Counterexample-Preserving Reduction for Symbolic Model Checking

Algorithm 2

Framework of the PDR algorithm.

  Input: The components 𝒱, 𝜌, 𝜃₀ of the model 𝑀; a safety property 𝜃.

  Output: The affirmative answer if 𝑀 is safe w.r.t. 𝜃; otherwise, a counterexample witnessing that ¬𝜃 is reachable.

  (1) let  𝑘∶=0;

 (2) let  Γ₀={𝜃₀};

 (3) let  𝐐∶=∅; /* 𝐐 is a priority queue */

 (4) repeat

 (5)   while there exists  𝒰⊆𝒱 s.t. 𝒰⊩Γ_𝑘∧¬𝜃  do

 (6)   add (𝒰,𝑘) to the head of  𝐐;

 (7)   if  strengthen({Γ_𝑖}_𝑖⩽𝑘,𝐐,𝒱) fails then

 (8)     return counterexample extracted from 𝐐;

 (9)   end

  (10)   propagate({Γ_𝑖}_𝑖⩽𝑘);

   (11)   if there exists some 𝑗≤𝑘 s.t.  Γ_𝑗=Γ_(𝑗−1)  then

  (12)     return “M is safe from 𝜃”;

  (13)   end

  (14)   let  Γ_𝑘+1∶=∅;

  (15)   𝑘∶=𝑘+1;

  (16)   end

  (17) until 1≠1;