Essence
Theoretic
LatticeThe-

Of Property Directed
9.2

taylori
Kohei
23

Natsuki Urabe? Shin yaand Ichiro Has no!
-,Sinenaga

Katsu mata?

".

Graduate University for Advanced
National Institute of Informatics

1 The

Reachability Analysis

studies (SOKEIVDAI)

Kyoto University

7th Aug'in

CAV 22

?1 N2i
Knaster-

Tarski

KleenepropertydirectedReachab.li#CPDR)Model Checking Algorithm

verify safety problems
known for its performanceTo•of state transition systems.

.

hardware verification [Bradley VMCAZ ]'-",Used in Spacer [H◦der+ Cavil] as part of 2- 3 [MouraB. TACAS 'o8]

-,

•many
1.

Ivariants :/ PDR [Bradley

VMCAI'll ]ReÑ_PDRfbPDR
original one

2.

.

,

:

[Eent FMCAD 'D.

.

[Seufert & Scholl DATE 48.19 ].

search direction is reversed
3.

PIE [Baat cairo]

Model checking:.

probabilistic extension:).

) MPPs.

checking
Kripke structures

Model€☐

②→za

¥0.33

2

0tibE Mathematical Abstraction of PDR:

t-PDRID-knaster.
la#i&kleene#Our⑦
Lattice-Theoreticalalgorithm

abstraction /Essence Combination of\:② Instantiatedfory-f.intheoryuIC31PDInstan)Ins Instance'sfor Kripke structures¥④→← →ᵈfor Markov

for MarkovDecision

RewardProcesses

Models?⃝3

ou-line-1.LT-••

PDR-lattice-theoretic essences

Positive & Negative
LT PDR
--let these

2. Instances of LT PDR-

3.

help each otherfor quantitative model

checking

Categorical classification of PDR variants

4. From mathematical abstraction
5. Experiments

To

programming abstraction.

overviewoft-PDR-Nega-i.ve
Side

PositiveThin ( Kleene )Thin ( Knaster Tarski ).

-.

Prefixed points form a complete lattice

There exists ✗ se.

.

f-✗ ≤ ✗ ≤ ✗helpeach✗ ≤ ✗ fse.

MFU FI=NEINrF&✗

mF≤ ✗◦

Side".

other( Ci≤ ✗n f- ✗ n ,--- --.

.

Cny )

s.t.ci-i-FCi.cn

F✗iEXi+i and ✗n→≤✗verifies

F1$✗

There exists n.seµF≤?✗

refutes-142g

ou-line-1.LT-••

PDR-lattice-theoretic essences

Positive & Negative
LT PDR
--let these

2. Instances of LT PDR-3.

help each otherfor quantitative modelchecking

Categorical classification of PDR variants4. From mathematical abstraction
5. Experiments

To

programming abstraction.

Overviewoftttdl, µµ

POSiTiveLT_PDRaims To- - -game ,verify µF≤ ✗gym¢, µµ"✗se( Ci✗n→≤✗S t-.

- ".

.

Cny )

Citi ≤ Fci.

Cut # ✗

Tofindth
It's.

.

≤-_Éadidates of ×✗◦ ≤ ✗ i. Xz ≤ff"t!
-Fit ≤ ×".

stabilized.

easiertof.net#( Positive LTPDR )(Ex ) and check Fxi ≤ ✗i-n.EE#fatetEFtE--accelerates'--.

•F1$✗

Invariant_Construct.

F✗≤ ✗ C- ✗.

.

•There exists n.se

helpThis partki Fid ≤ ✗( Naively ) Because f-✗≤ ✗"1≤≤Ftand check F
construct
FL ≤-f-✗ ≤ ✗ ≤ ✗"≤ ✗it ,How To search for ✗ ?
-rF&✗

.

EXn-F-Xn-is-e.fi
and,There exists

FI=eachother◦( knaster Tarski )mF≤ ✗.

MF.

,

✗ ≤⇐.

-.

-There exists ✗ se,* ,*""aster Tarski )Prefixed points form a complete lattice'Thm

Negative side

Positive sideIt

Preemptively inflate and shrink if necessary

the search.

.

5

overviewoft.PT#ThispaµegativeLT-PDR_"a;a. "aeene >÷Prefixed points form a complete lattice

There exists ✗ se---refute MF ≤ ✗from Kleene -1hm

aims toComes

◦

5- e-

There exists ns.t.FI $ ✗There exists hic

seThere exists n.se.

F1$✗"her( Ci✗n .
.

and ✗n→≤✗S t-µFE?✗.

- ".

.

Cny )

Citi ≤ Fci.

Cut # ✗

refutesandLT-ppRÑaHeC

4- ✗Unsafe.

unsafe

2.

Pick

2.

Construct.

help£.

CE FI.

How to search for C ? ( in Negative3f-✗ ≤ ✗ ≤ ✗counterexample.

.

,FI=rF&✗.

verifies.

Thin ( Kleene )seF✗i≤ ✗itMF.

""✗ ≤ ⇐ ÷×.

'mF$✗

Negative Side

Positive SideCie

Ci Citi.

FI

If co =L- ".

.

] Cn]

CuCi*≤FiI
then

try to prove

ÉE.

. .

Cus -1-1( teachable )!-by backtracking

Cn is the one( Let's hope this is the case.

. .

)

6

ou-line-1.LT-

••

PDR-

lattice-theoretic essences

Positive & Negative
LT PDR--let these

2. Instances of LT PDR-3.

help each otherfor quantitative model

checking

Categorical classification of PDR variants

4. From mathematical abstraction
5. Experiments

To

programming abstraction.

-overviewofLT-PDRPosit.ve

Negative SideThin ( knas-ier-Ta.sk:)

Thin ( Kleene )⇐* .µµPSide.

.

Prefixed points form a complete lattice-MF.

Combination of Positive & Negative ones

helping each other✗◦ ≤.

_E.

an.

.

There exists n.se.

F1$✗"herca: - . .ca ).

-Citi ≤ Fci.

.

Cut # ✗µFE?✗
This partrefutes-Negative sideXn-1

lattice theoretic

help

shrinking overly inflated ✗→-÷✗nverifies( Ciproposition.

.

willtells co =Lbyf-✗ ≤ ✗ ≤ ✗s t.

hPositive side.

""

✗◦,

¥µF%

rF&✗

rF≤ ✗

There exists ✗ se=- -.

Cn 1)

never-

happen:7

ou-line-1.LT-

••

PDR-

lattice-theoretic essences

Positive & NegativeLT PDR--

let these

2. Instances of LT PDR-

3.

help each otherfor quantitative model

checking

Categorical classification of PDR variants

4. From mathematical abstraction
5. Experiments

Toprogramming abstraction.

IÉTPDR.

,,

Markov Decision Processes→" " ""⑤" " " " ""=§l→{Similar To

Ids -81511467'"PRI☐

lattice.

Theoretical→%ñi→Fe

abstraction //"•foryf-IQ.nl② Instantiate

theoryu

if SEX.

CBa-iz-i.CAV20]

beforereturning False
but our instance does not,.

for Kripke structures

F←

Markov Reward;÷, ( {RIC} needs additional check?⃝⑦

IC31PDInstan€]Ins Instance's

yngyana.gg

Maxµ,Mathematical Abstraction

RewardDecision→ᵈModels

Models→for Markovfor Markov.

0-3%0hewM"" " " "
=s →/

":"

hew -2']

tewcsl-2-dlsi.scs.si) ifs c- ✗SES0New PDR variant

otherwisefor MRM.

8

0u-line-1.LT-

••

PDR-

lattice-theoretic essences

Positive & Negative
LT PDR--let these

2. Instances of LFPDR
3.

help each otherfor quantitative model

checking

Categorical classification of PDR variant's

4. From mathematical abstraction
5. Experiments

To

programming abstraction

.

LT-

PAR

Dynamical systems

forfibration ofpredicatesa.
{C E"EasF

pullback/along dynamics',"LEsÉsiépredicaee
liftingP"

categorical

A

frmwk
-Coalgebras
as-IB

↳

9Cat

S 8- GS.

sets

If& functors& dynas,foragyg

JacobsI.
_,.

Fibration s

predicates[ Benabou.

.

.

[ Rutten✓G

dyn Sys.

Jacobs

.

.

.

.

,

Coatgebna

9I

UnifyingofView

Bwd FDR(uxcix✗ a.

ifEs

←

;

( Tx ) "( noG's?

S-8

GS>

c-✓

≤IBG

Es É Eas
7-.

F'involution

InkEas

LG

if E?

EsE-?

≤VariousPDR

tuk◦exInuBird.

Reverse PDR-,Scholl ,.

,Junger

-I-,.

.

.

IFwd

[ Bradleyfb PPR[ SeufertPr 2C }[ Batz.

✗--[ Seufert≤?

. :¥#PDF-LV

tis 8*x)

7L

.

tis,

Scholl /a--

7--,

F-eh,

.

.

.

I

Unlikely for 1417ps/0ou-line-1.LT-

••

PDR

-

lattice-theoretic essences

Positive & Negative
LT PDR
--let these

2. Instances of LT PDR-

3.

help each otherfor quantitative modelchecking

Categorical classification of PDR variants

4. From mathematical abstraction
5. Experiments

To

programming abstraction.

Mathematical Abstractionµ,.µ,%i¥E"Ee
programmingAbs-raction-ia-i-i.ieabstraction⑦.

Theoretical÷:

We caniii.

get instances of LT PDR by small efforts

Lattice-/"" """.

abstraction

900 lines~~( C++ )

#lineslives

theoryu""" """"

"Decision.

reward,*v50 lines② Instantiate

IC31PDInstan]Ins Instance's

G¥iÉ%i+-foryf-EI.nl:*. . """"

atethe theory✓

t.cm#TEEiT---FEEE7Lx7
for Kripke structures

Instance 3for Markovfor MarkovDecision

RewardProcesses

Models11

ou-line-1.LT-

••

PDR-

lattice-theoretic essences

Positive & Negative
LT PDR
--let these

2. Instances of LT PDR-

3.

help each otherfor quantitative model

checking

Categorical classification of PDR variants

4. From mathematical abstraction
5. Experiments

To

programming abstraction.

Programming Abstractionµ,-|=✗PlfiM@U

é÷÷:→Haskeac◦de◦fLFPDR#taggingµabstraction #a~,900 lines→◦ lines~lines

hes( C++ )" " """ "" ""

Instantiatetheorylives

T.cm#7EEiT---iFEEHEnx::T-H
for Kripke structures

for Markov

Decisionfor Markov
RewardModelsi÷÷!¥÷÷!÷÷÷÷: ""IKripke structure,PDRMDP

MDPSrefRIC}[Bat -2-1 Ear'2◦],

Observations§machinewith 16GB memory

Intel Core i ?
with 10GB
memory using Docker
1.2GHz Quad-core.

:

especially given that the coding effort is minimal
12

RTsComparison

TO

Programming Abstractionµµµµ µµµ,µ,[C } f @ f

é÷÷:%.ae#.a,,HaskeacoeeofLt-ppI-*end%deabstraction
natives

Lattice*( https://githwb.com/arbrad/IC3ref)" " ""-Tanti ate→◦ lines

Marines

the theorylinesaol.us( C++ )

T.cm#TEEiT---FEEHEE:THDecision

RewardProcesses

ModelsBenchmarks
HWIUCC't competition:

1-TO :I

Our own

600sec( latch0PDRFIref outperforms

Potential improvement:

ourUsetoy solver( https://gi-hub.com/msakai/-oysoluer )uses

PDRFK!

compatibility

generalization technicals used in EC3vef

Use another SAT Solver-).

for Haskell

Icounter.

refuses 2-3
",.

.

13

Results

Comparison

To

Programming Abstraction

PFIC}[ Bat -2-17

CAV 20]'.

µG¥i¥i, Haskeac◦de◦fLt-pDIµlattice*.

" " " ""

~Instantiate→◦ lines

abstraction

900 lines

lines

hestheorylives( C++ )

t.cm#7E-aeieFT---FEE*HL%5FH
for Kripke structures

for Markov

for Markov

Benchmarks are from [ Bat
TO 600sec#"" ".

Decision

RewardProcesses

Models-2-1.

CAVED.

:.

PrIC3 uses 2-3
PDRMDP uses GLPKNo clear comparison
Potential improvement••

express MPPs
use.

Ours

areoften better with smaller benchmarks:

symbolically.

other (so called) generalization-.

( linearpolynomial / hybrid )1¢Conclusions
LT PDR :•-.

--•

lattice theoretic abstraction of PDR-

Essence of PDR

ingenious combination of KT & Kleene theorem
Gives many instances for qualitative & quantitative systems
:.

.

.

Generic implementation of LT PDR--.

Haskellin.

Easily obtained instances have at least reasonable performance-.

Futurework••

Relation To

Abstract Interpretation

Get instances for other systems.

( e.g. hybrid systems [suenaga-s.u-mc-n-is.io] )15