Carnegie Mellon University A View from the Engine Room: Computational Support for Symbolic Model Checking Randal E. Bryant

– 2 – 25MC Outline Boolean Reasoning as Engine for Model Checking BDDs & SAT An Evaluation of SAT Current capabilities & limitations Making further progress Beyond SAT Enhancing DPLL to do more than find single solution

– 3 – 25MC The Origins of Symbolic Model Checking 1987 notes by Ken McMillan Backward traversal of Petri net state space Realized that reachability could be performed via symbolic Boolean manipulation

– 4 – 25MC Role of Boolean Manipulation in MC Contributions of BDDs to Model Checking Separate problem from implementation BDDs provide clean API to model checker Performed well for many examples The Emergence of SAT Initially for bounded model checking [Biere, et al., 96] More recently for full model checking SAT enumeration [McMillan 02] Interpolation-based abstraction-refinement [McMillan 03] Important Point Advances in Boolean manipulation drive progress in model checking

– 5 – 25MC Recent Progress in SAT Solving

– 6 – 25MC Conventional Wisdom on SAT BDDs vs. DPLL DPLL better than BDDs for straight SAT Especially problems with large numbers of variables Best Research Strategy is to Keep Refining DPLL Certainly has lead to big improvements!Claim This wisdom is overly simplistic

– 7 – 25MC Comparing Parity Trees Compare linear chain of XORs to randomly trees Known hard problem for resolution-based SAT solvers 16 n-input trees for different values of n

– 8 – 25MC Parity: Exhaustive Testing Testing 10 9 cases is no big deal

– 9 – 25MC Parity: DPLL (ca Limmat) Known difficult problem for DPLL

– 10 – 25MC Parity: DPLL (MiniSAT) Recent SAT solvers have made remarkable progress

– 11 – 25MC Parity: BDDs Trivial problem for BDDs

– 12 – 25MC Associativity Testing Typical of arithmetic verification problems Evaluate for different argument word sizes int addL (int x, int y, int z) { return (x+y)+z; } int addR(int x, int y) (int x, int y, int z) { return x+(y+z); } ?=?= int mulL (int x, int y, int z) { return (x*y)*z; } int mulR(int x, int y) (int x, int y, int z) { return x*(y*z); } ?=?=

– 13 – 25MC Associativity of Addition Easy for BDDs Recent DPLL handle readily

– 14 – 25MC Associativity of Multiplication BDDs better than DPLL

– 15 – 25MC Associativity of Multiplication Both worse than exhaustive

– 16 – 25MC Progress in SAT Research Evolution of DPLL Incremental advances yielding more than incremental improvements Encourages continued incrementingDownside Gene pool of SAT solvers diminishing All use DPLL, nonchronological backtracking, 2-literal watching … New approaches must overcome high performance standardClaim We need to be looking beyond incremental changes

– 17 – 25MC Breaking Free Raise the Bar on Benchmarks Identify challenge benchmarks Examples Arithmetic problems Breaking cryptosystems or secure hashes Combinatorial optimization Parameterize to allow scaling analysis Acknowledge Value of Niche Solvers Dont worry about problems that current solvers handle well

– 18 – 25MC BDD/DPLL Hybrids Very Different Approaches DPLL: Search for one solution from top down BDDs: Encode all solutions from bottom up Significant Recent Effort BDD preprocessing for SAT solver [Jin & Somenzi, 04] DPLL on ZDD-represented clause sets [Aloul, et al., 01] Satisfy conjunction of BDDs [Damiano & Kukula, 03, Franco et al., 04]Evaluation Incomplete Can help when one approach (BDD / DPLL) much better than other But what about problems that neither does well?

– 19 – 25MC Beyond SAT Dealing With Quantifiers DPLL as QBF solver has had limited success Strength for BDDs Especially with deep, alternating quantifier nesting E.g., model checkingUnsatisfiability Impressive progress on generating proofs and unsat cores Using scaffolding from DPLL Many applications E.g., refinement steps in model checking No counterpart with BDDs

– 20 – 25MC Challenge Problem: Quantifier Elimination Core Problem For Model Checking Bit-level: Relational product Predicate abstraction Flanagan & Qadeer, 02, Lahiri, Bryant, Cook, 03Methods BDDs: quantifier elimination Use early quantification DPLL: SAT enumeration Plaisted, 00, Gupta, et al., 00, McMillan 02, Clarke et al., 03 F X Y G Y G = X F

– 21 – 25MC Quantifier Elimination Example Example from Predicate Abstraction Lahiri, Bryant, Cook, 03 G = X F Current state variables X Next state variables Y xxxxxx [( x 1 x 2 x 3 x 4 x 5 x 6 ) xxxxxx ( x 1 x 2 x 3 x 4 x 5 x 6 ) ] Current State x 1, x 2, x 3, x 4, x 5, x 6 Transition Constraints xyyyxxy ( x 2 y 2 ) ( y 2 y 1 ) ( x 4 x 6 y 1 ) xyxy x 3 y 4 x 4 y 3 xyxy x 5 y 6 x 6 y 5

– 22 – 25MC x1x1 x2x2 x3x3 x4x4 x5x5 x6x6 y1y1 y2y2 y3y3 y4y4 y5y5 y6y Set Enumeration Run SAT checker over formula Generate blocking clause for each newly generated element ( y 1 y 2 y 3 y 4 y 5 y 6 ) xxxxxx [( x 1 x 2 x 3 x 4 x 5 x 6 ) xxxxxx ( x 1 x 2 x 3 x 4 x 5 x 6 ) ] xyyyxxy ( x 2 y 2 ) ( y 2 y 1 ) ( x 4 x 6 y 1 ) xyxy x 3 y 4 x 4 y 3 xyxy x 5 y 6 x 6 y 5

– 23 – 25MC y1y1 y2y2 y3y3 y4y4 y5y5 y6y Compressing Set Representation Disjunct set elements to form BDD Extract prime implicants from BDD Experience: 10X reduction in number of terms BDD Rep. y1y1 y2y2 y3y3 y4y4 y5y5 y6y6 0*0101 *

– 24 – 25MC SAT Enumeration Observations Performance Better than BDDs when |X| >> |Y| Only have to enumerate for unique assignments to YImprovements Attempt to enlarge solution as enumerate [McMillan 02] Build into DPLL search loop Lahiri, Nieuwenhuis, Oliveras, 06 Handle successful cases similarly to failures Make solver stop before it assigns values to all variables Implemented?Observation Enumerative methods seem inelegant

– 25 – 25MC Conclusions 25MC = 20OBDD Boolean methods have driven much of the progress in model checking BDDs & SAT SAT Progress Impressive, but still room for improvement Beyond SAT Quantifiers Unsatisfiability

Comments?