Deciding Bit-Vector Arithmetic with Abstraction

Abstract

Abstract. We present a new decision procedure for finite-precision bitvector arithmetic with arbitrary bit-vector operations. Our procedure alternates between generating under-and over-approximations of the original bit-vector formula. An under-approximation is obtained by a translation to propositional logic in which some bit-vector variables are encoded with fewer Boolean variables than their width. If the underapproximation is unsatisfiable, we use the unsatisfiable core to derive an over-approximation based on the subset of predicates that participated in the proof of unsatisfiability. If this over-approximation is satisfiable, the satisfying assignment guides the refinement of the previous underapproximation by increasing, for some bit-vector variables, the number of Boolean variables that encode them. We present experimental results that suggest that this abstraction-based approach can be considerably more efficient than directly invoking the SAT solver on the original formula as well as other competing decision procedures.

Whiley: A Platform for Research in Software Verification

“…Modern languages typically provide fixed-width numeric types, such as 32bit twos-compliment integers, or 64-bit IEEE 754 floating point numbers. Such data types are notoriously difficult for an automated theorem prover to reason about [22]. Systems like JML and Spec# assume (unsoundly) that numeric types do not overflow or suffer from rounding.…”

Trace-Driven Verification of Multithreaded Programs

“…4.3 An Illustrative Example Assume the first executed trace is π 1 = (1, 0.1), (1, 1.1), (1, 2.1), (1, 3), (1, 0.2), (1, 1.2), (1, 2.2), (1,5), (1,6), (2,13), (2,14), (2,15), (2,16), (3,13), (3,14), (3,15), (3,16),…”

Beaver: Engineering an Efficient SMT Solver for Bit-Vector Arithmetic

“…A more complete survey of current and past bit-vector decision procedures can be found in recent articles (e.g. [5]) and the SMT-COMP'08 results [14].…”

“…MathSAT [4] and Z3 [6] are based on bit-blasting using several wordlevel simplifications; we were unable to find a detailed exposition of which of these simplifications were the most useful. Finally, UCLID [5] uses an abstraction-refinement approach to solving bit-vector formulas, into which any model-generating SMT solver for QF BV, including BEAVER, can be easily integrated.…”

“…This theory is useful for reasoning about low-level system descriptions in languages such as C and Verilog which use finite-precision integer arithmetic and bit-wise operations on bit-vectors. Recently, there has been a resurgence of work on new QF BV SMT solvers such as BAT [10], Boolector [3], MathSAT [4], Spear [9], STP [8], UCLID [5] and Z3 [6].…”