Abstraction refinement in symbolic model checking using satisfiability as the only decision procedure.

Full text

Page 1

Software Tools for Technology Transfer manuscript No.
(will be inserted by the editor)
Abstraction Refinement in Symbolic Model Checking Using Satisfiability as the
Only Decision Procedure?
Bing Li, Chao Wang, Fabio Somenzi
University of Colorado at Boulder
e-mail: {bli,wangc,Fabio}@Colorado.EDU
Received: date / Revised version: date
Abstract
for model checking of safety properties that relies exclusively
on a SAT solver for checking the abstract model, testing ab-
stract counterexamples on the concrete model, and refine-
ment.Modelcheckingoftheabstractionsisbasedonbounded
model checking extended with checks for the existence of
simplepathsthathelpindecidingpassingproperties.Allmin-
imum-length spurious counterexamples are eliminated in one
refinement step by an incremental procedure that combines
the analysis of the conflict dependency graph produced by
the SAT solver while looking for concrete counterexamples
with an effective refinement minimization procedure.
We present an abstraction refinement algorithm
1 Introduction
Model checking [CGP99] is an algorithmic approach to the
verification of properties of reactive systems, which has been
successfully applied to both hardware and software. Since
model checking entails the exploration of a potentially very
large state space, the alleviation of the so-called state explo-
sion problem has been the object of much research. On the
one hand, techniques have been developed that allow models
with hundreds of state variables to be analyzed directly. On
the other hand, abstraction has been used to allow the model
checker to draw conclusions on the original, concrete model
by examining a simpler, abstract one.
For systems with many state variables and many transi-
tions, the symbolic approach has proved crucial. In symbolic
model checking, sets of states and transition are described
by their characteristic functions. Various forms of represen-
tation have been used for these functions, the most popular
being Binary Decision Diagrams (BDDs) [Bry86], and Con-
junctive Normal Form (CNF).
Classical BDD-based model checking [McM94] is based
on the computation of fixpoints. For instance, the reachable
states of a model are computed as the least fixpoint of the
?This work was supported in part by SRC contract 2003-TJ-920.
function λZ .I ∨ Succ(Z), which adds the successors of the
states in Z to the initial states. Both the set of states and
the successor relation are stored as BDDs. The fixpoint com-
putation converges in a number of iterations that equals the
maximum distance of a reachable state from the initial states.
Checking for convergence is made easy by the strong canon-
icity of BDDs (identical sets share the same representation).
BDD-based model checking can therefore prove properties
almost as easily as it can disprove them.
BoundedModelChecking(BMC)[BCCZ99],ontheother
hand, formulates the reachability test as a series of satisfiabil-
ity(SAT)checksforpathsofbounded length.(To see ifapath
of length k to a set of states exists, the transition relation is
unrolled k times.) For finite systems the process must even-
tually terminate: The length of the shortest path between two
states cannot exceed the number of states. Hence, if no path
is found with length up to the number of states, the target
states are known to be unreachable. This observation, how-
ever, does not help for the kind of models that one encoun-
ters in practice. The diameter of the state graph would give
a much better bound on k, but, unfortunately, it is hard to
compute [BCCZ99]. For this reason, BMC has come to be
regarded as an excellent debugging (as opposed to verifica-
tion) technique. That is, classical BMC is particularly adept
at finding counterexamples, but ill-suited to prove their ab-
sence.
The ability demonstrated by BMC to deal with models
beyond the reach of BDD-based methods has sparked inter-
est in the use of CNF and SAT for proof as well as refuta-
tion. Two main approaches have been pursued: The replace-
ment of BDDs with CNF formulae in the fixpoint compu-
tation [ABE00,WBCG00,McM02], and the development of
more effective termination criteria for BMC.
The opportunity of replacing BDDs with CNF formulae
can be argued on the grounds that canonicity of representa-
tion makes BDDs somewhat inflexible. Hence, some func-
tions that admit compact representations in CNF have ex-
ceedingly large BDDs. However, the inflexibility argument
can also be used against CNF, and memoization techniques
are more effective for BDDs. In fact, to date, CNF-based fix-

Page 2

2Bing Li et al.
A
B0
B n−2
2
Bn
2
Bn−1
D0
D n−2
2
Dn
2
Dn−1
C
Fig. 1 Model with long simple path
point computation has not demonstrated a consistent advan-
tage over the classical BDD-based one. One may argue that
the main reason for the success of BMC in finding counterex-
amples lies in its avoidance of the needless computation and
storage of reachable states that are not on the error trace.
SeveralproposalshavebeenmadetoimproveBMC’sabil-
ity to prove the non-existence of a path. It is straightforward
to check for inductive invariants, since it only entails check-
ing for the existence of a transition from a state that satisfies
the invariant to one that does not. An extension of the induc-
tive approach has been presented in [SSS00], in which ter-
mination occurs as soon as the length of the path reaches the
length of the longest simple path from an initial state, or to
a target state. A recent paper [McM03] proposes the analysis
of the unsatisfiable formulae to allow termination when the
reverse sequential depth of the model is reached.
Early termination in BMC requires additional checks be-
yond the one for the existence of paths of certain lengths.
These checks translate into more clauses in the CNF formu-
laewhosesatisfiabilityhastobeestablished.Fortheapproach
of [SSS00], the number of extra clauses is quadratic in the
length of the path. As a result, it is not surprising that finding
counterexamples is slower than with pure BMC. The extra
cost, however, appears to be worth paying, since it increases
substantially the fraction of passing properties that can be
decided. Unfortunately, there remain instances for which the
additional termination tests are too expensive1. Consider the
model illustrated in Fig. 1. It has 2n+2 states, one of which is
initial (A). The n/2 states Dn/2,...,Dn−1are the (unreach-
able) target states. The longest simple path from the initial
state has length n + 1, while the longest simple path to a tar-
get state that does not visit any other target state has length
n/2; the reverse sequential depth of the model is also n/2.
Hence, the methods of [SSS00,McM03] will have to consider
1In [KS03] it was shown how to reduce the number of clauses to
O(k log2k). However, the extra clauses to enforce simple paths still
represent a significant hurdle for the SAT solvers.
α
β0
β1
δ0
δ1
γ
Fig. 2 Abstraction of the model of Fig. 1
paths of length n/2 before they can declare the target states
unreachable. By contrast, the forward sequential depth is 2.
Fig. 2 shows an abstraction of the model of Fig. 1. States
A, Bi, C, and Diare abstracted by α, β?2i/n?, γ, and δ?2i/n?,
respectively.Thetargetstateremainsunreachableinthismodel,
andtheforwardsequentialdepthisstill2;however,thelongest
simple path and the sequential depth are reduced. Though
in general there is no guarantee that abstraction will shorten
or even not lengthen the longest simple paths, or the short-
est paths, this example illustrates how abstraction may help
BMC, especially for passing properties.
Abstraction and BMC have been combined in more than
one recent work, especially in the context of abstraction re-
finement. In abstraction refinement [Kur94], one starts with
a coarse abstraction of the given, concrete model and keeps
refining it until the property is decided. For universal prop-
erties like the reachability properties that are the focus of
this article, this often means that the abstract models simu-
late the concrete one [Mil71], and that either the property is
shown to hold on an abstract model, or a counterexample is
found in the concrete one. In [WHL+01,CGKS02,CCK+02,
WLJ+03] BMC is used to check whether counterexamples
foundintheabstractmodelscanbeconcretized,thatis,whether
a counterexample can be found in the concrete model that
is mapped by the abstraction onto the abstract counterexam-
ple. The first three of these methods also analyze the failed
concretization test to guide the refinement. Therefore, they
represent instances of counterexample-guided abstraction re-
finement. On the other hand, [WLJ+03] analyzes the abstract
model to decide how to refine it. Yet another approach is the
one of [MA03], in which the abstract model is derived from
a failing BMC run on the concrete model. This reversal of
the customary order is attractive for those frequent cases in
which paths of moderate length can be easily checked on the
concrete model.
One common trait of the approaches to abstraction re-
finement mentioned so far is the application of a BDD-based
model checker to the abstract models, and of SAT solvers to
the concrete ones. By contrast, the objective of this article is
to explore what can be achieved with a SAT solver as the only
decision procedure in the abstraction refinement framework.
The rationale for combining BDDs and SAT is that each is
well-suited to the task assigned to it: The SAT solver is good
at checking the existence of a path of a given length in a
large model, whereas the BDD-based model checker is bet-

Page 3

Abstraction Refinement in Symbolic Model Checking Using Satisfiability as the Only Decision Procedure3
ter at proving the absence of certain paths, regardless of their
lengths, in a model of moderate size. This observation is cer-
tainly well motivated when one regards the models for which
abstraction refinement results have been reported in the liter-
ature; their sizes rarely exceed 1,000 binary state variables.
As the models grow larger, however, we expect an approach
purely based on SAT to become more competitive. Therefore,
our goal is to eventually be able to switch between BDD-
basedmodelcheckingandSAT-basedtechniquesfortheanal-
ysis of the concrete model. In this article we report on a sig-
nificant step in that direction by presenting an algorithm for
abstraction refinement that is purely based on SAT.
Our approach is similar to the ones discussed so far in
the fact that abstractions are obtained by removing part of the
state variables of the model; refinement then consists of rein-
statingsomeoftheremovedvariables.Thealgorithmhasfour
major components: the decision procedure for the abstract
model is the one of [SSS00], which has already been men-
tioned. The second component is the concretization test: as in
[BGG02], a gradual refinement approach tries to prove coun-
terexamples spurious without resort to the concrete model.
The third component—the choice of the refinement—makes
use of elements of [WLJ+03], [MA03], and [CCK+02]. Like
the first two, it addresses all the abstract counterexamples of a
certain length at once; like the last two, it analyzes the proof
of non-existence of counterexamples of a certain length to
derive a set of candidate state variables from which the ones
that will be added to the abstract model are chosen. Finally,
the fourth component is a heuristic procedure for abstraction
minimization. This minimization is quite important in our
approach, because the simultaneous elimination of all spu-
rious counterexamples of a certain length tends to generate
large sets of candidate variables. Our experimental evalua-
tion of the SAT-based abstraction refinement algorithm com-
pared it to both BMC (with and without termination checks
for passing properties) and to the best abstraction refinement
algorithm available to us [WLJ+03]. The results, discussed
in Section 5, show that the new approach, though not uni-
formly superior, is more robust than the others, and is espe-
cially promising for the more challenging problems.
2 Preliminaries
2.1 Open Systems
Let V = {v1,...,vn} and W = {w1,...,wm} be sets of
Boolean variables. We designate by V?the set {v?
consisting of the primed version of the elements of V , and by
Vithe set {vi
open system is a 4-tuple
1,...,v?
n}
1,...,vi
n}. Likewise, Wi= {wi
1,...,wi
m}. An
?V,W,I,T? ,
where V is the set of (current) state variables, W is the set
of combinational variables, I(V ) is the initial state predicate,
and T(V,W,V?) is the transition relation. The variables in V?
w3
w1
v?
1
v1
w2
v?
2
v2
Fig. 3 A sequential circuit defining an open system with n = 2 and
m = 3. The rectangles represent binary state elements
arethenextstatevariables.Allsetsarefinite,andallvariables
range over finite domains.
We assume that T(V,W,V?) is given by a circuit graph,
that is, by a labeled graph C = (V ∪W,E) such that m ≥ n,
node vi∈ V is labeled by wi∈ W, node wi∈ W is labeled
by a Boolean formula Ti= wi↔ δi(V,W), (wi,vi) ∈ E for
i ∈ {1,...,n}, and, for x ∈ V ∪ W, wi∈ W, (x,wi) ∈ E
iff x appears in δi. The transition relation is then defined by:
?
In a sequential circuit, the variables in W are associated with
the primary inputs and the outputs of the combinational logic
gates of the circuit; the variables in V are associated with the
memory elements. Each Tiis called a gate relation because
it usually describes the behavior of a logic gate. For instance,
if wiis the output variable of a two-input AND gate with
inputs wjand vk, then Ti= wi↔ (wj∧vk). If, on the other
hand, wiis a primary input to the circuit, then Ti= 1. Each
term of the form v?
combinational variable. (The output of the gate feeding the
i-th memory element.)
A state variable vjis said to be in the direct support of
variable vi(wi) if vjis connected to vi(wi) by a path in C
that goes through nodes in W (logic gates) only. Variable vj
is in the cone of influence (COI) of vi(wi) if there is a path
(of any kind) connecting vjto vi(wi) in C.
Example 1 Figure 3 shows a simple sequential circuit with
two state variables. The transition relation (1) is given by
T(V,W,V?) =
1≤i≤n
(v?
i↔ wi) ∧
?
1≤i≤m
Ti(W,V ) . (1)
i↔ wiequates a next state variable to a
T(V,W,V?) = (v?
1↔ w1)∧(v?
2↔ w2)∧(w2↔ (w3∧v1)) .
Note that T1 = T3 = true. If the only initial state of the
circuit is v1= 0,v2= 0, then I(V ) = ¬v1∧ ¬v2. Variable
v1is in the direct support of w2, and in the COI of v2.
? ?
2.2 Proving Safety Properties
An open system Ω defines a labeled transition structure in the
usual way, with states QΩcorresponding to the valuations of
the variables in V , and transition labels corresponding to the
valuations of the variables in W. Conversely, a set of states
S ⊆ QΩcorrespondstoapredicateS(V )orS(V?).Predicate
S(V ) (S(V?)) is the characteristic function of S expressed in
terms of the current (next) state variables. State q ∈ QΩis an
initial state if it satisfies I(V ). State set S ⊆ QΩis reachable

Page 4

4Bing Li et al.
from state set S?in k steps if there is a path of length k in the
labeled transition structure defined by Ω that connects some
state in S?to some state in S; equivalently if
?
is satisfiable. State set S is reachable from S?if there exists
k ∈ N such that S is reachable in k steps from S?. A state set
is reachable (in k steps) if it is reachable (in k steps) from I.
When no confusion arises we shall identify a state q ∈ QΩ
with the set {q}. A finite (infinite) sequence of states ρ ∈ Q∗
(∈ Qω
and every other state is reachable from its predecessor in one
step. The set of all possible runs of Ω is the language of Ω,
denoted by L(Ω).
A linear-time safety property P of Ω is a subset of Qω
such that any infinite sequence over QΩnot in P has a finite
prefix that cannot be extended to a sequence in P [AS85].
Open system Ω satisfies safety property P if L(Ω) ⊆ P.
Checking the satisfaction of an ω-regular safety property P
by an open system Ω can be reduced to the reachability prob-
lem by composing Ω with an automaton APthat accepts the
inextensible prefixes of the sequences not in P. The property
is satisfied by the open system if no state of the composition
Ω ? AP that projects on an accepting state of AP is reach-
able. In the sequel we restrict ourselves to ω-regular safety
properties, and assume that the given open system already in-
corporates the property automaton. This assumption allows
us to identify the property with a set of states of the system,
which we also denote by P. Hence, property P is satisfied by
Ω if there is no k ∈ N such that
I(V0) ∧
1≤i≤k
is satisfiable. An invariant is a safety property that states that
a certain predicate holds of all reachable states of Ω. In this
case P is the set of states that satisfy that predicate.
S?(V0) ∧
1≤i≤k
T(Vi−1,Wi,Vi) ∧ S(Vk)
(2)
Ω
Ω) is a finite (infinite) run of Ω if the first state is initial,
Ω
?
T(Vi−1,Wi,Vi) ∧ ¬P(Vk)
(3)
Example 2 ContinuingExample1,supposethatP(V ) = ¬v2.
Then a counterexample of length 2 to P can be found by solv-
ing
¬v0
1∧ ¬v0
2∧ (v1
(w1
1↔ w1
2↔ (w1
(v2
1) ∧ (v1
3∧ v0
2↔ w2
2↔ w1
1)) ∧ (v2
2) ∧ (w2
2)∧
1↔ w2
2↔ (w2
1)∧
3∧ v1
1)) ∧ v2
2.
A satisfying assignment for this formula is
¬v0
The value of w1
1∧¬v0
2∧w1
1∧¬w1
3is irrelevant.
2∧v1
1∧¬v1
2∧w2
? ?
1∧w2
2∧w2
3∧v2
1∧v2
2.
The search for a k such that (3) is satisfiable can obvi-
ously be restricted to the range {0,...,|QΩ| − 1}. Hence,
in theory, the process is guaranteed to terminate. In practice,
the number of states is too large to be of any practical use,
and tighter upper bounds for k are sought. In model checking
approaches that are based on fixpoint computations [McM94,
ABE00,WBCG00,McM02], the maximum value of k is pro-
vided by the number of iterations needed to reach conver-
gence. On the other hand, for algorithms that directly check
the satisfiability of (3), the diameter of the graph [BCCZ99]
or bounds obtained from the structure of the hardware model
have been proposed [BKA02]. Here we summarize a method
proposed in [SSS00] that is of particular interest to us.
A simple path is one that visits a state at most once. If
some state in ¬P is reachable, there must exist a simple path
from an initial state to it that does not go through any other
states in I or ¬P. Hence, if no simple path of length k exists
such that its first state is initial and no other state is initial,
or such that its final state is in ¬P and no other state is in
¬P, then, there is no path of length greater than or equal to k
connecting a state in I to a state in ¬P. If in addition, there
is no path of length less than k connecting I to ¬P, then
Ω |= P.TwosetsofstatesS?andS areconnectedbyasimple
path of length k in Ω if
?
∧ S(Vk) ∧
0≤j<i≤k
issatisfiable.Checkingthetwoconditionsabovethenamounts
to checking that either of the following formulae is unsatisfi-
able:
Σk(S?,S) = S?(V0) ∧
1≤i≤k
T(Vi−1,Wi,Vi)
??
1≤l≤n
(vi
l?= vj
l)
(4)
Σk(I,Q) ∧
?
?
0<i≤k
¬I(Vi)
(5)
Σk(Q,¬P) ∧
0≤i<k
P(Vi) .
(6)
Note that the predicate corresponding to the set Q is true.
2.3 Abstraction Refinement
Abstractinterpretation[CC77]providesaveryflexibleframe-
work for the description of abstraction. In this article, how-
ever, we consider the following restricted definition. Open
system? Ω = ??V ,?
–?
–?I(?V ) = ∃(V \?V ).I(V );
∃(V?\?V?).T(V,W,V?).
This definition entails that? Ω simulates [Mil71] Ω. Hence,
abstraction of property P with respect to? Ω if?P(?V ) = ∀(V \
models)?P, then Ω satisfies P. That is,
W,?I,?T? is an abstraction of Ω if
W1∪ (V \?V );
–?T(?V ,?
(Note that wiis the combinational variable associated to v?
–?V ⊆ V ;
–?
W =?
W1⊆ W such that vi∈?V implies wi∈?
W,?V?) = ∃(V \?V ).∃(W \?
W;
W).
i.)
every run of Ω has a matching run in? Ω. Property?P is the
?V ).P(V ). If P is an ω-regular property and? Ω satisfies (or
? Ω |=?P → Ω |= P .
(7)

Page 5

Abstraction Refinement in Symbolic Model Checking Using Satisfiability as the Only Decision Procedure5
This preservation result is the basis for the following abstrac-
tion refinement approach to the verification of P. One starts
with a coarse abstraction? Ω0 of the concrete open system
Ω |= P; otherwise, there exists a least k?∈ N such that
?I(?V0) ∧
issatisfiable.Thesatisfyingassignmentsto(8)aretheshortest-
length abstract counterexamples (ACEs). If? Ω0 ?|=?P0one
checks whether (3) has solutions that agree with the ACE(s)
beingchecked.Becauseoftheadditionalconstraintsprovided
by the ACEs, a concretization test is often less expensive that
the satisfiability check of (3). However, its failure only indi-
cates that the abstract error traces are spurious. Therefore, if
the concretization test fails, one chooses a refined abstraction
? Ω1and repeats the process, until one of these cases occurs.
2. The concretization test passes for some i, in which case
it is concluded that Ω ?|= P and the satisfying assignment
found is returned as counterexample to P.
3. The refinement eventually produces? Ωi = Ω. In this fi-
checkingquestionconclusively.Thisisanundesirableout-
come because the purpose of abstraction is defeated.
Ω and checks whether? Ω0 |=?P0. If that is the case, then
?
1≤i≤k?
T(?Vi−1,?
Wi,?Vi) ∧ ¬?P(?Vk?)
(8)
or more ACEs are checked for concretization. That is, one
1.? Ωi|=?Pifor some i, in which case Ω |= P is inferred.
nal case, the satisfiability check of (8) answers the model
When the refinement? Ωi+1of? Ωiis chosen with the help of
talks of counterexample-guided abstraction refinement.
The cone of influence (direct support) of a property is the
union of the cones of influence (direct supports) of all the
variables mentioned in the predicate that defines the property.
Cone-of-influencereductionreferstothe abstraction in which
?V is the COI of the property. It is commonly applied before
? Ω |=?P ↔ Ω |= P .
Example 3 For the circuit of Fig. 3, consider the following
abstraction? Ω:
–?
–?T(?V ,?
a counterexample of length 1 exists in? Ω by solving
¬v0
The only satisfying assignment is ¬v0
Note that this ACE cannot be concretized because v0
be set to 1 in the concrete model. After refinement adds v1to
?V ,? Ω = Ω. The counterexample found in Example 2 there-
the information provided by the failed concretization test, one
any model checking is attempted, because it satisfies
(9)
–?V = {v2};
–?I(?V ) = ¬v2;
Suppose P(V ) =?P(?V ) = ¬v2. Then from (8) one finds that
2∧ (v1
W = {w2,w3,v1};
W,?V?) = (v?
2↔ w2) ∧ (w2↔ (w3∧ v1).
2↔ w1
2) ∧ (w1
2↔ (w1
3∧ v1
1)) ∧ v1
2.
2∧ w1
2∧ w1
3∧ v1
1∧ v1
1cannot
2.
fore shows that Ω ?|= P.
? ?
2.4 Satisfiability Solvers
Many modern SAT solvers are based on clause recording.
Whenever they detect a conflicting assignment to a formula f
(one that causes f to evaluate to false), they conjoin a conflict
clause to f. The new clause prevents the solver from attempt-
ing the same assignment again. It may also exclude from fu-
ture consideration other parts of the search space that can be
inferred to contain no satisfying assignments. Such inference
is based on the analysis of the so-called implication graph,
which shows which decisions and clauses are responsible for
the conflict. A SAT solver maintains the implication graph
by recording, for each assignment, the level at which it was
made2, whether it was a decision, and if not, the clause that
implied it. When a conflict is detected, a cut separating the
sink of the implication graph from the sources identifies a set
of assignments sufficient to cause the conflict. The disjunc-
tion of the negation of those assignments is a conflict clause.
The clauses that make up the edges of an implication
graph between the cut and the sink can be used to explain
the conflict clause deduced from it. When using a SAT solver
in model checking based on abstraction refinement, there are
two important reasons to keep track of the explanations of
conflict clauses. The first reason is the ability to identify an
unsatisfiable core [GN03,ZM03] of the given formula when
it is indeed unsatisfiable. This can be done by recursively
replacing conflict clauses with those appearing between the
chosen cut and the sink in the implication graphs that pro-
duced them. The process starts from the final conflict clause
and terminates when only clauses of the original formula are
left. When the check for existence of counterexamples of a
certain length fails, the unsatisfiable core produced by the
SAT solver can be used to guide the refinement of the abstract
model.
The second reason to preserve the mapping between con-
flict clauses and the edges of their implication graphs is to
helpintheincrementalsolutionofsequencesofSATinstances
[WKS01,ES03]. If f and f?are two CNF formulae, and γ is
a conflict clause of f, then γ is also a conflict clause of f?
if f?contains all the clauses of f in the implication graph
for γ up to the cut that identifies γ. Therefore, if f?is ob-
tained by slight modification of f, many conflict clauses de-
rived in checking the satisfiability of f may be added to f?
inexpensively if their “explanations” in terms of clauses of f
are saved. As a special case, if f?contains all the clauses of
f, then all conflict clauses deduced while checking the sat-
isfiability of f are also valid for f?. Sequences of closely re-
lated SAT instances are found in our algorithm for abstraction
refinement. They are discussed in Section 3.4 together with
the exploitation of inherited conflict clauses to speed up SAT
checking.
2The level starts from 0; it is incremented at every new decision;
and it decreases when the algorithm backtracks.