10,162 research outputs found
Transfer Function Synthesis without Quantifier Elimination
Traditionally, transfer functions have been designed manually for each
operation in a program, instruction by instruction. In such a setting, a
transfer function describes the semantics of a single instruction, detailing
how a given abstract input state is mapped to an abstract output state. The net
effect of a sequence of instructions, a basic block, can then be calculated by
composing the transfer functions of the constituent instructions. However,
precision can be improved by applying a single transfer function that captures
the semantics of the block as a whole. Since blocks are program-dependent, this
approach necessitates automation. There has thus been growing interest in
computing transfer functions automatically, most notably using techniques based
on quantifier elimination. Although conceptually elegant, quantifier
elimination inevitably induces a computational bottleneck, which limits the
applicability of these methods to small blocks. This paper contributes a method
for calculating transfer functions that finesses quantifier elimination
altogether, and can thus be seen as a response to this problem. The
practicality of the method is demonstrated by generating transfer functions for
input and output states that are described by linear template constraints,
which include intervals and octagons.Comment: 37 pages, extended version of ESOP 2011 pape
(Un)Decidability Results for Word Equations with Length and Regular Expression Constraints
We prove several decidability and undecidability results for the
satisfiability and validity problems for languages that can express solutions
to word equations with length constraints. The atomic formulas over this
language are equality over string terms (word equations), linear inequality
over the length function (length constraints), and membership in regular sets.
These questions are important in logic, program analysis, and formal
verification. Variants of these questions have been studied for many decades by
mathematicians. More recently, practical satisfiability procedures (aka SMT
solvers) for these formulas have become increasingly important in the context
of security analysis for string-manipulating programs such as web applications.
We prove three main theorems. First, we give a new proof of undecidability
for the validity problem for the set of sentences written as a forall-exists
quantifier alternation applied to positive word equations. A corollary of this
undecidability result is that this set is undecidable even with sentences with
at most two occurrences of a string variable. Second, we consider Boolean
combinations of quantifier-free formulas constructed out of word equations and
length constraints. We show that if word equations can be converted to a solved
form, a form relevant in practice, then the satisfiability problem for Boolean
combinations of word equations and length constraints is decidable. Third, we
show that the satisfiability problem for quantifier-free formulas over word
equations in regular solved form, length constraints, and the membership
predicate over regular expressions is also decidable.Comment: Invited Paper at ADDCT Workshop 2013 (co-located with CADE 2013
On Optimization Modulo Theories, MaxSMT and Sorting Networks
Optimization Modulo Theories (OMT) is an extension of SMT which allows for
finding models that optimize given objectives. (Partial weighted) MaxSMT --or
equivalently OMT with Pseudo-Boolean objective functions, OMT+PB-- is a
very-relevant strict subcase of OMT. We classify existing approaches for MaxSMT
or OMT+PB in two groups: MaxSAT-based approaches exploit the efficiency of
state-of-the-art MAXSAT solvers, but they are specific-purpose and not always
applicable; OMT-based approaches are general-purpose, but they suffer from
intrinsic inefficiencies on MaxSMT/OMT+PB problems.
We identify a major source of such inefficiencies, and we address it by
enhancing OMT by means of bidirectional sorting networks. We implemented this
idea on top of the OptiMathSAT OMT solver. We run an extensive empirical
evaluation on a variety of problems, comparing MaxSAT-based and OMT-based
techniques, with and without sorting networks, implemented on top of
OptiMathSAT and {\nu}Z. The results support the effectiveness of this idea, and
provide interesting insights about the different approaches.Comment: 17 pages, submitted at Tacas 1
Adapting Real Quantifier Elimination Methods for Conflict Set Computation
The satisfiability problem in real closed fields is decidable. In the context
of satisfiability modulo theories, the problem restricted to conjunctive sets
of literals, that is, sets of polynomial constraints, is of particular
importance. One of the central problems is the computation of good explanations
of the unsatisfiability of such sets, i.e.\ obtaining a small subset of the
input constraints whose conjunction is already unsatisfiable. We adapt two
commonly used real quantifier elimination methods, cylindrical algebraic
decomposition and virtual substitution, to provide such conflict sets and
demonstrate the performance of our method in practice
Pushing the envelope of Optimization Modulo Theories with Linear-Arithmetic Cost Functions
In the last decade we have witnessed an impressive progress in the
expressiveness and efficiency of Satisfiability Modulo Theories (SMT) solving
techniques. This has brought previously-intractable problems at the reach of
state-of-the-art SMT solvers, in particular in the domain of SW and HW
verification. Many SMT-encodable problems of interest, however, require also
the capability of finding models that are optimal wrt. some cost functions. In
previous work, namely "Optimization Modulo Theory with Linear Rational Cost
Functions -- OMT(LAR U T )", we have leveraged SMT solving to handle the
minimization of cost functions on linear arithmetic over the rationals, by
means of a combination of SMT and LP minimization techniques. In this paper we
push the envelope of our OMT approach along three directions: first, we extend
it to work also with linear arithmetic on the mixed integer/rational domain, by
means of a combination of SMT, LP and ILP minimization techniques; second, we
develop a multi-objective version of OMT, so that to handle many cost functions
simultaneously; third, we develop an incremental version of OMT, so that to
exploit the incrementality of some OMT-encodable problems. An empirical
evaluation performed on OMT-encoded verification problems demonstrates the
usefulness and efficiency of these extensions.Comment: A slightly-shorter version of this paper is published at TACAS 2015
conferenc
- …