Symbolic Trajectory Evaluation Research Articles

An assertion graph based abstraction algorithm in GSTE and Its application

Generalized Symbolic Trajectory Evaluation (GSTE) is an alternative model checking technique based on particular automata to specify the properties. Despite the success of GSTE, its state explosion remains a major hurdle when applying it to large industrial designs. This paper presents two efficient theoretical underpinning abstraction algorithms based on assertion graph to combat the state explosion problem. We implement these two algorithms as a prototype system for discrete models. Experimental results show that the prototype system is 10× faster than the former without abstraction.

Symbolic trajectory evaluation for word-level verification: theory and implementation

Symbolic trajectory evaluation (STE) is a model checking technique that has been successfully used to verify many industrial designs. Existing implementations of STE reason at the level of bits, allowing signals in a circuit to take values from a lattice comprised of three elements: 0, 1, and X. This limits the amount of abstraction that can be achieved, and presents limitations to scaling STE to even larger designs. The main contribution of this paper is to show how much more abstract lattices can be derived automatically from register-transfer level descriptions, and how a model checker for the general theory of STE instantiated with such abstract lattices can be implemented in practice. We discuss several implementation issues, including how word-level circuits can be symbolically simulated using a new encoding for words that allows representing X values of sub-words succinctly. This gives us the first practical word-level STE engine, called $$\mathsf {STEWord}$$STEWord. Experiments on a set of designs similar to those used in industry show that $$\mathsf {STEWord}$$STEWord scales better than bit-level STE, as well as word-level bounded model checking.

Causality and Responsibility for Formal Verification and Beyond

The theory of actual causality, defined by Halpern and Pearl, and its quantitative measure - the degree of responsibility - was shown to be extremely useful in various areas of computer science due to a good match between the results it produces and our intuition. In this paper, I describe the applications of causality to formal verification, namely, explanation of counterexamples, refinement of coverage metrics, and symbolic trajectory evaluation. I also briefly discuss recent applications of causality to legal reasoning.

Terminal Satisfiability in GSTE

Generalized symbolic trajectory evaluation(GSTE) is an extension of symbolic trajectory evaluation (STE) and a method of model checking. GSTE specifications are given as assertion graphs. There are four efficient methods to verify whether a circuit model obeys an assertion graph in GSTE, Model Checking Strong Satisfiability (SMC), Model Checking Normal Satisfiability (NMC), Model Checking Fair Satisfiability (FMC), and Model Checking Terminal Satisfiability (TMC). SMC, NMC, and FMC have been proved and applied in industry, but TMC has not. This paper gives a six-tuple definition and presents a new algorithm for TMC. Based on these, we prove that our algorithm is sound and complete. It solves the SMC’s limitation (resulting in false negative) without extending from finite specification to infinite specification. At last, a case of using TMC to verify a realistic hardware circuit round-robin arbiter is achieved. Avoiding verifying the undesired paths which are not related to the specifications, TMC makes it possible to reduce the computational complexity, and the experimental results suggest that the time cost by SMC is 3.14× with TMC in the case.

Combining Symmetry Reduction with Generalized Symbolic Trajectory Evaluation

Combining Symmetry Reduction with Generalized Symbolic Trajectory Evaluation

A Transformation-Based Approach to Implication of GSTE Assertion Graphs

Generalized symbolic trajectory evaluation (GSTE) is a model checking approach and has successfully demonstrated its powerful capacity in formal verification of VLSI systems. GSTE is an extension of symbolic trajectory evaluation (STE) to the model checking ofω-regular properties. It is an alternative to classical model checking algorithms where properties are specified as finite-state automata. In GSTE, properties are specified as assertion graphs, which are labeled directed graphs where each edge is labeled with two labeling functions: antecedent and consequent. In this paper, we show the complement relation between GSTE assertion graphs and finite-state automata with the expressiveness of regular languages andω-regular languages. We present an algorithm that transforms a GSTE assertion graph to a finite-state automaton and vice versa. By applying this algorithm, we transform the problem of GSTE assertion graphs implication to the problem of automata language containment. We demonstrate our approach with its application to verification of an FIFO circuit.

Exploring structural symmetry automatically in symbolic trajectory evaluation

This paper presents a formal theory to characterize symmetry in netlists and symmetry in properties. The inherent correlation between the two types of symmetry is formalized as a theorem, which provides the soundness of our symmetry reduction method. A practical tactic is introduced to effectively integrate the symmetry reduction approach in a hybrid verification environment which combines theorem proving and symbolic trajectory evaluation. Finally, the effecitveness of the symmetry reduction method is demonstrated by case studies.

A novel formalization of symbolic trajectory evaluation semantics in Isabelle/HOL

This paper presents a formal symbolic trajectory evaluation (STE) theory based on a structural netlist circuit model, instead of an abstract next state function. We introduce an inductive definition for netlists, which gives an accurate and formal definition for netlist structures. A closure state function of netlists is formally introduced in terms of the formal netlist model. We refine the definition of the defining trajectory and the STE implementation to deal with the closure state function. The close correspondence between netlist structures and properties is discussed. We present a set of novel algebraic laws to characterize the relation between the structures and properties of netlists. Finally, the application of the new laws is demonstrated by parameterized verification of the properties of content-addressable memories.

A Faithful Semantics for Generalised Symbolic Trajectory Evaluation

Generalised Symbolic Trajectory Evaluation (GSTE) is a high-capacity formal verification technique for hardware. GSTE uses abstraction, meaning that details of the circuit behaviour are removed from the circuit model. A semantics for GSTE can be used to predict and understand why certain circuit properties can or cannot be proven by GSTE. Several semantics have been described for GSTE. These semantics, however, are not faithful to the proving power of GSTE-algorithms, that is, the GSTE-algorithms are incomplete with respect to the semantics. The abstraction used in GSTE makes it hard to understand why a specific property can, or cannot, be proven by GSTE. The semantics mentioned above cannot help the user in doing so. The contribution of this paper is a faithful semantics for GSTE. That is, we give a simple formal theory that deems a property to be true if-and-only-if the property can be proven by a GSTE-model checker. We prove that the GSTE algorithm is sound and complete with respect to this semantics.

GSTE is partitioned model checking

Verifying whether an ω-regular property is satisfied by a finite-state system is a core problem in model checking. Standard techniques build an automaton with the complementary language, compute its product with the system, and then check for emptiness. Generalized symbolic trajectory evaluation (GSTE) has been recently proposed as an alternative approach, extending the computationally efficient symbolic trajectory evaluation (STE) to general ω-regular properties. In this paper, we show that the GSTE algorithms are essentially a partitioned version of standard symbolic model-checking (SMC) algorithms, where the partitioning is driven by the property under verification. We export this technique of property-driven partitioning to SMC and show that it typically does speed up SMC algorithms.

A Formal Framework for Verification of Embedded Custom Memories of the Motorola MPC7450 Microprocessor

In this presentation, we will deal with verification of custom designed embedded memories. Using our paradigm, one can abstract the behavior of a memory block by a couple of artifacts--one representing its contents, and another representing its interface. We make use of the well known behavioral model known as the Efficient Memory Model (EMM) [29, 30] to represent contents of memories. We provide a methodology using which the behavior of a switch (or equivalently, transistor) level device can be specified using parameterized regular expressions. These entities can be used to abstractly describe the behavior of a bunch of switches that represent the interface of a memory. An automaton that we construct out of an abstract memory interface definition represents an abstraction of the memory interface itself. We show that such an automaton also forms a transducer that is a simulation model in a symbolic simulation environment. An EMM representing a memory core in conjunction with a transducer representing its interface is used as an abstraction of a complete memory during our automatic verification process.We also present a language formalism using which we show that the outputs from the transducers that are generated from the abstract specifications are weaker than or equal to the outputs defined by the regular expressions, in a partially ordered output space. We show that although the regular expressions are defined over exact and legal input strings, the transducers computed from them can provide outputs even when provided with weak or illegal input strings. This is an absolute necessity in order to have the capability to produce outputs when treated as a reactive system embedded in a symbolic simulation environment. Thus, we show that the simulation model generated by our technique is an conservative approximation of the corresponding abstract specification.We present a simple theory of composition that can be used to compose different simulation models used in our technique. Memories consisting of several ports result into several user-provided abstract specifications, which in turn result into several transducers that can be composed into a single transducer. That transducer in turn can be composed to a simulation model of an EMM. Our simple theory of composition also enables one to compose the abstract state space a memory core along with its ports with the concrete state space of the circuitry surrounding the memory core. We have shown that the composite simulation model representing the complete circuit has a partially ordered state space that (a) forms a complete lattice, and (b) that has a monotonic state transition function, that makes it suitable for being used in a symbolic simulation environment making use of Symbolic Trajectory Evaluation (STE) [27].The verification paradigm used is STE. For Motorola high performance microprocessors, switch level models are hand designed assuming that corresponding RTLs are golden models. Therefore, checking of equivalence between the two models is of absolute necessity as the RTL needs to be predictive of silicon behavior. We have developed a tool based on the proposed technique and used it to check that RTL descriptions of custom memories have been correctly implemented by transistor level descriptions of the same, augmented with abstract specifications of their cores. Our example circuits were taken from the state of the art Motorola MPC7450 microprocessor, a Motorola PowerPC. Experimental evidence testify to the effectiveness of the technique in catching subtle bugs in data path circuitry.

An industrially effective environment for formal hardware verification

The Forte formal verification environment for datapath-dominated hardware is described. Forte has proven to be effective in large-scale industrial trials and combines an efficient linear-time logic model-checking algorithm, namely the symbolic trajectory evaluation (STE), with lightweight theorem proving in higher-order logic. These are tightly integrated in a general-purpose functional programming language, which both allows the system to be easily customized and at the same time serves as a specification language. The design philosophy behind Forte is presented and the elements of the verification methodology that make it effective in practice are also described.

Introduction to generalized symbolic trajectory evaluation

Symbolic trajectory evaluation (STE) is a lattice-based model checking technology that uses a form of symbolic simulation. It offers an alternative to 'classical' symbolic model checking that, within its domain of applicability, often is much easier to use and much less sensitive to state explosion. The limitation of STE, however, is that it can only express and verify properties over finite time intervals. In this paper, we present a generalized STE (GSTE) that extends STE style model checking to properties over infinite time intervals. We further strengthen the power of GSTE by introducing a form of backward symbolic simulation. It can be shown that these extensions together with a notion of fairness give STE the power to verify all /spl omega/-regular properties. The generalization also gives one the power to choose and adjust the level of model abstraction in a verification effort. We shall use a large-scale industrial memory design to demonstrate the strength and practicality of GSTE.

Exploiting symmetry when verifying transistor-level circuits by symbolic trajectory evaluation: a summary

Summary form only given. We describe the use of symmetry for verification of transistor-level circuits by symbolic trajectory evaluation (STE). We present a new formulation of STE which allows a succinct description of symmetry properties in circuits. Symmetries in circuits are classified as structural symmetries, arising from similarities in circuit structure, data symmetries, arising from similarities in the handling of data values, and mixed structural-data symmetries. We use graph isomorphism testing and symbolic simulation to verify the symmetries in the original circuit. Using conservative approximations, we partition a circuit to expose the symmetries in its components, and construct reduced system models which can be verified efficiently. Introducing X-drivers into switch-level circuits simplifies the task of creating conservative approximations of switch-level circuits. Our empirical results show that exploiting symmetry with conservative approximations can allow one to verify systems several orders of magnitude larger than otherwise possible. We present results of verifying Static Random Access Memory (SRAM) circuits with up to 1.5 million transistors.

Exploiting symmetry when verifying transistor-level circuits by symbolic trajectory evaluation

We describe the use of symmetry for verification of transistor-level circuits by symbolic trajectory evaluation (STE). We present a new formulation of STE which allows a succinct description of symmetry properties in circuits, Symmetries in circuits are classified as structural symmetries, arising from similarities in circuit structure, data symmetries, arising from similarities in the handling of data values, and mixed structural-data symmetries. We use graph isomorphism testing and symbolic simulation to verify the symmetries in the original circuit, Using conservative approximations, we partition a circuit to expose the symmetries in its components, and construct reduced system models which can be verified efficiently, Introducing X-drivers into switch-level circuits simplifies the task of creating conservative approximations of switch-level circuits, Our empirical results show that exploiting symmetry with conservative approximations can allow one to verify systems several orders of magnitude larger than otherwise possible. We present results of verifying static random access memory circuits with up to 1.5 Million transistors,.

Model checking lattices: using and reasoning about information orders for abstraction

The state explosion problem is the central challenge in automatic verification using model checking. In many cases, representing the state space of a system as a lattice is an effective way of representing very large state spaces. The partial order of the lattice represents an information ordering between states, which can be used as an abstraction mechanism to reduce the computational cost of model checking. The 'traditional' logical framework for model checking finite state systems has serious deficiencies when applied to information-ordered state spaces. Interpreting the truth of a proposition about a state or a sequence of states in a four-valved truth domain is better from a modelling point of view, allowing us to reason about partial and contradictory information. Moreover, it overcomes a serious technical difficulty encountered when using a two-valued truth domain. The paper defines the syntax and semantics of a four-valued temporal logic that can be used for specifying properties of a computer system. This framework has particular relevance to hardware verification. It could be used by several model checking algorithms. Symbolic trajectory evaluation (STE) [33] is a model checking algorithm that has had success in model checking using information orderings to reduce computational cost. Previous work used a two-valued logic though, which limited the expressiveness of the logic. Using the framework presented here, the STE algorithm can be generalised, and then applied in practice to a richer logic. Some examples are shown in this paper. Keywords:Symbolic trajectory evaluation, quarternary logic, model checking, temporal logic, bilattices.

A simple theorem prover based on symbolic trajectory evaluation and BDD's

Formal hardware verification based on symbolic trajectory evaluation shows considerable promise in verifying medium to large scale VLSI designs with a high degree of automation. However, in order to verify today's designs, a method for composing partial verification results is needed. This paper presents a theory of composition for symbolic trajectory evaluation and shows how implementing this theory using a specialized theorem prover is very attractive. Symbolic trajectory evaluation is used to prove low level properties of a circuit, and these properties are combined using the prover. Providing a powerful and flexible interface to a coherent system (with automatic assistance in parts) reduces the load on the human verifier. This hybrid approach, coupled with powerful and simple data representation, increases the range of circuits which can be verified using trajectory evaluation. The paper concludes with two examples. One example is the complete verification of a 64 b multiplier which takes approximately 15 minutes on a SPARC 10 machine.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Formal verification by symbolic evaluation of partially-ordered trajectories

Symbolic trajectory evaluation provides a means to formally verify properties of a sequential system by a modified form of symbolic simulation. The desired system properties are expressed in a notation combining Boolean expressions and the temporal logic ``next-time'''' operator. In its simplest form, each property is expressed as an assertion [ A =< C ], where the antecedent A expresses some assumed conditions on the system state over a bounded time period, and the consequent C expresses conditions that should result. A generalization allows simple invariants to be established and proven automatically. The verifier operates on system models in which the state space is ordered by ``information content''''. By suitable restrictions to the specification notation, we guarantee that for every trajectory formula, there is a unique weakest state trajectory that satisfies it. Therefore, we can verify an assertion [ A =< C ] by simulating the system over the weakest trajectory for A and testing adherence to C. Also, establishing invariants correspond to simple fixed point calculations. This paper presents the general theory underlying symbolic trajectory evaluation. It also illustrates the application of the theory to the task of verifying switch-level circuits as well as more abstract implementations.