STP is a constraint solver (or SMT solver) aimed at solving constraints of bitvectors and arrays. These types of constraints can be generated by program analysis tools, theorem provers, automated bug finders, cryptographic attack tools, intelligent fuzzers, model checkers, and by many other applications.

• Homepage: https://stp.github.io/

For a quick install:

sudo apt-get install git build-essential cmake bison flex libgmp-dev python3 perl
git clone https://github.com/stp/stp
cd stp
git submodule init && git submodule update
./scripts/deps/setup-cadical.sh
mkdir build
cd build
cmake -DUSE_CADICAL:BOOL=ON -DCADICAL_DIR:PATH="$(pwd)/../deps/cadical" ..
cmake --build . -j$(nproc)
sudo cmake --install .

Or, using Homebrew:

brew install stp

Or, with Docker, which needs nothing installed but Docker itself and reads the problem on standard input:

git clone https://github.com/stp/stp
cd stp
docker build -t stp .
echo "(set-logic QF_BV)
(assert (= (bvsdiv (_ bv3 2) (_ bv2 2)) (_ bv0 2)))
(check-sat)
(exit)" | docker run --rm -i stp

For more detailed instructions, see towards the end of the page.

The SMT-LIB2 format is the recommended file format, because it is parsed by all modern bitvector solvers. Only quantifier-free bitvectors and arrays are implemented from the SMT-LIB2 format.

Run with an SMT-LIB2 file:

stp myproblem.smt2

Overflowing a 32-bit integer using the python interface:

import stp

s = stp.Solver()
x = s.bitvec('x', width=32)
y = s.bitvec('y', width=32)
s.add(x + y < 20)
s.add(x > 10)
s.add(y > 10)
print(s.check())  # True
print(s.model())  # e.g. {'x': 4294967287, 'y': 11}

STP also reads from standard input, as in the Docker example above.

The system performs word-level preprocessing followed by translation to SAT which is then solved by a SAT solver. In particular, we introduce several new heuristics for the preprocessing step, including abstraction-refinement in the context of arrays, a new bitvector linear arithmetic equation solver, and some interesting simplifications. These heuristics help us achieve several magnitudes of order performance over other tools, and also over straight-forward translation to SAT. STP has been heavily tested on thousands of examples sourced from various real-world applications such as program analysis and bug-finding tools like EXE, and equivalence checking tools and theorem-provers.

STP is built with CMake, version 3.18 or newer. CMake is a meta build system that generates build files for other tools such as make(1), Visual Studio, Xcode, etc.

The 3.18 floor comes from the vendored mimalloc, which is the default allocator. On an older CMake, configure with -DSTP_ALLOCATOR=system to skip it and use the C library's malloc instead.

Here are a few interesting configuration variables. These apply to all generators.

• CMAKE_BUILD_TYPE - The build type (e.g. Release)
• CMAKE_INSTALL_PREFIX - The prefix for install (e.g. /usr/local )
• ENABLE_ASSERTIONS - If TRUE STP will be built with asserts.
• ENABLE_TESTING - Enable running tests
• ENABLE_PYTHON_INTERFACE - Enable building the Python interface (Python 3 only)
• PYTHON_EXECUTABLE - Set the Python 3 executable in case you have more than one python installed
• SANITIZE - Use Clang's sanitization checks
• STATICCOMPILE - Build static libraries and binaries instead of dynamic
• BUILD_SHARED_LIBS - Build libstp as a shared library (default ON; forced OFF by STATICCOMPILE)
• NOCRYPTOMINISAT - Don't try to use CryptoMiniSat, even if it is installed
• USE_CADICAL and CADICAL_DIR - Build against a CaDiCaL checkout (see below)
• USE_RISS - Try to use the Riss solver
• TUNE_NATIVE - Build with -mtune=native
• WERROR - Treat compiler warnings as errors
• ENABLE_FLOATING_POINT - SMT-LIB floating-point support (default ON), via the vendored SymFPU submodule (or an external clone through SYMFPU_INCLUDE_DIRS). With OFF, STP builds without SymFPU and rejects floating-point input with a clear error; the library ABI is identical either way.
• STP_ALLOCATOR - Which memory allocator the stp binary uses. STP is allocation-heavy, and the C library allocator is a significant bottleneck, so this defaults to mimalloc, which is vendored as a submodule and built as part of STP. Set to tcmalloc to link a system gperftools instead, or to system for plain malloc (roughly 14% slower, but the lowest peak memory). Only the executables link the allocator; libstp leaves the choice to whatever application embeds it.

STP relies on: flex, bison and perl, plus at least one SAT backend. CaDiCaL (opt-in via -DUSE_CADICAL, see below) is the recommended one; the alternatives are CryptoMiniSat (found automatically when installed) and MiniSat (opt-in via -DUSE_MINISAT, which also needs zlib). Configuration fails if no backend is enabled. The command-line parser, CLI11, is vendored as a submodule -- nothing to install. The floating-point support uses the header-only SymFPU library, which is vendored as a submodule -- nothing to install. Real literals in floating-point input -- ((_ to_fp 8 24) RNE 1.5) -- are converted by LibBF, an optional dependency fetched and built like minisat and CaDiCaL: run scripts/deps/setup-libbf.sh (it downloads the pinned release tarball, checks its hash, applies STP's MSVC portability patch and builds libbf.a; set LIBBF_TARBALL to a pre-downloaded copy for offline builds), then configure with -DUSE_LIBBF:BOOL=ON -DLIBBF_DIR:PATH=<repo>/deps/libbf. Without it STP builds as before and refuses real literals with a message pointing at the script. A python3 interpreter is needed for the python interface and for the test suite, and GMP is needed when building with CryptoMiniSat. You can install most of these by:

$ sudo apt-get install build-essential cmake bison flex libgmp-dev zlib1g-dev python3 perl

The MiniSat backend is optional and off by default; enable it with -DUSE_MINISAT:BOOL=ON. Your distribution's minisat package works, or STP maintains an updated fork that can be built as follows:

$ git clone https://github.com/stp/minisat
$ cd minisat
$ mkdir build && cd build
$ cmake ..
$ cmake --build . -j$(nproc)
$ sudo cmake --install .
$ command -v ldconfig && sudo ldconfig

Floating-point support is on by default, backed by the vendored SymFPU submodule (git submodule update --init lib/extlib-symfpu/symfpu if you cloned without --recursive); an external SymFPU clone can be used instead via -DSYMFPU_INCLUDE_DIRS=<directory containing the clone>. With it, STP solves the SMT-LIB floating-point theory (QF_FP/QF_BVFP/QF_ABVFP) and exposes floating-point terms through the C, C++ (stp/fp.hpp) and Python APIs. When additionally built with LibBF (-DUSE_LIBBF=ON, see Dependencies), real literals under to_fp -- ((_ to_fp 8 24) RNE 0.1) -- are folded to their exactly-rounded bits while parsing, in any format and under any of the five rounding modes, so they mean the same bits they do in bitwuzla, cvc5 and z3. One operation is format-bounded: fp.rem is refused past roughly binary64-sized formats (its circuit unrolls one divide step per representable exponent difference, so Float128's would be ~33000 steps deep). Configuring with -DENABLE_FLOATING_POINT=OFF builds without SymFPU entirely and rejects floating-point input with a clear "built without floating-point support" error; the library ABI is the same either way.

STP uses minisat as its SAT solver when nothing else is available, but it also supports other SAT solvers including CryptoMiniSat as an optional extra. If installed, it will be detected during the cmake and becomes the default solver, with --minisat selecting minisat at runtime:

$ git clone https://github.com/msoos/cryptominisat
$ cd cryptominisat
$ mkdir build && cd build
$ cmake ..
$ cmake --build . -j$(nproc)
$ sudo cmake --install .
$ command -v ldconfig && sudo ldconfig

Alternatively, these commands are pre-configured in scripts/deps/setup-minisat.sh and scripts/deps/setup-cms.sh (respectively). Those scripts install into deps/install, which CMake searches without any extra flags.

CaDiCaL is also supported, but is opt-in rather than auto-detected. It is consumed from a build tree rather than an installation, so point CADICAL_DIR at the checkout:

$ git clone https://github.com/arminbiere/cadical
$ cd cadical
$ git checkout rel-3.0.1
$ ./configure -fPIC
$ make

then configure STP with -DUSE_CADICAL:BOOL=ON -DCADICAL_DIR:PATH=<path>, where <path> is the checkout containing src/cadical.hpp and build/libcadical.a. -fPIC is required because libcadical.a is linked into STP's shared library. These commands are pre-configured in scripts/deps/setup-cadical.sh.

When STP is built this way CaDiCaL becomes the default solver; --cryptominisat (or --minisat, in a -DUSE_MINISAT build) selects the others at runtime.

With a CaDiCaL 3.x build, --cadical-factor controls CaDiCaL's bounded variable addition: on, off, or auto (the default, which enables it only for problems with array operations, where it measures fastest).

If you wish to build STP's dependencies without installing them, you can tell CMake where to find the non-installed artefacts. For example:

• -DMINISAT_INCLUDE_DIRS:PATH=<path> and -DMINISAT_LIBDIR:PATH=<path> -- the paths to minisat/core/Solver.h and the minisat libraries (respectively)
• -Dcryptominisat5_DIR:PATH=<path> -- the path to cryptominisat5Config.cmake

If you did not install these development libraries, then MINISAT_LIBDIR can be set to your build folder for minisat and cryptominisat5_DIR to your build folder for CryptoMiniSat.

$ mkdir build && cd build
$ cmake -DSTATICCOMPILE=ON ..
$ cmake --build . -j$(nproc)
$ sudo cmake --install .
$ command -v ldconfig && sudo ldconfig

To tweak the build configuration:

• Run cmake-gui /path/to/stp/source/root instead of cmake. This user interface lets you control the value of various configuration variables and lets you pick the build system generator.

• Run ccmake instead of cmake. This provides an ncurses terminal interface for changing configuration variables.

• Pass -D<VARIABLE>=<VALUE> options to cmake (not very user friendly). It is probably best if you only configure this way if you are writing scripts.

You can also tweak configuration later by running make edit_cache and edit any configuration variables, reconfigure and then regenerate the build system. After configuration, build by running make.

You can use the -j<n> flag to significantly to decrease build time by running <n> jobs in parallel (e.g. make -j4).

The test suite needs GTest and OutputCheck in deps/, plus lit and a python3 interpreter. Testing is silently disabled if python cannot be found or if BUILD_SHARED_LIBS is off.

git clone https://github.com/stp/stp
cd stp
git submodule update --init
pip install lit
./scripts/deps/setup-cadical.sh
./scripts/deps/setup-gtest.sh
./scripts/deps/setup-outputcheck.sh
mkdir build
cd build
cmake -DENABLE_TESTING=ON -DUSE_CADICAL:BOOL=ON -DCADICAL_DIR:PATH="$(pwd)/../deps/cadical" ..
cmake --build . -j$(nproc)
ctest

To install run make install and to uninstall run make uninstall. The root of installation is controlled by the CMAKE_INSTALL_PREFIX variable at configure time. You can change this by running make edit_cache and editing the value of CMAKE_INSTALL_PREFIX.

You will need to install cmake and follow the steps that the windows job in .github/workflows/ci.yml runs: install flex and bison, build minisat, then configure STP against it with -DNOCRYPTOMINISAT=ON (CryptoMiniSat does not build with MSVC). In case you still have trouble, please see the mini-HOWTO at issue #319.

• Vijay Ganesh
• Trevor Hansen
• Mate Soos
• Dan Liew
• Ryan Govostes
• Andrew Teylu
• And many others...