CTL Property Checking Based on a New High Level Model Without Equation Solving

Transcription

1 CTL Property Checkng Based on a New Hgh Level Model Wthout Equaton Solvng BIJAN ALIZADEH ZAINALABEDIN NAVABI Electrcal and Computer Engneerng Unversty o Tehran Buldng #2, North Kargar Ave, Faculty o Engneerng IRAN Abstract: - Ths paper descrbes the use o lnear taylor expanson dagrams or hgh level modelng dgtal crcuts or applcaton o ormal vercaton propertes at ths level. In our method, a behavoral state machne s represented by a multplexer based structure o lnear nteger equatons, and RT level propertes are drectly appled to ths representaton. Ths reduces the need or large BDD data structures and uses ar less memory. Furthermore, ths method s appled to crcuts wthout havng to separate ther data and control sectons. For ths mplementaton, we use a canoncal orm o lnear TED []. Ths paper compares our results wth those o the VIS vercaton tool that s a BDD based program. Key-Words: - Symbolc Model Checkng, Lnear TED, Equaton Solvng, Canoncal Form. Introducton On one hand, ormal methods provde exhaustve coverage o hardware behavor. On the other hand the desgner requres automated vercaton tools at hgher levels o abstracton [2, 3, 4] to very the desgn at the early stages o desgn low. So ormal vercaton methods such as symbolc model checkng have become mportant or RT or behavoral level vercaton. Most o methods use BDDs to represent the set o states and the state transton unctons [5, 6, 7]. The BDD technques may stll suer rom the memory exploson problem when the applcaton s a large datapath. Other hgh level data structures have been proposed to check equvalency o two crcuts, but they have not been used to do property checkng [8]. Bere et al. [9] propose an alternatve, symbolc model checkng approach by usng the Boolean satsablty (SAT) technques. Because o the low abstracton level BDDs, processng tme o crcuts represented as such becomes orbddngly hgh or large crcuts. Cheng et al. [0] propose a hybrd ATPG modular arthmetc constrant solvng technque or asserton checkng. However the arthmetc constrant solver s lmted to lnear constrants arsng rom adders, subtractors and multplers wth one constant nput. Fallah [] proposed a hybrd satsablty approach, HSAT, to generate unctonal test vectors or RTL desgns. Ths hybrd method generates lnear arthmetc constrants (LACs), or arthmetc operators, and conjunctve normal orm clauses or Boolean logc. Brnkmann et al. [2] use Fallah s method and propose a method or transormng conjunctons o btvector equaltes and nequaltes nto equvalent conjunctons o equatons and dsequatons n nteger lnear arthmetc. Ths method s just appled to datapath and there s necessary to use an ILP solver. Instead o usng FSMs as behavor and bt or bt vectors as data, we present a hgh level model based on lnear nteger equatons that uses nteger numbers as data and s ecent to do symbolc model checkng algorthms wth nteger data. For ths work, we use VHDL to descrbe a desgn and a subset o CTL ormat to descrbe propertes [7, 3]. Steps nvolved are extracton o a Data Flow Graph (DFG) o a desgn [4], convertng the DFG to lnear TED (LTED), and then provng the property. For evaluaton o ths work, we have

2 developed a Vsual C++ program that uses a VHDL ront. The program uses the CHIRE ntermedate ormat [5]. The man advantages o our technque are as ollows. Frst, our technque uses a hgh level model nstead o FSM, so we are able to check CTL based propertes very ecently n terms o CPU tme and memory usage, as compared wth the BDD based approaches. Second, our model can be used as a sutable model n system level vercaton to very nterconnecton o macro components. Thrd, our method does not need to solve nteger equatons explctly [9, 0, 2, 4]. Fourth, our technque can be appled to behavoral level and thereore we do not have to separate datapath and controller when the desgn becomes large. Ths paper descrbes our work n ve sectons. Secton 2 presents how to construct LTED as a canoncal representaton o expressons and Secton 3 shows how to convert DFG to LTED and then n Secton 4 we show whch subset o CTL wll be used as property. Secton 5 presents algorthms to check some basc propertes n our model. Secton 6 gves expermental results or some examples. Last secton presents a short concluson o ths work. 2 Lnear TED The LTED structure ncludes Varable, Constant, Branch, Unon and nodes. In ths representaton the algebrac expresson F(x,y, ) wll be represented by constant and lnear terms o Taylor seres expanson [], Equaton (), where const s some parts o F(x,y, ), whch are ndependent o varable x and lnear s some parts o F(x,y, ) that depend on varable x. The varable x s top varable o F(x,y, ) []. F ( x, y,...) const + x( lnear) () For representng relatonal expresson, we have just added relatonal operators, ncludng E (equal to zero), NE (not equal to zero) and GE (greater or equal to zero), to the LTED node. Each Varable node has a constrant eld whch ndcates ts range. For example consder varable as a bt type, so ts constrant eld ndcates 0. A Branch node has three elds, ncludng, and, where s a relatonal expresson,.e. CLTED node, and other elds are a LTED node. The unctonalty o a Branch node s ndcated by Equaton (2). F & + & (2) A Unon or node has two elds, ncludng Let chld and Rght chld, where these elds are LTED node. 2. Constructon o the LTED Our method needs two LTEDs called Orgnal LTED (OLTED) and Canoncal LTED (CLTED). OLTED and CLTED are drected acyclc graphs (F, B, V, E, T) and (F, U, I, V, E, T) respectvely, representng a compound o algebrac and relatonal expressons, where F s a top uncton, B s a set o Branch nodes, U s a set o Unon nodes, I s a set o nodes, V s a set o Varable nodes, E s a set o drected weghted edges connectng the nodes, and T s a set o Constant nodes. The next state and output unctons wll be shown by OLTED. CLTED s constructed when Branch nodes are converted to Unon and nodes based on Equaton (2). It happens when and elds have been converted to relatonal expressons. 2.2 LTED operatons In ths secton we are gong to descrbe how addton, subtracton, multplcaton, unon and ntersecton o two LTEDs are perormed. The addton and multplcaton operators are appled smlar to TED s ADD and MULT [] when two OLTEDs are not Branch nodes. Otherwse and elds o Branch node wll be added to (multpled by) another node as and elds o result respectvely. At ths pont two Branch nodes wth same elds wll be dstngushed to make a smpler LTED node. The unon and ntersecton operators are dened or CLTED. So we suppose two CLTEDs are algebrac expressons wth two varables ncludng relatonal operators. We must consder ollowng cases: Unon:

3 . None o nodes s Unon or, u,v V. We consder two LTEDs as two lnear equatons. Ater that we consder derent condtons o two lnear equatons to eachother. I two lnear equatons are parallel, value o coecents wll specy whch equaton s above or let hand sde o the other. Relatonal operator ndcates drecton o two equatons. At the end, we decde unon area based on relatonal operator. For example consder two lnear equatons I: +2-0 and II: Two lnes are parallel, same drectons,.e. UP, and the second one s below o the rst one. So unon o them wll be the second one. 2. Otherwse, ths procedure s called recursvely to compute OR o two CLTED nodes whch can be Unon or nodes. Ths computaton s the same as boolean unctons computaton. :. None o nodes s Unon or, u,v V. We consder two LTEDs as two lnear equatons. Ater that we consder derent condtons o two lnear equatons to eachother as explaned n Unon part. At the end, we decde ntersecton area based on relatonal operator. For example consder two lnear equatons I: +2-0 and II: agan. The o them wll be the rst one. 2. Otherwse, ths procedure s called recursvely to compute AND o two CLTED nodes whch are Unon or nodes. 2.3 Canoncal Form In ths secton we want to specy why CLTEDs are canoncal. I CLTED only ncludes Varable and Constant nodes, canoncty o TED [] s an evdence that CLTED s canoncal too. I we add relatonal operators to CLTED node, t wll reman canoncal yet, because we consder areas that are covered by two CLTEDs to compare two CLTED nodes. For example consder two LTED nodes - 0 and 0, where s a bt. Constrant 0 wll be consdered because o bt type. On the other hand 0 shows ( > 0 or < 0). When constrant s appled to ( > 0 or < 0), we wll have - 0. I CLTED ncludes Unon and nodes, It wll be canoncal yet, because we rst transer Varable, Constant and nodes to leaves o the tree and then transer Unon nodes to root o tree. On the other hand, we transorm Unon nodes to a unque orm, whch only ncludes another Unon node on ts Let-Chld sub term, and there wll be an, Varable or Constant node on ts Rght-Chld sub term. In the other word, we wll just have Unon nodes n Let-Chld part o each Unon node. Also Varable nodes are ordered rom LetChld to RghtChld n each Unon and nodes. Therore CLTEDs ncludng Unon and nodes wll be canoncal. Z Unon Z Unon Fg.. Unon and representaton For example, Fg. shows F (Z ) (Z ) ( ) as a ormula, where orderng o propostons s Z > >. 3 DFG to LTED converson The rst task s the DFG extracton [see 4]. Ater DFG extracton, we are ready to translate t to LTED. In our method, the desgn to be analyzed s represented as a system D (I, PS, NS, O, PF) wth a set o nputs I, a set o present states PS( v, v2,..., vn ), a set o next states ' ' ' NS( v, v 2,..., v n ), a set o outputs O( o, o2,..., om ), and a set o compound algebrac and relatonal expressons whch are related to next state and output unctons and are shown as Equaton (3).

4 v v... v ' ' 2 ' n ns ns 2 nsn o o o 2 m... o o 2 om (3) Next state and output unctons n DFG have multplexer based structure, whch wll be n oneto-one correspondence wth Branch node n OLTED. Thereore we can make next state and output unctons accordng to LTEDs and called them lst o TedState. The lst o TedState ncludes Id o next state varable, Id o related present state varable and value o next state varable as a LTED node. The Id o present state varable wll be there s an output or ntermedate varable as next state varable. As an example o our LTED, consder the Greatest Common Dvsor (GCD) example. The GCD algorthm s very smple: two arguments are mutually subtracted tll they become equal each other. Fg.2 shows LTED node, extracted or the nxt - 3 > 0. Ths relatonal expresson, as a OLTED node, can convert to a CLTED, accordng to Equaton (2) G - G - - GE a E Reset - Fg.2. LTED o (nxt 3 > 0) G E Start - 4 CTL subset as property We consder property as a general orm o P > Q by the ollowng grammer: P :: (P) P P P P P Varable Integer Value Q :: P E(Q) EG(Q) EF(Q) Where P s assumpton part and Q s commtment part. The most advantage o ths orm o property s that there s not necessary to take nto account the reachable state space whle provng the exstence o a path satsyng certan condtons. Ths s because the desgner speces some condtons as ntal states n assumpton E nxt part o property and thereore each property wll be checked rom ntal condtons that were speced explctly. It s clear that we can check ths subset o CTL, we wll be able to check CTL completely. 5 CTL Property Checkng n Desgn An overall vew o the CTL property checkng s shown n Fg.3. Frst, we extract LTEDs o next state and output unctons rom a syntheszed desgn. On the other hand, we extract tree structure o the Q part to specy what vercaton procedures need to be called at each level o the tree. We start satsyng a property set rom propostons or sub-ormulas to the man ormula. Four procedures, CheckCombnatonal, CheckE, CheckEG and CheckEF perorm the task o vercaton o ths lowchart. VHDL Code D FG E xtracton DFG To LTED Call Procedure n Fgures 4, 5, 6, 7 Fg.3. Flowchart o our work CTL Property ( P>Q) Extract Parse Tree o Q Converton to LTED Fg.4 shows the CheckCombnatonal procedure n the lowchart o Fg.3. When the Q part o a property s combnatonal,.e. wthout state operators, we must replace ntermedate varables by ther value speced n lst o TedState, and then convert t to CLTED. Ater that P part o property wll be elmnated rom computed CLTED. At the end o the procedure, CLTED equatons that ndcate condtons needed to satsy the property wll be returned. CheckCombnatonal (LTED Q). Replace ntermedate varables n Q by ther value elds rom lst o TedState 2. Convert Q to CLTED and smply t (Satsy t) 3. Elmnate P part rom CLTED n step 2 4. Return computed CLTED Fg.4. Combnatonal part

5 To elmnate one CLTED, e.g. u, rom another CLTED, e.g. v, we recursvely perorm ths procedure tll both o them become Varable nodes. At ths pont, ntersecton o u and v s one o them, wll be returned. Otherwse ntersecton result wll be returned. I u s or Unon node, ths procedure s called recursvely or u.let and u.rght. Fg.5 shows the CheckE procedure n the lowchart o Fg.3. When the Q part o a property only uses the next-state operator (), correctness o the property s checked n three major steps. CheckE (LTED Q). Replace present state and ntermedate varables n Q by ther value elds rom lst o TedState 2. Convert new Q to CLTED and smply t 3. Check P part s subset o CLTED rom step 2 4. Return computed CLTED Fg.5. Next State() operator These steps are current state varables to next state varables convertng, next state varables replacng and smplyng. Smplcaton s perormed based on and Unon operators whch were descrbed n secton 2.2. I P part s subset o result, ths part o vercaton s O.K. and return result as a CLTED node. Else vercaton has been aled. To specy one CLTED, e.g. u, s subset o another CLTED, e.g. v, we perorm ths procedure recursvely untl u and v become Varable nodes. Under ths condton, unon o them s the second one,.e. v, t means that u s subset o v. I u s node and u.let and u.rght are subset o v, then u wll be subset o v. I u s Unon node and u.let or u.rght s subset o v, then u wll be subset o v. Fg.6 llustrates the CheckEG procedure n the lowchart o Fg.3. When the Q part o a property only uses all states operator (G) we should compute Equaton (4). Z + Q E ( Z ); Z Q (4) In each teraton we wll compute E( Z ) n three major steps as prevously descrbed. Completon o the procedure s ndcated by Z Z +. When ths happens, equatons wll be returned that ndcate condtons needed to satsy the property beng vered. The Lmtaton parameter s number o states o the desgn. The rst mportant pont n ths algorthm s that Z + are computed by the ntersecton o Q and Z. We can dene the ntersecton o Q and Z, because they are both n terms o CLTEDs. Another mportant pont n ths algorthm s that P part exsts, t must be subset o the rst CheckE( ) to contnue algorthm. Z CheckEG (P,Q: CLTED, Lmtaton: nt) Z Q ( ) For ( 0 ; < Lmtaton ; ++ ) exz CheckE( Z ); ( 0 && P!NULL ) (P s not subset o exz) return 0; Elmnate Inputs rom exz; Z exz AND Q; + ( Z + Z ) return ; Z Z ; + retrun 0; Fg.6. All States (G) operator Fg.7 llustrates the CheckEF procedure n the lowchart o Fg.3. When the Q part o a property only uses eventually state operator (F) we should compute Equaton (5). Z + Q E ( Z ); Z Q (5) CheckEF (P,Q: CLTED, Lmtaton: nt) Z Q ( ) For ( 0 ; < Lmtaton ; ++ ) exz CheckE( Z ); Elmnate Inputs rom exz; Z exz OR Q; + ( P! NULL ) (P s subset o Z ) + return ; else ( Z + Z ) return ; Z Z ; + retrun 0; Fg.7. Eventually State (F) operator

6 In each teraton we wll compute E( Z ) n three major steps as prevously descrbed. Completon o the procedure s ndcated by Z Z + or P Z. When ths happens, + CLTED equatons wll be returned that ndcate condtons needed to satsy the property beng vered. Important pont n ths algorthm s that Z are computed by the unon o Q and + Z. Another mportant pont n ths algorthm s that P part exsts, completon o the procedure wll be speced by P Z +. 6 Expermental Results We wll very derent propertes on ve examples ncludng the Trac Lght Control (TLC), Greatest Common Dvsor (GCD), Elevator(EL), 2-Clent Arbter(2CA) and a Specal Counter (SC). The SC example s a 3-bt counter but there s a eedback rom state 5 to state 4 when nput I s. TLC Propertes:. start 0 > E(hwy_lght GREEN). Ths property means that start s zero, then a path exsts where hwy_lght wll be green at the next state. 2. start 0 > EG(hwy_lght GREEN). Ths property wll not be passed. 3. EG(hwy_lght GREEN & arm_lght GREEN). Ths property wll be aled. 4. arm_lght RED > EF(arm_lght GREEN). GCD Propertes:. Reset 0 & 3 > EF( ) > EG( < ). Ths property ndcates that 2 then a path exsts that wll always becomes less than. Ths property s not correct and wll not be passed. Table. Comparson wth VIS 3. Reset 0 & 2 > E2(Reset ). 4. Reset 0 & > 2 > E( > ). SC Propertes:. Count 7 > E(Count > 7). Ths property wll be aled. 2. Count 6 > E2(Count 0). Ths says that Count s 6 then a path exsts that Count wll be zero two states later. 3. Count 5 > EF(Count 6). 4. Count 3 > EG(Count > 3). EL Propertes:. EG(door OPEN). Ths property wll be aled. 2. EG(drecton UP). 3. EF(door CLOSED). 4. nb > EF(open_next ). Ths property means that button o rst loor has been pushed, a path exsts that sgnal open_next wll eventually become actve. Ths sgnal shows that elevator must be stopped at the next locaton. 2CA Propertes:. EF(ack ). Ths property means that a path exsts where acknowledgement o rst clent wll eventually become actve. 2. req 0 > EG(cntl BUS). Ths property wll be aled. 3. EF(cntl BUS & cntl2 BUS). Ths property s not correct. 4. cntl2 IDLE > E(cntl2 READ). Table compares our results wth those o the VIS vercaton tool [6]. As shown n the table, we have acheved less memory usage and CPU tme. In TLC example, Property consumed 0.0 second n comparson o 0. second by VIS on a Pentum III system wth 256MB RAM. Also memory usage n our method s 5.3MB that s less than 0.MB used by VIS. In example GCD, none o propertes can be checked because VIS does not support them. In example EL the last property s not supported (NS n Table ) by VIS because t ncludes condton on nput sgnal. Crcut TLC GCD SC EL 2CA Cpu Tme Property (second) Our Method VIS 0. Not Supported Cpu Tme Property2 (second) Our Method VIS.2 NS Cpu Tme Property3 (second) Our Method VIS 9.2 NS Cpu Tme Property4 (second) Our Method VIS 0.9 NS 0.56 NS 0. Number o Nodes( LTED,BDD) Our Method VIS Memory Usage (MegaByte) Our Method VIS

7 The GCD example shows mportant results whch s an evdence that our method work on datapath applcatons very well. Table shows that a BDD based approach,.e. VIS, uses 36MB memory and generates BDD nodes or 8 bt nput numbers, but our method uses 4.5MB memory and generates 32 LTED nodes. It seems to be clear that our method can accept word level propertes, but BDD based approach can not. Notce we have used Wndows-based VIS and CPU tme n VIS s just related to some parts o VIS that calls E, EG or EF unctons and s not CPU tme o all parts o VIS. In order to compute these tmes, we have added approprate VIS unctons to VIS source codes to report executon tme o E, EG or EF uncton calls. 7 Concluson In order to overcome problems related to the use o BDDs and other representatons [8], we use a hgh level o representaton nstead o FSMs. As the result, we are able to manpulate complex desgns n much less tme and memory than FSM models usng BBDs. Unlke FSM models, our representaton treats data and control unts together and s not lmted to controller crcuts or datapath crcuts ndvdually [8]. Also our model does not need to solve nteger equatons or to do satsablty checkng as some people have done [9, 0, 2, 4]. Reerence: [] M. Ceselsk, P. Kalla and Z. Zeng, Taylor Expanson Dagrams: A Compact Canoncal Representaton or Arthmetc Expressons, n DATE [2] M.C. McFarland. Formal Vercaton o Sequental Hardware. IEEE Transactons On Computer- Aded Desgn o Integrated crcuts and systems Vol. 2, No. 5, page 633, May 993. [3] C. Kern and M.R. Greenstreet. Formal Vercaton In Hardware Desgn. ACM Transactons on Desgn Automaton o Electronc Systems, Vol. 4, No. 2, Aprl 999, page 23. [4] S. Devadas, H.T. Ma and A.R. Newton. On The Vercaton o sequental machnes at derng levels o abstracton. 24 th ACM/IEEE Desgn Automaton Conerence 987, page 27. [5] H. Touat, H. Savoj and B. Ln. Implct State Enumeraton o Fnte State Machnes Usng BDD s. IEEE Transactons on Computer 990, page 30. [6] G. Cabod, P. Camurat and F. Corno. Sequental Crcut Dagnoss based on Formal Vercaton Technques. Internatonal Test Conerence 992, page 87. [7] K. McMllan. Symbolc Model Checkng. Kluwer Academc Publshers, Boston, 993. [8] R. Drechsler. Formal Vercaton o Crcuts. Kluwer Academc Publshers, [9] A. Bere, A. Cmatt, E.M. Clarke, M. Fujta and. Zhu. Symbolc Model Checkng Usng SAT Procedures Instead o BDDs. In Proceedngs DAC, June 999, pages [0] C.-. Huang and K.-T. Cheng. Asserton Checkng by Combned Word-level ATPG and Modular Arthmetc Constrant-Solvng Technques. In Proceedngs o DAC 00, pages 8-23, [] F. Fallah, S. Devadas and K. Keutzer. Functonal Vector Generaton or HDL Models Usng Lnear Programmng and 3-Satsablty. In Proceedngs o 35 th DAC-98, p.p 528. [2] R. Brnkmann and R. Drechsler. RTL-Datapath Vercaton usng Integer Lnear Programmng. In Proceedngs o IEEE VLSI Desgn 0 & Asa and South Pacc Desgn Automaton Conerence, pages , Bangalore, [3] E. Clarke, R. Enders, and T. Flkorn. Explotng Symmetry n Temporal Logc Model Checkng. Formal Methods n System Desgn 9, (996). [4] B. Alzadeh and M.R. Kakoee, Usng Integer Equatons or Hgh Level Formal Vercaton Property Checkng, n ISQED [5] M.H. Reshad, A.M. Gharehbagh and Z. Navab, Intermedate Format Standardzaton: Ambgutes, Decences, Portablty ssues, Documentaton and Improvements, HDLCon2000, March [6] Robert K. Brayton, A. Sangovann, A. Azz and et al. VIS: A system or Vercaton and Synthess. Proceedngs o the Eghth Internatonal Conerence on Computer Aded Vercaton, 996.