Results 1  10
of
29
A Fast LinearArithmetic Solver for DPLL(T
, 2006
"... Abstract. We present a new Simplexbased linear arithmetic solver that can be integrated efficiently in the DPLL(T) framework. The new solver improves over existing approaches by enabling fast backtracking, supporting a priori simplification to reduce the problem size, and providing an efficient for ..."
Abstract

Cited by 182 (9 self)
 Add to MetaCart
Abstract. We present a new Simplexbased linear arithmetic solver that can be integrated efficiently in the DPLL(T) framework. The new solver improves over existing approaches by enabling fast backtracking, supporting a priori simplification to reduce the problem size, and providing an efficient form of theory propagation. We also present a new and simple approach for solving strict inequalities. Experimental results show substantial performance improvements over existing tools that use other Simplexbased solvers in DPLL(T) decision procedures. The new solver is even competitive with stateoftheart tools specialized for the difference logic fragment. 1
Lazy Satisfiability Modulo Theories
 Journal on Satisfiability, Boolean Modeling and Computation
, 2007
"... Satisfiability Modulo Theories (SMT) is the problem of deciding the satisfiability of a firstorder formula with respect to some decidable firstorder theory T (SMT (T)). These problems are typically not handled adequately by standard automated theorem provers. SMT is being recognized as increasingl ..."
Abstract

Cited by 74 (32 self)
 Add to MetaCart
Satisfiability Modulo Theories (SMT) is the problem of deciding the satisfiability of a firstorder formula with respect to some decidable firstorder theory T (SMT (T)). These problems are typically not handled adequately by standard automated theorem provers. SMT is being recognized as increasingly important due to its applications in many domains in different communities, in particular in formal verification. An amount of papers with novel and very efficient techniques for SMT has been published in the last years, and some very efficient SMT tools are now available. Typical SMT (T) problems require testing the satisfiability of formulas which are Boolean combinations of atomic propositions and atomic expressions in T, so that heavy Boolean reasoning must be efficiently combined with expressive theoryspecific reasoning. The dominating approach to SMT (T), called lazy approach, is based on the integration of a SAT solver and of a decision procedure able to handle sets of atomic constraints in T (Tsolver), handling respectively the Boolean and the theoryspecific components of reasoning. Unfortunately, neither the problem of building an efficient SMT solver, nor even that of acquiring a comprehensive background knowledge in lazy SMT, is of simple solution. In this paper we present an extensive survey of SMT, with particular focus on the lazy approach. We survey, classify and analyze from a theoryindependent perspective the most effective techniques and optimizations which are of interest for lazy SMT and which have been proposed in various communities; we discuss their relative benefits and drawbacks; we provide some guidelines about their choice and usage; we also analyze the features for SAT solvers and Tsolvers which make them more suitable for an integration. The ultimate goals of this paper are to become a source of a common background knowledge and terminology for students and researchers in different areas, to provide a reference guide for developers of SMT tools, and to stimulate the crossfertilization of techniques and ideas among different communities.
The yices smt solver
, 2006
"... Abstract. SMT stands for Satisfiability Modulo Theories. An SMT solver decides the satisfiability of propositionally complex formulas in theories such as arithmetic and uninterpreted functions with equality. SMT solving has numerous applications in automated theorem proving, in hardware and software ..."
Abstract

Cited by 47 (0 self)
 Add to MetaCart
Abstract. SMT stands for Satisfiability Modulo Theories. An SMT solver decides the satisfiability of propositionally complex formulas in theories such as arithmetic and uninterpreted functions with equality. SMT solving has numerous applications in automated theorem proving, in hardware and software verification, and in scheduling and planning problems. This paper describes Yices, an efficient SMT solver developed at SRI International. Yices supports a rich combination of firstorder theories that occur frequently in software and hardware modeling: arithmetic, uninterpreted functions, bit vectors, arrays, recursive datatypes, and more. Beyond pure SMT solving, Yices can solve weighted MAXSMT problems, compute unsatisfiable cores, and construct models. Yices is the main decision procedure used by the SAL model checking environment, and it is being integrated to the PVS theorem prover. As a MAXSMT solver, Yices is the main component of the probabilistic consistency engine used in SRI’s CALO system. 1
Delayed theory combination vs. NelsonOppen for satisfiability modulo theories: A comparative analysis
 IN PROC. LPAR’06, VOLUME 4246 OF LNAI
, 2006
"... Many approaches for Satisfiability Modulo Theory (SMT(T)) rely on the integration between a SAT solver and a decision procedure for sets of literals in the background theory T (Tsolver). When T is the combination T1 ∪ T2 of two simpler theories, the approach is typically handled by means of Nelson ..."
Abstract

Cited by 20 (7 self)
 Add to MetaCart
Many approaches for Satisfiability Modulo Theory (SMT(T)) rely on the integration between a SAT solver and a decision procedure for sets of literals in the background theory T (Tsolver). When T is the combination T1 ∪ T2 of two simpler theories, the approach is typically handled by means of NelsonOppen’s (NO) theory combination schema in which two specific Tsolvers deduce and exchange (disjunctions of) interface equalities. In recent papers we have proposed a new approach to SMT(T1 ∪ T2), called Delayed Theory Combination (DTC). Here part or all the (possibly very expensive) task of deducing interface equalities is played by the SAT solver itself, at the potential cost of an enlargement of the boolean search space. In principle this enlargement could be up to exponential in the number of interface equalities generated. In this paper we show that this estimate was too pessimistic. We present a comparative analysis of DTC vs. NO for SMT(T1 ∪T2), which shows that, using stateoftheart SATsolving techniques, the amount of boolean branches performed by DTC can be upper bounded by the number of deductions and boolean branches performed by NO on the same problem. We prove the result for different deduction capabilities of the Tsolvers and for both convex and nonconvex theories.
The MathSAT 3 system
 Automated Deduction: Proceedings of the 20th International Conference, volume 3632 of Lecture Notes in Computer Science
, 2005
"... Satisfiability Modulo Theories (SMT) can be seen as an extended form of propositional satisfiability, where propositions are either simple boolean propositions or quantifierfree atomic constraints in a specific theory. In this paper we present MATHSAT version 3 [6,7,8], a DPLLbased decision procedu ..."
Abstract

Cited by 17 (1 self)
 Add to MetaCart
Satisfiability Modulo Theories (SMT) can be seen as an extended form of propositional satisfiability, where propositions are either simple boolean propositions or quantifierfree atomic constraints in a specific theory. In this paper we present MATHSAT version 3 [6,7,8], a DPLLbased decision procedure for the SMT problem for various theories,
Lemmas on Demand for the Extensional Theory of Arrays
 In Proc. SMT’08. ACM
, 2008
"... The quantifierfree extensional theory of arrays TA plays an important role in hardware and software verification. In this article we present a novel decision procedure that refines formula abstractions with lemmas on demand. We consider the case where TA is combined with a decidable quantifierfree ..."
Abstract

Cited by 11 (3 self)
 Add to MetaCart
The quantifierfree extensional theory of arrays TA plays an important role in hardware and software verification. In this article we present a novel decision procedure that refines formula abstractions with lemmas on demand. We consider the case where TA is combined with a decidable quantifierfree firstorder theory TB. Unlike traditional lazy SMT approaches, where lemmas are added on the boolean abstraction layer, our decision procedure adds lemmas in TB. We discuss our decision procedure in detail. In particular, we prove soundness and completeness, and discuss complexity. We present our decision procedure in a generic context and provide implementation details and optimizations, in particular for bitvectors. Finally, we report on experiments and discuss related work. Keywords: SMT, arrays, bitvectors, decision procedures
Verifying HeapManipulating Programs in an SMT Framework ⋆
"... Abstract. Automated software verification has made great progress recently, and a key enabler of this progress has been the advances in efficient, automated decision procedures suitable for verification (Boolean satisfiability solvers and satisfiabilitymodulotheories (SMT) solvers). Verifying gene ..."
Abstract

Cited by 10 (1 self)
 Add to MetaCart
Abstract. Automated software verification has made great progress recently, and a key enabler of this progress has been the advances in efficient, automated decision procedures suitable for verification (Boolean satisfiability solvers and satisfiabilitymodulotheories (SMT) solvers). Verifying general software, however, requires reasoning about unbounded, linked, heapallocated data structures, which in turn motivates the need for a logical theory for such structures that includes unbounded reachability. So far, none of the available SMT solvers supports such a theory. In this paper, we present our integration of a decision procedure that supports unbounded heap reachability into an available SMT solver. Using the extended SMT solver, we can efficiently verify examples of heapmanipulating programs that we could not verify before. 1
To Ackermannize or not to Ackermannize? On Efficiently Handling Uninterpreted Function Symbols in SMT (EUF ∪ T)
 LPAR
, 2006
"... Satisfiability Modulo Theories (SMT(T)) is the problem of deciding the satisfiability of a formula with respect to a given background theory T. When T is the combination of two simpler theories T1 and T2 (SMT(T1 ∪ T2)), a standard and general approach is to handle the integration of T1 and T2 by pe ..."
Abstract

Cited by 8 (3 self)
 Add to MetaCart
Satisfiability Modulo Theories (SMT(T)) is the problem of deciding the satisfiability of a formula with respect to a given background theory T. When T is the combination of two simpler theories T1 and T2 (SMT(T1 ∪ T2)), a standard and general approach is to handle the integration of T1 and T2 by performing some form of search on the equalities between the shared variables. A frequent and very relevant subcase of SMT(T1 ∪ T2) is when T1 is the theory of Equality and Uninterpreted Functions (EUF). For this case, an alternative approach is to eliminate first all uninterpreted function symbols by means of Ackermann’s expansion, and then to solve the resulting SMT (T2) problem. In this paper we build on the empirical observation that there is no absolute winner between these two alternative approaches, and that the performance gaps between them are often dramatic, in either direction. We propose a simple technique for estimating a priori the costs and benefits, in terms of the size of the search space of an SMT tool, of applying Ackermann’s expansion to all or part of the function symbols. We have implemented a preprocessor which analyzes the input formula, decides autonomously which functions to expand, performs such expansions and gives the resulting formula as input to an SMT tool. A thorough experimental analysis, including the benchmarks of the SMT’05 competition, shows that our preprocessor performs the best choice(s) nearly always, and that the proposed technique is extremely effective in improving the overall performance of the SMT tool.
Matching midlet’s security claims with a platform security policy using automata modulo theory
 In 12th Nordic Workshop on Secure IT Systems (NordSec’07
, 2007
"... Modelcarrying code and securitybycontract have proposed to augment mobile code with a claim on its security behavior that could be matched against a mobile platform policy before downloading the code. In this paper we show that it is possible to define very expressive policies — essentially with ..."
Abstract

Cited by 7 (4 self)
 Add to MetaCart
Modelcarrying code and securitybycontract have proposed to augment mobile code with a claim on its security behavior that could be matched against a mobile platform policy before downloading the code. In this paper we show that it is possible to define very expressive policies — essentially with infinite cases — that can capture realistic scenarios (e.g. ”only connections to urls starting with