210 likes | 303 Views
Quantifiers, Arithmetic and Fixed-points. Quantifier Elimination Procedures in Z3 Support for Non-linear arithmetic Fixed-points – features and a preview. Quantifier Elimination. O ption: ELIM_QUANTIFIERS=true LRA – Linear real arithmetic LIA – Linear integer arithemtic
E N D
Quantifiers, Arithmetic and Fixed-points • Quantifier Elimination Procedures in Z3 • Support for Non-linear arithmetic • Fixed-points – features and a preview
Quantifier Elimination • Option: ELIM_QUANTIFIERS=true • LRA – Linear real arithmetic • LIA – Linear integer arithemtic • D – Algebraic Datatypes • Booleans & Bit-vectors – (All-SAT) • NRA2 – Quadratic (using virtual substitutions) • Arrays – ad hoc
LRA Terms Atoms Formulas
LIA Terms Atoms Formulas
D – algebraic data-types • Domain Closure: • Eliminate accessors: • Solve equalities: • Virtual substitution:
NRA • Virtual substitutions for second-degree polynomials • Method by Weispfenning et.al. (Redlog) • Used both as quantifier elimination (all SAT) and ground decision procedure (first SAT) • ….
Analysis Tool Logic Engine Z3
Tool Encodings Methodology Fixed-Point SLAyer Sep. Logic Abstract Interpretation Logic Programming GateKeeper Simulation Relation Predicate Based MC Summaries SAGE BDD MC Abstraction Refinement Datalog Havoc Houdini Interpolating MC
The Z Tool • Ships with Z3 • Online demo • BDD tablesample in distribution • Mostly developed by Krystof Hoder
Why fixed-points Variant for Connoisseurs: Recall the basic sausage* rule: In a nutshell: Aim of Satisfiability Modulo Fixed-points and Theories. Is valid? Is satisfiable? *“sausage” terminology by AndreyRybalchenko
Portfolio approach to fix-points • Efficient Datalog Engine • Finite Tables • Symbolic Tables • ComposableAbstract Relations: • Use abstract interpretation domains. • Use SMT as a domain. • Reduced product operators for sharing • Efficient Algorithms from Symbolic MC Modulo Theories • I will give a taste of this later. Is satisfiable? BDD packages Abstract Domains Interpolation Tools
Core Engine Compilation Restarts Relational Algebra Abstract Machine
Core Engine Plugin architecture: New domains added using plugins implementing Relational Algebra operations. Restarts
Relation representation x 0 1 y z 0 1 Bounds Intervals + = + Pentagons =
Relation representation x 0 1 y z 0 1 Bounds Intervals • Product: Table x Table • Indexed Relation: Table x Relation • Reduced Product: Relation x Relation
Preview – Generalized PDR Is valid? Is satisfiable? • PDR: Property Directed ReachabilityA new Algorithm For Symbolic Model Checking of Hardware • by Aaron Bradley. • In • Lift it to proceduresmultiple operators, non-linear • Lift beyond propositional logic Theories, non-ground
Generalizations • PDR works for linearTransformers • Generalize to non-linear • PDR works with a singleTransformer • Work with multipletransformers. • A Solver for Datalog/Boolean Programs • PDR is for propositionallogic • Search Modulo Theories (with McMillan’s FociZ3 and other methods)