Abstract
We present LTPDR, a latticetheoretic generalization of Bradley’s property directed reachability analysis (PDR) algorithm. LTPDR identifies the essence of PDR to be an ingenious combination of verification and refutation attempts based on the Knaster–Tarski and Kleene theorems. We introduce four concrete instances of LTPDR, derive their implementation from a generic Haskell implementation of LTPDR, and experimentally evaluate them. We also present a categorical structural theory that derives these instances.
Keywords
 Property directed reachability analysis
 Model checking
 Lattice theory
 Fixed point theory
 Category theory
The authors are supported by ERATO HASUO Metamathematics for Systems Design Project (No. JPMJER1603). MK is a JSPS DC fellow and supported by JSPS KAKENHI Grant (No. 22J21742). KS is supported by JST CREST Grant (No. JPMJCR2012) and JSPS KAKENHI Grant (No. 19H04084).
Download conference paper PDF
1 Introduction
Property directed reachability (PDR) (also called IC3) introduced in [9, 13] is a model checking algorithm for proving/disproving safety problems. It has been successfully applied to software and hardware model checking, and later it has been extended in several directions, including fbPDR [25, 26] that uses both forward and backward predicate transformers and PrIC3 [6] for the quantitative safety problem for probabilistic systems. See [14] for a concise overview.
The original PDR assumes that systems are given by binary predicates representing transition relations. The PDR algorithm maintains data structures called frames and proof obligations—these are collections of predicates over states—and updates them. While this logicbased description immediately yields automated tools using SAT/SMT solvers, it limits target systems to qualitative and nondeterministic ones. This limitation was first overcome by PrIC3 [6] whose target is probabilistic systems. This suggests room for further generalization of PDR.
In this paper, we propose the first lattice theorybased generalization of the PDR algorithm; we call it LTPDR. This makes the PDR algorithm apply to a wider class of safety problems, including qualitative and quantitative. We also derive a new concrete extension of PDR, namely one for Markov reward models.
We implemented the general algorithm LTPDR in Haskell, in a way that maintains the theoretical abstraction and clarity. Deriving concrete instances for various types of systems is easy (for Kripke structures, probabilistic systems, etc.). We conducted an experimental evaluation, which shows that these easilyobtained instances have at least reasonable performance.
Preview of the Theoretical Contribution. We generalize the PDR algorithm so that it operates over an arbitrary complete lattice L. This generalization recasts the PDR algorithm to solve a general problem \(\mu F\le ^{?}\alpha \) of overapproximating the least fixed point of an \(\omega \)continuous function \(F:L\rightarrow L\) by a safety property \(\alpha \). This latticetheoretic generalization signifies the relationship between the PDR algorithm and the theory of fixed points. This also allows us to incorporate quantitative predicates suited for probabilistic verification.
More specifically, we reconstruct the original PDR algorithm as a combination of two constituent parts. They are called positive LTPDR and negative LTPDR. Positive LTPDR comes from a witnessbased proof method by the Knaster–Tarski fixed point theorem, and aims to verify \(\mu F\le ^{?}\alpha \). In contrast, negative LTPDR comes from the Kleene fixed point theorem and aims to refute \(\mu F\le ^{?}\alpha \). The two algorithms build up witnesses in an iterative and nondeterministic manner, where nondeterminism accommodates guesses and heuristics. We identify the essence of PDR to be an ingenious combination of these two algorithms, in which intermediate results on one side (positive or negative) give informed guesses on the other side. This is how we formulate LTPDR in Sect. 3.3.
We discuss several instances of our general theory of PDR. We discuss three concrete settings: Kripke structures (where we obtain two instances of LTPDR), Markov decision processes (MDPs), and Markov reward models. The two in the first setting essentially subsume many existing PDR algorithms, such as the original PDR [9, 13] and Reverse PDR [25, 26], and the one for MDPs resembles PrIC3 [6]. The last one (Markov reward models) is a new algorithm that fully exploits the generality of our framework.
In fact, there is another dimension of theoretical generalization: the derivation of the above concrete instances follows a structural theory of statebased dynamics and predicate transformers. We formulate the structural theory in the language of category theory [3, 23]—using especially coalgebras [17] and fibrations [18]—following works such as [8, 15, 21, 28]. The structural theory tells us which safety problems arise under what conditions; it can therefore suggest that certain safety problems are unlikely to be formulatable, too. The structural theory is important because it builds a mathematical order in the PDR literature, in which theoretical developments tend to be closely tied to implementation and thus theoretical essences are often not very explicit. For example, the theory is useful in classifying a plethora of PDRlike algorithms for Kripke structures (the original, Reverse PDR, fbPDR, etc.). See Sect. 5.1.
We present the above structural theory in Sect. 4 and briefly discuss its use in the derivation of concrete instances in Sect. 5. We note, however, that this categorical theory is not needed for reading and using the other parts of the paper.
There are other works on generalization of PDR [16, 24], but our identification of the interplay of Knaster–Tarski and Kleene is new. They do not accommodate probabilistic verification, either. See [22, Appendix A] for further discussions.
Preliminaries. Let \((L,\le )\) be a poset. \((L,\le )^\mathrm {op}\) denotes the opposite poset \((L,\ge )\). Note that if \((L,\le )\) is a complete lattice then so is \((L,\le )^\mathrm {op}\). An \(\omega \)chain (resp. \(\omega ^{op}\)chain) in L is an \(\mathbb {N}\)indexed family of increasing (resp. decreasing) elements in L. A monotone function \(F:L\rightarrow L\) is \(\omega \)continuous (resp. \(\omega ^{op}\)continuous) if F preserves existing suprema of \(\omega \)chains (resp. infima of \(\omega ^\mathrm {op}\)chains).
2 Fixedpoints in Complete Lattices
Let \((L, \le )\) be a complete lattice and \(F: L \rightarrow L\) be a monotone function. When we analyze fixed points of F, pre/postfixed points play important roles.
Definition 2.1
A prefixed point of F is an element \(x \in L\) satisfying \(Fx \le x\). A postfixed point of F is an element \(x \in L\) satisfying \(x \le Fx\). We write \(\mathbf {Pre}(F)\) and \(\mathbf {Post}(F)\) for the set of prefixed points and postfixed points of F, respectively.
The following results are central in fixed point theory. They allow us to under/overapproximate the least/greatest fixed points.
Theorem 2.2
A monotone endofunction F on a complete lattice \((L, \le )\) has the least fixed point \(\mu F\) and the greatest fixed point \(\nu F\). Moreover,

1.
(Knaster–Tarski [30]) The set of fixed points forms a complete lattice. Furthermore, \(\mu F = \bigwedge \{x \in L \mid Fx \le x\}\) and \(\nu F = \bigvee \{x \in L \mid x \le Fx\}\).

2.
(Kleene, see e.g. [5]) If F is \(\omega \)continuous, \(\mu F=\bigvee _{n \in \mathbb {N}} F^n\bot \). Dually, if F is \(\omega ^\mathrm {op}\)continuous, \(\nu F = \bigwedge _{n \in \mathbb {N}} F^n\top \). \(\square \)
Theorem 2.2.2 is known to hold for arbitrary \(\omega \)cpos (complete lattices are their special case). A generalization of Theorem 2.2.2 is the Cousot–Cousot characterization [11], where F is assumed to be monotone (but not necessarily \(\omega \)continuous) and we have \(\mu F=F^\kappa \bot \) for a sufficiently large, possibly transfinite, ordinal \(\kappa \). In this paper, for the algorithmic study of PDR, we assume the \(\omega \)continuity of F. Note that \(\omega \)continuous F on a complete lattice is necessarily monotone.
We call the \(\omega \)chain \(\bot \le F\bot \le \cdots \) the initial chain of F and the \(\omega ^\mathrm {op}\)chain \(\top \ge F\top \ge \cdots \) the final chain of F. These appear in Theorem 2.2.2.
Theorem 2.2.1 and 2.2.2 yield the following witness notions for proving and disproving \(\mu F \le \alpha \), respectively.
Corollary 2.3
Let \((L,\le )\) be a complete lattice and \(F:L\rightarrow L\) be \(\omega \)continuous.

1.
(KT) \(\mu F \le \alpha \) if and only if there is \(x\in L\) such that \(Fx \le x\le \alpha \).

2.
(Kleene) \(\mu F \not \le \alpha \) if and only if there is \(n\in \mathbb {N}\) and \(x \in L\) such that \(x \le F^n \bot \) and \(x \not \le \alpha \). \(\square \)
By Corollary 2.3.1, proving \(\mu F \le \alpha \) is reduced to searching for \(x\in L\) such that \(Fx \le x\le \alpha \). We call such x a KT (positive) witness. In contrast, by Corollary 2.3.2, disproving \(\mu F \le \alpha \) is reduced to searching for \(n\in \mathbb {N}\) and \(x \in L\) such that \(x \le F^n \bot \) and \(x \not \le \alpha \). We call such x a Kleene (negative) witness.
Notation 2.4
We shall use lowercase (Roman and Greek) letters for elements of L (such as \(\alpha , x\in L\)), and uppercase letters for (finite or infinite) sequences of L (such as \(X\in L^{*}\) or \(L^{\omega }\)). The ith (or \((ij)\)th when subscripts are started from j) element of a sequence X is designated by a subscript: \(X_{i}\in L\).
3 LatticeTheoretic Reconstruction of PDR
Towards the LTPDR algorithm, we first introduce two simpler algorithms, called positive LTPDR (Sect. 3.1) and negative LTPDR (Sect. 3.2). The target problem of the LTPDR algorithm is the following:
Definition 3.1
(the LFPOA problem \(\mu F \le ^{?} \alpha \)). Let L be a complete lattice, \(F: L \rightarrow L\) be \(\omega \)continuous, and \(\alpha \in L\). The lfp overapproximation (LFPOA) problem asks if \(\mu F \le \alpha \) holds; the problem is denoted by \(\mu F \le ^{?} \alpha \).
Example 3.2
Consider a transition system, where S be the set of states, \(\iota \subseteq S\) be the set of initial states, \(\delta : S \rightarrow \mathcal {P}S\) be the transition relation, and \(\alpha \subseteq S\) be the set of safe states. Then letting \(L{:}{=}\mathcal {P}S\) and \(F {:}{=}\iota \cup \bigcup _{s \in ()}\delta (s)\), the lfp overapproximation problem \(\mu F \le ^{?} \alpha \) is the problem whether all reachable states are safe. It is equal to the problem studied by the conventional IC3/PDR [9, 13].
Positive LTPDR iteratively builds a KT witness in a bottomup manner that positively answers the LFPOA problem, while negative LTPDR iteratively builds a Kleene witness for the same LFPOA problem. We shall present these two algorithms as clear reflections of two proof principles (Corollary 2.3), each of which comes from the fundamental Knaster–Tarski and Kleene theorems.
The two algorithms build up witnesses in an iterative and nondeterministic manner. The nondeterminism is there for accommodating guesses and heuristics. We identify the essence of PDR to be an ingenious combination of these two algorithms, in which intermediate results on one side (positive or negative) give informed guesses on the other side. This way, each of the positive and negative algorithms provides heuristics in resolving the nondeterminism in the execution of the other. This is how we formulate the LTPDR algorithm in Sect. 3.3.
The dual of LFPOA problem is called the gfpunderapproximation problem (GFPUA): the GFPUA problem for a complete lattice L, an \(\omega ^\mathrm {op}\)continuous function \(F:L\rightarrow L\) and \(\alpha \in L\) is whether the inequality \(\alpha \le \nu F\) holds or not, and is denoted by \(\alpha \le ^{?}\nu F\). It is evident that the GFPUA problem for \((L, F, \alpha )\) is equivalent to the LFPOA problem for \((L^\mathrm {op},F,\alpha )\). This suggests the dual algorithm called LTOpPDR for GFPUA problem. See Remark 3.24 later.
3.1 Positive LTPDR: Sequential Positive Witnesses
We introduce the notion of KT\(^\omega \) witness—a KT witness (Corollary 2.3) constructed in a sequential manner. Positive LTPDR searches for a KT\(^\omega \) witness by growing its finitary approximations (called KT sequences).
Let L be a complete lattice. We regard each element \(x\in L\) as an abstract presentation of a predicate on states. The inequality \(x\le y\) means that the predicate x is stronger than the predicate y. We introduce the complete lattice [n, L] of increasing chains of length \(n\in \mathbb {N}\), whose elements are \((X_0 \le \cdots \le X_{n1})\) in L equipped with the elementwise order. We similarly introduce the complete lattice \([\omega , L]\) of \(\omega \)chains in L. We lift \(F:L\rightarrow L\) to \(F^\# : [\omega , L] \rightarrow [\omega , L]\) and \(F^\#_n: [n, L] \rightarrow [n, L]\) (for \(n \ge 2\)) as follows. Note that the entries are shifted.
Definition 3.3
(\(\mathbf {KT}^{\omega }\) witness). Let \(L,F,\alpha \) be as in Definition 3.1. Define \(\varDelta \alpha := (\alpha \le \alpha \le \cdots )\). A \(\text {KT}^{\omega }\) witness is \(X \in [\omega , L]\) such that \(F^\# X \le X \le \varDelta \alpha \).
Theorem 3.4
Let \(L,F,\alpha \) be as in Definition 3.1. There exists a KT witness (Corollary 2.3) if and only if there exists a \(\text {KT}^{\omega }\)witness. \(\square \)
Concretely, a KT witness x yields a \(\text {KT}^{\omega }\) witness \(x\le x\le \cdots \); a \(\text {KT}^{\omega }\) witness X yields a KT witness \(\bigvee _{n \in \omega } X_{n}\). A full proof (via Galois connections) is in [22].
The initial chain \(\bot \le F\bot \le \cdots \) is always a \(\text {KT}^{\omega }\) witness for \(\mu F \le \alpha \). There are other \(\text {KT}^{\omega }\) witnesses whose growth is accelerated by some heuristic guesses—an extreme example is \(x\le x\le \cdots \) with a KT witness x. \(\text {KT}^{\omega }\) witnesses embrace the spectrum of such different sequential witnesses for \(\mu F\le \alpha \), those which mix routine constructions (i.e. application of F) and heuristic guesses.
Definition 3.5
(KT sequence). Let \(L,F,\alpha \) be as in Definition 3.1. A KT sequence for \(\mu F \le ^{?} \alpha \) is a finite chain \((X_0\le \cdots \le X_{n1})\), for \(n\ge 2\), satisfying

1.
\(X_{n2} \le \alpha \); and

2.
X is a prefixed point of \(F^\#_n\), that is, \(FX_{i}\le X_{i+1}\) for each \(i\in [0, n2]\).
A KT sequence \((X_{0} \le \cdots \le X_{n1})\) is conclusive if \(X_{j+1} \le X_{j}\) for some j.
KT sequences are finite by definition. Note that the upper bound \(\alpha \) is imposed on all \(X_{i}\) but \(X_{n1}\). This freedom in the choice of \(X_{n1}\) offers room for heuristics, one that is exploited in the combination with negative LTPDR (Sect. 3.3).
We take KT sequences as finite approximations of \(\text {KT}^{\omega }\) witnesses. This view shall be justified by the partial order \((\preceq )\) between KT sequences defined below.
Definition 3.6
(order \(\preceq \) between KT sequences). We define a partial order relation \(\preceq \) on KT sequences as follows: \((X_0, \dots , X_{n1}) \preceq (X'_0, \dots , X'_{m1})\) if \(n \le m\) and \(X_j \ge X_j'\) for each \(0 \le j \le n1\).
The order \(X_j\ge X_j'\) represents that \(X_j'\) is a stronger predicate (on states) than \(X_j\). Therefore \(X\preceq X'\) expresses that \(X'\) is a longer and stronger/more determined chain than X. We obtain \(\text {KT}^{\omega }\) witnesses as their \(\omega \)superma.
Theorem 3.7
Let \(L,F,\alpha \) be as in Definition 3.1. The set of KT sequences, augmented with the set of \(\text {KT}^{\omega }\) witnesses \(\{X \in [\omega , L] \mid F^\# X \le X \le \varDelta \alpha \}\) and ordered by the natural extension of \(\preceq \), is an \(\omega \)cpo. In this \(\omega \)cpo, each \(\text {KT}^{\omega }\)witness X is represented as the suprema of an \(\omega \)chain of KT sequences, namely \(X = \bigvee _{n \ge 2} X_n\) where \(X_n \in [n, L]\) is the length n prefix of X. \(\square \)
Proposition 3.8
Let \(L,F,\alpha \) be as in Definition 3.1. There exists a \(\text {KT}^{\omega }\) witness if and only if there exists a conclusive KT sequence.
Proof
(\(\Rightarrow \)): If there exists a \(\text {KT}^{\omega }\) witness, \(\mu F \le \alpha \) holds by Corollary 2.3 and Theorem 3.4. Therefore, the “informed guess” \((\mu F \le \mu F)\) gives a conclusive KT sequence. (\(\Leftarrow \)): When X is a conclusive KT sequence with \(X_j = X_{j+1}\), \(X_0 \le \cdots \le X_j = X_{j+1} = \cdots \) is a \(\text {KT}^{\omega }\) witness. \(\square \)
The proposition above yields the following partial algorithm that aims to answer positively to the LFPOA problem. It searches for a conclusive KT sequence.
Definition 3.9
(positive LTPDR). Let \(L,F,\alpha \) be as in Definition 3.1. Positive LTPDR is the algorithm shown in Algorithm 1, which says ‘True’ to the LFPOA problem \(\mu F \le ^{?} \alpha \) if successful.
The rules are designed by the following principles.
Valid is applied when the current X is conclusive.
Unfold extends X with \(\top \). In fact, we can use any element x satisfying \(X_{n1} \le x\) and \(FX_{n1} \le x\) in place of \(\top \) (by the application of Induction with x). The condition \(X_{n1} \le \alpha \) is checked to ensure that the extended X satisfies the condition in Definition 3.5.1.
Induction strengthens X, replacing the jth element with its meet with x. The first condition \(X_{k} \not \le x\) ensures that this rule indeed strengthens X, and the second condition \(F(X_{k1} \wedge x) \le x\) ensures that the strengthened X satisfies the condition in Definition 3.5.2, that is, \(F^\#_n X \le X\) (see the proof in [22]).
Theorem 3.10
Let \(L,F,\alpha \) be as in Definition 3.1. Then positive LTPDR is sound, i.e. if it outputs ‘True’ then \(\mu F \le \alpha \) holds.
Moreover, assume \(\mu F\le \alpha \) is true. Then positive LTPDR is weakly terminating (meaning that suitable choices of x when applying Induction make the algorithm terminate). \(\square \)
The last “optimistic termination” is realized by the informed guess \(\mu F\) as x in Induction. To guarantee the termination of LTPDR, it suffices to assume that the complete lattice L is wellfounded (no infinite decreasing chain exists in L) and there is no strictly increasing \(\omega \)chain under \(\alpha \) in L, although we cannot hope for this assumption in every instance (Sect. 5.2, 5.3).
Lemma 3.11
Let \(L,F,\alpha \) be as in Definition 3.1. If \(\mu F \le \alpha \), then for any KT sequence X, at least one of the three rules in Algorithm 1 is enabled.
Moreover, for any KT sequence X, let \(X'\) be obtained by applying either Unfold or Induction. Then \(X\preceq X'\) and \(X\ne X'\). \(\square \)
Theorem 3.12
Let \(L,F,\alpha \) be as in Definition 3.1. Assume that \(\le \) in L is wellfounded and \(\mu F \le \alpha \). Then, any nonterminating run of positive LTPDR converges to a \(\text {KT}^{\omega }\) witness (meaning that it gives a \(\text {KT}^{\omega }\) witness in \(\omega \)steps). Moreover, if there is no strictly increasing \(\omega \)chain bounded by \(\alpha \) in L, then positive LTPDR is strongly terminating. \(\square \)
3.2 Negative PDR: Sequential Negative Witnesses
We next introduce Kleene sequences as a latticetheoretic counterpart of proof obligations in the standard PDR. Kleene sequences represent a chain of sufficient conditions to conclude that certain unsafe states are reachable.
Definition 3.13
(Kleene sequence). Let \(L,F,\alpha \) be as in Definition 3.1. A Kleene sequence for the LFPOA problem \(\mu F \le ^? \alpha \) is a finite sequence \((C_0, \dots , C_{n1})\), for \(n \ge 0\) (C is empty if \(n=0\)), satisfying

1.
\(C_j \le FC_{j1}\) for each \(1 \le j \le n1\);

2.
\(C_{n1} \not \le \alpha \).
A Kleene sequence \((C_0, \dots , C_{n1})\) is conclusive if \(C_0 = \bot \). We may use \(i \ (0 \le i \le n)\) instead of 0 as the starting index of the Kleene sequence C.
When we have a Kleene sequence \(C=(C_{0},\dots ,C_{n1})\), the chain of implications \((C_{j}\le F^{j}\bot ) \implies (C_{j+1}\le F^{j+1}\bot )\) hold for \(0 \le j < n1\). Therefore when C is conclusive, \(C_{n1}\) is a Kleene witness (Corollary 2.3.2).
Proposition 3.14
Let \(L,F,\alpha \) be as in Definition 3.1. There exists a Kleene (negative) witness if and only if there exists a conclusive Kleene sequence.
Proof
(\(\Rightarrow \)): If there exists a Kleene witness x such that \(x \le F^n \bot \) and \(x \not \le \alpha \), \((\bot , F\bot , \dots , F^n \bot )\) is a conclusive Kleene sequence. (\(\Leftarrow \)): Assume there exists a conclusive Kleene sequence C. Then \(C_{n1}\) satisfies \(C_{n1} \le F^{n1}\bot \) and \(C_{n1} \not \le \alpha \) because of \(C_{n1} \le FC_{n2} \le \cdots \le F^{n1}C_0 = F^{n1}\bot \) and Definition 3.13.2. \(\square \)
This proposition suggests the following algorithm to negatively answer to the LFPOA problem. It searches for a conclusive Kleene sequence. The algorithm updates a Kleene sequence until its first component becomes \(\bot \).
Definition 3.15
(negative LTPDR). Let \(L,F,\alpha \) be as in Definition 3.1. Negative LTPDR is the algorithm shown in Algorithm 2, which says ‘False’ to the LFPOA problem \(\mu F \le ^? \alpha \) if successful.
The rules are designed by the following principles.
Candidate initializes C with only one element x. The element x has to be chosen such that \(x \not \le \alpha \) to ensure Definition 3.13.2.
Model is applied when the current Kleene sequence C is conclusive.
Decide prepends x to C. The condition \(C_0 \le Fx\) ensures Definition 3.13.1.
Theorem 3.16
Let \(L,F,\alpha \) be as in Definition 3.1.

1.
Negative LTPDR is sound, i.e. if it outputs ‘False’ then \(\mu F \not \le \alpha \).

2.
Assume \(\mu F \not \le \alpha \) is true. Then negative LTPDR is weakly terminating (meaning that suitable choices of x when applying rules Candidate and Decide make the algorithm terminate). \(\square \)
3.3 LTPDR: Integrating Positive and Negative
We have introduced two simple PDR algorithms, called positive LTPDR (Sect. 3.1) and negative LTPDR (Sect. 3.2). They are so simple that they have potential inefficiencies. Specifically, in positive LTPDR, it is unclear that how we choose \(x \in L\) in Induction, while in negative LTPDR, it may easily diverge because the rules Candidate and Decide may choose \(x\in L\) that would not lead to a conclusive Kleene sequence. We resolve these inefficiencies by combining positive LTPDR and negative LTPDR. The combined PDR algorithm is called LTPDR, and it is a latticetheoretic generalization of conventional PDR.
Note that negative LTPDR is only weakly terminating. Even worse, it is easy to make it diverge—after a choice of x in Candidate or Decide such that \(x\not \le \mu F\), no continued execution of the algorithm can lead to a conclusive Kleene sequence. For deciding \(\mu F \le ^? \alpha \) efficiently, therefore, it is crucial to detect such useless Kleene sequences.
The core fact that underlies the efficiency of PDR is the following proposition, which says that a KT sequence (in positive LTPDR) can quickly tell that a Kleene sequence (in negative LTPDR) is useless. This fact is crucially used for many rules in LTPDR (Definition 3.20).
Proposition 3.17
Let \(C=(C_i, \dots , C_{n1})\) be a Kleene sequence \((2 \le n, 0 < i \le n1)\) and \(X=(X_0 \le \cdots \le X_{n1})\) be a KT sequence. Then

1.
\(C_i \not \le X_i\) implies that C cannot be extended to a conclusive one, that is, there does not exist \(C_0, \dots , C_{i1}\) such that \((C_0, \dots , C_{n1})\) is conclusive.

2.
\(C_i \not \le F X_{i1}\) implies that C cannot be extended to a conclusive one.

3.
There is no conclusive Kleene sequence with length \(n1\). \(\square \)
The proof relies on the following lemmas.
Lemma 3.18
Any KT sequence \((X_0 \le \cdots \le X_{n1})\) overapproximates the initial sequence: \( F^i\bot \le X_i\) holds for any i such that \(0\le i\le n1\). \(\square \)
Lemma 3.19
Let \(C=(C_i, \dots , C_{n1})\) be a Kleene sequence \((0 < i \le n1)\) and \((X_0 \le \cdots \le X_{n1})\) be a KT sequence. The following satisfy \(1 \Leftrightarrow 2 \Rightarrow 3\).

1.
The Kleene sequence C can be extended to a conclusive one.

2.
\(C_i \le F^i\bot \).

3.
\(C_i \le F^j X_{ij}\) for each j with \(0 \le j \le i\). \(\square \)
Using the above latticetheoretic properties, we combine positive and negative LTPDRs into the following LTPDR algorithm. It is also a latticetheoretic generalization of the original PDR algorithm. The combination exploits the mutual relationship between KT sequences and Kleene sequences, exhibited as Proposition 3.17, for narrowing down choices in positive and negative LTPDRs.
Definition 3.20
(LTPDR). Given a complete lattice L, an \(\omega \)continuous function \(F: L \rightarrow L\), and an element \(\alpha \in L\), LTPDR is the algorithm shown in Algorithm 3 for the LFPOA problem \(\mu F \le ^? \alpha \).
The rules are designed by the following principles.
(Valid, Unfold, and Induction): These rules are almost the same as in positive LTPDR. In Unfold, we reset the Kleene sequence because of Proposition 3.17.3. Occurrences of Unfold punctuate an execution of the algorithm: between two occurrences of Unfold, a main goal (towards a negative conclusion) is to construct a conclusive Kleene sequence with the same length as the X.
(Candidate, Model, and Decide): These rules have many similarities to those in negative LTPDR. Differences are as follows: the Candidate and Decide rules impose \(x \le X_i\) on the new element x in \((x, C_{i+1}, \dots , C_{n1})\) because Proposition 3.17.1 tells us that other choices are useless. In Model, we only need to check whether \(C_1\) is defined instead of \(C_0 = \bot \). Indeed, since \(C_1\) is added in Candidate or Decide, \(C_1 \le X_1 = F\bot \) always holds. Therefore, \(2 \Rightarrow 1\) in Lemma 3.19 shows that \((\bot , C_1, \dots , C_{n1})\) is conclusive.
(Conflict): This new rule emerges from the combination of positive and negative LTPDRs. This rule is applied when \(C_i \not \le FX_{i1}\), which confirms that the current C cannot be extended to a conclusive one (Proposition 3.17.2). Therefore, we eliminate \(C_i\) from C and strengthen X so that we cannot choose \(C_i\) again, that is, so that \(C_i \not \le (X_i \wedge x)\). Let us explain how X is strengthened. The element x has to be chosen so that \(C_i \not \le x\) and \(F(X_{i1} \wedge x) \le x\). The former disinequality ensures the strengthened X satisfies \(C_i \not \le (X_i \wedge x)\), and the latter inequality implies \(F(X_{i1} \wedge x) \le x\). One can see that Conflict is Induction with additional condition \(C_i \not \le x\), which enhances so that the search space for x is narrowed down using the Kleene sequence C.
Canonical choices of \(x\in L\) in Candidate, Decide, and Conflict are \(x:=X_{n1}\), \(x:=X_{i1}\), and \(x:=FX_{i1}\), respectively. However, there can be cleverer choices; e.g. \(x:= S\setminus (C_i\setminus FX_{i1})\) in Conflict when \(L=\mathcal {P}S\).
Lemma 3.21
Each rule of LTPDR, when applied to a pair of a KT and a Kleene sequence, yields a pair of a KT and a Kleene sequence. \(\square \)
Theorem 3.22
(correctness). LTPDR is sound, i.e. if it outputs ‘True’ then \(\mu F \le \alpha \) holds, and if it outputs ‘False’ then \(\mu F \not \le \alpha \) holds. \(\square \)
Many existing PDR algorithms ensure termination if the state space is finite. A general principle behind is stated below. Note that it rarely applies to infinitary or quantitative settings, where we would need some abstraction for termination.
Proposition 3.23
(termination). LTPDR terminates regardless of the order of the ruleapplications if the following conditions are satisfied.

1.
Valid and Model rules are immediately applied if applicable.

2.
\((L,\le )\) is wellfounded.

3.
Either of the following is satisfied: a) \(\mu F \le \alpha \) and \((L, \le )\) has no strictly increasing \(\omega \)chain bounded by \(\alpha \), or b) \(\mu F \not \le \alpha \). \(\square \)
Cond 1 is natural: it just requires LTPDR to immediately conclude ‘True’ or ‘False’ if it can. Cond. 2–3 are always satisfied when L is finite.
Theorem 3.22 and Proposition 3.23 still hold if Induction rule is dropped. However, the rule can accelerate the convergence of KT sequences and improve efficiency.
Remark 3.24
(LTOpPDR). The GFPUA problem \(\alpha \le ^{?}\nu F\) is the dual of LFPOA, obtained by opposing the order \(\le \) in L. We can also dualize the LTPDR algorithm (Algorithm 3), obtaining what we call the LTOpPDR algorithm for GFPUA. Moreover, we can express LTOpPDR as LTPDR if a suitable involution \(\lnot :L\rightarrow L^{\mathrm {op}}\) is present. See [22, Appendix B] for further details; see also Proposition 4.3.
4 Structural Theory of PDR by Category Theory
Before we discuss concrete instances of LTPDR in Sect. 5, we develop a structural theory of transition systems and predicate transformers as a basis of LTPDR. The theory is formulated in the language of category theory [3, 17, 18, 23]. We use category theory because 1) categorical modeling of relevant notions is well established in the community (see e.g. [2, 8, 17, 18, 27]), and 2) it gives us the right level of abstraction that accommodates a variety of instances. In particular, qualitative and quantitative settings are described in a uniform manner.
Our structural theory (Sect. 4) serves as a backend, not a frontend. That is,

the theory in Sect. 4 is important in that it explains how the instances in Sect. 5 arise and why others do not, but

the instances in Sect. 5 are described in noncategorical terms, so readers who skipped Sect. 4 will have no difficulties following Sect. 5 and using those instances.
4.1 Categorical Modeling of Dynamics and Predicate Transformers
Our interests are in instances of the LFPOA problem \(\mu F \le ^{?} \alpha \) (Definition 3.1) that appear in model checking. In this context, 1) the underlying lattice L is that of predicates over a state space, and 2) the function \(F:L\rightarrow L\) arises from the dynamic/transition structure, specifically as a predicate transformer. The categorical notions in Table 1 model these ideas (statebased dynamics, predicate transformers). This modeling is wellestablished in the community.
Our introduction of Table 1 here is minimal, due to the limited space. See [22, Appendix C] and the references therein for more details.
A category consists of objects and arrows between them. In Table 1, categories occur twice: 1) a base category \(\mathbb {B}\) where objects are typically sets and arrows are typically functions; and 2) fiber categories \(\mathbb {E}_{S}\), defined for each object S of \(\mathbb {B}\), that are identified with the lattices of predicates. Specifically, objects \(P,Q,\dotsc \) of \(\mathbb {E}_{S}\) are predicates over S, and an arrow \(P\rightarrow Q\) represents logical implication. A general fact behind the last is that every preorder is a category—see e.g. [3].
Transition Systems as Coalgebras. Statebased transition systems are modeled as coalgebras in the base category \(\mathbb {B}\) [17]. We use a functor \(G:\mathbb {B}\rightarrow \mathbb {B}\) to represent a transition type. A Gcoalgebra is an arrow \(\delta :S\rightarrow GS\), where S is a state space and \(\delta \) describes the dynamics. For example, a Kripke structure can be identified with a pair \((S,\delta )\) of a set S and a function \(\delta :S\rightarrow \mathcal {P}S\), where \(\mathcal {P}S\) denotes the powerset. The powerset construction \(\mathcal {P}\) is known to be a functor \(\mathcal {P}:\mathbf {Set}\rightarrow \mathbf {Set}\); therefore Kripke structures are \(\mathcal {P}\)coalgebras. For other choices of G, Gcoalgebras become different types of transition systems, such as MDPs (Sect. 5.2) and Markov Reward Models (Sect. 5.3).
Predicates Form a Fibration. Fibrations are powerful categorical constructs that can model various indexed entities; see e.g. [18] for its general theory. Our use of them is for organizing the lattices \(\mathbb {E}_{S}\) of predicates over a set S, indexed by the choice of S. For example, \(\mathbb {E}_{S}=2^{S}\)—the lattice of subsets of S—for modeling qualitative predicates. For quantitative reasoning (e.g. for MDPs), we use \(\mathbb {E}_{S}=[0,1]^{S}\), where [0, 1] is the unit interval. This way, qualitative and quantitative reasonings are mathematically unified in the language of fibrations.
A fibration is a functor \(p:\mathbb {E}\rightarrow \mathbb {B}\) with suitable properties; it can be thought of as a collection \((\mathbb {E}_{S})_{S\in \mathbb {B}}\) of fiber categories \(\mathbb {E}_{S}\)—indexed by objects S of \(\mathbb {B}\)—suitably organized as a single category \(\mathbb {E}\). Notable in this organization is that we obtain the pullback functor \(l^{*}:\mathbb {E}_{Y}\rightarrow \mathbb {E}_{X}\) for each arrow \(l:X\rightarrow Y\) in \(\mathbb {B}\). In our examples, \(l^{*}\) is a substitution along l in predicates—\(l^{*}\) is the monotone map that carries a predicate P(y) over Y to the predicate P(l(x)) over X.
In this paper, we restrict to a subclass of fibrations (called \({\boldsymbol{CLat}}_{\wedge }\)fibrations) in which every fiber category \(\mathbb {E}_{S}\) is a complete lattice, and each pullback functor preserves all meets. We therefore write \(P\le Q\) for arrows in \(\mathbb {E}_{S}\); this represents logical implication, as announced above. Notice that each \(f^*\) has a left adjoint (lower adjoint in terms of Galois connection), which exists by Freyd’s adjoint functor theorem. The left adjoint is denoted by \(f_*\).
We also consider a lifting \(\dot{G}:\mathbb {E}\rightarrow \mathbb {E}\) of G along p; it is a functor \(\dot{G}\) such that \(p\dot{G}=Gp\). See the diagram on the right. It specifies the logical interpretation of the transition type G. For example, for \(G=\mathcal {P}\) (the powerset functor) from the above, two choices of \(\dot{G}\) are for the may and must modalities. See e.g. [2, 15, 20, 21].
Categorical Predicate Transformer. The above constructs allow us to model predicate transformers—F in our examples of the LFPOA problem \(\mu F \le ^{?} \alpha \)—in categorical terms. A predicate transformer along a coalgebra \(\delta :S\rightarrow GS\) with respect to the lifting \(\dot{G}\) is simply the composite \( \mathbb {E}_{S}\xrightarrow {\dot{G}} \mathbb {E}_{GS}\xrightarrow {\delta ^{*}} \mathbb {E}_{S} \), where the first \(\dot{G}\) is the restriction of \(\dot{G}:\mathbb {E}\rightarrow \mathbb {E}\) to \(\mathbb {E}_{S}\). Intuitively, 1) given a postcondition P in \(\mathbb {E}_{S}\), 2) it is first interpreted as the predicate \(\dot{G}P\) over GS, and then 3) it is pulled back along the dynamics \(\delta \) to yield a precondition \(\delta ^{*}\dot{G}P\). Such (backward) predicate transformers are fundamental in a variety of model checking problems.
4.2 Structural Theory of PDR from Transition Systems
We formulate a few general safety problems. We show how they are amenable to the LTPDR (Definition 3.20) and LTOpPDR (Remark 3.24) algorithms.
Definition 4.1
(backward safety problem, BSP). Let p be a CLat \(_{\wedge }\)fibration, \(\delta : S \rightarrow GS\) be a coalgebra in \(\mathbb {B}\), and \(\dot{G}: \mathbb {E} \rightarrow \mathbb {E}\) be a lifting of G along p such that \(\dot{G}_X:\mathbb {E}_X\rightarrow \mathbb {E}_{GX}\) is \(\omega ^\mathrm {op}\)continuous for each \(X\in \mathbb {B}\). The backward safety problem for \((\iota \in \mathbb {E}_S, \delta , \alpha \in \mathbb {E}_S)\) in \((p, G, \dot{G})\) is the GFPUA problem for \((\mathbb {E}_S, \alpha \wedge \delta ^*\dot{G}, \iota )\), that is,
Here, \(\iota \) represents the initial states and \(\alpha \) represents the safe states. The predicate transformer \(x\mapsto \alpha \wedge \delta ^*\dot{G}x\) in (2) is the standard one for modeling safety—currently safe (\(\alpha \)), and the next time x (\(\delta ^*\dot{G}x\)). Its gfp is the safety property; (2) asks if all initial states (\(\iota \)) satisfy the safety property. Since the backward safety problem is a GFPUA problem, we can solve it by LTOpPDR (Remark 3.24).
Additional assumptions allow us to reduce the backward safety problem to LFPOA problems, which are solvable by LTPDR, as shown on the right.
The first case requires the existence of the left adjoint to the predicate transformer \(\delta ^*\dot{G}_S:\mathbb {E}_S\rightarrow \mathbb {E}_S\). Then we can translate BSP to the following LFPOA problem. It directly asks whether all reachable states are safe.
Proposition 4.2
(forward safety problem, FSP). In the setting of Definition 4.1, assume that each \(\dot{G}_X: \mathbb {E}_{X} \rightarrow \mathbb {E}_{GX}\) preserves all meets. Then by letting \(\dot{H}_S: \mathbb {E}_{GS} \rightarrow \mathbb {E}_{S}\) be the left adjoint of \(\dot{G}_S\), the BSP (2) is equivalent to the LFPOA problem for \((\mathbb {E}_S,\iota \vee \dot{H}_S\delta _*,\alpha )\):
This problem is called the forward safety problem for \((\iota , \delta , \alpha )\) in \((p, G, \dot{G})\). \(\square \)
The second case assumes that the complete lattice \(\mathbb {E}_S\) of predicates admits an involution operator \(\lnot :\mathbb {E}_S\rightarrow \mathbb {E}_S^\mathrm {op}\) (cf. [22, Appendix B]).
Proposition 4.3
(inverse backward safety problem, IBSP). In the setting of Definition 4.1, assume further that there is a monotone function \(\lnot : \mathbb {E}_S \rightarrow \mathbb {E}^\mathrm {op}_S\) satisfying \(\lnot \circ \lnot = \mathrm {id}\). Then the backward safety problem (2) is equivalent to the LFPOA problem for \((\mathbb {E}_S,(\lnot \alpha )\vee (\lnot \circ \delta ^*\dot{G}\circ \lnot ),\lnot \iota )\), that is,
We call (4) the inverse backward safety problem for \((\iota , \delta , \alpha )\) in \((p, G, \dot{G})\). Here \((\lnot \alpha ) \vee (\lnot \circ \delta ^*\dot{G}\circ \lnot ())\) is the inverse backward predicate transformer. \(\square \)
When both additional assumptions are fulfilled (in Proposition 4.2 and 4.3), we obtain two LTPDR algorithms to solve BSP. One can even simultaneously run these two algorithms—this is done in fbPDR [25, 26]. See also Sect. 5.1.
5 Known and New PDR Algorithms as Instances
We present several concrete instances of our LTPDR algorithms. The one for Markov reward models is new (Sect. 5.3). We also sketch how those instances can be systematically derived by the theory in Sect. 4; details are in [22, Appendix D].
5.1 LTPDRs for Kripke Structures: \({\textbf {PDR}}^{{\textbf {FKr}}}\)and \({\textbf {PDR}}^{{\textbf {IBKr}}}\)
In most of the PDR literature, the target system is a Kripke structure that arises from a program’s operational semantics. A Kripke structure consists of a set S of states and a transition relation \(\delta \subseteq S\times S\) (here we ignore initial states and atomic propositions). The basic problem formulation is as follows.
Definition 5.1
(backward safety problem (BSP) for Kripke structures). The BSP for a Kripke structure \((S,\delta )\), a set \(\iota \in 2^S\) of initial states, and a set \(\alpha \in 2^S\) of safe states, is the GFPUA problem \( \iota \,\le ^?\, \nu x.\, \alpha \wedge F' x, \) where \(F':2^{S}\rightarrow 2^{S}\) is defined by \(F'(A)\mathbin {:=}\{s\mid \forall s'.\, ((s,s')\in \delta \Rightarrow s'\in A)\}\).
It is clear that the GFP in Definition 5.1 represents the set of states from which all reachable states are in \(\alpha \). Therefore the BSP is the usual safety problem.
The above BSP is easily seen to be equivalent to the following problems.
Proposition 5.2
(forward safety problem (FSP) for Kripke structures). The BSP in Definition 5.1 is equivalent to the LFPOA problem \( \mu x.\, \iota \vee F''x\, \le ^? \,\alpha \), where \(F'':2^{S}\rightarrow 2^{S}\) is defined by \(F''(A)\mathbin {:=}\bigcup _{s\in A}\{s'\mid (s,s')\in \delta \}\). \(\square \)
Proposition 5.3
(inverse backward safety problem (IBSP) for Kripke structures). The BSP in Definition 5.1 is equivalent to the LFPOA problem \( \mu x.\, \lnot \alpha \vee \lnot F'(\lnot x) \,\le ^?\, \lnot \iota \), where \(\lnot :2^{S}\rightarrow 2^{S}\) is the complement function \(A\mapsto S\setminus A\). \(\square \)
Instances of LTPDR. The FSP and IBSP (Propositions 5.2–5.3), being LFPOA, are amenable to the LTPDR algorithm (Definition 3.20). Thus we obtain two instances of LTPDR; we call them \(\boldsymbol{PDR}^{\boldsymbol{F\text {}Kr}}\) and \(\boldsymbol{PDR}^{\boldsymbol{IB\text {}Kr}}\). \({\textbf {PDR}}^{{\textbf {IBKr}}}\) is a stepbystep dual to the application of LTOpPDR to the BSP (Definition 5.1)—see Remark 3.24.
We compare these two instances of LTPDR with algorithms in the literature. If we impose \(C_i=1\) on each element \(C_i\) of Kleene sequences, the \({\textbf {PDR}}^{{\textbf {FKr}}}\) instance of LTPDR coincides with the conventional IC3/PDR [9, 13]. In contrast, \({\textbf {PDR}}^{{\textbf {IBKr}}}\) coincides with Reverse PDR in [25, 26]. The parallel execution of \({\textbf {PDR}}^{{\textbf {FKr}}}\) and \({\textbf {PDR}}^{{\textbf {IBKr}}}\) roughly corresponds to fbPDR [25, 26].
Structural Derivation. The equivalent problems (Propositions 5.2–5.3) are derived systematically from the categorical theory in Sect. 4.2. Indeed, using a lifting \(\dot{\mathcal {P}}:2^{S} \rightarrow 2^{\mathcal {P}S}\) such that \(A\mapsto \{A'\mid A'\subseteq A\}\) (the must modality \(\Box \)), \(F'\) in Definition 5.1 coincides with \(\delta ^{*}\dot{\mathcal {P}}\) in (2). The above \(\dot{\mathcal {P}}\) preserves meets (cf. the modal axiom \(\Box (\varphi \wedge \psi )\cong \Box \varphi \wedge \Box \psi \), see e.g. [7]); thus Proposition 4.2 derives the FSP. Finally, \(\lnot \) in Proposition 5.3 allows the use of Proposition 4.3. More details are in [22, Appendix D].
5.2 LTPDR for MDPs: \({\textbf {PDR}}^{{\textbf {IBMDP}}}\)
The only known PDRlike algorithm for quantitative verification is PrIC3 [6] for Markov decision processes s(MDPs). Here we instantiate LTPDR for MDPs and compare it with PrIC3.
An MDP consists of a set S of states, a set \(\mathrm {Act}\) of actions and a transition function \(\delta \) mapping \(s \in S\) and \(a \in \mathrm {Act}\) to either \(*\) (“the action a is unavailable at s”) or a probability distribution \(\delta (s)(a)\) over S.
Definition 5.4
(IBSP for MDPs). The inverse backward safety problem (IBSP) for an MDP \((S,\delta )\), an initial state \(s_{\iota }\in S\), a real number \(\lambda \in [0,1]\), and a set \(\alpha \subseteq S\) of safe states, is the LFPOA problem \( \mu x.\, F'( x) \;\le ^?\; d_{\iota ,\lambda } \). Here \(d_{\iota ,\lambda }:S\rightarrow [0,1]\) is the predicate such that \(d_{\iota ,\lambda }(s_{\iota })=\lambda \) and \(d_{\iota ,\lambda }(s)=1\) otherwise. \(F':[0,1]^{S}\rightarrow [0,1]^{S}\) is defined by \( F' (d)(s) =1\) if \(s\not \in \alpha \), and \( F' (d)(s) = \max \{\sum _{s' \in S} d(s') \cdot \delta (s)(a)(s') \mid a \in \mathrm {Act}, \delta (s)(a) \ne *\}\) if \(s\in \alpha \).
The function \(F'\) in Definition 5.4 is a Bellman operator for MDPs—it takes the average of d over \(\delta (s)(a)\) and takes the maximum over a. Therefore the lfp in Definition 5.4 is the maximum reachability probability to \(S\setminus \alpha \); the problem asks if it is \(\le \lambda \). In other words, it asks whether the safety probability—of staying in \(\alpha \) henceforth, under any choices of actions—is \(\ge 1\lambda \). This problem is the same as in [6].
Instance of PDR. The IBSP (Definition 5.4) is LFPOA and thus amenable to LTPDR. We call this instance \(\boldsymbol{PDR}^{\boldsymbol{IB\text {}MDP}}\); See [22, Appendix E] for details.
\({\textbf {PDR}}^{{\textbf {IBMDP}}}\) shares many essences with PrIC3 [6]. It uses the operator \(F'\) in Definition 5.4, which coincides with the one in [6, Def. 2]. PrIC3 maintains frames; they coincide with KT sequences in \({\textbf {PDR}}^{{\textbf {IBMDP}}}\).
Our Kleene sequences correspond to obligations in PrIC3, modulo the following difference. Kleene sequences aim at a negative witness (Sect. 3.2), but they happen to help the positive proof efforts too (Sect. 3.3); obligations in PrIC3 are solely for accelerating the positive proof efforts. Thus, if PrIC3 cannot solve these efforts, we need to check whether obligations yield a negative witness.
Structural Derivation. One can derive the IBSP (Definition 5.4) from the categorical theory in Sect. 4.2. Specifically, we first formulate the BSP \( \lnot d_{\lambda } \;\le ^?\; \nu x.\, d_\alpha \wedge \delta ^*\dot{G}x \), where \(\dot{G}\) is a suitable lifting (of G for MDPs, Table 1) that combines average and minimum, \(\lnot :[0,1]^{S}\rightarrow [0,1]^{S}\) is defined by \((\lnot d)(s)\mathbin {:=}1d(s)\), and \(d_{\alpha }\) is such that \(d_{\alpha }(s)=1\) if \(s\in \alpha \) and \(d_{\alpha }(s)=0\) otherwise. Using \(\lnot :[0,1]^{S}\rightarrow [0,1]^{S}\) in the above as an involution, we apply Proposition 4.3 and obtain the IBSP (Definition 5.4).
Another benefit of the categorical theory is that it can tell us a forward instance of LTPDR (much like \({\textbf {PDR}}^{{\textbf {FKr}}}\) in Sect. 5.1) is unlikely for MDPs. Indeed, we showed in Proposition 4.2 that \(\dot{G}'s\) preservation of meets is essential (existence of a left adjoint is equivalent to meet preservation). We can easily show that our \(\dot{G}\) for MDPs does not preserve meets. See [22, Appendix G].
5.3 LTPDR for Markov Reward Models: \({\textbf {PDR}}^{{\textbf {MRM}}}\)
We present a PDRlike algorithm for Markov reward models (MRMs), which seems to be new, as an instance of LTPDR. An MRM consists of a set S of states and a transition function \(\delta \) that maps \(s \in S\) (the current state) and \(c \in \mathbb {N}\) (the reward) to a function \(\delta (s)(c): S \rightarrow [0, 1]\); the last represents the probability distribution of next states.
We solve the following problem. We use \([0,\infty ]\)valued predicates—representing accumulated rewards—where \([0,\infty ]\) is the set of extended nonnegative reals.
Definition 5.5
(SP for MRMs). The safety problem (SP) for an MRM \((S,\delta )\), an initial state \(s_{\iota }\in S\), \(\lambda \in [0,\infty ]\), and a set \(\alpha \subseteq S\) of safe states is \( \mu x.\, F'( x) \,\le ^?\, d_{\iota ,\lambda } \). Here \(d_{\iota ,\lambda }:S\rightarrow [0,\infty ]\) maps \(s_{\iota }\) to \(\lambda \) and others to \(\infty \), and \(F':[0,\infty ]^{S}\rightarrow [0,\infty ]^{S}\) is defined by \( F'(d)(s) = 0 \) if \(s\not \in \alpha \), and \( F'(d)(s) = \sum _{s' \in S,c \in \mathbb {N}} (c+d(s')) \cdot \delta (s)(c)(s') \) if \(s\in \alpha \).
The function \(F'\) accumulates expected reward in \(\alpha \). Thus the problem asks if the expected accumulated reward, starting from \(s_{\iota }\) and until leaving \(\alpha \), is \(\le \lambda \).
Instance of PDR. The SP (Definition 5.5) is LFPOA thus amenable to LTPDR. We call this instance \(\boldsymbol{PDR}^{\boldsymbol{MRM}}\). It seems new. See [22, Appendix F] for details.
Structural Derivation. The function \(F'\) in Definition 5.5 can be expressed categorically as \(F'(x)=d_\alpha \wedge \delta ^*\dot{G}(x)\), where \(d_{\alpha }:S\rightarrow [0,\infty ]\) carries \(s\in \alpha \) to \(\infty \) and \(s\not \in \alpha \) to 0, and \(\dot{G}\) is a suitable lifting that accumulates expected reward. However, the SP (Definition 5.5) is not an instance of the three general safety problems in Sect. 4.2. Consequently, we expect that other instances of LTPDR than \({\textbf {PDR}}^{{\textbf {MRM}}}\) (such as \({\textbf {PDR}}^{{\textbf {FKr}}}\) and \({\textbf {PDR}}^{{\textbf {IBKr}}}\) in Sect. 5.1) are hard for MRMs.
6 Implementation and Evaluation
Implementation. We implemented LTPDR in Haskell. Exploiting Haskell’s language features, it is succinct (\(\sim \)50 lines) and almost a literal translation of Algorithm 3 to Haskell. Its main part is presented in [22, Appendix K]. In particular, using suitable type classes, the code is as abstract and generic as Algorithm 3.
Specifically, our implementation is a Haskell module named . It has two interfaces, namely the type class (the lattice of predicates) and the type (the definitions of Candidate, Decide, and Conflict). The main function for LTPDR is , where the second argument is for a monotone function F of type and the last is for the safety predicate \(\alpha \).
Obtaining concrete instances is easy by fixing \(\tau \) and . A simple implementation of \({\textbf {PDR}}^{{\textbf {FKr}}}\) takes 15 lines; a more serious SATbased one for \({\textbf {PDR}}^{{\textbf {FKr}}}\) takes \(\sim \)130 lines; \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) and \({\textbf {PDR}}^{{\textbf {MRM}}}\) take \(\sim \)80 lines each.
Heuristics. We briefly discuss the heuristics, i.e. how to choose \(x \in L\) in Candidate, Decide, and Conflict, used in our experiments. The heuristics of \({\textbf {PDR}}^{{\textbf {FKr}}}\) is based on the conventional PDR [9]. The heuristics of \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) is based on the idea of representing the smallest possible x greater than some real number \(v \in [0, 1]\) (e.g. x taken in Candidate) as \(x=v+\epsilon \), where \(\epsilon \) is a symbolic variable. This implies that Unfold (or Valid, Model) is always applied in finite steps, which further guarantees finitestep termination for invalid cases and \(\omega \)step termination for valid cases (see [22, Appendix H] for more detail). The heuristics of \({\textbf {PDR}}^{{\textbf {MRM}}}\) is similar to that of \({\textbf {PDR}}^{{\textbf {IBMDP}}}\).
Experiment Setting. We experimentally assessed the performance of instances of . The settings are as follows: 1.2 GHz QuadCore Intel Core i7 with 10 GB memory using Docker, for \({\textbf {PDR}}^{{\textbf {IBMDP}}}\); Apple M1 Chip with 16 GB memory for the other. The different setting is because we needed Docker to run PrIC3 [6].
Experiments with \({\textbf {PDR}}^{{\textbf {MRM}}}\). Table 2a shows the results. We observe that \({\textbf {PDR}}^{{\textbf {MRM}}}\) answered correctly, and that the execution time is reasonable. Further performance analysis (e.g. comparison with [19]) and improvement is future work; the point here, nevertheless, is the fact that we obtained a reasonable MRM model checker by adding \(\sim \)80 lines to the generic solver .
Experiments with \({\textbf {PDR}}^{{\textbf {IB}}\text {}{} {\textbf {MDP}}}\). Table 2c shows the results. Both PrIC3 and our \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) solve a linear programming (LP) problem in Decide. PrIC3 uses Z3 for this; \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) uses GLPK. PrIC3 represents an MDP symbolically, while \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) do so concretely. Symbolic representation in \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) is possible—it is future work. PrIC3 can use four different interpolation generalization methods, leading to different performance (Table 2c).
We observe that \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) outperforms PrIC3 for some benchmarks with smaller state spaces. We believe that the failure of \({\textbf {PDR}}^{{\textbf {IBMDP}}}\) in many instances can be attributed to our current choice of a generalization method (it is the closest to the linear one for PrIC3). Table 2c suggests that use of polynomial or hybrid can enhance the performance.
Experiments with \({\textbf {PDR}}^{{\textbf {F}}\text {}{} {\textbf {Kr}}}\). Table 2b shows the results. The benchmarks are mostly from the HWMCC’15 competition [1], except for latch0.smv^{Footnote 1} and counter.smv (our own).
IC3ref vastly outperforms \({\textbf {PDR}}^{{\textbf {FKr}}}\) in many instances. This is hardly a surprise—IC3ref was developed towards superior performance, while \({\textbf {PDR}}^{{\textbf {FKr}}}\)’s emphasis is on its theoretical simplicity and genericity. We nevertheless see that \({\textbf {PDR}}^{{\textbf {FKr}}}\) solves some benchmarks of substantial size, such as power2bit8.smv. This demonstrates the practical potential of LTPDR, especially in view of the following improvement opportunities (we will pursue them as future work): 1) use of welldeveloped SAT solvers (we currently use toysolver^{Footnote 2} for its good interface but we could use Z3); 2) allowing \(C_i > 1\), a technique discussed in Sect. 5.1 and implemented in IC3ref but not in \({\textbf {PDR}}^{{\textbf {FKr}}}\); and 3) other small improvements, e.g. in our CNFbased handling of propositional formulas.
Ablation Study. To assess the value of the key concept of PDR (namely the positivenegative interplay between the Knaster–Tarski and Kleene theorems (Sect. 3.3)), we compared \({\textbf {PDR}}^{{\textbf {FKr}}}\) with the instances of positive and negative LTPDR (Sects. 3.1–3.2) for Kripke structures.
Table 2d shows the results. Note that the value of the positivenegative interplay is already theoretically established; see e.g. Proposition 3.17 (the interplay detects executions that lead to nowhere). This value was also experimentally witnessed: see power2bit8.smv and simpleTrans.smv, where the onesided methods made wrong choices and timed out. Onesided methods can be efficient when they get lucky (e.g. in counter.smv). LTPDR may be slower because of the overhead of running two sides, but that is a tradeoff for the increased chance of termination.
Discussion. We observe that all of the studied instances exhibited at least reasonable performance. We note again that detailed performance analysis and improvement is out of our current scope. Being able to derive these model checkers, with such a small effort as \(\sim \)100 lines of Haskell code each, demonstrates the value of our abstract theory and its generic Haskell implementation .
7 Conclusions and Future Work
We have presented a latticetheoretic generalization of the PDR algorithm called LTPDR. This involves the decomposition of the PDR algorithm into positive and negative ones, which are tightly connected to the Knaster–Tarski and Kleene fixed point theorems, respectively. We then combined it with the coalgebraic and fibrational theory for modeling transition systems with predicates. We instantiated it with several transition systems, deriving existing PDR algorithms as well as a new one over Markov reward models. We leave instantiating our LTPDR and categorical safety problems to derive other PDRlike algorithms, such as PDR for hybrid systems [29], for future work.
We will also work on the combination of our work and the theory of abstract interpretation [10, 12]. Our current framework axiomatizes what is needed of heuristics, but it does not tell how to realize such heuristics (that differ a lot in different concrete settings). We expect abstract interpretation to provide some general recipes for realizing such heuristics.
References
The 8th competitive event for hardware model checkers (HWMCC 2015) (2015). http://fmv.jku.at/hwmcc15/
Aguirre, A., Katsumata, S.: Weakest preconditions in fibrations. Electronic Notes in Theoretical Comput. Sci. 352, 5–27 (2020). http://www.sciencedirect.com/science/article/pii/S1571066120300487, the 36th Mathematical Foundations of Programming Semantics Conference (2020)
Awodey, S.: Category Theory. Oxford Logic Guides. Oxford Univ. Press, Oxford (2006)
Baier, C., Katoen, J.: Principles of Model Checking. MIT Press, Cambridge (2008)
Baranga, A.: The contraction principle as a particular case of Kleene’s fixed point theorem. Discret. Math. 98(1), 75–79 (1991)
Batz, K., Junges, S., Kaminski, B.L., Katoen, J.P., Matheja, C., Schröer, P.: PrIC3: property directed reachability for MDPs. In: Lahiri, S.K., Wang, C. (eds.) CAV 2020. LNCS, vol. 12225, pp. 512–538. Springer, Cham (2020). https://doi.org/10.1007/9783030532918_27
Blackburn, P., de Rijke, M., Venema, Y.: Modal Logic. In: Tracts in Theoretical Computer Science No. 53 (2001)
Bonchi, F., König, B., Petrisan, D.: Upto techniques for behavioural metrics via fibrations. In: Schewe, S., Zhang, L. (eds.) 29th International Conference on Concurrency Theory, CONCUR 2018. LIPIcs, vol. 118, pp. 17:1–17:17. Schloss Dagstuhl  LeibnizZentrum für Informatik (2018). https://doi.org/10.4230/LIPIcs.CONCUR.2018.17
Bradley, A.R.: SATbased model checking without unrolling. In: Jhala, R., Schmidt, D. (eds.) VMCAI 2011. LNCS, vol. 6538, pp. 70–87. Springer, Heidelberg (2011). https://doi.org/10.1007/9783642182754_7
Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Graham, R.M., Harrison, M.A., Sethi, R. (eds.) Conference Record of the Fourth ACM Symposium on Principles of Programming Languages, pp. 238–252. ACM (1977). https://doi.org/10.1145/512950.512973
Cousot, P., Cousot, R.: Constructive versions of Tarski’s fixed point theorems. Pacific J. Math. 82(1), 43–57 (1979). https://doi.org/10.2140/pjm.1979.82.43
Cousot, P., Cousot, R.: Systematic design of program analysis frameworks. In: Aho, A.V., Zilles, S.N., Rosen, B.K. (eds.) Conference Record of the Sixth Annual ACM Symposium on Principles of Programming Languages, pp. 269–282. ACM Press (1979). https://doi.org/10.1145/567752.567778
Eén, N., Mishchenko, A., Brayton, R.K.: Efficient implementation of property directed reachability. In: Bjesse, P., Slobodová, A. (eds.) International Conference on Formal Methods in ComputerAided Design, FMCAD 2011, pp. 125–134. FMCAD Inc. (2011). http://dl.acm.org/citation.cfm?id=2157675
Gurfinkel, A.: IC3, PDR, and friends (2015). https://arieg.bitbucket.io/pdf/gurfinkel_ssft15.pdf
Hermida, C., Jacobs, B.: Structural induction and coinduction in a fibrational setting. Inf. Comput. 145(2), 107–152 (1998). https://doi.org/10.1006/inco.1998.2725
Hoder, K., Bjørner, N.: Generalized property directed reachability. In: Cimatti, A., Sebastiani, R. (eds.) SAT 2012. LNCS, vol. 7317, pp. 157–171. Springer, Heidelberg (2012). https://doi.org/10.1007/9783642316128_13
Jacobs, B.: Introduction to Coalgebra: Towards Mathematics of States and Observation, Cambridge Tracts in Theoretical Computer Science, vol. 59. Cambridge University Press (2016). https://doi.org/10.1017/CBO9781316823187
Jacobs, B.P.: Categorical Logic and Type Theory, Studies in logic and the foundations of mathematics, vol. 141. NorthHolland (2001). http://www.elsevierdirect.com/product.jsp?isbn=9780444508539
Katoen, J., Khattri, M., Zapreev, I.S.: A Markov reward model checker. In: Second International Conference on the Quantitative Evaluaiton of Systems (QEST 2005), pp. 243–244. IEEE Computer Society (2005). https://doi.org/10.1109/QEST.2005.2
Komorida, Y., Katsumata, S., Hu, N., Klin, B., Hasuo, I.: Codensity games for bisimilarity. In: 34th Annual ACM/IEEE Symposium on Logic in Computer Science, LICS 2019, Vancouver, BC, Canada, June 24–27, 2019, pp. 1–13. IEEE (2019). https://doi.org/10.1109/LICS.2019.8785691
Kori, M., Hasuo, I., Katsumata, S.: Fibrational initial algebrafinal coalgebra coincidence over initial algebras: turning verification witnesses upside down. In: Haddad, S., Varacca, D. (eds.) 32nd International Conference on Concurrency Theory, CONCUR 2021. LIPIcs, vol. 203, pp. 21:1–21:22. Schloss Dagstuhl  LeibnizZentrum für Informatik (2021). https://doi.org/10.4230/LIPIcs.CONCUR.2021.21
Kori, M., Urabe, N., Katsumata, S.Y., Suenaga, K., Hasuo, I.: The latticetheoretic essence of propertydirected reachability analysis (2022). https://arxiv.org/abs/2203.14261, a longer version
Mac Lane, S.: Categories for the Working Mathematician, 2nd edn. Springer, Heidelberg (1998). https://doi.org/10.1007/9781461298397
Rinetzky, N., Shoham, S.: Property directed abstract interpretation. In: Jobstmann, B., Leino, K.R.M. (eds.) VMCAI 2016. LNCS, vol. 9583, pp. 104–123. Springer, Heidelberg (2016). https://doi.org/10.1007/9783662491225_5
Seufert, T., Scholl, C.: Combining PDR and reverse PDR for hardware model checking. In: Madsen, J., Coskun, A.K. (eds.) 2018 Design, Automation & Test in Europe Conference & Exhibition. DATE 2018, pp. 49–54. IEEE (2018). https://doi.org/10.23919/DATE.2018.8341978
Seufert, T., Scholl, C.: fbPDR: Indepth combination of forward and backward analysis in property directed reachability. In: Teich, J., Fummi, F. (eds.) Design, Automation & Test in Europe Conference & Exhibition, DATE 2019. pp. 456–461. IEEE (2019). https://doi.org/10.23919/DATE.2019.8714819
Sokolova, A.: Probabilistic systems coalgebraically: a survey. Theor. Comput. Sci. 412(38), 5095–5110 (2011). https://doi.org/10.1016/j.tcs.2011.05.008
Sprunger, D., Katsumata, S., Dubut, J., Hasuo, I.: Fibrational bisimulations and quantitative reasoning. In: Cîrstea, C. (ed.) CMCS 2018. LNCS, vol. 11202, pp. 190–213. Springer, Cham (2018). https://doi.org/10.1007/9783030003890_11
Suenaga, K., Ishizawa, T.: Generalized propertydirected reachability for hybrid systems. In: Beyer, D., Zufferey, D. (eds.) VMCAI 2020. LNCS, vol. 11990, pp. 293–313. Springer, Cham (2020). https://doi.org/10.1007/9783030393229_14
Tarski, A.: A latticetheoretical fixpoint theorem and its applications. Pacific J. Math. 5(2), 285–309 (1955)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Copyright information
© 2022 The Author(s)
About this paper
Cite this paper
Kori, M., Urabe, N., Katsumata, Sy., Suenaga, K., Hasuo, I. (2022). The LatticeTheoretic Essence of Property Directed Reachability Analysis. In: Shoham, S., Vizel, Y. (eds) Computer Aided Verification. CAV 2022. Lecture Notes in Computer Science, vol 13371. Springer, Cham. https://doi.org/10.1007/9783031131851_12
Download citation
DOI: https://doi.org/10.1007/9783031131851_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 9783031131844
Online ISBN: 9783031131851
eBook Packages: Computer ScienceComputer Science (R0)