Having modified Reach to use monotone layers, we are still short of three individual enhancements before the algorithm is turned into full-fledged PDR. We first explain obligation rescheduling, by which the algorithm generalizes Reach’s strict backtracking scheme of dealing with the partial model path.
Obligation rescheduling
Recall that the computation of Reach can be separated into iterations such that during iteration k the algorithm tries to construct a witnessing path of length k while it has already shown in the previous iterations that there are no witnessing paths of lengths 0, 1, . . . , k− 1. In PDR, we separate the individual states Vi of the currently constructed
pathV = (Vi)0≤i<|V| into so called obligations, where an obligation corresponding to the
state Vi during iteration k is the ordered pair (Vi, k− i) and k − i can be understood as
an estimate on the distance of the state Vi towards the goal. This simple reindexing is
an essential step towards the following observation.
When the extension query fails for a state s from an obligation (s, j), we do not need to immediately discard the state (as we do in Reach), but we can retry it later at positions j + 1, j + 2, . . ., which are further from the goal. This obligation rescheduling technique allows the algorithm to discover witnessing paths of a length greater than the current iteration k. Intuitively, this helps to boost the performance of the algorithm in the satisfiable case as it can then avoid completing a potentially computationally expensive
way and then inverted (see Remark 5.1). Then the initial formula I describes the negated invariance property and the goal formula G is a conjunction of unit clauses that initializes the latches. This is the most common encoding setup of circuits in PDR, as it typically yields the best results.
proof that a short path does not exist. Obligation rescheduling incurs no overhead and can be turned off if a witnessing path of guaranteed minimal length is required.
Clause propagation
While obligation rescheduling could be added already to Reach, the second enhancement, clause propagation, relies in an essential way on the monotonicity of layers maintained by PDR. Recall that with monotone layers the layer repetition always occurs between two neighboring layers Li and Li+1 for some i. Clause propagation can be understood
as a way of bringing about layer repetition sooner by actively copying clauses from Li
to Li+1 whenever this preserves invariant 3), which states that Li+1 over-approximate
the preimage of Li. In detail, one checks for every C ∈ Li\ Li+1 by a call to the SAT
solver whether
(Li)0∧ T ⇒ C.
If the implication holds, the clause C can be ”pushed forward” and added to Li+1.10
This makes the two layers ”more equal” by reducing the size of Li\ Li+1.
We note that making the layers stronger has a positive effect also on the performance on satisfiable problems, because the strengthened layers subsequently provide for a better guidance towards the goal.
Small explaining clauses
When the extension query fails in Reach, the algorithm relies on the SAT solving under assumptions technique (Section 3.2) to obtain an explaining clause and enrich one of the layers. The explaining clause should ideally be as small as possible to generalize the most from the current failure and guide well during future extensions. So far, we have been relying on the SAT solver to provide a small explaining clause by itself. It turns out that one can typically remove further literals afterwards and thus improve performance. Let us first explain a simple version of an explicit minimization technique, which could already be added into Reach, before moving to a more advanced “inductive” version, which relies on monotone layers and is thus PDR-specific.
Recall the general form of a extension query for a state s, transition formula T and a layer Li−1:
SAT ?[ Lits(s)∧ T ∧ (Li−1)0].
In the unsatisfiable case, we obtain a reason cube r ⊆ Lits(s) for the unsuccessful extension and compute the corresponding explaining clause C as a complement of r. The reason r returned by a SAT solver can typically be further reduced, which results in a smaller explaining clause. We can explicitly minimize r by trying to remove literals one by one. If the respective query remains unsatisfiable we leave the literal out. Otherwise we put it back. In a number of steps proportional to |r| we obtain a final reason set r∗⊆ r minimal with respect to subset relation such that the query
SAT ?[ r∗∧ T ∧ (Li−1)0], 10Because C is already present in layers L
is unsatisfiable. The order in which the literals are tried out influences the final result and may be subject to heuristical tuning. Although reason minimization is an expensive operation (we need one extra SAT-solver call per literal), it pays off on average and, as experiments show, it is an important ingredient for solving hard problems.
Inductive reason minimization, a more powerful version of the above, relies on the specific way in which the layers are updated in PDR. Since after a reason r is computed we are in the next step going to strengthen the layers L0, . . . , Li (and, in particular, the
layer Li−1) with the explaining clause C =∼r, we may already assume C to hold “on
the primed side” when minimizing r. This means, we can use the stronger query SAT ?[ r∧ T ∧ (Li−1∧ ∼r)0].
Having r on both sides of the transition breaks monotonicity of the minimization process: as r gets weaker, ∼r gets stronger. Satisfiable query may become unsatisfiable again when more literals are removed from r. This makes the task of finding subset-minimal “inductive reason” computationally difficult (Bradley and Manna, 2007).
Algorithm 5.4 Inductive reason minimization: Input:
A set of clauses L and a cube r such that
the formulas r∧ T ∧ (L)0 and r∧ G are unsatisfiable
Output:
Minimized inductive reason r∗ ⊆ r, i.e., a cube r∗ such that
the formulas r∗∧ T ∧ (L ∧ ∼r∗)0 and r∗∧ G are unsatisfiable
1: r0 ← r
2: loop
3: foreach l∈ r do/* Check each literal of r once */
4: if there is l0 ∈ (r0\ {l}) such that {∼l0} ∈ G then /* Can try removing l */
5: r0 ← (r0\ {l})
6: if SAT ?[ r0∧ T ∧ (L ∧ ∼r0)0] then
7: r0← (r0∪ {l}) /* Put the literal back */
8: if r = r0 then/* No removal in the last iteration */
9: return r
10: r ← r0
In Algorithm 5.4, we present a simple version of inductive reason minimization with no minimality guarantee, which was, however, successfully applied in hardware model checking (E´en et al., 2011). To ensure the the weaker-than-goal requirement for the final explaining clause, the procedure assumes that the goal formula G is in the form of a set of unit clauses. It then keeps G∧ r0 unsatisfiable, which is equivalent to maintaining
G ⇒ C for the corresponding explaining clause C = ∼r0. Given the non-monotone
flavor of inductive minimization it makes sense to retry all the literals once a single literal has been successfully removed. That is why the procedure employes the outer loop to continue minimizing till a true “fixed point” is reached.