Transcript FORMAL METHODS IN HARDWARE VERIFICATION Maciej Ciesielski Dept. of Electrical & Computer Engineering University of Massachusetts, Amherst, USA [email protected]  2001 Ciesielski Formal Verification.

FORMAL METHODS IN
HARDWARE VERIFICATION
Maciej Ciesielski
Dept. of Electrical & Computer Engineering
University of Massachusetts, Amherst, USA
[email protected]
 2001 Ciesielski
Formal Verification
1
Overview
• Introduction
– What is verification (validation)
– Why do we need it
– Formal verification vs. simulation-based methods
• Math background
– Decision diagrams (BDD’s, BMD’s, etc.)
– Symbolic FSM traversal
• Formal methods
– model checking
– equivalence checking
• Semi-formal methods
– symbolic simulation
– functional validation
 2001 Ciesielski
Formal Verification
2
Formal Methods
• Equivalence checking
– Combinational circuits
– Sequential circuits
• Model checking
– Problem statement
– Explicit algorithms (on graphs)
– Symbolic algorithms (using BDDs)
• Theorem proving
– Deductive reasoning
 2001 Ciesielski
Formal Verification
3
Functional Testing
• Simulation-based methods
– Symbolic simulation
– Functional test generation
• SAT-based methods, Boolean SAT
• RTL verification: Arithmetic/Boolean SAT
• ATPG-based methods
• Emulation-based methods
– Hardware-assisted simulation
– System prototyping
 2001 Ciesielski
Formal Verification
4
Part I
INTRODUCTION
 2001 Ciesielski
Formal Verification
5
Verification
• Design verification = ensuring correctness of the design
– against its implementation (at different levels)
– against alternative design (at the same level)
?
model
behavior
function
?
?
structure
Design 1
?
Design 2
HDL / RTL
RTL
Logic level
Logic level
?
Gate level
Gate level
Mask level
Mask level
?
?
layout
 2001 Ciesielski
Formal Verification
6
Why Verification
• Verification crisis
– System complexity, difficult to manage
– More time, effort devoted to verification than to
actual design
– Need automated verification methods, integration
• Consequences
– Disasters, life threatening situations
– Inconvenience (Pentium bug … ?)
– Many more …
 2001 Ciesielski
Formal Verification
7
Verification Methods
• Deductive verification
• Model checking
Formal Verification
• Equivalence checking
• Simulation - performed on the model
• Emulation, prototyping – product + environment
• Testing - performed on the actual product
(manufacturing test)
 2001 Ciesielski
Formal Verification
8
Formal Verification
• Deductive reasoning (theorem proving)
– uses axioms, rules to prove system correctness
– no guarantee that it will terminate
– difficult, time consuming: for critical applications only
• Model checking
– automatic technique to prove correctness of concurrent
systems: digital circuits, communication protocols, etc.
• Equivalence checking
– check if two circuits are equivalent
– OK for combinational circuits, unsolved for sequential
 2001 Ciesielski
Formal Verification
9
Why Formal Verification
• Need for reliable hardware validation
• Simulation, test cannot handle all possible cases
• Formal verification conducts exhaustive exploration
of all possible behaviors
– compare to simulation, which explores some of possible
behaviors
– if correct, all behaviors are verified
– if incorrect, a counter-example (proof) is presented
• Examples of successful use of formal verification
– SMV system [McMillan 1993]
– verification of cache coherence protocol in IEEE Futurebus+
standard
 2001 Ciesielski
Formal Verification
10
Model Checking
• Algorithmic method of verifying correctness of
(finite state) concurrent systems against temporal
logic specifications
– A practical approach to formal verification
• Basic idea
– System is described in a formal model
• derived from high level design (HDL, C), circuit structure,
etc.
– The desired behavior is expressed as a set of properties
• expressed as temporal logic specification
– The specification is checked against the model
 2001 Ciesielski
Formal Verification
11
Functional Validation
• Verify the design in the full operational context
• RTL functional verification
– Validate HDL specification of RTL model
• Functional test generation
– SAT-based methods (Boolean, arithmetic)
– ATPG-based methods
• Symbolic simulation (semi-formal methods)
– Combine simulation with symbolic methods
 2001 Ciesielski
Formal Verification
12
Part II
BACKGROUND
• Canonical representations: BDD, BMD
• Boolean satisfiability problem (SAT)
• Finite State Machine (FSM) traversal
 2001 Ciesielski
Formal Verification
13
Binary Decision Diagrams (BDD)
• Based on recursive Shannon expansion
F = x Fx + x’ Fx’
• Compact data structure for Boolean logic
– can represents sets of objects (states) encoded as
Boolean functions
• Canonical representation
– reduced ordered BDDs (ROBDD) are canonical
– essential for verification
 2001 Ciesielski
Formal Verification
14
BDD Construction
• Typically done using APPLY operator
• Reduction rules
– remove duplicate terminals
– merge duplicate nodes
(isomorphic subgraphs)
– remove redundant nodes
a
b
f
f
a
f
b
• Redundant nodes:
b
b
c
– nodes with identical children
0
 2001 Ciesielski
Formal Verification
1
0
1
15
BDD Construction – your first BDD
• Construction of a Reduced Ordered BDD
a b c
f
0
0
0
0
1
1
1
1
0
0
0
1
0
1
0
1
0
0
1
1
0
0
1
1
0
1
0
1
0
1
0
1
f
f = ac + bc
a
b
b
c
0
c
0
Truth table
 2001 Ciesielski
1 edge
0 edge
0
c
1
0
c
1
0
1
Decision tree
Formal Verification
16
BDD Construction – cont’d
f
f
a
a
b
b
c
c
0
c
c
1
1. Remove
duplicate terminals
 2001 Ciesielski
f = (a+b)c
a
b
b
c
c
0
1
2. Merge
duplicate nodes
Formal Verification
b
c
0
1
3. Remove
redundant nodes
17
Application to Verification
• Equivalence of combinational circuits
• Canonicity property of BDDs:
– if F and G are equivalent, their BDDs are
identical (for the same ordering of variables)
a F = a’bc + abc +ab’c

b
b
c
0
 2001 Ciesielski
G = ac +bc
a
c
1
0
Formal Verification
1
18
Application to Verification, cont’d
• Functional test generation
– SAT, Boolean satisfiability
analysis
– to test for H = 1 (0), find a path
in the BDD to terminal 1 (0)
– the path, expressed in function
variables, gives a satisfying
solution (test vector)
0
 2001 Ciesielski
Formal Verification
H
a
b
ab
c
ab’c
1
19
Logic Manipulation using BDDs
• Useful operators
F’
F
– Complement ¬ F = F’
¬
(switch the terminal nodes)
0
1
1
F(y)
F(x,y)
– Restrict: F|x=b = F(x=b)
where b = const
 2001 Ciesielski
Formal Verification
0
Restrict
0
1
x=b
0
1
20
Useful BDD Operators - cont’d
• Apply: F

where

G
stands for any Boolean operator (AND, OR, XOR, )
F
G
F
1
G
=

0

0
1
0
1
• Any logic operation can be expressed using only
Restrict and Apply
• Efficient algorithms, work directly on BDDs
 2001 Ciesielski
Formal Verification
21
Apply Operation
• Basic operator for efficient BDD manipulation
(structural)
• Based on recursive Shannon expansion
F OP G = x (Fx OP Gx) + x’(Fx’ OP Gx’)
where OP = OR, AND, XOR, etc
 2001 Ciesielski
Formal Verification
22
Apply Operation - AND
a AND c
ac
a 2.3
a 2
=
0
1
1.3 c
c 3
AND
0
 2001 Ciesielski
1
0.3
1.0
Formal Verification
1.1
a
=
c
0
1
23
Apply Operation - OR
f = ac+bc
ac
bc
a 4
OR
c
0
b 6
5
1
 2001 Ciesielski
c
0
a
a 4+6
1
6+5 b
0+6
7
=
0+7 0+5 7+5 c
0+0
0
Formal Verification
1
b
=
c
0
1
24
Binary Moment Diagrams (*BMD)
• Devised for word-level operations, arithmetic
• Based on Shannon expansion, manipulated
f = x fx + x’ fx’ = x fx + (1-x) fx’
= fx’ + x (fx - fx’ ) = fx’ + x fx.
• fx’ = f(x=0), is constant (zero moment)
• fx. = (fx - fx’ ) is called first moment, similar to first
derivative
• Additive and multiplicative weights on edges (*BMD)
 2001 Ciesielski
Formal Verification
25
*BMD for arithmetic circuits
• Efficiently models word-level operators
y2
y2
y1
y0
4
x0
y1
4
y0
2
X
x0
0
Y
4
X
2
1
0
1
1
 2001 Ciesielski
1
x1
1
Bit level
2
x2
2
0
XY
4
Y
1
x2
x1
X+Y
0
word level
Formal Verification
1
1
Bit level
word level
26
*BMD for Boolean logic
• Needed to model complex arithmetic circuits
x’ = (1-x)
x y = x y
x
x
1
-1
0
x  y = (x + y – x y)
x
y
y
x
y
1
1
NOT
0
1
AND
 2001 Ciesielski
x  y = (x + y – 2 x y)
y
-1
1
0
OR
Formal Verification
y
1
0
-2
1
XOR
27
Decison Diagrams - summary
• BDDs and BMDs are canonical for fixed variable order
• BDDs
– Good for equivalence checking and SAT
– Inefficient for large arithmetic circuits (multipliers)
• BMDs
– Efficient for word-level operators
– Less compact for Boolean logic than BDDs
– Good for equivalence checking, but not for SAT
• New type of compact, canonical diagram available,
better suited for arithmetic designs
– TED, based on Taylor series Expansion
 2001 Ciesielski
Formal Verification
28
Boolean Satisfiability (SAT)
• Given a representation for a Boolean function f (X):
– Find an assignment X* such that f (X*) = 1, or
– Prove that such an assignment does not exist
• A classical way to solve SAT:
– Represent function f (X) in conjunctive normal form (CNF)
– Solve SAT by finding satisfying assignment to binary
variables for each clause (GRASP, SATO)
 2001 Ciesielski
Formal Verification
29
CNF for Boolean Network
• Represent Boolean function as a connection of gates
• Represent each gate as a CNF clause
• Solve = find satisfying assignment for all CNF clauses
a
b
 2001 Ciesielski
d
jd = [d = ¬(a b )][¬d = a b]
= [d = ¬a + ¬b][¬d = a b]
= (¬a  d)(¬b  d)(a b  ¬d)
= (a + d)(b + d)(¬a + ¬b + ¬d)
Formal Verification
30
Finite State Machines (FSM)
X
• FSM M(X,S, , ,O)
s
(s,x)
(s,x)
O
s’
R
–
–
–
–
–
Inputs:
X
Outputs:
O
States:
S
Next state function, (s,x) : S  X  S
Output function,
(s,x) : S  X  O
 2001 Ciesielski
Formal Verification
31
FSM Traversal
• State Transition Graphs
– directed graphs with labeled nodes and arcs
(transitions)
– symbolic state traversal methods
• important for symbolic verification, state reachability
analysis, FSM traversal, etc.
1/0
0/0
0/1
s0
1/0
 2001 Ciesielski
s1
s2
Formal Verification
0/1
32
Existential Quantification
• Existential quantification (abstraction)
x f = f |x=0 + f |x=1
• Example:
x (x y + z) = y + z
• Note: x f does not depend on x (smoothing)
• Useful in symbolic image computation (sets of states)
 2001 Ciesielski
Formal Verification
33
Existential Quantification - cont’d
• Function can be existentially quantified w.r.to
a vector: X = x1x2…
X f = x1x2... f = x1 x2 ... f
• Can be done efficiently directly on a BDD
• Very useful in computing sets of states
– Image computation: next states
– Pre-Image computation: previous states
from a given set of initial states
 2001 Ciesielski
Formal Verification
34
Image Computation
• Computing set of next states from a given initial state
(or set of states)
Img( S,R ) = u S(u) • R(u,v)
R(u,v)
S(u)
Img(v)
• FSM: when transitions are labeled with input predicates
x, quantify w.r.to all inputs (primary inputs and state var)
Img( S,R ) = x u S(u) • R(x,u,v)
 2001 Ciesielski
Formal Verification
35
Image Computation - example
Compute a set of next states from state s1
• Encode the states: s1=00, s2=01, s3=10, s4=11
• Write transition relations for the encoded states:
R = (ax’y’X’Y + a’x’y’XY’ + xy’XY + ….)
s1
a
s2
01
s4
00 a’
11
10
 2001 Ciesielski
a xy XY
1 00 01
0 00 10
- 10 11
……….
s3
Formal Verification
36
Example - cont’d
• Compute Image from s1 under R
Img( s1,R ) = a xy s1(x,y) • R(a,x,y,X,Y)
= a xy (x’y’) • (ax’y’X’Y + a’x’y’XY’ + xy’XY + ….)
= axy (ax’y’X’Y + a’x’y’XY’ ) = (X’Y + XY’ )
= {01, 10} = {s2,s3}
s1
a
s2
01
s4
00 a’
11
10
 2001 Ciesielski
Result: a set of next
states for all inputs
s1  {s2, s3}
s3
Formal Verification
37
Pre-Image Computation
• Computing a set of present states from a given next
state (or set of states)
Pre-Img( S’,R) = v R(u,v) )• S’(v)
R(u,v)
Pre-Img(u)
S’(v)
• Similar to Image computation, except that quantification is done
w.r.to next state variables
• The result: a set of states backward reachable from state set S’,
expressed in present state variables u
• Useful in computing CTL formulas: AF, EF
 2001 Ciesielski
Formal Verification
38
Part III
EQUIVALENCE CHECKING
 2001 Ciesielski
Formal Verification
39
Equivalence Checking
• Two circuits are functionally equivalent
if they exhibit the same behavior
• Combinational circuits
In
Out
CL
– for all possible input values
PI
• Sequential circuits
Po
CL
– for all possible input sequences
Ps
Ns
R
 2001 Ciesielski
Formal Verification
40
Combinational Equivalence Checking
• Functional Approach
– transform output functions of combinational
circuits into a unique (canonical) representation
– two circuits are equivalent if their representations
are identical
– efficient canonical representation: BDD
• Structural
– identify structurally similar internal points
– prove internal points (cut-points) equivalent
– find implications
 2001 Ciesielski
Formal Verification
41
Functional Equivalence
• If BDD can be constructed for each circuit
– represent each circuit as shared (multi-output) BDD
• use the same variable ordering !
– BDDs of both circuits must be identical
• If BDDs are too large
– cannot construct BDD, memory problem
– use partitioned BDD method
• decompose circuit into smaller pieces, each as BDD
• check equivalence of internal points
 2001 Ciesielski
Formal Verification
42
Functional Decomposition
• Decompose each function into functional blocks
– represent each block as a BDD (partitioned BDD method)
– define cut-points (z)
– verify equivalence of blocks at cut-points
starting at primary inputs
F
G
g2
f2
z
z
g1
f1
x
 2001 Ciesielski
Formal Verification
y
x
y
43
Cut-Points Resolution Problem
• If all pairs of cut-points (z1,z2) are equivalent
– so are the two functions, F,G
• If intermediate functions (f2,g2) are not equivalent
– the functions (F,G) may still be equivalent
– this is called false negative
F
• Why do we have false negative ?
– functions are represented in terms of
intermediate variables
– to prove/disprove equivalence must
represent the functions in terms of
primary inputs (BDD composition)
 2001 Ciesielski
Formal Verification
G
g2
f2
z1
z2
g1
f1
x
y
x
y
44
Cut-Point Resolution – Theory
• Let f1(x)=g1(x) x
– if f2(z,y)  g2(z,y), z,y then f2(f1(x),y)  g2(f1(x),y)  F  G
– if f2(z,y)  g2(z,y), z,y
F
G
g2
f2
z
z
x
 2001 Ciesielski
y
x
f2(f1(x),y)  g2(f1(x),y)  F  G
We cannot say if F  G or not
• False negative
– two functions are equivalent,
but the verification algorithm
declares them as different.
g1
f1

y
Formal Verification
45
Cut-Point Resolution – cont’d
• How to verify if negative is false or true ?
• Procedure 1: create a miter (XOR) between
two potentially equivalent nodes/functions
– perform ATPG test for stuck-at 0
– find test pattern to prove F  G
– efiicient for true negative
(gives test vector, a proof)
– inefficient when there is no test
0, F  G (false negative)
1, F  G (true negative)
F
 2001 Ciesielski
Formal Verification
G
46
Cut-Point Resolution – cont’d
• Procedure 2: create a BDD for F  G
– perform satisfiability analysis (SAT) of the BDD
• if BDD for F G = , problem is not satisfiable, false negative
• BDD for F G  , problem is satisfiable, true negative
G
F

F G =
=
, F  G (false negative)
Non-empty, F  G
Note: must compose BDDs until they
are equivalent, or expressed in terms
of primary inputs
– the SAT solution, if exists, provides a test vector
(proof of non-equivalence) – as in ATPG
– unlike the ATPG technique, it is effective for false negative
(the BDD is empty!)
 2001 Ciesielski
Formal Verification
47
Structural Equivalence Check
• Given two circuits, each with its own structure
– identify “similar” internal points, cut sets
– exploit internal equivalences
• False negative problem may arise
– F  G, but differ structurally (different local support)
– verification algorithm declares F,G as different
a
b •
d1
F
a
b
c
•
d2
G
• Solution: use BDD-based or ATPG-based methods to resolve
the problem. Also: implication, learning techniques.
 2001 Ciesielski
Formal Verification
48
Implication Techniques
• Techniques that extract and exploit internal
correspondences to speed up verification
• Implications – direct and indirect
b=x
d=0
f=0
a=1
c=x
e=0
Direct: a=1  f=0
 2001 Ciesielski
b=x
d=x
f=1
a=0
c=x
e=x
Indirect (learning): f=1  a=0
Formal Verification
49
Learning Techniques
• Learning
– process of deriving indirect implications
– Recursive learning
• recursively analyzes effects of each justification
– Functional learning
• uses BDDs to learn indirect implications
G
H
a
a
b
c
H=?
a
b
b
G=1
0
1
0
1
G=1  H=0
 2001 Ciesielski
Formal Verification
50
Learning Techniques – cont’d
• Other methods to check implications G=1  H=0
– Build a BDD for G • H’
• If this function is satisfiable (G·H’=1), the implication holds
and gives a test vector
• Otherwise it does not hold
– Since G=1  H=0  (G’+H’)=1, build a BDD for (G’+H’)
• The implication holds if (G’+H’) 1 (tautology, trivial BDD)
a
b
c
 2001 Ciesielski
H
G=1
Formal Verification
51
Sequential Equivalence Checking
• Represent each sequential circuit as an FSM
– verify if two FSMs are equivalent
• Approach 1: reduction to combinational circuit
– unroll FSM over n time frames (flatten the design)
x(1)
x(2)
M(t1)
s(1)
M(t2)
x(n)
…
…
s(2)
M(tn)
s(n)
Combinational logic: F(x(1,2, …n), s(1,2, … n))
– check equivalence of the resulting combinational circuits
– problem: the resulting circuit can be too large too handle
 2001 Ciesielski
Formal Verification
52
Sequential Verification
• Approach 2: based on isomorphism of state transition
graphs
– two machines M1, M2 are equivalent if their state transition
graphs (STGs) are isomorphic
– perform state minimization of each machine
– check if STG(M1) and STG(M2) are isomorphic
1/0
0/0
0/1
0
1/0
1/1 1
2
0/1
State min.
1/0
0/1
0/0
0
M1
M1min
1.2

1/1
1/0
0/1
0/0
M2
0
1
1/1
 2001 Ciesielski
Formal Verification
53
Sequential Verification
• Approach 3: symbolic FSM traversal of the product
machine
• Given two FSMs: M1(X,S1, 1, 1,O1),
M2(X,S2, 2, 2,O2)
• Create a product FSM: M = M1 M2
– traverse the states of M and check its
output for each transition
– the output O(M) =1, if outputs O1= O2
– if all outputs of M are 1, M1 and M2 are
equivalent
– otherwise, an error state is reached
– error trace is produced to show: M1  M2
 2001 Ciesielski
Formal Verification
O(M)
O1
O2
M1
M2
S1
S2
X
54
Product Machine - Construction
• Define the product machine M(X,S, , ,O)
– states,
S = S1  S2
– next state function, (s,x) : (S1  S2)  X  (S1  S2)
– output function,
(s,x) : (S1  S2)  X  {0,1}
O=
1
1
2
M1
M2

1 if O1=O2
0 otherwise
(s,x) = 1(s1,x)  2(s2,x)
• Error trace (distinguishing sequence)
that leads to an error state
2
- sequence of inputs which produces 1
at the output of M
- produces a state in M for which M1
and M2 give different outputs
X
 2001 Ciesielski
Formal Verification
55
FSM Traversal - Algorithm
• Traverse the product machine M(X,S,, ,O)
– start at an initial state S0
– iteratively compute symbolic image Img(S0,R)
(set of next states):
Img( S0,R ) = x s S0(s) • R(x,s,t)
R = i Ri = i (ti  i(s,x))
until an error state is reached
– transition relation Ri for each next state variable ti
can be computed as ti = (t  (s,x))
(this is an alternative way to compute transition relation, when
design is specified at gate level)
 2001 Ciesielski
Formal Verification
56
Construction of the Product FSM
0/0
1/0
M1
0/1
0/0
0
2
M2
1
1/1
0/0
1/1
0
• For each pair of states, s1 M1, s2 M2
1/0
1/1
0/1
1
– create a combined state s = (s1. s2) of M
– create transitions out of this state to other states of M
– label the transitions (input/output) accordingly
0/1
M1
1/0
1
11
0/1
0
00
0/1
M2
1/0
1
 2001 Ciesielski
2
1.1
1/1
Formal Verification
Output =
{ 10 OK
error
0.2
57
FSM Traversal in Action
0/0
1/0
0/1
0/0
0
M1
2
1/1
1
0/0
1/1
M2
0
Initiall states: s1=0, s2=0, s=(0.0)
0/0
State reached x=0 x=1
1 1
• New 1 = (1.1)
1 1
• New = (0.2)
• New 3 = (1.0)
2
1 1
0 0
1/1
0/1
1
Error state
Out(M)
• New 0 = (0.0)
1/0
1/0
1/1
1/0
0/0
1.2
1/1
0.0
0/1
0/1
0.2
1/0
M
0/0
1.0
0.1
1/1
1.1
0/1
• STOP - backtrack to initial state to get error trace: x={1,1,1,0}
 2001 Ciesielski
Formal Verification
58
Part IV
MODEL CHECKING
 2001 Ciesielski
Formal Verification
59
Model Checking
• Algorithmic method of verifying correctness of
(finite state) concurrent systems against temporal
logic specifications
– A practical approach to formal verification
• Basic idea
– System is described in a formal model
• derived from high level design (HDL, C), circuit structure,
etc.
– The desired behavior is expressed as a set of properties
• expressed as temporal logic specification
– The specification is checked agains the model
 2001 Ciesielski
Formal Verification
60
Model Checking
• How does it work
– System is modeled as a state transition structure
(Kripke structure)
– Specification is expressed in propositional
temporal logic (CTL formula)
• asserts how system behavior evolves over time
– Efficient search procedure checks the transition
system to see if it satisifes the specification
 2001 Ciesielski
Formal Verification
61
Model Checking
• Characteristics
–
–
–
–
–
searches the entire solution space
always terminates with YES or NO
relatively easy, can be done by experienced designers
widely used in industry
can be automated
• Challenges
– state space explosion – use symbolic methods, BDDs
• History
– Clark, Emerson [1981] USA
– Quielle, Sifakis [1980’s] France
 2001 Ciesielski
Formal Verification
62
Model Checking - Tasks
• Modeling
– converts a design into a formalism: state transition
system
• Specification
– state the properties that the design must satisfy
– use logical formalism: temporal logic
• asserts how system behavior evolves over time
• Verification
– automated procedure (algorithm)
 2001 Ciesielski
Formal Verification
63
Model Checking - Issues
• Completeness
– model checking is effective for a given property
– impossible to guarantee that the specification
covers all properties the system should satisfy
– writing the specification - responsibility of the user
• Negative results
– incorrect model
– incorrect specification (false negative)
– failure to complete the check (too large)
 2001 Ciesielski
Formal Verification
64
Model Checking - Basics
• State transition structure
M(S,R,L) (Kripke structure)
S = finite set of states {s1, s2, … sn}
R = transition relation
L = set of labels assigned to states, so that
L(s) = f if state s has property f
s1
a
s2
• All properties are composed of atomic
propositions (basic properties), e.g.
the light is green, the door is open, etc.
b
ac
s3
Label (property)
– L(s) is a subset of all atomic propositions
true in state s
 2001 Ciesielski
Formal Verification
65
Specification using Temporal Logic
• Formalism describing sequences of transitions
• Time is not mentioned explicitly
• The temporal operators used to express temporal
properties
– eventually
– never
– always
• Temporal logic formulas are evaluated w.r.to a state
in the model
• Temporal operators can be combined with Boolean
expressions
 2001 Ciesielski
Formal Verification
66
Temporal Logics
• Temporal logics add temporal operators and
path quantifiers to standard (e.g.
propositional) logics
• Temporal operators allow one to conveniently
describe the order of occurrence of events
– Involve time, without explicitly mentioning it
• Exmples: CTL*, CTL, LTL, etc
– Branching time logic
– Linear time logic
 2001 Ciesielski
Formal Verification
67
Computation Trees
s1
a
s1
a
s2
b
ac
b
ac
s3
a
State transition structure
(Kripke Model)
ac
ac
ac
Infinite computation tree
for initial state s1
 2001 Ciesielski
Formal Verification
68
CTL – Computation Tree Logic
• Path quantifiers - describe branching structure of the
tree
– A (for all computation paths)
– E (for some computation path = there exists a path)
• Temporal operators - describe properties of a path
through the tree
– X (next time, next state)
– F (eventually, finally)
– G (always, globally)
– U (until)
– R (release, dual of U)
 2001 Ciesielski
Formal Verification
69
Operators and Quantifiers
• State operators
–
–
–
–
–
Ga:
Fa:
Xa:
a U b:
a R b:
a holds globally
a holds eventually
a holds at the next state
a holds until b holds
a releases b
• Path quantifiers
– E:
– A:
 2001 Ciesielski
along at least one path (there exists …)
along all paths (for all …)
Formal Verification
70
CTL – Computational Tree Logic
• CTL* - a powerul branching-time temporal
logic
• CTL – a branching-time fragment of CTL*
• In CTL every temporal operator (G,F,X,U,R)
must be immediately preceded by a path
quantifier (A,E)
• We need both state formulae and path
formulae to recursively define the logic
 2001 Ciesielski
Formal Verification
71
CTL Formulas
• Temporal logic formulas are evaluated w.r.to
a state in the model
• State formulas
– apply to a specific state
• Path formulas
– apply to all states along a specific path
 2001 Ciesielski
Formal Verification
72
Basic CTL Formulas
• E X (f)
– true in state s if f is true in some successor of s (there
exists a next state of s for which f holds)
• A X (f)
– true in state s if f is true for all successors of s (for all next
states of s f is true)
• E G (f)
– true in s if f holds in every state along some path
emanating from s (there exists a path ….)
• A G (f)
– true in s if f holds in every state along all paths emanating
from s (for all paths ….globally )
 2001 Ciesielski
Formal Verification
73
Basic CTL Formulas - cont ’d
• E F (g)
– there exists a path which eventually contains a state
in which g is true
• A F (g)
– for all paths, eventually there is state in which g holds
• E F, A F are special case of E [f U g], A [f U g]
– E F (g) = E [ true U g ], A F (g) = A [ true U g ]
• f U g (f until g)
– true if there is a state in the path where g holds, and
at every previous state f holds
 2001 Ciesielski
Formal Verification
74
CTL Operators - examples
so
so
g
g
g
so |= E F g
so
so |= A F g
g
so
g
g
g
g
g
so |= E G g
 2001 Ciesielski
g
g
g
g
so |= A G g
Formal Verification
75
CTL* Syntax
•
•
•
•
•
•
An atomic proposition is a state formula
A state formula is also a path formula
If a, b are state formulae, so are ¬a, ab, ab,
If p is a path formula, E p is a state formula
If p, q are path formulae, so are ¬p, pq, pq
If p, q are path formulae, so are X p, pUq, pRq,
 2001 Ciesielski
Formal Verification
76
Minimal set of CTL Formulas
• Full set of operators
– Boolean:
– temporal:
¬, , , , 
E, A, X, F, G, U, R
• Minimal set sufficient to express any CTL formula
– Boolean:
– temporal:
¬, 
E, X, U
• Examples:
f  g = ¬(¬f  ¬g),
 2001 Ciesielski
F f = true U f ,
Formal Verification
A (f ) = ¬E(¬f )
77
CTL* Semantics
• If formula q holds at state s (path ), we write:
s |= q
( |= q)
• s |= p, p  A iff p  L(s)
[label of s]
• s |= ¬ a, iff s |# a
• s |= a b, iff s |= a and s |= b
• s |= E p, iff   from state s, s.t.  |= p
•  |= ¬ p, iff  |# p
•  |= p q, iff  |= p and  |= q
•  |= X p, iff 1 |= p (p reachable in next state)
 2001 Ciesielski
Formal Verification
78
Semantics of X and U
• Semantics of X:
 |= X p

1 |= p
• Semantics of U:  |= p U q
 i |= q

 j |= p
 2001 Ciesielski
Formal Verification
79
Typical CTL Formulas
• E F ( start  ¬ ready )
– eventually a state is reached where start holds
and ready does not hold
• A G ( req  A F ack )
– any time request occurs, it will be eventually
acknowledged
• A G ( E F restart )
– from any state it is possible to get to the restart
state
 2001 Ciesielski
Formal Verification
80
Model Checking – Explicit Algorithm
Problem: given a structure M(S,R,L) and a temporal logic
formula f, find a set of states that satisfy f
{s  S: M,s |= f }
•
Explicit algorithm: label each state s with the set
label(s) of sub-formulas of f which are true in s.
1. i = 0; label(s) = L(s)
2. i = i + 1; Process formulas with (i -1) nested CTL operators.
Add the processed formulas to the labeling of each state in
which it is true.
3. Continue until closure.
 2001 Ciesielski
Result: M,s |= f iff f  label (s)
Formal Verification
81
Explicit Algorithm - cont’d
• To check for arbitrary CTL formula f
– successively apply the state labeling algorithm to the
sub-formulas
– start with the shortest, most deeply nested
– work outwards
• Example: E F ¬ (g  h )
T1 = states in which g and h are true
T2 = complement of T1
T3 = predecessor states to T2
 2001 Ciesielski
Formal Verification
82
Actions for Each Label
• Atomic proposition p: return set of states with
p in their labels
• ¬a: return the complement of sat(M,a)
• ab: return sat(M,a)  sat(M,b)
• ab: return sat(M,a)  sat(M,b)
• EX a: return the set of predecessors in M of
the states in sat(M,a)
• EG a: return the set of states entirely
contained in sat(M,a)
 2001 Ciesielski
Formal Verification
83
Model Checking Example
Traffic light controller (simplified)
sensor
C Timer
C ’+ T ’
G1 R2
Road 2
G1 R2
CT
R1 Y2
TC
G1 R2
Road 1
C = car sensor
T = timer
G1 R2
Y1 R2
Y1 R2
R1 G2
Y1 R2
Y1 R2
C ’+ T
R1 G2
CT’
G1 G2
Y1 Y2
R1 R2
R1 Y2
R1 G2
R1 G2
R1 Y2
R1 G2
G1 R2
R1 Y2
 2001 Ciesielski
Formal Verification
84
Traffic light controller - Model Checking
• Model Checking task: check
– safety condition
– fairness conditions
C ’+T ’
G1 R2
CT
• Safety condition: no green lights
on both roads at the same time
A G ¬ (G1  G2 )
R1 Y2
• Fairness condition: eventually
one road has green light
C ’+T
R1 G2
CT’
E F (G1  G2)
 2001 Ciesielski
Y1 R2
Formal Verification
85
Checking the Safety Condition
A G ¬ (G1  G2) = ¬ E F (G1G2)
G1 R2
•
•
•
S(G1  G2 ) = S(G1)  S(G2) =
{1}{3} = 
S(EF (G1  G2 )) = 
S(¬ EF (G1  G2 )) = ¬
= {1, 2, 3, 4}
1
2
R1 Y2
Y1 R2
4
R1 G2
3
Each state is included in {1,2,3,4} 
the safety condition is true (for each state)
 2001 Ciesielski
Formal Verification
86
Checking the Fairness Condition
E F (G1  G2 ) = E(true U (G1  G2 ) )
•
•
S(G1  G2 ) = S(G1)S(G2) = {1} {3} = {1,3}
S(EF (G1  G2 )) = {1,2,3,4}
(going backward from {1,3}, find predecessors)
1
4
3
3
2
1
Since {1,2,3,4} contains all states, the condition is
true for all the states
 2001 Ciesielski
Formal Verification
87
Another Check
E X2 (Y1) = E X (E X (Y1))
G1 R2
(starting at S1=G1R2, is there a
path s.t. Y1 is true in 2 steps ?)
• S (Y1) = {2}
• S (EX (Y1)) = {1}
(predecessor of 2)
• S (EX (EX(Y1)) = {1,4}
(predecessors of 1)
1
2
R1 Y2
Y1 R2
4
R1 G2
3
Property E X2 (Y1) is true for states {1,4}, hence true
 2001 Ciesielski
Formal Verification
88
Explicit Model Checking complexity
• CTL model checking is linear in the size of
the formula and the size of the structure M
• Not a good news:
– what if you have 1050 states?
– Number of states grows exponentially with number
of variables
– Explicit model checking limited to … 109 states
• Symbolic model checking can do much better
 2001 Ciesielski
Formal Verification
89
Symbolic Model Checking
• Symbolic
– operates on entire sets rather than individual states
• Uses BDD for efficient representation
– represent Kripke structure
– manipulate Boolean formulas
• RESTRICT and APPLY logic operators
• Quantification operators
– Existential:
– Universal:
 2001 Ciesielski
 x f = f |x=0 + f |x=1
x f = f |x=0 • f |x=1
Formal Verification
(smoothing)
(consensus)
90
Symbolic Model Checking - example
Traffic Light Controller
• Encode the atomic propositions (G1,R1,Y1, G2,Y2,R2):
use [a b c d] for present state, [v x y z] for next state
G1 R2
abcd
s1
11 10
G1
Y1
R1
G2
Y2
R2
11 -01 -10 ---11
--01
-- 10
s2
10 01
R1 Y2
s4
Y1 R2
01 10
10 11
R1 G2
s3
 2001 Ciesielski
Formal Verification
91
Example - cont’d
• Represent the set of states as Boolean formula Q:
Q = abcd’ + a’bcd’ + ab’cd + ab’c’d
G1 R2
• Store Q in a BDD
s1
11 10
(It will be used to perform logic
operations, such as S(G1)  S(G2)
s2
10 01
R1 Y2
s4
Y1 R2
01 10
10 11
R1 G2
s3
 2001 Ciesielski
Formal Verification
92
Example - cont’d
• Write a characteristic function R for the transition relation
R =abcd’vxyz’ + abcd’v’xyz’ + … + ab’c’dvxyz’
(6 terms)
abcd vxyz
R
1110
1110
0110
1011
1011
1001
1
1
1
1
1
1
1110
0110
1011
1011
1001
1110
• Store R in a BDD. It will be used for
Pre-Image computation for EF.
 2001 Ciesielski
Formal Verification
G1 R2
s1
11 10
s2
10 01
R1 Y2
s4
Y1 R2
01 10
10 11
R1 G2
s3
93
Example - Fairness Condition
• Check fairness condition: E F (G1  G2 )
• Step 1: compute S(G1), S(G2) using RESTRICT operator
– S(G1): ab·Restrict Q(G1) = ab Q|ab = abcd’ = {s1}
– S(G2): cd·Restrict Q(G2) = cd Q|cd = ab’cd = {s3}
• Step 2: compute S(G1)  S(G2 ) using APPLY operator
– Construct BDD for (abcd’ + ab’cd) = {s1, s3}, set of states
labeled with G1 or G2
 2001 Ciesielski
Formal Verification
94
Example – cont’d
• Step 3: compute S(EF (G1  G2 )) using Pre-Image
computation (quanitfy w.r.to next state variables)
• Recall: R = abcd’vxyz’ + abcd’v’xyz’+ … + ab’c’dvxyz’
•
s’ {s1’,s3’} • R(s,s’) ) =
= vxyz(vxyz’ + vx’yz) • R(a,b,c,d;v,x,y,z)
= vxyz(abcd’vxyz’ + a’bcd’vx’yz + ab’cdvx’yz + ab’c’dvxyz’)
= (abcd’ + a’bcd’ + ab’cd + ab’c’d) = {s1, s2, s3, s4}
• Compare to the result of explicit algoritm
 2001 Ciesielski
Formal Verification

95
Example – Interpretation
• Pre-Img(s1’,s3’,R) eliminates those
transitions which do not reach {s1,s3}
G1 R2
X
X
abcd vxyz
R
1110
1110
0110
1011
1011
1001
1
1
1
1
1
1
1110
0110
1011
1011
1001
1110
s1
11 10
s2
10 01
R1 Y2
s4
Y1 R2
01 10
10 11
R1 G2
s3
• Quantification w.r.to next state variables (v,x,y,z)
gives the encoded present states {s1,s2,s3,s4}
 2001 Ciesielski
Formal Verification
96