Mathematica for the symbolic. Combining ACL2 and. ACL2 Workshop 2003 Boulder,CO. TIMA Laboratory -VDS Group, Grenoble, France

Transcription

1 Combining ACL2 and Mathematica for the symbolic simulation of digital systems AL SAMMANE Ghiath, BORRIONE Dominique, OSTIER Pierre, SCHMALTZ Julien, TOMA Diana TIMA Laboratory -VDS Group, Grenoble, France ACL2 Workshop 2003 Boulder,CO VDS Diana Toma 1

2 Symbolic simulation Symbolic simulation - semi-formal technique based on numeric simulation : some inputs are valued, others stay symbolic results: arithmetic and logical expressions Problems: Symbolic expressions become very large with the number of simulation cycles The simulation tree grows exponentially (with conditional statements when the condition is a symbolic term) The results are unreadable VDS Diana Toma 2

3 Constrained Symbolic Simulation Two aspects of the simulation: algebraic computation -> Mathematica branching decision -> ACL2 Constraints: data type restrictions, inequalities and equalities between expressions composed of design variables or input signals and arithmetic operators VDS Diana Toma 3

4 Constrained Symbolic Simulation VHDL File M-Code Symbolic Computation within Mathematica Symbolic Results Simulation Constraints Constraints Resolution within ACL2 User ACL2 Books Simulation Theorems VDS Diana Toma 4

5 Branch Decision Scheme Mathematica ACL2 Call of ACL2 to check consistency of constraints Consistency L h? If I h is returned, show it to the user, else L h implies branch condition B? I h or t L h fib Check_consistency (L h ) If answer is Q.E.D simulate true branch else L h implies not B? If answer is Q.E.D. simulate false branch else ask the user to add constraints or fork answer L h fi (not B) answer Prove (L h implies B) Prove (L h implies (not B)) VDS Diana Toma 5

6 Checking constraints consistency check_consistency function Uses : tool1-fn from /books/misc/expander consistency function (defun check-consistency (Lh state) (if (true-listp Lh) (cond ((endp Lh) (value nil)) (t (mv-let (erp val state) (tool1-fn Lh state nil t nil t t) (if erp (value nil) (if (nth 1 val) (value t) (consistency Lh nil 1 state)))))) (value nil))) VDS Diana Toma 6

7 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) I h L h nil ( C 1 C k-1 C k C k+1 C n ) t VDS Diana Toma 7

8 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) L h I h nil ( C 1 C k-1 C k C k+1 C n ) t VDS Diana Toma 8

9 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) L h I h nil ( C 1 C k-1 C k C k+1 C n ) f VDS Diana Toma 9

10 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) L h I h nil ( C 1 C k-1 C k C k+1 C n ) f VDS Diana Toma 10

11 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) I h L h (C k ) ( C 1 C k-1 C k C k+1 C n ) f VDS Diana Toma 11

12 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) I h ( C k ) L h (C 1 C k-1 C k+1 C n ) f -> stop VDS Diana Toma 12

13 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) I h ( C k ) L h (C 1 C k-1 C k+1 C n ) t VDS Diana Toma 13

14 Checking constraints consistency consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) I h ( C k ) L h ( C 1 C k-1 C k+1 C n ) t VDS Diana Toma 14

15 Checking constraints consistency Example consistency function Returns, for an inconsistent set of constraints nil in case of errors otherwise a minimal set of contradictory constraints (minimal = any strict subset is satisfiable) L h = ((< a b) ( integerp a) (< c a) (< c d) (< b c)) I h = ((< b c) (< c a) (< a b)) VDS Diana Toma 15

16 ACL2 - Mathematica communication Communication via a pipe Initialized by Mathematica with callacl2 function Mathematica gets the last line of the ACL2 response One ACL2 session during the whole simulation callacl2[ (defthm foo (equal x x) : rule-classes nil) ] FOO callacl2[ (defthm foo (not (equal x x) ): rule-classes nil) ] ******** FAILED ******** See :DOC failure ******** FAILED **** VDS Diana Toma 16

17 ACL2 - Mathematica communication Theorems: callacl2[ (mv-let (erp val state) (defthm foo (implies L B)) (declare (ignore val)) (if erp (value nil) (value T))) ] Functions: callacl2[ (mv-let (erp val state) (check_consistency L) (if erp (value nil) (value val))) ] VDS Diana Toma 17

18 Euclid s GCD Algorithm P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; VDS Diana Toma 18

19 Euclid s GCD Algorithm =b 0 1st simulation cycle >b ok<=true 0 P1: process begin Res:=a 0 wait until clk='1'; if RST='1' then b 0 :=b 0 a 0 :=a 0 a0:=a; 2nd simulation cycle =(b 0 ) if (a 0 )=b 0 b0:=b; ok<=false; >(b 0 ) ok<=true ok<=true if (a elsif a0=b0 then Res:=a 0 )>b 0 0 Res:=a 0 ok<=true; b 0 :=(b 0 ) a 0 :=a 0 -(b 0 ) b 0 :=b 0 -(a 0 ) a 0 :=(a 0 ) elsif a0>b0 then 3rd =(b 0 ) -(b 0 )=b 0 if a a0:=a0-b0; 0 =(b 0 ) if (a 0 ) =b 0 else b0:=b0-a0; ok<=true ok<=true ok<=true ok<=true end if; Res:=a 0 Res:=a 0 -(b 0 ) Res:=a 0 Res:=(a 0 ) end process P1; >(b 0 ) -(b 0 )>(b 0 ) >(b 0 ) if (a 0 ) >b 0 a 0 :=a 0 -((b 0 ) ) a a 0 :=(a 0 -(b 0 ))-(b 0 ) 0 :=(a 0 )-(b 0 -(a 0 )) a 0 :=((a 0 ) ) b 0 :=((b 0 ) ) b 0 :=(b 0 -(a 0 ))-(a 0 )) b 0 :=(b 0 )-(a 0 -(b 0 )) b 0 :=b 0 -((a 0 ) ) VDS Diana Toma 19

20 Constraints: a=3n, b=n, nœn* Reduction of the execution tree 1st simulation cycle =b 0 >b 0 ok<=true Res:=a 0 begin b 0 :=b 0 a 0 :=a 0 -b until clk='1'; RST='1' then 2nd simulation cycle =(b 0 ) if (a 0 )=b a0:=a; b0:=b; >(b 0 ) ok<=true ok<=true if (a Res:=a 0 )>b 0 0 Res:=a ok<=false; ok<=true; 3rd then ok<=true ok<=true ok<=true a0:=a0-b0; ok<=true Res:=a 0 Res:=a 0 -(b 0 ) Res:=a 0 Res:=a b0:=b0-a0; process a 0 :=a 0 -((b 0 ) ) a a 0 :=(a 0 -(b 0 ))-(b 0 ) 0 :=(a 0 )-(b 0 -(a 0 )) a 0 :=((a 0 ) ) b 0 :=((b 0 ) ) b 0 :=(b 0 -(a 0 ))-(a 0 )) b 0 :=(b 0 )-(a 0 -(b 0 )) b 0 :=b 0 -((a 0 ) ) VDS Diana Toma 20

21 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; callacl2[ (mv-let (erp val state) (check_consistency ((integerp n) (< 0 n))) (if erp (value nil) (value val))) ] VDS Diana Toma 21

22 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; T callacl2[ (mv-let (erp val state) (check_consistency ((integerp n) (< 0 n))) (if erp (value nil) (value val))) ] VDS Diana Toma 22

23 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; callacl2[ (mv-let (erp val state) (defthm thm1 (implies (and (integerp n)(< 0 n)) (equal (* 3 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 23

24 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; nil callacl2[ (mv-let (erp val state) (defthm thm1 (implies (and (integerp n)(< 0 n)) (equal (* 3 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 24

25 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; callacl2[ (mv-let (erp val state) (defthm thm1-neg (implies (and (integerp n)(< 0 n)) (not (equal (* 3 n) n)))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 25

26 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; T callacl2[ (mv-let (erp val state) (defthm thm1-neg (implies (and (integerp n)(< 0 n)) (not (equal (* 3 n) n)))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 26

27 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 callacl2[ (mv-let (erp val state) (defthm thm2 (implies (and (integerp n)(< 0 n)) (> (* 3 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 27

28 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; T >b 0 callacl2[ (mv-let (erp val state) (defthm thm2 (implies (and (integerp n)(< 0 n)) (> (* 3 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 28

29 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 1st simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 VDS Diana Toma 29

30 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 if (a 0 )=b 0 callacl2[ (mv-let (erp val state) (defthm thm3 (implies (and (integerp n)(< 0 n)) (equal (* 2 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 30

31 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; nil >b 0 a 0 :=a 0 if (a 0 )=b 0 callacl2[ (mv-let (erp val state) (defthm thm3 (implies (and (integerp n)(< 0 n)) (equal (* 2 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 31

32 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 if (a 0 )=b 0 callacl2[ (mv-let (erp val state) (defthm thm3-neg (implies (and (integerp n)(< 0 n)) (not (equal (* 2 n) n)))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 32

33 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; T >b 0 a 0 :=a 0 if (a 0 )=b 0 callacl2[ (mv-let (erp val state) (defthm thm3-neg (implies (and (integerp n)(< 0 n)) (not (equal (* 2 n) n)))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 33

34 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 if (a 0 )=b 0 if (a 0 )>b 0 callacl2[ (mv-let (erp val state) (defthm thm4 (implies (and (integerp n)(< 0 n)) (> (* 2 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 34

35 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; T >b 0 a 0 :=a 0 if (a 0 )=b 0 if (a 0 )>b 0 callacl2[ (mv-let (erp val state) (defthm thm4 (implies (and (integerp n)(< 0 n)) (> (* 2 n) n))) (declare (ignore val)) (if erp (value nil) (value T))) ] VDS Diana Toma 35

36 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 2nd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 if (a 0 )=b 0 if (a 0 )>b 0 a 0 :=a 0-2b 0 VDS Diana Toma 36

37 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 3rd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; if n=n >b 0 a 0 :=a 0 if (a 0 )=b 0 if (a 0 )>b 0 a 0 :=a 0-2b 0 if (a 0-2b 0 )=b 0 VDS Diana Toma 37

38 Reduction of the execution tree Constraints: a=3n, b=n, nœn* 3rd simulation cycle =b 0 P1: process begin wait until clk='1'; if RST='1' then a0:=a; b0:=b; ok<=false; elsif a0=b0 then ok<=true; elsif a0>b0 then a0:=a0-b0; else b0:=b0-a0; end if; end process P1; >b 0 a 0 :=a 0 if (a 0 )=b 0 if (a 0 )>b 0 a 0 :=a 0-2b 0 if (a 0-2b 0 )=b 0 ok<=true Res:=a 0-2b 0 VDS Diana Toma 38

39 Symbolic evaluations of assertions the assert statement assures that bool_expr is never violated Label1 is translated into a variable that can remain symbolic during one or more simulation cycles If it evaluates to false at cycle C, the simulation path is a counter example VHDL Mathematica if function Label1: assert bool_expr report message severity severitylevel; If[bool_expr,ChangeVar[Label1,True],ChangeVar[Label1,False],If[CallACL2[bool_expr],ChangeVar[Label1,True],ChangeVar[Label1,False],Label1]] VDS Diana Toma 39

40 Conclusion A new approach for the symbolic simulation of high level circuits specifications Use of typing information and user constraints to prune the execution tree Use of two powerful automatic systems: Mathematica and ACL2 Future works: Validate the approach on industrial circuits Extend to new VHDL subset for the system-level synthesis and SystemC VDS Diana Toma 40

41 VDS Diana Toma 41

42 Foreseen VHDL subset Level 1 synthesizable subset Concurrent statements: Signal assignment Component instantiation Processes : single clock synchronized processes Sequential statements: Variable and signal assignments if-then-else, case conditionals, for-loop statements Types Scalar data types: integer, bit, boolean, character Subtypes defined on integer, bit vector type Hierarchy: components do not contain combinatorial processes Simulation cycle=clock cycle VDS Diana Toma 42