Digitaalsüsteemide verifitseerimise kursus1 Formal verification: Property checking Property checking

Digitaalsüsteemide verifitseerimise kursus2 Property checking If designs to be verified are sequential and the correspondence of states is not known then equivalence checking not an option Property checking traverses the full search space (bounded or unbounded) to check if a property holds in the design. Property checking needed if incomplete or abstract specifications verified

Digitaalsüsteemide verifitseerimise kursus3 safety property states that an undesired property should not hold liveness property states that a necessary property should hold fairness property states that some states are traversed repeatedly Types of properties

Digitaalsüsteemide verifitseerimise kursus4 Communication between TLC and property automaton with properties: 1.North-South traffic has a different light than East-West traffic. 2.Traffic light follows the sequence R,G,Y,R,G,Y.... Properties as an automaton

Digitaalsüsteemide verifitseerimise kursus5 Properties as an automaton

Digitaalsüsteemide verifitseerimise kursus6 Temporal structure & computation trees In general, using property automata is inconvenient Therefore other approaches applied: temporal logic, computation trees …

Digitaalsüsteemide verifitseerimise kursus7 State graph and state sequence Temporal structure & computation trees

Digitaalsüsteemide verifitseerimise kursus8 State transitions tree Temporal structure & computation trees

Digitaalsüsteemide verifitseerimise kursus9 Kripke structures: computational tree

Digitaalsüsteemide verifitseerimise kursus10 Temporal-logic Consider 3 logics: –LTL (linear temporal logic), –CTL (computation tree logic) and –CTL* LTL assumes linear time model, while CTL assumes branch time model Two types of formulae in temporal logic: state and path formulae

Digitaalsüsteemide verifitseerimise kursus11 Temporal-logic: LTL LTL considers a single path 2 temporal operations: X(neXt) and U(Until) LTL formulae: –Every Boolean variable is an LTL formula –If f and g are LTL formulae, then ~f and f+g are LTL formulae –If f and g are LTL formulae, then fUg and Xg are LTL formulae

Digitaalsüsteemide verifitseerimise kursus12 More complex functions can be derived: Fg = TRUE U g, i.e. g will eventually become true Gf = ~(F~f), i.e. f is always (globally) true fRg = ~(~f U ~g), i.e. f must be false until g becomes true (Release operation) Temporal-logic: LTL

Digitaalsüsteemide verifitseerimise kursus13 Temporal-logic: LTL

Digitaalsüsteemide verifitseerimise kursus14 CTL includes 8 operators: AX,EX,AG,EG,AF,EF,AU ja EU In fact can be represented by three: EX,EG and EU AXf = ~EX(~f) AF(f) = ~EG(~f) AG(f) = ~EF(~f) EF(f) = E( TRUE U f) A(fUg) = (~E(~gU(~f)(~g)))(~EG(~g)) Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus15 Operation AX(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus16 Operation EX(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus17 Operation AG(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus18 Operation EG(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus19 Operation AF(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus20 Operation EF(f): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus21 Operation A(fUg): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus22 Operation E(fUg): Temporal-logic: CTL

Digitaalsüsteemide verifitseerimise kursus23 Temporal-logic: System Verilog Assertions System Verilog Assertions and PSL also temporal languages!

Digitaalsüsteemide verifitseerimise kursus24 Property checking in automata 1.Describe property as automaton, such that some states represent success or failure of property 2.Compose design automaton with property automaton 3.Property succeeds only iff no failure composite state is reachable

Digitaalsüsteemide verifitseerimise kursus25 A and B throw dice. When A gets more points, then –A’s score incremented by 1, if the score is not 2. If score is 2, then it becomes 0 again. –B’s score skoor is decremented by 1, if score not 0. If B gets more points, then the same applies but A and B interchanged. If A, B get equal points then score unchanged. Property checking in automata: throwing dice

Digitaalsüsteemide verifitseerimise kursus26 Check two properties: 1.Can we have a draw1:1? 2.Can we have a draw 2:2? Property checking in automata: throwing dice

Digitaalsüsteemide verifitseerimise kursus27 Property checking in automata: throwing dice

Digitaalsüsteemide verifitseerimise kursus28 Property checking in automata: throwing dice

Digitaalsüsteemide verifitseerimise kursus29 Language containment Verify: L(D)  L(P)? 1.Construct complementary automaton ¬P for property automaton P 2.Compose: D × ¬P 3.L(D)  L(P), if L(D × ¬P) = Ø

Digitaalsüsteemide verifitseerimise kursus30 Language containment in verification

Digitaalsüsteemide verifitseerimise kursus31 Symbolic computation and model-checking Graph based algorithms described above operated with automata and Kripke structures Not applicable to large designs. A circuit with 100 flipflops has states... In Symbolic computation we don’t enumerate states but convert state traversal to Boolean functions We can verify larger designs

Digitaalsüsteemide verifitseerimise kursus32 Forward traversal of states: Symbolic computation and model-checking

Digitaalsüsteemide verifitseerimise kursus33 Generating counter-examples Forward traversal until faulty state reached Backward traversal from the faulty state using symbolic computation During backward traversal we limit the state image with the ones obtained during forward traversal This is needed to reach the initial state!

Digitaalsüsteemide verifitseerimise kursus34 Generating counter-examples

Digitaalsüsteemide verifitseerimise kursus35 Equivalence of Sequential Circuits How to perform sequential equivalence checking without one to one mapping in states? Have to check whether the output state 1 of the combined miter circuit is reachable