Speeding Up Quantifjed Bit-Vector SMT Solvers by Bit-Width - - PowerPoint PPT Presentation

▶

Sep 13, 2023 260 likes •628 views

Speeding Up Quantifjed Bit-Vector SMT Solvers by Bit-Width Reductions and Extensions Martin Jon , Jan Strejek Fondazione Bruno Kessler, Italy Faculty of Informatics, Masaryk University, Czech Republic In many software verifjcation

SLIDE 1

Speeding Up Quantifjed Bit-Vector SMT Solvers by Bit-Width Reductions and Extensions

Martin Jonáš, Jan Strejček

Fondazione Bruno Kessler, Italy Faculty of Informatics, Masaryk University, Czech Republic

SLIDE 2

Theory of Bit-Vectors

The theory of bit-vectors describes bounded integers (or vectors of bits of fjxed size) with: bitwise operations, arithmetic operations, signed and unsigned comparison. In many software verifjcation applications, quantifjers are necessary. For example in invariant generation, ranking function synthesis, cycle summarization, symbolic state equality test.

1 / 16

SLIDE 3

Theory of Bit-Vectors

The theory of bit-vectors describes bounded integers (or vectors of bits of fjxed size) with: bitwise operations, arithmetic operations, signed and unsigned comparison. In many software verifjcation applications, quantifjers are necessary. For example in invariant generation, ranking function synthesis, cycle summarization, symbolic state equality test.

1 / 16

SLIDE 4

Bit-with Reductions

In the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) x[32] and y[32] are variables of bit-width 32, 0[32] is a constant of bit-width 32. Reduction to 4 bits ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula.

2 / 16

SLIDE 5

Bit-with Reductions

In the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) x[32] and y[32] are variables of bit-width 32, 0[32] is a constant of bit-width 32. Reduction to 4 bits ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula.

2 / 16

SLIDE 6

Bit-with Reductions

In the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) x[32] and y[32] are variables of bit-width 32, 0[32] is a constant of bit-width 32. Reduction to 4 bits ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) Observation Performance of the solvers for quantifjed bit-vector formulas usually depends on the bit-widths used in the formula.

2 / 16

SLIDE 7

Bit-width Reductions and Satisfjability

Observation from our LPAR 2018 paper Vast majority of quantifjed bit-vectors does not change their satisfjability from very low bit-widths. Difgerent answer for some bit-width Total ≥ 1b ≥ 2b ≥ 4b ≥ 8b Count 4905 216 95 32 14 % 100 4.4 1.9 0.65 0.29 Challenges Can the safe bit-width be computed from the formula? Can the observation be leveraged to speed-up SMT solvers?

3 / 16

SLIDE 8

Bit-width Reductions and Satisfjability

Observation from our LPAR 2018 paper Vast majority of quantifjed bit-vectors does not change their satisfjability from very low bit-widths. Difgerent answer for some bit-width Total ≥ 1b ≥ 2b ≥ 4b ≥ 8b Count 4905 216 95 32 14 % 100 4.4 1.9 0.65 0.29 Challenges Can the safe bit-width be computed from the formula? Can the observation be leveraged to speed-up SMT solvers?

3 / 16

SLIDE 9

Outline of the Presentation

1 How to decide satisfjability using bit-width reductions 2 How to decide unsatisfjability using bit-width reductions 3 Our implementation in a single algorithm 4 Experimental evaluation

4 / 16

SLIDE 10

Symbolic Models of Quantifjed Formulas

Consider the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) It is satisfjable. What is its symbolic model? The Skolem function y[32] ↦ −x[32] because ∀x[32] (x[32] + (−x[32]) = 0[32]) is satisfjable.

5 / 16

SLIDE 11

Symbolic Models of Quantifjed Formulas

Consider the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) It is satisfjable. What is its symbolic model? The Skolem function y[32] ↦ −x[32] because ∀x[32] (x[32] + (−x[32]) = 0[32]) is satisfjable.

5 / 16

SLIDE 12

Symbolic Models of Quantifjed Formulas

Consider the formula ∀x[32]∃y[32] (x[32] + y[32] = 0[32]) It is satisfjable. What is its symbolic model? The Skolem function y[32] ↦ −x[32] because ∀x[32] (x[32] + (−x[32]) = 0[32]) is satisfjable.

5 / 16

SLIDE 13

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 14

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 15

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 16

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 17

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 18

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve extend substitute substitute solve

6 / 16

SLIDE 19

Deciding Satisfjability With Reductions

∀x[32]∃y[32] (x[32] + y[32] = 0[32]) ∀x[4]∃y[4] (x[4] + y[4] = 0[4]) SAT: y[4] ↦ −x[4] y[32] ↦ −x[32] ∀x[32] (x[32] + (−x[32]) = 0[32]) SAT reduce solve model-generating solver extend substitute substitute solve model-validating solver

6 / 16

SLIDE 20

Symbolic Countermodels of Quantifjed Formulas

Consider the formula ∀x[32] (x[32] + y[32] = 0[32]) It is unsatisfjable. What is its symbolic countermodel? The Herbrand function x[32] ↦ −y[32] + 1[32] because (−y[32] + 1[32]) + y[32] = 0[32] is unsatisfjable.

7 / 16

SLIDE 21

Symbolic Countermodels of Quantifjed Formulas

Consider the formula ∀x[32] (x[32] + y[32] = 0[32]) It is unsatisfjable. What is its symbolic countermodel? The Herbrand function x[32] ↦ −y[32] + 1[32] because (−y[32] + 1[32]) + y[32] = 0[32] is unsatisfjable.

7 / 16

SLIDE 22

Symbolic Countermodels of Quantifjed Formulas

Consider the formula ∀x[32] (x[32] + y[32] = 0[32]) It is unsatisfjable. What is its symbolic countermodel? The Herbrand function x[32] ↦ −y[32] + 1[32] because (−y[32] + 1[32]) + y[32] = 0[32] is unsatisfjable.

7 / 16

SLIDE 23

Overall Algorithm

1 Reduce the formula. 2 Try to solve its satisfjability. 3 Get a symbolic model/countermodel. 4 Extend the symbolic model/countermodel to the original bit-width. 5 Check whether it is a symbolic model/countermodel of the original formula. 6 If unsuccessful, increase the reduction bit-width and repeat.

8 / 16

SLIDE 24

Overall Algorithm – Practical Implementation

φ Model-generating solver Reduce to bw:=1 Reduce to larger bw Extend model and substitute Model-validating solver Model-generating solver Reduce to bw:=1 Quantify and negate φ Reduce to larger bw Extend model and substitute Model-validating solver SAT UNSAT sat unsat unsat sat sat unsat unsat sat

9 / 16

SLIDE 25

Overall Algorithm – Practical Implementation

φ Model-generating solver Reduce to bw:=1 Reduce to larger bw Extend model and substitute Model-validating solver Model-validating solver Model-generating solver Reduce to bw:=1 Quantify and negate φ Reduce to larger bw Extend model and substitute Model-validating solver SAT UNSAT sat unsat unsat sat sat unsat sat unsat unsat sat

9 / 16

SLIDE 26

Experimental Evaluation

Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B

10 / 16

SLIDE 27

Experimental Evaluation

Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B

10 / 16

SLIDE 28

Experimental Evaluation

Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B

10 / 16

SLIDE 29

Experimental Evaluation

Implementation reductions, extensions, and the solving algorithm in C++, using Z3 API Benchmarks 5741 quantifjed BV formulas from SMT-LIB 8 benchmark families Model-generating solver Boolector Model-validating solver Boolector CVC4 Q3B

10 / 16

SLIDE 30

Efgect of Reductions on Boolector

0.01 0.1 1 10 100 T/O 0.01 0.1 1 10 100 T/O

btor time (s) btor−r−no time (s) Family

2017−Preiner−keymaera 2017−Preiner−psyco 2017−Preiner−scholl−smt08 2017−Preiner−tptp 2017−Preiner−ua 20170501−Heizmann−ua 2018−Preiner−cav18 wintersteiger

Result

sat TIMEOUT (timeout) unsat

11 / 16

SLIDE 31

Efgect of Reductions on Boolector

0.01 0.1 1 10 100 T/O 0.01 0.1 1 10 100 T/O

btor time (s) btor−r time (s) Family

2017−Preiner−keymaera 2017−Preiner−psyco 2017−Preiner−scholl−smt08 2017−Preiner−tptp 2017−Preiner−ua 20170501−Heizmann−ua 2018−Preiner−cav18 wintersteiger

Result

sat TIMEOUT (timeout) unsat

12 / 16

SLIDE 32

Efgect of Reductions on Boolector

Reducing solver solved 449 formulas faster than Boolector itself. Used bit-widths for these formulas: Reduced bit-width 1 2 4 8 16 Count 185 119 122 17 6

13 / 16

SLIDE 33

Efgect on CVC4 and Q3B

CVC4

0.01 0.1 1 10 100 T/O 0.01 0.1 1 10 100 T/O

btor|cvc4 time (s) btor|cvc4−r time (s)

Q3B

0.01 0.1 1 10 100 T/O 0.01 0.1 1 10 100 T/O

btor|q3b time (s) btor|q3b−r time (s) Family

2017−Preiner−keymaera 2017−Preiner−psyco 2017−Preiner−scholl−smt08 2017−Preiner−tptp 2017−Preiner−ua 20170501−Heizmann−ua 2018−Preiner−cav18 wintersteiger

Result

sat TIMEOUT (timeout) unsat

14 / 16

SLIDE 34

Newly Solved Formulas

With reductions, all the solvers were able to solve some previously unsolved formulas: Boolector – 22 formulas CVC4 – 4 formulas Q3B – 7 formulas

15 / 16

SLIDE 35

Conclusions

We have developed a technique that solves satisfjability of formulas with reduced bit-widths, extends the models/countermodels to the original bit-width, verifjes the extended models/countermodels. We have shown that this technique can improve performance of state-of-the-art SMT solvers, allows solving previously unsolved formulas. Thank you for your attention.

16 / 16

SLIDE 36

Conclusions

We have developed a technique that solves satisfjability of formulas with reduced bit-widths, extends the models/countermodels to the original bit-width, verifjes the extended models/countermodels. We have shown that this technique can improve performance of state-of-the-art SMT solvers, allows solving previously unsolved formulas. Thank you for your attention.

16 / 16