SAT-based verification: underlying methods

1. SAT-based verification: underlying methods Mary Sheeran Chalmers University of Technology and Prover Technology AB

2. Synchronous Observer ok Program Obs

7. I B

8. B I

9. I B

10. I B

11. i I B Satisfying a formula I(s0) and path([s0..si]) and B(si)

12. I B I B I B I B

13. If system is bad • Finds a shortest countermodel • Error trace for debugging

14. I But when can we stop? when i contradictory?

15. I Not quite, but when i loop-free contradictory

16. And symmetrically when loop-free B contradictory

17. I i I B Algorithm 1 i:= 0 i i if not Sat or not Sat B then return True then return error trace if Sat i := i+1 ;

18. I i I B Tighten termination (Alg. 2) i:= 0 i i if not Sat or not Sat all (not I) all (not B) B then return True then return error trace if Sat i := i+1 ;

19. Avoid iteration from zero (Alg. 3) i := some constant which can be greater than zero i not (all P) then return error trace if Sat I i+1 i+1 if not Sat or not Sat I all (not I) all (not B) B then return True i:= i+1

20. Base I

21. Base I

22. Step

23. Step

24. Base B

25. Base B

26. Step

27. Step

28. Complete method i := some constant which can be greater than zero i not (all P) then return error trace if Sat I i+1 i+1 if not Sat or not Sat I all (not I) all (not B) B then return True i:= i+1

29. Strengthen i := some constant which can be greater than zero i not (all P) then return error trace if Sat I i+1 i+1 if not Sat or not Sat I all (not I) all (not B) B then return True i:= i+1

30. Another way to strengthen • Invent a lemma, L(s) that we believe to hold in the reachable states • Prove Q(s) = P(s) and L(s) • If both P and L hold in the reachable states, this can reduce induction depth

31. Choosing lemmas? • Domain knowledge • Analysis of the program • Strongest possibility is the characterization of the reachable states • Van Eijk’s method uses relations between signals as lemmas

32. Reachability analysis • Standard approach to safety property verification using Binary Decision Diagrams (BDDs) • Generate larger and larger subset of the reachable states. Stop when no new states added • Check whether intersects with bad states

33. Reachability analysis • Standard algorithms can be adapted to use a SAT-solver. • Need to be able to deal with quantifiers in a way that doesn’t just blow up • A fascinating research area!

34. References (bounded model checking) • A. Biere, A. Cimatti, E.M. Clarke, M. Fujita and Y. Zhu. Symbolic model checking using SAT procedures instead of BDDs. In Proc. 36th Design Automation Conference, 1999. • P. Bjesse, T. Leonard and A. Mokkedem. Finding bugs in an Alpha microprocessor using satisfiability solvers. In Proc. 13th Int. Conf. On Computer Aided Verification, 2001.

35. References (induction with SAT-solvers) • M. Sheeran, S. Singh and G. Stålmarck. Checking safety properties using induction and a SAT-solver. In Proc. 3rd Int. Conf. On Formal Methods in Computer Aided Design, LNCS, Springer Verlag, 2000. • P. Bjesse and K. Claessen. SAT-based verification without state space traversal. In Proc. 3rd Int. Conf. On Formal Methods in Computer Aided Design, LNCS, Springer Verlag, 2000.

36. References (SAT-based reachability analysis) • P. A. Abdulla, P. Bjesse and N. Een. Symbolic reachability analysis based on SAT-solvers. In Proc. TACAS’00. • P. F. Williams, A. Biere, E. M. Clarke and A. Gupta. Combining decision diagrams and SAT procedures for efficient symbolic model checking. In CAV’00. • A. Gupta, Z. Yang and P. Ashar, SAT-based image computation with application in reachability analysis for verification. In FMCAD’00.

37. SAT

38. BMC IND SAT RA … ARITH

39. The future? • Increasingly powerful proof engines • Integration in system development tools • Combining different engines or methods (for example BDDs and SAT or interactive and automatic methods) • Use of formal methods in test pattern generation