Applications and Challenges in Satisfiability Modulo Theories

The area of software analysis, testing and verification is no w undergoing a revolution thanks to the use of automated and scalable support for logical meth ods. A well-recognized premise is that at the core of software analysis engines is invariably a component using logical formulas for describing states and transformations between system stat es. One can thus say that symbolic logic is the calculus of computation. The process of using this inf ormation for discovering and checking program properties (including such important properties a s afety and security) amounts to automatic theorem proving. In particular, theorem provers that direc tly support common software constructs offer a compelling basis. Such provers are commonly called s atisfiability modulo theories (SMT) solvers. Z3 is the leading SMT solver. It is developed by the a uthors at Microsoft Research. It can be used to check the satisfiability of logical formulas over o ne r more theories such as arithmetic, bit-vectors, lists, records and arrays. This paper examines three applications of Z3 in the context o f invariant generation. The first lets Z3 infer invariants as a constraint satisfaction problem, t he second application illustrates the use of Z3 for bit-precise analysis and our third application exemp lifies using Z3 for calculations.