Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de...
Transcript of Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de...
![Page 1: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/1.jpg)
Leonardo de MouraMicrosoft Research
![Page 2: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/2.jpg)
Satisfiability Modulo Theories: An Appetizer
Verification/Analysis tools need some form of
Symbolic Reasoning
![Page 3: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/3.jpg)
Logic is “The Calculus of Computer Science” (Z. Manna).
High computational complexity
Satisfiability Modulo Theories: An Appetizer
![Page 4: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/4.jpg)
Satisfiability Modulo Theories: An Appetizer
Test case generation
Verifying Compilers
Predicate Abstraction
Invariant Generation
Type Checking
Model Based Testing
![Page 5: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/5.jpg)
VCC
Hyper-VTerminator T-2
NModel
HAVOC
F7SAGE
Vigilante
SpecExplorer
Satisfiability Modulo Theories: An Appetizer
![Page 6: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/6.jpg)
unsigned GCD(x, y) {requires(y > 0);while (true) {
unsigned m = x % y;if (m == 0) return y;x = y;y = m;
}} We want a trace where the loop is
executed twice.
(y0 > 0) and
(m0 = x0 % y0) and
not (m0 = 0) and
(x1 = y0) and
(y1 = m0) and
(m1 = x1 % y1) and
(m1 = 0)
Solver
x0 = 2
y0 = 4
m0 = 2
x1 = 4
y1 = 2
m1 = 0
SSA
Satisfiability Modulo Theories: An Appetizer
![Page 7: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/7.jpg)
Signature:div : int, { x : int | x 0 } int
Satisfiability Modulo Theories: An Appetizer
SubtypeCall site:if a 1 and a b then
return div(a, b)
Verification conditiona 1 and a b implies b 0
![Page 8: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/8.jpg)
Satisfiability Modulo Theories: An Appetizer
Is formula F satisfiablemodulo theory T ?
SMT solvers have
specialized algorithms for T
![Page 9: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/9.jpg)
b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1)
Satisfiability Modulo Theories: An Appetizer
![Page 10: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/10.jpg)
Arithmetic
b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1)
Satisfiability Modulo Theories: An Appetizer
![Page 11: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/11.jpg)
ArithmeticArray Theory
b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1)
Satisfiability Modulo Theories: An Appetizer
![Page 12: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/12.jpg)
ArithmeticArray TheoryUninterpreted
Functions
b + 2 = c and f(read(write(a,b,3), c-2) ≠ f(c-b+1)
Satisfiability Modulo Theories: An Appetizer
![Page 13: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/13.jpg)
A Theory is a set of sentences
Alternative definition:
A Theory is a class of structures
Satisfiability Modulo Theories: An Appetizer
![Page 14: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/14.jpg)
Z3 is a new solver developed at Microsoft Research.
Development/Research driven by internal customers.
Free for academic research.
Interfaces:
http://research.microsoft.com/projects/z3
Z3Text
C/C++ .NET
OCaml
Satisfiability Modulo Theories: An Appetizer
![Page 15: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/15.jpg)
For most SMT solvers: F is a set of ground formulas
Many Applications
Bounded Model Checking
Test-Case Generation
Satisfiability Modulo Theories: An Appetizer
![Page 16: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/16.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
a b c d e s t
![Page 17: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/17.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
a b c d e s t
![Page 18: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/18.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
c d e s ta,b
![Page 19: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/19.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
c d e s ta,b
![Page 20: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/20.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
d e s ta,b,c
![Page 21: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/21.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
d e s ta,b,c
![Page 22: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/22.jpg)
d,e
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
s ta,b,c
![Page 23: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/23.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
s ta,b,c d,e
![Page 24: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/24.jpg)
a,b,c,s
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
td,e
![Page 25: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/25.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
td,ea,b,c,s
![Page 26: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/26.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t
![Page 27: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/27.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t
![Page 28: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/28.jpg)
a = b, b = c, d = e, b = s, d = t, a e, a s
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t
Unsatisfiable
![Page 29: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/29.jpg)
a = b, b = c, d = e, b = s, d = t, a e
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t
Model
|M| = { 0, 1 }
M(a) = M(b) = M(c) = M(s) = 0
M(d) = M(e) = M(t) = 1
![Page 30: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/30.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t g(d) f(a,g(d))g(e) f(b,g(e))
Congruence Rule:
x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn)
![Page 31: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/31.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t g(d) f(a,g(d))g(e) f(b,g(e))
Congruence Rule:
x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn)
![Page 32: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/32.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t f(a,g(d)) f(b,g(e))
Congruence Rule:
x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn)
g(d),g(e)
![Page 33: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/33.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t f(a,g(d)) f(b,g(e))
Congruence Rule:
x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn)
g(d),g(e)
![Page 34: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/34.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t
Congruence Rule:
x1 = y1, …, xn = yn implies f(x1, …, xn) = f(y1, …, yn)
g(d),g(e) f(a,g(d)),f(b,g(e))
![Page 35: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/35.jpg)
a = b, b = c, d = e, b = s, d = t, f(a, g(d)) f(b, g(e))
Satisfiability Modulo Theories: An Appetizer
a,b,c,s d,e,t g(d),g(e) f(a,g(d)),f(b,g(e))
Unsatisfiable
![Page 36: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/36.jpg)
(fully shared) DAGs for representing terms
Union-find data-structure + Congruence Closure
O(n log n)
Satisfiability Modulo Theories: An Appetizer
![Page 37: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/37.jpg)
Satisfiability Modulo Theories: An Appetizer
x2y – 1 = 0, xy2 – y = 0, xz – z + 1 = 0
Tool: Gröbner Basis
![Page 38: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/38.jpg)
Satisfiability Modulo Theories: An Appetizer
Polynomial Ideals:
Algebraic generalization of zeroness
0 I
p I, q I implies p + q I
p I implies pq I
![Page 39: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/39.jpg)
Satisfiability Modulo Theories: An Appetizer
The ideal generated by a finite collection of polynomials P = { p1, …, pn } is defined as:
I(P) = {p1 q1 + … + pn qn | q1 , …, qn are polynomials}
P is called a basis for I(P).
Intuition:
For all s I(P),
p1 = 0, …, pn = 0 implies s = 0
![Page 40: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/40.jpg)
Satisfiability Modulo Theories: An Appetizer
Hilbert’s Weak Nullstellensatz
p1 = 0, …, pn = 0 is unsatisfiable over C
iff
I({p1, …, pn}) contains all polynomials
1 I({p1, …, pn})
![Page 41: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/41.jpg)
Satisfiability Modulo Theories: An Appetizer
1st Key Idea: polynomials as rewrite rules.
xy2 – y = 0
Becomes
xy2 y
The rewriting system is terminating but it is not confluent.
xy2 y, x2y 1
x2y2xy
y
![Page 42: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/42.jpg)
Satisfiability Modulo Theories: An Appetizer
2nd Key Idea: Completion.
xy2 y, x2y 1
x2y2xy
y
Add polynomial:
xy – y = 0
xy y
![Page 43: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/43.jpg)
Satisfiability Modulo Theories: An Appetizer
x2y – 1 = 0, xy2 – y = 0, xz – z + 1 = 0
x2y 1, xy2 y, xz z – 1
x2y 1, xy2 y, xz z – 1, xy y
x2y 1, xy2 y, xz z – 1, xy y
xy 1, xy2 y, xz z – 1, xy y
y 1, xy2 y, xz z – 1, xy y
y 1, x 1, xz z – 1, xy y
y 1, x 1, 1 = 0, xy y
![Page 44: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/44.jpg)
In practice, we need a combination of theory solvers.
Nelson-Oppen combination method.
Reduction techniques.
Model-based theory combination.
Satisfiability Modulo Theories: An Appetizer
![Page 45: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/45.jpg)
M | F
Partial modelSet of clauses
Satisfiability Modulo Theories: An Appetizer
![Page 46: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/46.jpg)
Guessing (case-splitting)
p, q | p q, q r
p | p q, q r
Satisfiability Modulo Theories: An Appetizer
![Page 47: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/47.jpg)
Deducing
p, s| p q, p s
p | p q, p s
Satisfiability Modulo Theories: An Appetizer
![Page 48: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/48.jpg)
Backtracking
p, s| p q, s q, p q
p, s, q | p q, s q, p q
Satisfiability Modulo Theories: An Appetizer
![Page 49: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/49.jpg)
Efficient indexing (two-watch literal)
Non-chronological backtracking (backjumping)
Lemma learning
…
Satisfiability Modulo Theories: An Appetizer
![Page 50: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/50.jpg)
Efficient decision procedures for conjunctions of ground literals.
a=b, a<5 | a=b f(a)=f(b), a < 5 a > 10
Satisfiability Modulo Theories: An Appetizer
![Page 51: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/51.jpg)
Satisfiability Modulo Theories: An Appetizer
a=b, a > 0, c > 0, a + c < 0 | F
backtrack
![Page 52: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/52.jpg)
Satisfiability Modulo Theories: An Appetizer
SMT Solver = DPLL + Decision Procedure
Standard question:
Why don’t you use CPLEX for
handling linear arithmetic?
![Page 53: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/53.jpg)
Satisfiability Modulo Theories: An Appetizer
Decision Procedures must be:Incremental & BacktrackingTheory Propagation
a=b, a<5 | … a<6 f(a) = a
a=b, a<5, a<6 | … a<6 f(a) = a
![Page 54: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/54.jpg)
Satisfiability Modulo Theories: An Appetizer
Decision Procedures must be:Incremental & BacktrackingTheory PropagationPrecise (theory) lemma learning
a=b, a > 0, c > 0, a + c < 0 | F Learn clause:(a=b) (a > 0) (c > 0) (a + c < 0)Imprecise!Precise clause:a > 0 c > 0 a + c < 0
![Page 55: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/55.jpg)
For some theories, SMT can be reduced to SAT
bvmul32(a,b) = bvmul32 (b,a)
Higher level of abstraction
Satisfiability Modulo Theories: An Appetizer
![Page 56: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/56.jpg)
F TFirst-order
Theorem Prover
T may not have a finite
axiomatization
Satisfiability Modulo Theories: An Appetizer
![Page 57: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/57.jpg)
![Page 58: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/58.jpg)
Test (correctness + usability) is 95% of the deal:
Dev/Test is 1-1 in products.
Developers are responsible for unit tests.
Tools:
Annotations and static analysis (SAL + ESP)
File Fuzzing
Unit test case generation
Satisfiability Modulo Theories: An Appetizer
![Page 59: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/59.jpg)
Security is critical
Security bugs can be very expensive:
Cost of each MS Security Bulletin: $600k to $Millions.
Cost due to worms: $Billions.
The real victim is the customer.
Most security exploits are initiated via files or packets.
Ex: Internet Explorer parses dozens of file formats.
Security testing: hunting for million dollar bugs
Write A/V
Read A/V
Null pointer dereference
Division by zero
Satisfiability Modulo Theories: An Appetizer
![Page 60: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/60.jpg)
Two main techniques used by “black hats”:
Code inspection (of binaries).
Black box fuzz testing.
Black box fuzz testing:
A form of black box random testing.
Randomly fuzz (=modify) a well formed input.
Grammar-based fuzzing: rules to encode how to fuzz.
Heavily used in security testing
At MS: several internal tools.
Conceptually simple yet effective in practice
Satisfiability Modulo Theories: An Appetizer
![Page 61: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/61.jpg)
Execution Path
Run Test and Monitor Path Condition
Solve
seed
New input
TestInputs
Constraint System
KnownPaths
Satisfiability Modulo Theories: An Appetizer
![Page 62: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/62.jpg)
PEX Implements DART for .NET.
SAGE Implements DART for x86 binaries.
YOGIImplements DART to check the feasibility of program paths generated statically.
VigilantePartially implements DART to dynamically generate worm filters.
Satisfiability Modulo Theories: An Appetizer
![Page 63: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/63.jpg)
Test input generatorPex starts from parameterized unit tests
Generated tests are emitted as traditional unit tests
Satisfiability Modulo Theories: An Appetizer
![Page 64: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/64.jpg)
Satisfiability Modulo Theories: An Appetizer
![Page 65: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/65.jpg)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 66: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/66.jpg)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
Inputs
![Page 67: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/67.jpg)
Inputs
(0,null)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 68: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/68.jpg)
Inputs Observed
Constraints
(0,null) !(c<0)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
c < 0 false
![Page 69: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/69.jpg)
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
0 == c true
![Page 70: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/70.jpg)
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
} item == item true
This is a tautology,
i.e. a constraint that is always true,
regardless of the chosen values.
We can ignore such constraints.
![Page 71: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/71.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 72: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/72.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 73: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/73.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null) !(c<0) && 0!=c
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
0 == c false
![Page 74: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/74.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null) !(c<0) && 0!=c
c<0
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 75: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/75.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null) !(c<0) && 0!=c
c<0 (-1,null)
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 76: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/76.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null) !(c<0) && 0!=c
c<0 (-1,null) c<0
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
c < 0 true
![Page 77: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/77.jpg)
Constraints to
solve
Inputs Observed
Constraints
(0,null) !(c<0) && 0==c
!(c<0) && 0!=c (1,null) !(c<0) && 0!=c
c<0 (-1,null) c<0
class ArrayList {object[] items;int count;
ArrayList(int capacity) {if (capacity < 0) throw ...;items = new object[capacity];
}
void Add(object item) {if (count == items.Length)
ResizeArray();
items[this.count++] = item; }...
class ArrayListTest {[PexMethod]void AddItem(int c, object item) {
var list = new ArrayList(c);list.Add(item);Assert(list[0] == item); }
}
![Page 78: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/78.jpg)
Rich Combination
Linear arithmetic
Bitvector ArraysFree
Functions
Models Model used as test inputs
-QuantifierUsed to model custom theories (e.g., .NET type system)
APIHuge number of small problems. Textual interface is too inefficient.
Satisfiability Modulo Theories: An Appetizer
![Page 79: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/79.jpg)
Apply DART to large applications (not units).
Start with well-formed input (not random).
Combine with generational search (not DFS).Negate 1-by-1 each constraint in a path constraint.
Generate many children for each parent run.
parent
generation 1
Satisfiability Modulo Theories: An Appetizer
![Page 80: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/80.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 0 – seed file
Satisfiability Modulo Theories: An Appetizer
![Page 81: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/81.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 00 00 00 00 00 00 00 00 00 00 00 00 ; RIFF............
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 1
Satisfiability Modulo Theories: An Appetizer
![Page 82: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/82.jpg)
`
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
SMT@Microsoft
00000000h: 52 49 46 46 00 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF....*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 2
![Page 83: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/83.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 3
Satisfiability Modulo Theories: An Appetizer
![Page 84: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/84.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 00 00 00 00 ; ....strh........
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 4
Satisfiability Modulo Theories: An Appetizer
![Page 85: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/85.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 5
Satisfiability Modulo Theories: An Appetizer
![Page 86: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/86.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 00 00 00 00 ; ....strf........
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 6
Satisfiability Modulo Theories: An Appetizer
![Page 87: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/87.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(...
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 7
Satisfiability Modulo Theories: An Appetizer
![Page 88: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/88.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(...
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 C9 9D E4 4E ; ............É•äN
00000060h: 00 00 00 00 ; ....
Generation 8
Satisfiability Modulo Theories: An Appetizer
![Page 89: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/89.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 73 74 72 66 00 00 00 00 28 00 00 00 ; ....strf....(...
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 9
Satisfiability Modulo Theories: An Appetizer
![Page 90: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/90.jpg)
Starting with 100 zero bytes …
SAGE generates a crashing test for Media1 parser
00000000h: 52 49 46 46 3D 00 00 00 ** ** ** 20 00 00 00 00 ; RIFF=...*** ....
00000010h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000020h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00000030h: 00 00 00 00 73 74 72 68 00 00 00 00 76 69 64 73 ; ....strh....vids
00000040h: 00 00 00 00 73 74 72 66 B2 75 76 3A 28 00 00 00 ; ....strf²uv:(...
00000050h: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................
00000060h: 00 00 00 00 ; ....
Generation 10 – CRASH
Satisfiability Modulo Theories: An Appetizer
![Page 91: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/91.jpg)
SAGE is very effective at finding bugs.
Works on large applications.
Fully automated
Easy to deploy (x86 analysis – any language)
Used in various groups inside Microsoft
Powered by Z3.
Satisfiability Modulo Theories: An Appetizer
![Page 92: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/92.jpg)
Formulas are usually big conjunctions.
SAGE uses only the bitvector and array theories.
Pre-processing step has a huge performance impact.Eliminate variables.
Simplify formulas.
Early unsat detection.
Satisfiability Modulo Theories: An Appetizer
![Page 93: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/93.jpg)
Annotated Program
Verification Condition F
pre/post conditions
invariants
and other annotations
![Page 94: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/94.jpg)
class C {
private int a, z;
invariant z > 0
public void M()
requires a != 0
{
z = 100/a;
}
}
![Page 95: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/95.jpg)
StateCartesian product of variables
Execution traceNonempty finite sequence of states
Infinite sequence of states
Nonempty finite sequence of statesfollowed by special error state
…
(x: int, y: int, z: bool)
![Page 96: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/96.jpg)
x := Ex := x + 1
x := 10
havoc x
S ; T
assert P
assume P
S T
![Page 97: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/97.jpg)
Hoare triple { P } S { Q } says that
every terminating execution trace of S that starts in a state satisfying P
does not go wrong, and
terminates in a state satisfying Q
![Page 98: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/98.jpg)
Hoare triple { P } S { Q } says that
every terminating execution trace of S that starts in a state satisfying P
does not go wrong, and
terminates in a state satisfying Q
Given S and Q, what is the weakest P’ satisfying {P’} S {Q} ?
P' is called the weakest precondition of S with respect to Q, written wp(S, Q)
to check {P} S {Q}, check P P’
![Page 99: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/99.jpg)
wp( x := E, Q ) =
wp( havoc x, Q ) =
wp( assert P, Q ) =
wp( assume P, Q ) =
wp( S ; T, Q ) =
wp( S T, Q ) =
Q[ E / x ]
(x Q )
P Q
P Q
wp( S, wp( T, Q ))
wp( S, Q ) wp( T, Q )
![Page 100: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/100.jpg)
if E then S else T end =
assume E; S
assume ¬E; T
![Page 101: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/101.jpg)
while Einvariant J
doS
end
= assert J;havoc x; assume J;( assume E; S; assert J; assume false assume ¬E)
where x denotes the
assignment targets of S
“fast forward” to an arbitrary
iteration of the loop
check that the loop invariant holds initially
check that the loop invariant is
maintained by the loop body
![Page 102: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/102.jpg)
BIG
and-or
tree
(ground)
Axioms
(non-ground)
Control & Data
Flow
![Page 103: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/103.jpg)
Meta OS: small layer of software between hardware and OS
Mini: 60K lines of non-trivial concurrent systems C code
Critical: must provide functional resource abstraction
Trusted: a verification grand challenge
Hardware
Hypervisor
![Page 104: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/104.jpg)
VCs have several Mb
Thousands of non ground clauses
Developers are willing to wait at most 5 min per VC
Satisfiability Modulo Theories: An Appetizer
![Page 105: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/105.jpg)
Partial solutionsAutomatic generation of: Loop Invariants
Houdini-style automatic annotation generation
Satisfiability Modulo Theories: An Appetizer
![Page 106: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/106.jpg)
Quantifiers, quantifiers, quantifiers, …
Modeling the runtime
h,o,f:IsHeap(h) o ≠ null read(h, o, alloc) = tread(h,o, f) = null read(h, read(h,o,f),alloc) = t
Satisfiability Modulo Theories: An Appetizer
![Page 107: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/107.jpg)
Quantifiers, quantifiers, quantifiers, …
Modeling the runtime
Frame axioms
o, f:o ≠ null read(h0, o, alloc) = t
read(h1,o,f) = read(h0,o,f) (o,f) M
Satisfiability Modulo Theories: An Appetizer
![Page 108: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/108.jpg)
Quantifiers, quantifiers, quantifiers, …
Modeling the runtime
Frame axioms
User provided assertions
i,j: i j read(a,i) read(b,j)
Satisfiability Modulo Theories: An Appetizer
![Page 109: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/109.jpg)
Quantifiers, quantifiers, quantifiers, …
Modeling the runtime
Frame axioms
User provided assertions
Theories x: p(x,x)
x,y,z: p(x,y), p(y,z) p(x,z)
x,y: p(x,y), p(y,x) x = y
Satisfiability Modulo Theories: An Appetizer
![Page 110: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/110.jpg)
Quantifiers, quantifiers, quantifiers, …
Modeling the runtime
Frame axioms
User provided assertions
TheoriesSolver must be fast in satisfiable instances.
We want to find bugs!
Satisfiability Modulo Theories: An Appetizer
![Page 111: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/111.jpg)
There is no sound and refutationally complete
procedure for
linear integer arithmetic + free function symbols
Satisfiability Modulo Theories: An Appetizer
![Page 112: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/112.jpg)
Heuristic quantifier instantiation
Combining SMT with Saturation provers
Complete quantifier instantiation
Decidable fragments
Model based quantifier instantiation
Satisfiability Modulo Theories: An Appetizer
![Page 113: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/113.jpg)
Is the axiomatization of the runtime consistent?
False implies everything
Partial solution: SMT + Saturation Provers
Found many bugs using this approach
Satisfiability Modulo Theories: An Appetizer
![Page 114: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/114.jpg)
Standard complain
“I made a small modification in my Spec, and Z3 is timingout”
This also happens with SAT solvers (NP-complete)
In our case, the problems are undecidable
Partial solution: parallelization
Satisfiability Modulo Theories: An Appetizer
![Page 115: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/115.jpg)
Joint work with Y. Hamadi (MSRC) and C. Wintersteiger
Multi-core & Multi-node (HPC)
Different strategies in parallel
Collaborate exchanging lemmasStrategy
1
Strategy 2
Strategy 3
Strategy 4
Strategy 5
Satisfiability Modulo Theories: An Appetizer
![Page 116: Leonardo de Moura Microsoft Researchleodemoura.github.io/files/sbmf09-slides.pdf · Leonardo de Moura Microsoft Research. Satisfiability Modulo Theories: An Appetizer Verification/Analysis](https://reader033.fdocuments.us/reader033/viewer/2022050502/5f941f538e7c69100a21f0c9/html5/thumbnails/116.jpg)
Logic as a platform
Most verification/analysis tools need symbolic reasoning
SMT is a hot area
Many applications & challenges
http://research.microsoft.com/projects/z3
Thank You!
Satisfiability Modulo Theories: An Appetizer