Automated Extraction of Inductive Invariants to Aid Model Checking Michael L. Case, Alan Mishchenko, and Robert K. Brayton University of California, Berkeley FMCAD 2007

Motivation What kind of information will help verification? Design w/ Safety Property Design w/ Safety Property Additional Design Information Verification Time What kind of information will help verification? How do we know when we’ve given enough information? Is the additional information easily verifiable? November 14, 2007 Mike Case, FMCAD 2007

Abstract Present a framework to automatically find/prove this extra design information Local properties (Inductive Invariants) Only considered if they help the verification Limited in number, easy to prove correct Verifying safety properties in a gate-level hardware design Interpolation used as a case study November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

Approximating the Reachable States Prove inductive invariants (local properties that hold  reachable states) Conjunction gives reachability approximation I November 14, 2007 Mike Case, FMCAD 2007

Quickly Proving Local Properties Our previous work Derive a large set of candidate invariants (implications) Proved in a van Eijk-style induction Tries to prove as many properties as possible Do we need to prove all properties? Are some better than others? Tight reachability approx. or just “good enough”? November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

The Interpolation Algorithm Initialize approximation parameters Reachability: Tighten approximation parameters Image 2 Image 1 frontier := initial states B I Bad state reached? yes Interpolation: no Image 2 frontier += approxImage(frontier) Image 1 Cex reached directly from the initial state? no S B I Fixed Point? no yes yes Property Falsified November 14, 2007 Property Verified Mike Case, FMCAD 2007

Problems With Interpolation Can explore unreachable states No control over the approximate image Often can’t decide if an encountered bad state is reachable Requires frequent restarts Refining the approximation parameters and restarting is the most expensive operation Discards all prior work November 14, 2007 Mike Case, FMCAD 2007

Enhancing Interpolation Possible to avoid the model refinement Show either S or B unreachable  Invariants that are violated in either S or B Suppose we had a tool to find invariants to do this Adding the invariants to our satisfiability solver would prevent S or B from being explored Image 2 Image 1 S B I November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

Targetted Invariant Tool Given a state S that we want to prove unreachable Find {P} such that Implies that S is unreachable Can be proved with simple (one-step) induction November 14, 2007 Mike Case, FMCAD 2007

Initialize approximation parameters Tighten approximation parameters no frontier := initial states Can we find invariants? yes Bad state reached? yes no frontier += approxImage(frontier) Cex reached directly from the initial state? no Fixed Point? no yes yes Property Falsified Property Verified November 14, 2007 Mike Case, FMCAD 2007

Proving A State Unreachable Previous work proves a large set of states unreachable Proves many small properties Can we limit the invariants to target states of interest? November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

The Proof Graph { P } S { P } S (a state) (a set of properties) (a set of properties) (a state) S is the reason the inductive proof of the properties does not succeed S is the counterexample in the simple induction proof Proving S unreachable is a necessary condition for proving any property in the set S is why we can’t prove {P} Every property in the set is violated in S Proving any such property implies that S is unreachable {P} are how we will prove S unreachable November 14, 2007 Mike Case, FMCAD 2007

Proof Graph Example Input S0 Find properties violated in S0 Prove {P0} Input S0 Find properties violated in S0 Prove {P0} Cover the new states with properties Prove {P3} Prove {P03} { P } 1 { P } { P } 3 2 S 1 S 2 S 3 { P 2 } { P 3 } { P 1 } November 14, 2007 Mike Case, FMCAD 2007

Outline Forming a reachability approximation Brief introduction to Interpolation Tailoring reachable approximation for a target application Helping interpolation Proof graph formulation Experimental results November 14, 2007 Mike Case, FMCAD 2007

Experimental Results ABC logic synthesis system used as software base Extended through two C++ plugin libraries: Interpolation Proof graph formulation (this work) User can select to use interpolation alone or interpolation + proof graph Refuting error traces is an option Tested on extensively on both academic and industrial benchmarks November 14, 2007 Mike Case, FMCAD 2007

“Hard” Academic Benchmarks Verified 154 academic benchmarks (TIP suite) 18 timeout in 2 hours with standard interpolation 9 of these are “easy” when the proof graph refutes counterexample traces Why are there no false properties here? November 14, 2007 Mike Case, FMCAD 2007

“Hard” Industrial Benchmarks Sequential Equivalence Checking benchmarks 1800 second timeout Problems “hard” for standard interpolation Enabling proof graph dramatically helps runtime 1800 1800 November 14, 2007 Mike Case, FMCAD 2007

Summary Motivated need for a tool to show that a selected state is unreachable Constructed such a tool using the proof graph formulation Applied the tool to help interpolation Demonstrated the effectiveness on a variety of benchmarks Thank you. November 14, 2007 Mike Case, FMCAD 2007