## A decision procedure for bitvectors and arrays (2007)

Venue: | In Computer Aided Verification, number 4590 in LNCS |

Citations: | 129 - 7 self |

### BibTeX

@INPROCEEDINGS{Dill07adecision,

author = {Vijayganeshanddavidl. Dill},

title = {A decision procedure for bitvectors and arrays},

booktitle = {In Computer Aided Verification, number 4590 in LNCS},

year = {2007}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. STP is a decision procedure for the satisfiability of quantifier-free formulas in the theory of bit-vectors and arrays that has been optimized for large problems encountered in software analysis applications. The basic architecture of the procedure consists of word-level pre-processing algorithms followed by translation to SAT. The primary bottlenecks in software verification and bug finding applications are large arrays and linear bit-vector arithmetic. New algorithms based on the abstraction-refinement paradigm are presented for reasoning about large arrays. A solver for bit-vector linear arithmetic is presented that eliminates variables and parts of variables to enable other transformations, and reduce the size of the problem that is eventually received by the SAT solver. These and other algorithms have been implemented in STP, which has been heavily tested over thousands of examples obtained from several real-world applications. Experimental results indicate that the above mix of algorithms along with the overall architecture is far more effective, for a variety of applications, than a direct translation of the original formula to SAT or other comparable decision procedures. 1

### Citations

462 |
N.: An extensible SAT-solver
- Eén, Sörensson
- 2003
(Show Context)
Citation Context ...izations that eventually convert the original problem to a conjunctive-normal form (CNF) formula for input to a high-speed solver for the satisfiability problem for propositional logic formulas (SAT) =-=[10]-=-. Thus, STP fully exploits the speed of modern SAT solvers while also taking advantage of theory-specific optimizations for bit-vectors and arrays. In this respect, STP is most similar to UCLID [13]. ... |

392 | Simplification by cooperating decision procedures
- Nelson, Oppen
- 1982
(Show Context)
Citation Context ...is different from most decision procedures that support both bit-vectors and arrays [18, 2, 9], which are based on backtracking and a framework for combining specialized theories such as Nelson-Oppen =-=[15]-=-. Instead, STP consists of a series of word-level transformations and optimizations that eventually convert the original problem to a conjunctive-normal form (CNF) formula for input to a high-speed so... |

226 | Exe: Automatically generating inputs of death
- CADAR, GANESH, et al.
(Show Context)
Citation Context ...h theorem-proving and hardware verification have been the primary users of decision procedures, increasingly they are being used in large-scale program analysis, bug finding and test generation tools =-=[7, 16]-=-. These tools often symbolically analyze code and generate constraints for the decision procedure to solve, and use the results to guide analysis or generate new test cases. Software analysis tools cr... |

204 |
CVC Lite: A new implementation of the cooperating validity checker
- Barrett, Berezin
- 2004
(Show Context)
Citation Context ...s, addition, multiplication, unaryminus, (signed) division and modulo, array read and write functions, and relational operators. The semantics parallel the semantics of the SMTLIB bit-vector language =-=[1]-=-or the C programming language, except that in STP bit-vectors can have any positive length. Also, all arithmetic and bitwise Boolean operations require that the inputs be ofthe same length. STP can be... |

183 | A fast linear-arithmetic solver for dpll(t
- Dutertre, Moura
(Show Context)
Citation Context ...tools. These decision procedures usually support integer and real arithmetic, uninterpreted functions, bit-vectors, and arrays. Examples of such decision procedures include Yices, SVC, CVC Lite,UCLID =-=[9, 3, 2, 13]-=-. Although theorem-proving and hardware verification have been the primary users of decision procedures, increasingly they are being used in large-scale program analysis, bug finding and test generati... |

151 | Validity checking for combinations of theories with equality
- Barrett, Dill, et al.
- 1996
(Show Context)
Citation Context ...tools. These decision procedures usually support integer and real arithmetic, uninterpreted functions, bit-vectors, and arrays. Examples of such decision procedures include Yices, SVC, CVC Lite,UCLID =-=[9, 3, 2, 13]-=-. Although theorem-proving and hardware verification have been the primary users of decision procedures, increasingly they are being used in large-scale program analysis, bug finding and test generati... |

116 | DPLL(T) fast decision procedures
- Ganzinger, Hagen, et al.
- 2004
(Show Context)
Citation Context ...other decision procedures based on case splitting and backtracking, including tools like SVC, and CVC Lite [3, 2], and other solvers based on the Davis-Putnam-Logemann-Loveland (DPLL(T)) architecture =-=[11]-=-. Conceptually, those solvers recursively assert atomic formulas and their negations to a theory-specific decision procedures to check for consistency with formulas that are already asserted, backtrac... |

113 | CVC: A Cooperating Validity Checker
- Stump, Barrett, et al.
- 2002
(Show Context)
Citation Context ... There is a nice overview of bit-vector decision procedures in [6], which we do not repeat here. STP’s architecture is different from most decision procedures that support both bit-vectors and arrays =-=[18, 2, 9]-=-, which are based on backtracking and a framework for combining specialized theories such as Nelson-Oppen [15]. Instead, STP consists of a series of word-level transformations and optimizations that e... |

74 | A decision procedure for an extensional theory of arrays
- Stump, Barrett, et al.
- 2001
(Show Context)
Citation Context ...havior. The constraint problems are large and extremely challenging to solve. This paper reports on STP, a decision procedure for quantifier-free first order logic with bit-vector and array datatypes =-=[17]-=-. The design of STP is has been driven primarily by the demands of software analysis research projects. STP is being used in severalssoftware analysis, bug finding and hardware verification applicatio... |

52 | J.R.: A decision procedure for bit-vector arithmetic
- Barret, Dill, et al.
- 1998
(Show Context)
Citation Context ...ons, the solver leads to a sound and complete polynomial-time decision procedure. Furthermore, the equations are reduced to a closed form that captures all of the possible solutions. 2 As observed in =-=[4]-=-, the theory of linear mod 2 n arithmetic (equations only) in tandem with concatenate and extract operations is NP-complete. Although STP has concatenate and extraction operations, terms with those op... |

43 | Deciding bit-vector arithmetic with abstraction
- Bryant, Kroening, et al.
- 2007
(Show Context)
Citation Context ...linear constraints, and liberal use of bit-vector functions and predicates, and STP solves it in approx. 2 minutes on a 3.2GHz Linux box. There is a nice overview of bit-vector decision procedures in =-=[6]-=-, which we do not repeat here. STP’s architecture is different from most decision procedures that support both bit-vectors and arrays [18, 2, 9], which are based on backtracking and a framework for co... |

41 |
Automatically identifying trigger-based behavior in malware
- Brumley, Hartwig, et al.
- 2008
(Show Context)
Citation Context ...XE project [7] at Stanford, which generates test cases for C programs using symbolic execution, and uses STP to solve the constraints. Other projects include the Replayer project [16] and Minesweeper =-=[5]-=- at Carnegie Mellon University which produce constraints from symbolic execution of machine code, and the CATCHCONV project [14] at Berkeley which tries to catch errors due to type conversion in C pro... |

41 | Replayer: Automatic protocol replay by binary analysis
- Newsome, Brumley, et al.
- 2006
(Show Context)
Citation Context ...h theorem-proving and hardware verification have been the primary users of decision procedures, increasingly they are being used in large-scale program analysis, bug finding and test generation tools =-=[7, 16]-=-. These tools often symbolically analyze code and generate constraints for the decision procedure to solve, and use the results to guide analysis or generate new test cases. Software analysis tools cr... |

39 | The UCLID Decision Procedure
- Lahiri, Seshia
- 2004
(Show Context)
Citation Context ...tools. These decision procedures usually support integer and real arithmetic, uninterpreted functions, bit-vectors, and arrays. Examples of such decision procedures include Yices, SVC, CVC Lite,UCLID =-=[9, 3, 2, 13]-=-. Although theorem-proving and hardware verification have been the primary users of decision procedures, increasingly they are being used in large-scale program analysis, bug finding and test generati... |

14 | Assertion Checking by Combined Wordlevel ATPG and Modular Arithmetic Constraint-Solving Techniques
- Huang, Cheng
- 2000
(Show Context)
Citation Context ...ost of these algorithms do not provide a solved form that captures all possible solutions. Some of the ideas presented here were devised by Clark Barrett and implemented in the SVC decision procedure =-=[12, 4]-=-, but the SVC algorithm has exponential worst-case time complexity while STP’s linear solver is polynomial in the worst-case. The closest related work is probably in a paper by Huang and Cheng [12], w... |

5 |
Introduction to Algorithms, chapter 11
- Cormen, Leiserson, et al.
- 2001
(Show Context)
Citation Context ...is also a basic result from number theory that a number a has a multiplicative inverse mod m iff gcd(a, m) = 1, and that this inverse can be computed by the extended greatest-common divisor algorithm =-=[8]-=- or a method from [4]. So, if there is a variable with an odd coefficient, the solver isolates it on the left-hand-side and multiplies through by the inverse of the coefficient. In the example, the mu... |

2 |
A Decision Procedure for an Extensional Theoryof Arrays
- Stump, Dill, et al.
- 2001
(Show Context)
Citation Context ...ehavior. The constraint problems are large and extremely challenging to solve.This paper reports on STP, a decision procedure for quantifier-free first order logic with bit-vector and array datatypes =-=[17]-=-. The design of STP is has been driven primar-ily by the demands of software analysis research projects. STP is being used in severalssoftware analysis, bug finding and hardware verification applicati... |

1 |
Catchconv : A tool for catching conversion errors
- Molnar, Wagner, et al.
- 2007
(Show Context)
Citation Context ...raints. Other projects include the Replayer project [16] and Minesweeper [5] at Carnegie Mellon University which produce constraints from symbolic execution of machine code, and the CATCHCONV project =-=[14]-=- at Berkeley which tries to catch errors due to type conversion in C programs. The CATCHCONV project produced the largest example solved by STP so far. It is a 412 Mbyte formula, with 2.12 million 32 ... |

1 |
R.L.: Introduction to Algorithms (chapter
- Cormen, Leiserson, et al.
- 1998
(Show Context)
Citation Context ... is also a basic result from number theory that a number a has a multiplicative inverse mod m iff gcd(a, m) =1, and that this inverse can be computed by the extended greatest-common divisor algorithm =-=[8]-=- or a method from [4]. So, if there is a variable with an odd coefficient, the solver isolates it on the left-hand-side and multiplies through by the inverse of the coefficient. In the example, the mu... |