Solution Enumeration Abstraction: A Modeling Idiom to Enhance a Lightweight Formal Method

Sullivan, Allison; Marinov, Darko; Khurshid, Sarfraz

doi:10.1007/978-3-030-32409-4_21

Cited by 11 publications

(8 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Convergence in Lazy All-SMT. Many algorithms in automated reasoning work in the style of the lazy All-SMT loop [John and Chakraborty 2011;Lahiri et al 2006;Monniaux 2010;Sullivan et al 2019]. These algorithms iteratively enumerate the models of a formula φ, which are used to "generalize" some abstraction; the iteration terminates until the abstraction has encompassed the formula's solution space.…”

Section: Discussionmentioning

confidence: 99%

Program analysis via efficient symbolic abstraction

Yao

Shi²,

Huang

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

This paper concerns the scalability challenges of symbolic abstraction: given a formula ϕ in a logic L and an abstract domain A , find a most precise element in the abstract domain that over-approximates the meaning of ϕ. Symbolic abstraction is an important point in the space of abstract interpretation, as it allows for automatically synthesizing the best abstract transformers. However, current techniques for symbolic abstraction can have difficulty delivering on its practical strengths, due to performance issues. In this work, we introduce two algorithms for the symbolic abstraction of quantifier-free bit-vector formulas, which apply to the bit-vector interval domain and a certain kind of polyhedral domain, respectively. We implement and evaluate the proposed techniques on two machine code analysis clients, namely static memory corruption analysis and constrained random fuzzing. Using a suite of 57,933 queries from the clients, we compare our approach against a diverse group of state-of-the-art algorithms. The experiments show that our algorithms achieve a substantial speedup over existing techniques and illustrate significant precision advantages for the clients. Our work presents strong evidence that symbolic abstraction of numeric domains can be efficient and practical for large and realistic programs.

show abstract

Section: Discussionmentioning

confidence: 99%

Program analysis via efficient symbolic abstraction

Yao

Shi²,

Huang

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…One traditional approach is to reduce the number of scenarios through symmetry breaking, where constraints are added to the formula to remove isomorphic solutions [6,27,13]. Beyond symmetry breaking, several past projects improve scenario enumeration by trying to narrow what scenarios are generated using a specific criteria, e.g., abstract functions [29], minimality [21], field exhaustiveness [23], and coverage [31,24]. All of these techniques reduce the number of scenarios by applying some criteria across the entire enumeration.…”

Section: Related Workmentioning

confidence: 99%

REACH: Refining Alloy Scenarios by Scope

Jovanović¹,

Sullivan²

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Writing declarative models has numerous benefits, ranging from automated reasoning and correction of design-level properties before systems are built, to automated testing and debugging of their implementations after they are built. Alloy is a declarative modeling language that is well suited for verifying system designs. A key strength of Alloy is its scenario-finding toolset, the Analyzer, which allows users to explore all valid scenarios that adhere to the model's constraints up to a user-provided scope. In Alloy, it is common for users to desire to first validate smaller scenarios, then once confident, move onto validating larger scenarios. However, the Analyzer only presents scenarios in the order they are discovered by the SAT solver. This paper presents Reach, an extension to the Analyzer which allows users to explore scenarios by size. Experimental results reveal Reach's enumeration improves performance while having the added benefit of maintaining a semi-sorted ordering of scenarios for the user. Moreover, we highlight Reach's ability to improve the performance of Alloy's analysis when the user makes incremental changes to the scope of the enumeration. Reach is available at: https://reachenumerator.github.io/

show abstract

“…If conflict analysis is carried out as described in Subsection 3.2, the learned clause ¬I contains only negated assumption literals. 11 On the one hand, ¬I represents a cause for the conflict in N . On the other hand, due to Equation 5, its negation I represents a (partial) model of F .…”

Section: Dual Reasoning For Model Shrinkingmentioning

confidence: 99%

“…Propositional model enumeration (All-SAT) 1 is the task of enumerating (all) satisfying assignments of a propositional formula. It is a key task in, e. g., bounded and unbounded model checking [1,2,3,4,5,6], image computation [7,8,9,10], system engineering [11], predicate abstraction [12], and lazy Satisfiability Modulo Theories [13].…”

Section: Introductionmentioning

confidence: 99%

“…Another example is weighted model integration (WMI) [33,34] which generalizes WMC for hybrid domains. In some applications, repeating models might lead to inefficiency and harm scalability [11]. In the context of model counting but also relevant in model enumartion, Bayardo and Pehoushek [35] identified the need for good learning similarly to its learning counterpart in CDCL, and various measures have therefore been proposed to avoid the multiple enumeration of models.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

On Enumerating Short Projected Models

Möhle¹,

Sebastiani²,

Biere³

2021

Preprint

View full text Add to dashboard Cite

Propositional model enumeration, or All-SAT, is the task to record all models of a propositional formula. It is a key task in software and hardware verification, system engineering, and predicate abstraction, to mention a few. It also provides a means to convert a CNF formula into DNF, which is relevant in circuit design. While in some applications enumerating models multiple times causes no harm, in others avoiding repetitions is crucial. We therefore present two model enumeration algorithms, which adopt dual reasoning in order to shorten the found models. The first method enumerates pairwise contradicting models. Repetitions are avoided by the use of so-called blocking clauses, for which we provide a dual encoding. In our second approach we relax the uniqueness constraint. We present an adaptation of the standard conflict-driven clause learning procedure to support model enumeration without blocking clauses. Our procedures are expressed by means of a calculus and proofs of correctness are provided.

show abstract

Solution Enumeration Abstraction: A Modeling Idiom to Enhance a Lightweight Formal Method

Cited by 11 publications

References 36 publications

Program analysis via efficient symbolic abstraction

Program analysis via efficient symbolic abstraction

REACH: Refining Alloy Scenarios by Scope

On Enumerating Short Projected Models

Contact Info

Product

Resources

About