Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in
Toggle navigation
Menu
Open sidebar
Martin Jonáš
DTEDI
Commits
cc7d22bb
Commit
cc7d22bb
authored
Sep 05, 2016
by
Martin Jonas
Browse files
Small changes
parent
e2016e8c
Changes
5
Hide whitespace changes
Inline
Side-by-side
Bibliography.bib
View file @
cc7d22bb
...
...
@@ -956,7 +956,8 @@ year = {2005},
of Systems - 22nd International Conference, {TACAS}
2016, Held as Part of the ETAPS 2016, Eindhoven, The
Netherlands, April 2-8, 2016, Proceedings}
,
pages
=
{946--949}
pages
=
{946--949}
,
year
=
{2016}
}
@inproceedings
{
JS16
,
...
...
@@ -1337,4 +1338,14 @@ pages={358--372},
series
=
{LNCS}
,
volume
=
{8044}
,
publisher
=
{Springer}
}
\ No newline at end of file
}
@inproceedings
{
Lei10
,
author
=
{K. Rustan M. Leino}
,
title
=
{Dafny: An Automatic Program Verifier for Functional Correctness}
,
booktitle
=
{Logic for Programming, Artificial Intelligence, and Reasoning - 16th
International Conference, LPAR-16, Dakar, Senegal, April 25-May 1,
2010, Revised Selected Papers}
,
pages
=
{348--370}
,
year
=
{2010}
}
Chapters/Chapter01.tex
View file @
cc7d22bb
...
...
@@ -15,13 +15,13 @@ also has the ability to provide its model. Modern \smt solvers support
wide range of different first-order theories -- for example theories
of integers, real numbers, floating-point numbers, arrays, strings,
inductively defined data types, bit-vectors, and various combinations
and
sub-theories of
these theories~
\cite
{
BFT15, ZZG13,
RB16
}
. From the
software analysis and verification point of view, a
particularly
important of these theories is the theory of bit-vectors,
which can be
used to describe properties of computer programs, since
programs
usually use data-types of bounded size instead of
mathematical
integers. Additionally, operations over these bounded
data-types
naturally corespond to operations of the bit-vector theory.
and
fragments of formulas over
these theories~
\cite
{
BFT15, ZZG13,
RB16
}
. From the
software analysis and verification point of view, a
particularly
important of these theories is the theory of bit-vectors,
which can be
used to describe properties of computer programs, since
programs
usually use data-types of bounded size instead of
mathematical
integers. Additionally, operations over these bounded
data-types
naturally cor
r
espond to operations of the bit-vector theory.
The benefit of describing properties of programs by bit-vector
formulas is twofold. Formulas in the bit-vector theory allow to model
...
...
@@ -33,27 +33,27 @@ even if the multiplication is allowed.
Therefore, quantifier-free bit-vector formulas are used in tools for
symbolic execution, bounded model checking, analysis of hardware
circuits, static analysis, or test generation~
\cite
{
CGPD08, CDE08,
CFM12
}
. Most of the current
\smt
solvers for the
quantifier-free
bit-vector formulas eagerly or lazily translate the
formula to the
propositional logic (
\emph
{
bit-blasting
}
) and use an
efficient
\sat
solver to decide its satisfiability. Therefore, the
efficiency of most
of the bit-vector
\smt
solvers is tightly connected
to the efficiency
of the
\sat
solvers. Plenty of solvers
for the quantifier-free
bit-vector formulas exist: Beaver~
\cite
{
Beaver
}
,
Lei10,
CFM12
}
. Most of the current
\smt
solvers for the
quantifier-free
bit-vector formulas eagerly or lazily translate the
formula to the
propositional logic (
\emph
{
bit-blasting
}
) and use an
efficient
\sat
solver to decide its satisfiability. Therefore, the
efficiency of most
of the bit-vector
\smt
solvers is tightly connected
to the efficiency
of the
\sat
solvers. Plenty of solvers
supporting
the quantifier-free
bit-vector formulas exist: Beaver~
\cite
{
Beaver
}
,
Boolector~
\cite
{
Boolector
}
, CVC4~
\cite
{
CVC4
}
, MathSAT5~
\cite
{
MathSAT
}
,
OpenSMT~
\cite
{
OpenSMT
}
, Sonolar~
\cite
{
Sonolar
}
, Spear~
\cite
{
Spear
}
,
STP~
\cite
{
STP
}
, UCLID~
\cite
{
LS04
}
, Yices~
\cite
{
Yices
}
, and
Z3~
\cite
{
Z3
}
.
In some cases, quantifier-free formulas are not succinct enough and
using quantification is necessary keep size of the formula
reasonable.
Bit-vector quantified
formulas arise naturally for example
using quantification is necessary
to
keep
the
size of the formula
reasonable.
Quantified bit-vector
formulas arise naturally for example
in applications that need to decide equality of two symbolically
represented states~
\cite
{
BHB14
}
, or in applications that generate loop
invariants, ranking functions, or loop
summaries~
\cite
{
WHD13,KLW13
}
. However, the current
\smt
solvers'
support of quantified bit-vector logic is
much more
modest -- only
CVC4, Yices,
and Z3 officially support quantifiers in bit-vector
support of quantified bit-vector logic is modest -- only
CVC4, Yices,
and Z3 officially support quantifiers in bit-vector
formulas. Recently, quantifiers have been also implemented in an
development version of Boolector~
\cite
{
BoolectorComp
}
. All of these
\smt
solvers solve quantified bit-vector formulas by some variant of
...
...
@@ -61,8 +61,8 @@ quantifier-instantiation and using a solver for quantifier-free
formulas as an oracle.
In the last year, we have proposed a different approach. We have
implemented a symbolic solver Q3B, which is based on binary
decision
diagrams
, and
have shown that it can not only compete with
implemented a symbolic
\smt
solver Q3B, which is based on binary
decision
diagrams
. We
have shown that it can not only compete with
state-of-the art
\smt
solvers, but outperforms them in many
cases~
\cite
{
JS16
}
. However,
\bdds
are not a silver bullet; the
symbolic
\smt
solver fails on formulas containing non-trivial
...
...
@@ -71,14 +71,14 @@ study, I plan to develop a hybrid approach to solving quantified
bit-vectors, which combines symbolic representation by
\bdds
with
search techniques employed by existing state-of-the-art solvers. I
also plan to continue developing the symbolic solver Q3B itself,
namely improv
ing
its efficiency and add
ing
support for features as
uninterpreted functions and arrays, which are important in the
software
verification.
namely improv
e
its efficiency and add support for features as
uninterpreted functions and arrays, which are important in the
software
verification.
The thesis proposal is organized as follows. Chapter~
\ref
{
ch:sota
}
summarizes the state of the art and is divided into six
sections. Section~
\ref
{
sec:prelim
}
introduces necessary background and
notations from propositional
logic
and first-order
notations from
the
propositional and first-order
logic. Section~
\ref
{
sec:sat
}
describes approaches to solving
propositional satisfiability and Section~
\ref
{
sec:smt
}
describes
approaches to solving satisfiability modulo theories. Sections
...
...
@@ -86,7 +86,7 @@ approaches to solving satisfiability modulo theories. Sections
and quantified formulas over the theory of bit-vectors,
respectively. Finally, Section~
\ref
{
sec:complexity
}
section describes
results concerning the computational complexity of bit-vector
logics. Chapter~
\ref
{
ch:achieved
}
describes results
, which
we have
logics. Chapter~
\ref
{
ch:achieved
}
describes results
that
we have
achieved during the first two years of my PhD
study. Chapter~
\ref
{
ch:aims
}
presents the aim of the thesis and states
plans for the remaining part of my PhD study.
...
...
Chapters/Chapter02.tex
View file @
cc7d22bb
...
...
@@ -150,7 +150,7 @@ $\mathcal{T}$- prefixes.
\subsection
{
Many-sorted logic
}
For some theories, it can be conv
i
nient to distinguish several types
For some theories, it can be conv
e
nient to distinguish several types
of objects instead of having only one universe. This can be achieved
by using a
\emph
{
many-sorted logic
}
. In contrast with a single-sorted
signature, defined in the previous subsection, a
\emph
{
many-sorted
...
...
@@ -168,7 +168,7 @@ Enderton~\cite{End01}.
For a many-sorted signature
$
\Sigma
$
, a
\emph
{$
\Sigma
$
-structure
}
$
\mathcal
{
A
}$
consists of an assignment
$
(
\_
)
^
\mathcal
{
A
}$
, which to
each sort symbol
$
S
\in
\Sigma
^
S
$
assigns a non-empty set
$
S
^
\mathcal
{
A
}$
, caled the
\emph
{
domain of S in
$
\mathcal
{
A
}$}
, to
$
S
^
\mathcal
{
A
}$
, cal
l
ed the
\emph
{
domain of S in
$
\mathcal
{
A
}$}
, to
each variable
$
x
$
of sort
$
S
$
assigns an element
$
x
^
\mathcal
{
A
}
\in
S
^
\mathcal
{
A
}$
, to each function symbol
$
f
\in
\Sigma
^
f
$
of an arity
$
(
S
_
1
,
\ldots
, S
_
n, S
_{
n
+
1
}
)
$
assigns a
...
...
@@ -380,7 +380,7 @@ For a detailed description of these theories and implementation of the
respective
$
\mathcal
{
T
}$
-solvers, we refer the reader for example to the book of
Bradley and Manna~
\cite
{
BM07
}
.
In prac
i
tce, a satisfiability of formulas using a combination of
In pract
i
ce, a satisfiability of formulas using a combination of
theories is often needed. For example, a single formula may be using
integers, arrays, and uninterpreted functions. In their seminal work,
Nelson and Oppen have shown that satisfiability of combination of
...
...
Chapters/Chapter03.tex
View file @
cc7d22bb
...
...
@@ -57,12 +57,12 @@ the size of the formula. Dually, the existential quantification can be
distributed over disjunctions.
Moreover, universal quantification can distribute over disjunctions in
cases where the variable bound by the quantifier does not occur
g
in one
cases where the variable bound by the quantifier does not occur in one
of the disjuncts. This leads to the following rule and its dual
version, which is known as
\emph
{
miniscoping
}
~
\cite
{
Har09
}
:
\[
\forall
x.
\,
(
\varphi
~
\vee
~
\psi
)
~~
\leadsto
~~
(
\forall
x .
\,
\varphi
)
~
\vee
~
\psi
,
\forall
x.
\,
(
\varphi
[
x
]
~
\vee
~
\psi
)
~~
\leadsto
~~
(
\forall
x .
\,
\varphi
[
x
]
)
~
\vee
~
\psi
,
\]
where
$
x
$
does not occur freely in
$
\psi
$
. Note that the scope of the
quantifier is again reduced, which can lead to smaller intermediate
...
...
@@ -218,10 +218,15 @@ which uses quantified formulas to decide the equality of two symbolic
states. On this set of benchmarks, our solver Q3B also has better
performance than
\smt
solvers based on the quantifier instantiation
and bit-blasting. Table
\ref
{
tbl:results
}
shows the numbers of
formulas solved by each solver and
f
igure
\ref
{
fig:quantilePlots
}
formulas solved by each solver and
F
igure
\ref
{
fig:quantilePlots
}
presents the quantile plot of CPU times needed to solve these
formulas.
All experiments were performed on a Debian machine with two six-core
Intel Xeon E5-2620 2.00GHz processors and 128 GB of RAM. Each
benchmark run was limited to use 3 processor cores, 4 GB of RAM and 20
minutes of CPU time (if not stated otherwise).
\begin{table}
\checkoddpage
\edef\side
{
\ifoddpage
l
\else
r
\fi
}
...
...
@@ -298,8 +303,9 @@ formulas.
\end{minipage}
}
\end{table}
Recently, these results were confirmed by the
\smt
competition 2016 --
our solver is the winner of the quantified-bit vectors category. Table
Recently, these results were confirmed by the
\smt
competition
2016
\footnote
{
\url
{
http://smtcomp.sourceforge.net/2016/
}}
-- our
solver is the winner of the quantified-bit vectors category. Table
\ref
{
tbl:smtcomp
}
shows official results for this category. The
benchmarks are divided into two groups, with
\emph
{
known
}
and
\emph
{
unknown
}
status. A benchmark has a known status if at least two
...
...
Chapters/Chapter04.tex
View file @
cc7d22bb
...
...
@@ -5,13 +5,13 @@
\section
{
Objectives and Expected Results
}
\subsection
{
Symbolic solver for quantified bit-vectors
}
I plan to continue developing the
implemented symbolic
\smt
solver
Q3B, which is aimed at solving quantified bit-vector formulas. In
particular, I plan to add support for uninterpreted functions and the
theory of arrays, which is highly desirable for applications in the
program verification. I also want to
implement extraction of an
unsatisfiable core from the intermediate
\bdds
that were produced
during the computation.
Throughout the rest of my PhD study,
I plan to continue developing the
implemented symbolic
\smt
solver Q3B, which is aimed at solving
quantified bit-vector formulas. In particular, I plan to add support
for uninterpreted functions and the theory of arrays, which is highly
desirable for applications in the
program verification. I also want to
implement extraction of an
unsatisfiable core from the intermediate
\bdds
that were produced
during the computation.
Additionally, currently implemented approximations are very simple and
could benefit from better refinement in the case that the current
...
...
@@ -61,7 +61,7 @@ correctness is not yet complete.
Moreover, the simplifications of formulas with unconstrained variables
can be further extended. For example, if a formula contains a term
$
k
\times
x
$
in which the variable
$
x
$
is unconstrained, this term can
be replaced by a simpler term regar
g
less the parity of the value
be replaced by a simpler term regar
d
less the parity of the value
$
k
$
. In particular, if
$
i
$
is the largest number for which
$
2
^
i
$
divides the constant
$
k
$
and the unconstrained variable
$
x
$
has
bit-width
$
n
$
, the term
$
k
\times
x
$
can be rewritten to
...
...
@@ -87,18 +87,20 @@ those complexity classes. We are working on a proof which shows that
BV2 is complete for the class of problems solvable by the
\emph
{
alternating Turing machine
}
(
\atm
) with the exponential space
and
\emph
{
polynomial number of alternations
}
with respect to log-space
reduction. This class is usually denoted as
\AEXPTIMEp
and is known to
be in between
\NEXPTIME
and
\EXPSPACE
~
\cite
{
HKVV15, Luc16
}
. However,
whether any of the inclusions is proper is not known.
reductions. This class is usually denoted as
\AEXPTIMEp
and is known
to be in between
\NEXPTIME
and
\EXPSPACE
~
\cite
{
HKVV15,
Luc16
}
. However, whether any of the inclusions is proper is not
known.
\section
{
Progression Schedule
}
The plan of my future study and research activities is following:
\begin{description}
[style=nextline,leftmargin=0.8cm]
\item
[now -- January 2017] Extending unconstrained variable
propagation to quantified formulas and to non-linear multiplication.
\item
[now -- January 2019] Improvements and maintaining of the
developed symbolic
\smt
solver Q3B.
\item
[now -- January 2017] Extending unconstrained variable
propagation to quantified formulas and to non-linear multiplication
and division.
\item
[January 2017] Doctoral exam and defense of this thesis proposal.
\item
[February 2017 -- April 2017] Proving a precise complexity class
of the quantified bit-vector formulas without uninterpreted functions
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment