Invariant Checking of NRA Transition Systems via Incremental Reduction to LRA with EUF

Abstract

Model checking invariant properties of designs, represented as transition systems, with non-linear real arithmetic (NRA), is an important though very hard problem. On the one hand NRA is a hard-to-solve theory; on the other hand most of the powerful model checking techniques lack support for NRA. In this paper, we present a counterexample-guided abstraction refinement (CEGAR) approach that leverages linearization techniques from differential calculus to enable the use of mature and efficient model checking algorithms for transition systems on linear real arithmetic (LRA) with uninterpreted functions (EUF). The results of an empirical evaluation confirm the validity and potential of this approach.This work was performed as part of the H2020-and to proceed incrementally. These extra functions are usually not available, or they have a very high computational cost.In this paper, we propose a completely different approach to tackle invariant checking for NRA transition systems. Basically, we work with an abstract version of the transition system, expressed over LRA with EUF, for which we have effective verification tools [9]. In the abstract space, nonlinear multiplication is modeled as an uninterpreted function. When spurious counter-examples are found, the abstraction is tightened by the incremental introduction of linear constraints, including tangent planes resulting from differential calculus, and monotonicity constraints.We implemented the approach on top of the NUXMV model checker [7], leveraging the IC3 engine with Implicit Abstraction [9] for invariant checking of transition systems over LRA with EUF. We compared it, on a wide set of benchmarks, against multiple approaches working at NRA level, including BMC and k-induction using SMT(NRA), the recent interpolation-based ISAT3 engine [24], and the static abstraction approach proposed in [8]. The results demonstrate substantial superiority of our approach, that is able to solve the highest number of benchmarks.The effectiveness of our approach is possibly explained with the following insights. On the one hand, in contrast to LRA, NRA is a hard-to-solve theory: in practice, most available complete solvers rely on CAD techniques [12], which require double exponential time in worst case. Thus, we try to avoid NRA reasoning, trading it for LRA and EUF reasoning. On the other hand, proving properties of practical NRA transition systems may not require the full power of non-linear solving. In fact, some systems are "mostly-linear" (i.e. non-linear constraints are associated to a very small part of the system), an example being the Transport Class Model (TCM) for aircraft simulation from the Simulink model library [19]. Furthermore, even NRA transition systems with significant non-linear dynamics may admit a piecewise-linear invariant of the transition system that is strong enough to prove the property.Structure. In Sec. 2 we discuss the related work, and in Sec. 3 introduce some background. In Sec. 4 we discuss the approach in the setting of SMT(NRA). In Sec. 5 we pr...

Satisfiability Modulo Transcendental Functions via Incremental Linearization

“…If ϕ contains also non-linear polynomials, we handle them as described in [5]: we replace each non-linear product t 1 * t 2 with an uninterpreted function application f mul(t 1 , t 2 ), and add to the input formula some initial axioms expressing general, simple mathematical properties of multiplications. (We refer the reader to [5] for details. )…”

“…First, if the formula contains also some non-linear polynomials, check-refine performs the refinement of non-linear multiplications as described in [5]. In Fig.…”

“…In this section, we describe the implementation of the poly-approx and refine-extra for the transcendental functions that we currently support, namely exp and sin. 5 The poly-approx(tf (x), c, ) function uses the Maclaurin series of the corresponding transcendental function and Taylor's theorem to find the lower and upper polynomials. Essentially, this is done by expanding the series (and the remainder approximation) up to a certain n, until the desired precision (i.e.…”

Theory Refinement for Program Verification

“…This approach can be viewed as a special case of the framework we present in this paper; the formulas we derive can also be used for generating test cases, although this is not the focus of this paper. Similarly, [10] combines linear real arithmetic and equality of uninterpreted functions (QF UF) for the SMT encoding of the program. The algorithm initially uses QF UF to abstract non-linear operators, and then uses the monotonicity and the multiplication checks to identify spurious counterexample thus avoiding simulation and code execution.…”

SC-square: when Satisfiability Checking and Symbolic Computation join forces

“…Motivated by the observation that in many important application domains systems are "mostly-linear", the authors of [11] propose a counterexample-guided abstraction refinement approach to work with abstractions expressed over linear arithmetic with uninterpreted functions, where nonlinear multiplication is modeled as an uninterpreted function. If the solver finds a solution for the linear abstraction which does not satisfy the concrete non-linear problem (i.e., a spurious counterexample), then the abstraction is tightened by adding new linear constraints, including tangent planes resulting from differential calculus, and monotonicity constraints.…”