Lecture 3: Model-checker NuSMV B. Srivathsan Chennai Mathematical - - PowerPoint PPT Presentation

▶
lecture 3 model checker nusmv
SMART_READER_LITE
LIVE PREVIEW

Lecture 3: Model-checker NuSMV B. Srivathsan Chennai Mathematical - - PowerPoint PPT Presentation

Oct 06, 2022 592 likes •1.72k views

Lecture 3: Model-checker NuSMV B. Srivathsan Chennai Mathematical Institute NPTEL-course July - November 2015 1 / 31 Model-checker Specify the model of the system Specify the requirements Model-checker will automatically check if system

slide-1
SLIDE 1

Lecture 3: Model-checker NuSMV

  • B. Srivathsan

Chennai Mathematical Institute

NPTEL-course July - November 2015

1/31

slide-2
SLIDE 2

Model-checker

◮ Specify the model of the system ◮ Specify the requirements

Model-checker will automatically check if system satisfies requirements

2/31

slide-3
SLIDE 3

Specifying the system

View the computation as a sequence of states

3/31

slide-4
SLIDE 4

Specifying the system

View the computation as a sequence of states A state is a valuation of the variables

3/31

slide-5
SLIDE 5

Specifying the system

View the computation as a sequence of states A state is a valuation of the variables

◮ Declare the variables

3/31

slide-6
SLIDE 6

Specifying the system

View the computation as a sequence of states A state is a valuation of the variables

◮ Declare the variables ◮ Define the initial values of the variables

3/31

slide-7
SLIDE 7

Specifying the system

View the computation as a sequence of states A state is a valuation of the variables

◮ Declare the variables ◮ Define the initial values of the variables ◮ Define the next-state relation

3/31

slide-8
SLIDE 8

Specifying the system

View the computation as a sequence of states A state is a valuation of the variables

◮ Declare the variables ◮ Define the initial values of the variables ◮ Define the next-state relation

In this course: model-checker NuSMV

3/31

slide-9
SLIDE 9

NuSMV

New Symbolic Model Verifier http://nusmv.fbk.eu/

4/31

slide-10
SLIDE 10

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1 5/31

slide-11
SLIDE 11

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main

5/31

slide-12
SLIDE 12

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main VAR x: boolean; r: boolean;

5/31

slide-13
SLIDE 13

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main VAR x: boolean; r: boolean; ASSIGN init(r) := FALSE;

5/31

slide-14
SLIDE 14

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main VAR x: boolean; r: boolean; ASSIGN init(r) := FALSE; next(r) := x xor r;

5/31

slide-15
SLIDE 15

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main VAR x: boolean; r: boolean; DEFINE y := !(x xor r); ASSIGN init(r) := FALSE; next(r) := x xor r;

5/31

slide-16
SLIDE 16

y = NOT ( XOR (x,r) ) rnext = XOR (x,r)

XOR NOT

x

y

r register

x = 0,r = 0,y = 1 x = 1,r = 0,y = 0 x = 0,r = 1,y = 0 x = 1,r = 1,y = 1

MODULE main VAR x: boolean; r: boolean; DEFINE y := !(x xor r); ASSIGN init(r) := FALSE; next(r) := x xor r;

NuSMV demo: circuit-demo1.smv

5/31

slide-17
SLIDE 17

l1 l2 x < 10 x := x+1

6/31

slide-18
SLIDE 18

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN

6/31

slide-19
SLIDE 19

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100;

6/31

slide-20
SLIDE 20

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0;

6/31

slide-21
SLIDE 21

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case esac;

6/31

slide-22
SLIDE 22

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; esac;

6/31

slide-23
SLIDE 23

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; esac;

6/31

slide-24
SLIDE 24

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; TRUE: location; esac;

6/31

slide-25
SLIDE 25

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; TRUE: location; esac; next(x) := case esac;

6/31

slide-26
SLIDE 26

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; TRUE: location; esac; next(x) := case (location = l2) & x < 100: x+1; esac;

6/31

slide-27
SLIDE 27

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; TRUE: location; esac; next(x) := case (location = l2) & x < 100: x+1; TRUE: x; esac;

6/31

slide-28
SLIDE 28

l1 l2 x < 10 x := x+1 MODULE main VAR ASSIGN location: {l1,l2}; x: 0 .. 100; init(location) := l1; init(x) := 0; next(location) := case (location = l1) & (x<10): l2; (location = l2) : l1; TRUE: location; esac; next(x) := case (location = l2) & x < 100: x+1; TRUE: x; esac; NuSMV file: pg-demo.smv

6/31

slide-29
SLIDE 29

MODULE main VAR request: boolean; status: {ready, busy}

7/31

slide-30
SLIDE 30

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy}

7/31

slide-31
SLIDE 31

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready;

7/31

slide-32
SLIDE 32

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

7/31

slide-33
SLIDE 33

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

7/31

slide-34
SLIDE 34

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

7/31

slide-35
SLIDE 35

Coming next: checking requirements in NuSMV

8/31

slide-36
SLIDE 36

l1 l2 x < 10 x := x+1

Executions

l1, x=0 l2, x=0 l1, x=1 l2, x=1 l1, x=9 l2, x=9 l1, x=10

. . .

9/31

slide-37
SLIDE 37

request=1 ready request=1 busy request=0 ready request=0 busy

Executions

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 busy request=1 busy request=0 busy

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

10/31

slide-38
SLIDE 38

Transition system satisfies a requirement means all its executions satisfy the requirement

11/31

slide-39
SLIDE 39

Requirement type 1: G

12/31

slide-40
SLIDE 40

Requirement type 1: G

G (x >= 0)

l1 l2 x < 10 x := x+1 l1, x=0 l2, x=0 l1, x=1 l2, x=1 l1, x=9 l2, x=9 l1, x=10

. . .

12/31

slide-41
SLIDE 41

Requirement type 1: G

G (x >= 0) TS of above PG with initial value x=0 satisfies G (x >= 0)

l1 l2 x < 10 x := x+1 l1, x=0 l2, x=0 l1, x=1 l2, x=1 l1, x=9 l2, x=9 l1, x=10

. . .

12/31

slide-42
SLIDE 42

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=0)

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

13/31

slide-43
SLIDE 43

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=0)

×

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

13/31

slide-44
SLIDE 44

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=0)

× ×

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

13/31

slide-45
SLIDE 45

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=0)

× ×

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

13/31

slide-46
SLIDE 46

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=0)

× ×

  • TS does not satisfy

G (request=0)

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

13/31

slide-47
SLIDE 47

...

T T T T T T

Execution satisfies G (expr) if expr evaluates to T in all its states

14/31

slide-48
SLIDE 48

...

T T T T T T

Execution satisfies G (expr) if expr evaluates to T in all its states Transition system satisfies G (expr) if all its executions satisfy G (expr)

14/31

slide-49
SLIDE 49

Checking the G requirement: NuSMV demo

15/31

slide-50
SLIDE 50

Requirement type 2: F

16/31

slide-51
SLIDE 51

Requirement type 2: F

F (x >= 5)

l1 l2 x < 10 x := x+1 l1, x=0 l2, x=0 l1, x=1 l2, x=1 l1, x=9 l2, x=9 l1, x=10

. . .

16/31

slide-52
SLIDE 52

Requirement type 2: F

F (x >= 5) TS of above PG with initial value x=0 satisfies F (x >= 5)

l1 l2 x < 10 x := x+1 l1, x=0 l2, x=0 l1, x=1 l2, x=1 l1, x=9 l2, x=9 l1, x=10

. . .

16/31

slide-53
SLIDE 53

request=1 ready request=1 busy request=0 ready request=0 busy

F (request=1)

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

17/31

slide-54
SLIDE 54

request=1 ready request=1 busy request=0 ready request=0 busy

F (request=1)

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

17/31

slide-55
SLIDE 55

request=1 ready request=1 busy request=0 ready request=0 busy

F (request=1)

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

17/31

slide-56
SLIDE 56

request=1 ready request=1 busy request=0 ready request=0 busy

F (request=1)

  • ×

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

17/31

slide-57
SLIDE 57

request=1 ready request=1 busy request=0 ready request=0 busy

F (request=1)

  • ×

TS does not satisfy F (request=1)

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . . ...

17/31

slide-58
SLIDE 58

...

T

Execution satisfies F (expr) if expr evaluates to T in one of its states

18/31

slide-59
SLIDE 59

...

T

Execution satisfies F (expr) if expr evaluates to T in one of its states Transition system satisfies F (expr) if all its executions satisfy F (expr)

18/31

slide-60
SLIDE 60

Checking the F requirement: NuSMV demo

19/31

slide-61
SLIDE 61

Coming next: Combining G and F

20/31

slide-62
SLIDE 62

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=1 => F status=busy)

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . .

21/31

slide-63
SLIDE 63

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=1 => F status=busy)

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . .

21/31

slide-64
SLIDE 64

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=1 => F status=busy)

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . .

21/31

slide-65
SLIDE 65

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=1 => F status=busy)

  • request=0

ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . .

21/31

slide-66
SLIDE 66

request=1 ready request=1 busy request=0 ready request=0 busy

G (request=1 => F status=busy)

  • TS satisfies

G (request => F (status=busy))

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

request=1 ready request=1 busy request=0 ready request=1 busy request=0 ready

. . .

request=0 ready request=0 ready request=0 ready request=0 ready request=0 ready

. . .

21/31

slide-67
SLIDE 67

Summary

Using NuSMV

Format for writing models G and F requirements

22/31

slide-68
SLIDE 68

Summary

Using NuSMV

Format for writing models G and F requirements

Coming next: More circuits

22/31

slide-69
SLIDE 69

NAND

in1 in2

  • ut

23/31

slide-70
SLIDE 70

NAND

in1 in2

  • ut

MODULE main VAR in1: boolean; in2: boolean; DEFINE −− ZERO DELAY

  • ut := !(in1 & in2);

23/31

slide-71
SLIDE 71

NAND

in1 in2

  • ut

1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean; DEFINE −− ZERO DELAY

  • ut := !(in1 & in2);

23/31

slide-72
SLIDE 72

NAND

in1 in2

  • ut

1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean; DEFINE −− ZERO DELAY

  • ut := !(in1 & in2);

23/31

slide-73
SLIDE 73

NAND

in1 in2

  • ut

1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean; DEFINE −− ZERO DELAY

  • ut := !(in1 & in2);

23/31

slide-74
SLIDE 74

NAND

in1 in2

  • ut

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-75
SLIDE 75

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-76
SLIDE 76

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-77
SLIDE 77

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-78
SLIDE 78

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-79
SLIDE 79

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR in1: boolean; in2: boolean;

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

24/31

slide-80
SLIDE 80

NAND

in1 in2

  • ut

1 1 1 1 1 1 1 1 1 1 1 1

MODULE main VAR input1: boolean; input2: boolean; q: nand2(input1, input2); MODULE nand2(in1, in2) VAR

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

25/31

slide-81
SLIDE 81

NAND

x1 x2

NAND

y1 y2

XOR MODULE main VAR x1: boolean; x2:boolean; y1: boolean; y2:boolean; q1: nand2(x1, x2); q2: nand2(y1, y2); DEFINE −− ZERO DELAY fout := q1.out xor q2.out; MODULE nand2(in1, in2) VAR

  • ut:

boolean; ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

26/31

slide-82
SLIDE 82

NAND

x

NAND

y

XOR MODULE main VAR x: boolean; y: boolean; q1: nand2(x, q2.out); q2: nand2(q1.out, y); DEFINE −− ZERO DELAY fout := q1.out xor q2.out; MODULE nand2(in1, in2) VAR

  • ut:

boolean ASSIGN −− UNIT DELAY init(out) := TRUE; next(out) := !(in1 & in2);

27/31

slide-83
SLIDE 83

Coming next: Three-bit adder

28/31

slide-84
SLIDE 84

MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-85
SLIDE 85

bit0 bit1 bit2 carry_in value carry_out 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-86
SLIDE 86

bit0 bit1 bit2 carry_in value carry_out 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-87
SLIDE 87

bit0 bit1 bit2 carry_in value carry_out 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-88
SLIDE 88

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-89
SLIDE 89

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-90
SLIDE 90

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-91
SLIDE 91

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-92
SLIDE 92

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-93
SLIDE 93

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-94
SLIDE 94

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-95
SLIDE 95

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-96
SLIDE 96

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-97
SLIDE 97

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-98
SLIDE 98

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-99
SLIDE 99

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-100
SLIDE 100

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-101
SLIDE 101

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 MODULE counter_cell(carry_in) VAR value:boolean; ASSIGN init(value):=FALSE; next(value):= value xor carry_in; DEFINE carry_out := carry_in & value; MODULE main VAR bit0:counter_cell(TRUE); bit1:counter_cell(bit0.carry_out); bit2:counter_cell(bit1.carry_out);

29/31

slide-102
SLIDE 102

bit0 bit1 bit2 carry_in value carry_out 1

30/31

slide-103
SLIDE 103

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1

30/31

slide-104
SLIDE 104

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1

30/31

slide-105
SLIDE 105

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30/31

slide-106
SLIDE 106

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30/31

slide-107
SLIDE 107

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30/31

slide-108
SLIDE 108

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30/31

slide-109
SLIDE 109

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30/31

slide-110
SLIDE 110

bit0 bit1 bit2 carry_in value carry_out 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Synchronous composition All assignments to all MODULES occur simultaneously

(more about this later)

30/31

slide-111
SLIDE 111

Summary

Hierarchical designs

Use of MODULE Synchronous composition

31/31

slide-112
SLIDE 112

Take-away

◮ Computation as a sequence of states ◮ Specify initial values for variables ◮ Specify next-state relation: how the variables change given the

current valuation

◮ NuSMV models of simple systems ◮ Requirements G and F

32/31