├── Makefile
├── LICENSE
├── README
├── IC3.h
├── main.cpp
├── Model.h
├── Model.cpp
└── IC3.cpp


/Makefile:
--------------------------------------------------------------------------------
 1 | CC=gcc
 2 | CFLAGS=-std=c++0x -Wall -D __STDC_LIMIT_MACROS -D __STDC_FORMAT_MACROS -O3 -g
 3 | CXX=g++
 4 | 
 5 | INCLUDE=-Iminisat -Iminisat/minisat/core -Iminisat/minisat/mtl -Iminisat/minisat/simp -Iaiger
 6 | 
 7 | all:	ic3
 8 | 
 9 | ic3:	minisat/build/dynamic/lib/libminisat.so aiger/aiger.o Model.o IC3.o main.o
10 | 	$(CXX) $(CFLAGS) $(INCLUDE) -o IC3 \
11 | 		aiger.o Model.o IC3.o main.o \
12 | 		minisat/build/release/lib/libminisat.a
13 | 
14 | .c.o:
15 | 	$(CC) -g -O3 $(INCLUDE) $< -c
16 | 
17 | .cpp.o:	
18 | 	$(CXX) $(CFLAGS) $(INCLUDE) $< -c
19 | 
20 | clean:
21 | 	rm -f *.o ic3
22 | 
23 | dist:
24 | 	cd ..; tar cf ic3ref/IC3ref.tar ic3ref/*.h ic3ref/*.cpp ic3ref/Makefile ic3ref/LICENSE ic3ref/README; gzip ic3ref/IC3ref.tar
25 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | IC3 reference implementation
 2 | 
 3 | Copyright 2013, Aaron R. Bradley
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining
 6 | a copy of this software and associated documentation files (the
 7 | "Software"), to deal in the Software without restriction, including
 8 | without limitation the rights to use, copy, modify, merge, publish,
 9 | distribute, sublicense, and/or sell copies of the Software, and to
10 | permit persons to whom the Software is furnished to do so, subject to
11 | the following conditions:
12 | 
13 | The above copyright notice and this permission notice shall be
14 | included in all copies or substantial portions of the Software.
15 | 
16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
17 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
18 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
19 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
20 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
21 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
22 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
23 | 


--------------------------------------------------------------------------------
/README:
--------------------------------------------------------------------------------
 1 | IC3 reference implementation: a short, simple, fairly competitive
 2 | implementation of IC3.  Read it, tune it, extend it, play with it.
 3 | 
 4 | Copyright 2013, Aaron R. Bradley
 5 | 
 6 | 1. Obtain the latest version of Minisat at
 7 | 
 8 |     https://github.com/niklasso/minisat
 9 | 
10 |   Unpack it into ic3ref/minisat (so that Solver.h is at
11 |   ic3ref/minisat/minisat/core/Solver.h).  Make.
12 | 
13 | 2. Obtain the AIGER utilities (aiger-1.9.4.tar.gz) at 
14 | 
15 |     http://fmv.jku.at/aiger/
16 | 
17 |   Unpack it into ic3/aiger (so that aiger.c is at
18 |   ic3ref/aiger/aiger.c).  DO NOT MAKE.
19 | 
20 | 3. At ic3ref, make.
21 | 
22 | 4. Run
23 | 
24 |     ./IC3 [<option>|<property ID>]* < <AIGER file>
25 | 
26 |   where
27 | 
28 |     -v: enables verbose output
29 | 
30 |     -s: enables output of runtime statistics
31 | 
32 |     -r: randomizes execution to better indicate performance
33 | 
34 |     -b: uses basic generalization
35 | 
36 |     <property ID>: an integer specifying a property index in the AIGER
37 |         file, which defaults to 0.  If 'B' is non-0, prefers 'B' to
38 |         'O' (see AIGER 1.9 format).
39 | 
40 |     <AIGER file>: AIGER formatted file with .aig or .aag extension
41 | 


--------------------------------------------------------------------------------
/IC3.h:
--------------------------------------------------------------------------------
 1 | /*********************************************************************
 2 | Copyright (c) 2013, Aaron Bradley
 3 | 
 4 | Permission is hereby granted, free of charge, to any person obtaining
 5 | a copy of this software and associated documentation files (the
 6 | "Software"), to deal in the Software without restriction, including
 7 | without limitation the rights to use, copy, modify, merge, publish,
 8 | distribute, sublicense, and/or sell copies of the Software, and to
 9 | permit persons to whom the Software is furnished to do so, subject to
10 | the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be
13 | included in all copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
19 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
20 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
21 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22 | *********************************************************************/
23 | 
24 | #ifndef IC3_h_INCLUDED
25 | #define IC3_h_INCLUDED
26 | 
27 | #include "Model.h"
28 | 
29 | namespace IC3 {
30 | 
31 |   bool check(Model & model, 
32 |              int verbose = 0,       // 0: silent, 1: stats, 2: informative
33 |              bool basic = false,    // simple inductive generalization
34 |              bool random = false);  // random runs for statistical profiling
35 | 
36 | }
37 | 
38 | #endif
39 | 


--------------------------------------------------------------------------------
/main.cpp:
--------------------------------------------------------------------------------
 1 | /*********************************************************************
 2 | Copyright (c) 2013, Aaron Bradley
 3 | 
 4 | Permission is hereby granted, free of charge, to any person obtaining
 5 | a copy of this software and associated documentation files (the
 6 | "Software"), to deal in the Software without restriction, including
 7 | without limitation the rights to use, copy, modify, merge, publish,
 8 | distribute, sublicense, and/or sell copies of the Software, and to
 9 | permit persons to whom the Software is furnished to do so, subject to
10 | the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be
13 | included in all copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
19 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
20 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
21 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22 | *********************************************************************/
23 | 
24 | #include <iostream>
25 | #include <string>
26 | #include <time.h>
27 | 
28 | extern "C" {
29 | #include "aiger.h"
30 | }
31 | #include "IC3.h"
32 | #include "Model.h"
33 | 
34 | int main(int argc, char ** argv) {
35 |   unsigned int propertyIndex = 0;
36 |   bool basic = false, random = false;
37 |   int verbose = 0;
38 |   for (int i = 1; i < argc; ++i) {
39 |     if (string(argv[i]) == "-v")
40 |       // option: verbosity
41 |       verbose = 2;
42 |     else if (string(argv[i]) == "-s")
43 |       // option: print statistics
44 |       verbose = max(1, verbose);
45 |     else if (string(argv[i]) == "-r") {
46 |       // option: randomize the run, which is useful in performance
47 |       // testing; default behavior is deterministic
48 |       srand(time(NULL));
49 |       random = true;
50 |     }
51 |     else if (string(argv[i]) == "-b")
52 |       // option: use basic generalization
53 |       basic = true;
54 |     else
55 |       // optional argument: set property index
56 |       propertyIndex = (unsigned) atoi(argv[i]);
57 |   }
58 | 
59 |   // read AIGER model
60 |   aiger * aig = aiger_init();
61 |   const char * msg = aiger_read_from_file(aig, stdin);
62 |   if (msg) {
63 |     cout << msg << endl;
64 |     return 0;
65 |   }
66 |   // create the Model from the obtained aig
67 |   Model * model = modelFromAiger(aig, propertyIndex);
68 |   aiger_reset(aig);
69 |   if (!model) return 0;
70 | 
71 |   // model check it
72 |   bool rv = IC3::check(*model, verbose, basic, random);
73 |   // print 0/1 according to AIGER standard
74 |   cout << !rv << endl;
75 | 
76 |   delete model;
77 | 
78 |   return 1;
79 | }
80 | 


--------------------------------------------------------------------------------
/Model.h:
--------------------------------------------------------------------------------
  1 | /*********************************************************************
  2 | Copyright (c) 2013, Aaron Bradley
  3 | 
  4 | Permission is hereby granted, free of charge, to any person obtaining
  5 | a copy of this software and associated documentation files (the
  6 | "Software"), to deal in the Software without restriction, including
  7 | without limitation the rights to use, copy, modify, merge, publish,
  8 | distribute, sublicense, and/or sell copies of the Software, and to
  9 | permit persons to whom the Software is furnished to do so, subject to
 10 | the following conditions:
 11 | 
 12 | The above copyright notice and this permission notice shall be
 13 | included in all copies or substantial portions of the Software.
 14 | 
 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 19 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 20 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 21 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 22 | *********************************************************************/
 23 | 
 24 | #ifndef MODEL_H_INCLUDED
 25 | #define MODEL_H_INCLUDED
 26 | 
 27 | #include <algorithm>
 28 | #include <set>
 29 | #include <sstream>
 30 | #include <unordered_map>
 31 | #include <vector>
 32 | 
 33 | extern "C" {
 34 | #include "aiger.h"
 35 | }
 36 | #include "Solver.h"
 37 | #include "SimpSolver.h"
 38 | 
 39 | // Read it and weep: yes, it's in a header file; no, I don't want to
 40 | // have std:: all over the place.
 41 | using namespace std;
 42 | 
 43 | // A row of the AIGER spec: lhs = rhs0 & rhs1.
 44 | struct AigRow {
 45 |   AigRow(Minisat::Lit _lhs, Minisat::Lit _rhs0, Minisat::Lit _rhs1) :
 46 |     lhs(_lhs), rhs0(_rhs0), rhs1(_rhs1) {}
 47 |   Minisat::Lit lhs, rhs0, rhs1;
 48 | };
 49 | // Intended to hold the AND section of an AIGER spec.
 50 | typedef vector<AigRow> AigVec;
 51 | typedef vector<Minisat::Lit> LitVec;
 52 | 
 53 | // A lightweight wrapper around Minisat::Var that includes a name.
 54 | class Var {
 55 | public:
 56 |   Var(const string name) {
 57 |     _var = gvi++;
 58 |     _name = name;
 59 |   }
 60 |   size_t index() const { return (size_t) _var; }
 61 |   Minisat::Var var() const { return _var; }
 62 |   Minisat::Lit lit(bool neg) const {
 63 |     return Minisat::mkLit(_var, neg);
 64 |   }
 65 |   string name() const { return _name; }
 66 | private:
 67 |   static Minisat::Var gvi;  // aligned with solvers
 68 |   Minisat::Var _var;        // corresponding Minisat::Var in *any* solver
 69 |   string _name;
 70 | };
 71 | 
 72 | typedef vector<Var> VarVec;
 73 | 
 74 | class VarComp {
 75 | public:
 76 |   bool operator()(const Var & v1, const Var & v2) {
 77 |     return v1.index() < v2.index();
 78 |   }
 79 | };
 80 | typedef set<Var, VarComp> VarSet;
 81 | typedef set<Minisat::Lit> LitSet;
 82 | 
 83 | // A simple wrapper around an AIGER-specified invariance benchmark.
 84 | // It specifically disallows primed variables beyond those required to
 85 | // express the (property-constrained) transition relation and the
 86 | // primed error constraint.  Variables are kept aligned with the
 87 | // variables of any solver created through newSolver().
 88 | class Model {
 89 | public:
 90 |   // Construct a model from a vector of variables, indices indicating
 91 |   // divisions between variable types, constraints, next-state
 92 |   // functions, the error, and the AND table, closely reflecting the
 93 |   // AIGER format.  Easier to use "modelFromAiger()", below.
 94 |   Model(vector<Var> _vars, 
 95 |         size_t _inputs, size_t _latches, size_t _reps, 
 96 |         LitVec _init, LitVec _constraints, LitVec _nextStateFns, 
 97 |         Minisat::Lit _err, AigVec _aig) :
 98 |     vars(_vars), 
 99 |     inputs(_inputs), latches(_latches), reps(_reps),
100 |     primes(_vars.size()), primesUnlocked(true), aig(_aig),
101 |     init(_init), constraints(_constraints), nextStateFns(_nextStateFns),
102 |     _error(_err), inits(NULL), sslv(NULL)
103 |   {
104 |     // create primed inputs and latches in known region of vars
105 |     for (size_t i = inputs; i < reps; ++i) {
106 |       stringstream ss;
107 |       ss << vars[i].name() << "'";
108 |       vars.push_back(Var(ss.str()));
109 |     }
110 |     // same with primed error
111 |     _primedError = primeLit(_error);
112 |     // same with primed constraints
113 |     for (LitVec::const_iterator i = constraints.begin(); 
114 |          i != constraints.end(); ++i)
115 |       primeLit(*i);
116 |   }
117 |   ~Model();
118 | 
119 |   // Returns the Var of the given Minisat::Lit.
120 |   const Var & varOfLit(Minisat::Lit lit) const {
121 |     Minisat::Var v = Minisat::var(lit);
122 |     assert ((unsigned) v < vars.size());
123 |     return vars[v];
124 |   }
125 | 
126 |   // Returns the name of the Minisat::Lit.
127 |   string stringOfLit(Minisat::Lit lit) const {
128 |     stringstream ss;
129 |     if (Minisat::sign(lit)) ss << "~";
130 |     ss << varOfLit(lit).name();
131 |     return ss.str();
132 |   }
133 | 
134 |   // Returns the primed Var/Minisat::Lit for the given
135 |   // Var/Minisat::Lit.  Once lockPrimes() is called, primeVar() fails
136 |   // (with an assertion violation) if it is asked to create a new
137 |   // variable.
138 |   const Var & primeVar(const Var & v, Minisat::SimpSolver * slv = NULL);
139 |   Minisat::Lit primeLit(Minisat::Lit lit, Minisat::SimpSolver * slv = NULL) {
140 |     const Var & pv = primeVar(varOfLit(lit), slv);
141 |     return pv.lit(Minisat::sign(lit));
142 |   }
143 |   Minisat::Lit unprimeLit(Minisat::Lit lit) {
144 |     size_t i = (size_t) var(lit);
145 |     if (i >= primes && i < primes + reps - inputs)
146 |       return Minisat::mkLit((Minisat::Var) (i - primes + inputs), sign(lit));
147 |     else
148 |       return lit;
149 |   }
150 | 
151 |   // Once all primed variables have been created, it locks the Model
152 |   // from creating any further ones.  Then Solver::newVar() may be
153 |   // called safely.
154 |   //
155 |   // WARNING: Do not call Solver::newVar() until lockPrimes() has been
156 |   // called.
157 |   void lockPrimes() { primesUnlocked = false; }
158 | 
159 |   // Minisat::Lits corresponding to true/false.
160 |   Minisat::Lit btrue() const { return Minisat::mkLit(vars[0].var(), true); }
161 |   Minisat::Lit bfalse() const { return Minisat::mkLit(vars[0].var(), false); }
162 | 
163 |   // Primary inputs.
164 |   VarVec::const_iterator beginInputs() const { 
165 |     return vars.begin()+inputs; 
166 |   }
167 |   VarVec::const_iterator endInputs() const { 
168 |     return vars.begin()+latches; 
169 |   }
170 | 
171 |   // Latches.
172 |   VarVec::const_iterator beginLatches() const { 
173 |     return vars.begin()+latches; 
174 |   }
175 |   VarVec::const_iterator endLatches() const { 
176 |     return vars.begin()+reps; 
177 |   }
178 | 
179 |   // Next-state function for given latch.
180 |   Minisat::Lit nextStateFn(const Var & latch) const {
181 |     assert (latch.index() >= latches && latch.index() < reps);
182 |     return nextStateFns[latch.index()-latches];
183 |   }
184 | 
185 |   // Error and its primed form.
186 |   Minisat::Lit error() const { return _error; }
187 |   Minisat::Lit primedError() const { return _primedError; }
188 | 
189 |   // Invariant constraints
190 |   const LitVec & invariantConstraints() { return constraints; }
191 | 
192 |   // Creates a Solver and initializes its variables to maintain
193 |   // alignment with the Model's variables.
194 |   Minisat::Solver * newSolver() const;
195 | 
196 |   // Loads the TR into the solver.  Also loads the primed error
197 |   // definition such that Model::primedError() need only be asserted
198 |   // to activate it.  Invariant constraints (AIGER 1.9) and the
199 |   // negation of the error are always added --- except that the primed
200 |   // form of the invariant constraints are not asserted if
201 |   // !primeConstraints.
202 |   void loadTransitionRelation(Minisat::Solver & slv, 
203 |                               bool primeConstraints = true);
204 |   // Loads the initial condition into the solver.
205 |   void loadInitialCondition(Minisat::Solver & slv) const;
206 |   // Loads the error into the solver, which is only necessary for the
207 |   // 0-step base case of IC3.
208 |   void loadError(Minisat::Solver & slv) const;
209 | 
210 |   // Use this method to allow the Model to decide how best to decide
211 |   // if a cube has an initial state.
212 |   bool isInitial(const LitVec & latches);
213 | 
214 | private:
215 |   VarVec vars;
216 |   const size_t inputs, latches, reps, primes;
217 | 
218 |   bool primesUnlocked;
219 |   typedef unordered_map<size_t, size_t> IndexMap;
220 |   IndexMap primedAnds;
221 | 
222 |   const AigVec aig;
223 |   const LitVec init, constraints, nextStateFns;
224 |   const Minisat::Lit _error;
225 |   Minisat::Lit _primedError;
226 | 
227 |   typedef size_t TRMapKey;
228 |   typedef unordered_map<TRMapKey, Minisat::SimpSolver *> TRMap;
229 |   TRMap trmap;
230 | 
231 |   Minisat::Solver * inits;
232 |   LitSet initLits;
233 | 
234 |   Minisat::SimpSolver * sslv;
235 | 
236 | };
237 | 
238 | // The easiest way to create a model.
239 | Model * modelFromAiger(aiger * aig, unsigned int propertyIndex);
240 | 
241 | #endif
242 | 


--------------------------------------------------------------------------------
/Model.cpp:
--------------------------------------------------------------------------------
  1 | /*********************************************************************
  2 | Copyright (c) 2013, Aaron Bradley
  3 | 
  4 | Permission is hereby granted, free of charge, to any person obtaining
  5 | a copy of this software and associated documentation files (the
  6 | "Software"), to deal in the Software without restriction, including
  7 | without limitation the rights to use, copy, modify, merge, publish,
  8 | distribute, sublicense, and/or sell copies of the Software, and to
  9 | permit persons to whom the Software is furnished to do so, subject to
 10 | the following conditions:
 11 | 
 12 | The above copyright notice and this permission notice shall be
 13 | included in all copies or substantial portions of the Software.
 14 | 
 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 19 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 20 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 21 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 22 | *********************************************************************/
 23 | 
 24 | #include <iostream>
 25 | 
 26 | #include "Model.h"
 27 | #include "SimpSolver.h"
 28 | #include "Vec.h"
 29 | 
 30 | Minisat::Var Var::gvi = 0;
 31 | 
 32 | Model::~Model() {
 33 |   if (inits) delete inits;
 34 |   if (sslv) delete sslv;
 35 | }
 36 | 
 37 | const Var & Model::primeVar(const Var & v, Minisat::SimpSolver * slv) {
 38 |   // var for false
 39 |   if (v.index() == 0) return v;
 40 |   // latch or PI
 41 |   if (v.index() < reps)
 42 |     return vars[primes+v.index()-inputs];
 43 |   // AND lit
 44 |   assert (v.index() >= reps && v.index() < primes);
 45 |   // created previously?
 46 |   IndexMap::const_iterator i = primedAnds.find(v.index());
 47 |   size_t index;
 48 |   if (i == primedAnds.end()) {
 49 |     // no, so make sure the model hasn't been locked
 50 |     assert (primesUnlocked);
 51 |     // create a primed version
 52 |     stringstream ss;
 53 |     ss << v.name() << "'";
 54 |     index = vars.size();
 55 |     vars.push_back(Var(ss.str()));
 56 |     if (slv) {
 57 |       Minisat::Var _v = slv->newVar();
 58 |       assert (_v == vars.back().var());
 59 |     }
 60 |     assert (vars.back().index() == index);
 61 |     primedAnds.insert(IndexMap::value_type(v.index(), index));
 62 |   }
 63 |   else
 64 |     index = i->second;
 65 |   return vars[index];
 66 | }
 67 | 
 68 | Minisat::Solver * Model::newSolver() const {
 69 |   Minisat::Solver * slv = new Minisat::Solver();
 70 |   // load all variables to maintain alignment
 71 |   for (size_t i = 0; i < vars.size(); ++i) {
 72 |     Minisat::Var nv = slv->newVar();
 73 |     assert (nv == vars[i].var());
 74 |   }
 75 |   return slv;
 76 | }
 77 | 
 78 | void Model::loadTransitionRelation(Minisat::Solver & slv, bool primeConstraints) {
 79 |   if (!sslv) {
 80 |     // create a simplified CNF version of (this slice of) the TR
 81 |     sslv = new Minisat::SimpSolver();
 82 |     // introduce all variables to maintain alignment
 83 |     for (size_t i = 0; i < vars.size(); ++i) {
 84 |       Minisat::Var nv = sslv->newVar();
 85 |       assert (nv == vars[i].var());
 86 |     }
 87 |     // freeze inputs, latches, and special nodes (and primed forms)
 88 |     for (VarVec::const_iterator i = beginInputs(); i != endInputs(); ++i) {
 89 |       sslv->setFrozen(i->var(), true);
 90 |       sslv->setFrozen(primeVar(*i).var(), true);
 91 |     }
 92 |     for (VarVec::const_iterator i = beginLatches(); i != endLatches(); ++i) {
 93 |       sslv->setFrozen(i->var(), true);
 94 |       sslv->setFrozen(primeVar(*i).var(), true);
 95 |     }
 96 |     sslv->setFrozen(varOfLit(error()).var(), true);
 97 |     sslv->setFrozen(varOfLit(primedError()).var(), true);
 98 |     for (LitVec::const_iterator i = constraints.begin(); 
 99 |          i != constraints.end(); ++i) {
100 |       Var v = varOfLit(*i);
101 |       sslv->setFrozen(v.var(), true);
102 |       sslv->setFrozen(primeVar(v).var(), true);
103 |     }
104 |     // initialize with roots of required formulas
105 |     LitSet require;  // unprimed formulas
106 |     for (VarVec::const_iterator i = beginLatches(); i != endLatches(); ++i)
107 |       require.insert(nextStateFn(*i));
108 |     require.insert(_error);
109 |     require.insert(constraints.begin(), constraints.end());
110 |     LitSet prequire; // for primed formulas; always subset of require
111 |     prequire.insert(_error);
112 |     prequire.insert(constraints.begin(), constraints.end());
113 |     // traverse AIG backward
114 |     for (AigVec::const_reverse_iterator i = aig.rbegin(); 
115 |          i != aig.rend(); ++i) {
116 |       // skip if this row is not required
117 |       if (require.find(i->lhs) == require.end() 
118 |           && require.find(~i->lhs) == require.end())
119 |         continue;
120 |       // encode into CNF
121 |       sslv->addClause(~i->lhs, i->rhs0);
122 |       sslv->addClause(~i->lhs, i->rhs1);
123 |       sslv->addClause(~i->rhs0, ~i->rhs1, i->lhs);
124 |       // require arguments
125 |       require.insert(i->rhs0);
126 |       require.insert(i->rhs1);
127 |       // primed: skip if not required
128 |       if (prequire.find(i->lhs) == prequire.end()
129 |           && prequire.find(~i->lhs) == prequire.end())
130 |         continue;
131 |       // encode PRIMED form into CNF
132 |       Minisat::Lit r0 = primeLit(i->lhs, sslv), 
133 |         r1 = primeLit(i->rhs0, sslv), 
134 |         r2 = primeLit(i->rhs1, sslv);
135 |       sslv->addClause(~r0, r1);
136 |       sslv->addClause(~r0, r2);
137 |       sslv->addClause(~r1, ~r2, r0);
138 |       // require arguments
139 |       prequire.insert(i->rhs0);
140 |       prequire.insert(i->rhs1);
141 |     }
142 |     // assert literal for true
143 |     sslv->addClause(btrue());
144 |     // assert ~error, constraints, and primed constraints
145 |     sslv->addClause(~_error);
146 |     for (LitVec::const_iterator i = constraints.begin(); 
147 |          i != constraints.end(); ++i) {
148 |       sslv->addClause(*i);
149 |     }
150 |     // assert l' = f for each latch l
151 |     for (VarVec::const_iterator i = beginLatches(); i != endLatches(); ++i) {
152 |       Minisat::Lit platch = primeLit(i->lit(false)), f = nextStateFn(*i);
153 |       sslv->addClause(~platch, f);
154 |       sslv->addClause(~f, platch);
155 |     }
156 |     sslv->eliminate(true);
157 |   }
158 |   // load the clauses from the simplified context
159 |   while (slv.nVars() < sslv->nVars()) slv.newVar();
160 |   for (Minisat::ClauseIterator c = sslv->clausesBegin(); 
161 |        c != sslv->clausesEnd(); ++c) {
162 |     const Minisat::Clause & cls = *c;
163 |     Minisat::vec<Minisat::Lit> cls_;
164 |     for (int i = 0; i < cls.size(); ++i)
165 |       cls_.push(cls[i]);
166 |     slv.addClause_(cls_);
167 |   }
168 |   for (Minisat::TrailIterator c = sslv->trailBegin(); 
169 |        c != sslv->trailEnd(); ++c)
170 |     slv.addClause(*c);
171 |   if (primeConstraints)
172 |     for (LitVec::const_iterator i = constraints.begin(); 
173 |          i != constraints.end(); ++i)
174 |       slv.addClause(primeLit(*i));
175 | }
176 | 
177 | void Model::loadInitialCondition(Minisat::Solver & slv) const {
178 |   slv.addClause(btrue());
179 |   for (LitVec::const_iterator i = init.begin(); i != init.end(); ++i)
180 |     slv.addClause(*i);
181 |   if (constraints.empty())
182 |     return;
183 |   // impose invariant constraints on initial states (AIGER 1.9)
184 |   LitSet require;
185 |   require.insert(constraints.begin(), constraints.end());
186 |   for (AigVec::const_reverse_iterator i = aig.rbegin(); i != aig.rend(); ++i) {
187 |     // skip if this (*i) is not required
188 |     if (require.find(i->lhs) == require.end() 
189 |         && require.find(~i->lhs) == require.end())
190 |       continue;
191 |     // encode into CNF
192 |     slv.addClause(~i->lhs, i->rhs0);
193 |     slv.addClause(~i->lhs, i->rhs1);
194 |     slv.addClause(~i->rhs0, ~i->rhs1, i->lhs);
195 |     // require arguments
196 |     require.insert(i->rhs0);
197 |     require.insert(i->rhs1);
198 |   }
199 |   for (LitVec::const_iterator i = constraints.begin(); 
200 |        i != constraints.end(); ++i)
201 |     slv.addClause(*i);
202 | }
203 | 
204 | void Model::loadError(Minisat::Solver & slv) const {
205 |   LitSet require;  // unprimed formulas
206 |   require.insert(_error);
207 |   // traverse AIG backward
208 |   for (AigVec::const_reverse_iterator i = aig.rbegin(); i != aig.rend(); ++i) {
209 |     // skip if this row is not required
210 |     if (require.find(i->lhs) == require.end() 
211 |         && require.find(~i->lhs) == require.end())
212 |       continue;
213 |     // encode into CNF
214 |     slv.addClause(~i->lhs, i->rhs0);
215 |     slv.addClause(~i->lhs, i->rhs1);
216 |     slv.addClause(~i->rhs0, ~i->rhs1, i->lhs);
217 |     // require arguments
218 |     require.insert(i->rhs0);
219 |     require.insert(i->rhs1);
220 |   }
221 | }
222 | 
223 | bool Model::isInitial(const LitVec & latches) {
224 |   if (constraints.empty()) {
225 |     // an intersection check (AIGER 1.9 w/o invariant constraints)
226 |     if (initLits.empty())
227 |       initLits.insert(init.begin(), init.end());
228 |     for (LitVec::const_iterator i = latches.begin(); i != latches.end(); ++i)
229 |       if (initLits.find(~*i) != initLits.end())
230 |         return false;
231 |     return true;
232 |   }
233 |   else {
234 |     // a full SAT query
235 |     if (!inits) {
236 |       inits = newSolver();
237 |       loadInitialCondition(*inits);
238 |     }
239 |     Minisat::vec<Minisat::Lit> assumps;
240 |     assumps.capacity(latches.size());
241 |     for (LitVec::const_iterator i = latches.begin(); i != latches.end(); ++i)
242 |       assumps.push(*i);
243 |     return inits->solve(assumps);
244 |   }
245 | }
246 | 
247 | // Creates a named variable.
248 | Var var(const aiger_symbol * syms, size_t i, const char prefix, 
249 |         bool prime = false)
250 | {
251 |   const aiger_symbol & sym = syms[i];
252 |   stringstream ss;
253 |   if (sym.name) 
254 |     ss << sym.name;
255 |   else
256 |     ss << prefix << i;
257 |   if (prime) 
258 |     ss << "'";
259 |   return Var(ss.str());
260 | }
261 | 
262 | Minisat::Lit lit(const VarVec & vars, unsigned int l) {
263 |   return vars[l>>1].lit(aiger_sign(l));
264 | }
265 | 
266 | Model * modelFromAiger(aiger * aig, unsigned int propertyIndex) {
267 |   VarVec vars(1, Var("false"));
268 |   LitVec init, constraints, nextStateFns;
269 | 
270 |   // declare primary inputs and latches
271 |   for (size_t i = 0; i < aig->num_inputs; ++i)
272 |     vars.push_back(var(aig->inputs, i, 'i'));
273 |   for (size_t i = 0; i < aig->num_latches; ++i)
274 |     vars.push_back(var(aig->latches, i, 'l'));
275 | 
276 |   // the AND section
277 |   AigVec aigv;
278 |   for (size_t i = 0; i < aig->num_ands; ++i) {
279 |     // 1. create a representative
280 |     stringstream ss;
281 |     ss << 'r' << i;
282 |     vars.push_back(Var(ss.str()));
283 |     const Var & rep = vars.back();
284 |     // 2. obtain arguments of AND as lits
285 |     Minisat::Lit l0 = lit(vars, aig->ands[i].rhs0);
286 |     Minisat::Lit l1 = lit(vars, aig->ands[i].rhs1);
287 |     // 3. add AIG row
288 |     aigv.push_back(AigRow(rep.lit(false), l0, l1));
289 |   }
290 | 
291 |   // acquire latches' initial states and next-state functions
292 |   for (size_t i = 0; i < aig->num_latches; ++i) {
293 |     const Var & latch = vars[1+aig->num_inputs+i];
294 |     // initial condition
295 |     unsigned int r = aig->latches[i].reset;
296 |     if (r < 2)
297 |       init.push_back(latch.lit(r == 0));
298 |     // next-state function
299 |     nextStateFns.push_back(lit(vars, aig->latches[i].next));
300 |   }
301 | 
302 |   // invariant constraints
303 |   for (size_t i = 0; i < aig->num_constraints; ++i)
304 |     constraints.push_back(lit(vars, aig->constraints[i].lit));
305 | 
306 |   // acquire error from given propertyIndex
307 |   if ((aig->num_bad > 0 && aig->num_bad <= propertyIndex)
308 |       || (aig->num_outputs > 0 && aig->num_outputs <= propertyIndex)) {
309 |     cout << "Bad property index specified." << endl;
310 |     return 0;
311 |   }
312 |   Minisat::Lit err = 
313 |     aig->num_bad > 0 
314 |     ? lit(vars, aig->bad[propertyIndex].lit) 
315 |     : lit(vars, aig->outputs[propertyIndex].lit);
316 | 
317 |   size_t offset = 0;
318 |   return new Model(vars, 
319 |                    offset += 1, offset += aig->num_inputs, 
320 |                    offset + aig->num_latches,
321 |                    init, constraints, nextStateFns, err, aigv);
322 | }
323 | 


--------------------------------------------------------------------------------
/IC3.cpp:
--------------------------------------------------------------------------------
  1 | /*********************************************************************
  2 | Copyright (c) 2013, Aaron Bradley
  3 | 
  4 | Permission is hereby granted, free of charge, to any person obtaining
  5 | a copy of this software and associated documentation files (the
  6 | "Software"), to deal in the Software without restriction, including
  7 | without limitation the rights to use, copy, modify, merge, publish,
  8 | distribute, sublicense, and/or sell copies of the Software, and to
  9 | permit persons to whom the Software is furnished to do so, subject to
 10 | the following conditions:
 11 | 
 12 | The above copyright notice and this permission notice shall be
 13 | included in all copies or substantial portions of the Software.
 14 | 
 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 17 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 19 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 20 | OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 21 | WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 22 | *********************************************************************/
 23 | 
 24 | #include <algorithm>
 25 | #include <iostream>
 26 | #include <set>
 27 | #include <sys/times.h>
 28 | 
 29 | #include "IC3.h"
 30 | #include "Solver.h"
 31 | #include "Vec.h"
 32 | 
 33 | // A reference implementation of IC3, i.e., one that is meant to be
 34 | // read and used as a starting point for tuning, extending, and
 35 | // experimenting.
 36 | //
 37 | // High-level details:
 38 | //
 39 | //  o The overall structure described in
 40 | //
 41 | //      Aaron R. Bradley, "SAT-Based Model Checking without
 42 | //      Unrolling," VMCAI'11
 43 | //
 44 | //    including frames, a priority queue of frame-specific proof
 45 | //    obligations, and induction-based generalization.  See check(),
 46 | //    strengthen(), handleObligations(), mic(), propagate().
 47 | //
 48 | //  o Lifting, inspired by
 49 | //
 50 | //      Niklas Een, Alan Mishchenko, Robert Brayton, "Efficient
 51 | //      Implementation of Property Directed Reachability," FMCAD'11
 52 | //
 53 | //    Each CTI is lifted to a larger cube whose states all have the
 54 | //    same successor.  The implementation is based on
 55 | //
 56 | //      H. Chockler, A. Ivrii, A. Matsliah, S. Moran, and Z. Nevo,
 57 | //      "Incremental Formal Verification of Hardware," FMCAD'11.
 58 | //
 59 | //    In particular, if s with inputs i is a predecessor of t, then s
 60 | //    & i & T & ~t' is unsatisfiable, where T is the transition
 61 | //    relation.  The unsat core reveals a suitable lifting of s.  See
 62 | //    stateOf().
 63 | //
 64 | //  o One solver per frame, which various authors of IC3
 65 | //    implementations have tried (including me in pre-publication
 66 | //    work, at which time I thought that moving to one solver was
 67 | //    better).
 68 | //
 69 | //  o A straightforward proof obligation scheme, inspired by the ABC
 70 | //    implementation.  I have so far favored generalizing relative to
 71 | //    the maximum possible level in order to avoid over-strengthening,
 72 | //    but doing so requires a more complicated generalization scheme.
 73 | //    Experiments by Zyad Hassan indicate that generalizing relative
 74 | //    to earlier levels works about as well.  Because literals seem to
 75 | //    be dropped more quickly, an implementation of the "up" algorithm
 76 | //    (described in my FMCAD'07 paper) is unnecessary.
 77 | //
 78 | //    The scheme is as follows.  For obligation <s, i>:
 79 | //
 80 | //    1. Check consecution of ~s relative to i-1.
 81 | //
 82 | //    2. If it succeeds, generalize, then push foward to, say, j.  If
 83 | //       j <= k (the frontier), enqueue obligation <s, j>.
 84 | //
 85 | //    3. If it fails, extract the predecessor t (using stateOf()) and
 86 | //       enqueue obligation <t, i-1>.
 87 | //
 88 | //    The upshot for this reference implementation is that it is
 89 | //    short, simple, and effective.  See handleObligations() and
 90 | //    generalize().
 91 | //
 92 | //  o The generalization method described in
 93 | //
 94 | //      Zyad Hassan, Aaron R. Bradley, and Fabio Somenzi, "Better
 95 | //      Generalization in IC3," (submitted May 2013)
 96 | //
 97 | //    which seems to be superior to the single-clause method described
 98 | //    in the original paper, first described in
 99 | //
100 | //      Aaron R. Bradley and Zohar Manna, "Checking Safety by
101 | //      Inductive Generalization of Counterexamples to Induction,"
102 | //      FMCAD'07
103 | //
104 | //    The main idea is to address not only CTIs, which are states
105 | //    discovered through IC3's explict backward search, but also
106 | //    counterexamples to generalization (CTGs), which are states that
107 | //    are counterexamples to induction during generalization.  See
108 | //    mic() and ctgDown().
109 | //
110 | //    A basic one-cube generalization scheme can be used instead
111 | //    (third argument of check()).
112 | //
113 | // Limitations in roughly descending order of significance:
114 | //
115 | //  o A permanent limitation is that there is absolutely no
116 | //    simplification of the AIGER spec.  Use, e.g.,
117 | //
118 | //      iimc -t pp -t print_aiger 
119 | //
120 | //    or ABC's simplification methods to produce preprocessed AIGER
121 | //    benchmarks.  This implementation is intentionally being kept
122 | //    small and simple.
123 | //
124 | //  o An implementation of "up" is not provided, as it seems that it's
125 | //    unnecessary when both lifting-based and unsat core-based
126 | //    reduction are applied to a state, followed by mic before
127 | //    pushing.  The resulting cube is sufficiently small.
128 | 
129 | namespace IC3 {
130 | 
131 |   class IC3 {
132 |   public:
133 |     IC3(Model & _model) :
134 |       verbose(0), random(false), model(_model), k(1), nextState(0),
135 |       litOrder(), slimLitOrder(),
136 |       numLits(0), numUpdates(0), maxDepth(1), maxCTGs(3),
137 |       maxJoins(1<<20), micAttempts(3), cexState(0), nQuery(0), nCTI(0), nCTG(0),
138 |       nmic(0), satTime(0), nCoreReduced(0), nAbortJoin(0), nAbortMic(0)
139 |     {
140 |       slimLitOrder.heuristicLitOrder = &litOrder;
141 | 
142 |       // construct lifting solver
143 |       lifts = model.newSolver();
144 |       // don't assert primed invariant constraints
145 |       model.loadTransitionRelation(*lifts, false);
146 |       // assert notInvConstraints (in stateOf) when lifting
147 |       notInvConstraints = Minisat::mkLit(lifts->newVar());
148 |       Minisat::vec<Minisat::Lit> cls;
149 |       cls.push(~notInvConstraints);
150 |       for (LitVec::const_iterator i = model.invariantConstraints().begin();
151 |            i != model.invariantConstraints().end(); ++i)
152 |         cls.push(model.primeLit(~*i));
153 |       lifts->addClause_(cls);
154 |     }
155 |     ~IC3() {
156 |       for (vector<Frame>::const_iterator i = frames.begin(); 
157 |            i != frames.end(); ++i)
158 |         if (i->consecution) delete i->consecution;
159 |       delete lifts;
160 |     }
161 | 
162 |     // The main loop.
163 |     bool check() {
164 |       startTime = time();  // stats
165 |       while (true) {
166 |         if (verbose > 1) cout << "Level " << k << endl;
167 |         extend();                         // push frontier frame
168 |         if (!strengthen()) return false;  // strengthen to remove bad successors
169 |         if (propagate()) return true;     // propagate clauses; check for proof
170 |         printStats();
171 |         ++k;                              // increment frontier
172 |       }
173 |     }
174 | 
175 |     // Follows and prints chain of states from cexState forward.
176 |    void printWitness() {
177 |       if (cexState != 0) {
178 |         size_t curr = cexState;
179 |         while (curr) {
180 |           cout << stringOfLitVec(state(curr).inputs) 
181 |                << stringOfLitVec(state(curr).latches) << endl;
182 |           curr = state(curr).successor;
183 |         }
184 |       }
185 |     }
186 | 
187 |   private:
188 | 
189 |     int verbose; // 0: silent, 1: stats, 2: all
190 |     bool random;
191 | 
192 |     string stringOfLitVec(const LitVec & vec) {
193 |       stringstream ss;
194 |       for (LitVec::const_iterator i = vec.begin(); i != vec.end(); ++i)
195 |         ss << model.stringOfLit(*i) << " ";
196 |       return ss.str();
197 |     }
198 | 
199 |     Model & model;
200 |     size_t k;
201 | 
202 |     // The State structures are for tracking trees of (lifted) CTIs.
203 |     // Because States are created frequently, I want to avoid dynamic
204 |     // memory management; instead their (de)allocation is handled via
205 |     // a vector-based pool.
206 |     struct State {
207 |       size_t successor;  // successor State
208 |       LitVec latches;
209 |       LitVec inputs;
210 |       size_t index;      // for pool
211 |       bool used;         // for pool
212 |     };
213 |     vector<State> states;
214 |     size_t nextState;
215 |     // WARNING: do not keep reference across newState() calls
216 |     State & state(size_t sti) { return states[sti-1]; }
217 |     size_t newState() {
218 |       if (nextState >= states.size()) {
219 |         states.resize(states.size()+1);
220 |         states.back().index = states.size();
221 |         states.back().used = false;
222 |       }
223 |       size_t ns = nextState;
224 |       assert (!states[ns].used);
225 |       states[ns].used = true;
226 |       while (nextState < states.size() && states[nextState].used)
227 |         nextState++;
228 |       return ns+1;
229 |     }
230 |     void delState(size_t sti) {
231 |       State & st = state(sti);
232 |       st.used = false;
233 |       st.latches.clear();
234 |       st.inputs.clear();
235 |       if (nextState > st.index-1) nextState = st.index-1;
236 |     }
237 |     void resetStates() {
238 |       for (vector<State>::iterator i = states.begin(); i != states.end(); ++i) {
239 |         i->used = false;
240 |         i->latches.clear();
241 |         i->inputs.clear();
242 |       }
243 |       nextState = 0;
244 |     }
245 | 
246 |     // A CubeSet is a set of ordered (by integer value) vectors of
247 |     // Minisat::Lits.
248 |     static bool _LitVecComp(const LitVec & v1, const LitVec & v2) {
249 |       if (v1.size() < v2.size()) return true;
250 |       if (v1.size() > v2.size()) return false;
251 |       for (size_t i = 0; i < v1.size(); ++i) {
252 |         if (v1[i] < v2[i]) return true;
253 |         if (v2[i] < v1[i]) return false;
254 |       }
255 |       return false;
256 |     }
257 |     static bool _LitVecEq(const LitVec & v1, const LitVec & v2) {
258 |       if (v1.size() != v2.size()) return false;
259 |       for (size_t i = 0; i < v1.size(); ++i)
260 |         if (v1[i] != v2[i]) return false;
261 |       return true;
262 |     }
263 |     class LitVecComp {
264 |     public:
265 |       bool operator()(const LitVec & v1, const LitVec & v2) {
266 |         return _LitVecComp(v1, v2);
267 |       }
268 |     };
269 |     typedef set<LitVec, LitVecComp> CubeSet;
270 | 
271 |     // A proof obligation.
272 |     struct Obligation {
273 |       Obligation(size_t st, size_t l, size_t d) :
274 |         state(st), level(l), depth(d) {}
275 |       size_t state;  // Generalize this state...
276 |       size_t level;  // ... relative to this level.
277 |       size_t depth;  // Length of CTI suffix to error.
278 |     };
279 |     class ObligationComp {
280 |     public:
281 |       bool operator()(const Obligation & o1, const Obligation & o2) {
282 |         if (o1.level < o2.level) return true;  // prefer lower levels (required)
283 |         if (o1.level > o2.level) return false;
284 |         if (o1.depth < o2.depth) return true;  // prefer shallower (heuristic)
285 |         if (o1.depth > o2.depth) return false;
286 |         if (o1.state < o2.state) return true;  // canonical final decider
287 |         return false;
288 |       }
289 |     };
290 |     typedef set<Obligation, ObligationComp> PriorityQueue;
291 | 
292 |     // For IC3's overall frame structure.
293 |     struct Frame {
294 |       size_t k;             // steps from initial state
295 |       CubeSet borderCubes;  // additional cubes in this and previous frames
296 |       Minisat::Solver * consecution;
297 |     };
298 |     vector<Frame> frames;
299 | 
300 |     Minisat::Solver * lifts;
301 |     Minisat::Lit notInvConstraints;
302 | 
303 |     // Push a new Frame.
304 |     void extend() {
305 |       while (frames.size() < k+2) {
306 |         frames.resize(frames.size()+1);
307 |         Frame & fr = frames.back();
308 |         fr.k = frames.size()-1;
309 |         fr.consecution = model.newSolver();
310 |         if (random) {
311 |           fr.consecution->random_seed = rand();
312 |           fr.consecution->rnd_init_act = true;
313 |         }
314 |         if (fr.k == 0) model.loadInitialCondition(*fr.consecution);
315 |         model.loadTransitionRelation(*fr.consecution);
316 |       }
317 |     }
318 | 
319 |     // Structure and methods for imposing priorities on literals
320 |     // through ordering the dropping of literals in mic (drop leftmost
321 |     // literal first) and assumptions to Minisat.  The implemented
322 |     // ordering prefers to keep literals that appear frequently in
323 |     // addCube() calls.
324 |     struct HeuristicLitOrder {
325 |       HeuristicLitOrder() : _mini(1<<20) {}
326 |       vector<float> counts;
327 |       size_t _mini;
328 |       void count(const LitVec & cube) {
329 |         assert (!cube.empty());
330 |         // assumes cube is ordered
331 |         size_t sz = (size_t) Minisat::toInt(Minisat::var(cube.back()));
332 |         if (sz >= counts.size()) counts.resize(sz+1);
333 |         _mini = (size_t) Minisat::toInt(Minisat::var(cube[0]));
334 |         for (LitVec::const_iterator i = cube.begin(); i != cube.end(); ++i)
335 |           counts[(size_t) Minisat::toInt(Minisat::var(*i))] += 1;
336 |       }
337 |       void decay() {
338 |         for (size_t i = _mini; i < counts.size(); ++i)
339 |           counts[i] *= 0.99;
340 |       }
341 |     } litOrder;
342 | 
343 |     struct SlimLitOrder {
344 |       HeuristicLitOrder *heuristicLitOrder;
345 | 
346 |       SlimLitOrder() {}
347 | 
348 |       bool operator()(const Minisat::Lit & l1, const Minisat::Lit & l2) const {
349 |         // l1, l2 must be unprimed
350 |         size_t i2 = (size_t) Minisat::toInt(Minisat::var(l2));
351 |         if (i2 >= heuristicLitOrder->counts.size()) return false;
352 |         size_t i1 = (size_t) Minisat::toInt(Minisat::var(l1));
353 |         if (i1 >= heuristicLitOrder->counts.size()) return true;
354 |         return (heuristicLitOrder->counts[i1] < heuristicLitOrder->counts[i2]);
355 |       }
356 |     } slimLitOrder;
357 | 
358 |     float numLits, numUpdates;
359 |     void updateLitOrder(const LitVec & cube, size_t level) {
360 |       litOrder.decay();
361 |       numUpdates += 1;
362 |       numLits += cube.size();
363 |       litOrder.count(cube);
364 |     }
365 | 
366 |     // order according to preference
367 |     void orderCube(LitVec & cube) {
368 |       stable_sort(cube.begin(), cube.end(), slimLitOrder);
369 |     }
370 | 
371 |     typedef Minisat::vec<Minisat::Lit> MSLitVec;
372 | 
373 |     // Orders assumptions for Minisat.
374 |     void orderAssumps(MSLitVec & cube, bool rev, int start = 0) {
375 |       stable_sort(cube + start, cube + cube.size(), slimLitOrder);
376 |       if (rev) reverse(cube + start, cube + cube.size());
377 |     }
378 | 
379 |     // Assumes that last call to fr.consecution->solve() was
380 |     // satisfiable.  Extracts state(s) cube from satisfying
381 |     // assignment.
382 |     size_t stateOf(Frame & fr, size_t succ = 0) {
383 |       // create state
384 |       size_t st = newState();
385 |       state(st).successor = succ;
386 |       MSLitVec assumps;
387 |       assumps.capacity(1 + 2 * (model.endInputs()-model.beginInputs())
388 |                        + (model.endLatches()-model.beginLatches()));
389 |       Minisat::Lit act = Minisat::mkLit(lifts->newVar());  // activation literal
390 |       assumps.push(act);
391 |       Minisat::vec<Minisat::Lit> cls;
392 |       cls.push(~act);
393 |       cls.push(notInvConstraints);  // successor must satisfy inv. constraint
394 |       if (succ == 0)
395 |         cls.push(~model.primedError());
396 |       else
397 |         for (LitVec::const_iterator i = state(succ).latches.begin(); 
398 |              i != state(succ).latches.end(); ++i)
399 |           cls.push(model.primeLit(~*i));
400 |       lifts->addClause_(cls);
401 |       // extract and assert primary inputs
402 |       for (VarVec::const_iterator i = model.beginInputs(); 
403 |            i != model.endInputs(); ++i) {
404 |         Minisat::lbool val = fr.consecution->modelValue(i->var());
405 |         if (val != Minisat::l_Undef) {
406 |           Minisat::Lit pi = i->lit(val == Minisat::l_False);
407 |           state(st).inputs.push_back(pi);  // record full inputs
408 |           assumps.push(pi);
409 |         }
410 |       }
411 |       // some properties include inputs, so assert primed inputs after        
412 |       for (VarVec::const_iterator i = model.beginInputs(); 
413 |            i != model.endInputs(); ++i) {
414 |         Minisat::lbool pval = 
415 |           fr.consecution->modelValue(model.primeVar(*i).var());
416 |         if (pval != Minisat::l_Undef)
417 |           assumps.push(model.primeLit(i->lit(pval == Minisat::l_False)));
418 |       }
419 |       int sz = assumps.size();
420 |       // extract and assert latches
421 |       LitVec latches;
422 |       for (VarVec::const_iterator i = model.beginLatches(); 
423 |            i != model.endLatches(); ++i) {
424 |         Minisat::lbool val = fr.consecution->modelValue(i->var());
425 |         if (val != Minisat::l_Undef) {
426 |           Minisat::Lit la = i->lit(val == Minisat::l_False);
427 |           latches.push_back(la);
428 |           assumps.push(la);
429 |         }
430 |       }
431 |       orderAssumps(assumps, false, sz);  // empirically found to be best choice
432 |       // State s, inputs i, transition relation T, successor t:
433 |       //   s & i & T & ~t' is unsat
434 |       // Core assumptions reveal a lifting of s.
435 |       ++nQuery; startTimer();  // stats
436 |       bool rv = lifts->solve(assumps);
437 |       endTimer(satTime);
438 |       assert (!rv);
439 |       // obtain lifted latch set from unsat core
440 |       for (LitVec::const_iterator i = latches.begin(); i != latches.end(); ++i)
441 |         if (lifts->conflict.has(~*i))
442 |           state(st).latches.push_back(*i);  // record lifted latches
443 |       // deactivate negation of successor
444 |       lifts->releaseVar(~act);
445 |       return st;
446 |     }
447 | 
448 |     // Checks if cube contains any initial states.
449 |     bool initiation(const LitVec & latches) {
450 |       return !model.isInitial(latches);
451 |     }
452 | 
453 |     // Check if ~latches is inductive relative to frame fi.  If it's
454 |     // inductive and core is provided, extracts the unsat core.  If
455 |     // it's not inductive and pred is provided, extracts
456 |     // predecessor(s).
457 |     bool consecution(size_t fi, const LitVec & latches, size_t succ = 0,
458 |                      LitVec * core = NULL, size_t * pred = NULL, 
459 |                      bool orderedCore = false)
460 |     {
461 |       Frame & fr = frames[fi];
462 |       MSLitVec assumps, cls;
463 |       assumps.capacity(1 + latches.size());
464 |       cls.capacity(1 + latches.size());
465 |       Minisat::Lit act = Minisat::mkLit(fr.consecution->newVar());
466 |       assumps.push(act);
467 |       cls.push(~act);
468 |       for (LitVec::const_iterator i = latches.begin(); 
469 |            i != latches.end(); ++i) {
470 |         cls.push(~*i);
471 |         assumps.push(*i);  // push unprimed...
472 |       }
473 |       // ... order... (empirically found to best choice)
474 |       if (pred) orderAssumps(assumps, false, 1);
475 |       else orderAssumps(assumps, orderedCore, 1);
476 |       // ... now prime
477 |       for (int i = 1; i < assumps.size(); ++i)
478 |         assumps[i] = model.primeLit(assumps[i]);
479 |       fr.consecution->addClause_(cls);
480 |       // F_fi & ~latches & T & latches'
481 |       ++nQuery; startTimer();  // stats
482 |       bool rv = fr.consecution->solve(assumps);
483 |       endTimer(satTime);
484 |       if (rv) {
485 |         // fails: extract predecessor(s)
486 |         if (pred) *pred = stateOf(fr, succ);
487 |         fr.consecution->releaseVar(~act);
488 |         return false;
489 |       }
490 |       // succeeds
491 |       if (core) {
492 |         if (pred && orderedCore) {
493 |           // redo with correctly ordered assumps
494 |           reverse(assumps+1, assumps+assumps.size());
495 |           ++nQuery; startTimer();  // stats
496 |           rv = fr.consecution->solve(assumps);
497 |           assert (!rv);
498 |           endTimer(satTime);
499 |         }
500 |         for (LitVec::const_iterator i = latches.begin(); 
501 |              i != latches.end(); ++i)
502 |           if (fr.consecution->conflict.has(~model.primeLit(*i)))
503 |             core->push_back(*i);
504 |         if (!initiation(*core))
505 |           *core = latches;
506 |       }
507 |       fr.consecution->releaseVar(~act);
508 |       return true;
509 |     }
510 | 
511 |     size_t maxDepth, maxCTGs, maxJoins, micAttempts;
512 | 
513 |     // Based on
514 |     //
515 |     //   Zyad Hassan, Aaron R. Bradley, and Fabio Somenzi, "Better
516 |     //   Generalization in IC3," (submitted May 2013)
517 |     //
518 |     // Improves upon "down" from the original paper (and the FMCAD'07
519 |     // paper) by handling CTGs.
520 |     bool ctgDown(size_t level, LitVec & cube, size_t keepTo, size_t recDepth) {
521 |       size_t ctgs = 0, joins = 0;
522 |       while (true) {
523 |         // induction check
524 |         if (!initiation(cube))
525 |           return false;
526 |         if (recDepth > maxDepth) {
527 |           // quick check if recursion depth is exceeded
528 |           LitVec core;
529 |           bool rv = consecution(level, cube, 0, &core, NULL, true);
530 |           if (rv && core.size() < cube.size()) {
531 |             ++nCoreReduced;  // stats
532 |             cube = core;
533 |           }
534 |           return rv;
535 |         }
536 |         // prepare to obtain CTG
537 |         size_t cubeState = newState();
538 |         state(cubeState).successor = 0;
539 |         state(cubeState).latches = cube;
540 |         size_t ctg;
541 |         LitVec core;
542 |         if (consecution(level, cube, cubeState, &core, &ctg, true)) {
543 |           if (core.size() < cube.size()) {
544 |             ++nCoreReduced;  // stats
545 |             cube = core;
546 |           }
547 |           // inductive, so clean up
548 |           delState(cubeState);
549 |           return true;
550 |         }
551 |         // not inductive, address interfering CTG
552 |         LitVec ctgCore;
553 |         bool ret = false;
554 |         if (ctgs < maxCTGs && level > 1 && initiation(state(ctg).latches)
555 |             && consecution(level-1, state(ctg).latches, cubeState, &ctgCore)) {
556 |           // CTG is inductive relative to level-1; push forward and generalize
557 |           ++nCTG;  // stats
558 |           ++ctgs;
559 |           size_t j = level;
560 |           // QUERY: generalize then push or vice versa?
561 |           while (j <= k && consecution(j, ctgCore)) ++j;
562 |           mic(j-1, ctgCore, recDepth+1);
563 |           addCube(j, ctgCore);
564 |         }
565 |         else if (joins < maxJoins) {
566 |           // ran out of CTG attempts, so join instead
567 |           ctgs = 0;
568 |           ++joins;
569 |           LitVec tmp;
570 |           for (size_t i = 0; i < cube.size(); ++i)
571 |             if (binary_search(state(ctg).latches.begin(), 
572 |                               state(ctg).latches.end(), cube[i]))
573 |               tmp.push_back(cube[i]);
574 |             else if (i < keepTo) {
575 |               // previously failed when this literal was dropped
576 |               ++nAbortJoin;  // stats
577 |               ret = true;
578 |               break;
579 |             }
580 |           cube = tmp;  // enlarged cube
581 |         }
582 |         else
583 |           ret = true;
584 |         // clean up
585 |         delState(cubeState);
586 |         delState(ctg);
587 |         if (ret) return false;
588 |       }
589 |     }
590 | 
591 |     // Extracts minimal inductive (relative to level) subclause from
592 |     // ~cube --- at least that's where the name comes from.  With
593 |     // ctgDown, it's not quite a MIC anymore, but what's returned is
594 |     // inductive relative to the possibly modifed level.
595 |     void mic(size_t level, LitVec & cube, size_t recDepth) {
596 |       ++nmic;  // stats
597 |       // try dropping each literal in turn
598 |       size_t attempts = micAttempts;
599 |       orderCube(cube);
600 |       for (size_t i = 0; i < cube.size();) {
601 |         LitVec cp(cube.begin(), cube.begin() + i);
602 |         cp.insert(cp.end(), cube.begin() + i+1, cube.end());
603 |         if (ctgDown(level, cp, i, recDepth)) {
604 |           // maintain original order
605 |           LitSet lits(cp.begin(), cp.end());
606 |           LitVec tmp;
607 |           for (LitVec::const_iterator j = cube.begin(); j != cube.end(); ++j)
608 |             if (lits.find(*j) != lits.end())
609 |               tmp.push_back(*j);
610 |           cube.swap(tmp);
611 |           // reset attempts
612 |           attempts = micAttempts;
613 |         }
614 |         else {
615 |           if (!--attempts) {
616 |             // Limit number of attempts: if micAttempts literals in a
617 |             // row cannot be dropped, conclude that the cube is just
618 |             // about minimal.  Definitely improves mics/second to use
619 |             // a low micAttempts, but does it improve overall
620 |             // performance?
621 |             ++nAbortMic;  // stats
622 |             return;
623 |           }
624 |           ++i;
625 |         }
626 |       }
627 |     }
628 | 
629 |     // wrapper to start inductive generalization
630 |     void mic(size_t level, LitVec & cube) {
631 |       mic(level, cube, 1);
632 |     }
633 | 
634 |     size_t earliest;  // track earliest modified level in a major iteration
635 | 
636 |     // Adds cube to frames at and below level, unless !toAll, in which
637 |     // case only to level.
638 |     void addCube(size_t level, LitVec & cube, bool toAll = true, 
639 |                  bool silent = false)
640 |     {
641 |       sort(cube.begin(), cube.end());
642 |       pair<CubeSet::iterator, bool> rv = frames[level].borderCubes.insert(cube);
643 |       if (!rv.second) return;
644 |       if (!silent && verbose > 1) 
645 |         cout << level << ": " << stringOfLitVec(cube) << endl;
646 |       earliest = min(earliest, level);
647 |       MSLitVec cls;
648 |       cls.capacity(cube.size());
649 |       for (LitVec::const_iterator i = cube.begin(); i != cube.end(); ++i)
650 |         cls.push(~*i);
651 |       for (size_t i = toAll ? 1 : level; i <= level; ++i)
652 |         frames[i].consecution->addClause(cls);
653 |       if (toAll && !silent) updateLitOrder(cube, level);
654 |     }
655 | 
656 |     // ~cube was found to be inductive relative to level; now see if
657 |     // we can do better.
658 |     size_t generalize(size_t level, LitVec cube) {
659 |       // generalize
660 |       mic(level, cube);
661 |       // push
662 |       do { ++level; } while (level <= k && consecution(level, cube));
663 |       addCube(level, cube);
664 |       return level;
665 |     }
666 | 
667 |     size_t cexState;  // beginning of counterexample trace
668 | 
669 |     // Process obligations according to priority.
670 |     bool handleObligations(PriorityQueue obls) {
671 |       while (!obls.empty()) {
672 |         PriorityQueue::iterator obli = obls.begin();
673 |         Obligation obl = *obli;
674 |         LitVec core;
675 |         size_t predi;
676 |         // Is the obligation fulfilled?
677 |         if (consecution(obl.level, state(obl.state).latches, obl.state, 
678 |                         &core, &predi)) {
679 |           // Yes, so generalize and possibly produce a new obligation
680 |           // at a higher level.
681 |           obls.erase(obli);
682 |           size_t n = generalize(obl.level, core);
683 |           if (n <= k)
684 |             obls.insert(Obligation(obl.state, n, obl.depth));
685 |         }
686 |         else if (obl.level == 0) {
687 |           // No, in fact an initial state is a predecessor.
688 |           cexState = predi;
689 |           return false;
690 |         }
691 |         else {
692 |           ++nCTI;  // stats
693 |           // No, so focus on predecessor.
694 |           obls.insert(Obligation(predi, obl.level-1, obl.depth+1));
695 |         }
696 |       }
697 |       return true;
698 |     }
699 | 
700 |     bool trivial;  // indicates whether strengthening was required
701 |                    // during major iteration
702 | 
703 |     // Strengthens frontier to remove error successors.
704 |     bool strengthen() {
705 |       Frame & frontier = frames[k];
706 |       trivial = true;  // whether any cubes are generated
707 |       earliest = k+1;  // earliest frame with enlarged borderCubes
708 |       while (true) {
709 |         ++nQuery; startTimer();  // stats
710 |         bool rv = frontier.consecution->solve(model.primedError());
711 |         endTimer(satTime);
712 |         if (!rv) return true;
713 |         // handle CTI with error successor
714 |         ++nCTI;  // stats
715 |         trivial = false;
716 |         PriorityQueue pq;
717 |         // enqueue main obligation and handle
718 |         pq.insert(Obligation(stateOf(frontier), k-1, 1));
719 |         if (!handleObligations(pq))
720 |           return false;
721 |         // finished with States for this iteration, so clean up
722 |         resetStates();
723 |       }
724 |     }
725 | 
726 |     // Propagates clauses forward using induction.  If any frame has
727 |     // all of its clauses propagated forward, then two frames' clause
728 |     // sets agree; hence those clause sets are inductive
729 |     // strengthenings of the property.  See the four invariants of IC3
730 |     // in the original paper.
731 |     bool propagate() {
732 |       if (verbose > 1) cout << "propagate" << endl;
733 |       // 1. clean up: remove c in frame i if c appears in frame j when i < j
734 |       CubeSet all;
735 |       for (size_t i = k+1; i >= earliest; --i) {
736 |         Frame & fr = frames[i];
737 |         CubeSet rem, nall;
738 |         set_difference(fr.borderCubes.begin(), fr.borderCubes.end(),
739 |                        all.begin(), all.end(),
740 |                        inserter(rem, rem.end()), LitVecComp());
741 |         if (verbose > 1)
742 |           cout << i << " " << fr.borderCubes.size() << " " << rem.size() << " ";
743 |         fr.borderCubes.swap(rem);
744 |         set_union(rem.begin(), rem.end(),
745 |                   all.begin(), all.end(), 
746 |                   inserter(nall, nall.end()), LitVecComp());
747 |         all.swap(nall);
748 |         for (CubeSet::const_iterator i = fr.borderCubes.begin(); 
749 |              i != fr.borderCubes.end(); ++i)
750 |           assert (all.find(*i) != all.end());
751 |         if (verbose > 1)
752 |           cout << all.size() << endl;
753 |       }
754 |       // 2. check if each c in frame i can be pushed to frame j
755 |       for (size_t i = trivial ? k : 1; i <= k; ++i) {
756 |         int ckeep = 0, cprop = 0, cdrop = 0;
757 |         Frame & fr = frames[i];
758 |         for (CubeSet::iterator j = fr.borderCubes.begin(); 
759 |              j != fr.borderCubes.end();) {
760 |           LitVec core;
761 |           if (consecution(i, *j, 0, &core)) {
762 |             ++cprop;
763 |             // only add to frame i+1 unless the core is reduced
764 |             addCube(i+1, core, core.size() < j->size(), true);
765 |             CubeSet::iterator tmp = j;
766 |             ++j;
767 |             fr.borderCubes.erase(tmp);
768 |           }
769 |           else {
770 |             ++ckeep;
771 |             ++j;
772 |           }
773 |         }
774 |         if (verbose > 1)
775 |           cout << i << " " << ckeep << " " << cprop << " " << cdrop << endl;
776 |         if (fr.borderCubes.empty())
777 |           return true;
778 |       }
779 |       // 3. simplify frames
780 |       for (size_t i = trivial ? k : 1; i <= k+1; ++i)
781 |         frames[i].consecution->simplify();
782 |       lifts->simplify();
783 |       return false;
784 |     }
785 | 
786 |     int nQuery, nCTI, nCTG, nmic;
787 |     clock_t startTime, satTime;
788 |     int nCoreReduced, nAbortJoin, nAbortMic;
789 |     clock_t time() {
790 |       struct tms t;
791 |       times(&t);
792 |       return t.tms_utime;
793 |     }
794 |     clock_t timer;
795 |     void startTimer() { timer = time(); }
796 |     void endTimer(clock_t & t) { t += (time() - timer); }
797 |     void printStats() {
798 |       if (!verbose) return;
799 |       clock_t etime = time();
800 |       cout << ". Elapsed time: " << ((double) etime / sysconf(_SC_CLK_TCK)) << endl;
801 |       etime -= startTime;
802 |       if (!etime) etime = 1;
803 |       cout << ". % SAT:        " << (int) (100 * (((double) satTime) / ((double) etime))) << endl;
804 |       cout << ". K:            " << k << endl;
805 |       cout << ". # Queries:    " << nQuery << endl;
806 |       cout << ". # CTIs:       " << nCTI << endl;
807 |       cout << ". # CTGs:       " << nCTG << endl;
808 |       cout << ". # mic calls:  " << nmic << endl;
809 |       cout << ". Queries/sec:  " << (int) (((double) nQuery) / ((double) etime) * sysconf(_SC_CLK_TCK)) << endl;
810 |       cout << ". Mics/sec:     " << (int) (((double) nmic) / ((double) etime) * sysconf(_SC_CLK_TCK)) << endl;
811 |       cout << ". # Red. cores: " << nCoreReduced << endl;
812 |       cout << ". # Int. joins: " << nAbortJoin << endl;
813 |       cout << ". # Int. mics:  " << nAbortMic << endl;
814 |       if (numUpdates) cout << ". Avg lits/cls: " << numLits / numUpdates << endl;
815 |     }
816 | 
817 |     friend bool check(Model &, int, bool, bool);
818 | 
819 |   };
820 | 
821 |   // IC3 does not check for 0-step and 1-step reachability, so do it
822 |   // separately.
823 |   bool baseCases(Model & model) {
824 |     Minisat::Solver * base0 = model.newSolver();
825 |     model.loadInitialCondition(*base0);
826 |     model.loadError(*base0);
827 |     bool rv = base0->solve(model.error());
828 |     delete base0;
829 |     if (rv) return false;
830 | 
831 |     Minisat::Solver * base1 = model.newSolver();
832 |     model.loadInitialCondition(*base1);
833 |     model.loadTransitionRelation(*base1);
834 |     rv = base1->solve(model.primedError());
835 |     delete base1;
836 |     if (rv) return false;
837 | 
838 |     model.lockPrimes();
839 | 
840 |     return true;
841 |   }
842 | 
843 |   // External function to make the magic happen.
844 |   bool check(Model & model, int verbose, bool basic, bool random) {
845 |     if (!baseCases(model))
846 |       return false;
847 |     IC3 ic3(model);
848 |     ic3.verbose = verbose;
849 |     if (basic) {
850 |       ic3.maxDepth = 0;
851 |       ic3.maxJoins = 0;
852 |       ic3.maxCTGs = 0;
853 |     }
854 |     if (random) ic3.random = true;
855 |     bool rv = ic3.check();
856 |     if (!rv && verbose > 1) ic3.printWitness();
857 |     if (verbose) ic3.printStats();
858 |     return rv;
859 |   }
860 | 
861 | }
862 | 


--------------------------------------------------------------------------------