SATbased Bounded Model Checking Formulation of famous problems

SAT-based Bounded Model Checking

Formulation of famous problems as SAT: Bounded Model Checking Given a property p: (e. g. “always signal_a = signal_b”) Is there a state reachable within k cycles, which satisfies p ? p p p s 0 s 1 s 2 . . . p sk-1 p sk

Bounded Model Checking: safety The reachable states in k steps are captured by: The property p fails in one of the cycles 1. . k:

Bounded Model Checking: safety The safety property p is valid up to cycle k iff (k) is unsatisfiable: p p p s 0 s 1 s 2 . . . p sk-1 p sk

Bounded Model Checking: safety Example: a two bit counter 00 11 01 10 Initial state: I: : l Æ : r Transition: R: l’ = (l r) Æ r’ = : r G ( l r). Property: For k = 2, (k) is unsatisfiable. For k = 4 (k) is satisfiable

Bounded Model Checking : liveness The liveness property Fp is valid up to cycle k iff (k) is unsatisfiable: = : p s 0 : p s 1 : p s 2 . . . p sk-1 : p sk

Intel’s results (2002)

IBM’s results (2000)

SAT made some progress…

Bounded Model Checking Resources exceeded k=0 BMC(M, f, k) k++ no k¸? yes

How big should k be? n For every finite model M and LTL property there exists k s. t. n We call the minimal such k the Completeness Threshold (CT) n Clearly if M ² then CT = 0 n computing CT for a given M model checking

The Completeness Threshold Let’s try the following strategy: Compute CT for an abstraction of M that unites all models with certain graph-theoretic properties equal to those of M

Basic notions… n n n Diameter D(M) = longest shortest path between any two reachable states. Recurrence Diameter RD(M) = longest loop-free path between any two reachable states. The initialized versions: DI(M) and RDI(M) start from an initial state. DI(M) = D(M) = 2 RDI(M) = RD(M) = 3

The Completeness Threshold n Theorem: for AGp properties CT = DI(M) (For AFp properties this does not hold) p s 0 Arbitrary path p p p

The Completeness Threshold n Theorem: for AFp properties CT= RDI(M)+1 s p p p 0 n Theorem: for an LTL property CT = ?

What is SAT? Given a propositional formula in CNF, find an assignment to Boolean variables that makes the formula true: 1 = (x 2 x 3) 2 = ( x 1 x 4) 3 = ( x 2 x 4) A = {x 1=0, x 2=1, x 3=0, x 4=1} SATisfying assignment!

A Basic SAT algorithm Given in CNF: (x, y, z), (-x, y), (-y, z), (-x, -y, -z) Decide() x=0@1 z=0@2 X X X Deduce() X X y=0@2 Resolve_Conflict()

Backtracking Search in Action x 1 = 0@1 x 2 = 0@2 x 2 x 3 = 1@2 {(x 1, 0), (x 2, 0), (x 3, 1)} 1 = (x 2 x 3) 2 = ( x 1 x 4) 3 = ( x 2 x 4) x 1 = 1@1 x 4 = 0@1 x 2 = 0@1 x 3 = 1@1 {(x 1, 1), (x 2, 0), (x 3, 1) , (x 4, 0)} No backtrack in this example, regardless of the decision!

Backtracking Search in Action x 1 = 1@1 x 4 = 0@1 x 2 = 0@1 x 3 = 1@1 conflict Add a clause 1 = (x 2 x 3) x 1 = 0@1 x 2 2 = ( x 1 x 4) 3 = ( x 2 x 4) 4 = ( x 1 x 2 x 3) x 2 = 0@2 x 3 = 1@2 {(x 1, 0), (x 2, 0), (x 3, 1)}

Decision heuristics DLIS (Dynamic Largest Individual Sum) n n Choose the variable and value that satisfies the maximum number of unsatisfied clauses. This requires going through all clauses for each decision.

Decision heuristics Jeroslow-Wang method Compute for every clause w and every variable l (in each phase): n n n J(l) : = Choose a variable l that maximizes J(l). This gives an exponentially higher weight to literals in shorter clauses.

Implication graphs and learning Current truth assignment: {x 9=0@1 , x 10=0@3, x 11=0@3, x 12=1@2, x 13=1@2} Current decision assignment: {x 1=1@6} x 10=0@3 1 = ( x 1 x 2) x 2=1@6 2 = ( x 1 x 3 x 9) 1 3 = ( x 2 x 3 x 4) 4 = ( x 4 x 5 x 10) 5 = ( x 4 x 6 x 11) 6 = ( x 5 x 6) 7 = (x 1 x 7 x 12) 8 = (x 1 x 8) x 1=1@6 2 2 x 9=0@1 3 3 x 3=1@6 4 4 x 4=1@6 5 5 x 5=1@6 6 6 conflict x 6=1@6 x 11=0@3 9 = ( x 7 x 8 x 13) We learn the conflict clause 10 : (: x 1 Ç x 9 Ç x 11 Ç x 10)

Implication graph, flipped assignment 1 = ( x 1 x 2) x 13=1@2 2 = ( x 1 x 3 x 9) 3 = ( x 2 x 3 x 4) 4 = ( x 4 x 5 x 10) 5 = ( x 4 x 6 x 11) 6 = ( x 5 x 6) 7 = (x 1 x 7 x 12) 8 = (x 1 x 8) 9 = ( x 7 x 8 x 13) 10 : (: x 1 Ç x 9 Ç x 11 Ç x 10) x 8=1@6 x 9=0@1 10 x 10=0@3 10 8 x 1=0@6 10 x 11=0@3 Due to the conflict clause 7 7 x 12=1@2 9 9 x 7=1@6 9 ’

Non-chronological backtracking 3 Which assignments caused the conflicts ? x 9= 0@1 x 10= 0@3 x 11= 0@3 x 12= 1@2 x 13= 1@2 Decision level 4 5 These assignments Are sufficient for Causing a conflict. x 1 Backtrack to decision level 3 6 ’ Nonchronological backtracking

Tuning SAT for BMC I. Variable ordering II. Incremental SAT: reusability of conflict clauses between different (yet related) SAT instances. III. Replicating Conflict Clauses: generation of conflict clauses 'for free', based on the unique structure of BMC invariant properties.

Static variable ordering A (CNF) dependency graph D (V, E): A partitioning C 1. . Cn: An abstract dependency graph D’(V’, E’):

Static variable ordering for BMC (The natural order of (k)) For (k) there exists a partition C 1. . Cn s. t. the abstract dependency graph is linear V 0 C 0 V 1 C 1 V 2 C 2 V 3 C 3 . . . Vk-1 Ck-1 Vk Ck

Static variable ordering (A simple static ordering) I 0 (k) should satisfy I 0 Riding on unreachable states. . . Pk (k) should satisfy Pk I 0 Riding on legal executions. . . Pk

Incremental SAT Given two CNF formulas (sets of clauses) S 1 and S 2, and a conflict clause s. t. S 1 ` , under what conditions the following holds: S 2 is satisfiable iff S 2 is satisfiable.

Incremental SAT S 1 S 2 Let 0 S 1 S 2 0 0 ` Claim: if 0 ` then S 1 is satisfiable iff S 1 is satisfiable. S 2 is satisfiable iff S 2 is satisfiable. Thus, if we deduce while checking S 1, we can reuse it when checking S 2.

Incremental SAT for BMC Testing whether the clauses involved in deducing are a subset of 0 requires marking them in advance. In the BMC case this is easy: Only one clause in (k) is not included in (k+1)

Incremental SAT 1. Mark 0 , the subset of clauses that are also contained in subsequent instances. 2. If s ` for some s 0, then add to 0 and mark it as pervasive. S 1 S 2 0

Replicated clauses The BMC invariant formula includes k structurally similar parts: Can this symmetry be used to speed up the search ?

Replicated clauses Let xk denote variable x in cycle k. Let c(i) denote the clause c, where every variable in c is shifted i cycles. For example: c = (x 5 y 2 z 7) c(2) = (x 7 y 4 z 9) c(-2) = (x 3 y 0 z 5) Similarly, s(i) denotes the set of shifted clauses in the set s, i. e. j cj s, cj(i) s(i).

Replicated clauses Let s be a subset of (k)'s clauses, and let be a conflict clause deducible from s, i. e. s ` . ( x 2 y 5), (x 2 y 5 z 3 w 4) s= =(y 5 z 3 w 4) By substitution, it is also true that s(i) ` (i). s(i) = ( x 2+i y 5+i), (x 2+i y 5+i z 3+i w 4+i) (i) =(y 5+i z 2+i w 4+i)

Replicated clauses Conclusion: if s(i) (k) then we can also add (i) to (k). (i) is a new clause that we got 'for free'. We call (i) a 'replicated clause'. The remaining question is: for which i, s(i) (k).

Replicated clauses 1. While generating (k), mark all transition relation clauses. 2. For every conflict clause , if all the clauses in s are marked, then mark as 'replicable'. .

Replicated clauses Given a replicable clause and the subset of clauses s from which it was deduced: . . . 3. Record ls and hs, the lowest and highest cycle index in s. 4. Add a replicated clause (i) for i in the range -ls. . (k - hs).

Example s= ( x 2 y 5), (x 2 y 5 z 3 w 4) ls = 2, hs = 5 k=6 = (y 5 z 3 w 4) Going right (1) = (y 6 z 4 w 5) Going left (-1) = (y 4 z 2 w 3) (-2) = (y 3 z 1 w 2)

Experimental results (2001)