Recent Trends in SMT and Z3

An interactive taste of SMT with Z3

 Nikolaj Bjørner Microsoft Research nbjorner@microsoft.com

Plan

1. SMT and Z3

2. Theories

3. Programming Solvers with an application to MaxSAT

Z3

• A state-of-art Satisfiability Modulo Theories (SMT) solver

• On GitHub: https://github.com/Z3prover/z3.git
• MIT open source license
• Developments: Scalable simplex solver, Strings, Horn clauses, floating points, SAT extensions

Some Z3 Applications

• Program Verification
• VCC, Everest, Dafny, Havoc, Leon

• Symbolic Execution
• SAGE, Pex, KLEE

• Software Model Checking
• Static Driver Verifier, Smash, SeaHorn

• Configurations
• Network Verification with SecGuru
• Dynamics Product Configuration

Basic SAT

  Tie, Shirt = Bools('Tie Shirt')
s = Solver()
s.add(Or(Tie, Shirt), Or(Not(Tie), Shirt), Or(Not(Tie), Not(Shirt)))
print s.check()
print s.model()

Basic SMT

I = IntSort()
f = Function('f', I, I)
x, y, z = Ints('x y z')
A = Array('A',I,I)

fml = Implies(x + 2 == y, f(Select(Store(A, x, 3), y - 2)) == f(y - x + 1))

s = Solver()
print s.check()

Logical Queries - SAT+

sat unsat

model (clausal) proof

correction set core

local min correction set local min core

min correction set min core

Theory Solvers

Equality and Uninterpreted functions

EUF

  (declare-sort A)
(declare-fun f (A) A)
(declare-const x A)
(assert (= (f (f x)) x))
(assert (= (f (f (f x))) x))
(check-sat)

(assert (not (= (f x) x)))
(check-sat)

A linear arithmetic conjecture

A linear arithmetic conjecture in SMT

(declare-const xR Real)
(declare-const yR Real)
(declare-const x Int)
(declare-const y Int)
(declare-const a Int)

(assert (< (+ xR yR) a))
(assert (> (+ x y) a))
(assert (or (= x xR) (< x xR (+ x 1)) (< (- x 1) xR x)))
(assert (or (= y yR) (< y yR (+ y 1)) (< (- y 1) yR y)))
(check-sat)
(get-model)