State Abstraction Techniques for the Verification of Reactive - - PowerPoint PPT Presentation
Title Page State Abstraction Techniques for the Verification of Reactive Circuits Designing Correct Circuits, European Joint Conference on Theory and Practice of Software, Grenoble, France april 6-7 2002 Yannis Bres, CMA-EMP / INRIA
Title Page
Designing Correct Circuits, European Joint Conference on Theory and Practice of Software, Grenoble, France april 6-7 2002 Yannis Bres, CMA-EMP / INRIA Gérard Berry, Esterel Technologies Amar Bouali, Esterel Technologies Ellen M. Sentovich, Cadence Berkeley Labs
Outline
Introduction Context of our work Finite State Machines (FSMs) Reachable State Space (RSS) computation principle and algorithm Computing Over-approximated Reachable State Space (ORSS) State variable inputization Variable abstraction using ternary-valued logic Refinement using the Esterel Selection Tree Experiment results Conclusions
Reachable State Space Uses
Computing the Reachable State Space of a design is used for: Formal verification by observers Equivalence checking Automated test pattern generation State minimization State re-encoding …
Exact RSS computation is expensive
Exponentially complex wrt. intermediate variables, in both memory and time: 1 variable per input 2 variables per state variable Several (orthogonal) techniques to reduce complexity: Application-specific partial RSS computation (transitive network sweeping) BDD pruning Decomposed FSM RSS computation Turning state variables into inputs … Our approach : abstracting variables through ternary-valued logic
Context of our work
Synchronous logical circuits (RTL level) derived from high-level hierarchical programs written in SyncCharts, ECL or Esterel Well-suited for control-dominated programs, both for hardware and software targets Implicit state set representation using BDDs (TiGeR package) Application to safety property verification (synchronous observers) Implemented as a command-line tool
FSMs
A Finite State Machine (FSM) is described by the tuple , where is the number of inputs is the number of state variables (registers) is the number of outputs is the transition function is the output function describes the set of initial states describes the valid input space
RSS computation principle
Find the limit of the converging sequence: Where becomes: Eventually, the equality becomes:
Basic RSS computation algorithm
Complexity analysis
With BDDs: ¬: constant ∨, ∧: polynomial ∃, substitutions: exponential … with respect to the number of intermediate variables ⇒ Goal: reducing the number of intermediate variables ! Constraint: be “conservative”, i.e. compute an over-approximation of the RSS Thus, if property holds on the “cheap” ORSS, it holds on the exact RSS
State variable inputization
Reduces the number of register variables 2 variables per register → 1 variable per inputized register Reduces the number of functions Increases the swept area Maintains correlation between instances of a variable i ∧ ¬i = 0 i ∨ ¬i = 1 Same number of a posteriori existential quantifications Over-approximated result because constraints between variables are relaxed “Snow-ball” effect
Ternary-valued logic
Usual Boolean logic with a third value: d or (i.e. ⊥, X, …) Parallel extension of Boolean operators: d d 1 1 ¬ 1 1 1 1 d 1 d d d d 1 1 ∨ d 1 1 d d d d 1 ∧ Dual-rail encoding of constants: 1 v1 v0 d 1 1 v
Ternary-valued logic
Ternary Valued Functions (TVFs) are encoded using a pair of Boolean functions
¬( f 0 , f 1 ) = ( f 1 , f 0 ) Standard Boolean operators are extended to TVFs:
f 0 f 1 f d
Application to RSS computation
The Boolean transition function is enlarged as: f 0 f 1 f d ¬ f f
Variable abstraction
Abstracted variables are replaced by the constant d Reduces the number of state variables 2 variables per register → 0 variable per abstracted register Reduces the number of input variables 1 variable per input → 0 variable per abstracted input Even fewer a posteriori existential quantifications Reduces the number of functions Increases the swept area Loses correlation between instances of a variable d ∧ ¬d = d d ∨ ¬d = d Even more over-approximated result “Snow-ball” effect Variables to be abstracted must be chosen with great care!
Refinement Using the Esterel Selection Tree
[ await I1 ; do something ; await I2 ; do something || await I3 ; do something ] ; await I4 ; do something 1 2 3 4 # ∨ # Gives an overapproximation ceiling Allows to reinforce input care set for inputized registers
Experiment results #1
Industrial design: fuel management system of a jet aircraft from Dassault Aviation
Experiment results #1
/ 4 5Mb / 400 0.3s 4 abstraction / 4 5Mb / 200 0.6s 4 inputization memory time 21Mb >2mn 7 correct exact 6 / 13 6Mb / 400 1.5s 4 abstraction / 13 6Mb / 150 3.8s 3 inputization 79Mb >10mn 5 correct exact 4 depth result method property Inputization gives excellent results on all properties Abstraction gives even better ones !
Experiment results #2
Undisclosed industrial design 475Mb 1h 11 14 correct exact all / 5 51Mb / 40 47s 4 + sel tree * 1.5 378Mb / 2 17mn 8 abstraction / 34 7Mb / 460 4s 4 + sel tree / 11 21Mb / 20 1mn 30s 10 inputization memory time 238Mb 30mn 13 correct exact 2 / 20 10Mb / 250 7s 7 abstraction / 22 9Mb / 85 20s 9 inputization 203Mb 28mn 13 correct exact 1 depth result method property
Experiment results #2
/ 26 8Mb / 180 11s + sel tree 3_2 / 13 16Mb / 80 25s 8 correct + sel tree false 7Mb 0.5s 2 abstraction / 19 11Mb / 80 25s 10 inputization 206Mb 33mn 13 correct exact / 9 23Mb / 80 23s + sel tree / 6 34Mb / 47 39s 8 abstraction / 460 4s + sel tree / 29 7Mb / 262 7s 10 inputization memory time 203Mb 30mn 13 correct exact 3_1 depth result method property Abstraction gives very good on most properties, but inputization often gives better ones !
Conclusions
A method to ease Reachable State Space computation, by computing an over- approximation of it, through variable abstraction, using a ternary-valued logic. Requires some abstraction hints from the designer, easy in a graphical IDE for hierarchical designs. Refinements and over-approximation ceiling from design structural informations Quite good results on a few experiments on industrial designs, although current implementation is rather crude ⇒ Abstraction figures vs. inputization ones can be improved