Presentation on theme: "Aaron Bradley University of Colorado, Boulder"— Presentation transcript:
1 PDR: Property Directed Reachability AKA ic3: SAT-Based Model Checking Without Unrolling Aaron BradleyUniversity of Colorado, BoulderRobert Brayton Niklas Een Alan MishchenkoUniversity of California, Berkeley
2 Outline Motivation Pioneering work of Aaron Bradley Sequential verification is hard (needs new engines!)Pioneering work of Aaron BradleyA surprise (3d place) winner at HWMCC’10!Remarkable featuresEfficiently tackles both SAT and UNSAT instancesLends itself to localization abstraction and parallelismConceptually simple, relatively tuning-freeUnderstanding the algorithmPseudo-code…Experimental results and conclusions
3 Pioneering WorkAaron Bradley developed this algorithm after several years of work on “inductive generalization”Preliminary work (A. R. Bradley and Z. Manna, “Checking safety by inductive generalization of counterexamples to induction”, FMCAD’07)This work (A. R. Bradley, “k-step relative inductive generalization”,The original version of the tool to enter HWMCC’10 (ic3,ic3 won the third place and only lost, by a small margin, to two mature, integrated engines (ABC and PdTRAV)
4 Efficient Implementation Niklas Een implemented Aaron Bradley’s algorithm while taking advantage of the strengths of MiniSAT:Incremental interfaceActivation literals to enable/disable clausesProcedure AnalyzeFinal to compute an UNSAT core in terms of the original assumptionsResource-driven recycling of the SAT solverAdditionally, Niklas proposedTernary simulation for quick cube expansionNew heuristics for inductive generalizationSmart data-structures for clauses and proof obligationsNiklas’ implementation runs faster and proves more properties than the original implementation
5 PDR: The Main IdeaPDR is a way of computing an inductive invariant that does not overlap with bad statesIt is similar to interpolation, but the way of deriving the invariant is differentPDR has better control of the invariant, and this may explain its good performanceState spaceInductive invariant is a Boolean function in terms of register variables, such thatIt is true for the initial statesIt is inductive (assuming it in one time frame leads to making it true in the next timeframe)BadInvariantInitReached
6 PDR: The Main IdeaConstruct over-approximations (F0, F1, …, Fk) of states reachable after each time stepStart with F0 = Init, and compute other over-approximations as sets of CNF clausesAdditionally, require thatSemantically (as functions): F0→F1→F2→... →FkSyntactically (as clause sets): F1⊇ F2⊇ ... ⊇ Fk
7 PDR: The Main Idea Termination criteria If an over-approximation is inductive, return UNSATIf a counter-example is found, return SATThe algorithm constructs over-approximationsin a property directed waythe property is used to decide what clauses to includewith an inductive flavorinduction is used to prove that a clause holds in a frame
8 PDR: Illustration T Time frame Time frame 0 Time frame 1 Comb Logic Primary inputsProperty outputComb Logic…Register outputsRegister inputsInitial StateStates where property failsState space of time frame 0State space of time frame 1Initial statesa1a2BadBada3Cubes (a1, a2, a3) are covering bad states and not including reached states. The product of their complements is a property-directed over-approximation F1 of reachable states at frame 1.TInitInitReached
9 Inductive Generalization Assume that, at some point, we have the following over-approximations of reached states: (F0, F1, …, Fk)Suppose we wish to block state s in frame iWe can try to find a clause c, such that c s and add it to the set of clauses for frame i.Clause c can be added if it satisfies condition Fi-1∧T→ cAnother possibility is to run a stronger inductive check Fi-1 ∧ c’ ∧ T→ c where c’ is clause c expressed in terms of the current state variablesWe can also try to generalize (or strengthen) clause c, by removing literals, as long as the inductive check passes
10 State space of time frame k-1 (all bad states are blocked by clauses) State space of time frame k (there is a bad state s that needs blocking)a1a4a5a2s’BadBada3TSPre-image s’ of sInitInitReached(k-1)Reached(k-1)Reached(k)Consider the case when s’ is blocked by clauses in frame k-1.We can use inductive generalization to derive a new clause c blocking s in frame k, such that Fk-1∧c’∧T→ c, where Fk-1 is the product of clauses in frame k-1 and T is the transition relation.
11 State space of time frame k-1 (all bad states are blocked by clauses) State space of time frame k (there is a bad state s that needs blocking)a1a4a5a2BadBada3TSs’Pre-image s’ of sInitInitReach(k-1)Reach(k-1)Reach(k)Consider the case when s’ is NOT blocked by clauses in frame k-1.In this case, we schedule a proof obligation to block s’ in frame k-1. We treat s’ as a bad state in frame k-1 and try to block it recursively.
13 Procedures solver CreateSatSolver( AIG, initialize ) returns a SAT solver with the AIG; optionally initializes itcube GetBadState( solver[k] )returns a state cube failing property in the k-th framebool BlockState( cube, solver, …, solver[k] )recursively tries to block cube by adding clauses to solversreturns 1, if the cube could be blocked; 0, otherwisebool PushClauses( solver, …, solver[k] )moves clauses in i-th frame to i+1-th frame, if they holdreturns 1, if an inductive invariant is found; 0, otherwise
14 Remarkable Features Efficiently tackles both SAT and UNSAT instances Often finds counter-examples that cannot be found by bounded model checkingOften proves problems that are not proved by interpolationAmenable to localization abstractionPDR solver can work in-place and increase its scope on-demand, without traversing all registers and logic gates of the designLends itself to parallelismEach process working on some proof obligations and exchange clausesConceptually simple, relatively tuning-freeUnlike, for example, BDD-based reachability that takes lots of time to develop and leaves lots of parameters to tune
15 Example of Inductive Invariant # Inductive invariant for "hwmcc08\eijkS208"# generated by PDR in ABC on Tue Dec 07 09:36:.i 22.o 1.p 43.eFlop relationships:F8 = F14F7 = F18 & F19 & F20 & F21
18 Experiments on Hard Examples (previously unsolved by ABC) Statistics: number of primary inputs (PI), flip-flops (FF), and AIG nodes (AND)Frame: timeframe where inductive invariant or counter-example was foundClauses: the number of clauses in the inductive invariantTime: runtime of PDR, without preprocessing
19 Conclusion Presented PDR Explained how it works pioneering work of Aaron Bradleyefficient implementation by Niklas EenExplained how it worksDiscussed its remarkable featuresFuture improvementslocalization abstractiontemporal decompositionsignal-clauses instead of register-clausesapplications in logic synthesis
Your consent to our cookies if you continue to use this website.