1. State Abstraction Techniques for the Verification of Reactive Circuits
Title Page
State Abstraction Techniques for the Verification of Reactive Circuits
Designing Correct Circuits, European Joint Conference on Theory and Practice of Software, Grenoble, France  april
Yannis Bres, CMA-EMP / INRIA Gérard Berry, Esterel Technologies Amar Bouali, Esterel Technologies Ellen M. Sentovich, Cadence Berkeley Labs

2. Outline Introduction Context of our work Finite State Machines (FSMs)
Reachable State Space (RSS) computation principle and algorithm
Computing Over-approximated Reachable State Space (ORSS)
State variable inputization
Variable abstraction using ternary-valued logic
Refinement using the Esterel Selection Tree
Experiment results
Conclusions

3. Reachable State Space Uses
Computing the Reachable State Space of a design is used for:
Formal verification by observers
Equivalence checking
Automated test pattern generation
State minimization
State re-encoding …

4. Exact RSS computation is expensive
Exponentially complex wrt. intermediate variables, in both memory and time:
1 variable per input
2 variables per state variable
Several (orthogonal) techniques to reduce complexity:
Application-specific partial RSS computation (transitive network sweeping)
BDD pruning
Decomposed FSM RSS computation
Turning state variables into inputs …
Our approach : abstracting variables through ternary-valued logic

5. Context of our work
Context of our work
Synchronous logical circuits (RTL level) derived from high-level hierarchical programs written in SyncCharts, ECL or Esterel
Well-suited for control-dominated programs, both for hardware and software targets
Implicit state set representation using BDDs (TiGeR package)
Application to safety property verification (synchronous observers)
Implemented as a command-line tool

6. FSMs A Finite State Machine (FSM) is described by the tuple , where
is the number of inputs
is the number of state variables (registers)
is the number of outputs
is the transition function
is the output function
describes the set of initial states
describes the valid input space

7. RSS computation principle
Find the limit of the converging sequence:
Where
becomes:
Eventually, the equality
becomes:

8. Basic RSS computation algorithm

9. Complexity analysis With BDDs: : constant , : polynomial
, substitutions: exponential
… with respect to the number of intermediate variables 
Goal: reducing the number of intermediate variables !
Constraint: be “conservative”, i.e. compute an over-approximation of the RSS
Thus, if property holds on the “cheap” ORSS, it holds on the exact RSS

10. State variable inputization
Reduces the number of register variables
2 variables per register  1 variable per inputized register
Reduces the number of functions
Increases the swept area
Maintains correlation between instances of a variable
i  i = 0
i  i = 1
Same number of a posteriori existential quantifications
Over-approximated result because constraints between variables are relaxed
“Snow-ball” effect

11. Ternary-valued logic
Ternary-valued logic
Usual Boolean logic with a third value: d or (i.e. , X, …)
Parallel extension of Boolean operators:  1 d  1 d  1 d
Dual-rail encoding of constants: v v0 v1 1 d

12. Ternary-valued logic
Ternary-valued logic
Ternary Valued Functions (TVFs) are encoded using a pair of Boolean functions ( f 0 , f 1 )
f 0
f 1
f d
Standard Boolean operators are extended to TVFs:
( f 0 , f 1 ) = ( f 1 , f 0 )
( f 0 , f 1 )  ( g0 , g1 ) = ( f 0  g0, f 1  g1 )
( f 0 , f 1 )  ( g0 , g1 ) = ( f 0  g0, f 1  g1 )

13. Application to RSS computation
The Boolean transition function
is enlarged as:
f 0 
f 1  f
 f
f d

14. Variable abstraction
Variable abstraction
Abstracted variables are replaced by the constant d
Reduces the number of state variables
2 variables per register  0 variable per abstracted register
Reduces the number of input variables
1 variable per input  0 variable per abstracted input
Even fewer a posteriori existential quantifications
Reduces the number of functions
Increases the swept area
Loses correlation between instances of a variable
d  d = d
d  d = d
Even more over-approximated result
“Snow-ball” effect
Variables to be abstracted must be chosen with great care!

15. Refinement Using the Esterel Selection Tree
[ await I1 ; do something ; await I2 ; do something || await I3 ; do something ] ; await I4 ; do something 1 # 2  3 # 4
Gives an overapproximation ceiling
Allows to reinforce input care set for inputized registers

16. Experiment results #1
Experiment results #1
Industrial design: fuel management system of a jet aircraft from Dassault Aviation
 ensures that the engines are properly fed
 manages system components failures
 manages the fuel load balancing between the two sides of the aircraft
 manages in-flight refueling
 …

17. Experiment results #1 property method result depth time memory 4 exact
correct 5
>10mn
79Mb
inputization 3
3.8s
/ 150
6Mb
/ 13
abstraction
1.5s
/ 400 6 7
>2mn
21Mb
0.6s
/ 200
5Mb
/ 4
0.3s
Inputization gives excellent results on all properties
Abstraction gives even better ones !

18. Experiment results #2 Undisclosed industrial design property method
depth
time
memory
all
exact
correct 14
1h 11
475Mb 1 13
28mn
203Mb
inputization 9
20s
/ 85
9Mb
/ 22
abstraction 7 7s
/ 250
10Mb
/ 20 2
30mn
238Mb 10
1mn 30s
21Mb
/ 11
+ sel tree 4 4s
/ 460
7Mb
/ 34 8
17mn
/ 2
378Mb
* 1.5
47s
/ 40
51Mb
/ 5

19. Experiment results #2 property method result depth time memory 3_1
exact
correct 13
30mn
203Mb
inputization 10 7s
/ 262
7Mb
/ 29
+ sel tree 4s
/ 460
abstraction 8
39s
/ 47
34Mb
/ 6
23s
/ 80
23Mb
/ 9
3_2
33mn
206Mb
25s
11Mb
/ 19
11s
/ 180
8Mb
/ 26
false 2
0.5s
16Mb
/ 13
Abstraction gives very good on most properties, but inputization often gives better ones !

20. Conclusions
Conclusions
A method to ease Reachable State Space computation, by computing an over-approximation of it, through variable abstraction, using a ternary-valued logic.
Requires some abstraction hints from the designer, easy in a graphical IDE for hierarchical designs.
Refinements and over-approximation ceiling from design structural informations
Quite good results on a few experiments on industrial designs, although current implementation is rather crude
 Abstraction figures vs. inputization ones can be improved