5.3 Towards Property Directed Reachability
5.3.1 Monotone layers
The main difference between Reach and PDR, which is also the only difference in the core of the algorithms, is an extra condition that PDR imposes on the layers. PDR re- quires that its layers are monotone or, more precisely, linearly ordered by set inclusion.
While this immediately entails a theoretical improvement of the algorithm’s time com- plexity upper bound, namely from doubly to singly exponential, its observed practical performance, as we later show, actually deteriorates. The monotone layers, however, subsequently motivate and enable three independent enhancements of the algorithm, whose practical benefits are significant. In this sense, PDR can be understood as Reach enhanced.
We will now set out to show how to keep the layers monotone by just a slight change in the usual update of the layers that happens after an unsuccessful extension. To keep our exposition simple and also to conform with the standard presentation of PDR, we will only consider a single sequence of sets of clauses L0, L1, . . . (corresponding to the
proper layers of Reach). Thus we will here ignore the possibility of using the dependency tracking technique for the discovery of universal clauses. Omitting this optimization does not influence correctness of the algorithms in any way.8
Unsuccessful extensions in Reach and PDR
Let us recapitulate (taking into account the simplified treatment of layers) that the extension query for a state s lying in a position i steps from the goal asks whether there is a successor of s with respect to the transition formula T that satisfies the clauses of layer Li−1. Formally, the query is expressed by the formula
SAT ?[ Lits(s)∧ T ∧ (Li−1)0]. (5.10)
An unsuccessful extension occurs when no such successor exists and the formula (5.10) is unsatisfiable. In that case, we expect our SAT solver to return a sub-cube r⊆ Lits(s) of those assumptions Lits(s) that were actually used in the unsatisfiability proof. Let us give this cube r a name and call it a reason for the unsuccessful extension. This notion will become useful mainly later on. As we know from Section 3.2.1, by complementing the reason cube we obtain a corresponding explaining clause C =∼r = {∼l | l ∈ r}. It follows that this clause is a property of the preimage (with respect to T ) of set of states represented by Li−1:
T∧ (Li−1)0|= C (5.11)
and that the state s fails to satisfy the clause: s6|= C.
Now, in Reach we insert the explaining clause C into layer Li and backtrack over the
state s to look for a different state that additionally satisfies C. The main difference in PDR is that we insert the new clause into all the layers L0, . . . , Li. This is all that is
needed to ensure monotonicity. However, to maintain overall correctness of the algorithm we must additionally require that the explaining clause C does not rule out any goal state or, in symbols, that G⇒ C. We will discuss in detail how to satisfy this weaker-than-goal requirement after formally stating PDR’s main invariants.
8
Two further remarks are in order. First, with the monotonicity condition imposed in PDR there is no need to organize the universal clauses in separate layers (like in Reach) and we can store them just in one universal set U (cf. the set F∞ in the presentation of E´en et al., 2011, Section IV). Second, although dependency tracking is not explicitly shown in Pseudocode 5.5, our implementation of PDR does use the technique and so its effects are reflected in the reported experiments.
Layer invariants in PDR
At any moment during the run of the algorithm the layers in PDR satisfy the following three properties:
1) L0 is equivalent to G,
2) Lj+1⊆ Lj and thus Lj ⇒ Lj+1 for any j≥ 0,
3) (Lj)0∧ T ⇒ Lj+1 for any j≥ 0.
Invariant 1) generalizes a similar claim from Reach, where L0 is initialized by the goal
clauses G and then remains constant during the whole subsequent computation. Since PDR inserts explaining clauses even to L0, it relies on the mentioned weaker-than-goal
requirement (details still further below) to keep 1) valid.
Invariant 2) is the discussed monotonicity of layers, which distinguishes PDR from Reach. It is satisfied at the beginning of the algorithm’s run, because PDR initializes all the layers except L0 to be empty, and it is also preserved when a new explaining
clause is derived, as the algorithm inserts the clause to all the layers L0, . . . , Li for some
i. Notice that it follows from monotonicity that when a layer repetition occurs in PDR, it must be between two neighboring layers, i.e., Lj = Lj+1 for some j.
Finally, invariant 3), which PDR shares with Reach, informally states that the layer Lj+1over-approximates the preimage (with respect to T ) of layer Lj. The key to showing
preservation of invariant 3) is property (5.11) of explaining clauses. The preservation is immediate in Reach, where the new explaining clauses C is added just to Li. In
PDR, where the clause is added to L0, . . . , Li, we combine the same argument with
monotonicity of layers (in particular, we use the fact that Lj ⇒ Li whenever j < i) to
justify preservation also for j < i− 1. Explaining clauses weaker than the goal
As we have seen, preservation of invariant 1) requires that every derived explaining clause C satisfies G⇒ C or, in other words, C must be weaker than the goal formula G. Here we show that this requirement can always be met, although we may be forced to weaken the explaining clause a bit, which goes against the heuristic of preferring short explaining clauses for their better generalizing power.
Notice that the algorithm never attempts to extend a goal state (because reaching the goal is a reason for termination) and thus we always have s|= ¬G when extending a state s. This means that there is always an explaining clause weaker than the goal, namely the clause obtained by complementing the maximal reason r = Lits(s). Typically, however, much smaller clauses are available.
There is a simple way to satisfy the weaker-than-goal requirement in practice, which can be employed whenever we work with a goal formula G expressed in the form of a set of unit clauses.9 We can then scan the explaining clause C looking for a literal l∈ C
such that the unit clause {l} is in G. If we find such a literal, the weaker-than-goal
requirement is already met: because G ⇒ l, the presence of l in C ensures that the clause is weaker than G. If we do not find it, there must still be at least one literal l with{l} ∈ G such that ∼l 6∈ C (otherwise s |= G). In this case, we weaken C by adding a single such literal l into it to satisfy the weaker-than-goal requirement.
Our approach for dealing with the situation of a goal formula G in its general clausal form is to reduce it to the above case by translating the given STSS = (Σ, I, G, T ). The idea of the translation, inspired by the technique of Gago et al. (2002) for implementing loop search in CTR (recall Section 2.5.2), is to represent the formula G by a single unit goal clause g (where g is a fresh variable) and add a set of defining clauses into the “universal part” of the STS to express the desired relation between g and G. In detail, we define the transformed STS as S∗= (Σ∪ {g}, I ∪ H, {{g}}, T ∪ (H)0), where
H ={¬g ∨ C | C ∈ G}
functions as the definition of the original goal formula G. We insert H both to the new initial formula (to properly constrain a potential witnessing paths of length 0) and put the primed version (H)0 to the transition formula (to constrain all the longer paths). It is straightforward to verify that the STSS and S∗ are equisatisfiable.