Pono: A Flexible and Extensible SMT-Based Model Checker

Abstract

Symbolic model checking is an important tool for finding bugs (or proving the absence of bugs) in modern system designs. Because of this, improving the ease of use, scalability, and performance of model checking tools and algorithms continues to be an important research direction. In service of this goal, we present , an open-source SMT-based model checker. is designed to be both a research platform for developing and improving model checking algorithms, as well as a performance-competitive tool that can be used for academic and industry verification applications. In addition to performance, prioritizes transparency (developed as an open-source project on GitHub), flexibility ( can be adapted to a variety of tasks by exploiting its general SMT-based interface), and extensibility (it is easy to add new algorithms and new back-end solvers). In this paper, we describe the design of the tool with a focus on the flexible and extensible architecture, cover its current capabilities, and demonstrate that is competitive with state-of-the-art tools.

Smt-Switch: a solver-agnostic C++ API for SMT Solving

“…We have presented work in progress on Smt-Switch, a solver-agnostic API for performant prototyping with SMT solvers in C++. This system is available for use on GitHub and has already been used in projects [13,16]. Future work includes adding a backend for Z3 [5], adding support for quantifiers and inductive datatypes, as well as investigating possible performance improvements, such as optimized data structures and alternatives to smart pointers.…”

UCLID5: Multi-Modal Formal Modeling, Verification, and Synthesis

“…[23,5,43], or concurrent computation modeling, e.g. [6,10,32,15,31]. Although users of these systems can often overcome the tool's modeling focus by manually including support for different computation paradigms, for example, Dafny can be used to model concurrent systems [24], this is not always straightforward, and limited support for different paradigms can manifest as limitations in downstream applications.…”

“…Tools that do offer multi-modal verification do not offer the same range of options as UCLID5. For example, [31] does not support linear temporal logic, and [32,14] does not support hyperproperty verification.…”

“…This work was supported in part by NSF grant 1837132, the DARPA grant FA8750-20-C-0156 (LOGiCS), by the Qualcomm Innovation Fellowship, and by Amazon and Intel. 9 https://github.com/uclid-org/riscverifier [24][25][26][27][28][29][30][31][32][33][34][35][36][37][38][39] constrain the next nondeterministic value of state to one that complies with the language semantics. The operational modeling using the next block simplifies the specification of constraints including non-decreasing time tags (line 25), unique event per tag (line 27), reaction priority (line 29), connection delay (line [31][32][33][34][35][36], and trigger mechanism (line [38][39][40].…”

“…9 https://github.com/uclid-org/riscverifier [24][25][26][27][28][29][30][31][32][33][34][35][36][37][38][39] constrain the next nondeterministic value of state to one that complies with the language semantics. The operational modeling using the next block simplifies the specification of constraints including non-decreasing time tags (line 25), unique event per tag (line 27), reaction priority (line 29), connection delay (line [31][32][33][34][35][36], and trigger mechanism (line [38][39][40]. The reachability property, "the train does not move when the door is open," can then be checked using proof by induction (line 44).…”