## A Hybrid SAT-Based Decision Procedure for Separation Logic with Uninterpreted Functions (2003)

### Cached

### Download Links

- [www.dac.com]
- [www.cecs.uci.edu]
- [www.eecs.berkeley.edu]
- [uclid.eecs.berkeley.edu]
- [www.cs.cmu.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | In Proc. DAC’03 |

Citations: | 48 - 4 self |

### BibTeX

@INPROCEEDINGS{Seshia03ahybrid,

author = {Sanjit A. Seshia and Shuvendu K. Lahiri and Randal E. Bryant},

title = {A Hybrid SAT-Based Decision Procedure for Separation Logic with Uninterpreted Functions},

booktitle = {In Proc. DAC’03},

year = {2003},

pages = {425--430}

}

### OpenURL

### Abstract

SAT-based decision procedures for quantifier-free fragments of firstorder logic have proved to be useful in formal verification. These decision procedures are either based on encoding atomic subformulas with Boolean variables, or by encoding integer variables as bit-vectors. Based on evaluating these two encoding methods on a diverse set of hardware and software benchmarks, we conclude that neither method is robust to variations in formula characteristics. We therefore propose a new hybrid technique that combines the two methods. We give experimental results showing that the hybrid method can significantly outperform either approach as well as other decision procedures.

### Citations

278 | Automatic verification of pipelined microprocessor control
- Burch, Dill
- 1994
(Show Context)
Citation Context ...y formal verification efforts. Decision procedures for the Logic of Equality with Uninterpreted Functions(EUF) have been successfully used in the automated verification of pipelined processor designs =-=[8, 4]. -=-Predicate abstraction methods [9] based on decision procedures have ∗ This work was supported by ARO grant DAAD19-01-1-0485 and SRC contract 1029.001 Permission to make digital or hard copies of all... |

153 | Validity checking for combinations of theories with equality
- Barrett, Dill, et al.
- 1996
(Show Context)
Citation Context ...parison with Other Decision Procedures. We compared our decision procedure against existing decision procedures that can decide SUF formulas. One such procedure is the Stanford Validity Checker (SVC) =-=[2]-=-. SVC (version 1.1) can decide a superset of SUF, including, in addition, linear arithmetic and bit-vector arithmetic. We also compared against the more recent Cooperating Validity Checker (CVC) [3], ... |

150 | Modeling and verifying systems using a logic of counter arithmetic with lambda expressions and uninterpreted functions
- Bryant, Lahiri, et al.
- 2002
(Show Context)
Citation Context ...ight 2003 ACM 1-58113-688-9/03/0001 ...$5.00. 425 27.1 been used to verify parameterized cache coherence protocols. The logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions =-=[6]-=- (CLU), which generalizes EUF, is the basis for the UCLID verifier which has been used for bounded model checking and inductive invariant checking of out-of-order microprocessors with unbounded resour... |

137 | Experience with predicate abstraction
- Das, Dill, et al.
- 1999
(Show Context)
Citation Context ...n procedures for the Logic of Equality with Uninterpreted Functions(EUF) have been successfully used in the automated verification of pipelined processor designs [8, 4]. Predicate abstraction methods =-=[9] b-=-ased on decision procedures have ∗ This work was supported by ARO grant DAAD19-01-1-0485 and SRC contract 1029.001 Permission to make digital or hard copies of all or part of this work for personal ... |

96 | Superscalar processor verification using efficient reductions of the logic of equality with uninterpreted functions
- Velev, Bryant
- 1999
(Show Context)
Citation Context ...y formal verification efforts. Decision procedures for the Logic of Equality with Uninterpreted Functions(EUF) have been successfully used in the automated verification of pipelined processor designs =-=[8, 4]. -=-Predicate abstraction methods [9] based on decision procedures have ∗ This work was supported by ARO grant DAAD19-01-1-0485 and SRC contract 1029.001 Permission to make digital or hard copies of all... |

95 |
Checking satisfiability of first-order formulas by incremental translation to SAT
- Barrett, Dill, et al.
- 2002
(Show Context)
Citation Context ...ager approaches [4, 6, 12, 14], the quantifierfree first-order formula is converted in a single step to an equivalent Boolean formula which is checked using the SAT solver. The lazy approaches (e.g., =-=[3, 1]-=-) iteratively refine the Boolean encoding based on satisfying assignments from the SAT solver that are inconsistent with the first order theory. The process is repeated until a consistent assignment i... |

90 | Effective use of Boolean satisfiability procedures in the formal verification of superscalar and VLIW microprocessors
- Velev, Bryant
- 2003
(Show Context)
Citation Context ...aration predicate (e.g., x ≥ y + c) is encoded using a single Boolean variable (e.g., e ≥,c x,y ). This encoding appears to assist the DPLL-based SAT solvers, as has been observed by Velev and Bry=-=ant [15]-=- for deciding the restricted class of EUF logic. This is probably because, in many formulas, separation predicates control the values sub-expressions of the formula evaluate to, and so assigning to th... |

82 | A SAT Based Approach for Solving Formulas over Boolean and Linear Mathematical Propositions
- Audemard, Bertoli, et al.
- 2002
(Show Context)
Citation Context ...ager approaches [4, 6, 12, 14], the quantifierfree first-order formula is converted in a single step to an equivalent Boolean formula which is checked using the SAT solver. The lazy approaches (e.g., =-=[3, 1]-=-) iteratively refine the Boolean encoding based on satisfying assignments from the SAT solver that are inconsistent with the first order theory. The process is repeated until a consistent assignment i... |

76 | Temporal-safety proofs for systems code
- Henzinger, Jhala, et al.
- 2002
(Show Context)
Citation Context ...of out-of-order microprocessors with unbounded resources [11]. Decision procedures are an integral part of software verification systems including the Code Validation tool [13] and the Blast verifier =-=[10]-=-. Hence the importance of having efficient decision procedures can hardly be overstated. Many decision procedures leverage off the recent advances in Boolean satisfiability (SAT) solvers. These decisi... |

55 | Deciding equality formulas by small domains instantiations
- Pnueli, Rodeh, et al.
- 1999
(Show Context)
Citation Context .... These decision procedures differ in the Boolean encoding and the degree of the coupling with the SAT solver. One can classify these procedures as being either eager or lazy. In the eager approaches =-=[4, 6, 12, 14]-=-, the quantifierfree first-order formula is converted in a single step to an equivalent Boolean formula which is checked using the SAT solver. The lazy approaches (e.g., [3, 1]) iteratively refine the... |

47 | Modeling and verification of out-of-order microprocessors
- Lahiri, Seshia, et al.
(Show Context)
Citation Context ...U), which generalizes EUF, is the basis for the UCLID verifier which has been used for bounded model checking and inductive invariant checking of out-of-order microprocessors with unbounded resources =-=[11]-=-. Decision procedures are an integral part of software verification systems including the Code Validation tool [13] and the Blast verifier [10]. Hence the importance of having efficient decision proce... |

47 | Deciding Separation Formulas with SAT
- STRICHMAN, SESHIA, et al.
- 2002
(Show Context)
Citation Context .... These decision procedures differ in the Boolean encoding and the degree of the coupling with the SAT solver. One can classify these procedures as being either eager or lazy. In the eager approaches =-=[4, 6, 12, 14]-=-, the quantifierfree first-order formula is converted in a single step to an equivalent Boolean formula which is checked using the SAT solver. The lazy approaches (e.g., [3, 1]) iteratively refine the... |

38 | Boolean satisfiability with transitivity constraints
- Bryant, Velev
- 2002
(Show Context)
Citation Context ...owever, that for the subclass of logic involving only equalities without arithmetic, the number of transitivity constraints grows only polynomially in the number of equalities in the original formula =-=[7]-=-. The SD and EIJ methods also differ in their impact on search in SAT solvers. As the SD method uses a vector of Boolean variables to encode each symbolic constant, sufficient number of these Boolean ... |

30 | The code validation tool CVT: Automatic verification of a compilation process
- Pnueli, Shtrichman, et al.
- 1998
(Show Context)
Citation Context ...nductive invariant checking of out-of-order microprocessors with unbounded resources [11]. Decision procedures are an integral part of software verification systems including the Code Validation tool =-=[13]-=- and the Blast verifier [10]. Hence the importance of having efficient decision procedures can hardly be overstated. Many decision procedures leverage off the recent advances in Boolean satisfiability... |

19 | Deciding CLU Logic formulas via Boolean and Pseudo-Boolean encodings
- BRYANT, LAHIRI, et al.
(Show Context)
Citation Context ...encoded as a Boolean variable. Constraints are then added to prune off the inconsistent assignments of the Boolean variables. In this paper, we confirm results of our previous experimental evaluation =-=[5]-=- of these two encoding methods, concluding that neither of the approaches are robust to variations in formula characteristics. Hence, we propose a new hybrid method that combines the two methods, and ... |

1 |
The code validation tool - automatic verification of a compilation process
- Pnueli, Siegel, et al.
- 1998
(Show Context)
Citation Context ...nductive invariant checking of out-of-order microprocessors with unbounded resources [11]. Decision procedures are an integral part of software verification systems including the Code Validation tool =-=[13]-=- and the Blast verifier [10]. Hence the importance of having efficient decision procedures can hardly be overstated. Many decision procedures leverage off the recent advances in Boolean satisfiability... |