<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>On Intervals and Bounds in Bit-vector Arithmetic</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Mikolas Janota</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Christoph M. Wintersteiger</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Microsoft Research</institution>
        </aff>
      </contrib-group>
      <fpage>2</fpage>
      <lpage>5</lpage>
      <abstract>
        <p>interpretation [3,2]. For the purpose of the memo we assume a xed bit-with w 2 N+. A bit vector variable is seen as an integer variable with possible values 0::(2w 1). Addition a +w b is de ned as (a + b) mod 2w. Two types of comparisons are de ned: unsigned a u b and signed a s b. The unsigned is standard integer comparison, i.e., a u b , a b. The signed uses the two's complement representation for signed numbers. Hence, we have a s b , s(a) s(b), where s(a) , a &lt; 2w 1 ? a : a 2w. Consider a conjunction V1::m :(ai bi) ^ Vm+1::n(ai bi), where ai bi is one of the following forms with x a bit-vector variable and c1; c2 constants.</p>
      </abstract>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>Introduction</title>
    </sec>
    <sec id="sec-2">
      <title>De nition</title>
      <p>2. c1
3. c1 +w x
4. x s c1
5. c1 s x
1. c1 +w x u c2 +w x
u c2 +w x</p>
      <p>u c2</p>
      <p>Problem: Decide whether the input has a solution and if it has, determine
if it is unique.</p>
    </sec>
    <sec id="sec-3">
      <title>Solution</title>
      <p>We show that every constraint of the form above can be represented as a positive
or negative interval constraint. We write [a ; b] and v[a ; b] for the positive and
negative interval ranging from a to b inclusively, respectively. Hence, [a ; b] for
0 a; b &lt; 2w denotes the set of values from a to b and v[a ; b] the values v with
(0 v &lt; a) _ (b &lt; v &lt; 2w). Observe that [a ; b] [ v[a ; b] = [0 ; 2w 1]. For a &gt; b,
it holds that [a ; b] = ; and v[a ; b] = [0 ; 2w 1].
1 The algorithm is a generalization of a standard solution to \The Interval Point Cover
Problem".</p>
      <p>Algorithm 1: Compute bounds</p>
      <p>input : Set of intervals I
1 P f[a ; b] j [a ; b] 2 Ig
2 l P = ; ? 0 : min fa j [a ; b] 2 P g
3 h P = ; ? 2w 1 : max fb j [a ; b] 2 P g
4 N fv[a ; b] j v[a ; b] 2 Ig
5 N sort N by rst element
6 p; l0; h0 l; l; l 1
7 for v[a ; b] 2 N [ v[2w ; 2w] do
8 if p &gt; h then break
9 if b &lt; p then continue
10 if p &lt; a then
11 if h0 &gt; l0 then l0 p
12 h0 a 1
13
p
3.1 Implementation and Redundancies
Algorithm 1 can be implemented in a straightforward fashion. Positive intervals
do not need to be explicitly stored. Rather, we maintain a lower and upper bound
L and U , respectively. These are updated with every new positive interval. These
bounds let us also simplify negative intervals. An interval v[a ; b] with a L
is simpli ed to [b + 1 ; 2w 1]. Analogously, v[a ; b] with b u is simpli ed to
[0 ; a 1].</p>
      <p>Maintaining the upper and lower bounds lets us quickly detect if a new
interval is redundant. A positive interval [a ; b] is redundant if L a ^ b U
and a negative interval v[a ; b] is redundant if a &gt; U _ b &lt; L. Note that such
detection of redundancies depends on the order of processing the intervals.
4</p>
    </sec>
    <sec id="sec-4">
      <title>Examples</title>
      <p>
        To measure the e ect of the individual simpli cations we construct several
examples. (
        <xref ref-type="bibr" rid="ref1">1</xref>
        ) For c1 &lt; c2, the conjunct x +w c1 x +w c2 ^ x +w c2 x +w c1
is unsatis able. (
        <xref ref-type="bibr" rid="ref2">2</xref>
        ) For x +w c1 x +w c2 ^ x +w d1 x +w d2 the second
conjunct is redundant if c2 d2 d1 1 c1 1. (
        <xref ref-type="bibr" rid="ref3">3</xref>
        ) For x +w c1
x +w c2 ^ x +w d1 x +w d2 ^ x +w a x +w b we obtain x = c1 if c2 a
c1 1 b 1 d1 1 and d2 = c1 + 1.
      </p>
      <p>We generated 100 random instances for 32-bit numbers for each example and
applied the standard bit-blasting technique in Z3 on them. Table 2 overviews
the number of con icts in the SAT solver.</p>
      <p>
        Examples (
        <xref ref-type="bibr" rid="ref1">1</xref>
        ) and (
        <xref ref-type="bibr" rid="ref2">2</xref>
        ) are completely solved by Algorithm 1. Hence,
implementing the algorithm in a preprocessor saves us the number of con icts
presented. For case (
        <xref ref-type="bibr" rid="ref2">2</xref>
        ) we compare the reduced and original instance, i.e., the
redundant version contains two conjuncts whereas the reduced version only one.
      </p>
      <p>The comparison shows that the biggest saving are in the case of unsatis able
constraints and constraints that lead to unique solution. In the case of redundant
intervals, however, the results do not indicate improvement.
5</p>
    </sec>
    <sec id="sec-5">
      <title>Conclusion and Future Work</title>
      <p>This memo shows how a system of inequalities over one variable and no
multiplication can be represented as a set of positive and negative intervals.
Naturally, such intervals are closed under negation, admit a polynomial satis ability
check and check for solution uniqueness. Preliminary evaluation suggests that
such analysis enables signi cant speedups. In the future we plan to integrate
this analysis into Z3 and investigate how could improve bit-vector solving by
approximating solutions as intervals.</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1. Bj rner, N.,
          <string-name>
            <surname>Blass</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gurevich</surname>
            ,
            <given-names>Y.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Musuvathi</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          :
          <article-title>Modular di erence logic is hard</article-title>
          .
          <source>CoRR abs/0811</source>
          .0987 (
          <year>2008</year>
          ), http://arxiv.org/abs/0811.0987
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <string-name>
            <surname>Elder</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Lim</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Sharma</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Andersen</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Reps</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          :
          <article-title>Abstract domains of a ne relations</article-title>
          .
          <source>ACM Trans. Program. Lang. Syst</source>
          .
          <volume>36</volume>
          (
          <issue>4</issue>
          ),
          <volume>11</volume>
          :1{
          <fpage>11</fpage>
          :73 (Oct
          <year>2014</year>
          ), http: //doi.acm.
          <source>org/10.1145/2651361</source>
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          3.
          <string-name>
            <surname>Sharma</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Thakur</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Reps</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          :
          <article-title>An abstract domain for bit-vector inequalities</article-title>
          .
          <source>Tech. Rep. TR1789</source>
          , University of Wisconsin-Madison (
          <year>2013</year>
          ), http://digital. library.wisc.edu/1793/65366
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>