Automatic Abstraction Refinement for GSTE Yan Chen, Yujing He, and Fei Xie Portland State University Jin Yang Intel Nov 13, 2007

Our Contributions AutoGSTE – An automatic approach to abstraction refinement for GSTE Quickly converge to good abstractions that enable verifications that are not possible before Allow assertion graphs to be high-level w/o adapting too much to circuit implementation 2

Outline Overview of (G)STE Quaternary Abstraction and its Imprecision Our Solution – AutoGSTE Counterexample-guided abstraction refinement Model refinement and specification refinement Experiments Conclusion & Future Work 3

Symbolic Trajectory Evaluation [Bryant & Seger] Scalability Model checking complexity largely depends on the complexity of the assertion rather than the circuit Pros: Highly efficient Cons: False negatives due to insufficient input constraints R. Tzoref, O. Grumberg, Automatic refinement and vacuity detection for STE, CAV’06 J. Roorda, K. Clarssen, Sat-based assistance to abstraction refinement for STE, CAV’06 Only properties over finite time  GSTE 4

Generalized STE [Yang & Seger] ω -regular properties represented by assertion graphs G = { (V, v 0, E, ant, cons) } Non-deterministic execution Fixed-point computation 5

GSTE Algorithm 6 Algorithm: GSTE(G, post) (* initialize symbolic simulation *) 1. for each edge e in G 2. if e is from the initial vertex 3. sim(e) := ant(e); 4. put e in EventQueue; 5. else 6. sim(e) := { }; (* perform symbolic simulation *) 7. while EventQueue is not empty 8. get an edge e from the queue, 9. for each successor edge e’ of e begin 10. sim(e’) := sim(e’)  post(sim(e))  ant(e’); 11. if there is a change in sim(e’) 12. put e’ into EventQueue; end (* check consequence *) 13. for each edge e in G 14. if !(sim(e)  cons(e)) return false; 15. return true; end.

Outline Overview of (G)STE Quaternary Abstraction and its Imprecision Our Solution – AutoGSTE Counterexample-guided abstraction refinement Model refinement and specification refinement Experiments Conclusion & Future Work 7

Quaternary-Value Logic (Unknown) (Conflict) Information Partial OrderPropagation of “Unknown” Two sides of a coin Significantly reduce state spaces by quaternary abstraction Over abstractions cause false negatives  8

1 X Causes of False Negative: Quaternary State Set Unions A B Out 1 0 1X X X Abs sim(e’) := sim(e’)  post(sim(e))  ant(e’); 11 Check whether the output is always 1 under certain inputs

Causes of False Negative: Existentially Quantified-Out Symbolic Variables c1,c2 is existentially quantified out after every single step simulation 10 [A=c1, B=(!c1|c2)] Out=A|B=c1|(!c1|c2)=1 [A=X, B=X] Out=A|B=X A B Out

Outline Overview of (G)STE Quaternary Abstraction and its Imprecision Our Solution – AutoGSTE Counterexample-guided abstraction refinement Model refinement and specification refinement Experiments Conclusion & Future Work 11

AutoGSTE: Automatic Abstraction Refinement (1) GSTE Circuit Impl. Assertion Graph Assertion holds Counter Example (2) Counter Example Analysis Assertion fails Causes of Imprecision (3) Abstraction Refinement Refined Abstraction Abstraction refinement: (monotonic) (1) Constraining inputs with symbolic constants/variables (2) Model refinement: introducing precise nodes (3) Spec refinement: assertion graph transformations Causes of imprecision in GSTE’s quaternary abstraction: (1) Under-constrained inputs; (2) Quaternary state set unions; (3) Existentially quantified-out symbolic variables

Counter Example Analysis Counter Example [(edge 1,src 1,dest 1 ),…,(edge T, src T,dest T )] Identify “X” nodes in dest T that violates consequent on edge T Backtrack to identify the causes for “X” node N In the end, the following causes will be identified: Output circuit nodes/assertion edges on which Xs are introduced. 13 InputUnionWeak

AutoGSTE: Automatic Abstraction Refinement (1) GSTE Circuit Impl. Assertion Graph Assertion holds Counter Example (2) Counter Example Analysis Assertion fails Causes of Imprecision (3) Abstraction Refinement Refined Abstraction Abstraction refinement: (1) Constraining inputs with symbolic constants/variables (2) Model refinement: introducing precise nodes (3) Spec refinement: assertion graph transformations Causes of imprecision in GSTE’s quaternary abstraction: (1) Under-constrained inputs; (2) Quaternary state set unions; (3) Existentially quantified-out symbolic variables

Model Refinement Symbolic Indexing (Verifier has to encode it in the specification) Abs. Partition Abs.rew. Finer Partition 15

Model Refinement (Cont.) Precise Nodes: Circuit nodes that must always have boolean values by symbolic indexing [Yang and Seger, FMCAD’02] Manually specify precise nodes to eliminate Xs caused by both unions and weaks. AutoGSTE automatically marks precise nodes Mark all the identified nodes as precise Mark one node at a time (control signals first?) 16

Specification Refinement Loop unrolling transformations address unions Allow the specification to be high level Dynamically adapt to the real computation flow of the circuit …… 17

Automating loop unrolling Unroll each problematic edge to prevent unwanted state set unions Specification Refinement (Cont.)

Case splitting transformations address weaks Symbolic variables symbolically index a set of edges with scalar values Remember the variable values by case splitting Specification Refinement (Cont.) 19

Outline Overview of (G)STE Quaternary Abstraction and its Imprecision Our solution – AutoGSTE Counterexample-guided abstraction refinement Model Refinement.vs. Specification Refinement Experiments Conclusion & Future Work 20

Experiment: FIFO 21

FIFO Model Refinement CircuitMark precise nodes all at onceMark precise nodes one a time FIFO Depth # of Nodes # of Iter. # of P. Nodes Time (Sec.) BDD Nodes # of P. Nodes Time (Sec.) BDD Nodes Better than manual analysis! 22

FIFO Specification Refinement CircuitGSTE on Original assertion graphSemantic-Preserving Transformation FIFO Depth # of Edges Time (Sec.) BDD Nodes Mem (MB) Result # of Edges Time (Sec.) BDD Nodes Mem (MB) Result Fail Pass Fail Pass Fail Pass Fail Pass Too complex to do manually! 23

Conclusion & Future Work An automatic approach to abstraction refinement for GSTE Quickly converge to good abstractions Future work Identify minimal set of precise nodes Reduce unnecessary loop-unrolling/case-splitting Integrate model refinement and spec refinement 27