Presentation is loading. Please wait.

Presentation is loading. Please wait.

Model Checking Base on Interoplation K. L. McMillan Cadence Berkeley Labs.

Similar presentations


Presentation on theme: "Model Checking Base on Interoplation K. L. McMillan Cadence Berkeley Labs."— Presentation transcript:

1 Model Checking Base on Interoplation K. L. McMillan Cadence Berkeley Labs

2 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Interpolation If A B = false, there exists an interpolant A' for (A,B) such that: A A' A' B = false A' refers only to common variables of A,B Example: –A = p q, B = q r, A' = q Interpolants from proofs –given a resolution refutation of A B, A' can be derived in linear time. (Craig,57) (Pudlak,Krajicek,97)

3 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Interpolation-based MC Combining bounded model checking and interpolation gives us –A means of over-approximate image computation –Hence, reachability analysis Method is complete for systems of finite diameter. Modern SAT solvers naturally produce resolution refutations –Leads to fully SAT-based model checking.

4 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Outline Computing interpolants Interpolation-based image computation Model checking finite state systems

5 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Resolution Modern SAT solvers naturally produce refutations for CNF formulas using resolution Interpolants can be derived from such refutations in linear time. (A p) ( p B) (A B)

6 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Example Interpolant is a circuit that follows structure of the proof. A = (b)( b c)B = ( c d)( d) (b)( b c) (c)(c)( c d) (d)(d)( d) c =c

7 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. DPLL SAT solvers Given a propositional formula in CNF: –Produce a satisfying assignment –Produce a resolution refutation Current solvers, like Chaff and BerkMin are highly efficient, especially in the case when there is a small core of clauses that are unsatisfiable.

8 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. An interpolating SAT solver SAT solver (A,B) in CNF Interpolation proof A

9 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Interpolation-based MC Exploit interpolation to compute an over- approximate image operator. –Allows symbolic model checking –Procedure is complete for finite diameter systems

10 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Modeling System modeled by a transition constraint a b cp g Each circuit element induces a constraint note: a = a t and a' = a t+1 g = a b p = g c c' = p Model: C = { g = a b, p = g c, c' = p }

11 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Bounded model checking Unfold the model k times: U = C 0 C 1... C k-1 a b cp g a b cp g a b cp g... I0I0 FkFk Use SAT solver to check satisfiability of I 0 U F k If unsatisfiable: property has no Cex of length k can produce a refutation proof P

12 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Reachability Is there a path (of any length) from I to F satisfying transition constraint C? Reachability fixed point: R 0 = I R i+1 = R i Img(R i,C) R = R i Image operator: Img(P,C) = V'. V. (P(V) C(V,V)) F is reachable iff R F false

13 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Reachability IF R1R1 R2R2... R = I Img(I,C) = R 1 Img(R 1,C)

14 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Overapproximation An overapproximate image op. is Img' s.t. for all P, Img(P,C) implies Img'(P,C) Overapprimate reachability: R' 0 = I R' i+1 = R' i Img'(R' i,C) R' = R' i Img' is adequate (w.r.t.) F, when –if P cannot reach F, Img(P,C) cannot reach F If Img' is adequate, then –F is reachable iff R' F false

15 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Adequate image PF Img(P,C) Reached from PCan reach F Img(P,C) But how do you get an adequate Img'?

16 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. k-adequate image operator Img' is k-adequate (w.r.t.) F, when –if P cannot reach F, Img(P,C) cannot reach F within k steps Note, if k > diameter, then k-adequate is equivalent to adequate.

17 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Interpolation-based image Idea -- use unfolding to enforce k-adequacy A = P -1 C -1 B = C 0 C 1 C k-1 F k P F CCCCCCC AB t=0 t=k Let Img'(P) 0 = A', where A' is an interpolant for (A,B)... Img' is k-adequate!

18 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Huh? A A' –Img(P,C) Img'(P,C) A' B = false – Img'(P,C) cannot reach F in k steps Hence Img' is k-adequate overapprox. P F CCCCCCC AB t=0 t=k A' Note: if A,B are consistent, then let Img(P,C) = T.

19 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Intuition A' tells is everything the prover deduced about the image of P in proving it can't reach F in k steps. Hence, A' is in some sense an abstraction of the image relative to the property. P F CCCCCCC AB t=0 t=k A'

20 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Reachability algorithm let k = 0 repeat if I can reach F within k steps, answer reachable R = I while Img'(R,C) F = false R' = Img'(R,C) R if R' = R answer unreachable R = R' end while increase k end repeat

21 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Termination Since k increases at every iteration, eventually k > d, the diameter, in which case Img' is adequate, and hence we terminate. Notes: –don't need to know when k > d in order to terminate –often termination occurs with k << d –depth bound for earlier method (Sheeran et al '00) is "longest simple path", which can be exponentially longer than diameter

22 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. PicoJava II benchmarks Hardware Java virtual machine implementation Properties derived from verification of ICU –handles cache, instruction prefetch and decode Original abstraction was manual Added neigboring IFU to make problem harder –result: many irrelevant facts in problem ICUIFU Mem, Cache Integer unit properties

23 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Results Benchmarks completed in 1800 s: –Standard model checking: 0/20 –Interpolation-based: 19/20 Reason: –Interpolation method exploits the SAT solvers ability to narrow proofs to relevant facts.

24 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. v. proof-based abstraction McM,TACAS03

25 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. v. proof-based abstraction CCKSVW,FMCAD02

26 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. v. K-induction SSS, FMCAD00

27 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. IBM GP benchmarks

28 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. GP benchmarks - true properties

29 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Characteristics SAT-based methods are effective when –Very large set of facts is available –Only a small subset are relevant to property They exploit the SAT solver's ability to narrow the proof to relevant facts –I.e., narrows reachable states approximation to relevant variables. Interpolation method exploits this fact to compute abstract image operator.

30 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Infinite-state verification Direct approach: –express transition constraint in FOL –example: simple Bakery protocol: ticket 0 > ticket 1 ticket 1 > ticket 0 state 1 = NC NC C ticket 1 > ticket 0 ticket 0 > ticket 1 state 0 = NC NC C Terminates because diameter is finite, though state space is infinite

31 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Infinite-state verification Predicate abstraction approach (Graf,Saïdi,97) –Choose a set of predicates to represent state I.e., for bakery: ticket 1 > ticket 0 and ticket 0 > ticket 1 –Transform C into a predicate-state transducer –Interpolants are now strictly Boolean Convergence guaranteed, but may have false negatives Advantages of interpolation approach: –Avoid conversion to a Boolean formula –Avoid building BDDs! –Strong ability to ignore irrelevant predicates

32 Copyright 2002 Cadence Design Systems. Permission is granted to reproduce without modification. Conclusion SAT solvers have the ability: –to generate refutations for bounded reachability –to filter out irrelevant facts. These abilities can be exploited to generate an abstract image operator, using Craig interpolation. This yields a reachability procedure that –is fully SAT-base –operates directly on infinite-state systems –is robust w.r.t. irrelevant facts


Download ppt "Model Checking Base on Interoplation K. L. McMillan Cadence Berkeley Labs."

Similar presentations


Ads by Google