Results 11  20
of
54
Modeling and Verification of OutofOrder Microprocessors in UCLID
, 2002
"... In this paper, we describe the modeling and verification of outoforder microprocessors with unbounded resources using an expressive, yet efficiently decidable, quantifierfree fragment of first order logic. This logic includes uninterpreted functions, equality, ordering, constrained lambda express ..."
Abstract

Cited by 42 (13 self)
 Add to MetaCart
In this paper, we describe the modeling and verification of outoforder microprocessors with unbounded resources using an expressive, yet efficiently decidable, quantifierfree fragment of first order logic. This logic includes uninterpreted functions, equality, ordering, constrained lambda expressions, and counter arithmetic. UCLID is a tool for specifying and verifying systems expressed in this logic. The paper makes two main contributions. First, we show that the logic is expressive enough to model components found in most modern microprocessors, independent of their actual sizes. Second, we demonstrate UCLID's verification capabilities, ranging from full automation for bounded property checking to a high degree of automation in proving restricted classes of invariants. These techniques, coupled with a counterexample generation facility, are useful in establishing correctness of processor designs. We demonstrate UCLID's methods using a case study of a synthetic model of an outoforder processor where all the invariants were proved automatically.
Deciding QuantifierFree Presburger Formulas Using Finite Instantiation Based on Parameterized Solution Bounds
 In Proc. 19 th LICS. IEEE
, 2003
"... Given a formula # in quantifierfree Presburger arithmetic, it is well known that, if there is a satisfying solution to #, there is one whose size, measured in bits, is polynomially bounded in the size of #. In this paper, we consider a special class of quantifierfree Presburger formulas in which m ..."
Abstract

Cited by 34 (7 self)
 Add to MetaCart
Given a formula # in quantifierfree Presburger arithmetic, it is well known that, if there is a satisfying solution to #, there is one whose size, measured in bits, is polynomially bounded in the size of #. In this paper, we consider a special class of quantifierfree Presburger formulas in which most linear constraints are separation (di#erencebound) constraints, and the nonseparation constraints are sparse. This class has been observed to commonly occur in software verification problems. We derive a new solution bound in terms of parameters characterizing the sparseness of linear constraints and the number of nonseparation constraints, in addition to traditional measures of formula size. In particular, the number of bits needed per integer variable is linear in the number of nonseparation constraints and logarithmic in the number and size of nonzero coe#cients in them, but is otherwise independent of the total number of linear constraints in the formula. The derived bound can be used in a decision procedure based on instantiating integer variables over a finite domain and translating the input quantifierfree Presburger formula to an equisatisfiable Boolean formula, which is then checked using a Boolean satisfiability solver. We present empirical evidence indicating that this method can greatly outperform other decision procedures.
Restart Policies with Dependence among Runs: A Dynamic Programming Approach
, 2002
"... The time required for a backtracking search procedure to solve a problem can be reduced by employing randomized restart procedures. To date, ..."
Abstract

Cited by 31 (4 self)
 Add to MetaCart
The time required for a backtracking search procedure to solve a problem can be reduced by employing randomized restart procedures. To date,
The AVISS Security Protocol Analysis Tool
, 2002
"... We introduce AVISS, a tool for security protocol analysis that supports the integration of backends implementing different search techniques, allowing for their systematic and quantitative comparison and paving the way to their e ective interaction. As a significant example, we have implemented thr ..."
Abstract

Cited by 28 (13 self)
 Add to MetaCart
We introduce AVISS, a tool for security protocol analysis that supports the integration of backends implementing different search techniques, allowing for their systematic and quantitative comparison and paving the way to their e ective interaction. As a significant example, we have implemented three backends, and used the AVISS tool to analyze and find flaws in 36 protocols, including 31 problems in the ClarkJacob's protocol library and a previously unreported flaw in the DenningSacco protocol.
Formal Models of HeavyTailed Behavior in Combinatorial Search
 In CP’01
, 2001
"... Recently, it has been found that the cost distributions of randomized backtrack search in combinatorial domains are often heavytailed. Such heavytailed distributions explain the high variability observed when using backtrackstyle procedures. A good understanding of this phenomenon can lead to bett ..."
Abstract

Cited by 28 (13 self)
 Add to MetaCart
Recently, it has been found that the cost distributions of randomized backtrack search in combinatorial domains are often heavytailed. Such heavytailed distributions explain the high variability observed when using backtrackstyle procedures. A good understanding of this phenomenon can lead to better search techniques. For example, restart strategies provide a good mechanism for eliminating the heavytailed behavior and boosting the overall search performance. Several stateoftheart SAT solvers now incorporate such restart mechanisms. The study of heavytailed phenomena in combinatorial search has so far been been largely based on empirical data. We introduce several abstract tree search models, and show formally how heavytailed cost distribution can arise in backtrack search. We also discuss how these insights may facilitate the development of better combinatorial search methods.
On Solving Presburger and Linear Arithmetic with SAT
 In Proc. of Formal Methods in ComputerAided Design (FMCAD 2002), LNCS
, 2002
"... We show a reduction to propositional logic from quantifierfree Presburger arithmetic, and disjunctive linear arithmetic, based on FourierMotzkin elimination. While the complexity of this procedure is not better than competing techniques, it has practical advantages in solving verification problems ..."
Abstract

Cited by 26 (2 self)
 Add to MetaCart
We show a reduction to propositional logic from quantifierfree Presburger arithmetic, and disjunctive linear arithmetic, based on FourierMotzkin elimination. While the complexity of this procedure is not better than competing techniques, it has practical advantages in solving verification problems. It also promotes the option of deciding a combination of theories by reducing them to this logic.
Qubos: Deciding Quantified Boolean Logic using Propositional Satisfiability Solvers
 In Proc. 4 th Intl. Conf. on Formal Methods in ComputerAided Design (FMCAD’02), volume 2517 of LNCS
, 2002
"... We describe Qubos (QUantified BOolean Solver), a decision procedure for quantified Boolean logic. The procedure is based on nonclausal simplification techniques that reduce formulae to a propositional clausal form after which o#theshelf satisfiability solvers can be employed. We show that ther ..."
Abstract

Cited by 23 (0 self)
 Add to MetaCart
We describe Qubos (QUantified BOolean Solver), a decision procedure for quantified Boolean logic. The procedure is based on nonclausal simplification techniques that reduce formulae to a propositional clausal form after which o#theshelf satisfiability solvers can be employed. We show that there are domains exhibiting structure for which this procedure is very e#ective and we report on experimental results.
Verics: A Tool for Verifying Timed Automata and Estelle Specifications
, 2003
"... The paper presents a new tool for automated veri cation of Timed Automata as well as protocols written in the speci cation language Estelle. The current version oers an automatic translation from Estelle speci cations to timed automata, and two complementary methods of reachability analysis, ..."
Abstract

Cited by 22 (14 self)
 Add to MetaCart
The paper presents a new tool for automated veri cation of Timed Automata as well as protocols written in the speci cation language Estelle. The current version oers an automatic translation from Estelle speci cations to timed automata, and two complementary methods of reachability analysis, the rst of which is based on Bounded Model Checking (BMC), while the second one is an onthey veri cation on an abstract model of the system.
Efficient Data Structures for Backtrack Search SAT Solvers
, 2002
"... The implementation of efficient Propositional Satisfiability (SAT) solvers entails the utilization of highly efficient data structures, as illustrated by most of the recent stateoftheart SAT solvers. However, it is in general hard to compare existing data structures, since different solvers are o ..."
Abstract

Cited by 22 (3 self)
 Add to MetaCart
The implementation of efficient Propositional Satisfiability (SAT) solvers entails the utilization of highly efficient data structures, as illustrated by most of the recent stateoftheart SAT solvers. However, it is in general hard to compare existing data structures, since different solvers are often characterized by fairly different algorithmic organizations and techniques, and by different search strategies and heuristics. This paper aims the evaluation of data structures for backtrack search SAT solvers, under a common unbiased SAT framework. In addition, advantages and drawbacks of each existing data structure are identified. Finally, new data structures are proposed, that are competitive with the most efficient data structures currently available, and that may be preferable for the next generation SAT solvers.
Using SAT based image computation for reachability analysis
, 2003
"... 1 Introduction Image Computation and Reachability Analysis Computing the set ofstates reachable in one step from a given set of states under a transition relation forms the heart of many symbolic state exploration algorithms, includingreachability analysis, model checking [8, 6, 7], etc. This operat ..."
Abstract

Cited by 20 (4 self)
 Add to MetaCart
1 Introduction Image Computation and Reachability Analysis Computing the set ofstates reachable in one step from a given set of states under a transition relation forms the heart of many symbolic state exploration algorithms, includingreachability analysis, model checking [8, 6, 7], etc. This operation is called image computation. Let us consider a state transition relation T over the set ofstates S. The set of states is defined by the set of valuations over a vector ofstate variables x. We denote a set or a vector of variables in a boldface. The