On Solving Word Equations Using SAT

  • Joel D. Day
  • Thorsten Ehlers
  • Mitja KulczynskiEmail author
  • Florin Manea
  • Dirk Nowotka
  • Danny Bøgsted Poulsen
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11674)


We present Woorpje, a string solver for bounded word equations (i.e., equations where the length of each variable is upper bounded by a given integer). Our algorithm works by reformulating the satisfiability of bounded word equations as a reachability problem for nondeterministic finite automata, and then carefully encoding this as a propositional satisfiability problem, which we then solve using the well-known Glucose SAT-solver. This approach has the advantage of allowing for the natural inclusion of additional linear length constraints. Our solver obtains reliable and competitive results and, remarkably, discovered several cases where state-of-the-art solvers exhibit a faulty behaviour.


  1. 1.
    Abdulla, P.A., et al.: Norn: an SMT solver for string constraints. In: Kroening, D., Păsăreanu, C.S. (eds.) CAV 2015. LNCS, vol. 9206, pp. 462–469. Springer, Cham (2015). Scholar
  2. 2.
    Abío, I., Stuckey, P.J.: Encoding linear constraints into SAT. In: O’Sullivan, B. (ed.) CP 2014. LNCS, vol. 8656, pp. 75–91. Springer, Cham (2014). Scholar
  3. 3.
    Audemard, G., Simon, L.: On the glucose SAT solver. Int. J. Artif. Intell. Tools 27(01), 1840001 (2018)CrossRefGoogle Scholar
  4. 4.
    Barrett, C., et al.: CVC4. In: Gopalakrishnan, G., Qadeer, S. (eds.) CAV 2011. LNCS, vol. 6806, pp. 171–177. Springer, Heidelberg (2011). Scholar
  5. 5.
    Berzish, M., Ganesh, V., Zheng, Y.: Z3str3: a string solver with theory-aware heuristics. In: 2017 Formal Methods in Computer Aided Design (FMCAD), pp. 55–59, October 2017Google Scholar
  6. 6.
    Bjørner, N., Tillmann, N., Voronkov, A.: Path feasibility analysis for string-manipulating programs. In: Kowalewski, S., Philippou, A. (eds.) TACAS 2009. LNCS, vol. 5505, pp. 307–321. Springer, Heidelberg (2009). Scholar
  7. 7.
    Cadar, C., Dunbar, D., Engler, D.R.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: Draves, R., van Renesse, R. (eds.) 8th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2008, 8–10 December 2008, San Diego, California, USA, Proceedings, pp. 209–224. USENIX Association (2008).
  8. 8.
    Chen, T., Hague, M., Lin, A.W., Rümmer, P., Wu, Z.: Decision procedures for path feasibility of string-manipulating programs with complex operations. Proc. ACM Program. Lang. 3(POPL), 49 (2019)CrossRefGoogle Scholar
  9. 9.
    Cordeiro, L., Kesseli, P., Kroening, D., Schrammel, P., Trtik, M.: JBMC: a bounded model checking tool for verifying Java bytecode. In: Chockler, H., Weissenbacher, G. (eds.) CAV 2018. LNCS, vol. 10981, pp. 183–190. Springer, Cham (2018). Scholar
  10. 10.
    Day, J.D., Manea, F., Nowotka, D.: The hardness of solving simple word equations. In: Proceedings of MFCS 2017. LIPIcs, vol. 83, pp. 18:1–18:14 (2017)Google Scholar
  11. 11.
    Holík, L., Jank P., Lin, A.W., Rümmer, P., Vojnar, T.: String constraints with concatenation and transducers solved efficiently. Proc. ACM Program. Lang. 2(POPL), 4 (2017)CrossRefGoogle Scholar
  12. 12.
    Jeż, A.: Recompression: a simple and powerful technique for word equations. In: 30th International Symposium on Theoretical Aspects of Computer Science, STACS 2013, 27 February- 2 March 2013, Kiel, Germany, pp. 233–244 (2013).
  13. 13.
    Jeż, A.: Word equations in nondeterministic linear space. In: Proceedings of ICALP 2017. LIPIcs, vol. 80, pp. 95:1–95:13. Schloss Dagstuhl - Leibniz-Zentrum fuer Informatik (2017)Google Scholar
  14. 14.
    Karhumäki, J., Mignosi, F., Plandowski, W.: The expressibility of languages and relations by word equations. J. ACM (JACM) 47(3), 483–505 (2000)MathSciNetCrossRefGoogle Scholar
  15. 15.
    Kiezun, A., Ganesh, V., Guo, P.J., Hooimeijer, P., Ernst, M.D.: Hampi: a solver for string constraints. In: Proceedings of the Eighteenth International Symposium on Software Testing and Analysis, pp. 105–116. ACM (2009)Google Scholar
  16. 16.
    Makanin, G.S.: The problem of solvability of equations in a free semigroup. Sbornik: Math. 32(2), 129–198 (1977)MathSciNetCrossRefGoogle Scholar
  17. 17.
    Plandowski, W., Rytter, W.: Application of Lempel-Ziv encodings to the solution of word equations. In: Larsen, K.G., Skyum, S., Winskel, G. (eds.) ICALP 1998. LNCS, vol. 1443, pp. 731–742. Springer, Heidelberg (1998). Scholar
  18. 18.
    Plandowski, W.: Satisfiability of word equations with constants is in PSPACE. In: 40th Annual Symposium on Foundations of Computer Science, pp. 495–500. IEEE (1999)Google Scholar
  19. 19.
    Saxena, P., Akhawe, D., Hanna, S., Mao, F., McCamant, S., Song, D.: A symbolic execution framework for Javascript. In: 2010 IEEE Symposium on Security and Privacy, pp. 513–528. IEEE (2010)Google Scholar
  20. 20.
    Trinh, M.-T., Chu, D.-H., Jaffar, J.: Progressive reasoning over recursively-defined strings. In: Chaudhuri, S., Farzan, A. (eds.) CAV 2016. LNCS, vol. 9779, pp. 218–240. Springer, Cham (2016). Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Joel D. Day
    • 1
  • Thorsten Ehlers
    • 2
  • Mitja Kulczynski
    • 3
    Email author
  • Florin Manea
    • 3
  • Dirk Nowotka
    • 3
  • Danny Bøgsted Poulsen
    • 3
  1. 1.Department of Computer ScienceLoughborough UniversityLoughboroughUK
  2. 2.German Aerospace Center (DLR)Helmholtz AssociationHamburgGermany
  3. 3.Department of Computer ScienceKiel UniversityKielGermany

Personalised recommendations