The IC3 Algorithm Shoham Ben-David
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
The IC3 Algorithm
Shoham Ben-David
The IC3/PDR Algorithm
Aaron R. Bradley: SAT-Based Model Checking withoutUnrolling. VMCAI 2011
Incremental Construction of Inductive Clauses for IndubitableCorrectness : IC3
Known also as Property Directed Reachability
As of today: the state-of-art symbolic model checkingalgorithm.
Symbolic Model Checking
The main problem in model checking: the size problem
For |V | = 100 we have 2100 states to explore
Symbolic model checking deals with it by never referring tosingle states
Rather: always refer to sets of states
A Boolean formula F over the variables V represents a set ofstates in M:
All the states that satisfy F .
Symbolic Model Checking
The main problem in model checking: the size problem
For |V | = 100 we have 2100 states to explore
Symbolic model checking deals with it by never referring tosingle states
Rather: always refer to sets of states
A Boolean formula F over the variables V represents a set ofstates in M:
All the states that satisfy F .
Symbolic Model Checking
The main problem in model checking: the size problem
For |V | = 100 we have 2100 states to explore
Symbolic model checking deals with it by never referring tosingle states
Rather: always refer to sets of states
A Boolean formula F over the variables V represents a set ofstates in M:
All the states that satisfy F .
Some Definition
A cube is a conjunction of literals
For a clause c , ¬c is a cube
S , I ,T ,P,V ,V ′ as before
Primed formulas (e.g. s ′) are defined on V ′
Some Definition
A cube is a conjunction of literals
For a clause c , ¬c is a cube
S , I ,T ,P,V ,V ′ as before
Primed formulas (e.g. s ′) are defined on V ′
Some Definition
A cube is a conjunction of literals
For a clause c , ¬c is a cube
S , I ,T ,P,V ,V ′ as before
Primed formulas (e.g. s ′) are defined on V ′
PDR: Frames
The PDR algorithm is based on maintaining a sequence of“frames”
R0,R1, ...,RN .
1 Each frame is a CNF formula over the variables V ,representing a set of states in the model (Rj ⊆ S).
2 Each frame Rj is an over-approximations of the statesreachable from the initial states I in j steps or less.
Properties of Frames
The frames Rj fulfill the following conditions:
1 R0 = I .2 1 Rj ⊆ Rj+1.
2 CL(Rj+1) ⊆ CL(Rj), for j > 0.
3 T (Rj) ⊆ Rj+1.
4 Rj ⊆ P, for j < N.
Note that RN is different from the other frames, as it does notnecessarily satisfy P.
Termination of Algorithm
The PDR algorithm proceeds by refining the frames, adding moreclauses when possible, while maintaining the conditions discussedabove.The algorithm terminates in one of two cases:
1 For some j , Rj = Rj+1. In this case a fix point of reachablestates have been found, and thus M |= P.
2 An error state sI ∈ I is found, from which a path to ¬P exists.In this case M 6|= P.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.
Otherwise – continue with Query 1 on RN+1.
Taking a Step Forward
Set a query to the SAT solver:
SAT?[RN ∧ ¬P] (1)
If not, then RN ⊆ P.
Open a new empty frame RN+1
For every 0 < j , try to “push” clauses from Rj to Rj+1.
A clause c ∈ Rj can be pushed forward if
SAT?[Rj ∧ T ∧ ¬c′] (2)
is not satisfiable.
If two frames are found to be equal, terminate.Otherwise – continue with Query 1 on RN+1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.
If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
Now suppose that SAT?[RN ∧ ¬P] is satisfiable.
The SAT solver provides a satisfying assignment to thevariables V
A cube s, such that s ⊆ RN , but s ⊆ S \ P.If P holds in M, then the states in s are not reachable in M
exist in RN only because RN is an over-approximation
We want to block s in frame RN
CheckSAT?[RN−1 ∧ T ∧ s′] (3)
If (3) is not satisfiable, s is blockedAdd ¬s to RN ; Continue with Query 1.
The IC3 Algorithm
CheckSAT?[RN−1 ∧ T ∧ s′]
If (3) is satisfiable
We get a cube s1Needs to be blocked in frame RN−1
Check Query 3 with frame RN−2 and s′1...
If none of the cubes can be blocked during this process, thena query finally returns a cube sI ⊆ I
Cannot be blockedP does not hold in the model!
The IC3 Algorithm
CheckSAT?[RN−1 ∧ T ∧ s′]
If (3) is satisfiable
We get a cube s1Needs to be blocked in frame RN−1Check Query 3 with frame RN−2 and s′1
...
If none of the cubes can be blocked during this process, thena query finally returns a cube sI ⊆ I
Cannot be blockedP does not hold in the model!
The IC3 Algorithm
CheckSAT?[RN−1 ∧ T ∧ s′]
If (3) is satisfiable
We get a cube s1Needs to be blocked in frame RN−1Check Query 3 with frame RN−2 and s′1...
If none of the cubes can be blocked during this process, thena query finally returns a cube sI ⊆ I
Cannot be blockedP does not hold in the model!
Related Documents
