| Home | • | Docs | • | Download | • | • | FAQ | • | Awards | • | Status | • | MSR |
|---|
An Efficient SMT Solver
| |
L_FALSE |
| |
L_UNDEF |
| |
L_TRUE |
| |
INT_SYMBOL |
| |
STRING_SYMBOL |
| |
UNINTERPRETED_TYPE |
| |
BOOL_TYPE |
| |
INT_TYPE |
| |
REAL_TYPE |
| |
BV_TYPE |
| |
ARRAY_TYPE |
| |
TUPLE_TYPE |
| |
UNKNOWN_TYPE |
| |
NUMERAL_AST |
| |
CONST_DECL_AST |
| |
CONST_AST |
| |
TYPE_AST |
| |
VAR_AST |
| |
PATTERN_AST |
| |
QUANTIFIER_AST |
| |
UNKNOWN_AST |
| |
OP_TRUE |
| |
OP_FALSE |
| |
OP_EQ |
| |
OP_DISTINCT |
| |
OP_ITE |
| |
OP_AND |
| |
OP_OR |
| |
OP_IFF |
| |
OP_XOR |
| |
OP_NOT |
| |
OP_IMPLIES |
| |
OP_LE |
| |
OP_GE |
| |
OP_LT |
| |
OP_GT |
| |
OP_ADD |
| |
OP_SUB |
| |
OP_UMINUS |
| |
OP_MUL |
| |
OP_DIV |
| |
OP_IDIV |
| |
OP_REM |
| |
OP_MOD |
| |
OP_STORE |
| |
OP_SELECT |
| |
OP_CONST_ARRAY |
| |
OP_ARRAY_DEFAULT |
| |
OP_STORE_ITE |
| |
OP_SET_UNION |
| |
OP_SET_INTERSECT |
| |
OP_SET_DIFFERENCE |
| |
OP_SET_COMPLEMENT |
| |
OP_SET_SUBSET |
| |
OP_BIT1 |
| |
OP_BIT0 |
| |
OP_BNEG |
| |
OP_BADD |
| |
OP_BSUB |
| |
OP_BMUL |
| |
OP_BSDIV |
| |
OP_BUDIV |
| |
OP_BSREM |
| |
OP_BUREM |
| |
OP_BSMOD |
| |
OP_BSDIV0 |
| |
OP_BUDIV0 |
| |
OP_BSREM0 |
| |
OP_BUREM0 |
| |
OP_BSMOD0 |
| |
OP_ULEQ |
| |
OP_SLEQ |
| |
OP_UGEQ |
| |
OP_SGEQ |
| |
OP_ULT |
| |
OP_SLT |
| |
OP_UGT |
| |
OP_SGT |
| |
OP_BAND |
| |
OP_BOR |
| |
OP_BNOT |
| |
OP_BXOR |
| |
OP_BNAND |
| |
OP_BNOR |
| |
OP_BXNOR |
| |
OP_CONCAT |
| |
OP_SIGN_EXT |
| |
OP_ZERO_EXT |
| |
OP_EXTRACT |
| |
OP_REPEAT |
| |
OP_BREDOR |
| |
OP_BREDAND |
| |
OP_BCOMP |
| |
OP_BSHL |
| |
OP_BLSHR |
| |
OP_BASHR |
| |
OP_ROTATE_LEFT |
| |
OP_ROTATE_RIGHT |
| |
OP_INT2BV |
| |
OP_BV2INT |
| |
OP_UNINTERPRETED |
| |
BOOL_VALUE |
| |
NUMERAL_VALUE |
| |
ARRAY_VALUE |
| |
TUPLE_VALUE |
| |
UNKNOWN_VALUE |
Create configuration
|
Configurations are created in order to assign parameters prior to creating contexts for Z3 interaction. For example, if the users whishes to use model generation, then call:
set_param_value cfg "MODEL" "true"
Z3.mk_context_x instead of using
explicit configuration objects. The function Z3.mk_context_x
receives an array of string pairs. This array represents the
configuration options.
Z3.set_param_value
Z3.del_configThe list of all configuration parameters can be obtained using the Z3 executable:
z3.exe -ini?
Z3.mk_configCreate context
|
After a context is created, the configuration cannot be changed. All main interaction with Z3 happens in the context of a context.
Z3.mk_context_x instead of using
explicit configuration objects. The function Z3.mk_context_x
receives an array of string pairs. This array represents the
configuration options.
Z3.del_contextWhen trace messages are enabled, Z3 will record the operations performed on a context in the given file file. Return TRUE if the file was opened successfully, and FALSE otherwise.
Z3.trace_off
Z3.trace_to_file
Z3.trace_to_stdout
Z3.trace_to_stderrTheories
|
Symbols
|
Symbols are used to name several term and type constructors.
Z3.mk_string_symbolSymbols are used to name several term and type constructors.
Z3.mk_int_symbolTypes
|
Two free types are considered the same iff the have the same name.
This type is used to create propositional variables and predicates.
This type is not the int type found in programming languages.
A machine integer can be represented using bit-vectors. The function
Z3.mk_bv_type creates a bit-vector type.
Z3.mk_bv_type
This type is not a floating point number.
Z3 does not have support for floating point numbers yet.
This type can also be seen as a machine integer.
We usually represent the array type as: domain -> range .
Arrays are usually used to model the heap/memory in software verification.
Z3.mk_select
Z3.mk_storecontext ->
symbol ->
symbol array ->
type_ast array ->
type_ast * const_decl_ast * const_decl_ast array
mk_tuple_type c name field_names field_types creates a tuple with a constructor named name,
a n fields, where n is the size of the arrays field_names and field_types.
Constants and Applications
|
mk_func_decl c n d r creates a function with name n, domain d, and range r.
The arity of the function is the size of the array d.
After declaring a constant or function, the function
Z3.mk_app can be used to create a constant or function
application.
Z3.mk_app
mk_const c s t is a shorthand for mk_app c (mk_func_decl c s [||] t) [||]
Z3.mk_func_decl
Z3.mk_app
A label behaves as an identity function, so the truth value of the
labeled formula is unchanged. Labels are used for identifying
useful sub-formulas when generating counter-examples.
Z3 will generate an unique name for this function declaration.
Z3.mk_func_decl
mk_fresh_const c p t is a shorthand for mk_app c (mk_fresh_func_decl c p [||] t) [||].
Z3.mk_func_decl
Z3.mk_app mk_eq c l r ]
Create an AST node representing l = r .
The nodes l and r must have the same type.
mk_distinct c [| t_1; ...; t_n |] ] Create an AST
node represeting a distinct construct. It is used for declaring
the arguments t_i pairwise distinct.
All arguments must have the same type.
mk_not c a ]
Create an AST node representing not(a) .
The node a must have Boolean type.
mk_ite c t1 t2 t2 ]
Create an AST node representing an if-then-else: ite(t1, t2,
t3) .
The node t1 must have Boolean type, t2 and t3 must have the same type.
The type of the new node is equal to the type of t2 and t3.
mk_iff c t1 t2 ]
Create an AST node representing t1 iff t2 .
The nodes t1 and t2 must have Boolean type.
mk_implies c t1 t2 ]
Create an AST node representing t1 implies t2 .
The nodes t1 and t2 must have Boolean type.
mk_xor c t1 t2 ]
Create an AST node representing t1 xor t2 .
The nodes t1 and t2 must have Boolean type.
mk_and c [| t_1; ...; t_n |] ] Create the conjunction: t_1 and ... and t_n.
All arguments must have Boolean type.
mk_or c [| t_1; ...; t_n |] ] Create the disjunction: t_1 or ... or t_n.
All arguments must have Boolean type.
mk_add c [| t_1; ...; t_n |] ] Create the term: t_1 + ... + t_n.
All arguments must have int or real type.
mk_mul c [| t_1; ...; t_n |] ] Create the term: t_1 * ... * t_n.
All arguments must have int or real type.
mk_sub c [| t_1; ...; t_n |] ] Create the term: t_1 - ... - t_n.
All arguments must have int or real type.
mk_lt c t1 t2 ]
Create less than.
The nodes t1 and t2 must have the same type, and must be int or real.
mk_le c t1 t2 ]
Create less than or equal to.
The nodes t1 and t2 must have the same type, and must be int or real.
mk_gt c t1 t2 ]
Create greater than.
The nodes t1 and t2 must have the same type, and must be int or real.
mk_ge c t1 t2 ]
Create greater than or equal to.
The nodes t1 and t2 must have the same type, and must be int or real.
mk_bvneg c t1 ]
Bitwise negation.
The node t1 must have a bit-vector type.
mk_bvand c t1 t2 ]
Bitwise and.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvor c t1 t2 ]
Bitwise or.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvxor c t1 t2 ]
Bitwise exclusive-or.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvnand c t1 t2 ]
Bitwise nand.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvnor c t1 t2 ]
Bitwise nor.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvxnor c t1 t2 ]
Bitwise xnor.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvneg c t1 ]
Standard two's complement unary minus.
The node t1 must have bit-vector type.
mk_bvadd c t1 t2 ]
Standard two's complement addition.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsub c t1 t2 ]
Standard two's complement subtraction.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvmul c t1 t2 ]
Standard two's complement multiplication.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvudiv c t1 t2 ]
Unsigned division.
It is defined as the floor of t1/t2 if t2 is different from zero. If t2 is zero, then the result is undefined.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsdiv c t1 t2 ]
Two's complement signed division.
It is defined in the following way:
The nodes t1 and t2 must have the same bit-vector type.
mk_bvurem c t1 t2 ]
Unsigned remainder.
It is defined as t1 - (t1 /u t2) * t2 , where /u represents unsigned int division.
If t2 is zero, then the result is undefined.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsrem c t1 t2 ]
Two's complement signed remainder (sign follows dividend).
It is defined as t1 - (t1 /s t2) * t2 , where /s represents signed division. The most significant bit (sign) of the result is equal to the most significant bit of t1.
If t2 is zero, then the result is undefined.
The nodes t1 and t2 must have the same bit-vector type.
Z3.mk_bvsmod mk_bvsmod c t1 t2 ]
Two's complement signed remainder (sign follows divisor).
If t2 is zero, then the result is undefined.
The nodes t1 and t2 must have the same bit-vector type.
Z3.mk_bvsrem mk_bvult c t1 t2 ]
Unsigned less than.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvslt c t1 t2 ]
Two's complement signed less than.
It abbreviates:
(or (and (= (extract[|m-1|:|m-1|] s) bit1)
(= (extract[|m-1|:|m-1|] t) bit0))
(and (= (extract[|m-1|:|m-1|] s) (extract[|m-1|:|m-1|] t))
(bvult s t)))
The nodes t1 and t2 must have the same bit-vector type.
mk_bvule c t1 t2 ]
Unsigned less than or equal to.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsle c t1 t2 ]
Two's complement signed less than or equal to.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvuge c t1 t2 ]
Unsigned greater than or equal to.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsge c t1 t2 ]
Two's complement signed greater than or equal to.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvugt c t1 t2 ]
Unsigned greater than.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvsgt c t1 t2 ]
Two's complement signed greater than.
The nodes t1 and t2 must have the same bit-vector type.
mk_concat c t1 t2 ]
Concatenate the given bit-vectors.
The nodes t1 and t2 must have (possibly different) bit-vector types
The result is a bit-vector of size n1+n2 , where n1 (n2) is the size
of t1 (t2).
mk_extract c high low t1 ]
Extract the bits high down to low from a bitvector of
size m to yield a new bitvector of size n, where n =
high - low + 1 .
The node t1 must have a bit-vector type.
mk_sign_ext c i t1 ]
Sign-extend of the given bit-vector to the (signed) equivalent bitvector of
size m+i , where m is the size of the given
bit-vector.
The node t1 must have a bit-vector type.
mk_zero_ext c i t1 ]
Extend the given bit-vector with zeros to the (unsigned int) equivalent
bitvector of size m+i , where m is the size of the
given bit-vector.
The node t1 must have a bit-vector type.
mk_bvshl c t1 t2 ]
Shift left.
It is equivalent to multiplication by 2^x where x is the value of the third argument.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvlshr c t1 t2 ]
Logical shift right.
It is equivalent to unsigned int division by 2^x where x is the value of the third argument.
The nodes t1 and t2 must have the same bit-vector type.
mk_bvashr c t1 t2 ]
Arithmetic shift right.
It is like logical shift right except that the most significant bits of the result always copy the most significant bit of the second argument.
The nodes t1 and t2 must have the same bit-vector type.
mk_rotate_left c i t1 ]
Rotate bits of t1 to the left i times.
The node t1 must have a bit-vector type.
mk_rotate_right c i t1 ]
Rotate bits of t1 to the right i times.
The node t1 must have a bit-vector type.
mk_select c a i ]
Array read.
The node a must have an array type domain -> range , and i must have the type domain.
The type of the result is range.
Z3.mk_array_type
Z3.mk_store mk_store c a i v ]
Array update.
The node a must have an array type domain -> range , i must have type domain,
v must have type range. The type of the result is domain -> range .
Z3.mk_array_type
Z3.mk_storeNumerals
|
This function can be use to create numerals that fit in a machine integer.
It is slightly faster than Z3.mk_numeral since it is not necessary to parse a string.
Z3.mk_numeral
This function can be use to create numerals that fit in a machine unsinged integer.
It is slightly faster than Z3.mk_numeral since it is not necessary to parse a string.
Z3.mk_numeralQuantifiers
|
Z3 uses pattern matching to instantiate quantifiers. If a pattern is not provided for a quantifier, then Z3 will automatically compute a set of patterns for it. However, for optimal performance, the user should provide the patterns.
Patterns comprise a list of terms. The list should be non-empty. If the list comprises of more than one term, it is a called a multi-pattern.
In general, one can pass in a list of (multi-)patterns in the quantifier constructor.
Z3.mk_forall
Z3.mk_existsBound variables are indexed by de-Bruijn indices. It is perhaps easiest to explain the meaning of de-Bruijn indices by indicating the compilation process from non-de-Bruijn formulas to de-Bruijn format.
abs(forall (x1) phi) = forall (x1) abs1(phi, x1, 0)
abs(forall (x1, x2) phi) = abs(forall (x1) abs(forall (x2) phi))
abs1(x, x, n) = b_n
abs1(y, x, n) = y
abs1(f(t1,...,tn), x, n) = f(abs1(t1,x,n), ..., abs1(tn,x,n))
abs1(forall (x1) phi, x, n) = forall (x1) (abs1(phi, x, n+1))
The last line is significant: the index of a bound variable is different depending on the scope in which it appears. The deeper x appears, the higher is its index.
Z3.mk_forall
Z3.mk_exists
mk_forall c w p t n b creates a forall formula, where
w is the weight, p is an array of patterns, t is an array
with the types of the bound variables, n is an array with the
'names' of the bound variables, and b is the body of the
quantifier. Quantifiers are associated with weights indicating
the importance of using the quantifier during
instantiation.
Z3.mk_pattern
Z3.mk_bound
Z3.mk_existsZ3.mk_forall.
Z3.mk_pattern
Z3.mk_bound
Z3.mk_forallcontext ->
bool ->
int ->
int ->
pattern_ast ->
int -> ast -> int -> type_ast -> symbol -> ast -> ast
Z3.mk_pattern
Z3.mk_bound
Z3.mk_forall
Z3.mk_existsAccessors
|
Z3.mk_int_symbol, and STRING_SYMBOL if the symbol
was constructed using Z3.mk_string_symbol. get_symbol_int c s ]
Return the symbol int value.
Z3.mk_int_symbol get_symbol_string c s ]
Return the symbol name.
Z3.mk_string_symbol
An expression is a constant, application, numeral, bound variable, or quantifier.
get_const_ast_num_args c a ]
Return the number of argument of an application. If t
is an constant, then the number of arguments is 0. get_const_ast_arg c a i ]
Return the i-th argument of the given application.
The AST node must be a constant, application, numeral, bound variable, or quantifier.
Z3.is_expr get_domain c d i ]
Return the type of the i-th parameter of the given function declaration.
Z3.get_domain_size get_range c d ]
Return the range of the given declaration.
If d is a constant (i.e., has zero arguments), then this
function returns the type of the constant.
get_bv_type_size c t ]
Return the size of the given bit-vector type.
Z3.mk_bv_type
Z3.get_type_kind get_array_type_domain c t ]
Return the domain of the given array type.
Z3.mk_array_type
Z3.get_type_kind get_array_type_range c t ]
Return the range of the given array type.
Z3.mk_array_type
Z3.get_type_kind get_tuple_type_mk_decl c t ]
Return the constructor declaration of the given tuple
type.
Z3.mk_tuple_type
Z3.get_type_kind get_tuple_type_num_fields c t ]
Return the number of fields of the given tuple type.
Z3.get_tuple_type, which
returns a tuple: tuple constructor, and an array of the tuple type fields.
Z3.mk_tuple_type
Z3.get_type_kind get_tuple_type_field_decl c t i ]
Return the i-th field declaration (i.e., projection function declaration)
of the given tuple type.
Z3.get_tuple_type, which
returns a tuple: tuple constructor, and an array of the tuple type fields.
Z3.mk_tuple_type
Z3.get_type_kind
Preturn TRUE if the numeral value fits in 64 bit numerals, FALSE otherwise.
Coercions
|
Z3.get_ast_kind returns CONST_AST.
Z3.get_ast_kind returns NUMERAL_AST.Constraints
|
The logical context can be viewed as a stack of contexts. The scope level is the number of elements on this stack. The stack of contexts is simulated using trail (undo) stacks.
Z3.pop
Restores the context from the top of the stack, and pops it off the
stack. Any changes to the logical context (by Z3.assert_cnstr or
other functions) between the matching Z3.push and pop
operators are flushed, and the context is completely restored to
what it was right before the Z3.push.
Z3.pushAfter one assertion, the logical context may become inconsistent.
The functions Z3.check or Z3.check_and_get_model should be
used to check whether the logical context is consistent or not.
Z3.check
Z3.check_and_get_model
If the logical context is not unsatisfiable (i.e., the return value is different from L_FALSE)
and model construction is enabled (see Z3.mk_config), then a model is stored in m. Otherwise,
the value 0 is stored in m.
The caller is responsible for deleting the model using the function Z3.del_model.
Z3.mk_config).
Z3.check
Z3.del_model
The function Z3.check_and_get_model should be used when models are needed.
Z3.check_and_get_model
Provides an interface to the AST simplifier used by Z3.
It allows clients to piggyback on top of the AST simplifier
for their own term manipulation.
Z3.del_labels
Z3.get_num_labels
Z3.get_label_symbolThe disabled label is not going to be used when blocking the subsequent search.
Z3.block_labelsModel navigation
|
Z3.get_model_constants.
Z3.get_model_constant get_model_constant c m i ]
Return the i-th constant in the given model.
Z3.get_model_constants.
Z3.get_value
Z3.get_value_kind
Z3.get_value_type
NUMERAL_VALUE stores the value of different types (int, real, bv, and uninterpreted).
get_numeral_value_string c v ]
Return a numeral value as a string. The representation is stored in decimal notation.
Z3.get_value_kind get_numeral_value_int c v ]
Similar to Z3.get_numeral_value_string, but only succeeds if
the value can fit in a machine int. Return TRUE if the call succeeded.
Z3.get_numeral_value_string get_numeral_value_uint c v ]
Similar to Z3.get_numeral_value_string, but only succeeds if
the value can fit in a machine unsigned int int. Return TRUE if the call succeeded.
Z3.get_numeral_value_string get_bool_value_bool c v ]
Return the value of v as a Boolean value.
Z3.get_value_kind get_tuple_value_mk_decl c v ]
Return the constructor declaration of the given tuple
value.
Z3.get_tuple_value.
Z3.get_value_kind get_tuple_value_num_fields c v ]
Return the number of fields of the given tuple value.
Z3.get_tuple_value.
Z3.get_value_kind get_tuple_value_field c v i ]
Return the i-th field of the given tuple value.
Z3.get_tuple_value.
Z3.get_value_kind get_array_value_size c v ]
An array values is represented as a dictionary plus a
default (else) value. This function returns the size of the
dictionary.
Z3.get_array_value.
Z3.get_value_kind get_array_value_else c v ]
An array values is represented as a dictionary plus a
default (else) value. This function returns the default (else) value.
Z3.get_array_value.
Z3.get_value_kind get_array_value_entry_index c v i ]
An array values is represented as a dictionary plus a
default (else) value. Each dictionary entry is a pair (index, value).
This function return the i-th index of the array.
If v contains an entry (index, value), then
v[index] = value.
Z3.get_array_value.
Z3.get_value_kind get_array_value_entry_value c v i ]
An array values is represented as a dictionary plus a
default (else) value. Each dictionary entry is a pair (index, value).
This function return the i-th value of the array.
If v contains an entry (index, value), then
v[index] = value.
Z3.get_array_value.
Z3.get_value_kindA function interpretation is represented as a finite map and an 'else' value. Each entry in the finite map represents the value of a function given a set of arguments.
Z3.get_model_funcs.
Z3.get_model_func_decl
Z3.get_model_func_else
Z3.get_model_func_num_entries
Z3.get_model_func_entry_num_args
Z3.get_model_func_entry_arg is_model_func_internal c m i ]
Return true if the i-th function in the model is \em internal.
Internal functions are created by Z3, and their interpretations are not usually useful for users.
Z3.get_model_funcs.
Z3.get_model_num_funcs get_model_func_decl c m i ]
Return the declaration of the i-th function in the given model.
Z3.get_model_funcs.
Z3.get_model_num_funcs get_model_func_else c m i ]
Return the 'else' value of the i-th function interpretation in the given model.
A function interpretation is represented as a finite map and an 'else' value.
Z3.get_model_funcs.
Z3.get_model_num_funcs
Z3.get_model_func_num_entries
Z3.get_model_func_entry_num_args
Z3.get_model_func_entry_arg get_model_func_num_entries c m i ]
Return the number of entries of the i-th function interpretation in the given model.
A function interpretation is represented as a finite map and an 'else' value.
Z3.get_model_funcs.
Z3.get_model_num_funcs
Z3.get_model_func_else
Z3.get_model_func_entry_num_args
Z3.get_model_func_entry_arg get_model_func_entry_num_args c m i j ]
Return the number of arguments of the j-th entry of the i-th function interpretation in the given
model.
A function interpretation is represented as a finite map and an 'else' value. This function returns the j-th entry of this map.
An entry represents the value of a function given a set of arguments.
Z3.get_model_funcs.
Z3.get_model_num_funcs
Z3.get_model_func_num_entries
Z3.get_model_func_entry_arg