Saturn: A SAT-Based Tool for Bug Detection

Xie, Yichen; Aiken, Alex

doi:10.1007/11513988_13

Cited by 40 publications

(24 citation statements)

References 16 publications

(18 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Constraint solvers have been used for finding bugs in loop-free programs [41] (obtained by unrolling loops in programs heuristically). In contrast, our methodology can be used to find a mostgeneral counterexample and also find bugs in programs that require an unbounded or a large number of loop iterations for the bug to manifest.…”

Section: Related Workmentioning

confidence: 99%

Program analysis as constraint solving

Gulwani

Srivastava

Venkatesan

2008

Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation

148

113

View full text Add to dashboard Cite

A constraint-based approach to invariant generation in programs translates a program into constraints that are solved using off-theshelf constraint solvers to yield desired program invariants.In this paper we show how the constraint-based approach can be used to model a wide spectrum of program analyses in an expressive domain containing disjunctions and conjunctions of linear inequalities. In particular, we show how to model the problem of context-sensitive interprocedural program verification. We also present the first constraint-based approach to weakest precondition and strongest postcondition inference. The constraints we generate are boolean combinations of quadratic inequalities over integer variables. We reduce these constraints to SAT formulae using bitvector modeling and use off-the-shelf SAT solvers to solve them.Furthermore, we present interesting applications of the above analyses, namely bounds analysis and generation of most-general counter-examples for both safety and termination properties. We also present encouraging preliminary experimental results demonstrating the feasibility of our technique on a variety of challenging examples.

show abstract

Section: Related Workmentioning

confidence: 99%

Program analysis as constraint solving

Gulwani

Srivastava

Venkatesan

2008

Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation

148

113

View full text Add to dashboard Cite

show abstract

“…It has also been applied to program analysis, and in particular invariant inference, where off-the-shelf linear and nonlinear solvers [7,27], SAT solvers [31], and SMT solvers [16] have been employed. In those works, a pre-processing, or abstraction, step is necessary to transform the problem of inferring an inductive invariant, which is inherently second-order, into a first-order formula.…”

Section: Related Workmentioning

confidence: 99%

An Algorithm Inspired by Constraint Solvers to Infer Inductive Invariants in Numeric Programs

Miné¹,

Breck²,

Reps³

2016

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract. This paper addresses the problem of proving a given invariance property ϕ of a loop in a numeric program, by inferring automatically a stronger inductive invariant ψ. The algorithm we present is based on both abstract interpretation and constraint solving. As in abstract interpretation, it computes the effect of a loop using a numeric abstract domain. As in constraint satisfaction, it works from "above"-interactively splitting and tightening a collection of abstract elements until an inductive invariant is found. Our experiments show that the algorithm can find non-linear inductive invariants that cannot normally be obtained using intervals (or octagons), even when classic techniques for increasing abstract-interpretation precision are employed-such as increasing and decreasing iterations with extrapolation, partitioning, and disjunctive completion. The advantage of our work is that because the algorithm uses standard abstract domains, it sidesteps the need to develop complex, non-standard domains specialized for solving a particular problem.

show abstract

“…SATURN [20] also uses SAT-solving, but for bug-finding in loop-free programs. (Programs with loops are modeled by unrolling loops.)…”

Section: Weakest Precondition Inferencementioning

confidence: 99%

Constraint-Based Invariant Inference over Predicate Abstraction

Gulwani

Srivastava

Venkatesan

2008

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This paper describes a constraint-based invariant generation technique for proving the validity of safety assertions over the domain of predicate abstraction in an interprocedural setting. The key idea of the technique is to represent each invariant in bounded DNF form by means of boolean indicator variables, one for each predicate p and each disjunct d denoting whether p is present in d or not. The verification condition of the program is then encoded by means of a boolean formula over these boolean indicator variables such that any satisfying assignment to the formula yields the inductive invariants for proving the validity of given program assertions. This paper also describes how to use the constraint-based methodology for generating weakest preconditions for safety assertions. An interesting application of weakest precondition generation is to produce mostgeneral counterexamples for safety assertions. We also present preliminary experimental evidence demonstrating the feasibility of this technique.

show abstract

Saturn: A SAT-Based Tool for Bug Detection

Cited by 40 publications

References 16 publications

Program analysis as constraint solving

Program analysis as constraint solving

An Algorithm Inspired by Constraint Solvers to Infer Inductive Invariants in Numeric Programs

Constraint-Based Invariant Inference over Predicate Abstraction

Contact Info

Product

Resources

About