Towards Bit-Width-Independent Proofs in SMT Solvers

Abstract

Many SMT solvers implement efficient SAT-based procedures for solving fixed-size bit-vector formulas. These approaches, however, cannot be used directly to reason about bit-vectors of symbolic bit-width. To address this shortcoming, we propose a translation from bit-vector formulas with parametric bit-width to formulas in a logic supported by SMT solvers that includes non-linear integer arithmetic, uninterpreted functions, and universal quantification. While this logic is undecidable, this approach can still solve many formulas by capitalizing on advances in SMT solving for non-linear arithmetic and universally quantified formulas. We provide several case studies in which we have applied this approach with promising results, including the bit-width independent verification of invertibility conditions, compiler optimizations, and bit-vector rewrites. Symbol SMT-LIB Syntax

Verifying Bit-vector Invertibility Conditions in Coq (Extended Abstract)

“…To overcome this limitation, a later paper by Niemetz et al [10] suggested a translation from bit-vector formulas with parametric bit-widths to the theory of (non-linear) integer arithmetic with uninterpreted functions. Thanks to this translation, the authors were able to verify, with the aid of SMT solvers for the theory of integer arithmetic with uninterpreted functions, the correctness of 110 out of 160 invertibility equivalences.…”

“…In the rest of this paper we describe our initial efforts and future plans for proving the invertibility equivalences, starting with those that were not proved in [10].…”

“…Table 1 summarizes the results of proving invertibility equivalences for invertibility conditions in the signature Σ 0 . In the table, means that the invertibility equivalence was successfully verified in Coq but not in [10], while means the opposite; means that the invertibility equivalence was verified using both approaches, and means that it was verified with neither. We successfully proved all invertibility 1 Lemma bv_ule_1_firstn : forall (n : nat) (x : bitvector), 2 (n < length x)%nat -> 3 bv_ule (firstn n x) (firstn n (mk_list_true (length x))) = true.…”

“…equivalences over = that are expressible in Σ 0 , including 4 that were not proved in [10]. For the rest of the predicates, we focused only on the 8 invertibility equivalences that were not proved in [10], and succeeded in proving 7 of them.…”

“…However, they were able to verify, using SMT solvers, the corresponding invertibility equivalences only for concrete bit-widths up to 65, given the reasoning limitations of SMT solvers mentioned earlier. A recent paper by Niemetz et al [10] addresses this challenge by translating these invertibility equivalences into quantified formulas over the combined theory of non-linear integer arithmetic and uninterpreted functions -a theory supported by a number of SMT solvers. While partially successful, this approach failed to verify over a quarter of the invertibility equivalences.…”