Abstract

Generalized symbolic trajectory evaluation (GSTE) is an extension of symbolic trajectory evaluation (STE) and a method of model checking. GSTE specifications are given as assertion graphs. There are four efficient methods to verify whether a circuit model obeys an assertion graph in GSTE, Model Checking Strong Satisfiability (SMC), Model Checking Normal Satisfiability (NMC), Model Checking Fair Satisfiability (FMC), and Model Checking Terminal Satisfiability (TMC). SMC, NMC, and FMC have been proved and applied in industry, but TMC has not. This paper gives a six-tuple definition and presents a new algorithm for TMC. Based on these, we prove that our algorithm is sound and complete. It solves the SMC’s limitation (resulting in false negative) without extending from finite specification to infinite specification. At last, a case of using TMC to verify a realistic hardware circuit round-robin arbiter is achieved. Avoiding verifying the undesired paths which are not related to the specifications, TMC makes it possible to reduce the computational complexity, and the experimental results suggest that the time cost by SMC is 3.14× with TMC in the case.

1. Introduction

Logic errors found in finite state concurrent systems are extremely important problems for both circuit designers and programmers [1] (i.e., sequential circuit designs and communication protocols). Model checking is a technique for verifying finite state concurrent systems [1]. Symbolic trajectory evaluation is a lattice-based model checking technique based on a form of symbolic simulation [2–4]. STE has shown great promise in verifying medium to large scale industrial hardware designs with a high degree of automation at both the gate level and the transistor level [4–7]. Generalized symbolic trajectory evaluation [3, 8] is an extension of symbolic trajectory evaluation [9, 10]. STE is very limited in the types of properties that it can specify and verify. GSTE can handle -regular properties and maintain the efficiency and capacity of STE [9–13]. GSTE is originally developed at Intel and has been used successfully on Intel’s next-generation microprocessors [14].

The main disadvantage of model checking is the state explosion, which motivates the need for algorithms such as abstract technology and the data structure of BDD and so forth to alleviate it [2, 15–18]. Although a lot of effort has been spent on improving this weakness, the efficient and effective method has yet to be developed. GSTE is a method of model checking and it also has the problem of state explosion. In GSTE, specifications are given as assertion graph and a model is induced by transition relation. Each edge in the model represents a state transition and a trace in the model is a state sequence, while a path in the assertion graph is an edge sequence. In SMC, NMC, and FMC, a model satisfies an assertion graph if all the traces (finite or infinite) in the model are accepted by all the paths of the same length in the assertion graph [3, 8, 19]. Results shown in [1, 9, 15, 17, 20–22] indicate that the method of enumeration usually leads to state explosion and increases the complexity of computing. As we know, traces are induced by model, and the number of traces is directly proportional to the size of model. Furthermore, paths are related to specifications. Thus, it will not need to verify each trace or path. Therefore, the key to alleviating the state explosion lies in deleting some undesired paths and traces. Aiming at this situation, this paper puts forward the filtering approach for TMC (Terminal Satisfiability Model Checking).

Previous studies have shown or suggested that a tool is needed to tell the difference between desired paths and undesired paths. One possible method is to choose as the filter condition, where is the set of edges in assertion graph. Our approach only adds some restricted conditions into assertion graphs without changing the structure of models and assertion graphs. Each edge in the assertion graph is labeled by an antecedent and consequent . and are sets of states in the model, so we can assign the states related to specifications to the of edge which is in . Then, we can delete undesired paths by . A fuller discussion of TMC will appear in a later section.

In this paper, we focus on the need for alleviating state explosion and present a new algorithm for TMC based on GSTE. In Section 2, we introduce the basic definitions in GSTE. In Section 3, some concepts such as terminal assertion graph, terminal path, and terminal satisfiability are defined. After a statement of the basic concepts, related properties and a theorem are given. In Section 4, we present an algorithm for verifying terminal satisfiability with an example which cannot be verified by SMC but by TMC. In the end, we use TMC to successfully verify a hardware circuit round-robin arbiter, and the time cost by SMC is 3.14× with TMC in the case. In Section 5, we prove that our algorithm is sound and complete. Section 6 is the conclusion of the paper.

2. Preliminaries

We introduce some basic definitions in GSTE [3, 8]. We assume a universal set of finite states, denoted by .

2.1. Model

Definition 1 (transition relation; see [3, 8]). A relation is a transition relation if for all , , .

Definition 2 (model; see [3, 8]). The model induced by the transition relation is the pair , where(1)the preimage transformer pre: is defined as (2)and the postimage transformer post: is defined as

Definition 3 (trace; see [3, 8]). A trace in model is a state sequence such that for all .

2.2. Assertion Graph

Definition 4 (assertion graph; see [3, 8]). An assertion graph is a quintuple , where is a finite set of vertices, is the initial vertex, is a set of edges satisfying for all , , , is a mapping:   , and is a mapping:    .

Definition 5 (path; see [3, 8]). A path in assertion graph is an edge sequence such that ends at a vertex from which starts for all .

Definition 6 (a trace is accepted by a path; see [3, 8]). An execution trace in a model is accepted by a path in an assertion graph if (suppose the length of trace and path is ) where is the th state of the trace and is the th edge of the path .

2.3. Four Kinds of Verifying Algorithms

Based on Definition 6, GSTE has four kinds of acceptance [19].

Definition 7 (SMC (model checking strong satisfiability)). A model strongly satisfies an assertion graph if for all finite initial paths in and all finite traces in of the same length is accepted by , denoted by .

Definition 8 (NMC (model checking normal satisfiability)). A model normally satisfies an assertion graph if for every infinite initial path in and every infinite trace in of the same length is accepted by , denoted by .

Definition 9 (FMC (model checking fair satisfiability)). A model fairly satisfies an assertion graph under (fairness constraint) if for every infinite fair path in and every infinite trace in , is accepted by , denoted by .

Definition 10 (TMC (model checking terminal satisfiability)). A model terminally satisfies an assertion graph under (terminal edge set) if for all finite terminal paths in and all finite traces in of the same length is accepted by , denoted by .

We use the following notations in the rest of the paper, be an arbitrary sequence of elements, be the length of the sequence, and be the th element in the sequence. Further, denotes the sequence by appending element to the end of when is finite, and is the sequence by appending element to the head of .

3. Terminal Satisfiability

In this section, we define some concepts such as terminal assertion graph and terminal path and give some related properties on them.

In GSTE, the set of states in model is finite , but each state has its successor states so that traces in the model can be extended to infinite length. Each edge in the assertion graph has its successor edges so that assertion graphs can specify infinite properties. It should be noted that in our daily life, most of the properties which have been verified are finite rather than infinite. In particular, some properties are terminated at some states and these states are not involved. In GSTE existing theories, the SMC algorithm is the only one used to handle finite properties [3, 8]; it cannot stop at some edges whose labels are not related to the specifications and there are many redundant calculations. The program proves that we can predict the behavior of the model; these observations lead us to hypothesize that finite specifications will terminate at some states which we can predict. Corresponding to terminal specifications, the paths will also terminate at some edges, which are named terminal edge. Our algorithm will make the labels on the edges, which cannot reach terminal edges, equal to . The method outlined here can be used to reduce the complexity of computation.

For convenience, we expanded the assertion graph into six-tuple.

Definition 11 (terminal assertion graph). A terminal assertion graph is a six-tuple , where , , , , and are the same as in preliminaries; is a set of terminal edges.

Definition 12 (terminal path). A terminal path is where is an initial edge, it starts from , and is a terminal edge, . The last edge of path must be terminal edge.

Definition 13 (a trace is accepted by a terminal path; see [3, 8, 19]). Let be a terminal assertion graph and be a model. Given an edge labeling where is either or , a trace in satisfies a terminal path of the same length under if for every , , denoted by The trace is accepted by the terminal path if denoted by .

Definition 14 (model satisfies terminal assertion graph). A model satisfies a terminal assertion graph if for all terminal paths in and all traces in of the same length one has , denoted by

Definition 15 (model strongly satisfies assertion graph; see [3, 8]). A model strongly satisfies an assertion graph () if for all finite paths in and all traces in of the same length one has , denoted by The Difference between Finite Path and Terminal Path. Note that there is a key difference between finite path and terminal path; unlike terminal path, which must be end up with a terminal edge , finite path can end up with any edge . Given our analysis, this suggests a terminal path will be a finite path; however, a finite path may not be a terminal path.

Let is a finite initial path and the length of is , where and is a terminal path and the length of is , where . The last edge of must be a terminal edge, ; however, the last edge of does not have this restriction, it just needs to meet , , so one has .

Theorem 16. For any assertion graph and any model , one has

Proof. According to Definition 15

Theorem 16 describes the relationship between SMC and TMC. If SMC returns true, then TMC returns true, but not vice versa. When , terminal satisfiability behaves as strong satisfiability. When , , we can remove some undesired paths in the assertion graph.

4. Model Checking with Terminal Satisfiability

In this section, we describe a model checking method for verifying terminal satisfiability. The concept of terminal satisfiability was proposed in [19] but was not given any algorithm. In this paper, we present an algorithm and prove it.

4.1. The TMC Algorithm

In [3, 8], the algorithms for SMC, NMC, and FMC were given. Our TMC algorithm is similar. First, we should define the backward simulation sequence.

Definition 17. Given an assertion graph and a model , the backward simulation sequence is as below where   () is the -step backward simulation relation. It is defined as

Based on this result, when we verify finite properties, we simply verify those traces that can reach some states in , where . These states, which are related to the property, are assigned to the label of the terminal edge. Then we emulate the model’s behavior backwards starting from the terminal edge. The -step backward simulation relation is the set of the states that can reach the terminal edge within -step.

Obviously, the backward simulation relation sequence is nondecreasing and has a least fix-point upper limit bounded by . We denote the least fix-point by . Now we propose a terminal satisfiability model checking algorithm that first performs a series of graph transformations and then checks strong satisfiability on the resulting graph.

4.2. The Application of TMC

In order to describe TMC clearly, let us look at the following example [23].

Example 18. Consider the model in Figure 1, where .

Figure 1 

A simple model.

Suppose we want to specify the following property: if the system is in the state , then it must have been in the last time when it was neither in nor . The model satisfies this property. Now, let us catch this property using the assertion graph in Figure 2.

Figure 2 

An assertion graph.

The fact that SMC cannot verify this property is due to undesired paths, such as the finite initial path and the finite trace , , but the first state of is not in the . Thus, the model does not strongly satisfy the assertion graph. If we use SMC, the SMC algorithm will return false. In order to deal with this situation in the former, [3, 8] introduce NMC and FMC. As we know, NMC and FMC have been used to deal with -regular properties. If we want to solve the SMC’s limitation, we should expand finite specifications to infinite specifications. This is the key that leads to the increasing complexity of the model checking. However, the algorithm of using TMC to verify this property is more suitable. TMC can be accomplished without expanding finite specifications to infinite specifications. The following example is constructed only for the purpose of illustrating the computational procedure discussed.

Step 1. Construct the terminal assertion graph and figure out the terminal edges (Figure 3).

Figure 3 

A terminal assertion graph.

Step 2. First, the fix-point of every edge is computed according to Definition 17; then the label of every edge is replaced by the corresponding ; lastly, the resulting assertion graph is gotten.

Step 3. This step behaves as the algorithm . The edge which is marked by the blue line is the terminal edge. Supposing , there is only one terminal edge in the case (Figure 3). Thus, the terminal path can be grouped into two cases (as follows): Because the terminal path must end up with the terminal edge, there is only one terminal edge in Figure 3 and the vertex to is unreachable. Thus, if a path reaches the edge that is not a terminal path, then all terminal paths are finite. As we know, the length of a terminal path must be greater than or equal to 2. Thus, we can eliminate the path and the trace , which will lead to SMC returning false negative, since . The trace in model (Figure 1), if not starting from , ultimately would violate the label on the edge ; therefore the model (Figure 1) terminally satisfies the terminal assertion graph (Figure 3). The calculation is as follows (after one iteration, every edge can be reached to the fix-point).

The first iteration (initialization):

The second iteration: After replacing the label of each edge with the corresponding fix-point , the resulting assertion graph is shown as Figure 4.

Figure 4 

The resulting assertion graph .

As can be seen, of each edge has been reached by the minimum, and TMC returns true. Thus, the model satisfies the terminal assertion graph.

4.3. A Hardware Verification Case of TMC

In this section, we present a case study of TMC on hardware verification. The circuit we choose for this study is a round-robin arbiter, which is the core component in many real network systems [24]. An arbiter has inputs and the output is a vector encoding of arbitration results. Request with highest priority in round-robin order is granted in each cycle, and the priority of the request which is granted in last arbitration will become the lowest in the next round; this protocol guarantees a dynamic priority assignment to requestors without starvation. We consider the arbiter with 4 inputs (shown in Figure 5). First, the priority of inputs is placed in descending order from to [25, 26]. Thus, has the highest priority, has the next priority, and so on. Each input of the arbiter in Figure 5 is connected to a switch cell; only one of the four inputs will succeed each clock cycle. Others are rejected and must retry later. routeEnable is enable signal.

Figure 5 

An arbiter with 4 inputs.

We model this arbiter as a finite state machine (shown in Figure 6) according to its truth table in paper [24]. The input is a vector of ternary-valued variables; each variable can take 0, 1, or . indicates that variable can take 0 or 1. Figure 6 is the model of this arbiter. Consider Safety property: once a request is set high from a state and kept high, then the request will be granted after several cycles. Suppose a state where the value of grant is , which means that the last request granted is req2; if the request req2 is set high again and kept high, then the request will be granted after at most 4 cycles. We use the terminal assertion graph to specify this property (shown as in Figure 7) [24]. Consider The edge is the terminal edge. We only verify those paths that end up with the edge . If we use SMC to verify this property, we must verify all finite paths. If using TMC, we only need to verify terminal paths. In the terminal assertion graph (Figure 7), all finite paths are as follows: If we use SMC, we must verify 22 paths: . But we use TMC only to verify . Therefore, the time cost by SMC is 3.14× with TMC in this case.