Add IC3/PDR engine for unbounded safety verification

[lsk567]

Summary

• Adds an IC3/PDR (Property Directed Reachability) engine that proves unbounded safety properties without requiring a bound, complementing the existing BMC and k-induction engines
• Supports ic3 as a new control command (usage: v = ic3; check; print_results; v.print_cex;)
• Handles infinite-state (integer arithmetic) systems via symbolic cubes and integer inequality generalization
• Generates concrete counterexample traces compatible with print_cex and print_cex_json

Changes

• IC3Engine.scala (new): Core IC3/PDR algorithm — frame management, proof obligations, consecution checks, cube generalization (unsat cores + sign-based inequality abstraction), clause propagation, fixpoint detection, and BMC-style CEX trace reconstruction
• Context.scala: Add checkAssumptions() / getUnsatCore() to solver interface
• Z3Interface.scala: Implement assumption-based checking and unsat core extraction via Z3 Java API
• ControlCommandChecker.scala: Add ic3 command validation
• SymbolicSimulator.scala: Add ic3 command dispatch with label support for print_cex
• build.sbt: Configure java.library.path for Z3 native libraries
• Test files: test-ic3-0.ucl (property proved), test-ic3-1.ucl (CEX found + printed), test-ic3-2.ucl (requires strengthening)

Test plan

• test-ic3-0.ucl: x >= 0 proved (1-inductive, fixpoint at frame 2)
• test-ic3-1.ucl: x < 5 fails with CEX trace (x: 0→1→2→3→4→5)
• test-ic3-2.ucl: y <= x proved with strengthening (not 1-inductive, fixpoint at frame 4)
• examples/cpu_induction.ucl: All 9 properties proved (bitvectors, enums, uninterpreted types, arrays)
• Full test suite: no regressions (34 pre-existing failures unchanged)

🤖 Generated with Claude Code

[KE7]

LGTM

[polgreen]

Minor point:

• the tests aren't included in the regression tests run by the CI
• it would be helpful if it could output the final frame so you could sanity check that frame is actually inductive and sufficient to prove the property

Major point:

• this doesn't work. I haven't looked into why, but this property passes using IC3, and fails using BMC:

/* Test IC3: property should fail due to overflow */
module main {
  var x : bv3;

  init {
    x = 1bv3;
  }

  next {
    x' = x + 1bv3;
  }

  invariant x_non_neg : x > 0bv3;

  control {
    v1 = bmc(3); // fails
    check;
    v1.print_cex(x);
    v2 = ic3; // passes, and should not
    check;
    v2.print_cex(x);
  }
}

[polgreen]

why do we need this now?

[polgreen]

why do we need this now?

[polgreen]

These tests need to be added to the regression tests that are run by CI

[polgreen]

I don't know if this should be inside the Z3 interface or within IC3, it seems specific to IC3

[polgreen]

Also, really hard to debug this because I can't make sense of the SMT files it prints, because it prints one to check the initial state, and then it prints two that just contain the property and nothing else

[polgreen]

This doesn't work:

module main {
  var x : real;
  var y: real;

  init {
    x = 0.0;
    y = 5.0;
  }

  next {
    x' = x + y;
    y' = y - 2.0;
  }

  invariant x_pos : x >= 0.0;

  control {
    v = ic3; // passes with IC3
    //v = bmc(10); // fails with bmc
    check;
    print_results;
    v.print_cex;
  }
}

[polgreen]

See the example I've given above; this needs to handle and test all the datatypes we support, not just integers and bitvecs

[polgreen]

You need to consider all the datatypes we support, not just bitvectors and integers