Scaling Up DPLL(T) String Solvers Using Context-Dependent Simplification
|
|
|
- Pamela Heath
- 5 years ago
- Views:
Transcription
1 Scaling Up DPLL(T) String s Using Context-Dependent Simplification Andrew Reynolds, Maverick Woo, Clark Barrett, David Brumley, Tianyi Liang, Cesare Tinelli CAV
2 Importance of String s Automated string solvers are essential for formal methods applications Security applications (e.g. finding XSS attacks) require string solvers that: Are highly efficient Reason about strings with unbounded length (not just bounded ones) Accept a rich language of string constraints 2
3 In This Paper: DPLL(T) string solvers for extended string constraints New technique, context-dependent simplification, improves scalability of current string solvers Implemented in SMT solver CVC4 Experiments show advantages using CVC4 as backend to symbolic execution engine PyEx 3
4 Basic String Constraints Equalities and disequalities between: Basic string terms String constants:, abc Concatenation: x abc Length: x Linear arithmetic terms: x+4,y>2 Extended string terms: Example: x a =y y > x +2 Substring substr( abcde,1,3) = bcd String Contains contains( abcde, cd ) = T String find index of indexof( abcde, d,0) = 3 String Replace replace( ab, b, c ) = ac 4
5 Basic String Constraints Equalities and disequalities between: Basic string terms String constants:, abc Concatenation: x abc Length: x Linear arithmetic terms: x+4,y>2 Extended string terms: Example: x a =y y > x +2 Substring substr( abcde,1,3) = bcd String Contains contains( abcde, cd ) = T String find index of indexof( abcde, d,0) = 3 String SMT Replace Procedure for basic constraints in CVC4 replace( ab, b, c ) = ac [Liang et al CAV2014] UN 5
6 Extended String Constraints Equalities and disequalities between: Basic string terms String constants:, abc Concatenation: x abc Length: x Linear arithmetic terms: x+4,y>2 Extended string terms: Substring: substr( abcde,1,3) String contains: contains( abcde, cd ) Find index of : indexof( abcde, d,0) String replace: replace(x, a, b ) Example: contains(substr(x,0,3), a ) 0 indexof(x, ab,0)<4? Focus of this work 6
7 DPLL(T) String s Cooperation between: Arithmetic String 7
8 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 Set of extended string formulas in CNF Arithmetic String 8
9 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 Arithmetic String Find propositionally satisfying assignment 9
10 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 n<4 Arithmetic contains(x, a ) indexof(x, ab,0)=n String Distribute to arithmetic and string solvers 10
11 DPLL(T) String s (Arithmetic, String) Context contains(x, a ) indexof(x, ab,0)=n n<4 n>8 n<4 Arithmetic contains(x, a ) indexof(x, ab,0)=n String s maintain a context (conjunction of theory literals) 11
12 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 len(x) n x n len(x) n x n x= x= len(x)>0 x >0 n<4 Arithmetic x n x n contains(x, a ) indexof(x, ab,0)=n String x= x >0 String and arithmetic solvers return theory lemmas to solver 12
13 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 len(x) n x n len(x) n x n x= x= len(x)>0 x >0 n<4 x n Arithmetic contains(x, a ) indexof(x, ab,0)=n x= String and repeat 13
14 DPLL(T) String s contains(x, a ) indexof(x, ab,0)=n n<4 n>8 x n x n x= x >0 n<4 x n Arithmetic contains(x, a ) indexof(x, ab,0)=n x= String when no satisfying assignment exists UN when no theory lemmas are returned (context is ) 14
15 Properties of DPLL(T) String s For basic constraints, DPLL(T) string solvers: Can be used for sat and unsat answers Are incomplete and/or non-terminating in general Expected, since decidability is unknown [Bjorner et al 2009,Ganesh et al 2011] Regardless, modern solvers are efficient in practice [Zheng et al 2013,Liang et al 2014,Abdulla et al 2015,Trinh et al 2016] 15
16 How do we handle Extended String Constraints? contains(x, a ) 16
17 How do we handle Extended String Constraints? Naively, by reduction to basic constraints + bounded contains(x, a ) Approach used by many current solvers [Bjorner et al 2009,Zheng et al 2013,Li et al 2013,Trinh et al 2014] 17
18 How do we handle Extended String Constraints? Naively, by reduction to basic constraints + bounded contains(x, a ) 0 n< x.substr(x,n,1) a Expand contains Approach used by many current solvers [Bjorner et al 2009,Zheng et al 2013,Li et al 2013,Trinh et al 2014] 18
19 How do we handle Extended String Constraints? Naively, by reduction to basic constraints + bounded contains(x, a ) 0 n< x.substr(x,n,1) a substr(x,0,1) a substr(x,4,1) a Expand contains Assuming bound x 5 Approach used by many current solvers [Bjorner et al 2009,Zheng et al 2013,Li et al 2013,Trinh et al 2014] 19
20 How do we handle Extended String Constraints? Naively, by reduction to basic constraints + bounded contains(x, a ) 0 n< x.substr(x,n,1) a substr(x,0,1) a substr(x,4,1) a Expand contains Assuming bound x 5 x=z 11 k 1 z 21 z 11 =0 k 1 a... x=z 14 k 4 z 24 z 14 =4 Expand substr k 4 a Approach used by many current solvers [Bjorner et al 2009,Zheng et al 2013,Li et al 2013,Trinh et al 2014] 20
21 How do we handle Extended String Constraints? Naively, by reduction to basic constraints + bounded contains(x, a ) 0 n< x.substr(x,n,1) a substr(x,0,1) a substr(x,4,1) a Expand contains Assuming bound x 5 x=z 11 k 1 z 21 z 11 =0 k 1 a... x=z 14 k 4 z 24 z 14 =4 k 4 a Expand substr Approach used by many current solvers [Bjorner et al 2009,Zheng et al 2013,Li et al 2013,Trinh et al 2014] 21
22 (Eager) Expansion of Extended Constraints contains(x, a ) x=y d Arithmetic String 22
23 (Eager) Expansion of Extended Constraints contains(x, a ) x=y d x=z 11 k 1 z 21 z 11 =0 k 1 a... x=y d x=z 14 k 4 z 24 z 14 =4 k 4 a Expand and eliminate extended symbols Arithmetic String 23
24 (Eager) Expansion of Extended Constraints contains(x, a ) x=y d x=z 11 k 1 z 21 z 11 =0 k 1 a... x=y d x=z 14 k 4 z 24 z 14 =4 k 4 a Expand and eliminate extended symbols Arithmetic String UN or 24
25 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d Arithmetic String 25
26 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d contains(x, a ) x=y d y= ab Arithmetic String 26
27 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d contains(x, a ) x=con(y, d ) x=y d y= ab Arithmetic String contains(x, a ) (x=z 11 k 1 z 21 z 11 =0 k 1 a... x=z 14 k 4 z 24 z 14 =4 k 4 a ) 27
28 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d (x=z 11 k 1 z 21 contains(x, a ) z 11 =0... k 1 a x=z 14 k 4 z 24 z 14 =4 k 4 a ) Arithmetic contains(x, a ) x=y d y= ab String contains(x, a ) (x=z 11 k 1 z 21 z 11 =0 k 1 a... x=z 14 k 4 z 24 z 14 =4 k 4 a ) 28
29 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d (x=z 11 k 1 z 21 contains(x, a ) z 11 =0... k 1 a x=z 14 k 4 z 24 z 14 =4 k 4 a ) Arithmetic contains(x, a ) x=y d y= ab String UN or 29
30 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d (x=z 11 k 1 z 21 contains(x, a ) z 11 =0... k 1 a x=z 14 k 4 z 24 z 14 =4 k 4 a ) Either way: must deal with a large constraint contains(x, a ) x=y d y= ab Arithmetic String UN or 30
31 (Lazy) Expansion of Extended Constraints contains(x, a ) x=y d (x=z 11 k 1 z 21 contains(x, a ) z 11 =0... k 1 a x=z 14 k 4 z 24 z 14 =4 k 4 a ) what if we simplify the input? contains(x, a ) x=y d y= ab Arithmetic String UN or 31
32 SMT s + Simplification All SMT solvers implement simplification techniques contains(x, a ) x=y d (also called normalization or rewrite rules) Leads to smaller inputs, simpler procedures 32
33 SMT s + Simplification All SMT solvers implement simplification techniques contains(x, a ) x=y d (also called normalization or rewrite rules) contains(y d, a ) since x=y d Leads to smaller inputs, simpler procedures 33
34 SMT s + Simplification All SMT solvers implement simplification techniques contains(x, a ) x=y d (also called normalization or rewrite rules) contains(y d, a ) since x=y d contains(y, a ) since contains(y d, a ) contains(y, a ) Leads to smaller inputs, simpler procedures 34
35 SMT s + Simplification All SMT solvers implement simplification techniques contains(x, a ) x=y d (also called normalization or rewrite rules) contains(y d, a ) since x=y d contains(y, a ) since contains(y d, a ) contains(y, a ) Leads to smaller inputs, simpler procedures 35
36 (Lazy) Expansion + Simplification contains(x, a ) x=y d Arithmetic String 36
37 (Lazy) Expansion + Simplification contains(x, a ) x=y d contains(y, a ) Simplify the input Arithmetic String 37
38 (Lazy) Expansion + Simplification contains(y, a ) Arithmetic contains(y, a ) y= ab String 38
39 (Lazy) Expansion + Simplification contains(y, a ) Arithmetic contains(y, a ) y= ab String contains(y, a ) (y=z 11 k 1 z 21 z 11 =0 k 1 a... y=z 14 k 4 z 24 z 14 =4 k 4 a ) 39
40 (Lazy) Expansion + Simplification contains(y, a ) Arithmetic contains(y, a ) y= ab String Still have a large constraint contains(y, a ) (y=z 11 k 1 z 21 z 11 =0 k 1 a... y=z 14 k 4 z 24 z 14 =4 k 4 a ) 40
41 (Lazy) Expansion + Simplification What if we simplify based on the context? contains(y, a ) Arithmetic contains(y, a ) y= ab String contains(y, a ) (y=z 11 k 1 z 21 z 11 =0 k 1 a... y=z 14 k 4 z 24 z 14 =4 k 4 a ) 41
42 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) Arithmetic contains(y, a ) y= ab String Since contains(y, a ) is true when y= ab 42
43 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) Arithmetic contains(y, a ) y= ab String y= ab contains(y, a )=T 43
44 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) Arithmetic contains(y, a ) y= ab String y= ab contains(y, a )=T 44
45 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) Arithmetic contains(y, a ) y= ab String 45
46 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) Arithmetic contains(y, a ) y= ac y= ab String 46
47 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) Arithmetic contains(y, a ) y= ac y= ab String contains(y, a ) is also true when y= ac 47
48 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) y= ac contains(y, a ) Arithmetic contains(y, a ) y= ac y= ab String y= ac contains(y, a )=T 48
49 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) y= ac contains(y, a ) Arithmetic contains(y, a ) y= ac y= ab String UN 49
50 (Lazy) Expansion + Context-Dependent Simplification contains(y, a ) y= ab contains(y, a ) y= ac contains(y, a ) Did not need to fully expand contains! contains(y, a ) y= ac y= ab Arithmetic String UN Refer to this as context-dependent simplification 50
51 Context-Dependent Simplification Context String 51
52 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v contains(u,x) indexof(v, c,0) replace(z, a,y) Equalities between (basic) string terms String Extended terms appearing in constraints 52
53 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v contains(u,x) indexof(v, c,0) replace(z, a,y) String 53
54 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains(u,x) indexof(v, c,0) replace(z, a,y) Construct derivable substitution over basic variables String 54
55 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) String Apply this substitution to extended terms 55
56 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w Simplify results String 56
57 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef String contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w For each extended term that was simplified to a basic one 57
58 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w String x=y b z z= a w u= abcdef contains(u,x)= record simplification as theory lemma 58
59 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w String x=y b z z= a w u= abcdef contains(u,x)= u= abcdef u=v indexof(v, c,0)=2 record simplification as theory lemma 59
60 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w String x=y b z z= a w u= abcdef contains(u,x)= u= abcdef u=v indexof(v, c,0)=2 z= a w replace(z, a,y)=y w record simplification as theory lemma 60
61 Context-Dependent Simplification x=y b z z= a w u= abcdef u=v x y ba w y y z a w w w u abcdef v abcdef contains( abcdef,y ba w) indexof( abcdef, c,0) replace( a w, a,y) 2 y w String x=y b z z= a w u= abcdef contains(u,x)= u= abcdef u=v indexof(v, c,0)=2 z= a w replace(z, a,y)=y w In our dataset, inference of this form is possible in 98% of contexts 61
62 Simplification Rules for Strings Unlike arithmetic: x+x+7*y=y-4 2*x+6*y+4=0 simplification rules for strings are highly non-trivial: substr(x abcd,1+len(x),2) contains( abcde, b x a ) contains(x ac y, b ) indexof( abc x, a x,1) replace( a x, b,y) Implemented in lines of C++ code bc contains(x, b ) contains(y, b ) -1 con( a,replace(x, b,y)) 62
63 Theoretical Contribution Approach described as a rule-based calculus, e.g.: Calculus is: Refutation-sound Model-sound Not terminating in general (decidability is still unknown) 63
64 Experimental Results : PyEx Symbolic Execution Logged queries from PyEx symbolic execution engine (successor of PyExZ3) Using z3str2, z3 and cvc4 as path constraint solver Total of 25,421 benchmarks over 3 runs Compared z3str2, z3, cvc4 w, w/o context-dependent simplification (cds) 64
65 Results : PyEx Symbolic Execution Benchmarks (25,421) z3str2 z3 cvc4 cvc4 + cds 65
66 Results : PyEx Symbolic Execution Benchmarks (25,421) z3 cvc4 + cds cvc4+context-dependent simplification solves 23,802 benchmarks in 5h8m Nearest competitor z3 solves 19,368 benchmarks in 11h33m 66
67 Results : PyEx Symbolic Execution Benchmarks (25,421) cvc4 cvc4 + cds By using context-dependent simplification: cvc4+cds solves 536 benchmarks ( ) w.r.t default cvc4 cvc4+cds expands 4.2x fewer extended terms per benchmark 67
68 Impact on PyEx Symbolic Execution Considered regression tests for 4 Python packages: httplib2, pip, pymongo, requests Tested PyEx using different SMT backends: Config Time Branch Coverage Line Coverage PyEx+z3str2 13h49m 3, % PyEx+z3 11h57m 3, % PyEx+cvc4 4h55m 3, % PyEx+cvc4 achieves comparable program coverage, much faster, wrt other solvers 68
69 Summary New technique context-dependent simplification implemented in CVC4 s string solver Improves scalability on extended string constraints PyEx + CVC4 achieves comparable program coverage using 41% of the runtime as PyEx + nearest competitor 69
70 Future Work More aggressive simplification rules for strings More powerful rules better performance Quality of models for PyEx symbolic execution Which models lead to higher code coverage? Apply context-dependent simplification to other theories: Non-linear arithmetic Lazy bit-blasting approaches to bit-vectors See [Reynolds et al FroCoS 2017] for details Simplification directly benefits Syntax-Guided Synthesis for strings in CVC4 70
71 String solver in CVC4 Open source Available at : 25,421 new benchmarks from PyEx (*.smt2) Available at : Thanks for listening! 71
Andrew Reynolds Liana Hadarean
425,7 3!7441$ 89028147 30,7 #0, 7 9 209.&8 3 $ Andrew Reynolds Liana Hadarean July 15, 2010 1 . 34 0/ 020398 University of Iowa Andrew Reynolds, Cesare Tinelli, Aaron Stump Liana Hadarean, Yeting Ge, Clark
Generating Small Countermodels. Andrew Reynolds Intel August 30, 2012
Generating Small Countermodels using SMT Andrew Reynolds Intel August 30, 2012 Acknowledgements Intel Corporation AmitGoel, Sava Krstic University of Iowa Cesare Tinelli, Francois Bobot New York University
A Decision Procedure for (Co)datatypes in SMT Solvers. Andrew Reynolds Jasmin Christian Blanchette IJCAI sister conference track, July 12, 2016
A Decision Procedure for (Co)datatypes in SMT Solvers Andrew Reynolds Jasmin Christian Blanchette IJCAI sister conference track, July 12, 2016 Satisfiability Modulo Theories (SMT) Solvers Software Verification
Z3str3: A String Solver with Theory-aware Heuristics
Z3str3: A String Solver with Theory-aware Heuristics Murphy Berzish and Vijay Ganesh University of Waterloo Waterloo Canada Yunhui Zheng IBM Research Yorktown Heights USA Abstract We present a new string
SMT Solvers for Verification and Synthesis. Andrew Reynolds VTSA Summer School August 1 and 3, 2017
SMT Solvers for Verification and Synthesis Andrew Reynolds VTSA Summer School August 1 and 3, 2017 Acknowledgements Thanks to past and present members of development team of CVC4: Cesare Tinelli, Clark
DPLL(T ):Fast Decision Procedures
DPLL(T ):Fast Decision Procedures Harald Ganzinger George Hagen Robert Nieuwenhuis Cesare Tinelli Albert Oliveras MPI, Saarburcken The University of Iowa UPC, Barcelona Computer Aided-Verification (CAV)
A Tour of CVC4. Tim King
A Tour of CVC4 Morgan Deters mdeters@cs.nyu.edu Cesare Tinelli cesare-tinelli@uiowa.edu Tim King tim.king@imag.fr Andrew Reynolds andrew.reynolds@epfl.ch Clark Barrett barrett@cs.nyu.edu ÉC O L E P O L
Symbolic Execu.on for Python Progress & Challenges. Maverick Woo
Symbolic Execu.on for Python Progress & Challenges Maverick Woo pooh@cmu.edu 2017-09-26 My Collaborators CMU Peter Chapman; now at Duolingo David Brumley University of Iowa Andrew Reynolds Tianyi Liang;
Symbolic and Concolic Execution of Programs
Symbolic and Concolic Execution of Programs Information Security, CS 526 Omar Chowdhury 10/7/2015 Information Security, CS 526 1 Reading for this lecture Symbolic execution and program testing - James
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS Mathias Preiner, Aina Niemetz and Armin Biere Institute for Formal Models and Verification (FMV) Johannes Kepler University, Linz, Austria http://fmv.jku.at/ TACAS
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS Mathias Preiner?y, Aina Niemetz?y and Armin Biere?? Johannes Kepler University y Stanford University SMT Workshop July 22-23, 2017 Heidelberg, Germany Introduction
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS
COUNTEREXAMPLE-GUIDED MODEL SYNTHESIS Mathias Preiner, Aina Niemetz and Armin Biere Johannes Kepler University Stanford University SMT Workshop July 22-23, 2017 Heidelberg, Germany Introduction Counterexample-Guided
LEARNING TO INSTANTIATE QUANTIFIERS
LEARNING TO INSTANTIATE QUANTIFIERS Armin Biere 1 joint work with Mathias Preiner 1,2, Aina Niemetz 1,2 TACAS 17, SMT 17, PhD Thesis Mathias Preiner in 2017 1 Johannes Kepler University Linz 2 Stanford
Motivation. CS389L: Automated Logical Reasoning. Lecture 17: SMT Solvers and the DPPL(T ) Framework. SMT solvers. The Basic Idea.
Motivation Lecture 17: SMT rs and the DPPL(T ) Framework şıl Dillig n previous lectures, we looked at decision procedures for conjunctive formulas in various first-order theories This lecture: How to handle
Boolean Representations and Combinatorial Equivalence
Chapter 2 Boolean Representations and Combinatorial Equivalence This chapter introduces different representations of Boolean functions. It then discusses the applications of these representations for proving
Clause Sharing and Partitioning for Cloud-Based SMT Solving
Università della Svizzera italiana Facoltà di scienze informatiche Clause Sharing and Partitioning for Cloud-Based SMT Solving Matteo Marescotti, Antti E. J. Hyvärinen, and Natasha Sharygina Università
Scaling Up DPLL(T) String Solvers using Context-Dependent Simplification
Scaling Up DPLL(T) String Solvers using Context-Dependent Simplification Andrew Reynolds 1, Maverick Woo 2, Clark Barrett 3, David Brumley 2, Tianyi Liang 4, and Cesare Tinelli 1 1 Department of Computer
Improving Local Search for Bit-Vector Logics in SMT with Path Propagation
Improving Local Search for Bit-Vector Logics in SMT with Path Propagation Aina Niemetz, Mathias Preiner, Andreas Fröhlich and Armin Biere Institute for Formal Models and Verification (FMV) Johannes Kepler
CAV Verification Mentoring Workshop 2017 SMT Solving
CAV Verification Mentoring Workshop 2017 SMT Solving Alberto Griggio Fondazione Bruno Kessler Trento, Italy The SMT problem Satisfiability Modulo Theories Given a (quantifier-free) FOL formula and a (decidable)
Experiment 3: Logic Simplification
Module: Logic Design Name:... University no:.. Group no:. Lab Partner Name: Mr. Mohamed El-Saied Experiment : Logic Simplification Objective: How to implement and verify the operation of the logical functions
Lost in translation. Leonardo de Moura Microsoft Research. how easy problems become hard due to bad encodings. Vampire Workshop 2015
Lost in translation how easy problems become hard due to bad encodings Vampire Workshop 2015 Leonardo de Moura Microsoft Research I wanted to give the following talk http://leanprover.github.io/ Automated
Z3str2: An Efficient Solver for Strings, Regular Expressions, and Length Constraints
Noname manuscript No. (will be inserted by the editor) Z3str2: An Efficient Solver for Strings, Regular Expressions, and Length Constraints unhui Zheng Vijay Ganesh Sanu Subramanian Omer Tripp Murphy Berzish
PLDI 2016 Tutorial Automata-Based String Analysis
PLDI 2016 Tutorial Automata-Based String Analysis Tevfik Bultan, Abdulbaki Aydin, Lucas Bang Verification Laboratory http://vlab.cs.ucsb.edu Department of Computer Science Common Usages of Strings } Input
Lemmas on Demand for Lambdas
Lemmas on Demand for Lambdas Mathias Preiner, Aina Niemetz and Armin Biere Institute for Formal Models and Verification (FMV) Johannes Kepler University, Linz, Austria http://fmv.jku.at/ DIFTS Workshop
DSAS Laboratory no 4. Laboratory 4. Logic forms
Laboratory 4 Logic forms 4.1 Laboratory work goals Going from Boolean functions to Boolean forms. Logic forms equivalence. Boolean forms simplification. Shannon s theorems. Representation in NAND and NOR
HAMPI A Solver for String Theories
HAMPI A Solver for String Theories Vijay Ganesh MIT (With Adam Kiezun, Philip Guo, Pieter Hooimeijer and Mike Ernst) Dagstuhl, 2010 Motivation for String Theories String-manipulating programs ü String
Gate Level Minimization Map Method
Gate Level Minimization Map Method Complexity of hardware implementation is directly related to the complexity of the algebraic expression Truth table representation of a function is unique Algebraically
Circuit analysis summary
Boolean Algebra Circuit analysis summary After finding the circuit inputs and outputs, you can come up with either an expression or a truth table to describe what the circuit does. You can easily convert
Improving Coq Propositional Reasoning Using a Lazy CNF Conversion
Using a Lazy CNF Conversion Stéphane Lescuyer Sylvain Conchon Université Paris-Sud / CNRS / INRIA Saclay Île-de-France FroCoS 09 Trento 18/09/2009 Outline 1 Motivation and background Verifying an SMT solver
A Tale Of Two Solvers: Eager and Lazy Approaches to Bit-vectors
A Tale Of Two Solvers: Eager and Lazy Approaches to Bit-vectors Liana Hadarean 1, Kshitij Bansal 1, Dejan Jovanović 3, Clark Barrett 1, and Cesare Tinelli 2 1 New York University 2 The University of Iowa
SMTCoq: A plug-in for integrating SMT solvers into Coq
SMTCoq: A plug-in for integrating SMT solvers into Coq Burak Ekici 1, Alain Mebsout 1, Cesare Tinelli 1, Chantal Keller 2, Guy Katz 3, Andrew Reynolds 1, and Clark Barrett 3 1 The University of Iowa, USA
LSN 4 Boolean Algebra & Logic Simplification. ECT 224 Digital Computer Fundamentals. Department of Engineering Technology
LSN 4 Boolean Algebra & Logic Simplification Department of Engineering Technology LSN 4 Key Terms Variable: a symbol used to represent a logic quantity Compliment: the inverse of a variable Literal: a
Lemmas on Demand for the Extensional Theory of Arrays
Lemmas on Demand for the Extensional Theory of Arrays Robert Brummayer Armin Biere Institute for Formal Models and Verification Johannes Kepler University, Linz, Austria ABSTRACT Categories and Subject
Small Formulas for Large Programs: On-line Constraint Simplification In Scalable Static Analysis
Small Formulas for Large Programs: On-line Constraint Simplification In Scalable Static Analysis Isil Dillig, Thomas Dillig, Alex Aiken Stanford University Scalability and Formula Size Many program analysis
Sciduction: Combining Induction, Deduction and Structure for Verification and Synthesis
Sciduction: Combining Induction, Deduction and Structure for Verification and Synthesis (abridged version of DAC slides) Sanjit A. Seshia Associate Professor EECS Department UC Berkeley Design Automation
Decision Procedures in the Theory of Bit-Vectors
Decision Procedures in the Theory of Bit-Vectors Sukanya Basu Guided by: Prof. Supratik Chakraborty Department of Computer Science and Engineering, Indian Institute of Technology, Bombay May 1, 2010 Sukanya
UNIT 1 SIMILARITY, CONGRUENCE, AND PROOFS Lesson 6: Defining and Applying Similarity Instruction
Prerequisite Skills This lesson requires the use of the following skills: creating ratios solving proportions identifying congruent triangles calculating the lengths of triangle sides using the distance
Module -7. Karnaugh Maps
1 Module -7 Karnaugh Maps 1. Introduction 2. Canonical and Standard forms 2.1 Minterms 2.2 Maxterms 2.3 Canonical Sum of Product or Sum-of-Minterms (SOM) 2.4 Canonical product of sum or Product-of-Maxterms(POM)
Deductive Methods, Bounded Model Checking
Deductive Methods, Bounded Model Checking http://d3s.mff.cuni.cz Pavel Parízek CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Deductive methods Pavel Parízek Deductive Methods, Bounded
Efficient Circuit to CNF Conversion
Efficient Circuit to CNF Conversion Panagiotis Manolios and Daron Vroon College of Computing, Georgia Institute of Technology, Atlanta, GA, 30332, USA http://www.cc.gatech.edu/home/{manolios,vroon} Abstract.
Transformation a shifting or change in shape of a graph
1.1 Horizontal and Vertical Translations Frieze Patterns Transformation a shifting or change in shape of a graph Mapping the relating of one set of points to another set of points (ie. points on the original
Formally Certified Satisfiability Solving
SAT/SMT Proof Checking Verifying SAT Solver Code Future Work Computer Science, The University of Iowa, USA April 23, 2012 Seoul National University SAT/SMT Proof Checking Verifying SAT Solver Code Future
CSCI 220: Computer Architecture I Instructor: Pranava K. Jha. Simplification of Boolean Functions using a Karnaugh Map
CSCI 22: Computer Architecture I Instructor: Pranava K. Jha Simplification of Boolean Functions using a Karnaugh Map Q.. Plot the following Boolean function on a Karnaugh map: f(a, b, c, d) = m(, 2, 4,
Ordered structures. Dr. C. Constantinides. Department of Computer Science and Software Engineering Concordia University Montreal, Canada
Ordered structures Dr. C. Constantinides Department of Computer Science and Software Engineering Concordia University Montreal, Canada January 10, 2017 1/19 Introduction Ordered structures include tuples,
DPLL(Γ+T): a new style of reasoning for program checking
DPLL(Γ+T ): a new style of reasoning for program checking Dipartimento di Informatica Università degli Studi di Verona Verona, Italy June, 2011 Motivation: reasoning for program checking Program checking
Integration of SMT-LIB Support into Maple
Integration of SMT-LIB Support into Maple SMT-CAS Integration Some SMT solvers presently incorporate computer algebra techniques in their theory solvers. Examples: verit [3], SMT-RAT [4] Alternate avenue
9.1 Cook-Levin Theorem
CS787: Advanced Algorithms Scribe: Shijin Kong and David Malec Lecturer: Shuchi Chawla Topic: NP-Completeness, Approximation Algorithms Date: 10/1/2007 As we ve already seen in the preceding lecture, two
Gate Level Minimization
Gate Level Minimization By Dr. M. Hebaishy Digital Logic Design Ch- Simplifying Boolean Equations Example : Y = AB + AB Example 2: = B (A + A) T8 = B () T5 = B T Y = A(AB + ABC) = A (AB ( + C ) ) T8 =
Unit-IV Boolean Algebra
Unit-IV Boolean Algebra Boolean Algebra Chapter: 08 Truth table: Truth table is a table, which represents all the possible values of logical variables/statements along with all the possible results of
Automated Theorem Proving and Proof Checking
Automated Theorem Proving and Proof Checking #1 #2 Cunning Theorem-Proving Plan There are full-semester courses on automated deduction; we will elide details. Logic Syntax Theories Satisfiability Procedures
The 4 th Competition on Syntax-Guided Synthesis. Rajeev Alur, Dana Fisman, Rishabh Singh and Armando Solar-Lezama
The 4 th Competition on Syntax-Guided Synthesis Rajeev Alur, Dana Fisman, Rishabh Singh and Armando Solar-Lezama SyGuS Idea and Definition in a Nutshell New Trends in Synthesis Turn off rightmost continuous
QuteSat. A Robust Circuit-Based SAT Solver for Complex Circuit Structure. Chung-Yang (Ric) Huang National Taiwan University
QuteSat A Robust Circuit-Based SAT Solver for Complex Circuit Structure Chung-Yang (Ric) Huang National Taiwan University To appear: DATE 27 2/1/27 Fact Sheet (Background) Boolean Satisfiability (SAT)
The SMT-LIB 2 Standard: Overview and Proposed New Theories
1 / 23 The SMT-LIB 2 Standard: Overview and Proposed New Theories Philipp Rümmer Oxford University Computing Laboratory philr@comlab.ox.ac.uk Third Workshop on Formal and Automated Theorem Proving and
Automata-based Model Counting for String Constraints. Abdulbaki Aydin, Lucas Bang, Tevfik Bultan
Automata-based Model Counting for String Constraints Abdulbaki Aydin, Lucas Bang, Tevfik Bultan https://vlab.cs.ucsb.edu Model Counting for String Constraints Automata-Based model Counter (ABC) 2 Can you
Assignment (3-6) Boolean Algebra and Logic Simplification - General Questions
Assignment (3-6) Boolean Algebra and Logic Simplification - General Questions 1. Convert the following SOP expression to an equivalent POS expression. 2. Determine the values of A, B, C, and D that make
Yices 1.0: An Efficient SMT Solver
Yices 1.0: An Efficient SMT Solver SMT-COMP 06 Leonardo de Moura (joint work with Bruno Dutertre) {demoura, bruno}@csl.sri.com. Computer Science Laboratory SRI International Menlo Park, CA Yices: An Efficient
Minimum Satisfying Assignments for SMT. Işıl Dillig, Tom Dillig Ken McMillan Alex Aiken College of William & Mary Microsoft Research Stanford U.
Minimum Satisfying Assignments for SMT Işıl Dillig, Tom Dillig Ken McMillan Alex Aiken College of William & Mary Microsoft Research Stanford U. 1 / 20 Satisfiability Modulo Theories (SMT) Today, SMT solvers
CSC312 Principles of Programming Languages : Functional Programming Language. Copyright 2006 The McGraw-Hill Companies, Inc.
CSC312 Principles of Programming Languages : Functional Programming Language Overview of Functional Languages They emerged in the 1960 s with Lisp Functional programming mirrors mathematical functions:
An Introduction to Satisfiability Modulo Theories
An Introduction to Satisfiability Modulo Theories Philipp Rümmer Uppsala University Philipp.Ruemmer@it.uu.se February 13, 2019 1/28 Outline From theory... From DPLL to DPLL(T) Slides courtesy of Alberto
Combining forces to solve Combinatorial Problems, a preliminary approach
Combining forces to solve Combinatorial Problems, a preliminary approach Mohamed Siala, Emmanuel Hebrard, and Christian Artigues Tarbes, France Mohamed SIALA April 2013 EDSYS Congress 1 / 19 Outline Context
Leonardo de Moura and Nikolaj Bjorner Microsoft Research
Leonardo de Moura and Nikolaj Bjorner Microsoft Research A Satisfiability Checker with built-in support for useful theories Z3 is a solver developed at Microsoft Research. Development/Research driven by
QUESTION BANK CHAPTER 1 : OVERVIEW OF SYSTEM SOFTWARE. CHAPTER 2: Overview of Language Processors. CHAPTER 3: Assemblers
QUESTION BANK CHAPTER 1 : OVERVIEW OF SYSTEM SOFTWARE 1) Explain Analysis-synthesis model/fron end backend model of compiler 2) Explain various phases of compiler and symbol table. Consider the statement
Nenofar: A Negation Normal Form SMT Solver
Nenofar: A Negation Normal Form SMT Solver Combining Non-Clausal SAT Approaches with Theories Philippe Suter 1, Vijay Ganesh 2, Viktor Kuncak 1 1 EPFL, Switzerland 2 MIT, USA Abstract. We describe an implementation
Automated reasoning over string constraints
University of Iowa Iowa Research Online Theses and Dissertations Fall 2014 Automated reasoning over string constraints Tianyi Liang University of Iowa Copyright 2014 Tianyi Liang This dissertation is available
Turbo-Charging Lemmas on Demand with Don t Care Reasoning
Turbo-Charging Lemmas on Demand with Don t Care Reasoning Aina Niemetz, Mathias Preiner and Armin Biere Institute for Formal Models and Verification (FMV) Johannes Kepler University, Linz, Austria http://fmv.jku.at/
Solving Quantified Verification Conditions using Satisfiability Modulo Theories
Solving Quantified Verification Conditions using Satisfiability Modulo Theories Yeting Ge 1, Clark Barrett 1, and Cesare Tinelli 2 1 New York University, yeting barrett@cs.nyu.edu 2 The University of Iowa,
Applications of Logic in Software Engineering. CS402, Spring 2016 Shin Yoo
Applications of Logic in Software Engineering CS402, Spring 2016 Shin Yoo Acknowledgements I borrow slides from: Moonzoo Kim Theo C. Ruys (http://spinroot.com/spin/doc/ SpinTutorial.pdf) CBMC & Daniel
Combinational Logic Circuits
Chapter 2 Combinational Logic Circuits J.J. Shann (Slightly trimmed by C.P. Chung) Chapter Overview 2-1 Binary Logic and Gates 2-2 Boolean Algebra 2-3 Standard Forms 2-4 Two-Level Circuit Optimization
SMT-LIB for HOL. Daniel Kroening Philipp Rümmer Georg Weissenbacher Oxford University Computing Laboratory. ITP Workshop MSR Cambridge 25 August 2009
1 / 13 SMT-LIB for HOL Daniel Kroening Philipp Rümmer Georg Weissenbacher Oxford University Computing Laboratory ITP Workshop MSR Cambridge 25 August 2009 2 / 13 The SMT-LIB Standard SMT Satisfiability
Model Checking and Its Applications
Model Checking and Its Applications Orna Grumberg Technion, Israel Verification and Deduction Mentoring Workshop July 13, 2018 1 Personal data Ph.d. in (non-automated) verification Postdoc in Model Checking
Suggested problems - solutions
Suggested problems - solutions Quadrilaterals Material for this section references College Geometry: A Discovery Approach, 2/e, David C. Kay, Addison Wesley, 2001. In particular, see section 3.7, pp 190-193.
Given the following information about rectangle ABCD what triangle criterion will you use to prove ADC BCD.
A B D Given the following information about rectangle ABCD what triangle criterion will you use to prove ADC BCD. ADC and BCD are right angles because ABCD is a rectangle ADC BCD because all right angles
argo-lib: A Generic Platform for Decision Procedures
argo-lib: A Generic Platform for Decision Procedures Filip Marić 1 and Predrag Janičić 2 1 e-mail: filip@matf.bg.ac.yu 2 e-mail: janicic@matf.bg.ac.yu Faculty of Mathematics, University of Belgrade Studentski
Symbolic Execution as DPLL Modulo Theories
Symbolic Execution as DPLL Modulo Theories Quoc-Sang Phan Queen Mary University of London q.phan@qmul.ac.uk Abstract We show how Symbolic Execution can be understood as a variant of the DPLL(T ) algorithm,
Inconsistency-tolerant logics
Inconsistency-tolerant logics CS 157 Computational Logic Autumn 2010 Inconsistent logical theories T 1 = { p(a), p(a) } T 2 = { x(p(x) q(x)), p(a), q(a) } Definition: A theory T is inconsistent if T has
EXTENDING SAT SOLVER WITH PARITY CONSTRAINTS
TKK Reports in Information and Computer Science Espoo 2010 TKK-ICS-R32 EXTENDING SAT SOLVER WITH PARITY CONSTRAINTS Tero Laitinen TKK Reports in Information and Computer Science Espoo 2010 TKK-ICS-R32
Yices 2.2. Bruno Dutertre. Computer Science Laboratory, SRI International, 333 Ravenswood Avenue, Menlo Park, CA 94025, USA
Yices 2.2 Bruno Dutertre Computer Science Laboratory, SRI International, 333 Ravenswood Avenue, Menlo Park, CA 94025, USA bruno@csl.sri.com Abstract. Yices is an SMT solver developed by SRI International.
18733: Applied Cryptography S17. Mini Project. due April 19, 2017, 11:59pm EST. φ(x) := (x > 5) (x < 10)
18733: Applied Cryptography S17 Mini Project due April 19, 2017, 11:59pm EST 1 SMT Solvers 1.1 Satisfiability Modulo Theory SMT (Satisfiability Modulo Theories) is a decision problem for logical formulas
Specifying logic functions
CSE4: Components and Design Techniques for Digital Systems Specifying logic functions Instructor: Mohsen Imani Slides from: Prof.Tajana Simunic and Dr.Pietro Mercati We have seen various concepts: Last
An Alldifferent Constraint Solver in SMT
An Alldifferent Constraint Solver in SMT Milan Banković and Filip Marić Faculty of Mathematics, University of Belgrade (milan filip)@matf.bg.ac.rs May 16, 2010 Abstract The finite domain alldifferent constraint,
The Barcelogic SMT Solver
The Barcelogic SMT Solver Tool Paper Miquel Bofill 1, Robert Nieuwenhuis 2, Albert Oliveras 2, Enric Rodríguez-Carbonell 2, and Albert Rubio 2 1 Universitat de Girona 2 Technical University of Catalonia,
Chapter Seven: Regular Expressions. Formal Language, chapter 7, slide 1
Chapter Seven: Regular Expressions Formal Language, chapter 7, slide The first time a young student sees the mathematical constant π, it looks like just one more school artifact: one more arbitrary symbol
OpenSMT2. A Parallel, Interpolating SMT Solver. Antti Hyvärinen, Matteo Marescotti, Leonardo Alt, Sepideh Asadi, and Natasha Sharygina
OpenSMT2 A Parallel, Interpolating SMT Solver Antti Hyvärinen, Matteo Marescotti, Leonardo Alt, Sepideh Asadi, and Natasha Sharygina Why another SMT solver? Model checking OpenSMT Interpolation Parallel
Restoring Circuit Structure From SAT Instances. Jarrod A. Roy, Igor L. Markov, and Valeria Bertacco University of Michigan at Ann Arbor
Restoring Circuit Structure From SAT Instances Jarrod A. Roy, Igor L. Markov, and Valeria Bertacco University of Michigan at Ann Arbor Outline Motivation Preliminaries A Generic Circuit Detection Algorithm
ELCT201: DIGITAL LOGIC DESIGN
ELCT201: DIGITAL LOGIC DESIGN Dr. Eng. Haitham Omran, haitham.omran@guc.edu.eg Dr. Eng. Wassim Alexan, wassim.joseph@guc.edu.eg Lecture 3 Following the slides of Dr. Ahmed H. Madian محرم 1439 ه Winter
Seminar decision procedures: Certification of SAT and unsat proofs
Seminar decision procedures: Certification of SAT and unsat proofs Wolfgang Nicka Technische Universität München June 14, 2016 Boolean satisfiability problem Term The boolean satisfiability problem (SAT)
OpenMath and SMT-LIB
James, Matthew England, Roberto Sebastiani & Patrick Trentin 1 Universities of Bath/Coventry/Trento/Trento J.H.@bath.ac.uk 17 July 2017 1 Thanks to EU H2020-FETOPEN-2016-2017-CSA project SC 2 (712689)
Testing & Symbolic Execution
Testing & Symbolic Execution Software Testing The most common way of measuring & ensuring correctness Input 2 Software Testing The most common way of measuring & ensuring correctness Input Observed Behavior
Algebra 1 Review. Properties of Real Numbers. Algebraic Expressions
Algebra 1 Review Properties of Real Numbers Algebraic Expressions Real Numbers Natural Numbers: 1, 2, 3, 4,.. Numbers used for counting Whole Numbers: 0, 1, 2, 3, 4,.. Natural Numbers and 0 Integers:,
JPF SE: A Symbolic Execution Extension to Java PathFinder
JPF SE: A Symbolic Execution Extension to Java PathFinder Saswat Anand 1,CorinaS.Păsăreanu 2, and Willem Visser 2 1 College of Computing, Georgia Institute of Technology saswat@cc.gatech.edu 2 QSS and
[Draft. Please do not distribute] Online Proof-Producing Decision Procedure for Mixed-Integer Linear Arithmetic
![[Draft. Please do not distribute] Online Proof-Producing Decision Procedure for Mixed-Integer Linear Arithmetic](/thumbs/96/126522402.jpg "[Draft. Please do not distribute] Online Proof-Producing Decision Procedure for Mixed-Integer Linear Arithmetic")
[Draft Please do not distribute] Online Proof-Producing Decision Procedure for Mixed-Integer Linear Arithmetic Sergey Berezin, Vijay Ganesh, and David L Dill Stanford University {berezin,vganesh,dill}@stanfordedu
Testing, Fuzzing, & Symbolic Execution
Testing, Fuzzing, & Symbolic Execution Software Testing The most common way of measuring & ensuring correctness Input 2 Software Testing The most common way of measuring & ensuring correctness Input Observed
This lecture. Databases -Normalization I. Repeating Data. Redundancy. This lecture introduces normal forms, decomposition and normalization.
This lecture Databases -Normalization I This lecture introduces normal forms, decomposition and normalization (GF Royle 2006-8, N Spadaccini 2008) Databases - Normalization I 1 / 23 (GF Royle 2006-8, N
SAT/SMT summer school 2015 Introduction to SMT
SAT/SMT summer school 2015 Introduction to SMT Alberto Griggio Fondazione Bruno Kessler Trento, Italy Some material courtesy of Roberto Sebastiani and Leonardo de Moura Outline Introduction The DPLL(T)
Cuts from Proofs: A Complete and Practical Technique for Solving Linear Inequalities over Integers
Cuts from Proofs: A Complete and Practical Technique for Solving Linear Inequalities over Integers Isil Dillig, Thomas Dillig, and Alex Aiken Computer Science Department Stanford University Linear Arithmetic
Chapter 4. Combinational Logic. Dr. Abu-Arqoub
Chapter 4 Combinational Logic Introduction N Input Variables Combinational Logic Circuit M Output Variables 2 Design Procedure The problem is stated 2 The number of available input variables & required
3.4 Deduction and Evaluation: Tools Conditional-Equational Logic
3.4 Deduction and Evaluation: Tools 3.4.1 Conditional-Equational Logic The general definition of a formal specification from above was based on the existence of a precisely defined semantics for the syntax
Dependently Typed Programming with Mutable State
Dependently Typed Programming with Mutable State Aaron Stump 1 Evan Austin 2 1 Computer Science The University of Iowa 2 Computer Science The University of Kansas U.S. National Science Foundation CAREER
HECTOR: Formal System-Level to RTL Equivalence Checking
ATG SoC HECTOR: Formal System-Level to RTL Equivalence Checking Alfred Koelbl, Sergey Berezin, Reily Jacoby, Jerry Burch, William Nicholls, Carl Pixley Advanced Technology Group Synopsys, Inc. June 2008
Encoding First Order Proofs in SMT
Encoding First Order Proofs in SMT Jeremy Bongio Cyrus Katrak Hai Lin Christopher Lynch Ralph Eric McGregor June 4, 2007 Abstract We present a method for encoding first order proofs in SMT. Our implementation,