Sharpening Constraint Programming Approaches for Bit-Vector Theory

Abstract

We address the challenge of developing efficient Constraint Programming-based approaches for solving formulas over the quantifier-free fragment of the theory of bitvectors (BV), which is of paramount importance in software verification. We propose CP(BV), a highly efficient BV resolution technique built on carefully chosen anterior results sharpened with key original features such as thorough domain combination or dedicated labeling. Extensive experimental evaluations demonstrate that CP(BV) is much more efficient than previous similar attempts from the CP community, that it is indeed able to solve the majority of the standard verification benchmarks for bitvectors, and that it already complements the standard SMT approaches on several crucial (and industry-relevant) aspects, notably in terms of scalability w.r.t. bit-width, theory combination or intricate mix of non-linear arithmetic and bitwise operators. This work paves the way toward building competitive CP-based verification-oriented solvers. * Work partially funded by ANR under grants ANR-14-CE28-0020 and ANR-12-INSE-0002. The CP solver COLIBRI is generously sponsored by IRSN, the French nuclear safety agency.

Automating the Verification of Floating-Point Programs

“…The tables from Figures 2 and 4 summarize the proof results with provers from the current SPARK toolset: SMT solvers CVC4, Alt-Ergo, Z3 and static analyzer CodePeer. We add in these figures two provers: AE_fpa, the prototype of Alt-Ergo with FP support [12], and COLIBRI, a prover based on constraint solving techniques [28,11]. Dark cells correspond to unproved VCs with a given prover.…”

Wombit: A Portfolio Bit-Vector Solver Using Word-Level Propagation

“…However, the work by Bardin et al [14] has narrowed the gap between the word-level solving approach and the SAT solving approach considerably, and the gap continues to narrow. Chihani et al [22] extend the work of Bardin et al [14] by utilising the representational idea of Michel and Van Hentenryck [50] (what we have called lo-hi form) to build a CP-based bit-vector solver which enables channelling with other constraint domains, such as bounds constraints and global difference constraints [29]. Chihani, Bobot and Bardin [21] further argue for word-level conflict analysis and learning, to replace the bit-learning that we have delegated to a SAT solver.…”

CDCL-inspired Word-level Learning for Bit-vector Constraint Solving

“…Recent efforts in both the CP and SMT communities have demonstrated the potential benefits of word-level reasoning over bitvectors [12,13,14,15,16,17] (where structural information "is not blasted into bits" [18]), but these works are mostly limited to the propagation step while the strength of modern SAT solvers rely on their learning mechanism [11]. Actually, two recent works [15,19] do combine word-level propagation and learning for bitvectors, yet the learning is either bit-level [15] or assignment-dependent [19] in the vein of NoGood Learning [20].…”

“…• Finally, our learning mechanism, being based on resolution, can be combined with resolution-based learning on other theories (notably arithmetic), allowing to learn also from simplifications (Sec. 3.4) used at propagation [14].…”

“…Discussion. This work paves the way to truly word-level decision procedures for bitvectors, taking full advantage of the word-level propagations recently designed in both CP [12,13,14,15] and SMT communities [16,17,19]. The presentation of our technique is high-level.…”