SAT Based Abstraction-Refinement Using ILP and Machine Learning Techniques

ion-Refinement 1. Generate an initial abstraction function h. 2. Build abstract machine M̂ based on h. Model check M̂ . If M̂ |= φ, then M |= φ. Return TRUE. 3. If M̂ 6|= φ, check the counterexample on the concrete model. If the counterexample is real, M 6|= φ. Return FALSE. 4. Refine h, and go to step 2. SAT based Abstraction-Refinement using ILP and Machine Learning Techniques 13 Abstraction Function • Partition variables V into visible(V) and invisible(I) variables. V = {v1, . . . , vk}. • The partitioning defines our abstraction function h : S → Ŝ. The set of abstract states is Ŝ = Dv1 × · · · ×Dvk and the abstraction functions is h(s) = (s(v1) . . . s(vk)) x1 x2 x3 x4 0 0 0 0 0 0 1 0 0 0 1 1 0 0 0 1 } 0 0 x1 x2 • Refinement : Move variables from I to V. SAT based Abstraction-Refinement using ILP and Machine Learning Techniques 14 Building Abstract Model M̂ can be computed efficiently if R is in functional form, e.g. sequential circuits. R(s, s′) = ∃i( ∧m j=1 x ′ j = fxj(s, i)) R̂(ŝ, ŝ′) = ∃sI∃i( ∧ xj∈V x̂ ′ j = fxj(ŝ, s I, i)) i1 i2 i3 x6 x1 x2 x5 x3 x4 i1 i2 i3 x3 x4 x5 x6 x1 x2 SAT based Abstraction-Refinement using ILP and Machine Learning Techniques 15 Checking the Counterexample • Counterexample : 〈ŝ1, ŝ2, . . . ŝm〉 • Set of concrete paths for counterexample : ψm = {〈s1 . . . sm〉 | I(s1) ∧ m−1 ∧ i=1 R(si, si+1) ∧ m ∧ i=1 h(si) = ŝi} • The right-most conjunct is a restriction of the visible variables to their values in the counterexample. • Counterexample is spurious ⇐⇒ ψm is empty. • Solve ψm with a SAT solver. SAT based Abstraction-Refinement using ILP and Machine Learning Techniques 16 Checking the Counterexample • Similar to BMC formulas, except – Path restricted to counterexample. – Also restrict values of (original) inputs that are assigned by counterexample. • If ψm is satisfiable we found a real bug. • If ψm is unsatisfiable, refine. SAT based Abstraction-Refinement using ILP and Machine Learning Techniques 17 Refinement • Find largest index f (failure index), f < m such that ψf is satisfiable. • The set D of all states df such that there is a concrete path 〈d1...df〉 in ψf is called the set of deadend states. Trace