Speeding Up Quantifjed Bit-Vector SMT Solvers by Bit-Width - PowerPoint PPT Presentation

Speeding Up Quantifjed Bit-Vector SMT Solvers by Bit-Width Reductions and Extensions Martin Jonáš , Jan Strejček Fondazione Bruno Kessler, Italy Faculty of Informatics, Masaryk University, Czech Republic

In many software verifjcation applications, quantifjers are necessary. For example in Theory of Bit-Vectors The theory of bit-vectors describes bounded integers (or vectors of bits of fjxed size) with: bitwise operations, arithmetic operations, signed and unsigned comparison. invariant generation, ranking function synthesis, cycle summarization, symbolic state equality test. 1 / 16

Theory of Bit-Vectors The theory of bit-vectors describes bounded integers (or vectors of bits of fjxed size) with: bitwise operations, arithmetic operations, signed and unsigned comparison. invariant generation, ranking function synthesis, cycle summarization, symbolic state equality test. 1 / 16 In many software verifjcation applications, quantifjers are necessary. For example in

∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) Bit-with Reductions In the formula Reduction to 4 bits Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula. 2 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) x [32] and y [32] are variables of bit-width 32, 0 [32] is a constant of bit-width 32.

Bit-with Reductions In the formula Reduction to 4 bits Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula. 2 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) x [32] and y [32] are variables of bit-width 32, 0 [32] is a constant of bit-width 32. ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] )

Bit-with Reductions In the formula Reduction to 4 bits Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula. 2 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) x [32] and y [32] are variables of bit-width 32, 0 [32] is a constant of bit-width 32. ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] )

Bit-width Reductions and Satisfjability 32 Can the observation be leveraged to speed-up SMT solvers? Can the safe bit-width be computed from the formula? Challenges 0.29 0.65 1.9 4.4 100 % 14 95 Observation from our LPAR 2018 paper 216 4905 Count ≥ 8 b ≥ 4 b ≥ 2 b ≥ 1 b Total Difgerent answer for some bit-width bit-widths. Vast majority of quantifjed bit-vectors does not change their satisfjability from very low 3 / 16

Bit-width Reductions and Satisfjability 32 Can the observation be leveraged to speed-up SMT solvers? Can the safe bit-width be computed from the formula? Challenges 0.29 0.65 1.9 4.4 100 % 14 95 Observation from our LPAR 2018 paper 216 4905 Count ≥ 8 b ≥ 4 b ≥ 2 b ≥ 1 b Total Difgerent answer for some bit-width bit-widths. Vast majority of quantifjed bit-vectors does not change their satisfjability from very low 3 / 16

Outline of the Presentation 1 How to decide satisfjability using bit-width reductions 2 How to decide unsatisfjability using bit-width reductions 3 Our implementation in a single algorithm 4 Experimental evaluation 4 / 16

y [32] ↦ −x [32] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) Symbolic Models of Quantifjed Formulas Consider the formula It is satisfjable. What is its symbolic model? The Skolem function because is satisfjable. 5 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] )

∀x [32] (x [32] + (−x [32] ) = 0 [32] ) Symbolic Models of Quantifjed Formulas Consider the formula It is satisfjable. What is its symbolic model? The Skolem function because is satisfjable. 5 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) y [32] ↦ −x [32]

Symbolic Models of Quantifjed Formulas Consider the formula It is satisfjable. What is its symbolic model? The Skolem function because is satisfjable. 5 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) y [32] ↦ −x [32] ∀x [32] (x [32] + (−x [32] ) = 0 [32] )

∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32] Deciding Satisfjability With Reductions SAT reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] )

SAT: y [4] ↦ −x [4] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32] Deciding Satisfjability With Reductions SAT reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] )

∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32] Deciding Satisfjability With Reductions SAT reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4]

∀x [32] (x [32] + (−x [32] ) = 0 [32] ) Deciding Satisfjability With Reductions SAT reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4] y [32] ↦ −x [32]

SAT Deciding Satisfjability With Reductions reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32]

SAT Deciding Satisfjability With Reductions reduce solve extend substitute substitute solve 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32]

SAT Deciding Satisfjability With Reductions reduce solve model-generating solver extend substitute substitute solve model-validating solver 6 / 16 ∀x [32] ∃y [32] (x [32] + y [32] = 0 [32] ) ∀x [4] ∃y [4] (x [4] + y [4] = 0 [4] ) SAT: y [4] ↦ −x [4] ∀x [32] (x [32] + (−x [32] ) = 0 [32] ) y [32] ↦ −x [32]

x [32] ↦ −y [32] + 1 [32] (−y [32] + 1 [32] ) + y [32] = 0 [32] Symbolic Countermodels of Quantifjed Formulas Consider the formula It is unsatisfjable. What is its symbolic countermodel? The Herbrand function because is unsatisfjable. 7 / 16 ∀x [32] (x [32] + y [32] = 0 [32] )

(−y [32] + 1 [32] ) + y [32] = 0 [32] Symbolic Countermodels of Quantifjed Formulas Consider the formula It is unsatisfjable. What is its symbolic countermodel? The Herbrand function because is unsatisfjable. 7 / 16 ∀x [32] (x [32] + y [32] = 0 [32] ) x [32] ↦ −y [32] + 1 [32]

Symbolic Countermodels of Quantifjed Formulas Consider the formula It is unsatisfjable. What is its symbolic countermodel? The Herbrand function because is unsatisfjable. 7 / 16 ∀x [32] (x [32] + y [32] = 0 [32] ) x [32] ↦ −y [32] + 1 [32] (−y [32] + 1 [32] ) + y [32] = 0 [32]

Overall Algorithm 1 Reduce the formula. 2 Try to solve its satisfjability. 3 Get a symbolic model/countermodel. 4 Extend the symbolic model/countermodel to the original bit-width. 5 Check whether it is a symbolic model/countermodel of the original formula. 6 If unsuccessful, increase the reduction bit-width and repeat. 8 / 16

Overall Algorithm – Practical Implementation φ sat unsat unsat sat sat unsat unsat sat UNSAT SAT solver Model-validating and substitute Extend model Reduce to Quantify and negate φ Extend model Model-generating solver Reduce Reduce to and substitute Model-validating solver Model-generating solver Reduce 9 / 16 larger bw larger bw to bw:=1 to bw:=1

Overall Algorithm – Practical Implementation unsat and substitute Model-validating solver SAT UNSAT sat unsat φ sat sat unsat sat unsat unsat sat Extend model Reduce to Quantify and negate φ and substitute Model-generating solver Reduce Reduce to Extend model Model-validating solver Model-validating solver Model-generating solver Reduce 9 / 16 larger bw larger bw to bw:=1 to bw:=1

Experimental Evaluation Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B 10 / 16

Experimental Evaluation Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B 10 / 16

Experimental Evaluation Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B 10 / 16

Experimental Evaluation Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B 10 / 16