versat: A Verified Modern SAT Solver

Transcription

1 Computer Science, The University of Iowa, USA

2 Satisfiability Problem (SAT) Is there a model for the given propositional formula? Model: assignments to the variables that makes the formula true. SAT if the formula has a model UNSAT if the formula has a contradiction (thus, no model) Decidable, but NP-Hard SAT solver decides the satisfiability of a formula. Modern SAT solvers can solve large problems. Smart engineering and heuristics work very well with human formulas. Many applications in automated reasoning and verification.

3 SAT Solver Verification Motivation Theoretically: simple specification, sophisticated implementation = a challenging work Practically: SAT solvers are used as trusted backends for verification systems. = to increase the level of trust Two Approaches for Verified SAT Verify the code: mostly written in C/C++, highly optimized Verify the certificate by a trusted(=small/verified) checker: SAT instance: a model that is found by the solver (easy) UNSAT instance: a refutational proof (execution trace, huge)

4 versat: a Verified SAT Solver Goal: Making a new SAT solver such that implements modern SAT techniques and low-level optimizations is verified to produce sound UNSAT answers Focus on the soundness of UNSAT answers and speed SAT certificates have very low overhead to implement and check. Why bother to verify the code for SAT? Speed is more important than a guarantee of termination.

5 The Guru Programming Language Guru is a functional programming language with: Dependent type system (for verification) supports inductive datatypes and (equality) formula types allows partial functions Resource type system (for efficient code generation) mutable arrays with constant time access configurable memory management and no garbage collection Published Papers: PLPV(2010) Resource Typing in Guru. Stump and Austin PLPV(2009) Verified Programming in Guru. Stump, et al. PSTT(2009) Deciding Joinability Modulo Ground Equations in Operational Type Theory. Petcher and Stump

6 Specification: Overview Summary It is an encoding of the propositional logic. This is the only trusted part of versat. The reset of versat are actual implementation and proof. to be checked and certified by the GURU compiler. Size: 259 lines of GURU code (reasonably small) The parser is a part of specification. a trusted interpretation of the benchmark file 145 lines (out of 259 lines)! The type of the solve function Define clause := <list lit>. Define formula := <list clause>. Define solve : Fun(F:formula).<answer F> :=...

7 Specification: Soundness of UNSAT answer Statement of Unsatisfiability Model Theoretically: M.M Φ or Φ Proof Theoretically: Φ (more natural) Solver returns UNSAT when the empty clause is deduced. The answer type Inductive answer : Fun(F:formula).type := sat : Fun(spec F:formula).<answer F> unsat : Fun(spec F:formula)(spec p:<pf F (nil lit)>).<answer F> A <pf F C> value represents a proof of F C. spec (specificational) arguments are only for type checking. So, proofs are not generated in run-time.

8 Specification: Inference System The pf type encodes res (a weaker system than ) Inductive pf : Fun(F : formula)(c:clause).type := pf_asm : Fun(F : formula)(c:clause) (u : { (member C F eq_clause) = tt }). <pf F C> pf_res : Fun(F : formula)(c1 C2 Cr : clause)(l:lit) (d1 : <pf F C1>) (d2 : <pf F C2>) (u : { (is_resolvent Cr C1 C2 l) = tt }). <pf F Cr> Term constructors are the inference rules. is resolvent is a logical (straightforward) function that determines whether Cr is a resolvent of C1 and C2.

9 Implemented Features The least set of features to make modern Engineering: Watched Literals Conflict Analysis + Fast Resolution Backjumping and Non-chronological Backtracking Heuristics: Variable Scoring Clause Learning Summary: 9884 lines of GURU code and proofs Proved 247 lemmas

10 Efficient Representation of Clauses aclause type: array-based clause and invariants Inductive aclause : Fun(nv:word)(F:formula).type := mk_aclause : Fun(spec nv:word)(spec F:formula) (spec n:word)(l:<array lit n>) (u1:{ (array_in_bounds nv l) = tt }) (spec c:clause)(spec pf_c:<pf F c>) (u2:{ c = (to_cl l) }).<aclause nv F> aclause stores a clause in the array. array in bounds: all array items are within bounds and the array is null-terminated. to cl interprets a null-terminated array as a list. the interpretation of array is valid in F.

11 Conflict Analysis with Fast Resolution C l D l Res C D Data structure: For constant time remove operation & duplication removal Invariants: (u1:{ C2L = (length C2) }) (u2:{ (all_lits_are_assigned T (append C2 C1)) = tt }) (u3:{ (cl_has_all_vars (append C2 C1) T) = tt }) (u4:{ (cl_unique C2) = tt })

12 Example Theorem: Clearing the Look-up Table Define cl_has_all_vars_implies_clear_vars_like_new : Forall (nv:word) (vt:<array assignment nv>) (c:clause) (u:{ (cl_valid nv c) = tt }) (r:{ (cl_has_all_vars c vt) = tt }).{ (clear_vars vt c) = (array_new nv UN) }

13 Results: versat vs. proof checking The Certified Track benchmarks of SAT Competition UNSAT benchmarks System: Intel Core 2 Duo 2.40GHz w/ 3GB of memory One hour timeout for solving and checking, individually Systems #Solved #Certified versat 6 6 picosat + RUP 14 4 picosat + TraceCheck Trusted Base: versat: GURU compiler lines of GURU code checker3 (RUP checker): 1,538 lines of C code tracecheck (TraceCheck checker): boolforce library + 2,989 lines of C code

14 Results: versat vs. State-of-the-art Solvers SAT Race 2008 Test Set 1 50 benchmarks System: Intel Xeon X GHz w/ 12GB of memory 900 seconds timeout for solving Systems #Solved #Timeout #Error/Wrong versat picosat minisat Note: versat solved velev-live-sat (78MB size, 224,920 variables, 3,596,474 clauses)

15 Conclusion versat is a new SAT solver written in GURU Implemented modern features with low-level data structures. The soundness of UNSAT answer is proved. Can solve and certify modern scale benchmarks Our paper is submiited to VMCAI and under review. Available at Future Work: Implementing state-of-the-art features: CC Minimization, Restarting, Reordering Literals Implement other related tools: RUP checker