Reasoning About Vectors Using an SMT Theory of Sequences

Abstract

Dynamic arrays, also referred to as vectors, are fundamental data structures used in many programs. Modeling their semantics efficiently is crucial when reasoning about such programs. The theory of arrays is widely supported but is not ideal, because the number of elements is fixed (determined by its index sort) and cannot be adjusted, which is a problem, given that the length of vectors often plays an important role when reasoning about vector programs. In this paper, we propose reasoning about vectors using a theory of sequences. We introduce the theory, propose a basic calculus adapted from one for the theory of strings, and extend it to efficiently handle common vector operations. We prove that our calculus is sound and show how to construct a model when it terminates with a saturated configuration. Finally, we describe an implementation of the calculus in cvc5 and demonstrate its efficacy by evaluating it on verification conditions for smart contracts and benchmarks derived from existing array benchmarks.

On SMT Theory Design: The Case of Sequences

“…Recent studies tend to confirm our hypothesis: it is more efficient to verify properties of such data structures with an SMT solver by using the theory of sequences rather than the theory of arrays with additional axiomatization [22].…”

“…Its signature is largely based on that of the theory of strings. From the available literature [22] and the properties of sequences in the theory, such as being 0-indexed and having dynamic lengths, we understand that the theory of sequences serves the purpose of more adequately representing arrays as found in programming languages than what the theory of arrays can do. However, a seq.set function in Seq, which would correspond to the store function in the theory of arrays and store one value at one index in a sequence, is missing.…”

“…The theory of sequences was introduced relatively recently, it was first formalized by Bjørner et al [3]. Sheng et al developed calculi to reason over their variant of the theory of sequences [22]. Additionally, there are works on the theory of arrays that extend the theory with a length function [5,15], a concatenation function [23], and others [6,12,14], giving arrays similar properties to those of sequences.…”

“…The SMT theory of sequences was proposed by Bjørner et al [3] as a generalization of the theory of strings to non-character values (Seq). State-of-the-art SMT solvers such as CVC5 2 [22] and Z3 3 support theories of sequences, referred to as Seq cvc5 and Seq z3 respectively. Their signatures share many symbols with Seq, along with some additions and deductions.…”

“…We present the signatures of Seq cvc5 and Seq z3 , starting with the shared symbols of the two, then the specificities of each one: The seq.update function is described differently in the paper that describes the reasoning implemented in CVC5 [22] for the theory of sequences and in the documentation of CVC5 4 . In the paper, it is described as a function that sets only the value of one index, and takes that value as a third argument, while in the documentation it takes a sequence as a third argument.…”