Satisfiability Modulo Theories

Section 1

Z3

• A state-of-art Satisfiability Modulo Theories (SMT) solver
  
  
  
  
• On GitHub: https://github.com/Z3prover/z3.git
  • MIT open source license
  • Developments: Scalable simplex solver, Strings, Horn clauses, floating points, SAT extensions

Some Z3 Applications

• Program Verification
  • VCC, Everest, Dafny, Havoc, Leon
    
    
• Symbolic Execution
  • SAGE, Pex, KLEE
    
    
• Software Model Checking
  • Static Driver Verifier, Smash, SeaHorn
    
    
• Configurations
  • Network Verification with SecGuru
  • Dynamics Product Configuration

Microsoft Tools using Z3

SAT/SMT examples

• Book draft by Dennis Yurichev

Basic SAT

  Tie, Shirt = Bools('Tie Shirt')
  s = Solver()
  s.add(Or(Tie, Shirt), Or(Not(Tie), Shirt), Or(Not(Tie), Not(Shirt)))
  print s.check()
  print s.model()

Basic SMT

I = IntSort()
f = Function('f', I, I)
x, y, z = Ints('x y z')
A = Array('A',I,I)

fml = Implies(x + 2 == y, f(Select(Store(A, x, 3), y - 2)) == f(y - x + 1))

s = Solver()
s.add(Not(fml))
print s.check()

SMT in a nutshell

Is formula satisfiable under theory ?

SMT solvers use specialized algorithms for .

Complexity