Pruning techniques for the SAT-based Bounded Model-Checking problem

1. Pruning techniques for the SAT-based Bounded Model-Checking problem Ofer Shtrichman Weizmann Institute of Science & IBM - HRL

2. Bounded Model Checking (BMC) of invariant properties Given a safety property p: (e.g. AG p : “always signal_a = signal_b”) Is there a state reachable within k cycles, which satisfies p ? p p p p p . . . s0 s1 s2 sk-1 sk

3. p p p p p . . . s0 s1 s2 sk-1 sk Reducing the BMC problem to SAT The safety property pis valid up to cycle k iff kis unsatisfiable:

4.  X  X X X X The DPLL SAT procedure Given  in CNF: (x,y,z),(-x,y),(-y,z),(-x,-y,-z) Decide() Deduce() Diagnose()

5. y=1 c1 c3 Decision w=X x=1 c4 c2 c2 z=1 v=0 A reminder: what are conflict clauses c1= (x y) c2= (x z v) c3= (y w) c4= (z w) The assignments (x=1, v=0) represent a sufficient condition for the conflict to arise. Therefore we can add its negation to the formula:  =(x v) is a new conflict clause.

6. In this work: We present two techniques for speeding up SAT engines, based on conflict clauses: I. Constraints Sharing: reusability of conflict clauses between different (yet related) SAT instances. II. Replicating Conflict Clauses: generation of conflict clauses 'for free', based on the unique structure of BMC invariant properties.

7. Part I. Constraints Sharing Silva et. al. showed how conflict clauses can be reused in the context of ATPG: Let C be a circuit formula, and f1...fna series of fault models. When checking Cf1, if a conflict clause is deduced from C, it can be reused when checking C  f2. In this case  is called pervasive. The more general question of ‘when can conflict clauses be declared pervasive’, is defined as an open question.

8. The general question Given two CNF formulas (sets of clauses) S1 and S2, and a conflict clause  s.t. S1|-, under what conditions the following holds: S2 is satisfiable iff S2  is satisfiable.

9. Constraints Sharing (cont’d) Let 0 S1  S2 Claim: if 0 |- then S1 is satisfiable iff S1 is satisfiable. S2 is satisfiable iff S2 is satisfiable. S1 S2 0 |- 0 Thus, if we deduce  while checking S1, we can reuse it when checking S2.

10. Constraints Sharing (cont’d) Testing whether the clauses involved in deducing  are a subset of 0 requires marking them in advance. In the BMC case this is easy: Only one clause in k is not included in k+1.

11. Constraints Sharing (cont’d) 1. Mark 0 , the subset of clauses that are also contained in subsequent instances. 2. If s |- for some s  0,then add  to0 and mark it as pervasive. S1 S2 0

12. A framework for solving BMC with constraints sharing In the gradual process of solving the BMC problem, we use a list of pervasive clauses pc-list. pc-list =  Bool Solve (int k) { 1: Generate k and mark 0clauses. 2: add pc-list to k 3: While solving k , if is deduced by a set of marked clauses, add it to pc-list. 4: if k is SAT then return SATISFIABLE. else Solve (k+1); }

13. Part II. Replicated clauses The BMC invariant formula includes k structurally similar parts: Can this symmetry be used to speed up the search ?

14. Definitions Let xkdenote variable x in cycle k. Let c(i)denote the clause c, where every variable in c is shifted i cycles. For example: c = (x5y2 z7) c(2) = (x7y4 z9) c(-2) = (x3y0 z5) Similarly, s(i) denotes the set of shifted clauses in the set s, i.e. j cjs, cj(i)s(i).

15. Replicated clauses (cont’d) Let s be a subset of k's clauses, and let  be a conflict clause deducible from s, i.e. s|-. (x2 y5), (x2 y5 z3  w4)  =(y5 z3  w4) s = By substitution, it is also true that s(i) |- (i). (x2+i y5+i), (x2+i y5+i z3+i  w4+i) (i) =(y5+i z2+i  w4+i) s(i) =

16. Replicated clauses (cont’d) Conclusion: if s(i)k then we can also add (i) to k. (i) is a new clause that we got 'for free'. We call (i) a 'replicated clause'. The remaining question is: for which i,s(i)k.

17. Replicated clauses in BMC (1/2) 1. While generating k, mark all transition relation clauses. 2. For every conflict clause , if all the clauses in s are marked, then mark  as 'replicable'. . . .

18. Replicated clauses in BMC (2/2) Given a replicable clause  and the subset of clauses s from which it was desuced: . . . 3.Recordls and hs, the lowest and highest cycle index in s. 4. Add a replicated clause (i) for i in the range -ls .. (k - hs).

19. Example (x2 y5), (x2 y5 z3  w4) s = ls = 2, hs = 5 k = 6  = (y5 z3 w4) Going right (1)= (y6 z4 w5) Going left (-1)= (y4 z2 w3) (-2)= (y3 z1 w2)

20. Experimental results