Recent Trends in SMT and Z3

Z3

• A state-of-art Satisfiability Modulo Theories (SMT) solver
  
  
  
  
• On GitHub: https://github.com/Z3prover/z3.git
  • MIT open source license
  • Developments: Scalable simplex solver, Strings, Horn clauses, floating points, SAT extensions

Some Z3 Applications

• Program Verification
  • VCC, Everest, Dafny, Havoc, Leon
    
    
• Symbolic Execution
  • SAGE, Pex, KLEE
    
    
• Software Model Checking
  • Static Driver Verifier, Smash, SeaHorn
    
    
• Configurations
  • Network Verification with SecGuru
  • Dynamics Product Configuration

Microsoft Tools using Z3

SAT/SMT examples

• Book draft by Dennis Yurichev

Basic SAT

  Tie, Shirt = Bools('Tie Shirt')
  s = Solver()
  s.add(Or(Tie, Shirt), Or(Not(Tie), Shirt), Or(Not(Tie), Not(Shirt)))
  print s.check()
  print s.model()

Basic SMT

I = IntSort()
f = Function('f', I, I)
x, y, z = Ints('x y z')
A = Array('A',I,I)

fml = Implies(x + 2 == y, f(Select(Store(A, x, 3), y - 2)) == f(y - x + 1))

s = Solver()
s.add(Not(fml))
print s.check()

Logical Queries - SAT+

sat unsat

model (clausal) proof

correction set core

local min correction set local min core

min correction set min core

Logical Queries

Equality and Uninterpreted functions

EUF

  (declare-sort A)
  (declare-fun f (A) A)
  (declare-const x A)
  (assert (= (f (f x)) x))
  (assert (= (f (f (f x))) x))
  (check-sat)
  
  (assert (not (= (f x) x)))
  (check-sat)

A linear arithmetic conjecture

A linear arithmetic conjecture in SMT

(declare-const xR Real)
(declare-const yR Real)
(declare-const x Int)
(declare-const y Int)
(declare-const a Int)

(assert (< (+ xR yR) a))
(assert (> (+ x y) a))
(assert (or (= x xR) (< x xR (+ x 1)) (< (- x 1) xR x)))
(assert (or (= y yR) (< y yR (+ y 1)) (< (- y 1) yR y)))
(check-sat)
(get-model)

A linear arithmetic conjecture online

A revised conjecture

A revised conjecture online

Jobshop scheduling