Transcript here

Advances in Symbolic Model
Checking
WPE – II Presentation
Abhishek Udupa
11th March 2013
Overview of this Talk
• The Model Checking Problem:
 Check if a program 𝑃 satisfies the specification 𝜑
 Assume that 𝑃 is finite state
• Explicit State Techniques:
 Construct an explicit representation of the state space of
the program
 Suffer from the state explosion problem
• Symbolic Model Checking Techniques:
 Provide a (limited) solution to the state explosion
problem
 Analyze the state space using symbolic representations
 Ordered Binary Decision Diagrams (OBDDs) typically used
to represent symbolic formulas
2
7/26/2016
Overview of this Talk
• OBDDs:
 Often provide compact and canonical
representations of Boolean formulas
 Sometimes unpredictable in their resource usage
 Compactness depends heavily on variable ordering
• Computing optimal variable ordering is hard
 Limiting factor for symbolic model checking
techniques
• This Talk:
 Can we mitigate and/or solve this problem?
3
7/26/2016
Outline
• Background
 Transition Systems, Temporal Logic
 Symbolic Model Checking
• Counterexample Guided Abstraction
Refinement (CEGAR)
• SAT-based Model Checking using
Interpolants
• IC3
• Discussion
4
7/26/2016
Background: Model Checking
• Given a representation of a program P
and a property φ check if P satisfies φ
 What is the representation used to model P?
• Usually represented as labelled Kripke structures
 How is the property φ expressed?
• Temporal logics like CTL, CTL* often used
 Symbolically checking if 𝑃 ⊨ 𝜑
• Reachability analysis using formulas to represent sets of
states
• Computes an inductive strengthening as a result
5
7/26/2016
Background: Kripke Structures
• A tuple 𝑀 = 𝑆, 𝑅, 𝐿, 𝐼
 S : Set of states
 R : Transition relation
 L : Labeling function
 I : Initial States
Ctr = 1
Ctr = 0
Ctr = 3
Ctr = 2
6
7/26/2016
Background: Symbolic Representation
of Kripke Structures
• A tuple 𝑀 = 𝑉, 𝑅, 𝐼
• For the example:
 𝑉 = 𝐶𝑡𝑟
Ctr = 1
Ctr = 0
Ctr = 3
Ctr = 2
 𝑅≡
• 𝐶𝑡𝑟 = 0 ∧ 𝐶𝑡𝑟 ′ = 1 ∨
• 𝐶𝑡𝑟 = 0 ∧ 𝐶𝑡𝑟 ′ = 2 ∨
• 𝐶𝑡𝑟 = 1 ∧ 𝐶𝑡𝑟 ′ = 3 ∨
• 𝐶𝑡𝑟 = 2 ∧ 𝐶𝑡𝑟 ′ = 3 ∨
• 𝐶𝑡𝑟 = 3 ∧ 𝐶𝑡𝑟 ′ = 0
 𝐼 ≡ 𝐶𝑡𝑟 = 0
7
7/26/2016
Background: Temporal Logic
• CTL*: Propositional Logic + Path
quantifiers + Temporal Operators
• Consider: 𝐴𝐺𝐹(𝐶𝑡𝑟 = 0)
Ctr = 1
Ctr = 0
Ctr = 3
Ctr = 2
8
7/26/2016
Background: Temporal Logic
• On the other hand, consider: 𝐴𝐺𝐹(𝐶𝑡𝑟 = 1)
Ctr = 1
Ctr = 0
Ctr = 3
Ctr = 2
Ctr = 0
Ctr = 3
Ctr = 2
9
7/26/2016
Background: Symbolic Model
Checking
• Key Idea: Represent sets of states by
symbolic formulas
 A symbolic formula 𝑝 can be interpreted as the set
of states { 𝑠 ∈ 𝑆: 𝑠 ⊨ 𝑝 }
• Example: The symbolic formula 𝑣 < 3 ∧ 𝑣 ≥ 0 represents the
set of states where 𝑣 is 0, 1 or 2.
 Use OBDDs to represent formulas
• Canonical Representation
• Efficient checks for emptiness, subsumption
10
7/26/2016
Background: Symbolic Safety
Checking
• Properties of the form 𝐴𝐺𝜑 (invariant)
• Check if a state satisfying ¬𝜑 reachable
𝐼
𝑃𝑜𝑠𝑡(𝐼, 𝑅) 𝑃𝑜𝑠𝑡 2 (𝐼, 𝑅)
… 𝑃𝑜𝑠𝑡
𝑘
𝐼, 𝑅 = 𝑃𝑜𝑠𝑡 𝑘+1 𝐼, 𝑅 = 𝑓𝑓𝑖𝑥
• 𝑃𝑜𝑠𝑡 𝐼, 𝑅 = 𝐼 ∨ 𝑅𝑒𝑛𝑎𝑚𝑒(∃𝑣 𝐼 ∧ 𝑅 , 𝑉 ′ , 𝑉)
• 𝑓𝑓𝑖𝑥 represents all reachable states
• Check if 𝑓𝑓𝑖𝑥 ∧ ¬𝜑 is empty
 Yes: 𝑓𝑓𝑖𝑥 is an inductive strengthening of 𝜑
11
 No: Violation of 𝜑 possible
7/26/2016
Summing up Symbolic Model
Checking
• Sets of states represented by OBDDs
• Usually provide a compact, canonical
representation of formulas
 Equivalence and subsumption are easy to check!
• Unfortunately, some formulas do not have
compact OBDD representations
• Selecting an optimal ordering is hard
• OBDDs often display unpredictable resource
usage in practice
• Can we mitigate this problem or do away
with OBDDs altogether?
12
7/26/2016
Outline
• Background
 Transition Systems, Temporal Logic
 Symbolic Model Checking
• Counterexample Guided Abstraction
Refinement (CEGAR)
• SAT-based Model Checking using
Interpolants
• IC3
• Discussion
13
7/26/2016
CEGAR: A high-level overview
Failure
Success
Compute
Initial
Abstraction
𝑀
Model Check
𝑀, w.r.t. the
ACTL* formula
𝜑
Failure
Concrete
Cex T
Abs. Cex. 𝑇
Analyze 𝑇
Refine
Abstraction
Spurious Cex
CEGAR Loop
14
7/26/2016
An Example of Abstraction
Program P
init(ctr) := 0;
next(ctr) :=
case
ctr = 9 : 0;
else : ctr + 1;
esac;
Spec 𝜑
AGF(ctr != 0)
Abstract Kripke Structure
𝑐𝑡𝑟 = 0
¬𝑐𝑡𝑟 = 9
¬𝑐𝑡𝑟 = 0
¬𝑐𝑡𝑟 = 9
¬𝑐𝑡𝑟 = 0
𝑐𝑡𝑟 = 9
𝐴𝑡𝑜𝑚𝑠 𝑃
{ 𝑐𝑡𝑟 = 9, 𝑐𝑡𝑟 = 0}
Abstract state space only has three states, corresponding to predicates in
𝐴𝑡𝑜𝑚𝑠 𝑃 , which is much less than the size of the original state space!
15
7/26/2016
CEGAR: An Intuitive View
16
7/26/2016
CEGAR: An Intuitive View
17
7/26/2016
CEGAR: An Intuitive View
18
7/26/2016
CEGAR: An Intuitive View
19
7/26/2016
CEGAR: The Details
• What constitutes a good abstraction?
 Group arbitrary states together? (Consistency)
 Compactness of the abstraction function?
• Checking for spurious counterexamples
 Spuriousness of path counterexamples
 Spuriousness of loop counterexamples
• Eliminating spurious counterexamples
 aka Abstraction Refinement
 Coarsest refinement?
• Too hard to compute
• Heuristics for reasonably good refinements
20
7/26/2016
Abstraction Functions
• ℎ ∶ 𝑆 → 𝑆 from states to abstract states
• Can be viewed as an equivalence relation:
• 𝑀ℎ = 𝑆, 𝑅, 𝐿, 𝐼 is 𝑀 abstracted using ℎ:
𝑆
21
𝑆
7/26/2016
Initial Abstraction
• Key Idea: Group states which are
indistinguishable with respect to the
specification and control flow
 Let 𝐴𝑡𝑜𝑚𝑠(𝑃) be the set of atomic propositions appearing the
program P or the spec 𝜑
 𝑑 ≡𝑖𝑛𝑖𝑡 𝑒 iff 𝑑 ⊨ 𝑓 ⇔ 𝑒 ⊨ 𝑓, for all 𝑓 ∈ 𝐴𝑡𝑜𝑚𝑠(𝑃), where 𝑑 and 𝑒
are states
 This preserves the control flow skeleton of the program
• Further, use composite abstraction functions for
compactness
 Partition the set of variables according to the formulas they
appear in
 Define a similar abstraction function with respect to each
variable cluster
 The complete abstraction function is the component
abstraction functions applied to each variable cluster
22
7/26/2016
CEGAR: The Details
• What constitutes a good abstraction?
 Group arbitrary states together? (Consistency)
 Compactness of the abstraction function?
• Checking for spurious counterexamples
 Spuriousness of path counterexamples
 Spuriousness of loop counterexamples
• Eliminating spurious counterexamples
 aka Abstraction Refinement
 Coarsest refinement?
• Too hard to compute
• Heuristics for reasonably good refinements
23
7/26/2016
Detecting Spurious Path
Counterexamples
𝑠1
𝑠2
𝑠3
𝑠4
ℎ−1 𝑠1
ℎ−1 𝑠2
ℎ−1 𝑠3
ℎ−1 𝑠4
𝑠6
𝑠1
𝑠4
𝑠2
𝑠9
𝑠7
𝑠5
𝑠3
𝑠10
𝑠8
No real counterexample exists! Since no error state is reachable in
the concrete Kripke Structure
24
7/26/2016
Detecting Spurious Path
Counterexamples
𝑠1
𝑠2
𝑠3
𝑠4
ℎ−1 𝑠1
ℎ−1 𝑠2
ℎ−1 𝑠3
ℎ−1 𝑠4
𝑠6
𝑠1
𝑠4
𝑠9
𝑠2
𝑠7
𝑠5
𝑠3
𝑠8
𝑆1 = 𝐼 ∩ ℎ−1 𝑠1
𝑆𝑖 = 𝐼𝑚𝑔 𝑆𝑖−1 , 𝑅 ∩ ℎ−1 𝑠𝑖
𝑆1 = { 𝑠1 }
25
𝑠10
𝑆2 = { 𝑠4, 𝑠5 }
𝑆3 = {𝑠6 }
𝑆4 = ∅
7/26/2016
Detecting Spurious Loop
Counterexamples
• Loop counterexamples are of the form:
 𝑇 = 𝑠1 , 𝑠2 , … , 𝑠𝑖 , 𝑠𝑖+1 , 𝑠𝑖+2 , … 𝑠𝑛
𝜔
• Unroll loop counterexample 𝑚𝑖𝑛 times (𝑇𝑢 )
 𝑚𝑖𝑛 = min( ℎ−1 𝑠𝑗 )
𝑖<𝑗≤𝑛
𝑠1
𝑠2
𝑠′2
𝑠4
𝑠1
𝑠2
𝑠3
𝑠3
𝑠5
𝑠′3
𝑠4
𝑠3
𝑠5
• min = 1 for this example
• Thus one unwinding suffices to detect loops here
26
7/26/2016
CEGAR: The Details
• What constitutes a good abstraction?
 Group arbitrary states together? (Consistency)
 Compactness of the abstraction function?
• Checking for spurious counterexamples
 Spuriousness of path counterexamples
 Spuriousness of loop counterexamples
• Eliminating spurious counterexamples
 aka Abstraction Refinement
 Coarsest refinement?
• Too hard to compute
• Heuristics for reasonably good refinements
27
7/26/2016
Eliminating Spurious
Counterexamples
𝑠1
𝑠2
𝑠3
𝑠4
ℎ−1 𝑠1
ℎ−1 𝑠2
ℎ−1 𝑠3
ℎ−1 𝑠4
𝑠6
𝑠1
𝑠4
𝑠9
𝑠2
𝑠7
𝑠5
𝑠3
𝑠8
𝑆1 = 𝐼 ∩ ℎ−1 𝑠1
𝑆𝑖 = 𝐼𝑚𝑔 𝑆𝑖−1 , 𝑅 ∩ ℎ−1 𝑠𝑖
𝑆1 = { 𝑠1 }
28
𝑠10
𝑆2 = { 𝑠4, 𝑠5 }
𝑆3 = {𝑠6 }
𝑆4 = ∅
7/26/2016
Eliminating Spurious
Counterexamples
ℎ−1 𝑠3
ℎ−1 𝑠4
𝑠6
𝑠9
𝑠7
𝑠10
𝑠8
•
•
•
•
29
𝑠6 is a dead-end state
𝑠8 is a bad state
𝑠7 is an irrelevant state
Refine the abstraction to separate 𝑠8 from 𝑠6
7/26/2016
Loop Counterexamples and
Correctness
• Loop counterexamples are reduced to path
counterexamples and treated similarly
• Termination:
 Refinement process cannot go on forever
 Each equivalence class must contain at least one
concrete state
 The domain is finite
• Soundness:
 The abstract Kripke structure simulates the original
Kripke structure
 Sound from the theorem by Clarke, et al.
30
7/26/2016
CEGAR in Practice
• Implemented using OBDD based
techniques
• Comparison with NuSMV + COI:
 CEGAR often took more memory to abstract
 Usually needed much less memory to model check
 Faster than NuSMV + COI on every benchmark
• CEGAR on the Fujitsu Design
 NuSMV + COI could not verify design
 CEGAR succeeded with three refinement steps
 Previously undiscovered bug uncovered
31
7/26/2016
Outline
• Background
 Transition Systems, Temporal Logic
 Symbolic Model Checking
• Counterexample Guided Abstraction
Refinement (CEGAR)
• SAT-based Model Checking using
Interpolants
• IC3
• Discussion
32
7/26/2016
Background on Interpolants
• Consider two sets of clauses (disjunction of
literals) 𝐴 and 𝐵 such that 𝐴 ∧ 𝐵 is unsat
• An interpolant 𝑃 is a formula such that:
 𝑃 refers only to variables common to 𝐴 and 𝐵
 𝐴⇒𝑃
 𝑃 ∧ 𝐵 is unsatisfiable
• An interpolant can be constructed in linear
time from a proof of unsatisfiability of 𝐴 ∧ 𝐵
 Resolution based SAT-solvers can be easily augmented to
produce proofs of unsatisfiability
33
7/26/2016
Bounded Model Checking
• Consider a Kripke structure 𝑀 = 𝑉, 𝑅, 𝐼 and an
invariant 𝜑
...
𝐼(𝑊0 )
𝐹1 = 𝐼 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐹2 = 𝐹1 ∧ 𝑅(𝑊1 , 𝑊2 )
𝐹𝑘 = 𝐹𝑘−1 ∧ 𝑅(𝑊𝑘−1 , 𝑊𝑘 )
• 𝐹𝑖 represents states reachable in 𝑖 steps
• Check if any 𝐹𝑖 can violate 𝜑:
 Check if 0≤𝑖≤𝑘 𝐹𝑖 ∧ ¬𝜑 is satisfiable
 Unsat  No erroneous state reachable in 𝑘 or fewer steps
• BMC can be used to prove presence of bugs
• But not to prove their absence!
34
7/26/2016
Interpolation and BMC
...
𝐼(𝑊0 )
𝐹1 = 𝐼 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐴 = 𝐼 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐹𝑘 = 𝐹𝑘−1 ∧ 𝑅(𝑊𝑘−1 , 𝑊𝑘 )
𝐵 = 𝐹𝑘 ∧
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
• 𝐴 ∧ 𝐵 is unsatisfiable
• Extract an interpolant 𝑃 from proof
 𝑃 ∧ 𝐵 is unsat  No state in 𝑃 can hit error in 𝑘 − 1 steps
 𝐼 ∧ 𝑅 ⇒ 𝑃  𝑃 is an over-approximation of states reachable in one
step from 𝐼
• Iterate until 𝑃 becomes inductive
 𝑃(𝑉) ∧ 𝑅 𝑉, 𝑉 ′ ⇒ 𝑃(𝑉 ′ )
35
7/26/2016
Interpolation and BMC
𝐼∧𝑅
...
𝑃1
𝐹1 = 𝑃1 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐹𝑘 = 𝐹𝑘−1 ∧ 𝑅(𝑊𝑘−1 , 𝑊𝑘 )
𝐴 = 𝑃1 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐵 = 𝐹𝑘 ∧
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
𝐼 ∧ 𝑅2
...
𝑃2
𝐹1 = 𝑃2 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐴 = 𝑃2 ∧ 𝑅(𝑊0 , 𝑊1 )
36
𝐹𝑘 = 𝐹𝑘−1 ∧ 𝑅(𝑊𝑘−1 , 𝑊𝑘 )
𝐵 = 𝐹𝑘 ∧
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
7/26/2016
Interpolation and BMC
𝐼 ∧ 𝑅2
...
𝑃2
𝐹1 = 𝑃2 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐴 = 𝑃2 ∧ 𝑅(𝑊0 , 𝑊1 )
𝐹𝑘 = 𝐹𝑘−1 ∧ 𝑅(𝑊𝑘−1 , 𝑊𝑘 )
𝐵 = 𝐹𝑘 ∧
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
𝐹𝑖 ∧ ¬𝜑
0≤𝑖≤𝑘
• What if an intermediate BMC query is
satisfiable?
 If no over-approximations are involved: True
Counterexample
 One or more over-approximations: Inconclusive
37
• Restart algorithm with a larger 𝑘
7/26/2016
Soundness and Termination
• On each successive BMC query, the initial set
grows
 Must either eventually become inductive, in the case that
no counterexample exists
 If a counterexample exists, then we will eventually hit it
for some 𝑘 without any over-approximation
• On successful termination, the last
interpolant which was computed is an
inductive strengthening of 𝜑
• Maximum number of unrollings needed will
be less than or equal to the diameter
• Unlike BMC, diameter need not be known in
advance!
38
7/26/2016
Interpolation in Practice
• Comparison with Proof based abstraction
(PBA) and Baumgartner’s approach
• PicoJava II:
 20 properties which NuSMV could not verify
 Interpolation verified all of them
 Almost always faster than PBA
• IBM Gigahertz:
 28 properties which Baumgartner could not verify
 Interpolation succeeded on all but one
 No clear winner between PBA and Interpolation
• PBA finds counterexamples quickly when they exist
• Unlike interpolation which require unrolling to the depth of
the shallowest counterexample
39
7/26/2016
Outline
• Background
 Transition Systems, Temporal Logic
 Symbolic Model Checking
• Counterexample Guided Abstraction
Refinement (CEGAR)
• SAT-based Model Checking using
Interpolants
• IC3
• Discussion
40
7/26/2016
IC3 Background
• A state is a conjunction of literals
• The negation of a state is a clause (disjunction of
literals)
• Inductive clause:
 A clause 𝑐 which is inductive w.r.t. 𝑅
 𝑐 ∧ 𝑅 ⇒ 𝑐′
• Relatively inductive clause:
 A clause 𝑐 which is inductive relative to known reachability
information 𝑄
 𝑄 ∧ 𝑐 ∧ 𝑅 ⇒ 𝑐′
• Minimal Inductive Subclause:
 A subclause 𝑐𝑠 of 𝑐 which is inductive and no subclause 𝑐𝑠′ of 𝑐𝑠
is inductive
 Can be considered a generalization of 𝑐
41
7/26/2016
Overview of IC3
• Construct a sequence of over-approximations
𝐹0 , 𝐹1 , 𝐹2 , … 𝐹𝑘 such that
𝜑
 𝐹0 ≡ 𝐼
 𝐹𝑖 ⇒ 𝜑
 𝐹𝑖 ∧ 𝑅 ⇒ 𝐹𝑖+1 ′
𝐹0 = 𝐼 𝐹1
𝐹2
...
𝐹𝑘 = 𝐹𝑘−1
 𝐹𝑖 ⇒ 𝐹𝑖+1
• Intuitively, 𝐹𝑖 is an over-approximation of the set of
states reachable in 𝑖 steps
• If for any 𝑖, 𝐹𝑖 = 𝐹𝑖+1 , then 𝐹𝑖 is an inductive
strengthening of 𝜑
• Otherwise, generalize any counterexample to
induction at level 𝑘:
 Generalize the negation of the satisfying assignment to
𝐹𝑘 ∧ 𝑅 ∧ ¬𝜑 ′
42
 No such counterexample  extend sequence to 𝐹𝑘+1
7/26/2016
IC3: The Intuition
𝐹0 = 𝐼
𝐹1
𝐹2
...
𝑠
𝐹𝑘−2
𝐹𝑘−1
𝐹𝑘
𝜑
• Is ¬𝑠 inductive relative to 𝐹𝑘 ?
 Yes: Generalize at level 𝑘
 No: Why is ¬𝑠 not inductive?
43
7/26/2016
IC3: The Intuition
𝐹0 = 𝐼
𝐹1
𝐹2
...
𝐹𝑘−2
𝑡
𝐹𝑘−1
𝑠
𝐹𝑘
𝜑
• Because 𝐹𝑘−1 contains a state 𝑡 which is a
predecessor of 𝑠
• Note that ¬𝑠 must be inductive relative to
𝐹𝑘−2
44
 Otherwise 𝑠 is an 𝐹𝑘−1 state and 𝐹𝑘 is not a subset of 𝜑
7/26/2016
IC3: The Intuition
𝐹0 = 𝐼
•
•
•
•
•
45
𝐹1
𝐹2
...
𝐹𝑘−2
𝑡
𝐹𝑘−1
𝑠
𝐹𝑘
𝜑
Recur on 𝑡 at level 𝐹𝑘−1
Say ¬𝑡 is inductive relative to 𝐹𝑘−1
Generalize at 𝐹𝑘−1
Propagate to level 𝐹𝑘 if inductive at 𝐹𝑘
Consider 𝑠 at level 𝐹𝑘 again until eliminated
7/26/2016
IC3: The Intuition
𝐹0 = 𝐼
•
•
•
•
•
46
𝐹1
𝐹2
...
𝐹𝑘−2
𝑡
𝐹𝑘−1
𝑠
𝐹𝑘
𝜑
Recur on 𝑡 at level 𝐹𝑘−1
Say ¬𝑡 is inductive relative to 𝐹𝑘−1
Generalize at 𝐹𝑘−1
Propagate to level 𝐹𝑘 if inductive at 𝐹𝑘
Consider 𝑠 at level 𝐹𝑘 again until eliminated
7/26/2016
IC3: Implementation Details
• 𝐹𝑖 maintained as clause sets
• Interpreted as 𝜑 ∧ 𝑐∈𝑐𝑙𝑎𝑢𝑠𝑒𝑠(𝐹𝑖) 𝑐
• Major Iteration: Extend to 𝐹𝑘+1
 Only when 𝐹0 , 𝐹1 , … 𝐹𝑘 satisfies invariants
 Initialize 𝐹𝑘+1 = 𝜑
 Propagate inductive clauses up from 𝐹𝑖 , 𝑖 < 𝑘 + 1
 𝐹𝑖 = 𝐹𝑖+1 for any 𝑖? Terminate, success
 On termination 𝐹𝑖 is an inductive strengthening of 𝜑
• Minor Iteration: Counterexample at 𝐹𝑘
 Generalize counterexample at highest level possible
 Recur on predecessors if necessary
 Fail if we ever consider a predecessor not inductive relative to 𝐹0
 Propagate generalizations upward as long as they are inductive
relative to higher levels
47
 All generalizations are always propagated downwards
7/26/2016
IC3 in Practice
• On HWMCC `08 and `10 benchmarks, IC3
does not emerge as a clear winner
 Dated SAT solver technologies
 Lack of support for incremental solving
• IC3 executes thousands of SAT queries per
second
 Goal of incrementality achieved
• IC3 easily parallelizable
 Generally scales linearly with number of CPU cores
 Parallel version enabled solution of 12 additional
benchmarks with a 900 second time limit
48
7/26/2016
Outline
• Background
 Transition Systems, Temporal Logic
 Symbolic Model Checking
• Counterexample Guided Abstraction
Refinement (CEGAR)
• SAT-based Model Checking using
Interpolants
• IC3
• Discussion
49
7/26/2016
Discussion: Inductive
Strengthening
• CEGAR
 Inductive strengthening implicitly constructed using fixpoint
characterizations
 Wins from over-approximating transition relation
 Not necessarily minimal
• Interpolation
 Inductive strengthening as a consequence
 Wins from over-approximating reachable states via interpolants
 Not necessarily minimal
• IC3
 Inductive strengthening explicitly constructed incrementally
 Wins from over-approximating reachable states by 𝜑 and then
refining over-approximation using CTIs
 Possible to obtain minimal CNF inductive strengthening
50
7/26/2016
Discussion: Decision Procedures
• CEGAR
 No decision procedure necessary, OBDDs used
 Potential for wins if formulas represented explicitly and
SAT solvers used as necessary
• Interpolation
 SAT solver necessary
 Size of queries typically large, grows linearly over time
 𝑂(𝐷𝑖𝑎 𝑀 2 ) queries in the worst case
• IC3
 SAT solver necessary
 Size of queries typically small
 Difficult to bound number of queries
51
7/26/2016
Discussion: Composability & Applicability
• CEGAR
 A paradigm more than an algorithm
 Actual model checker pluggable
 Can be used with Interpolation or IC3 techniques
 Only ACTL* specs allowed
• Interpolation
 Easily composable with BMC techniques and CEGAR
 Handles only safety properties
• Reducing liveness to safety often involves a blow-up
 Interpolation itself applicable to other infinite domains
• IC3
 Can be composed with CEGAR
 Adapted to handle CTL and LTL specifications
 Could benefit from invariant generation techniques like Daikon
52
 Unsat backward BMC queries could also provide useful information
for IC3
7/26/2016
Conclusions
• Approaches to mitigate unpredictability of
OBDDs
• CEGAR
 Mitigates problem by model checking smaller state space
• Interpolation
 Does not use OBDDs at all
 Leverages advances in SAT solver technology to compute
inductive strengthenings
• IC3
 Does not use OBDDs at all
 Tries to keep size of SAT queries small for better
scalability
 Easily parallelizable
53
7/26/2016
Going Forward
• Infinite Domains
 Advances in SMT solvers could help IC3
 Notion of Interpolants already extended to other domains
 Inductive generalization performed by IC3 could be used
to verify/infer loop invariants
• Program Synthesis
 In computing an inductive invariant, all approaches solve
an exists-forall formula
 This is precisely the form of synthesis problem proposed
in literature
 Can these advances in verification be leveraged to obtain
more efficient synthesis algorithms?
54
7/26/2016
Thank You
Questions?