LFSC for SMT Proofs: Work in Progress - University of Iowa
LFSC for SMT Proofs: Work in Progress - University of Iowa
LFSC for SMT Proofs: Work in Progress - University of Iowa
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>LFSC</strong> <strong>for</strong> <strong>SMT</strong> <strong>Pro<strong>of</strong>s</strong>:<br />
<strong>Work</strong> <strong>in</strong> <strong>Progress</strong><br />
Aaron Stump, Andrew Reynolds, Cesare<br />
T<strong>in</strong>elli, Aust<strong>in</strong> Laugesen, Harley Eades,<br />
Corey Oliver, Ruoyu Zhang<br />
PxTP workshop<br />
June 30 th , 2012
Acknowledgements<br />
• Current <strong>LFSC</strong> team:<br />
– Aaron Stump, Andrew Reynolds, Cesare T<strong>in</strong>elli, Aust<strong>in</strong><br />
Laugesen, Harley Eades, Corey Oliver, Ruoyu Zhang<br />
• Previous work on <strong>LFSC</strong>:<br />
– <strong>University</strong> <strong>of</strong> <strong>Iowa</strong><br />
• Duckki Oe, Jed McClurg, Cuong Thai<br />
– New York <strong>University</strong><br />
• Liana Hadarean, Yet<strong>in</strong>g Ge, Clark Barrett
In this talk:<br />
• Previous work:<br />
– <strong>LFSC</strong>: meta-<strong>for</strong>mat <strong>for</strong> def<strong>in</strong><strong>in</strong>g pro<strong>of</strong>s<br />
– High per<strong>for</strong>mance pro<strong>of</strong> checker (C++)<br />
– Applications to <strong>SMT</strong> pro<strong>of</strong>s<br />
• New work on <strong>LFSC</strong>:<br />
– New implementation (Ocaml), more optimizations<br />
– Language <strong>for</strong> def<strong>in</strong><strong>in</strong>g pro<strong>of</strong> signatures
Pro<strong>of</strong> Check<strong>in</strong>g <strong>in</strong> <strong>SMT</strong><br />
Formula ϕ<br />
<strong>SMT</strong> Solver<br />
Model<br />
sat<br />
unsat<br />
Pro<strong>of</strong> P<br />
Pro<strong>of</strong> Checker<br />
pf valid<br />
pf <strong>in</strong>valid
Challenges <strong>of</strong> Pro<strong>of</strong> Check<strong>in</strong>g <strong>in</strong> <strong>SMT</strong><br />
• Many theories<br />
– UF, Arrays, Arithmetic, Datatypes, Bitvectors<br />
– … Quantifiers<br />
• Solvers have unique implementations<br />
– Have highly optimized decision procedures<br />
– Use unique pro<strong>of</strong> <strong>in</strong>ferences<br />
• <strong>Pro<strong>of</strong>s</strong> can be very large<br />
– Can be on the order <strong>of</strong> gigabytes
Challenges <strong>of</strong> Pro<strong>of</strong> Check<strong>in</strong>g <strong>in</strong> <strong>SMT</strong><br />
• Most <strong>SMT</strong> solvers:<br />
– Do propositional reason<strong>in</strong>g via SAT solver<br />
– Per<strong>for</strong>m CNF conversion<br />
– Use theory solvers<br />
– Apply simplification to <strong>in</strong>put<br />
• ITE removal, theory-specific rewrit<strong>in</strong>g <strong>of</strong> literals, …<br />
– Use theory comb<strong>in</strong>ation<br />
– Apply quantifier <strong>in</strong>stantiation/elim<strong>in</strong>ation<br />
– …<br />
• Pro<strong>of</strong> system must account <strong>for</strong> all <strong>of</strong> these<br />
– In CVC3: 200+ f<strong>in</strong>e/coarse gra<strong>in</strong>ed pro<strong>of</strong> rules
Challenges <strong>of</strong> Pro<strong>of</strong> Check<strong>in</strong>g <strong>in</strong> <strong>SMT</strong><br />
• In purely declarative pro<strong>of</strong> <strong>for</strong>mat<br />
– Pro<strong>of</strong> size can be impractical<br />
• Consider arithmetic:<br />
( t 1 + … t n ) = ( s 1 + … + s n ),<br />
where s 1 … s n is a permutation <strong>of</strong> t 1 … t n<br />
– Requires O( n 2 ) applications <strong>of</strong> declarative rules<br />
• i.e. associative/commutative properties <strong>of</strong> addition<br />
‣Proposed solution:<br />
– use simple computational checks with<strong>in</strong> pro<strong>of</strong> rules<br />
• i.e. polynomial normalization
<strong>LFSC</strong>: Pro<strong>of</strong> Checker <strong>for</strong> <strong>SMT</strong><br />
• Flexible<br />
– Meta-<strong>for</strong>mat <strong>for</strong> def<strong>in</strong><strong>in</strong>g pro<strong>of</strong> systems<br />
– Pro<strong>of</strong> rules <strong>in</strong> user-def<strong>in</strong>ed signature<br />
– One checker suffices <strong>for</strong> many signatures<br />
• Fast<br />
– High per<strong>for</strong>mance C++ code<br />
– Use <strong>of</strong> side conditions to reduce pro<strong>of</strong> size<br />
– In most cases, check<strong>in</strong>g time
<strong>LFSC</strong>: LF with Side Conditions<br />
• Ed<strong>in</strong>burgh Logical Framework<br />
– Curry-Howard Isomorphism<br />
• <strong>Pro<strong>of</strong>s</strong> as terms<br />
• Pro<strong>of</strong> check<strong>in</strong>g becomes type check<strong>in</strong>g<br />
• Extends LF with side conditions<br />
– Written <strong>in</strong> simple functional programm<strong>in</strong>g language<br />
– Each side condition:<br />
• (Intended to be) small enough to verify by <strong>in</strong>spection
Framework <strong>for</strong> Pro<strong>of</strong> Check<strong>in</strong>g <strong>in</strong> <strong>SMT</strong><br />
Formula ϕ<br />
<strong>SMT</strong> Solver<br />
Model<br />
sat<br />
unsat<br />
Pro<strong>of</strong> P<br />
is P <strong>of</strong> type<br />
(holds ϕ) → (holds false)<br />
<strong>LFSC</strong><br />
Pro<strong>of</strong> Checker<br />
Signature<br />
pf valid<br />
pf <strong>in</strong>valid
Previous <strong>Work</strong><br />
• <strong>LFSC</strong> as:<br />
– Framework def<strong>in</strong><strong>in</strong>g pro<strong>of</strong> systems<br />
– Efficient pro<strong>of</strong> checker <strong>for</strong> <strong>SMT</strong><br />
– Flexible pro<strong>of</strong> checker <strong>for</strong> l<strong>in</strong>ear arithmetic<br />
– Certified <strong>in</strong>terpolant generator
Optimizations <strong>in</strong> <strong>LFSC</strong> [Oe et al 09]<br />
• Optimizations <strong>in</strong> <strong>LFSC</strong><br />
– Incremental Check<strong>in</strong>g<br />
• <strong>Pro<strong>of</strong>s</strong> checked as they are parsed<br />
– Optimized pro<strong>of</strong> rules <strong>for</strong> boolean resolution<br />
• Lazy approach to apply<strong>in</strong>g side conditions<br />
– Side condition compilation<br />
• Integrated <strong>in</strong>to C++ source, <strong>in</strong>stead <strong>of</strong> <strong>in</strong>terpreted<br />
• Each leads to order <strong>of</strong> magnitude speedup
L<strong>in</strong>ear Real Arithmetic [Reynolds et al 10]<br />
• <strong>LFSC</strong> Signature <strong>for</strong> L<strong>in</strong>ear Real Arithmetic (LRA)<br />
– Conversion <strong>of</strong> terms to normalized polynomials<br />
• t 1 = t 2 becomes p = 0, where p is ( t 1 – t 2 )↓<br />
– 60 l<strong>in</strong>es <strong>of</strong> side condition code<br />
• Code complexity roughly <strong>of</strong> merge sort<br />
• Exploit cont<strong>in</strong>uum <strong>of</strong> possible pro<strong>of</strong> systems<br />
– Declarative pro<strong>of</strong> system<br />
• Rewrite rules <strong>of</strong> the <strong>for</strong>m t 1 = t 2 ↔ t’ 1 = t’ 2<br />
– Computational pro<strong>of</strong> system<br />
• Side conditions to per<strong>for</strong>m operations on polynomials
L<strong>in</strong>ear Real Arithmetic<br />
• Experiments on <strong>SMT</strong> LIB benchmarks<br />
• Used CVC3 <strong>for</strong> pro<strong>of</strong> generation<br />
• Computational pro<strong>of</strong> system is advantageous<br />
– For pro<strong>of</strong>s <strong>of</strong> theory lemmas:<br />
• 5x reduction <strong>in</strong> pro<strong>of</strong> size<br />
• 2.5x reduction <strong>in</strong> pro<strong>of</strong> check<strong>in</strong>g time<br />
• Pro<strong>of</strong> check<strong>in</strong>g <strong>in</strong> both systems is fast<br />
– 10x faster than solv<strong>in</strong>g time
Interpolant Generation [Reynolds et al 11]<br />
• Interpolant <strong>for</strong> <strong>in</strong>consistent <strong>for</strong>mulas (A,B)<br />
– Summarizes the <strong>in</strong>consistency, <strong>in</strong> language <strong>of</strong> A ∩ B<br />
• Interpolants are useful <strong>in</strong> verification<br />
– Model check<strong>in</strong>g, abstraction ref<strong>in</strong>ement, …<br />
• Correctness <strong>of</strong> <strong>in</strong>terpolant can be critical<br />
• Often, <strong>in</strong>terpolant can be extracted from pro<strong>of</strong><br />
– Use <strong>of</strong> <strong>in</strong>terpolant generat<strong>in</strong>g calculi:<br />
⇒
Certified Interpolant Generation<br />
<strong>SMT</strong> Solver<br />
unsat<br />
Pro<strong>of</strong><br />
Pro<strong>of</strong><br />
Apply annotations<br />
to pro<strong>of</strong><br />
<strong>LFSC</strong><br />
Pro<strong>of</strong> Checker<br />
Extended<br />
Signature<br />
pf valid,<br />
pf <strong>in</strong>valid<br />
Interpolant
Certified Interpolant Generation<br />
• <strong>LFSC</strong> generates certified <strong>in</strong>terpolants<br />
– Comes as side effect <strong>of</strong> pro<strong>of</strong> check<strong>in</strong>g<br />
• Approach is practical:<br />
– 2x slower than check<strong>in</strong>g unannotated pro<strong>of</strong>s<br />
– Check<strong>in</strong>g is 5x faster than solv<strong>in</strong>g<br />
• 22% overhead
<strong>LFSC</strong>: Look<strong>in</strong>g Forward<br />
• User-friendly language <strong>for</strong> def<strong>in</strong><strong>in</strong>g Pf signatures<br />
– Surface language<br />
– Core language<br />
• Translation from surface to core language<br />
• Highly optimized pro<strong>of</strong> checker<br />
– Signature compilation<br />
• Side conditions as well as type check<strong>in</strong>g rules<br />
– Implicit arguments <strong>for</strong> pro<strong>of</strong> rules<br />
• Reduction <strong>in</strong> pro<strong>of</strong> size
<strong>LFSC</strong> : Pro<strong>of</strong> Checker<br />
…<br />
sat<br />
<strong>SMT</strong> Solver<br />
Pro<strong>of</strong><br />
unsat<br />
<strong>LFSC</strong><br />
Pro<strong>of</strong> Checker<br />
Signature<br />
pf valid<br />
pf <strong>in</strong>valid<br />
• For optimization, compile signature <strong>in</strong>to pro<strong>of</strong> checker
<strong>LFSC</strong> : Pro<strong>of</strong> Checker Generator<br />
…<br />
sat<br />
<strong>SMT</strong> Solver<br />
Pro<strong>of</strong><br />
unsat<br />
Signature<br />
<strong>LFSC</strong><br />
Pro<strong>of</strong> Checker<br />
Pro<strong>of</strong> Checker<br />
Generator<br />
pf valid<br />
pf <strong>in</strong>valid<br />
‣ Generic translation <strong>of</strong> signature <strong>in</strong>to<br />
C++ code <strong>for</strong> pro<strong>of</strong> checker
Example Pro<strong>of</strong> System
Example Pro<strong>of</strong> System <strong>in</strong> LF<br />
<strong>for</strong>mula : Type;<br />
imp : <strong>for</strong>mula -> <strong>for</strong>mula -> <strong>for</strong>mula;<br />
holds : <strong>for</strong>mula -> Type.<br />
imp_<strong>in</strong>tro :<br />
Π f1:<strong>for</strong>mula. Π f2:<strong>for</strong>mula.<br />
((holds f1) -> (holds f2)) -> (holds (imp f1 f2)).<br />
imp_elim :<br />
Π f1:<strong>for</strong>mula. Π f2:<strong>for</strong>mula.<br />
(holds (imp f1 f2)) -> (holds f1) -> (holds f2).<br />
‣Can be burdensome to write pro<strong>of</strong> signatures <strong>in</strong> this <strong>for</strong>mat
<strong>LFSC</strong> : Surface Language Support<br />
<strong>SMT</strong> Solver<br />
…<br />
sat<br />
unsat<br />
Signature<br />
Surface to Core<br />
Translation<br />
Pro<strong>of</strong><br />
Core<br />
Signature<br />
<strong>LFSC</strong><br />
Pro<strong>of</strong> Checker<br />
Pro<strong>of</strong> Checker<br />
Generator<br />
pf valid<br />
pf <strong>in</strong>valid
Surface Language<br />
SYNTAX<br />
<strong>for</strong>mula f ::= imp f1 f2.<br />
JUDGMENTS<br />
(holds f)<br />
RULES<br />
[ holds f1 ] |- holds f2<br />
…<br />
…<br />
----------------------------- imp_<strong>in</strong>tro<br />
holds (imp f1 f2) .<br />
holds (imp f1 f2) , holds f1<br />
----------------------------- imp_elim<br />
holds f2 .
Core Language<br />
tctor <strong>for</strong>mula : Type .<br />
ctor imp :<br />
Pi+(f1: <strong>for</strong>mula, f2:<strong>for</strong>mula) .<br />
tctor holds : Pi(f:<strong>for</strong>mula).Type .<br />
…<br />
…<br />
ctor imp_<strong>in</strong>tro :<br />
Pi-(f2:<strong>for</strong>mula).<br />
Pi+(f1:<strong>for</strong>mula, p:Pi+(p:(holds f1)).(holds f2)).<br />
(holds (imp f1 f2)).<br />
ctor imp_elim :<br />
Pi-(f1:<strong>for</strong>mula, f2:<strong>for</strong>mula).<br />
Pi+(p1:(holds (imp f1 f2)), p2:(holds f1)).<br />
(holds f2).
Compiled C++<br />
...<br />
str<strong>in</strong>g s = parse_str<strong>in</strong>g();<br />
if( s==“imp_<strong>in</strong>tro” ){<br />
...<br />
}else if( s==“imp_elim” ){<br />
Expr* e1 = parse_expr();<br />
Expr* e2 = parse_expr();<br />
if( e1->k<strong>in</strong>d==k_holds &&<br />
e2->k<strong>in</strong>d==k_holds &&<br />
e1->child[0]==e2->child[0] ){<br />
return e1->child[1];<br />
}else{<br />
Error(“pro<strong>of</strong> check<strong>in</strong>g failed”);<br />
}<br />
} ‣Actual generated C++ code is highly optimized<br />
…<br />
…
Example Pro<strong>of</strong><br />
…<br />
…
Example Pro<strong>of</strong> : <strong>LFSC</strong><br />
…<br />
…<br />
imp_<strong>in</strong>tro (imp p (imp (imp p q) q)) p<br />
u . imp_<strong>in</strong>tro (imp (imp p q) q) (imp p q)<br />
v . imp_elim (imp p q) q u v
Example Pro<strong>of</strong> : <strong>LFSC</strong><br />
• Pro<strong>of</strong> size may be reduced via use <strong>of</strong><br />
implicit arguments:<br />
imp_<strong>in</strong>tro p<br />
u . imp_<strong>in</strong>tro (imp p q)<br />
v . imp_elim u v<br />
…<br />
…<br />
‣ Automatically determ<strong>in</strong>e which arguments made implicit
Surface Language Example : <strong>SMT</strong><br />
SYNTAX<br />
sort s ::= arrow s1 s2 | bool .<br />
term t ::=<br />
true<br />
| false<br />
| (not t1)<br />
| (and t1 t2)<br />
| (or t1 t2)<br />
...<br />
| (ite t1 t2 t3)<br />
| (<strong>for</strong>all t ^ t)<br />
| (apply t1 t2)<br />
| (eq t1 t2).<br />
<strong>for</strong>mula f ::= t .
Surface Language Example : <strong>SMT</strong><br />
…<br />
JUDGMENTS<br />
(th_holds f)<br />
RULES<br />
---------------------------- refl<br />
th_holds (eq t1 t2) .<br />
th_holds (eq t1 t2)<br />
---------------------------- symm<br />
th_holds (eq t2 t1) .<br />
th_holds (eq t1 t2)<br />
-------------------------------------------- cong<br />
th_holds (eq (apply t3 t1)<br />
(apply t3 t2) ) .<br />
th_holds (eq t1 t2) th_holds (eq t2 t3)<br />
--------------------------------------------------- trans<br />
th_holds (eq t1 t3) .
Current <strong>Work</strong> on <strong>LFSC</strong><br />
• Design <strong>of</strong> core language<br />
– Side conditions<br />
– Implicit/Explicit arguments<br />
• Conversion <strong>of</strong> core language to pro<strong>of</strong> checker<br />
• Optimizations <strong>for</strong> pro<strong>of</strong> check<strong>in</strong>g<br />
• Develop signatures <strong>for</strong> various <strong>SMT</strong> theories<br />
– Arithmetic, parametric datatypes, quantifiers<br />
• Integration <strong>of</strong> <strong>LFSC</strong> <strong>in</strong>to <strong>SMT</strong> solver CVC4
Summary<br />
• Previous work on <strong>LFSC</strong>:<br />
– Fast and flexible approach <strong>for</strong> <strong>SMT</strong> pro<strong>of</strong>s<br />
• New version <strong>of</strong> <strong>LFSC</strong>:<br />
– Generates pro<strong>of</strong> checker from user signature<br />
– Surface language <strong>for</strong> def<strong>in</strong><strong>in</strong>g pro<strong>of</strong> signatures<br />
– Plans <strong>for</strong> highly optimized pro<strong>of</strong> checker<br />
• Currently <strong>in</strong> Development
Questions