1. Pruning techniques for the SAT-based Bounded Model-Checking problem Ofer Shtrichman Weizmann Institute of Science & IBM - HRL

2. Bounded Model Checking (BMC) of invariant properties Given a safety property p: (e.g. AG p : “always signal_a = signal_b”) Is there a state reachable within k cycles, which satisfies  p ?... s0s0 s1s1 s2s2 s k-1 sksk pp p pp p

3. Reducing the BMC problem to SAT The safety property p is valid up to cycle k iff  k is unsatisfiable:... s0s0 s1s1 s2s2 s k-1 sksk pp p pp p

4. The DPLL SAT procedure Given  in CNF: (x,y,z),(-x,y),(-y,z),(-x,-y,-z) Decide() Deduce() Diagnose()  X XX XX 

5. c1c1 c2c2 c3c3 c4c4 c2c2 x=1 y=1 z=1 v=0 w=Xw=X Decision c 1 = (  x  y) c 2 = (  x  z  v) c 3 = (  y  w) c 4 = (  z   w) A reminder: what are conflict clauses The assignments (x=1, v=0) represent a sufficient condition for the conflict to arise. Therefore we can add its negation to the formula:  = (  x  v)  is a new conflict clause.

6. We present two techniques for speeding up SAT engines, based on conflict clauses: I. C onstraints Sharing : reusability of conflict clauses between different (yet related) SAT instances. II. Replicating Conflict Clauses : generation of conflict clauses 'for free', based on the unique structure of BMC invariant properties. In this work:

7. Silva et. al. showed how conflict clauses can be reused in the context of ATPG: Let C be a circuit formula, and f 1...f n a series of fault models. When checking C  f 1, if a conflict clause  is deduced from C, it can be reused when checking C  f 2. In this case  is called pervasive. The more general question of ‘when can conflict clauses be declared pervasive’, is defined as an open question. Part I. Constraints Sharing

8. Given two CNF formulas (sets of clauses) S1 and S2, and a conflict clause  s.t. S1 |- , under what conditions the following holds: S2 is satisfiable iff S2   is satisfiable. The general question

9. Let  0  S1  S2 Claim: if  0 |-  then S1 is satisfiable iff S1   is satisfiable. S2 is satisfiable iff S2   is satisfiable. Thus, if we deduce  while checking S1, we can reuse it when checking S2. 00 S1S2  0 |-  Constraints Sharing (cont’d)

10. Testing whether the clauses involved in deducing  are a subset of  0 requires marking them in advance. In the BMC case this is easy: Only one clause in  k is not included in  k+1. Constraints Sharing (cont’d)

11. 00 S1S2 1. Mark  0, the subset of clauses that are also contained in subsequent instances. 2. If s |-  for some s   0, then add  to  0 and mark it as pervasive. Constraints Sharing (cont’d)

12. pc-list =  Bool Solve (int k) { 1: Generate  k and mark  0 clauses. 2: add pc-list to  k 3: While solving  k, if  is deduced by a set of marked clauses, add it to pc-list. 4: if  k is SAT then return SATISFIABLE. else Solve (k+1); } A framework for solving BMC with constraints sharing In the gradual process of solving the BMC problem, we use a list of pervasive clauses pc-list.

13. The BMC invariant formula includes k structurally similar parts: Part II. Replicated clauses Can this symmetry be used to speed up the search ?

14. Let x k denote variable x in cycle k. Let c (i) denote the clause c, where every variable in c is shifted i cycles. For example: c = (x 5   y 2  z 7 ) c (2) = (x 7   y 4  z 9 ) c (-2) = (x 3   y 0  z 5 ) Similarly, s (i) denotes the set of shifted clauses in the set s, i.e.  j c j  s, c j (i)  s (i). Definitions

15. Let s be a subset of  k 's clauses, and let  be a conflict clause deducible from s, i.e. s |- . By substitution, it is also true that s (i) |-  (i). Replicated clauses (cont’d) (  x 2  y 5 ), (x 2  y 5  z 3  w 4 )  =(y 5  z 3  w 4 ) (  x 2+i  y 5+i ), (x 2+i  y 5+i  z 3+i  w 4+i )  (i) =(y 5+i  z 2+i  w 4+i ) s = s (i) =

16. Conclusion: if s (i)   k then we can also add  (i) to  k.  (i) is a new clause that we got 'for free'. We call  (i) a 'replicated clause'. The remaining question is: for which i, s (i)   k. Replicated clauses (cont’d)

17. 1. While generating  k, mark all transition relation clauses. 2. For every conflict clause , if all the clauses in s are marked, then mark  as 'replicable'. Replicated clauses in BMC (1/2)......

18. Replicated clauses in BMC (2/2) 3. Record l s and h s, the lowest and highest cycle index in s. 4. Add a replicated clause  (i) for i in the range -l s.. (k - h s ). Given a replicable clause  and the subset of clauses s from which it was desuced:......

19. Going right Going left  = (y 5  z 3  w 4 )  (1) = (y 6  z 4  w 5 )  (-1) = (y 4  z 2  w 3 )  (-2) = (y 3  z 1  w 2 ) (  x 2  y 5 ), (x 2  y 5  z 3  w 4 ) s = l s = 2, h s = 5 k = 6 Example

20. Experimental results