Cut-Based Inductive Invariant Computation Michael Case 1,2 Alan Mishchenko 1 Robert Brayton 1 Robert Brayton 1 1 UC Berkeley 2 IBM Systems and Technology Group, Austin, TX

2 Overview Motivation Motivation Previous work Previous work Inductive invariants Inductive invariants Selecting invariant candidates Selecting invariant candidates Proving inductive invariants Proving inductive invariants Experimental results Experimental results Conclusions and future work Conclusions and future work

3 Motivation Inductive invariants in verification Inductive invariants in verification Prevent spurious counter-examples to induction Prevent spurious counter-examples to induction Speed up SAT and improve SAT-based algorithms Speed up SAT and improve SAT-based algorithms Interpolation, functional dependency, etc Interpolation, functional dependency, etc Inductive invariants in synthesis Inductive invariants in synthesis Represent over-approximation of reachable states Represent over-approximation of reachable states Can be used as care set during logic optimization Can be used as care set during logic optimization

4 Preventing Spurious C-Examples Spurious c-examples are Achilles' heel of induction Spurious c-examples are Achilles' heel of induction Remedy: Induction strengthening Remedy: Induction strengthening For example, property P  Q may be provable by induction, even if properties P and Q are not For example, property P  Q may be provable by induction, even if properties P and Q are not Q Q P  Q complete state space P P P P unreachable reachable

5 Previous Work on Induction Strengthening Van Eijk’s approach (TCAD’00) Van Eijk’s approach (TCAD’00) Use candidate equivalences Use candidate equivalences If not enough, add dangling nodes (nodes after retiming) If not enough, add dangling nodes (nodes after retiming) Mike Case’s approach (FMCAD’07) Mike Case’s approach (FMCAD’07) Use implications that cover counter-examples Use implications that cover counter-examples Aaron Bradley’s approach (FMCAD’07) Aaron Bradley’s approach (FMCAD’07) Use minimal clauses derive from counter-examples Use minimal clauses derive from counter-examples Proposed approach Proposed approach Create properties based on groups of signals in the network Create properties based on groups of signals in the network

6 Inductive Invariants If property P is hard to prove, the goal is to find a new property Q that strengthens P If property P is hard to prove, the goal is to find a new property Q that strengthens P Q is an inductive invariant Q is an inductive invariant n P Q Y X

7 Selecting Invariant Candidates Perform two rounds of simulation: Perform two rounds of simulation: Combinational (C) Combinational (C) Random primary inputs and register outputs Random primary inputs and register outputs Sequential (S) Sequential (S) Random primary inputs and reachable states at register outputs Random primary inputs and reachable states at register outputs Collect combinations in Y-space of n appearing in C but not in S Collect combinations in Y-space of n appearing in C but not in S These are likely due to unreachable states These are likely due to unreachable states Consider one combination, say, (0110) Consider one combination, say, (0110) Q(y) = y1  y2  y3  y4 Q(y) = y1  y2  y3  y4 Q(y) is likely true only in unreachable states Q(y) is likely true only in unreachable states Its complement is a candidate inductive invariant Its complement is a candidate inductive invariant Q(y) = y1  y2  y3  y4 Q(y) = y1  y2  y3  y4 n P Q Y X

8 a b c d g f Cuts of a Cut Assignments Appears in Comb. Sim. Appears in Seq. Sim. Candidate Seq. Invariant Candidate Seq. Invariant {b, c} bc bcb+c … {e, f, g} efge+f+g efg efg … abcdefg Combinational Simulation Dataabcdefg Sequential Simulation Data e Example of Candidate Invariants

9 Proving Inductive Invariants Collecting candidate inductive invariants Collecting candidate inductive invariants Constants (1-clauses) Constants (1-clauses) Implications (2-clauses) Implications (2-clauses) Values of signals at n-cuts (n-clauses) Values of signals at n-cuts (n-clauses) Values of signals at n randomly selected nodes (n-clauses) Values of signals at n randomly selected nodes (n-clauses) Proving inductive invariants Proving inductive invariants Use k-step induction Use k-step induction Check invariants in the initialized k-frames Check invariants in the initialized k-frames Assume invariants true in the uninitialized k-frames, and prove them in the k+1 st frame Assume invariants true in the uninitialized k-frames, and prove them in the k+1 st frame

10 Experiment Overview Implemented invariant computation in ABC and in IBM’s SixthSense tool Implemented invariant computation in ABC and in IBM’s SixthSense tool Used in synthesis Used in synthesis Lead to 1-3% improvement in AIG nodes Lead to 1-3% improvement in AIG nodes Overall results are marginal Overall results are marginal Used in verification Used in verification Observe strengthening on some properties Observe strengthening on some properties Overall results are not impressive Overall results are not impressive Used to improve several algorithms Used to improve several algorithms Interpolation, functional dependency, etc Interpolation, functional dependency, etc Overall results are promising Overall results are promising

11 Experimental Results

12 Conclusions Developed a new method for expressing candidate invariants using n-clauses Developed a new method for expressing candidate invariants using n-clauses Created a scalable hierarchical approach to proving the candidate invariants, which trades off computational effort for the number and expressiveness of invariants generated Created a scalable hierarchical approach to proving the candidate invariants, which trades off computational effort for the number and expressiveness of invariants generated Performed initial experiments to evaluate the usefulness of inductive invariants Performed initial experiments to evaluate the usefulness of inductive invariants

13 Future Work Run further experiments and finetune using industrial benchmarks Run further experiments and finetune using industrial benchmarks Integrate the induction strengthening engine into equivalence checkers and model checkers Integrate the induction strengthening engine into equivalence checkers and model checkers Use the computed invariant clause sets as don’t-cares for circuit restructuring in technology-dependent synthesis Use the computed invariant clause sets as don’t-cares for circuit restructuring in technology-dependent synthesis