Symbolic Trajectory Evaluation - A Survey

Transcription

1 Automated Verification Symbolic Trajectory Evaluation - A Survey by Mihaela Gheorghiu Department of Computer Science University of Toronto Instructor: Prof. Marsha Chechik January 3, 24

2 Motivation Simulation vs. verification... Multi-valued vs. symbolic simulation Symbolic Trajectory Evaluation (STE) - a multi-valued symbolic verification method based on simulation STE vs. model-checking

3 Basic STE Theory Model Complete lattice of states Monotonic next-state function Behaviors Infinite sequences Infinite trajectories - sequences obeying next-state function, for all Lattice order extended to sequences and trajectories pointwe, iff for all

4 Example (I) Inverter circuit (or Information partial order

5 Example (II) Each circuit node has excitation, constraint on its next value for all states so Sequence a trajectory Sequence not

6 Logic Trajectory formulas Atom - simple state predicate, monotonic, and having unique lowest state, defining state, where true e.g., with defining state - true of a trajectory iff true of its initial state Conjunction of trajectory formulas - usual semantics true of Next-time formula - true of trajectory iff Nothing else Exemple for inverter:

7 Specification Assertions with trajectory formulas True of a model iff for every trajectory if then Better: set of trajectories satfying satfying contained in that of those Inverter specification: In LTL:

8 Verification (I) To check Consider defining sequence for all trajectories satfying are those above th sequence Make it into defining trajectory the lowest trajectory satfying Consider defining sequence for Check

9 Verification (II) In general, to check check where, respectively Justification are the defining sequence for and defining trajectory for trajectories satfying trajectories satfying trajectories satfying

10 Symbolic Version Allow Boolean variables Inverter specification becomes Checked by True iff inequality holds for all possible interpretations of the variables There are symbolic states, sequences, trajectories, formulas Symbolic means parameterized by Boolean variables Implemented using BDDs!

11 A Few Points - fails: + simulation only works forward defining sequence for defining sequence for : : succeeds, but vacuity detected defining trajectory for their conjunction by pointwe lub + Verification does not depend on the size of the state space - Four-valued state space, but two-valued verification answer - Very restricted verification capabilities - only over finite sequences, cannot reason about eventuality, or support djunction, etc.

12 Beyond Basics Fixpoint computations for checking assertions of type Using enriched syntax and a four-valued information + truth lattice Z true false Generalized STE for checking assertion graphs representing all -regular properties true true write no overwrite read data correct

13 Forte Tool Forte a formal verification environment implementing STE, used at Intel First and current restricted academic version released January 23 Essentially performs symbolic simulation, not verification Example of STE invocation let ant = [(T, "out[]", T,, ), (T, "out[]", T,, ), (T, "c", F,, ), (T, "c", T,, 2)]; let cons = [(T, "out[]", F,, 2), (T, "out[]", F,, 2)]; STE "" model [] ant cons trace;

14 Summary and Open Problems STE a special-purpose model-checking method Successfully used in industry (Intel, IBM, Motorola) to verify large memories and datapth circuits Relationship to standard model-checking still unclear Formally shown to be a form of data-flow analys and its multi-valued models of circuits to be over-approximations of concrete ones To do: prove a direct relationship with multi-valued abstraction and model-checking as we know them To do: see how standard model-checking can benefit from STE