CSE507 Computer-Aided Reasoning for Software Finite Model Finding - - PowerPoint PPT Presentation

▶
cse507
SMART_READER_LITE
LIVE PREVIEW

CSE507 Computer-Aided Reasoning for Software Finite Model Finding - - PowerPoint PPT Presentation

Nov 12, 2022 288 likes •988 views

CSE507 Computer-Aided Reasoning for Software Finite Model Finding courses.cs.washington.edu/courses/cse507/14au/ Emina Torlak emina@cs.washington.edu Today 2 Today Last lecture The DPPL(T) framework for deciding quantifier-free SMT

slide-1
SLIDE 1

CSE507

Emina Torlak

emina@cs.washington.edu

courses.cs.washington.edu/courses/cse507/14au/

Computer-Aided Reasoning for Software

Finite Model Finding

slide-2
SLIDE 2

Today

2
slide-3
SLIDE 3

Today

2

Last lecture

  • The DPPL(T) framework for deciding quantifier-free SMT formulas
slide-4
SLIDE 4

Today

2

Last lecture

  • The DPPL(T) framework for deciding quantifier-free SMT formulas

Today

  • Finite model finding for quantified FOL and beyond
slide-5
SLIDE 5

Today

2

Last lecture

  • The DPPL(T) framework for deciding quantifier-free SMT formulas

Today

  • Finite model finding for quantified FOL and beyond

Announcements

  • Due date for Homework 2 moved to October 30 at 11pm
slide-6
SLIDE 6

a finite universe U finite model finder

Finite model finding

3

⋀ ¬ ∨ ∀ ∃ x f(a) p(y, z) a formula F in FOL

  • a model ⟨U, I⟩ ⊨ F

if one exists

  • a minimal unsat

core (or “unsat”)

  • therwise
slide-7
SLIDE 7

a finite universe U finite model finder

Finite model finding

3

⋀ ¬ ∨ ∀ ∃ x f(a) p(y, z) a formula F in FOL

  • a model ⟨U, I⟩ ⊨ F

if one exists

  • a minimal unsat

core (or “unsat”)

  • therwise
  • custom search

(SEM, CVC4)

  • reduction to SAT

(Paradox, Kodkod)

slide-8
SLIDE 8

Some applications of finite model finding

4

Proving theorems in finite algebras (Finder, SEM, MACE)

slide-9
SLIDE 9

Some applications of finite model finding

4

Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML)

slide-10
SLIDE 10

Some applications of finite model finding

4

Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle)

slide-11
SLIDE 11

Some applications of finite model finding

4

Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle)

MemSAT

slide-12
SLIDE 12

Some applications of finite model finding

4

Proving theorems in finite algebras (Finder, SEM, MACE) Checking lightweight formal specifications (Alloy, ProB, ExUML) Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) Declarative configuration and execution (ConfigAssure, Margrave, Squander, PBnJ)

MemSAT

SQUANDER

slide-13
SLIDE 13

Some applications of finite model finding

4

Checking lightweight formal specifications (Alloy, ProB, ExUML) Bounded verification of code and memory models (Forge, Miniatur, TACO, MemSAT) Counterexamples to tentative theorems in interactive proof assistants (Nitpick/Isabelle) Declarative configuration and execution (ConfigAssure, Margrave, Squander, PBnJ) KODKOD

slide-14
SLIDE 14

Overview of Kodkod

5

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator symmetry breaker SAT solver core extractor finite universe model minimal unsat core

slide-15
SLIDE 15

Overview of Kodkod

5

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator finite universe

slide-16
SLIDE 16

Relational logic by example

6

a minimalistic formal specification

  • f a filesystem
slide-17
SLIDE 17

Relational logic by example

6

Root ⊆ Dir

  • The root of a filesystem

hierarchy is a directory.

slide-18
SLIDE 18

Relational logic by example

6

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir)

  • The root of a filesystem

hierarchy is a directory.

  • Directories may contain

files or directories.

slide-19
SLIDE 19

Relational logic by example

6

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents

  • The root of a filesystem

hierarchy is a directory.

  • Directories may contain

files or directories.

  • All directories and files are

reachable from the root.

slide-20
SLIDE 20

Relational logic by example

6

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents)

  • The root of a filesystem

hierarchy is a directory.

  • Directories may contain

files or directories.

  • All directories and files are

reachable from the root.

  • The contents relation is

acyclic.

slide-21
SLIDE 21

Bounded relational logic by example

7

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

Finite universe of interpretation.

slide-22
SLIDE 22

Bounded relational logic by example

7

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

Finite universe of interpretation. Bounds for each relation:

  • Tuples it must contain

(partial model).

  • Tuples it may contain (type).
slide-23
SLIDE 23

Bounded relational logic by example

7

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir

slide-24
SLIDE 24

Translation by example

8

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

slide-25
SLIDE 25

Translation by example

8

Encode

  • relational constants as boolean

matrices

  • relational expressions as

matrix operations

  • formulas as constraints over

matrix entries

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

slide-26
SLIDE 26

Relational constants as boolean matrices

9
slide-27
SLIDE 27

Relational constants as boolean matrices

9

1 {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} R D1 D2 F1 F2

slide-28
SLIDE 28

Relational constants as boolean matrices

9

d0 d1 d2 1 {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} R D1 D2 F1 F2

slide-29
SLIDE 29

Relational constants as boolean matrices

9

f0 f1 d0 d1 d2 1 {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} R D1 D2 F1 F2

slide-30
SLIDE 30

Relational constants as boolean matrices

9

f0 f1 d0 d1 d2 1 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 c10 c11 c12 c13 c14 {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 D2 F1 F2 R D1 D2 F1 F2

slide-31
SLIDE 31

Relational expressions as matrix operations

10

f0 f1 d0 d1 d2 d0 d1 d2 f0 f1 File Dir File ∪ Dir ∨ = Dir d0 d1 d2 d0 d1 d2 f0 f1 File ∪ Dir × = d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1 Dir × (File ∪ Dir)

slide-32
SLIDE 32

d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1

Formulas as constraints over matrix entries

11

c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 c10 c11 c12 c13 c14 contents ⇒ = contents ⊆ Dir × (File ∪ Dir) Dir × (File ∪ Dir) (c0 ⇒ d0∧d0) ∧ (c1 ⇒ d0∧d1) ∧ (c2 ⇒ d0∧d2) ∧ (c3 ⇒ d0∧f0) ∧ (c4 ⇒ d0∧f1) ∧ (c5 ⇒ d1∧d0) ∧ … (c14 ⇒ d2∧f1)

slide-33
SLIDE 33

Dealing with sparseness and redundancy

12

Dir × (File ∪ Dir) d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1

slide-34
SLIDE 34

Dealing with sparseness and redundancy

12

Dir × (File ∪ Dir)

Empty regions in matrices (exponential w.r.t. relation arity).

d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1

slide-35
SLIDE 35

Dealing with sparseness and redundancy

12

Dir × (File ∪ Dir)

Empty regions in matrices (exponential w.r.t. relation arity). Different circuits for the same formula.

d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1

slide-36
SLIDE 36

Dealing with sparseness and redundancy

12

Dir × (File ∪ Dir) d0∧d0 d0∧d1 d0∧d2 d0∧f0 d0∧f1 d1∧d0 d1∧d1 d1∧d2 d1∧f0 d1∧f1 d2∧d0 d2∧d1 d2∧d2 d2∧f0 d2∧f1

Sparse matrices represented as interval trees. Compact Boolean Circuits (CBCs).

slide-37
SLIDE 37

Overview of Kodkod

13

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator finite universe

slide-38
SLIDE 38

Overview of Kodkod

13

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator symmetry breaker finite universe

slide-39
SLIDE 39

Symmetry by example

14

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir

slide-40
SLIDE 40

Symmetry by example

14

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir

slide-41
SLIDE 41

Symmetry by example

14

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir D2

slide-42
SLIDE 42

Symmetry by example

14

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R F1 F2 contents Root File Dir D2

slide-43
SLIDE 43

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

Symmetries between models

15

R D1 F1 F2 R D1 F2 F1 R D2 F1 F2 R D2 F2 F1

slide-44
SLIDE 44

Symmetries between non-models

16

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 R D1 F2 F1 R D2 F1 F2 R D2 F2 F1

slide-45
SLIDE 45

Symmetries induce equivalence classes

17

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

R D1 F1 F2 R D1 F2 F1 R D2 F1 F2 R D2 F2 F1 R D1 F1 F2 R D1 F2 F1 R D2 F1 F2 R D2 F2 F1

✓ ✗

slide-46
SLIDE 46

Symmetries induce equivalence classes

17

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

R D1 F1 F2 R D1 F1 F2

✓ ✗

sufficient to test

  • ne binding per

equivalence class

slide-47
SLIDE 47

Symmetry detection

18

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 R D1 F2 F1 R D2 F1 F2 R D2 F2 F1

Assignment symmetries = bound symmetries

slide-48
SLIDE 48

Detecting symmetries is hard …

19

Assignment symmetries = bound symmetries Graph automorphism detection

〈 , 〉 〈 , 〉 〈 , 〉 〈 , 〉 〈 , 〉 〈 , 〉 { }
slide-49
SLIDE 49

But only a few symmetries needed in practice

20

Greedy algorithm that partitions the universe into equivalence classes Graph automorphism detection

✗ ✓

slide-50
SLIDE 50

Base partitioning: practical symmetry detection

21

{ R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

The coarsest partitioning of the universe such that all non-empty bounds are expressible as unions of products of partitions. R D1 D2 F1 F2

slide-51
SLIDE 51

Finding the base partitioning

22

R D1 D2 F1 F2 start with a single partition and refine greedily for each non-empty lower and upper bound

slide-52
SLIDE 52

Finding base partitioning

23

R D1 D2 F1 F2

slide-53
SLIDE 53

Finding base partitioning

23

R D1 D2 F1 F2

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩}

slide-54
SLIDE 54

Finding base partitioning

23

D1 D2 F1 F2 R

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩}

slide-55
SLIDE 55

Finding base partitioning

23

D1 D2 F1 F2 R

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩}

slide-56
SLIDE 56

Finding base partitioning

23

R

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩}

D1 D2 F1 F2

slide-57
SLIDE 57

Finding base partitioning

23

R

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩}

D1 D2 F1 F2

slide-58
SLIDE 58

Finding base partitioning

23

R

{⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

D1 D2 F1 F2

slide-59
SLIDE 59

Overview of Kodkod

24

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator symmetry breaker finite universe

slide-60
SLIDE 60

Overview of Kodkod

24

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator symmetry breaker SAT solver finite universe model

slide-61
SLIDE 61

Overview of Kodkod

24

formula in relational logic (FOL, relations, bit vectors, transitive closure) bounds (partial model and types) translator symmetry breaker SAT solver core extractor finite universe model minimal unsat core

slide-62
SLIDE 62

A bug in the tiny filesystem

25

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir

slide-63
SLIDE 63

A bug in the tiny filesystem

25

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2} R D1 F1 F2 contents Root File Dir

The spec allows multiple parents.

slide-64
SLIDE 64

Fixing the tiny filesystem

26

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) ∀ f: File | one contents.f ∀ d: Dir | one contents.d { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

slide-65
SLIDE 65

Fixing the tiny filesystem

26

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) ∀ f: File | one contents.f ∀ d: Dir | one contents.d { R, D1, D2, F1, F2 } {⟨R⟩} ⊆ Root ⊆ {⟨R⟩} {} ⊆ Dir ⊆ {⟨R⟩, ⟨D1⟩, ⟨D2⟩} {} ⊆ File ⊆ {⟨F1⟩, ⟨F2⟩} {} ⊆ contents ⊆ {R, D1, D2} × {R, D1, D2, F1, F2}

Minimal unsatisfiable core: an unsatisfiable subset of a formula that becomes satisfiable if any of its members are removed.

slide-66
SLIDE 66

Resolution-based core extraction

27

Root ⊆ Dir contents ⊆ Dir × (File ∪ Dir) (File ∪ Dir) ⊆ Root.*contents ∀ d: Dir | ¬ (d ⊆ d.^contents) ∀ f: File | one contents.f ∀ d: Dir | one contents.d φ0 φ1 φ2 φ3 φ4 φ5

slide-67
SLIDE 67

High-level minimal cores from low-level proofs

28

φ0 φ1 φ2 φ3 φ4 φ5

How to use the proof at the SAT level to find a minimal core at the specification level when

  • SAT proof is not minimal
  • minimal SAT core may map to

a large specification core?

slide-68
SLIDE 68

Recycling core extraction

29

φ0 φ1 φ2 φ3 φ4 φ5

Key idea: minimize core by removing constraints at the specification level but re-use valid resolvents from the previous step so that the solver doesn’t have to re-derive them.

slide-69
SLIDE 69

Summary

30

Today

  • Finite model finding for first-order logic with

quantifiers, relations, and transitive closures Next lecture

  • Reasoning about program correctness