On ProjecFon using SAT/SMT Jörg Brauer (RWTH Aachen University) Andy King (Portcullis Computer Security) Jael Kriener (University of Kent) 05.03.2012 @ MPI, Saarbrücken
Myself Diploma in CS from University of Kiel (2008) StaFc analysis @ NICTA (2006-2008) Since 10/2008: PhD student @ RWTH Leading [mc]square project Research interests AutomaFc abstracfon Analysis of binaries Decision procedures (to some extent) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 2
Two Topics 1. ExistenFal quanffier eliminafon as incremental SAT solving 2. Approximate projecfon for (non- ) linear constraints 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 3
Why SAT? MoFvaFon CNF and SAT- based quan1fier elimina1on can be exponen1ally more efficient than [..] BDDs in cases where the resul1ng fixed points have compact representa1ons in CNF, but not as BDDs. [McM02] SAT- based algorithms are inelegant [Bry08] Require re- engineering of SAT Solver [McM02] Or combinafon with BDDs [LBC03] [Bry08] R.E. Bryant, A View From the Engine Room: ComputaFonal Support for Symbolic Model Checking [LBC03] S.K. Lahiri, R.E. Bryant, B. Cook, A Symbolic Approach to Predicate AbstracFon, CAV 03 [McM02] K. McMillan, Applying SAT Methods in Unbounded Symbolic Model Checking, CAV 02 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 4
QuanFfier EliminaFon in Predicate State variables: Input state: TransiFon relafon: AbstracFon X = {x 1,...,x 6 } Y = {y 1,...,y 6 } ξ =(x 1 x 2 x 3 x 4 x 5 x 6 ) (x 1 x 2 x 3 x 4 x 5 x 6 ) µ = (x 2 y 2 ) (y 2 y 1 ) ((x 4 x 6 ) y 1 ) (x 3 y 4 ) (x 4 y 3 ) (x 5 y 6 ) (x 6 y 5 ) Compute X : µ ξ 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 5
QuanFfier EliminaFon by Example Consider ϕ =( x z) (y z) ( x w z) (w z) Goal: eliminate from such that z ϕ z : ϕ in CNF Introduce fresh variables and replace posifve and negafve literals τ(ϕ) = (x z) (y + z) (x w z) (w + z) ( w + w ) ( x + x ) ( y + y ) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 6
QuanFfier EliminaFon by Example M = Passing τ(ϕ) to SAT solver gives a model w + 1, w 0, x + 0, x 1, y + 0, y 0, z 1 defines implicant M (w x) This means (w x) = z : ϕ Then add blocking clause 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 7
QuanFfier EliminaFon by Example Passing to SAT solver again gives new model M = w + 0, w 0, x + 0, x 1, y + 1, y 0, z 0 Defines new implicant Then ( x y) (w x) ( x y) = z : ϕ UnsaFsfiable in next iterafon, i.e. (w x) ( x y) z : ϕ 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 8
Intermission: SorFng Networks i 1 i 2 i 3 o 1 o 2 o 3 Cardinality constraint as o 1 o 2 o 3 in unary encoding i 1 + i 2 + i 3 =2 encoded Guarantees generafon of shortest implicants D. Knuth: The Art of Computer Programming, Vol. 3 N. Een and N. Sörensson. TranslaFng Pseudo- Boolean Constraints into SAT, JSAT 06 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 9
QuanFfier EliminaFon by Example So far: ψ equisafsfiable to z : ϕ in DNF Then Observe: ψ z : ϕ is in CNF n i=1 imp i = ψ ψ = n i=1 imp i ψ = n i=1 imp i z : ϕ = n i=1 imp i CNF 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 10
QuanFfier EliminaFon by Example Key idea: Simply re- apply technique to Gives ψ = ((w x) ( x y)) = (w x) ( x y) = ( w x) (x y) τ( ψ) = (w x + ) (x + y ) ( w + w ) ( x + x ) ( y + y ) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 11
QuanFfier EliminaFon by Example τ( ψ) = Gives Thus Then (w x + ) (x + y ) ( w + w ) ( x + x ) ( y + y ) (x) = ψ ( w y) = ψ (x) ( w y) ψ z : ϕ ψ ((x) ( w y)) ( x) (w y) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 12
Experimental Setup ImplementaFon using MiniSAT Approx. 100 lines of code Different benchmark sets (40 cases) Hardware circuits from ISCAS- 89 and 74x series ATmega16 transfer funcfons for synthesis Value- set abstracfons for PLCs Ranging from 66 vars in 119 clauses to 18658 variables in 61696 clauses Comparison to hybrid SAT/BDD approach using Cudd library 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 13
Experimental Results RunFme Primes win on 32 benchmarks, BDDs on 8 Ranging from 0.001s to 7.096s Building BDDs does not come for free But CNF enumerafon using Cudd is faster Size Primes win on 15 benchmarks, BDDs on 5 IdenFcal on 20 benchmarks Lessons learnt: BDDs depend a lot on dynamic variable reordering heurisfcs SAT depends a lot on the chosen encoding (orders of magnitudes) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 14
DistribuFon of Prime Implicants +!" '&!" *!" '%!" )!" '$!" (!" '#!" '!" '!!" &!" &!" %!" %!" $!" $!" #!" #!"!" #" $" %" &" '" (" )" *" +" #!" ##" #$" #%" #&"!" '" #" (" $" )" %" *" &" +" '!" ''" '#" '(" '$" ')" '%" '*" '&" '+" #!" #'" ##" '#" *!" '!" &" )!" (!" '!" %" &!" $" #" %!" $!" #!"!" '" #" (" $" )" %" *" &" +" '!" ''" '#" '("!" #" $" %" &" '" (" )" *" +" #!" ##" #$" #%" #&" 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 15
So as to not cause offense McMillan (CAV 02) Lahiri et al. (CAV 03 & CAV 06) Monniaux (CAV 10) Cavada et al. (FMCAD 07) Ketle et al. (TACAS 06) Brauer and King (NFM 11) Brauer and King (CAV 11) Goldberg and Manolios (arxiv 12) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 16
Discussion Two- staged algorithm Model enumerafon in DNF using prime implicants SomeFmes much faster (0.018s vs. 12.811s) Not much slower in worst case Prime implicant generafon on negated formula Converges onto quanffier- free formula from above Second phase is thus anyfme Some more intrinsics in the paper CompeFFve to hybrid SAT/BDD based approaches SystemaFc rather than heurisfc approach Easy to implement (~100 LoC on top of MiniSAT) Cleaned up (larger) source code is available from htp://www.cs.kent.ac.uk/people/staff/amk/ There are faster techniques though 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 17
Two Topics 1. ExistenFal quanffier eliminafon as incremental SAT solving 2. Approximate projecfon for (non- ) linear constraints Some ideas 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 18
The UlFmate Goal (1/3) We have a conjuncfon of integral non- linear inequalifes: y (x 4) 2 + 2 0 y 7 y < (x 5) 2 + 6 Such systems are rather heavyweight Over- approximate representafon using some linear template domain possible? 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 19
The UlFmate Goal (2/3) 8 7 6 5 4 3 2 1 1 2 3 4 5 6 7 8 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 20
The UlFmate Goal (3/3) 8 7 6 5 4 3 2 1 8 7 6 5 4 3 2 1 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 21
Simpler Example Consider ϕ = y = x 2 + 2 0 x 10 0 y 50 Variable bounds are important here! Approximate using octagons, i.e., Take x + y c, which entails Want to compute least sound 0 c 60 c ±x ± y c 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 22
Refining x + y c ϕ = y = x 2 + 2 0 x 10 0 y 50 0 c 60 We know Is ϕ (31 c 60) (0 c 30) (31 c 60) safsfiable? Just query an SMT solver Model (x = 6) (y = 38) entails x + y = 44 Thus (44 c 60) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 23
Refining x + y c ϕ = y = x 2 + 2 0 x 10 0 y 50 (44 c 60) Simply split Is No! Hence (44 c 60) (44 c 52) (53 c 60) ϕ (53 c 60) (44 c 52) into safsfiable? 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 24
Refining x + y c ϕ = y = x 2 + 2 0 x 10 0 y 50 (44 c 52) Just keep goin! Eventually gives, hence c = 44 x + y 44 Could have stopped prematurely though Kind of an anyfme projecfon algorithm x + y 47 is sound, too 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 25
The Result 8 7 6 5 4 3 2 1 1 2 3 4 5 6 7 8 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 26
Solving Non- Linear Constraints in Z3 1. Simplify formula 2. Bit- blast and run SAT solver a. If SAT return SAT b. Otherwise check soundness of transformafon 3. Run general- purpose SMT engine a. Simplex b. Bound propagafon c. Gomory cuts d. Interval spliyng e. Gröbner bases Sound + complete for (very) bounded non- linear integer arithmefc (QF_NIA) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 27
Related Work Lot of work on QE for linear and non- linear systems, from Fourier- Motzkin Fll 2011 Approximate methods based on refinements? None known to me (I m no expert though) Hints? Similar strategies found in abstract interpretafon Codish et al. (TPLP 08) Brauer, King and Kowalewski (FMICS 10) Brauer and King (ESOP 11) 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 28
Concluding Discussion ProjecFon from (non- ) linear system to (non- ) linear system ApproximaFons based on incremental refinements in some template domain Necessitates bounded problems Opinions? Any useful? Use off- the- shelf SMT solver and straigh orward encodings No need to be a genius 2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 29
2012 Jörg Brauer, Embedded SoWware Laboratory, RWTH Aachen University 30