) wp( havoc x, Q ) = P  Q wp( assert P, Q ) = P  Q wp( assume P, Q ) = wp( S, wp( T, Q )) wp( S ; T, Q ) = wp( S, Q )  wp( T, Q ) wp( S ฀ T, Q ) =

  47. if E then S else T end = assume E; S ฀ assume ¬E; T

Recommend

SMT@Microsoft AFM 2007 Leonardo de Moura and Nikolaj Bjrner { leonardo, nbjorner }

SMT@Microsoft AFM 2007 Leonardo de Moura and Nikolaj Bjrner { leonardo, nbjorner }

SMT@Microsoft AFM 2007 Leonardo de Moura and Nikolaj Bjrner { leonardo, nbjorner } @microsoft.com. Microsoft Research SMT@Microsoft p.1/36 Introduction Industry tools rely on powerful verification engines. Boolean satisfiability (SAT)

1.06k views • 51 slides
Leonardo de Moura Microsoft Research Verification/Analysis tools need some form of Symbolic

Leonardo de Moura Microsoft Research Verification/Analysis tools need some form of Symbolic

Leonardo de Moura Microsoft Research Verification/Analysis tools need some form of Symbolic Reasoning Logic is The Calculus of Computer Science (Z. Manna). High computational complexity Test case generation Verifying Compilers

1.73k views • 161 slides
SMT Solvers Theory &amp; Practice Leonardo de Moura leonardo@microsoft.com Microsoft Research

SMT Solvers Theory &amp; Practice Leonardo de Moura leonardo@microsoft.com Microsoft Research

SMT Solvers Theory &amp; Practice Leonardo de Moura leonardo@microsoft.com Microsoft Research FMCAD 2006 p.1/75 Credits Slides inspired by previous presentations by: Clark Barrett, Harald Ruess, Natarajan Shankar, Cesare Tinelli, Ashish

1.18k views • 113 slides
Z3 - a Tutorial Leonardo de Moura Nikolaj Bjrner Microsoft Research Microsoft Research

Z3 - a Tutorial Leonardo de Moura Nikolaj Bjrner Microsoft Research Microsoft Research

Z3 - a Tutorial Leonardo de Moura Nikolaj Bjrner Microsoft Research Microsoft Research leonardo@microsoft.com nbjorner@microsoft.com Abstract This tutorial introduces the use of the state-of-the-art Satisfiability Modulo Theories Solver

1k views • 61 slides
Developing Efficient SMT Solvers CMU May 2007 Leonardo de Moura leonardo@microsoft.com

Developing Efficient SMT Solvers CMU May 2007 Leonardo de Moura leonardo@microsoft.com

Developing Efficient SMT Solvers CMU May 2007 Leonardo de Moura leonardo@microsoft.com Microsoft Research CMU May 2007 p.1/66 Credits Slides inspired by previous presentations by: Clark Barrett, Harald Ruess, Natarajan Shankar, Cesare

1.03k views • 101 slides
Leonardo de Moura and Nikolaj Bjrner Microsoft Research Verification/Analysis tools need some

Leonardo de Moura and Nikolaj Bjrner Microsoft Research Verification/Analysis tools need some

Leonardo de Moura and Nikolaj Bjrner Microsoft Research Verification/Analysis tools need some form of Symbolic Reasoning Verification/Analysis tools need some form of Symbolic Reasoning Many Flavors: SAT Solvers SMT Solvers First-order

1.19k views • 55 slides
Leonardo de Moura (Microsoft Research) and Grant Passmore (University of Cambridge) A

Leonardo de Moura (Microsoft Research) and Grant Passmore (University of Cambridge) A

Leonardo de Moura (Microsoft Research) and Grant Passmore (University of Cambridge) A Satisfiability Checker with built-in support for useful theories b + 2 = c and f(read(write(a,b,3), c- 2) f(c -b+1) b + 2 = c and f(read(write(a,b,3),

1.21k views • 99 slides
Quantifiers Leonardo de Moura Microsoft Research Satisfiability &gt; + 2, =

Quantifiers Leonardo de Moura Microsoft Research Satisfiability &gt; + 2, =

Quantifiers Leonardo de Moura Microsoft Research Satisfiability &gt; + 2, = 2 + 10, + 1000 Model SAT = 0, = 3, = 5 0 &gt; + 2, 0 = 2 + 10, + () 1000

1.62k views • 125 slides
Proofs in Satisfiability Modulo Theories Clark Barrett (NYU) Leonardo de Moura (Microsoft

Proofs in Satisfiability Modulo Theories Clark Barrett (NYU) Leonardo de Moura (Microsoft

Proofs in Satisfiability Modulo Theories Clark Barrett (NYU) Leonardo de Moura (Microsoft Research) Pascal Fontaine (Inria, Loria, U. Lorraine) APPA: All about Proofs, Proofs for All X . X July 18, 2014 July 18, 2014 1 / 41 An

910 views • 76 slides
Leonardo de Moura Quantified SMT formulas. Applications: synthesis, software verification, ...

Leonardo de Moura Quantified SMT formulas. Applications: synthesis, software verification, ...

Leonardo de Moura Quantified SMT formulas. Applications: synthesis, software verification, ... forall x. f(x, x) &gt;= x+a, f(a, b) &lt; a, a &gt; 0 Models as functional programs. f (x1, x2) = if (x1 = 1 and x2 = 2) then 0 else x1 + 1 Online

469 views • 26 slides
Automation and Computation in the Lean Theorem Prover Robert Y. Lewis 1 Leonardo de Moura 2 1

Automation and Computation in the Lean Theorem Prover Robert Y. Lewis 1 Leonardo de Moura 2 1

Automation and Computation in the Lean Theorem Prover Robert Y. Lewis 1 Leonardo de Moura 2 1 Carnegie Mellon University 2 Microsoft Research, Redmond April 6, 2016 Goals for this talk Introduce Lean: a new proof assistant based on dependent

673 views • 39 slides
Model-Constructing Satisfiability Calculus Dejan Jovanovi c Clark Barrett Leonardo de Moura

Model-Constructing Satisfiability Calculus Dejan Jovanovi c Clark Barrett Leonardo de Moura

Model-Constructing Satisfiability Calculus Dejan Jovanovi c Clark Barrett Leonardo de Moura SRI International NYU Microsoft Research Satisfiability Modulo Theories and DPLL(T) Problem Check a given formula for satisfiability modulo the

889 views • 65 slides
Lean in Lean Leonardo de Moura - MSR - USA Workshop Lean Programming Language Goals

Lean in Lean Leonardo de Moura - MSR - USA Workshop Lean Programming Language Goals

Programming Language http://leanprover.github.io Lean in Lean Leonardo de Moura - MSR - USA Workshop Lean Programming Language Goals Extensibility, Expressivity, Scalability, Proof stability Functional Programming (e ffi ciency)

1.13k views • 54 slides
Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura joint work with Bruno

Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura joint work with Bruno

Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura joint work with Bruno Dutertre demoura@csl.sri.com Computer Science Laboratory SRI International Menlo Park, CA Yices: An Efficient Introduction Yices is a SMT Solver

429 views • 13 slides
Verification of Protocol Implementations by Typechecking Cdric Fournet Microsoft Research w

Verification of Protocol Implementations by Typechecking Cdric Fournet Microsoft Research w

Formal/Computational Verification of Protocol Implementations by Typechecking Cdric Fournet Microsoft Research w ith Karthik Bhargavan, Andy Gordon, http://research.microsoft.com/~fournet http://msr-inria.inria.fr/projects/sec

1.28k views • 101 slides
Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura (joint work with Bruno

Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura (joint work with Bruno

Yices 1.0: An Efficient SMT Solver SMT-COMP06 Leonardo de Moura (joint work with Bruno Dutertre) { demoura, bruno } @csl.sri.com. Computer Science Laboratory SRI International Menlo Park, CA Yices: An Efficient SMT Solver p.1

691 views • 16 slides
The Lean Theorem Prover Jeremy Avigad Department of Philosophy and Department of Mathematical

The Lean Theorem Prover Jeremy Avigad Department of Philosophy and Department of Mathematical

The Lean Theorem Prover Jeremy Avigad Department of Philosophy and Department of Mathematical Sciences Carnegie Mellon University (Leans principal developer is Leonardo de Moura, Microsoft Research, Redmond) September 2014 . Automated

965 views • 14 slides
Learning a SAT Solver from Single-Bit Supervision Daniel Selsam 1 Matthew Lamm 1 unz 1 Benedikt

Learning a SAT Solver from Single-Bit Supervision Daniel Selsam 1 Matthew Lamm 1 unz 1 Benedikt

Learning a SAT Solver from Single-Bit Supervision Daniel Selsam 1 Matthew Lamm 1 unz 1 Benedikt B Percy Liang 1 Leonardo de Moura 2 David L. Dill 1 1 Stanford University 2 Microsoft Research March 22nd, 2018 Setup Train: Input:

2.08k views • 88 slides
Yices 1.0: An Efficient SMT Solver AFM06 Tutorial Leonardo de Moura (joint work with Bruno

Yices 1.0: An Efficient SMT Solver AFM06 Tutorial Leonardo de Moura (joint work with Bruno

Yices 1.0: An Efficient SMT Solver AFM06 Tutorial Leonardo de Moura (joint work with Bruno Dutertre) { demoura, bruno } @csl.sri.com. Computer Science Laboratory SRI International Menlo Park, CA Yices: An Efficient SMT Solver p.1

430 views • 27 slides
Complete Instantiation of Quantified Formulas in Satisfiability Modulo Theories Yeting Ge 1

Complete Instantiation of Quantified Formulas in Satisfiability Modulo Theories Yeting Ge 1

Complete Instantiation of Quantified Formulas in Satisfiability Modulo Theories Yeting Ge 1 Leonardo de Moura 2 1 New York University 2 Microsoft Research 7th International Workshop on Satisfiability Modulo Theories Aug 3, 2009 Montreal, Canada

1.33k views • 86 slides
A Fast Linear-Arithmetic Solver for DPLL(T) Bruno Dutertre and Leonardo de Moura { bruno, demoura

A Fast Linear-Arithmetic Solver for DPLL(T) Bruno Dutertre and Leonardo de Moura { bruno, demoura

A Fast Linear-Arithmetic Solver for DPLL(T) Bruno Dutertre and Leonardo de Moura { bruno, demoura } @csl.sri.com. Computer Science Laboratory SRI International Menlo Park, CA A Fast Linear-Arithmetic Solver for DPLL(T) p.1 Introduction

945 views • 75 slides
Intermediate Verification Language K. Rustan M. Leino Principal Researcher Research in Software

Intermediate Verification Language K. Rustan M. Leino Principal Researcher Research in Software

Program Verification via an Intermediate Verification Language K. Rustan M. Leino Principal Researcher Research in Software Engineering (RiSE), Microsoft Research, Redmond Visiting Professor Department of Computing, Imperial College London

459 views • 35 slides
Verification Techniques for Object Invariants Peter Mller Microsoft Research Joint work with

Verification Techniques for Object Invariants Peter Mller Microsoft Research Joint work with

A Unified Framework for Verification Techniques for Object Invariants Peter Mller Microsoft Research Joint work with Sophia Drossopoulou and Adrian Francalanza 2 Object Invariants Express consistency criteria of objects Support

503 views • 18 slides
Which verification for soft error detection? Leonardo Bautista-Gomez 1 , Anne Benoit 2 , Aur

Which verification for soft error detection? Leonardo Bautista-Gomez 1 , Anne Benoit 2 , Aur

Problem statement Theoretical analysis Performance evaluation Conclusion Which verification for soft error detection? Leonardo Bautista-Gomez 1 , Anne Benoit 2 , Aur elien Cavelan 2 , Saurabh K. Raina 3 , Yves Robert 2 , 4 and Hongyang Sun 2 1

453 views • 34 slides

More recommend