Reasoning in Complex Theories and Applications Viorica - - PowerPoint PPT Presentation
Reasoning in Complex Theories and Applications Viorica Sofronie-Stokkermans Max-Planck-Institut f ur Informatik Saarbr ucken, Germany Tutorial KI 2008, September 23, 2008 1 Motivation Long-term goal of research in computer science -
1
2
Theories − numbers − polynomials − functions over numeric domains − algebras Tasks − construct proofs − check proofs MATHEMATICS
Example: Lipschitz functions R ∪ ( Lf
c,λ1) ∪ (
Lg
c,λ2) |
= ( Lf +g
c,(λ1+λ2))
( Lf
c,λ1)
A x |f (x) − f (c)| ≤ λ1 · |x − c| ( Lg
c,λ2)
A x |g(x) − g(c)| ≤ λ2 · |x − c| ( Lf+g
c,(λ1+λ2))
A x |f (x)+g(x)−f (c)−g(c)|≤(λ1+λ2) · |x−c| Similar:
their domain of definition, ...
3
Theories − numbers − polynomials − functions over numeric domains − algebras VERIFICATION MATHEMATICS Tasks Theories numeric domains − functions over − data types − numbers − safety / lifeness
− reactive and hybrid systems
− construct proofs − check proofs Tasks
− programs
− correctness − termination
Infinite state systems (software, real time, hybrid)
→ need symbolic methods Solution: - Build ’formal model’ of the system;
4
Theories − numbers − polynomials − functions over numeric domains − algebras VERIFICATION MATHEMATICS Tasks Theories numeric domains − functions over − data types − numbers − safety / lifeness
− reactive and hybrid systems
− construct proofs − check proofs Tasks
− programs
− correctness − termination
Example: Does BubbleSort return a sorted array? int [] BubbleSort(int[] a) { int i, j, t; for (i := |a| − 1; i > 0; i := i − 1) { for (j := 0; j < i; j := j + 1) { if (a[j] > a[j + 1]){t := a[j]; a[j] := a[j + 1]; a[j + 1] := t}; }} return a}
5
Theories − numbers − polynomials − functions over numeric domains − algebras VERIFICATION MATHEMATICS Tasks Theories numeric domains − functions over − data types − numbers − safety / lifeness
− reactive and hybrid systems
− construct proofs − check proofs Tasks
− programs
− correctness − termination
Example: Does BubbleSort return a sorted array? int [] BubbleSort(int[] a) { int i, j, t; for (i := |a| − 1; i > 0; i := i − 1) { for (j := 0; j < i; j := j + 1) { if (a[j] > a[j + 1]){t := a[j]; a[j] := a[j + 1]; a[j + 1] := t}; }} return a} Generate verification conditions and prove that they are valid Predicates:
A i, j(l≤i≤j≤u→a[i]≤a[j])
A i, j(l1≤i≤u1≤l2≤j≤u2→a[i]≤a[j])
6
Theories − numbers − polynomials − functions over numeric domains − algebras VERIFICATION MATHEMATICS Tasks Theories numeric domains − functions over − data types − numbers − safety / lifeness
− reactive and hybrid systems
− construct proofs − check proofs Tasks
− programs
− correctness − termination
Example: Controllers (safety)
valve (0/1) Lalarm Loverflow L
inflow
L < L
alarm alarmL := in(out(L)) L := in(L) L > L
valve := 0 valve := 1
RBC braking + reaction distance
in, out : R → R pos, pos′ : Z → R
7
Theories − numbers − polynomials − functions over numeric domains − algebras − test consistency Tasks − answer queries − limit search Tasks − construct proofs − check proofs VERIFICATION DATA BASES MATHEMATICS Tasks − safety / lifeness − correctness − termination − programs − reactive/hybrid systems Theories numeric domains − functions over − data types − numbers Theories − First−order logic − Datalog − ... − numbers − functions Complex theories
8
Theories − numbers − polynomials − functions over numeric domains − algebras − test consistency Tasks − answer queries − limit search Tasks − construct proofs − check proofs VERIFICATION DATA BASES MATHEMATICS Tasks − safety / lifeness − correctness − termination − programs − reactive/hybrid systems Theories numeric domains − functions over − data types − numbers Theories − First−order logic − Datalog − ... − numbers − functions Complex theories
9
Theories − numbers − polynomials − functions over numeric domains − algebras − test consistency Tasks − answer queries − limit search Tasks − construct proofs − check proofs VERIFICATION DATA BASES MATHEMATICS Tasks − safety / lifeness − correctness − termination − programs − reactive/hybrid systems Theories numeric domains − functions over − data types − numbers Theories − First−order logic − Datalog − ... − numbers − functions Complex theories
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
Example 1: Σ1 = ({f /2, g/1, c/0}, {P/2}) A1 = ({a, b}, {fA, gA, cA}, {PA}) fA : A2 → A fA(a, a) = fA(a, b) = a, fA(b, a) = fA(b, b) = b, gA : A → A gA(a) = b, gA(b) = a, cA = a ∈ A PA ⊆ A2 PA = {(b, a)}. Valuation in A1. β : X → {a, b} with β(x) = a, β(y) = b (A1, β)(f (g(x), y)) = fA(gA(β(x)), β(y)) = fA(gA(a), b) = b
28
Example 1: Σ1 = ({f /2, g/1, c/0}, {P/2}) A1 = ({a, b}, {fA, gA, cA}, {PA}) fA : A2 → A fA(a, a) = fA(a, b) = a, fA(b, a) = fA(b, b) = b, gA : A → A gA(a) = b, gA(b) = a, cA = a ∈ A PA ⊆ A2 PA = {(b, a)}. Valuation in A1. β : X → {a, b} with β(x) = a, β(y) = b (A1, β)(f (g(x), y)) = fA(gA(β(x)), β(y)) = fA(gA(a), b) = b Example 2: Σ2 = ({+/2, s/1, 0/0}, {≤ /2}) A2 = (Z, {+, s, 0}, {≤}) Valuation in A2. β : X → Z with β(x) = 4, β(y) = 5 (A2, β)(+(s(x), y)) = s(β(x)) + β(y) = s(4) + 5 = 5 + 5 = 10
29
Example 1: A1 = ({a, b}, {fA, gA, cA}, {PA}) PA ⊆ A2 PA = {(b, a)}; fA : A2 → A fA(a, a) = fA(a, b) = a, fA(b, a) = fA(b, b) = b, gA : A → A gA(a) = b, gA(b) = a, cA = a ∈ A β : X → {a, b} with β(x) = a, β(y) = b (A1, β)( A xP(f (g(x), x), c)) = min{(A1, β[x→d])P(f (g(x), x), c) | d∈{a, b}} = min{PA(fA(gA(a), a), cA), PA(fA(gA(b), b), cA)} = min{PA(fA(b, a), a), PA(fA(a, b), a)} = min(1, 0) = 0 (A1, β)( E xP(f (g(x), x), c)) = max{(A1, β[x→d])P(f (g(x), x), c) | d∈{a, b}} = max{PA(fA(gA(a), a), cA), PA(fA(gA(b), b), cA)} = max{PA(fA(b, a), a), PA(fA(a, b), a)} = max(1, 0) = 1
30
31
32
F ⊆ Th(Mod(F)) (typically strict) M ⊆ Mod(Th(M)) (typically strict)
33
34
35
36
Axiomatized by: A x ¬(x + 1 ≈ 0) (zero) A x A y (x + 1 ≈ y + 1 → x ≈ y (successor) F[0] ∧ ( A x (F[x] → F[x + 1]) → A xF[x]) (induction) A x (x + 0 ≈ x) (plus zero) A x, y (x + (y + 1) ≈ (x + y) + 1) (plus successor) A x, y (x ∗ 0 ≈ 0) (times zero) A x, y (x ∗ (y + 1) ≈ x ∗ y + x) (times successor)
37
38
39
40
41
Horn
,cl
42
Horn
,cl
,cl decidable iff T -validity for Th
,Horn decidable iff T -validity for Th
,cl decidable.
43
n
i=1
m
j=1
n
i=1
i
j
i then LI(Q) |
n
i=1
k for some k
44
45
i | L′ i literals}
46
i | L′ i literals}
47
48
49
Systems implementing such specialized satisfiability problems: Yices, Barcelogic Tools, CVC lite, haRVey, Math-SAT,... are called (S)atisfiability (M)odulo (T)heory solvers.
50
51
52
53
54
55
56
57
58
59
60
61
set K of Horn clauses
set F of ground atoms
ground atom G
62
set K of Horn clauses
set F of ground atoms
ground atom G
Ex: S(a) S(x) → R(x) R(a) E(a, c) R(x) ∧ E(x, y) → R(y) R(c) E(c, d) R(x) ∧ E(x, y) → R(y) R(d)
63
set K of Horn clauses
set F of ground atoms
ground atom G
Ex: S(a) S(x) → R(x) R(a) E(a, c) R(x) ∧ E(x, y) → R(y) R(c) E(c, d) R(x) ∧ E(x, y) → R(y) R(d)
64
A p (p = null ∧ p.next = null → p.next.prev = p) A p (p = null ∧ p.prev = null → p.prev.next = p) ∧ c=null ∧ c.next=null ∧ d=null ∧ d.next=null ∧ c.next=d.next ∧ c = d | = ⊥
65
(c=null ∧ c.next=null →c.next.prev=c) (c.next=null ∧ c.next.next=null →c.next.next.prev=c.next) (d=null ∧ d.next=null→d.next.prev=d) (d.next=null ∧ d.next.next=null→d.next.next.prev=d.next) ∧ c=null ∧ c.next=null ∧ d=null ∧ d.next=null ∧ c.next=d.next ∧ c = d | = ⊥
66
67
68
69
70
All terms Subterms of C
Subterms of C
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
c1
90
c1
c2
91
c1
c3
c4
c2
c5
92
c1
c3
c4
c2
c5
93
c1
c3
c4
c2
c5
94
c1
c3
c4
c2
c5
95
c1
c3
c4
c2
c5
96
c1
c3
c4
c2
c5
97
c1
c3
c4
c2
c5
98
c1
c3
c4
c2
c5
99
100
101
102
103
104
105
106
i xi ≈ yi implies φ |
107
i xi ≈ yi implies φ |
108
109
110
111
112
113
^
R(c,d)
c ≈ d ∧ ^
¬R(c,d)
c ≈ d
Idea of proof: Let Ai ∈ Mod(Ti) s.t. Ai| =φi∧ar(C, R). Then cA1=dA1 iff cA2=dA2. Let i : {cA1 | c ∈ C} → {cA2 | c ∈ C}, i(cA1) = cA2 well-defined; isomorphism. Stable infinity: can assume w.l.o.g. that A1, A2 have the same cardinality Let h : A1 → A2 bijection s.t. h(cA1 ) = cA2 Use h to transfer the Σ1-structure on A2.
114
115
[Tinelli,Zarba’03] One theory “shiny” (for each satisf. constraint we can compute a finite k s.t. the theory has models of every cardinality λ ≥ k) [Ghilardi’04] Model theoretical conditions. Presented in what follows.
116
117
118
The simplest way of avoiding non-termination in Step 2 is to make the following assumptions (cf. [Ghilardi’04]): A1: T1 and T2 contain a Σ0-theory T0 which is locally finite, i.e. has the property that for any finite set X of variables only finitely many Σ0-terms with variables in X (up to T0-equivalence) exist. A2: Representative terms for equivalence classes computable. Implementation: Propagation can still be implemented by – guessing (guess maximal set of representative Σ0-literals over shared constants), or – backtracking (make case-split on disjunctions of Σ0-literals over the shared constants which are not entailed by the purified formulae).
119
120
121
122
0 of the theory T0
0 .
0 , for i = 1, 2.
123
0 of the theory T0
0 .
0 , for i = 1, 2.
into a model of T ∗
allows QE (equiv: M ∈ Mod(T0) ⇒ M ∪ ∆(M) complete)
124
A1: T1 and T2 contain a locally finite Σ0-theory T0 (for any finite set X of variables
A2: Representative terms for equivalence classes computable. A3: T0 is universal and has a model completion T ∗
0 .
A4: Every model of Ti embeds into a model of Ti ∪ T ∗
0 , for i = 1, 2.
125
A1: T1 and T2 contain a locally finite Σ0-theory T0 (for any finite set X of variables
A2: Representative terms for equivalence classes computable. A3: T0 is universal and has a model completion T ∗
0 .
A4: Every model of Ti embeds into a model of Ti ∪ T ∗
0 , for i = 1, 2.
126
A1: T1 and T2 contain a locally finite Σ0-theory T0 (for any finite set X of variables
A2: Representative terms for equivalence classes computable. A3: T0 is universal and has a model completion T ∗
0 .
A4: Every model of Ti embeds into a model of Ti ∪ T ∗
0 , for i = 1, 2.
127
A1: T1 and T2 contain a locally finite Σ0-theory T0 (for any finite set X of variables
A2: Representative terms for equivalence classes computable. A3: T0 is universal and has a model completion T ∗
0 .
A4: Every model of Ti embeds into a model of Ti ∪ T ∗
0 , for i = 1, 2.
Proof: Information exchange → saturation E Ti -models Ai sharing common structure A. A4: A ֒ → Ai ֒ → A∗
i ∈ Mod(Ti ∪ T ∗ 0 )
A3: T0 is universal → A ∈ Mod(T0) T ∗
0 ∪ ∆(A) is a complete theory
Robinson’s Joint consistency theorem: ∆e(A1) ∪ ∆e(A2) consistent
1
2
128
0 of the theory of Boolean algebras is
129
A1 and A2: Obvious. A3 T0: universal; model completion: theory of dense total orders A4 T ∗ ⊆ T1; every model of T2 embeds into dense partial order with monotone f.
130
131
G
132
133
G
134
G
135
G
136
G
137
G
138
139
[VS,Ihlemann’07]
140
[VS,Ihlemann’07]
[VS’05,’06]
[VS, Ihlemann’07]
[VS’08]
[Ihlemann,Jacobs,VS’08]
141
142
143
144
145
f ), (Lλ2 g )
f )
g )
R∪Lλ1
f
∪Lλ2
g
| = A x, y(|f (x) + g(x) − (f (y) + g(y))|≤λ|x − y|) | {z }
Lλ f +g
;
146
f ∪Lλ2 g
f ∪Lλ2 g
G
f ∪Lλ2 g )[G] ∧ |f (c) + g(c) − (f (d) + g(d))| ≤ λ|c − d|
G
Def G ′ f (c) = c1 f (d) = d1 Lλ1
f
[G]0 : |c1 − d1| ≤ λ1|c − d| g(c) = c2 g(d) = d2 Lλ1
f
[G]0 : |c2 − d2| ≤ λ2|c − d| G : |c1 + d1 − c2 − d2| ≤ λ|c − d|
147
f ∪Lλ2 g
Def G ′ f (c) = c1 f (d) = d1 Lλ1
f
[G]0 : |c1 − d1| ≤ λ1|c − d| g(c) = c2 g(d) = d2 Lλ2
g [G]0 : |c2 − d2| ≤ λ2|c − d|
G0 : |c1 + d1 − c2 − d2| ≤ λ|c − d|
f [G]0 ∧ Lλ2 g [G]0 ∧ G0) is false
(λ+λ1−λ2<0 ∧ λ1−λ2<0) ∨ (λ+λ1−λ2<0 ∧ λ1−λ2≤0)∨ λ−λ2 < 0 ∨ λ−λ1 < 0 ∨ (λ−λ1−λ2 < 0 ∧ λ1+λ2≥0)) is false
148
f ∪Lλ2 g
Def G ′ f (c) = c1 f (d) = d1 Lλ1
f
[G]0 : |c1 − d1| ≤ λ1|c − d| g(c) = c2 g(d) = d2 Lλ2
g [G]0 : |c2 − d2| ≤ λ2|c − d|
G0 : |c1 + d1 − c2 − d2| ≤ λ|c − d|
f [G]0 ∧ Lλ2 g [G]0 ∧ G0) is false
(λ+λ1−λ2<0 ∧ λ1−λ2<0) ∨ (λ+λ1−λ2<0 ∧ λ1−λ2≤0)∨ λ−λ2 < 0 ∨ λ−λ1 < 0 ∨ (λ−λ1−λ2 < 0 ∧ λ1+λ2≥0)) is false
f
g
f +g
149
Automated reasoning − full theory − abstraction of theory Interpolation − use interpolants for refining abstraction Invariant checking/ BMC Model Checking Abstraction/ Refinement System Specifications Complex theories
150
151
152
Update(pos, pos′) :
i (i = 0 → pos(i) + ∆t∗min ≤ pos′(i) ≤ pos(i) + ∆t∗max)
i (0 < i < n ∧ pos(i − 1) > 0 ∧ pos(i − 1) − pos(i) ≥ lalarm → pos(i) + ∆t ∗ min ≤ pos′(i) ≤ pos(i) + ∆t∗max) ...
153
154
G
155
Initially list is sorted: p.next = null → p.prio ≥ p.next.prio c.prio = x, c.next = null for all p = c do if p.prio ≤ x then if First(p) then c.next′ = p, First′(c), ¬First′(p) endif; p.next′ = p.next p.prio > x then case p.next = null then p.next′ := c, c.next′ = null p.next = null ∧ p.next.prio > x then p.next′ = p.next p.next = null ∧ p.next.prio ≤ x then p.next′ = c, c.next′ = p.next Verification task: After insertion list remains sorted
156
Initially list is sorted: p.next = null → p.prio ≥ p.next.prio c.prio = x, c.next = null for all p = c do if p.prio ≤ x then if First(p) then c.next′ = p, First′(c), ¬First′(p) endif; p.next′ = p.next p.prio > x then case p.next = null then p.next′ := c, c.next′ = null p.next = null ∧ p.next.prio > x then p.next′ = p.next p.next = null ∧ p.next.prio ≤ x then p.next′ = c, c.next′ = p.next Verification task: After insertion list remains sorted
157
Initially list is sorted: p.next = null → p.prio ≥ p.next.prio c.prio = x, c.next = null for all p = c do if p.prio ≤ x then if First(p) then c.next′ = p, First′(c), ¬First′(p) endif; p.next′ = p.next p.prio > x then case p.next = null then p.next′ := c, c.next′ = null p.next = null ∧ p.next.prio > x then p.next′ = p.next p.next = null ∧ p.next.prio ≤ x then p.next′ = c, c.next′ = p.next Verification task: After insertion list remains sorted
158
Initially list is sorted: p.next = null → p.prio ≥ p.next.prio c.prio = x, c.next = null for all p = c do if p.prio ≤ x then if First(p) then c.next′ = p, First′(c), ¬First′(p) endif; p.next′ = p.next p.prio > x then case p.next = null then p.next′ := c, c.next′ = null p.next = null ∧ p.next.prio > x then p.next′ = p.next p.next = null ∧ p.next.prio ≤ x then p.next′ = c, c.next′ = p.next Verification task: After insertion list remains sorted
159
Initially list is sorted: A p(p.next = null → p.prio ≥ p.next.prio) A p(p=null ∧ p=c ∧ prio(p)≤x ∧ First(p) → next′(c)=p ∧ First′(c)) A p(p=null ∧ p=c ∧ prio(p)≤x ∧ First(p) → next′(p)=next(p) ∧ ¬First′(p)) A p(p=null ∧ p=c ∧ prio(p)≤x ∧ ¬First(p) → next′(p)=next(p)) A p(p=null ∧ p=c ∧ prio(p)>x ∧ next(p)=null → next′(p)=c A p(p=null ∧ p=c ∧ prio(p)>x ∧ next(p)=null → next′(c)=null) A p(p=null ∧ p=c ∧ prio(p)>x ∧ next(p)=null ∧ prio(next(p))>x → next′(p)=next(p)) A p(p=null ∧ p=c ∧ prio(p)>x ∧ next(p)=null ∧ prio(next(p))≤x → next′(p)=c A p(p=null ∧ p=c ∧ prio(p)>x ∧ next(p)=null ∧ prio(next(p))≤x → next′(c)=next(p)) To check: Sorted(next, prio) ∧ Update(next, next′) ∧ p0.next′=null∧p0.prio≥p0.next′.prio | =⊥ can be proved to be local
160
G
161
G
G′
162
G
163
Automated reasoning − full theory − abstraction of theory Interpolation − use interpolants for refining abstraction Invariant checking/ BMC Model Checking Abstraction/ Refinement System Specifications Complex theories
164
165
166