computer-aided reasoning for software cse507...building solver-aided tools: state-of-the-art 16...

CSE507Emina Torlak [email protected]

courses.cs.washington.edu/courses/cse507/14au/

Computer-Aided Reasoning for Software

Solver-Aided Languages

http://courses.cs.washington.edu/courses/cse507/14au/index.html

Today

2

Today

2

Last lecture• Program synthesis

https://uw.iasystem.org/survey/136370

http://courses.cs.washington.edu/courses/cse507/14au/project.html

Today

2


Today • The next N years: Solver-Aided Languages (?)



Today

2


Today • The next N years: Solver-Aided Languages (?)

Reminders• Please fill out the course evaluation form (Dec 02-08)

• 8 min final presentations on Monday, Dec 08, 10:30am, MGH 254

• Final projects due on Monday, Dec 08, at 11pm



visiona little programming for everyone

A little programming for everyone

4

We all want to build programs …

‣ spreadsheet data manipulation [Flashfill, POPL’11]


4


social scientist


‣ models of cell fates [SBL, POPL’13]


4


biologist social scientist



‣ cache coherence protocols [Transit, PLDI’13]

‣ memory models [MemSAT, PLDI’10]


4


hardware designer




‣ cache coherence protocols [Transit, PLDI’13]

‣ memory models [MemSAT, PLDI’10]


4

code

time

effort


hardware designer



5

less code

less time

less effort

solver-aided languages


‣ spreadsheet data manipulation‣ models of cell fates‣ cache coherence protocols‣ memory models

hardware designer


software crisis

program logics (Floyd, Hoare, Dijkstra)

mechanization of logic (Milner, Pnueli)

mechanized tools (Clarke, Emerson, Sifakis)

software gap

SAT/SMT solvers and tools


A little history

6

better programs

software crisis




software gap



A little history

6

better programs

1960

1970

1980

1990

2000

software crisis




software gap



A little history

6

better programs

1960

1970

1980

1990

2000

ASTRÉE[AbsInt]

SLAM[MSR]

6TH SENSE[IBM]

software crisis




software gap



A little history

6

better programs

1960

1970

1980

1990

2000

software crisis




software gap



A little history

6

better programs

more easily

1960

1970

1980

1990

2000

2010

outlinesolver-aided tools, languages and beyond

outlinesolver-aided tools, languages and beyondsolver-aided tools

outlinesolver-aided tools, languages and beyondsolver-aided tools, languages

outlinesolver-aided tools, languages and beyondsolver-aided tools, languages and beyond

storysolver-aided tools

P(x) {……

}

Programming …

9

specification

P(x) {……

}

Programming …

9

specificationtest case

assert safe(P(2))

Programming with a solver-aided tool

10

?SAT/SMT

solvertranslate(…)

P(x) {……

}assert safe(P(x))

Solver-aided tools: verification

11

Find an input on which the program fails.

∃x . ¬ safe(P(x))SAT/SMT

solver

P(x) {……

}assert safe(P(x))

CBMC [Kroening et al., DAC’03]Dafny [Leino, LPAR’10]Miniatur [Vaziri et al., FSE’07]Klee [Cadar et al., OSDI’08]

Solver-aided tools: verification

11

Find an input on which the program fails.

∃x . ¬ safe(P(x))

modelvalues

SAT/SMTsolver

P(x) {……

}assert safe(P(x))

42

CBMC [Kroening et al., DAC’03]Dafny [Leino, LPAR’10]Miniatur [Vaziri et al., FSE’07]Klee [Cadar et al., OSDI’08]

SAT/SMTsolver

Solver-aided tools: debugging

12

Localize bad parts of the program.

x = 42 ⋀ safe(P(x))

P(x) {v = x + 2…

}assert safe(P(x))

42

BugAssist [Jose & Majumdar, PLDI’11]Angelina [Chandra et al., ICSE’11]

SAT/SMTsolver

Solver-aided tools: debugging

12

min core

Localize bad parts of the program.

x = 42 ⋀ safe(P(x))

P(x) {v = x + 2…

}assert safe(P(x))

x + 2

42

expressions

BugAssist [Jose & Majumdar, PLDI’11]Angelina [Chandra et al., ICSE’11]

Solver-aided tools: angelic execution

13

Find values that repair the failing execution.

∃v . safe(P(42, v)) SAT/SMTsolver

P(x) {v = choose()…

}assert safe(P(x))

42

Kaplan [Koksal et al, POPL’12]PBnJ [Samimi et al., ECOOP’10]Squander [Milicevic et al., ICSE’11]

Solver-aided tools: angelic execution

13

Find values that repair the failing execution.

∃v . safe(P(42, v))

modelvalues

SAT/SMTsolver

P(x) {v = choose()…

}assert safe(P(x))

42 40

Kaplan [Koksal et al, POPL’12]PBnJ [Samimi et al., ECOOP’10]Squander [Milicevic et al., ICSE’11]

P(x) {v = ?? …

}assert safe(P(x))

Solver-aided tools: synthesis

14

Synthesize code that repairs the program.

∃e . ∀x . safe(Pe(x)) SAT/SMTsolver

Sketch [Solar-Lezama et al., ASPLOS’06]Comfusy [Kuncak et al., CAV’10]

P(x) {v = ?? …

}assert safe(P(x))

Solver-aided tools: synthesis

14

Synthesize code that repairs the program.

∃e . ∀x . safe(Pe(x)) SAT/SMTsolver

x − 2

modelexpressions

Sketch [Solar-Lezama et al., ASPLOS’06]Comfusy [Kuncak et al., CAV’10]

wantedmore solver-aided tools …

Building solver-aided tools: state-of-the-art

16

tools expert

execute synth


16

learn the problem domain

I need a tool to create models of biological cells …

tools expert domain expert

execute synth


16


design a domain language


Abstractions for cells, components, interactions, …


execute synth

build a symbolic compiler from the domain language to constraints


16



months or years of work



verify debug

execute synth

A solver-aided tool for creating biological models

Can we do better?

17


weeks

domain expert

verify debug

execute synth

implement an interpreter for the language, get a symbolic compiler for free

Can we do better?

17


weeks

domain expert

a solver-aided host language

a solver-aided domain-specific language (SDSL)

verify debug

execute synth

implement an interpreter for the language, get a symbolic compiler for free

designsolver-aided languages

domain-specific language (DSL)

Layers of languages

19

host language

A formal language that is specialized to a particular application domain and often limited in capability.

A high-level language for implementing DSLs, usually with meta-programming features.

interpreterlibrary

Scala, Racket, JavaScript


artificial intelligenceChurch, BLOG

databasesSQL, Datalog

hardware designBluespec, Chisel, Verilog, VHDL

math and statisticsEigen, Matlab, R

layout and visualizationLaTex, dot, dygraphs, D3

Layers of languages

19

host language

interpreterlibrary


Layers of languages

19

host language

C = A * B

C / Java

Eigen / Matlab

[associativity]C = A * B

for (i = 0; i < n; i++) for (j = 0; j < m; j++) for (k = 0; k < p; k++) C[i][k] += A[i][j] * B[j][k]

interpreterlibrary

solver-aided domain-specific language (SDSL)

Layers of solver-aided languages

20

solver-aided host language

symbolic virtual machine

interpreterlibrary



20



ROSETTE[Torlak & Bodik, Onward’13, PLDI’14]

interpreterlibrary

spatial programmingChlorophyll

data-parallel programmingSynthCL

web scrapingWebSynth

secure stack machinesIFC



20



ROSETTE[Torlak & Bodik, Onward’13, PLDI’14]

interpreterlibrary

deve

lopm

ent

time

(wee

ks)

0

4

8

12

16

Chlorophyll SynthCL WebSynth IFC

SDSLs developed with ROSETTE

21

(first-year grad) (expert) (undergrad) (expert)

deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Spatial programming for a low-power chip, using synthesis to partition code and data across 144 tiny cores.


21


GreenArrays GA144

x + z

deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Spatial programming for a low-power chip, using synthesis to partition code and data across 144 tiny cores.

Optimal partitioning synthesized in minutes, while manual partitioning takes days [Phothilimthana et al., PLDI’14].


21


GreenArrays GA144

x + zx + zx + z

deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Verification and synthesis for data-parallel programming with OpenCL.


21


deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Verification and synthesis for data-parallel programming with OpenCL.

Used by a novice to develop new vectorized kernels that are as fast as expert code.


21


deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Synthesis of web scraping scripts from examples (PBE).


21


deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Synthesis of web scraping scripts from examples (PBE).Works on real web pages (e.g., iTunes) in seconds.


21


deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Verification for executable specifications of secure stack machines.


21


deve

lopm

ent

time

(wee

ks)

0

4

8

12

16


Verification for executable specifications of secure stack machines.

Finds all bugs reported by a specialized tool [Hritcu et al., ICFP’13].


21


Modern descendent of Scheme with macro-based metaprogramming.

Anatomy of a solver-aided host language

22

Racket

ROSETTE

Anatomy of a solver-aided host language

22

(define-symbolic id type)

(assert expr)

(verify expr) (debug [expr] expr) (solve expr) (synthesize [expr] expr)

A tiny example SDSL

23

def bvmax(r0, r1) : r2 = bvge(r0, r1) r3 = bvneg(r2) r4 = bvxor(r0, r2) r5 = bvand(r3, r4) r6 = bvxor(r1, r5) return r6

BV: A tiny assembly-like language for writing fast, low-level library functions.

debugsynth

A tiny example SDSL

23



test verify

debugsynth

A tiny example SDSL

23



test verify

debugsynth

1. interpreter [10 LOC]

2. verifier [free]

3. debugger [free]

4. synthesizer [free]


> bvmax(-2, -1)

A tiny example SDSL:

24

ROSETTE


> bvmax(-2, -1)


24

(define bvmax `((2 bvge 0 1) (3 bvneg 2) (4 bvxor 0 2) (5 bvand 3 4) (6 bvxor 1 5)))

parse

ROSETTE


> bvmax(-2, -1)


24


parse

ROSETTE

(out opcode in ...)



> bvmax(-2, -1) -1

(define (interpret prog inputs) (make-registers prog inputs) (for ([stmt prog]) (match stmt [(list out opcode in ...) (define op (eval opcode)) (define args (map load in)) (store out (apply op args))])) (load (last)))


25

ROSETTE

interpret

(define bvmax `((2 bvge 0 1) (3 bvneg 2) (4 bvxor 0 2) (5 bvand 3 4) (6 bvxor 1 5))) `(-2 -1)


> bvmax(-2, -1) -1



25

ROSETTE

interpret


0 -21 -12 03 04 -25 06 -1


> bvmax(-2, -1) -1



25

ROSETTE

interpret


0 -21 -12 03 04 -25 06 -1

(2 bvge 0 1)


> bvmax(-2, -1) -1



25

ROSETTE

interpret


0 -21 -12 03 04 -25 06 -1

(2 bvge 0 1)(define bvmax `((2 bvge 0 1) (3 bvneg 2) (4 bvxor 0 2) (5 bvand 3 4) (6 bvxor 1 5)))


> bvmax(-2, -1) -1


26

ROSETTE


‣ pattern matching‣ dynamic evaluation‣ first-class &

higher-order procedures

‣ side effects


(define-symbolic n0 n1 number?) (define inputs (list n0 n1)) (verify (assert (= (interpret bvmax inputs) (interpret max inputs))))


> verify(bvmax, max) (0, -2)

> bvmax(0, -2) -1


27

ROSETTE

query





> bvmax(0, -2) -1


27

ROSETTE

Creates two fresh symbolic constants of type number and binds them to variables n0 and n1.

query






> bvmax(0, -2) -1


27

ROSETTE

Symbolic values can be used just like concrete values of the same type.

query







> bvmax(0, -2) -1


27

ROSETTE

(verify expr) searches for a concrete interpretation of symbolic constants that causes expr to fail.

query







> bvmax(0, -2) -1


27

ROSETTE

query

(define inputs (list 0 -2)) (debug [input-register?] (assert (= (interpret bvmax inputs) (interpret max inputs))))


> debug(bvmax, max, (0, -2))


28

ROSETTE

query

(define-symbolic n0 n1 number?) (define inputs (list n0 n1)) (synthesize [inputs] (assert (= (interpret bvmax inputs) (interpret max inputs)))))

def bvmax(r0, r1) : r2 = bvge(r0, r1) r3 = bvneg(r2) r4 = bvxor(??, ??) r5 = bvand(r3, ??) r6 = bvxor(??, ??) return r6

> synthesize(bvmax, max)


29

ROSETTE

query

(define-symbolic n0 n1 number?) (define inputs (list n0 n1)) (synthesize [inputs] (assert (= (interpret bvmax inputs) (interpret max inputs)))))

def bvmax(r0, r1) : r2 = bvge(r0, r1) r3 = bvneg(r2) r4 = bvxor(??, ??) r5 = bvand(r3, ??) r6 = bvxor(??, ??) return r6

> synthesize(bvmax, max)



29

ROSETTE

query

techsymbolic virtual machine (SVM)

ROSETTE

How it all works: a big picture view

31

symbolicvirtual machine

SDSL

program

query

solver

[Torlak & Bodik, Onward’13]

[Torlak & Bodik, PLDI’14]

ROSETTE


31


SDSL

program

result

solver



ROSETTE


31


SDSL

program

result

solver

‣ pattern matching‣ dynamic evaluation‣ first-class procedures ‣ higher-order procedures‣ side effects‣ macros

theory of bitvectors



(3, 1, -2) (1, 3)

Translation to constraints by example

32

solve: ps = () for v in vs: if v > 0: ps = insert(v, ps) assert len(ps) == len(vs)

reverse and filter, keeping only positive numbers

vs ps

(3, 1, -2) (1, 3)


32


vs ps


32


vs psconstraints

a>0 ∧ b>0 (a, b)


32


vs psconstraints

Design space of precise symbolic encodings

33

symbolic execution

bounded model checkingsolve: ps = () for v in vs: if v > 0: ps = insert(v, ps) assert len(ps) == len(vs)

{ }a > 0b ≤ 0false


33

a > 0

b ≤ 0

ps ↦ (a)

ps ↦ (a)

vs ↦ (a, b)ps ↦ ( )

symbolic execution


{ }a > 0b ≤ 0false

∨ ∨ ∨


33

a > 0

b ≤ 0

ps ↦ (a)

ps ↦ (a)

vs ↦ (a, b)ps ↦ ( )

b > 0b > 0

ps ↦ (b) ps ↦ (b, a)

{ }a ≤ 0b > 0false

{ }a > 0b > 0true

a ≤ 0

b ≤ 0

ps ↦ ( )

ps ↦ ( )

{ }a ≤ 0b ≤ 0false

symbolic execution


{ }a > 0b ≤ 0false

∨ ∨ ∨


33

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)

ps ↦ ps0

a > 0a ≤ 0

ps0 = ite(a > 0, (a), ( ))ps1 = insert(b, ps0)ps2 = ite(b > 0, ps0, ps1)assert len(ps2) = 2

a > 0

b ≤ 0

ps ↦ (a)

ps ↦ (a)

vs ↦ (a, b)ps ↦ ( )

b > 0b > 0

ps ↦ (b) ps ↦ (b, a)

{ }a ≤ 0b > 0false

{ }a > 0b > 0true

a ≤ 0

b ≤ 0

ps ↦ ( )

ps ↦ ( )

{ }a ≤ 0b ≤ 0false

symbolic execution

bounded model checking

ps ↦ ( )


{ }a > 0b ≤ 0false

∨ ∨ ∨


33

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)

ps ↦ ps0

a > 0a ≤ 0


a > 0

b ≤ 0

ps ↦ (a)

ps ↦ (a)

vs ↦ (a, b)ps ↦ ( )

b > 0b > 0

ps ↦ (b) ps ↦ (b, a)

{ }a ≤ 0b > 0false

{ }a > 0b > 0true

a ≤ 0

b ≤ 0

ps ↦ ( )

ps ↦ ( )

{ }a ≤ 0b ≤ 0false

symbolic execution


ps ↦ ( )

ps ↦ ps1

b > 0


{ }a > 0b ≤ 0false

∨ ∨ ∨


33

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)

ps ↦ ps0

a > 0a ≤ 0


a > 0

b ≤ 0

ps ↦ (a)

ps ↦ (a)

vs ↦ (a, b)ps ↦ ( )

b > 0b > 0

ps ↦ (b) ps ↦ (b, a)

{ }a ≤ 0b > 0false

{ }a > 0b > 0true

a ≤ 0

b ≤ 0

ps ↦ ( )

ps ↦ ( )

{ }a ≤ 0b ≤ 0false

symbolic execution


ps ↦ ( )

ps ↦ ps1

ps ↦ ps2

b > 0b ≤ 0

ps ↦ ps0


A new design: type-driven state merging

34

{ }a > 0b > 0true


Merge values of ‣ primitive types: symbolically‣ immutable types: structurally‣ all other types: via unions


34

{ }a > 0b > 0true



ba


34

{ }a > 0b > 0true


⁊g g

c


ba (c, d)(a, b)


34

{ }a > 0b > 0true


⁊g g

c(e, f)


ba (c, d)


34

{ }a > 0b > 0true


⁊g g

c(e, f){ ¬g ⊦ a, g ⊦ () }

()



35



a > 0a ≤ 0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )



Symbolic union: a set of guarded values, with disjoint guards.

g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1

c = ite(g1, b, a)assert g2

a > 0a ≤ 0 g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }


Execute insert concretely on all lists in the union.

g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1


a > 0a ≤ 0

g1

g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g0 ⊦ (b, a), ¬g0 ⊦ (b) }


g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1


a > 0a ≤ 0

¬ g1 g1

g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g0 ⊦ (b, a), ¬g0 ⊦ (b) }

ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }


g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1


a > 0a ≤ 0

¬ g1 g1

g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g0 ⊦ (b, a), ¬g0 ⊦ (b) }

ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g2 ⊦ (b, a), g3 ⊦ (c), g4 ⊦ ( ) }


Evaluate len concretely on all lists in the union; assertion true only on the list guarded by g2.

g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1


a > 0a ≤ 0

¬ g1 g1

g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g0 ⊦ (b, a), ¬g0 ⊦ (b) }

ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g2 ⊦ (b, a), g3 ⊦ (c), g4 ⊦ ( ) }


g0 = a > 0g1 = b > 0 g2 = g0 ∧ g1

g3 = ¬(g0 ⇔ g1)g4 = ¬g0 ∧ ¬g1


a > 0a ≤ 0

¬ g1 g1

g0¬ g0


35

vs ↦ (a, b)ps ↦ ( )

ps ↦ (a)ps ↦ ( )


ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g0 ⊦ (b, a), ¬g0 ⊦ (b) }

ps ↦ { g0 ⊦ (a), ¬g0 ⊦ ( ) }

ps ↦ { g2 ⊦ (b, a), g3 ⊦ (c), g4 ⊦ ( ) }

concrete evaluation

polynomial encoding

Effectiveness of type-driven state merging

36

Merging performance for verification and synthesis queries in SynthCL, WebSynth and IFC programs

0

10000

20000

30000

40000

number of control flow joins

0 4500 9000 13500 18000

R² = 0.9884

R² = 0.95

number of unionssize of all unions

Effectiveness of type-driven state merging

37

SVM and solving time for verification and synthesis queries in SynthCL, WebSynth and IFC programs

runn

ing

time

(sec

)

0

75

150

225

300

FWT

3 B1 B2 J2 B3

MM

1 J1

FWT

1 B4 SF3

CR

1

CR

2

CR

3

FWT

4

CR

4

MM

2

SF1

FWT

2

iTun

es

IMD

b

MM

3

AlA

n

SF4

SF2

SVMZ3

futureadvanced programming for everyone


Where next?

39

less code

less time

less effort

web scraping scriptssecure stack machines

spatial programs

data-parallel programs

advanced solver-aided languagessolver-aided languages

Where next?

39

less code

less time

less effort

new kinds of programs

harder programs

Keeping the programmer in the loop

40

SAT/SMTsolverSVM

SDSL program?verify debugexecute synth


40

SAT/SMTsolverSVM


domain properties, invariants, insight


40

SAT/SMTsolverSVM



??


40

SAT/SMTsolverSVM



symbolic profiling

??

recursive fibonacci

dynamic programming fibonacci ✘✓

Keeping the system in the loop

41

SAT/SMTsolverSVM

?verify debugexecute synth


SDSL program

symbolic design patterns

Keeping the system in the loop

41

SAT/SMTsolverSVM



SDSL program

Domain-specific solvers

42


Sometimes you need a special-purpose solver …

SDSL program

Domain-specific solvers for everyone

43


synthesis of domain-specific solvers

So long, and thanks for all the fish!

computer-aided reasoning for software cse507...building solver-aided tools: state-of-the-art 16...

Documents