1. Weizmann Institute Range Minimization O. Shtrichman The Weizmann Institute Joint work with A.Pnueli, Y.Rodeh, M.Siegel

2. Weizmann Institute DC+C Verification Condition Generator Code generation Abstraction Level ++ CVT Auto-decomposition Abstraction Range Minimizer TLV (verifier)

3. Weizmann Institute To a formula with uninterpreted functions Uninterpreted functions From a general formula:

4. Weizmann Institute From a formula with uninterpreted functions: To a formula in the theory of equality Ackerman’s reduction

5. Weizmann Institute Choosing a minimal range for the integer variables 0. a,b,c,d,e : {0..65536}(1.2 E 24)(normal) 1.a,b,c,d,e : {1..5} (3125)(1..n) 2. a,b,c: {1..3}(connectivity d,e: {1..2} (108) analysis) 3. a: {1}, b:{1-2}, c: {1-3}(factorial d: {1}, e: {1-2} (12) reduction) 4..........

6. Weizmann Institute The Range-Minimization Problem Given a quantifier-free formula with equalities only, find in polynomial time the minimal domain needed to preserve its truth value D : Infinite domain D*: finite domain D*D

7. Weizmann Institute Using the (1..11) range imposes a state space of 11 11 We can do much better: x1x1 x2x2 y1y1 y2y2 g1g1 g2g2 zu1u1 f1f1 f2f2 u2u2 x 1,y 1,u 1 :{0} x 2, y 2, f 1, f 2, u 2 : {0,1}g 1 : {0,1} g 2 : {0,2} z: {0,3} These ranges impose a state-space of 2 8 =256

8. Weizmann Institute Before and after, in SMV

9. Weizmann Institute Using Normal Form to analyze the formula The Disjunctive Normal Form of a formula can be exponentially long in its original size Yet...

10. Weizmann Institute Prediction of the negation sign in DNF The negation sign of each comparison, if transformed to DNF, can be predicted in polynomial time. Counting negations in the parsing tree:     b=c a=b d=e

11. Weizmann Institute The negation sign can be predicted in P-time. The clauses can not be predicted in P-time.

12. Weizmann Institute If  is false, then it has at least one falsifying vector Without knowing the partitioning of  to clauses, we have to consider ~ all combinations:

13. Weizmann Institute x1x1 x2x2 y1y1 y2y2 g1g1 g2g2 zu1u1 f1f1 f2f2 u2u2 0 110 {0,1} 00 0 A graphical representation These ranges impose a state-space of 16

14. Weizmann Institute The Range-Minimization Algorithm Step I - preprocessing Add a single unique value to G  /G = edges, and remove them from the graph: x1x1 x2x2 y1y1 y2y2 g1g1 g2g2 zu1u1 f1f1 f2f2 u2u2 0 110

15. Weizmann Institute Step II - Set construction For each shared vertex, following an arbitrary order: 1. Add a unique value 2. Broadcast the value on G  3. Remove it from the graph g1g1 g2g2 z 00 0 g1g1 z {0,1} g1g1 g2g2 z 0 1. 2.

16. Weizmann Institute u1u1 f1f1 f2f2 u2u2 0000 f1f1 f2f2 u2u2 {0,1} f2f2 u2u2 {0,1,2} u2u2 {0,1,2,3} u1u1 f1f1 f2f2 u2u2 0{0-1}{0-2}{0-3} 1. 2. 3. 4.

17. Weizmann Institute x1x1 x2x2 y1y1 y2y2 g1g1 g2g2 zu1u1 f1f1 f2f2 u2u2 0 110 0 {0,1} Why is the algorithm sound? For each G  component, in a given vector: As a common value, choose the value originated in the first shared vertex that was removed. The availability of these values is guaranteed by step II. 0{0-1}{0-2}{0-3}

18. Weizmann Institute Order makes a difference Order: State-space=24 {0}{0}{0,1}{0,1,2}{0,1,2,3} I IIIIIIV {1,0}{1}{1}{1,2}{1,2,3} III IIIIV Order: State-space=12

19. Weizmann Institute Construct G’(V,E): V: The shared vertexes of G E: An edge for every two shared vertexes connected directly on G  The Minimal Vertex Cover (MVC) of G’: the minimal set of vertexes that cover all edges of G’. Order makes a difference G’G’

20. Weizmann Institute The MVC problem is NP-Hard. Therefore we use a heuristic called the greedy algorithm: 1. Remove vertexes in a descending order of degree, until G’ is covered 2. Remove the rest of the vertexes in an arbitrary order Order makes a difference G’G’ Order: III IIIIV

21. Weizmann Institute V i - The i-th vertex in the order S i - The computed set of values for V i mvc k - the set of vertexes in the MVC of component k m k = |mvc k | For each V i  mvc k : |S i |  i. m k ! For each V i  mvc k : |S i |  m k +1 The upper bound for the state space is: Order makes a difference G’G’ In our case the upper bound is

22. Weizmann Institute Colors make a difference Order: State-space=12 State-space=4 III IIIIV {1,0}{1}{1}{1,2}{1,2,3} Order: III IIIIV {1,0}{1}{1}{1}{1}

23. Weizmann Institute Colors make a difference Construct G’’(V,E) and ‘color’ it: V: The shared vertexes of G E: Add an edge for every two shared vertexes that: 1. Are connected through exactly one solid edge (V 1,V 2 ) in G. 2. Are dominant, due to the ordering, in deciding the value of V 1 and V 2 v1v1 v2v2 v3v3 v4v4 If v 3 <v 1 and v 4 <v 2 then color(v 3 )  color(v 4 ) v1<v3v1<v3

24. Weizmann Institute y k - the number of colors in mvc k (y k  m k ) For every vertex V i s.t. i  y k : |S i |  i For every vertex V i s.t. y k <i  m k : |S i |  y k For every vertex V i s.t. m k <i  n k : |S i |  y k +1 G’’ {0,1}{0}{0}{0}{0} The state-space upper-bound : Colors make a difference

25. Weizmann Institute In our case: y k =1, m k =2, n k =4 and the upper bound is x1x1 x2x2 y1y1 y2y2 g1g1 g2g2 zu1u1 f1f1 f2f2 u2u2 0 110 {0,1} 00 0

26. Weizmann Institute The worst case: double cliques One connected component (n k =n) All vertexes are shared Worst vertex-cover: m k = n k -1 Worst coloring: y k =m k Worst state-space = n! A 4 double-clique

27. Weizmann Institute Formulas with constants The maximal state-space of a formula with c k constants: In the worst case: a b5 {1,5} {1,2,5}

28. Weizmann Institute The range minimization algorithm - FAQ: The Range minimization algorithm is proven to be sound for any mixed graph. It utilizes heuristics from 3 famous NP-hard problems: Coloring, Set Cover and Minimal Vertex-Cover Under the limitation of the above heuristics, in most cases the algorithm finds a solution which is very close to the optimal one. The implementation is ~ 700 lines long and available

29. Weizmann Institute Experimental Results Before : 92% verified in reasonable time After: 99.9% verified in reasonable time (solved almost all hard models) With the Range Minimization Module, CVT verified formulas that originally had a state-space of 150 150 and more.