Reliable reconstruction of Z3 function models for OSVAuto

Develop a robust procedure to reconstruct models returned by the Z3 SMT solver for interpreted function symbols so that OSVAuto can always convert these models back into OSVAuto’s language (covering structures, algebraic datatypes, and maps) for diagnosis and counterexample presentation in all cases.

Background

OSVAuto relies on models returned by the Z3 SMT solver to diagnose failed proof attempts by reconstructing counterexamples in the tool’s own specification language. This requires interpreting Z3’s function models, which are provided as input-output pairs plus an else branch, and mapping them back to OSVAuto’s constructs such as structures, algebraic datatypes, and maps.

The authors report that, due to the non-standard format Z3 uses for models of functions, they cannot always recover such models. This unresolved issue limits OSVAuto’s ability to consistently provide diagnostic models to users, motivating a concrete need for a method that reliably reconstructs Z3’s function interpretations in all cases.

References

Currently, we are unable to always recover the model from the SMT solver, due to the non-standard format for the model returned for the functions.

OSVAuto: automatic proofs about functional specifications in OS verification  (2403.13457 - Wu et al., 2024) in Subsection “Future improvements” (within Section “Evaluation”)