An Alternative to SAT-Based Approaches for Bit-Vectors

Abstract

Abstract. The theory BV of bit-vectors, i.e. fixed-size arrays of bits equipped with standard low-level machine instructions, is becoming very popular in formal verification. Standard solvers for this theory are based on a bit-level encoding into propositional logic and SAT-based resolution techniques. In this paper, we investigate an alternative approach based on a word-level encoding into bounded arithmetic and Constraint Logic Programming (CLP) resolution techniques. We define an original CLP framework (domains and propagators) dedicated to bitvector constraints. This framework is implemented in a prototype and thorough experimental studies have been conducted. The new approach is shown to perform much better than standard CLP-based approaches, and to considerably reduce the gap with the best SAT-based BV solvers.

A Certified Constraint Solver over Finite Domains

“…According to our knowledge, the approach reported in this paper is the first attempt to certify a CP(FD) constraint solver. CP(FD) solving is currently outside the scope of arithmetic decision procedures, and SMT solvers rely on the BitVectors Theory to handle finitely-encoded integers [5]. We selected the second approach discussed above, to build our certified CP(FD) solver, because unsatisfiability in these solvers is not reported with certificates or proof trees.…”

“…In this context, finite domains mean finite sets of labels or possible values associated to each variable of the program. Existing results show that CP(FD) is a complementary approach to SMT for certain classes of verification problems [5,3].…”

“…For example, formal verification involves showing that a formula embedding the negation of a property is unsatisfiable, i.e., the formula has no model or solution. While most verification techniques are based on SAT and SMT (Satisfiability Modulo Theory), tools built over Constraint Programming over Finite Domains, noted CP(FD) [14], become more and more competitive e.g., CPBPV [11], or OSMOSE [5,4]. In this context, finite domains mean finite sets of labels or possible values associated to each variable of the program.…”

Binary-Level Testing of Embedded Programs

“…OSMOSE performs bit-level reasoning through constraints expressed in the theory of bitvectors plus arrays [7]. Memory is modelled as an array of bytes, which is sufficient since safety-critical programs do not perform dynamic memory allocation.…”

Efficient and Complete FD-solving for extended array constraints

“…Another path in the quest of an efficient and expressive solving is the use of Constraint Programming over Finite Domains (FD) [Bardin and Gotlieb, 2012;Bardin and Herrmann, 2008;Charreteur et al, 2009;Marre and Blanc, 2005]. FD has been proved useful for reasoning about complex structures crucial to software verification, such as floating point numbers [Botella et al, 2006], modular arithmetic [Gotlieb et al, 2010] and bitvectors [Bardin et al, 2010]. Multi-theory and verificationoriented FD frameworks are also starting to emerge [Marre and Blanc, 2005].…”