421 research outputs found
Incomplete SMT techniques for solving non-linear formulas over the integers
We present new methods for solving the Satisfiability Modulo Theories problem over the theory of QuantifierFree Non-linear Integer Arithmetic, SMT(QF-NIA), which consists of deciding the satisfiability of ground formulas with integer polynomial constraints. Following previous work, we propose to solve SMT(QF-NIA)
instances by reducing them to linear arithmetic: non-linear monomials are linearized by abstracting them
with fresh variables and by performing case splitting on integer variables with finite domain. For variables
that do not have a finite domain, we can artificially introduce one by imposing a lower and an upper bound
and iteratively enlarge it until a solution is found (or the procedure times out).
The key for the success of the approach is to determine, at each iteration, which domains have to be
enlarged. Previously, unsatisfiable cores were used to identify the domains to be changed, but no clue was
obtained as to how large the new domains should be. Here, we explain two novel ways to guide this process by
analyzing solutions to optimization problems: (i) to minimize the number of violated artificial domain bounds,
solved via a Max-SMT solver, and (ii) to minimize the distance with respect to the artificial domains, solved
via an Optimization Modulo Theories (OMT) solver. Using this SMT-based optimization technology allows
smoothly extending the method to also solve Max-SMT problems over non-linear integer arithmetic. Finally,
we leverage the resulting Max-SMT(QF-NIA) techniques to solve ∃∀ formulas in a fragment of quantified
non-linear arithmetic that appears commonly in verification and synthesis applications.Peer ReviewedPostprint (author's final draft
Adapting Real Quantifier Elimination Methods for Conflict Set Computation
The satisfiability problem in real closed fields is decidable. In the context
of satisfiability modulo theories, the problem restricted to conjunctive sets
of literals, that is, sets of polynomial constraints, is of particular
importance. One of the central problems is the computation of good explanations
of the unsatisfiability of such sets, i.e.\ obtaining a small subset of the
input constraints whose conjunction is already unsatisfiable. We adapt two
commonly used real quantifier elimination methods, cylindrical algebraic
decomposition and virtual substitution, to provide such conflict sets and
demonstrate the performance of our method in practice
On Counterexample Guided Quantifier Instantiation for Synthesis in CVC4
We introduce the first program synthesis engine implemented inside an SMT
solver. We present an approach that extracts solution functions from
unsatisfiability proofs of the negated form of synthesis conjectures. We also
discuss novel counterexample-guided techniques for quantifier instantiation
that we use to make finding such proofs practically feasible. A particularly
important class of specifications are single-invocation properties, for which
we present a dedicated algorithm. To support syntax restrictions on generated
solutions, our approach can transform a solution found without restrictions
into the desired syntactic form. As an alternative, we show how to use
evaluation function axioms to embed syntactic restrictions into constraints
over algebraic datatypes, and then use an algebraic datatype decision procedure
to drive synthesis. Our experimental evaluation on syntax-guided synthesis
benchmarks shows that our implementation in the CVC4 SMT solver is competitive
with state-of-the-art tools for synthesis
Formalization and Validation of Safety-Critical Requirements
The validation of requirements is a fundamental step in the development
process of safety-critical systems. In safety critical applications such as
aerospace, avionics and railways, the use of formal methods is of paramount
importance both for requirements and for design validation. Nevertheless, while
for the verification of the design, many formal techniques have been conceived
and applied, the research on formal methods for requirements validation is not
yet mature. The main obstacles are that, on the one hand, the correctness of
requirements is not formally defined; on the other hand that the formalization
and the validation of the requirements usually demands a strong involvement of
domain experts. We report on a methodology and a series of techniques that we
developed for the formalization and validation of high-level requirements for
safety-critical applications. The main ingredients are a very expressive formal
language and automatic satisfiability procedures. The language combines
first-order, temporal, and hybrid logic. The satisfiability procedures are
based on model checking and satisfiability modulo theory. We applied this
technology within an industrial project to the validation of railways
requirements
Invariant Generation through Strategy Iteration in Succinctly Represented Control Flow Graphs
We consider the problem of computing numerical invariants of programs, for
instance bounds on the values of numerical program variables. More
specifically, we study the problem of performing static analysis by abstract
interpretation using template linear constraint domains. Such invariants can be
obtained by Kleene iterations that are, in order to guarantee termination,
accelerated by widening operators. In many cases, however, applying this form
of extrapolation leads to invariants that are weaker than the strongest
inductive invariant that can be expressed within the abstract domain in use.
Another well-known source of imprecision of traditional abstract interpretation
techniques stems from their use of join operators at merge nodes in the control
flow graph. The mentioned weaknesses may prevent these methods from proving
safety properties. The technique we develop in this article addresses both of
these issues: contrary to Kleene iterations accelerated by widening operators,
it is guaranteed to yield the strongest inductive invariant that can be
expressed within the template linear constraint domain in use. It also eschews
join operators by distinguishing all paths of loop-free code segments. Formally
speaking, our technique computes the least fixpoint within a given template
linear constraint domain of a transition relation that is succinctly expressed
as an existentially quantified linear real arithmetic formula. In contrast to
previously published techniques that rely on quantifier elimination, our
algorithm is proved to have optimal complexity: we prove that the decision
problem associated with our fixpoint problem is in the second level of the
polynomial-time hierarchy.Comment: 35 pages, conference version published at ESOP 2011, this version is
a CoRR version of our submission to Logical Methods in Computer Scienc
Automatic generation of loop invariants
CppInv works in two stages. Firstly, it parses a source code written in a subset of
C++ and abstracts all execution paths of the program building a control flow graph
associated to a transition system. Paths are expressed as arbitrary propositional
formulas over linear integer arithmetic including high level operators like integer
division and modulo. That makes easy the initial modeling. Later, formulas are
normalized and only paths between a set of locations that cover every cycle of the
control flow graph are regarded.
Secondly, CppInv generates linear invariants at the selected locations setting out
a constraint solving problem. We present a method to discover all linear invariant
of the considered form.
As a result, our tool can find linear invariants efficiently for a large set of interesting
programs. Moreover, CppInv is also able to generate some non-linear invariants
automatically. For instance, it is possible to prove the total correctness of a program
that multiplies two integers from the invariants returned by the tool
- …