SAT/SMT&Solvers&for&&...
Transcript of SAT/SMT&Solvers&for&&...
![Page 1: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/1.jpg)
SAT/SMT&Solvers&for&&So.ware&Engineering&and&Security!
!A!Short!Course!
by!Vijay!Ganesh!
Assistant!Professor,!University!of!Waterloo,!Canada.!Date:!April!4A8,!2016!
Venue:!Moscow!State!University,!Russia.!
![Page 2: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/2.jpg)
Lecture 1Symbolic Execution based Testing
An Application of Solvers
Vijay GaneshAffiliation: University of Waterloo
![Page 3: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/3.jpg)
Vijay Ganesh
Goals of this Course An introduction to SAT/SMT Solvers and Apps
3
• On the importance of logic in software engineering and security
• What are constraint solvers (Boolean SAT and SMT solvers)
• Symbolic execution + solvers: a powerful combination
• Dynamic symbolic testing (aka, concolic testing)
• Anatomy of modern CDCL solvers
• Conclusions
![Page 4: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/4.jpg)
Vijay Ganesh
A Foundation for Software Engineering Logic Abstractions of Computation
Formal Methods
Program Analysis
Automatic Testing
Program Synthesis
Program Reasoning
Logics(Boolean,...)
4
Bob Floyd (1967) Tony Hoare (1968,70) Amir Pnueli (1977) Ed Clarke (1982) ...
![Page 5: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/5.jpg)
Vijay Ganesh
Software Engineering & SAT/SMT Solvers An Indispensable Tactic for Any Strategy
Formal Methods
Program Analysis
Automatic Testing
Program Synthesis
SE Goal:Reliable/Secure
Software
SAT/SMTSolvers
5
![Page 6: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/6.jpg)
Vijay Ganesh
Software Engineering using Solvers Engineering, Usability, Novelty
6
Program Reasoning Tool
Program Specification
Program is correct?or Generate Counterexamples (test cases)
SAT/SMT Solver
Logic Formulas
SAT/UNSAT
![Page 7: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/7.jpg)
Vijay Ganesh
1,000 Constraints
10,000 Constraints
100,000 Constraints
1,000,000 Constraints
1998 2000 2004 2007 2010
• Solver-based programming languages• Compiler optimizations using solvers• Solver-based debuggers• Solver-based type systems• Solver-based concurrency bugfinding• Solver-based synthesis• Bio & Optimization
• Bounded MC• Program Analysis• AI
• Concolic Testing• Program Analysis• Equivalence Checking• Auto Configuration
SAT/SMT Solver Research Story A 1000x Improvement: Democratization of Logic
7
![Page 8: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/8.jpg)
Vijay Ganesh
The SAT/SMT Problem
• Rich logics (Modular arithmetic, Arrays, Strings,...)
• NP-complete, PSPACE-complete,...
• Practical, scalable, usable, automatic
• Enable novel software reliability approaches
Logic Formula
SAT
UNSATSolver
(q ∨ p ∨ ¬r)(q ∨ ¬p ∨ r)
...
8
![Page 9: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/9.jpg)
Vijay Ganesh
Lecture Outline
9
Points already covered
Motivation for SAT/SMT solvers in software engineering
High-level description of the SAT/SMT problem & logics
Why you should care
Rest of the lecture
• Dynamic symbolic testing (aka concolic testing): A classic use of solvers
• Modern CDCL SAT solver architecture & techniques
• SAT/SMT-based applications
• Future of SAT/SMT solvers
• Some history (who, when,...) and references sprinkled throughout the talk
![Page 10: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/10.jpg)
Vijay Ganesh
Dynamic Symbolic Testing Symbolic/Concrete Execution + Solvers
10
Dynamic Symbolic Interpreter
Program Specification
Program is correct?or Generate Counterexamples (test cases)
SAT/SMT Solver
Logic Formulas
SAT/UNSAT
![Page 11: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/11.jpg)
Concolic Testing: Example
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
The concolic testing slides are courtesy Koushik Sen
![Page 12: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/12.jpg)
Concolic Testing: Example
ERROR
2*y == x
x > y+10
Y
Y
N
N
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
![Page 13: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/13.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = x0, y = y0
![Page 14: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/14.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = x0, y = y0,
z = 2*y0
![Page 15: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/15.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } }
}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 22, y = 7,
z = 14
x = x0, y = y0,
z = 2*y0
2*y0 != x0
![Page 16: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/16.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 2, y = 1,
z = 2
x = x0, y = y0,
z = 2*y0
2*y0 == x0
Solve: 2*y0 == x0
Solution: x0 = 2, y0 = 1
![Page 17: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/17.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 2, y = 1, z = 2
x = x0, y = y0, z = 2*y0
2*y0 == x0
x0 < y0+10
![Page 18: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/18.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 2, y = 1,
z = 2
x = x0, y = y0,
z = 2*y0
Solve: (2*y0 == x0) AND (x0 > y0 + 10)
Solution: x0 = 30, y0 = 15
2*y0 == x0
x0 · y0+10
![Page 19: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/19.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 30, y = 15 x = x0, y = y0
![Page 20: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/20.jpg)
Concolic Testing Approach
int double (int v) { return 2*v; }
void testme (int x, int y) { z = double (y); if (z == x) { if (x > y+10) { ERROR; } } }
Concrete Execution
Symbolic Execution
concrete state
symbolic state
path condition
x = 30, y = 15 x = x0, y = y0
2*y0 == x0
x0 > y0+10
Program Error
![Page 21: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/21.jpg)
Concolic Testing Approach - Example 2
void testme (int x, int y) { if (hash(y) == x) {
ERROR; } }
Concolic Execution
concrete state
symbolic state
path condition
set y = 15, choose x randomly
record hash(y)
Run again by setting
y = 15, x= hash(y)
x = x0, y = y0 hash(15) ==x
![Page 22: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/22.jpg)
Explicit Path (not State) Model Checkingn Traverse all execution
paths one by one to detect errors q assertion violations q program crash q uncaught exceptions
n combine with valgrind to discover memory errors
F T
F F
F
F
T
T
T
T
T
T
![Page 23: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/23.jpg)
Vijay Ganesh
Dynamic Symbolic Testing Some History
23
Symbolic execution for testing first proposed by Lori Clarke (1975) ACM SIGSOFT Outstanding Researcher Award 2012
Follow up work by J.C. King (1976)
Rediscovered/modified in the context of powerful solvers, analysis, and appropriate concretizations by independent groups
Patrice Godefroid and Koushik Sen (2005)
Dawson Engler et al. (2005)
Nicky Williams et al. (2004)
Many follow up works by George Candea, Dawn Song, David Molnar,...
Beyond testing: fault localization, repair, security,...
![Page 24: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/24.jpg)
Vijay Ganesh
Dynamic Symbolic Testing and Analysis Tools
24
KLEE: the most well-known open-source symbolic execution tool (web: https://klee.github.io/)
SAGE: Microsoft’s dynamic symbolic execution tool (closed-source)
S2E: symbolic engine that is built on top of KLEE, but works on binaries (web: http://dslab.epfl.ch/pubs/s2e-tocs.pdf)
Jalangi: dynamic symbolic analysis tool for JavaScript (web: https://github.com/Samsung/jalangi2)
Other tools: Triton, BAP, Bitblaze, Webblaze
![Page 25: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/25.jpg)
Vijay Ganesh
Dynamic Symbolic Testing Symbolic/Concrete Execution + Solvers
25
Dynamic Symbolic Interpreter
Program Specification
Program is correct?or Generate Counterexamples (test cases)
SAT/SMT Solver
Logic Formulas
SAT/UNSAT
![Page 26: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/26.jpg)
Vijay Ganesh
Lecture Outline
26
Points already covered
Motivation for SAT/SMT solvers in software engineering
High-level description of the SAT/SMT problem & logics
Why you should care
Dynamic symbolic testing (sometime also called concolic testing)
Rest of the lecture
• Modern CDCL SAT solver architecture & techniques
• An overview of programmatic SAT solvers
• Some history (who, when,...) and references sprinkled throughout the talk
![Page 27: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/27.jpg)
Vijay Ganesh
The Boolean SAT Problem Basic Definitions and Format
A literal p is a Boolean variable x or its negation ¬x.
A clause C is a disjunction of literals: x2 ∨ ¬x41 ∨ x15
A CNF is a conjunction of clauses: (x2 ∨ ¬x1 ∨ x5) ∧ (x6 ∨ ¬x2) ∧ (x3 ∨ ¬x4 ∨ ¬x6)
All Boolean formulas assumed to be in CNF
Assignment is a mapping (binding) from variables to Boolean values (True, False).
A unit clause C is a clause with a single unbound literal
The SAT-problem is:
Find an assignment s.t. each input clause has a true literal (aka input formula has a solution or is SAT)
OR establish input formula has no solution (aka input formula is UNSAT)
The Input formula is represented in DIMACS Format:
c DIMACS
p cnf 6 3
2 -1 5 0
6 -2 0
3 -4 -6 0
![Page 28: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/28.jpg)
Vijay Ganesh
DPLL SAT Solver Architecture The Basic Solver
28
DPLL(Θcnf, assign) {
Propagate unit clauses;
if ”conflict”: return FALSE;
if ”complete assign”: return TRUE;
”pick decision variable x”;
return
DPLL(Θcnf⎮x=0, assign[x=0]) || DPLL(Θcnf⎮x=1, assign[x=1]);
}
• Propagate (Boolean Constant Propagation):• Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict:• Conflict: partial assignment is not satisfying
• Decide (Branch): • Choose a variable & assign some value
• Backtracking:• Implicitly done by the recursion
![Page 29: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/29.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Key Steps and Data-structures
29
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
Key steps
• Decide()• Propagate() (BCP: Boolean constraint propagation)• Conflict analysis and learning()• Backjump()• Forget()• Restart()
CDCL: Conflict-Driven Clause-Learning
• Conflict analysis is a key step• Results in learning a conflict clause• Prunes the search space
Key data-structures (State):
• Stack or trail of partial assignments (AT)• Input clause database• Conflict clause database• Conflict graph• Decision level (DL) of a variable
![Page 30: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/30.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
30
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Propagate (Boolean Constant Propagation):• Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict?• Conflict: partial assignment is not satisfying
• Decide: • Choose a variable & assign some value (decision)• Each decision is a decision level• Imposes dynamic variable order• Decision Level (DL): variable ⇒ natural number
• Conflict analysis and clause learning: • Analyze the reason (learn conflict clause) • Conflict clause blocks the non-satisfying & a large set of other ‘no-good’ assignments
• Marques-Silva & Sakallah (1999)
• BackJump: • Undo the decision(s) that caused no-good assignment• Assign ‘decision variables’ different values• Go back several decision levels• Marques-Silva & Sakallah (1999)• Backtrack (Davis, Putnam, Loveland, Logemann 1962)
![Page 31: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/31.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
31
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Propagate (Boolean Constant Propagation): • Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict?• Conflict: partial assignment is not satisfying
• Decide (Branch): • Choose a variable & assign some value (decision)• Basic mechanism to do search• Imposes dynamic variable order• Decision Level (DL): variable ⇒ natural number
• Conflict analysis and clause learning: Analyze the reason (learn conflict clause)
• Conflict clause blocks the non-satisfying & a large set of other ‘no-good’ assignments
• Marques-Silva & Sakallah (1999)
• BackJump: • Undo the decision(s) that caused no-good assignment• Assign ‘decision variables’ different values• Go back several decision levels• Marques-Silva & Sakallah (1999)• Backtrack (Davis, Putnam, Loveland, Logemann 1962)
![Page 32: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/32.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
32
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Propagate (Boolean Constant Propagation): • Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict?• Conflict: partial assignment is not satisfying
• Decide (Branch): • Choose a variable & assign some value (decision)• Basic mechanism to do search• Imposes dynamic variable order• Decision Level (DL): variable ⇒ natural number
• Conflict analysis and clause learning: • Analyze the reason (learn conflict clause) • Conflict clause blocks the non-satisfying & a large set of other ‘no-good’ assignments
• Marques-Silva & Sakallah (1999)
• BackJump: • Undo the decision(s) that caused no-good assignment• Assign ‘decision variables’ different values• Go back several decision levels• Marques-Silva & Sakallah (1999)• Backtrack (Davis, Putnam, Loveland, Logemann 1962)
![Page 33: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/33.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
33
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Propagate: • Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict?• Conflict: partial assignment is not satisfying
• Decide (Branch): • Choose a variable & assign some value (decision)• Each decision is a decision level• Imposes dynamic variable order• Decision Level (DL): variable ⇒ natural number
• Conflict analysis and clause learning:• Compute assignments that lead to conflict (analysis)• Construct conflict clause blocks the non-satisfying & a large set of other ‘no-good’ assignments (learning)
• Marques-Silva & Sakallah (1996)
• BackJump: • Undo the decision(s) that caused no-good assignment• Assign ‘decision variables’ different values• Go back several decision levels• Marques-Silva & Sakallah (1999)• Backtrack (Davis, Putnam, Loveland, Logemann 1962)
![Page 34: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/34.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
34
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Propagate: • Propagate inferences due to unit clauses• Most time in solving goes into this
• Detect Conflict?• Conflict: partial assignment is not satisfying
• Decide: • Choose a variable & assign some value (decision)• Each decision is a decision level• Imposes dynamic variable order• Decision Level (DL): variable ⇒ natural number
• Conflict analysis and clause learning: • Compute assignments that lead to conflict (analysis)• Construct conflict clause blocks the non-satisfying & a large set of other ‘no-good’ assignments (learning)
• Marques-Silva & Sakallah (1996)
• Conflict-driven BackJump: • Undo the decision(s) that caused no-good assignment• Assign ‘decision variables’ different values• Go back several decision levels• Backjump: Marques-Silva, Sakallah (1999)• Backtrack: Davis, Putnam, Loveland, Logemann (1962)
![Page 35: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/35.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
35
Propagate() (BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
. . .
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Unit clause (BCP) {3, 6, -7, 8}
{1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Decide
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
More unit clauses
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
CONFLICT! (Trigger to
analyze & backjump)
![Page 36: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/36.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Decide() Details: VSIDS Heuristic
36
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Decide() or Branching():
• Choose a variable & assign some value (decision)
• Imposes dynamic variable order (Malik et al. 2001)
• How to choose a variable:
• VSIDS heuristics
• Each variable has an activity
• Activity is bumped additively, if variable occurs in conflict clause
• Activity of all variables is decayed by multiplying by const < 1
• Next decision variable is the variable with highest activity
• Over time, truly important variables get high activity
• This is pure magic, and seems to work for many problems
![Page 37: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/37.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate() Details: Two-watched Literal Scheme
37
Propagate() (BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
. . .
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Unit clause (BCP) {3, 6, -7, 8}
{1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Decide
Watched Literal
Watcher List
-1 {-1, -3, 8},...
-3 {-1, -3, 8},...
... ...
Watched Literal
Watcher List
-1 {-1, -3, 8},...
-3 ...
8 {-1, -3, 8},...... ...
The constraint propagates 8
Watched Literal
Watcher List
-1 ...
-3 ...
8 {-1, -3, 8},...... ...
![Page 38: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/38.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
38
Propagate()(BCP)
NoConflict?
All VarsAssigned?
Conflict Analysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
. . .
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Unit clause (BCP) {3, 6, -7, 8}
{1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
Decide
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
More unit clauses
{3, 6, -7, 8} {1, 4, 7} {-8, 4} {-1, -3, 8} {-3, -4, -8} {-1, -2, 3, 4, -6}
CONFLICT! (Trigger to
analyze & backjump)
Basic Backtracking Search
• Flip the last decision 1• Try setting 1 to False• Highly inefficient• No learning from mistakes
![Page 39: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/39.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details
39
Propagate()(BCP)
NoConflict?
All VarsAssigned?
Conflict Analysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
Some Definitions
• Decision Level (DL)• Map from Boolean variables in input to natural numbers
• All unit clauses in input & resultant propagations get DL = 0
• Every decision var gets a DL in increasing order >= 1
• All propagations due to decision var at DL=x get the DL=x
• Conflict Graph (CG) or Implication Graph• Directed Graph that records decisions & propagations
• Vertices: literals, Edge: unit clauses
• Conflict Clause (CC)• Clause returned by Conflict Analysis(), added to conflict DB
• Implied by the input formula
• A cut in the CG
• Prunes the search
• Assignment Trail (AT)• A stack of partial assignment to literals, with DL info
![Page 40: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/40.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details: Implication Graph
40
Current Assignment Trail: {X9 = 0@1, X10 = 0@3, X11 = 0@3, X12 = 1@2, X13 = 1@2, ...}
Current decision: {X1 = 1@6}
X1 = 1@6
X2 = 1@6
X10 = 0@3
X3 = 1@6
X4 = 1@6
X5 = 1@6
X6 = 1@6
X11 = 0@3
Conflict
X9 = 0@1
W1
W2
W2
W3
W3 W5
W5
W4
W4
W6
W6
W1 = (¬X1 + X2)
W2 = (¬X1 + X3 + X9)W3 = (¬X2 + ¬X3 + X4)W4 = (¬X4 + X5 + X10)W5 = (¬X4 + X6 + X11)W6 = (¬X5 + ¬X6)W7 = (X1 + X7 + ¬X12)W8 = (X1 + X8)W9 = (¬X7 + ¬X8 + ¬X13)
Clause DB CONFLICT GRAPH
![Page 41: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/41.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details: Conflict Clause
41
Current Assignment Trail: {X9 = 0@1, X10 = 0@3, X11 = 0@3, X12 = 1@2, X13 = 1@2, ...}
Current Decision: {X1 = 1@6}
Simplest strategy is to traverse the conflict graph backwards until decision variables: conflict clause includes only decision variables (¬X1 + X9 + X10 + X11)
W1 = (¬X1 + X2)
W2 = (¬X1 + X3 + X9)W3 = (¬X2 + ¬X3 + X4)W4 = (¬X4 + X5 + X10)W5 = (¬X4 + X6 + X11)W6 = (¬X5 + ¬X6)W7 = (X1 + X7 + ¬X12)W8 = (X1 + X8)W9 = (¬X7 + ¬X8 + ¬X13)
Clause DB
Reason SideW4
X10 = 0@3
X1 = 1@6
X2 = 1@6
X3 = 1@6
X4 = 1@6
X5 = 1@6
X6 = 1@6
X11 = 0@3
Conflict
X9 = 0@1
W1
W2
W2
W3
W3 W5
W5
W4 W6
W6
Conflict Side
CONFLICT GRAPH
![Page 42: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/42.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details: Conflict Clause
42
Current Assignment Trail: {X9 = 0@1, X10 = 0@3, X11 = 0@3, X12 = 1@2, X13 = 1@2, ...}
Current Decision: {X1 = 1@6}
Another strategy is to use First Unique Implicant Point (UIP):Traverse graph backwards in breadth-first, expand literals of conflict, stop at first UIP
W1 = (¬X1 + X2)
W2 = (¬X1 + X3 + X9)W3 = (¬X2 + ¬X3 + X4)W4 = (¬X4 + X5 + X10)W5 = (¬X4 + X6 + X11)W6 = (¬X5 + ¬X6)W7 = (X1 + X7 + ¬X12)W8 = (X1 + X8)W9 = (¬X7 + ¬X8 + ¬X13)
Clause DB CONFLICT GRAPH
W4
X10 = 0@3
X1 = 1@6
X2 = 1@6
X3 = 1@6
X4 = 1@6
X5 = 1@6
X6 = 1@6
X11 = 0@3
Conflict
X9 = 0@1
W1
W2
W2
W3
W3 W5
W5
W4 W6
W6
Reason Side Conflict Side
![Page 43: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/43.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details: BackTrack
43
Current Assignment Trail: {X9 = 0@1, X10 = 0@3, X11 = 0@3, X12 = 1@2, X13 = 1@2, ...}
Current decision: {X1 = 1@6}
Strategy: Closest decision level (DL) ≤ current DL for which conflict clause is unit. Undo {X1 = 1@6}
W1 = (¬X1 + X2)
W2 = (¬X1 + X3 + X9)W3 = (¬X2 + ¬X3 + X4)W4 = (¬X4 + X5 + X10)W5 = (¬X4 + X6 + X11)W6 = (¬X5 + ¬X6)W7 = (X1 + X7 + ¬X12)W8 = (X1 + X8)W9 = (¬X7 + ¬X8 + ¬X13)
Clause DB
Reason SideW4
X10 = 0@3
X1 = 1@6
X2 = 1@6
X3 = 1@6
X4 = 1@6
X5 = 1@6
X6 = 1@6
X11 = 0@3
Conflict
X9 = 0@1
W1
W2
W2
W3
W3 W5
W5
W4 W6
W6
Conflict Side
CONFLICT GRAPH
![Page 44: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/44.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Conflict Analysis/Learn() Details: BackJump
44
¬X1 was implied literal, leading to another conflict described below
Conflict clause: (X9 + X10 + X11 + ¬X12 + ¬X13)
BackJump strategy: Closest decision level (DL) ≤ current DL for which conflict clause is unit. Undo {X10 = 0@3}
X1 = 0@6
X8 = 1@6
X7 = 1@6
Conflict
X12 = 1@2
W8
W7
W7
W9
W9
X9 = 0@1
X10 = 0@3
X11 = 0@3
X13 = 1@2W9
Reason Side
Conflict Side
CONFLICT GRAPH
3
1 0
TRAIL
4
5
6
BackJump
X1
DLW1 = (¬X1 + X2)
W2 = (¬X1 + X3 + X9)W3 = (¬X2 + ¬X3 + X4)W4 = (¬X4 + X5 + X10)W5 = (¬X4 + X6 + X11)W6 = (¬X5 + ¬X6)W7 = (X1 + X7 + ¬X12)W8 = (X1 + X8)W9 = (¬X7 + ¬X8 + ¬X13)
CLAUSE DB
![Page 45: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/45.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Restarts and Forget
45
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Restarts
• Clear the Trail and start again
• Start searching with a different variable order
• Only Conflict Clause (CC) database is retained
• Forget: throw away less active learnt conflict clauses routinely
• Routinely throw away very large CC
• Logically CC are implied
• Hence no loss in soundness/completeness
• Time Savings: smaller DB means less work in propagation
• Space savings
![Page 46: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/46.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Why is SAT efficient?
46
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• VSIDS branching heuristic and propagate (BCP)
• Conflict-Driven Clause-Learning (CDCL)
• Forget conflict clauses if DB goes too big
• BackJump
• Restarts
• All the above elements are needed for efficiency
• Deeper understanding lacking
• No predictive theory
![Page 47: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/47.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Propagate(), Decide(), Analyze/Learn(), BackJump()
47
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
• Conflict-Driven Clause-Learning (CDCL) (Marques-Silva & Sakallah 1996)
• Decide/branch and propagate (BCP) (Malik et al. 2001, Zabih & McAllester 1988)
• BackJump (McAllester 1980, Marques-Silva & Sakallah 1999)
• Restarts (Selman & Gomes 2001)
• Follows MiniSAT (Een & Sorensson 2003)
![Page 48: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/48.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Soundness, Completeness & Termination
48
Soundness: A solver is said to be sound, if, for any input formula F, the solver terminates and produces a solution, then F is indeed SAT
Proof: (Easy) SAT is returned only when all vars have been assigned a value (True, False) by Decide or BCP, and solver checks the solution.
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
![Page 49: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/49.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Soundness, Completeness & Termination
49
Completeness: A solver is said to be complete, if, for any input formula F that is SAT, the solver terminates and produces a solution (i.e., solver does not miss solutions)
Proof: (Harder) • Backtracking + BCP + decide is complete (easy)
• Conflict clause is implied by input formula (easy)
• Only need to see backjumping does not skip assignments
• Observe backjumping occurs only when conflict clause (CC) vars < decision level (DL) of conflicting var
• Backjumping to max(DL of vars in CC)
• Decision tree rooted at max(DL of vars in CC)+1 is guaranteed to not satisfy CC
• Hence, backjumping will not skip assignments
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
![Page 50: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/50.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture Soundness, Completeness & Termination
50
Termination: Some measure decreases every iteration
Proof Sketch:
• Loop guarantees either conflict clause (CC) added OR assign extended
• CC added. What stops CC addition looping forever?
• Recall that CC is remembered
• No CC duplication possible
• CC blocks UNSAT assign exploration in decision tree. No duplicate UNSAT assign exploration possible
• Size of decision tree explored decreases for each CC add
Propagate()(BCP)
NoConflict?
All VarsAssigned?
ConflictAnalysis()
Return SAT
Decide()TopLevelConflict?
Return UNSAT
BackJump()
Input SAT Instance
![Page 51: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/51.jpg)
Vijay Ganesh
Problem: Solvers are blackboxes Solution: Programmatic SAT
51
Input Instance Programmatic
SAT Solver
User codeencoding part of
the input
Inspect solver state
Provide corrective feedback
SAT 2012
Solved two problems:• RNA folding problem• Sub-graph isomorphism
![Page 52: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/52.jpg)
Vijay Ganesh
Solvers and Software Engineering Putting it All Together
52
1. SAT/SMT solvers are crucial for software engineering
2. SAT solvers key to SMT (Z3, CVC4, Yices, MathSAT, STP,...)
3. Huge impact in formal methods, program analysis and testing
4. Key ideas that make SAT efficient
1.Conflict-driven clause learning2.VSIDS (or similar) variable selection heuristics3.Backjumping4.Restarts
5. Teacher-student analogy
![Page 53: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/53.jpg)
Vijay Ganesh
One Slide History of Constraint Solving Methods
53
Before modern conception of logic (Before Boole and Frege)
• From Babylon to present day: Huge amount of work on methods to solve (find roots of) polynomials over reals, integers,...
• System of linear equations over the reals (Chinese methods, Cramer’s method, Gauss elimination)
• These methods were typically not complete (e.g., worked for a special class of polynomials)
After modern conception of logic
•Systems of linear inequalities over the integers are solvable (Presburger, 1927)
•Peano arithmetic is undecidable (hence, not solvable) (Godel, 1931)
•First-order logic is undecidable (hence, not solvable) (Turing,1936. Church, 1937)
•A exponential-time algorithm for Boolean SAT problem (Davis, Putnam, Loveland, Loggeman in 1962)
•Systems of Diophantine equations are not solvable (Matiyasevich. 1970)
•Boolean SAT problem is NP-complete (Cook 1971)
•Many efficient, scalable SAT procedures since 1962 for a variety of mathematical theories
![Page 54: SAT/SMT&Solvers&for&& So.ware&Engineering&and&Securitymk.cs.msu.ru/images/9/93/SAT_SMT_Vijay_Ganesh_lecture_1.pdf · Vijay Ganesh Goals of this Course An introduction to SAT/SMT Solvers](https://reader033.fdocuments.us/reader033/viewer/2022043005/5f8d4e3a386d015b904bc394/html5/thumbnails/54.jpg)
Vijay Ganesh
Modern CDCL SAT Solver Architecture References & Important SAT Solvers
54
1. Marques-Silva, J.P. and K.A. Sakallah. GRASP: A Search Algorithm for Propositional Satisfiability. IEEE Transactions on Computers 48(5), 1999, 506-521.
2. Marques-Silva, J.P. and K.A. Sakallah. GRASP: A Search Algorithm for Propositional Satisfiability. Proceedings of ICCAD, 1996.
3. M. Moskewicz, C. Madigan, Y. Zhao, L. Zhang, and S. Malik. CHAFF: Engineering an efficient SAT solver. Proceedings of the Design Automation Conference (DAC), 2001, 530-535.
4. L. Zhang, C. F. Madigan, M. H. Moskewicz and S. Malik. Efficient Conflict Driven Learning in a Boolean Satisfiability Solver. Proceedings of ICCAD, 2001, 279-285.
5. Armin Bierre, Marijn Heule, Hans van Maaren, and Toby Walsh (Editors). Handbook of Satisfiability. 2009. IOS Press. http://www.st.ewi.tudelft.nl/sat/handbook/
6. M. Davis, G. Logemann, and D. Loveland. A machine program for theorem proving. Communications of the ACM.1962.
7. zChaff SAT Solver by Lintao Zhang 2002.
8. GRASP SAT Solver by Joao Marques-Silva and Karem Sakallah 1999.
9. MiniSAT Solver by Niklas Een and Niklas Sorenson 2005 - present
10. SAT Live: http://www.satlive.org/, SAT Competition: http://www.satcompetition.org/
11. SAT/SMT summer school: http://people.csail.mit.edu/vganesh/summerschool/