1. 1 Computing Abstractions by integrating BDDs and SMT Solvers Alessandro Cimatti Fondazione Bruno Kessler, Trento, Italy Joint work with R. Cavada, A. Franzen, K. Krishnamani, M. Roveri, R. Shyamasundar

2. 22Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Index of the talk Background: Predicate Abstraction Predicate Abstraction via AllSMT Predicate Abstraction via BDDs + SMT Experiments Conclusions and Future Work

3. 33Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX P0P0 P1P1 not P 1 0100 1011 P2P2 not P 2 000 010011 001 100 101 Ψ 0 (X) Ψ 1 (X) Ψ 2 (X) Init(X) Trans(X, X') Invar(X) State vars X Abstract State vars P Init(P) Invar(P) Trans(P,P') not P 0

4. 44Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX CEGAR When imprecise abstraction !

5. 55Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Computing Abstractions Given concrete program over X Given set of predicates Ψ i (X) associated to abstract variable P i Obtain the corresponding abstract program For example, Trans(P, P') is defined by ∃ X X'.( CTrans(X, X') ⋀ ⋀ i P i ↔ Ψ i (X) ⋀ ⋀ i P i ' ↔ Ψ i (X') ) Basic computation: existential quantification

6. 66Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Index of the talk Background: Predicate Abstraction Predicate Abstraction via AllSMT Predicate Abstraction via BDDs + SMT Experiments Conclusions and Future Work

7. 77Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Existential quantification Let Φ(x, V) be a formula where –V are boolean variables (important vars) –x are the other variables Compute a boolean formula equivalent to ∃ x.Φ(x, V) Example (boolean case): –∃ B.(A ⋀ (B ⋁ C)) –V = {A, C} Example: –∃ x y.( (P ↔ x + y = 2) ⋀ (Q ↔ x – y 12 ) –V = { P, Q }

8. 88Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX All SMT [LNO'06] use SMT solver on Φ(x, V) Compute all satisfiable assignments to V SMTAbstract(Phi, V) { res = false; loop { mu = SMT(Phi); if mu == UNSAT then return res; else vmu = restrict(V, mu); res = res or vmu; Phi = Phi and ¬vmu; }}

9. 99Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX ∃ B.(A ⋀ (B ⋁ C)) V = { A, C } First iteration: mu: A, ¬C, B vmu: A, ¬C blocking clause: ¬A or C Second iteration: mu: A, C, ¬B vmu: A, C blocking clause: ¬A ⋁ ¬C Third iteration: unsat Result: (A ⋀ ¬C) ⋁ (A ⋀ C) → A AllSMT at work (boolean case) In fact, ∃ B.(A and (B or C)) reduces to (A and (true or C)) or (A and (false or C)) that is, A

10. 10 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX AllSMT at work ∃ x y. (P ↔ (x + y = 2)) ⋀ (Q ↔ (x – y 12) V = { P, Q } First iteration: mu: ¬P, ¬(x + y = 2), ¬Q, ¬(x – y 12) vmu: ¬P, ¬Q blocking clause: P ⋁ Q Second iteration: mu: ¬P, ¬(x + y = 2), Q, (x – y 12) vmu: ¬P, Q blocking clause: P ⋁ ¬Q Third iteration: unsat Result: ¬ P

11. 11 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX AllSMT: a closer look Limit case: Φ purely boolean, disjoint clauses, all variables are important (P1 1 ⋁ … ⋁ P1 n ) ⋀ … ⋀ (Pm 1 ⋁ … ⋁ Pm n ) blow up in number of disjuncts even prime implicants blow up !!! Intuition: –the approach constructs the DNF of the result –enumerating all the disjuncts

12. 12 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Index of the talk Background: Predicate Abstraction Predicate Abstraction via AllSMT Predicate Abstraction via BDDs + SMT Experiments Conclusions and Future Work

13. 13 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX The big picture BOOLEANMODULO THEORY ONE MODEL mu(V) |= Φ(V) SAT BDD SMT solver (SAT-based enumeration) MANY MODELS mu(V) |= ∃ x.Φ(V, x) BDD-based quantification SAT-based quantification BDD-based quantification Modulo Theory SMT-based quantification

14. 14 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Binary Decision Diagrams –canonical representation for boolean functions –ITE nodes –fixed order on test variables –(A ⋀ (B ⋁ C)) Reduction rules –only one occurrence of the same subtree –if(P, b, b) == b Can blow up in space Order of variables can make huge difference ABC truefalse

15. 15 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX More on BDDs Core of traditional EDA tools –Often replaced by SAT techniques –Capacity, automation, … Yes, but … –In practice, can be extremely efficient –They provide QBF functionalities ∃ x.Φ(x, V) == Φ(false, V) ⋁ Φ(true, V) –Fundamental operation in model checking

16. 16 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX BDD-based Abstraction BddAbstract(b, V) { if (b == True) or (b == False) then return b; tt = BddAbstract(BddThen(b), V); ee = BddAbstract(BddElse(b), V); if var(b) in V then return BddITE(var(v), tt, ee); else return BddOr(tt, ee); }

17. 17 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX BddThAbstract Our idea –extend BDD-based quantification –to deal with theory constraints Intuitive reduction –∃ x.Φ(x, V) –∃ x.Φ(C 1 (x), …, C n (x), V) –∃ x A 1, …, A n.(Φ(A 1, …, A n, V) ⋀ ⋀ i (A i ↔ C i (x)) ) –∃ A 1, …, A n.Φ(A 1, …, A n, V) this is BddAbstract, but… "modulo theory", i.e. interpreting each A i as C i (x) Result –A BDD whose paths are all theory consistent

18. 18 BddThAbstract(b, C, V) { if (b == True) or (b == False) then return b; if BooleanAtom(var(v)) then tt = BddThAbstract(BddThen(b), C, V); ee = BddThAbstract(BddElse(b), C, V); if (var(b) in V) then return BddITE(var(v), tt, ee); else return BddOr(tt, ee); else cv = VarToConstraint(var(v)); if ThInconsistent(C,cv) then tt = False; else tt = BddThAbstract(BddThen(b), C  {cv}, V); if ThInconsistent(C,  cv) then ee = False; else ee = BddThAbstract(BddElse(b), C  {  cv},V); return BddOr(tt, ee); } 18Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX

19. 19 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Architecture: SMT + BDD An SMT solver without selection heuristic NOT a theory solver! Contains stack and implication graph Can learn theory lemmas Carries out BCP

20. 20 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Index of the talk Background: Predicate Abstraction Predicate Abstraction via AllSMT Predicate Abstraction via BDDs + SMT Experiments Conclusions and Future Work

21. 21 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Experiments Implemented combining NuSMV and MathSAT Test cases: networks of Timed Automata Parameters: –number of automata –number of states –number of transitions Remark: –absolute time is global to all processes Timeout at 900s

22. 22 Experimental Evaluation 22Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX

23. 23 Experimental Evaluation 23Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX

24. 24 Experimental Evaluation 24Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX

25. 25 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Conclusions and Future Work A new approach for computing abstractions –BDD-based top level, SMT solver for consistency –Significantly faster within BDD capacity when many disjunct Future directions –Conjunctive partitioning of the matrix –Better memoizing –Any time ? –Experiments within CEGAR loop NuSMV + MathSAT Hybrid systems, word-level circuits

26. 26 Thanks for your attention

27. 27 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Related Work BDDs for SMT –DDDs –HarVey switched from BDDs to SAT –Armando simplifies boolean structure in SMT –Shuijers does not deal with quantification –LTL satisfiability, based on prime implicants [CAV'07] SAT-based existential quantification in the boolean case –McMillan, Gupta et al

28. 28 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Experiemental Evaluation

29. 29 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Experiemental Evaluation

30. 30 Predicate Abstraction with BDDs and SMT FMCAD'07, Austin, TX Experiemental Evaluation