A Transformation-Based Approach to Implication of GSTE Assertion Graphs

Abstract

Generalized symbolic trajectory evaluation (GSTE) is a model checking approach and has successfully demonstrated its powerful capacity in formal verification of VLSI systems. GSTE is an extension of symbolic trajectory evaluation (STE) to the model checking of 𝜔-regular properties. It is an alternative to classical model checking algorithms where properties are specified as finite-state automata. In GSTE, properties are specified as assertion graphs, which are labeled directed graphs where each edge is labeled with two labeling functions: antecedent and consequent. In this paper, we show the complement relation between GSTE assertion graphs and finite-state automata with the expressiveness of regular languages and 𝜔-regular languages. We present an algorithm that transforms a GSTE assertion graph to a finite-state automaton and vice versa. By applying this algorithm, we transform the problem of GSTE assertion graphs implication to the problem of automata language containment. We demonstrate our approach with its application to verification of an FIFO circuit.

1. Introduction

Generalized symbolic trajectory evaluation (GSTE) [1–4] is a model checking approach which was originally developed at Intel and has successfully demonstrated its powerful capacity in formal verification of VLSI systems [1–7]. GSTE is extended from the lattice-based symbolic trajectory evaluation (STE) [8, 9] which can handle large industrial designs [10–13]. The STE theory consists of a simple specification language, a simulation-based model checking algorithm, and a powerful quaternary abstraction algorithm. Though STE is very efficient in automatic verification of large-scale industrial hardware designs at both gate and transistor levels, it has a limited specification language which only allows the specification of properties over finite time intervals.

In GSTE, all 𝜔-regular properties can be expressed and verified with space and time efficiencies comparable with STE. Assertion graphs are introduced in GSTE as an extension of STE specification language and are the key to the usability of GSTE. An assertion graph is a labeled directed graph where each edge is labeled with two labeling functions: antecedent and consequent [3]. The existing GSTE theory provides an efficient model checking procedure for verifying that a circuit obeys an assertion graph as well as techniques based on abstract interpretation to combat state space explosion [3, 7].

How to establish that one specification implies another is a fundamental problem in formal verification. Hu et al. [6, 7] proposed some algorithms to decide whether one assertion graph implies another through building monitor circuits. Yang and Seger [2] verified assertion graphs through manually refining assertion graphs. Yang et al. [14] gave some conditions under which the assertion graphs implication is decided without reachability analysis if two assertion graphs have the same graph structure. Sebastiani et al. [15] gave the complement relation between an assertion graph and a finite-state automaton. An assertion graph with 𝑛 states resulted in a nondeterministic automaton with 3∗𝑛 states.

In this paper, we consider both finite-state automata that accept regular languages and finite-state 𝜔-automata with Büchi acceptance conditions that accept 𝜔-regular languages. For a finite-state automaton over finite words, acceptance is defined according to the last state visited by a run of the automaton; while for a finite-state automaton with Büchi acceptance conditions, there is no such “the last state” and acceptance is defined according to the set of states that a run visits infinitely often [16].

We present a theory on the complement relation between GSTE assertion graphs and finite-state automata and an algorithm which automatically transforms assertion graphs to their equivalent finite-state automata, and vice versa. For an assertion graph 𝐺, we construct a corresponding finite-state automaton 𝑀_𝐺 such that 𝐿^∗(𝐺)=Σ^∗−𝐿^∗(𝑀_𝐺) and 𝐿^𝜔(𝐺)=Σ^𝜔−𝐿^𝜔(𝑀_𝐺), the number of states in 𝑀_𝐺 is only twice as many as that in 𝐺, and a deterministic assertion graph is transformed to a deterministic automaton. On the other hand, for an arbitrary finite-state automaton 𝑀, we construct a corresponding assertion graph 𝐺_𝑀 such that 𝐿^∗(𝐺_𝑀)=Σ^∗−𝐿^∗(𝑀) and 𝐿^𝜔(𝐺_𝑀)=Σ^𝜔−𝐿^𝜔(𝑀), the number of states in G_𝑀 is the same as that in 𝑀, and a deterministic automaton is transformed to a deterministic assertion graph.

We apply the proposed theory and algorithm to the GSTE assertion graphs implication problem by transforming this problem to the automata language containment problem. Since, in many cases, assertion graphs are nondeterministic, their corresponding finite-state automata are also nondeterministic. This may cause exponential state space blowups in checking automata language containment [16–22]. We avoid such blowups in determining the implication relation between a nondeterministic assertion graph and its refinement derived following the refinement strategies given in [2], by transforming the implication relation between nondeterministic assertion graphs to the implication relation between deterministic assertion graphs without adding any states. This application is illustrated with a case study for verifying correctness properties of an FIFO circuit.

The remainder of this paper is organized as follows. In Section 2, we introduce the preliminaries of finite-state automata and GSTE assertion graphs. In Section 3, we present the transformation algorithm and prove its correctness. In Section 4, we propose an application of the transformation algorithm to determine the implication relation between GSTE assertion graphs and demonstrate its effectiveness with a case study. We conclude in Section 5.

2. Preliminaries

In this section, we give the definitions of finite-state automata and GSTE assertion graphs and of their finite and infinite languages. We also show that the fairness edge constraints for GSTE assertion graphs [1] are equivalent to the fairness state constraints.

Definition 1. A finite-state automaton 𝑀 is a tuple 𝑀=⟨𝑄,Σ,𝐸,𝐿𝐹,𝑞₀,𝐹⟩, where 𝑄 is a finite set of states, Σ is a finite alphabet, 𝐸 is a set of directed edges over 𝑄, 𝐿𝐹∶𝐸↦2^Σ is the labeling function for all edges, 𝑞₀∈𝑄 is the initial state, and 𝐹 is a subset of 𝑄 whose elements are called acceptance states.

Definition 2. A finite word (or string) 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈Σ^∗ is accepted by a finite-state automaton 𝑀 (denoted as 𝑋⊨_∗𝑀) if there exists a path 𝜌=𝑞₀𝑞₁⋯𝑞_𝑛 such that (𝑞_𝑖−1,𝑞_𝑖)∈𝐸, 𝑞_𝑛∈𝐹, and 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑞_𝑖)), denoted as 𝑋⊨_𝐿𝐹𝜌.

Definition 3. An infinite word (or string) 𝑋=𝑥₁𝑥₂⋯∈Σ^𝜔 is accepted by a finite-state automaton 𝑀 (denoted as 𝑋⊨_𝜔𝑀) if there exists an infinite path 𝜌=𝑞₀𝑞₁⋯ such that (𝑞_𝑖−1,𝑞_𝑖)∈𝐸, Inf(𝜌)∩𝐹≠∅, where Inf(𝜌) is the set of states occurring infinitely often in 𝜌, and 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑞_𝑖)), denoted as 𝑋⊨_𝐿𝐹𝜌.

Definition 4. The finite language 𝐿^∗(𝑀) of 𝑀 is 𝐿^∗(𝑀)={𝑋∈Σ^∗∣𝑋⊨_∗𝑀}. The infinite language 𝐿^𝜔(𝑀) of 𝑀 is 𝐿^𝜔(𝑀)={𝑋∈Σ^𝜔∣𝑋⊨_𝜔𝑀}.

Definition 5. Given a finite-state automaton 𝑀=⟨𝑄,Σ,𝐸,𝐿𝐹,𝑞₀,𝐹⟩, In(𝑞) and Out(𝑞) for 𝑞∈𝑄 are called the set of incoming edges of 𝑞 and the set of outgoing edges of 𝑞, respectively; that is, In(𝑞)={(𝑞^′,𝑞)∣(𝑞^′,𝑞)∈𝐸} and Out(𝑞)={(𝑞,𝑞^′)∣(𝑞,𝑞^′)∈𝐸}.

Definition 6. If for all 𝑞∈𝑄 and for all 𝑒,𝑒^′∈Out(𝑞), 𝑒≠𝑒^′ and 𝐿𝐹(𝑒)∩𝐿𝐹(𝑒^′)=∅, 𝑀 is called a deterministic finite-state automaton (DFA). Otherwise, 𝑀 is called a nondeterministic finite-state automaton (NFA).
Traditionally, an NFA may have a set of initial states. The expressiveness of an NFA with multiple initial states is the same as that of an NFA with a unique initial state. The transformation is easy.

Definition 7. An assertion graph 𝐺 is a tuple ⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹⟩, where 𝑄 is a finite set of states, Σ is a finite alphabet, 𝐸 is a set of directed edges over 𝑄, ant∶𝐸↦2^Σ and cons∶𝐸↦2^Σ are the labeling functions for all edges, 𝑞₀∈𝑄 is the initial state, and 𝐹 is a subset of 𝑄 and elements of 𝐹 are called acceptance states.

Definition 8. A finite word (or string) 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈Σ^∗ is accepted by an assertion graph 𝐺 (denoted as 𝑋⊨_∗𝐺) if for each finite path 𝜌=𝑞₀𝑞₁⋯𝑞_𝑛 with (𝑞_𝑖−1,𝑞_𝑖)∈𝐸 (where 1≤𝑖≤𝑛) and 𝑞_𝑛∈𝐹 such that 𝑋⊨_ant𝜌⇒𝑋⊨_cons𝜌, where 𝑋⊨_ant𝜌 denotes 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)) and 𝑋⊨_cons𝜌 denotes 𝑥_𝑖∈cons((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖≤𝑛. An infinite word (or string) 𝑋=𝑥₁𝑥₂⋯∈Σ^𝜔 is accepted by 𝐺 (denoted as 𝑋⊨_𝜔𝐺) if for all infinite path 𝜌=𝑞₀𝑞₁⋯ with (𝑞_𝑖−1,𝑞_𝑖)∈𝐸 (where 𝑖≥1) and Inf(𝜌)∩𝐹≠∅ such that 𝑋⊨_ant𝜌⇒𝑋⊨_cons𝜌. The finite language 𝐿^∗(𝐺) of 𝐺 is 𝐿^∗(𝐺)={𝑋∈Σ^∗∣𝑋⊨_∗𝐺}. The infinite language 𝐿^𝜔(𝐺) of 𝐺 is 𝐿^𝜔(𝐺)={𝑋∈Σ^𝜔∣𝑋⊨_𝜔𝐺}.

Remark 9. In [1], an assertion graph 𝐺=⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹_𝑒⟩ has a set 𝐹_𝑒 of acceptance (fair) edges. The final edge of a finite path must be in 𝐹_𝑒 and for an infinite path; at least one edge in 𝐹_𝑒 must appear in the path infinitely often. This can be transformed to the above definitions by the following construction. For any 𝑞∈𝑄, if the incoming edges In(𝑞) have both acceptance edges and nonacceptance edges, 𝑞 is substituted with 𝑞^′ and 𝑞^′′ such that In(𝑞^′)=In(𝑞)∩𝐹_𝑒, In(𝑞^′′)=In(𝑞)−In(𝑞^′); that is, the incoming edges of 𝑞^′ are all acceptance edges, the incoming edges of 𝑞^′′ are nonacceptance edges (See Figure 1). The outgoing edges of 𝑞^′ and 𝑞^′′ are the same as the outgoing edges of 𝑞, and the labeling function ant and cons are the same. All such 𝑞^′𝑠 are included the acceptance state set 𝐹 in the transformed assertion graph.

Figure 1 

Fair edges to fair states.

Definition 10. Given an assertion graph 𝐺=⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹⟩, if for all𝑞∈𝑄, for all𝑒,𝑒^′∈Out(𝑞) and 𝑒≠𝑒^′, ant(𝑒)∩ant(𝑒^′)=∅, 𝐺 is called a deterministic assertion graph (DAG). Otherwise, 𝐺 is called a nondeterministic assertion graph (NAG).

For any assertion graph 𝐺=⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹⟩, we can assume that 𝐺 is a nonrestarting assertion graph (i.e., In(𝑞₀)=∅); otherwise, we construct a nonrestarting assertion graph 𝐺^′=⟨𝑄^′,Σ,𝐸^′,𝑞₀,ant,cons,𝐹^′⟩ from 𝐺: 𝑄^′=𝑄∪{𝑞^′} (add a new state 𝑞^′ to 𝑄), In(𝑞^′)={(𝑞,𝑞^′)∣(𝑞,𝑞₀)∈𝐸)},Out(𝑞^′)={(𝑞^′,𝑞)∣(𝑞₀,𝑞)∈𝐸)}, ant((𝑞^′,𝑞))=ant((𝑞₀,𝑞)),cons((𝑞^′,𝑞))=cons((𝑞₀,𝑞)), ant((𝑞,𝑞^′))=ant((𝑞,𝑞₀)),cons((𝑞,𝑞^′))=cons((𝑞,𝑞₀)). Basically, we copy the edges and the related labeling functions ant and cons of 𝑞₀ to 𝑞^′ and delete the incoming edges of 𝑞₀. The other edges and labeling functions remain the same.

3. Transformations between GSTE Assertion Graphs and Finite-State Automata

In this section, we present the transformations between a GSTE assertion graph and a finite-state automaton. Given an assertion graph 𝐺, we build a finite-state automaton 𝑀_𝐺 such that 𝐿^∗(𝐺)=Σ^∗−𝐿^∗(𝑀_𝐺) and 𝐿^𝜔(𝐺)=Σ^𝜔−𝐿^𝜔(𝑀_𝐺). And if 𝐺 is a deterministic assertion graph, then 𝑀_𝐺 is also a deterministic finite-state automaton. Let 𝑀_𝐺=⟨𝑄^′,Σ,𝐸^′,𝐿𝐹,𝑞^′₀,𝐹^′⟩:(1)𝑄^′=(𝑄−{𝑞₀})×{0,1}∪{(𝑞₀,0)}, 𝑞^′₀=(𝑞₀,0); (2)𝐸^′={((𝑞₁,𝑘₁),(𝑞₂,𝑘₂))∣(𝑞₁,𝑞₂)∈𝐸;if𝑘₁=0,then𝑘₂∈{0,1};if𝑘₁=1,then𝑘₂=1} (See Figure 2); (3)𝐿𝐹((𝑞₁,0),(𝑞₂,0))=ant((𝑞₁,𝑞₂))∩cons((𝑞₁,𝑞₂)), 𝐿𝐹((𝑞₁,0),(𝑞₂,1))=ant((𝑞₁,𝑞₂))∩¬cons((𝑞₁,𝑞₂)), 𝐿𝐹((𝑞₁,1),(𝑞₂,1))=ant((𝑞₁,𝑞₂)); (4)𝐹^′={(𝑞,1)∣𝑞∈𝐹}.

Figure 2 

Assertion graph to finite-state automaton.

Intuitively, 𝑀_𝐺 is constructed to accept all strings (or words) that are not accepted by 𝐺. Such a string (or word) satisfies the antecedent of each edge traversed while violating the consequent of at least of such edge.

Theorem 11. If 𝐺 is a DAG, then 𝑀_𝐺 is a DFA.

Proof. We prove the following two cases.
(i) For any state (𝑞,1) in 𝑀_𝐺 and any two outgoing edges ((𝑞,1),(𝑞₁,1)) and ((𝑞,1),(𝑞₂,1)), 𝐿𝐹(((𝑞,1),(𝑞₁,1)))∩𝐿𝐹(((𝑞,1),(𝑞₂,1)))=ant((𝑞,𝑞₁))∩ant((𝑞,𝑞₂)) (the construction of 𝑀_𝐺) =∅ (the definition of DAG).
(ii) For any state (𝑞,0) in 𝑀_𝐺 and any two outgoing edges ((𝑞,0),(𝑞₁,𝑘₁)) and ((𝑞,0),(𝑞₂,𝑘₂)). (a)If 𝑞₁=𝑞₂, then 𝑘₁=0,𝑘₂=1, 𝐿𝐹(((𝑞,0),(𝑞₁,0)))∩𝐿𝐹(((𝑞,0),(𝑞₁,1)))=ant((𝑞,𝑞₁))∩cons((𝑞,𝑞₁))∩ant((𝑞,𝑞₁))∩¬cons((𝑞,𝑞₁))  (the construction of 𝑀_𝐺) =∅.(b)If 𝑞₁≠𝑞₂, then 𝐿𝐹(((𝑞,1),(𝑞₁,1)))∩𝐿𝐹(((𝑞,1),(𝑞₂,1)))⊆ant((𝑞,𝑞₁))∩ant((𝑞,𝑞₂))    (the construction of 𝑀_𝐺) =∅ (the definition of DAG). Therefore, 𝑀_𝐺 is a DFA.

Theorem 12. 𝐿^∗(𝑀_𝐺)=Σ^∗−𝐿^∗(𝐺).

Proof. First, we show 𝐿^∗(𝑀_𝐺)⊇Σ^∗−𝐿^∗(𝐺).
Suppose 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈Σ^∗−𝐿^∗(𝐺).
Then there exists a finite path 𝜌=𝑞₀𝑞₁⋯𝑞_𝑛 in 𝐺 with (𝑞_𝑖−1,𝑞_𝑖)∈𝐸,1≤𝑖≤𝑛 and 𝑞_𝑛∈𝐹 such that 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖≤𝑛; and ∃𝑙,1≤𝑙≤𝑛, when 1≤ℎ<𝑙, 𝑥_ℎ∈ant((𝑞_𝑖−1,𝑞_𝑖))∩cons((𝑞_𝑖−1,𝑞_𝑖)), 𝑥_𝑙∈ant((𝑞_𝑙−1,𝑞_𝑙))∩¬cons((𝑞_𝑖−1,𝑞_𝑖)).
Let a path 𝜌^′ of 𝑀_𝐺 be as follows: 𝜌^′=𝑞₀,0𝑞₁,0⋯𝑞_𝑙−0,0𝑞_𝑙,1⋯𝑞_𝑛,1. (1)
Then 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_i)), where 𝑘_𝑖=0 if 1≤𝑖<𝑙, 𝑘_𝑖=1 if 𝑙≤𝑖≤𝑛; and (𝑞_𝑛,1)∈𝐹^′.
Therefore, 𝑋∈𝐿^∗(𝑀_𝐺).
Second, we show 𝐿^∗(𝑀_𝐺)⊆Σ^∗−𝐿^∗(𝐺).
Suppose 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈𝐿^∗(𝑀_𝐺).
Then there exists a path as follows: 𝜌^′=𝑞₀,0𝑞₁,0⋯𝑞_𝑙−0,0𝑞_𝑙,1⋯𝑞_𝑛,1, (2) such that 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_𝑖)), where 𝑘_𝑖=0 if 1≤𝑖<𝑙, 𝑘_𝑖=1 if 𝑙≤𝑖≤𝑛; and (𝑞_𝑛,1)∈𝐹^′.
According to the construction of 𝑀_𝐺 from 𝐺, we know that 𝜌=𝑞₀𝑞₁⋯𝑞_𝑛 is a path of 𝐺; if1≤𝑖<𝑙, 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_𝑖))=𝐿𝐹((𝑞_𝑖−1,0),(𝑞_𝑖,0))=ant((𝑞_𝑖−1,𝑞_𝑖))∩cons((𝑞_𝑖−1,𝑞_𝑖))⊆ant((𝑞_𝑖−1,𝑞_𝑖)).
𝑥_𝑙∈𝐿𝐹((𝑞_𝑙−1,0),(𝑞_𝑙,1))=ant((𝑞_𝑙−1,𝑞_𝑙))∩¬cons((𝑞_𝑙−1,𝑞_𝑙)), that is, 𝑥_𝑙∈ant((𝑞_𝑙−1,𝑞_𝑙)), but 𝑥_𝑙∉cons((𝑞_𝑙−1,𝑞_𝑙)).
If 𝑙<𝑖≤𝑛, 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_𝑖))=𝐿𝐹((𝑞_𝑖−1,1),(𝑞_𝑖,1))=ant((𝑞_𝑖−1,𝑞_𝑖)).
Therefore, 𝑋∉𝐿^∗(𝐺).

Theorem 13. 𝐿^𝜔(𝑀_𝐺)=Σ^𝜔−𝐿^𝜔(𝐺).

Proof. First, we prove 𝐿^𝜔(𝑀_𝐺)⊇Σ^𝜔−𝐿^𝜔(𝐺).
Suppose 𝑋=𝑥₁𝑥₂⋯∈Σ^𝜔−𝐿^𝜔(𝐺).
Then there exists an infinite path 𝜌=𝑞₀𝑞₁⋯ in 𝐺 with (𝑞_𝑖−1,𝑞_𝑖)∈𝐸 and Inf(𝜌)∩𝐹≠∅ such that 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖; and ∃𝑙,1≤𝑙, 𝑥_𝑙∉cons((𝑞_𝑙−1,𝑞_𝑙)). Let a path 𝜌^′ of 𝑀_𝐺 be 𝜌^′=(𝑞₀,0)(𝑞₁,0)⋯(𝑞_𝑙−1,0)(𝑞_𝑙,1)(𝑞_𝑙+1,1)⋯. This path 𝜌^′ will visit infinitely often every (𝑞,1)∈𝐹^′ if 𝑞∈Inf(𝜌)∩𝐹. And 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_𝑖)), where 𝑘_𝑖−1=0 if 1≤𝑖≤𝑙, 𝑘_𝑖=1 if 𝑙<𝑖.
Thus 𝑋∈𝐿^𝜔(𝑀_𝐺).
Second, we prove 𝐿^𝜔(𝑀_𝐺)⊆Σ^𝜔−𝐿^𝜔(𝐺).
Suppose 𝑋=𝑥₁𝑥₂⋯∈𝐿^𝜔(𝑀_𝐺).
Then there exists an infinite path 𝜌^′=(𝑞₀,0)(𝑞₁,0)⋯(𝑞_𝑙−1,0)(𝑞_𝑙,1)(𝑞_𝑙+1,1)⋯ in 𝑀_𝐺 with (𝑞_𝑖−1,𝑞_𝑖)∈𝐸 and Inf(𝜌^′)∩𝐹^′≠∅ such that 𝑥_𝑖∈𝐿𝐹((𝑞_𝑖−1,𝑘_𝑖−1),(𝑞_𝑖,𝑘_𝑖)), where 𝑘_𝑖=0 if 1≤𝑖<𝑙, 𝑘_𝑖=1 if 𝑙≤𝑖≤𝑛.
According to the construction of 𝑀_𝐺 from 𝐺, we know that 𝜌=𝑞₀𝑞₁⋯ is a path of 𝐺, and Inf(𝜌)∩𝐹≠∅; 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖, and 𝑥_𝑙∈ant((𝑞_𝑙−1,𝑞_𝑙))∩¬cons((𝑞_𝑙−1,𝑞_𝑙)), that is, 𝑥_𝑙∉cons((𝑞_𝑙−1,𝑞_𝑙)).
Therefore, 𝑋⊭_𝜔𝐺, that is, 𝑋∈Σ^𝜔−𝐿^𝜔(𝐺).

Given a finite-state automaton 𝑀=⟨𝑄,Σ,𝐸,𝐿𝐹,𝑞₀,𝐹⟩, build an assertion graph 𝐺_𝑀 as 𝐺_𝑀=⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹⟩ where ant(𝑒)=𝐿𝐹(𝑒), cons(𝑒)=∅ for all 𝑒∈𝐸. This construction is the same as the construction proposed in [15].

Theorem 14. 𝐿^∗(𝐺_𝑀)=Σ^∗−𝐿^∗(𝑀) and 𝐿^𝜔(𝐺_𝑀)=Σ^𝜔−𝐿^𝜔(𝑀).

Proof. Directly from the construction of 𝐺_𝑀 and the language definitions in [15].

Theorem 15. If 𝑀 is a DFA, then 𝐺_𝑀 is a DAG.

Proof . Directly from the construction of 𝐺_𝑀 and the deterministic definition.

4. Application to GSTE Assertion Graphs Implication

4.1. Transforming GSTE Assertion Graphs Implication to Automata Language Containment

The complement relation between an assertion graph and a finite-state automaton can be applied to determine the implication relation between assertion graphs by transforming the GSTE assertion graphs implication to the finite-state automata language containment.

Definition 16. Given two assertion graphs 𝐺₁ and 𝐺₂, 𝐺₁⇒_∗𝐺₂ if and only if 𝐿^∗(𝐺₁)⊆𝐿^∗(𝐺₂) and 𝐺₁⇒_𝜔𝐺₂ if and only if 𝐿^𝜔(𝐺₁)⊆𝐿^𝜔(𝐺₂).

Let 𝑀^∗𝑐 be an automaton whose finite language is the complement of the finite language of an automaton 𝑀; that is, 𝐿^∗(𝑀^∗𝑐)=Σ^∗−𝐿^∗(𝑀). Let 𝑀^𝜔𝑐 be an automaton whose infinite language is the complement of the infinite language of an automaton 𝑀; that is, 𝐿^𝜔(𝑀^𝜔𝑐)=Σ^𝜔−𝐿^𝜔(𝑀).

Theorem 17. 𝐺₁⇒_∗𝐺₂ iff 𝐿^∗((𝑀_𝐺1)^∗𝑐×𝑀_𝐺2)=∅.
𝐺₁⇒_𝜔𝐺₂ iff 𝐿^𝜔((𝑀_𝐺1)^𝜔𝑐×𝑀_𝐺2)=∅.

Proof. (𝐺₁⇒_∗𝐺₂)⇔𝐿^∗(𝐺₁)⊆𝐿^∗(𝐺₂)⇔𝐿^∗(𝑀_𝐺1)⊇𝐿^∗(𝑀_𝐺2)⇔𝐿^∗((𝑀_𝐺1)^∗𝑐×𝑀_𝐺2)=∅.
(𝐺₁⇒_𝜔𝐺₂)⇔𝐿^𝜔(𝐺₁)⊆𝐿^𝜔(𝐺₂)⇔𝐿^𝜔(𝑀_𝐺1)⊇𝐿^𝜔(𝑀_𝐺2)⇔𝐿^𝜔((𝑀_𝐺1)^𝜔𝑐×𝑀_𝐺2)=∅.

In GSTE, because of its aggressive abstraction, abstraction refinement is often necessary [2]. Verifying whether a circuit 𝐶 satisfies an assertion graph 𝐺, 𝐶⊨𝐺, using the GSTE engine may produce false negative if 𝐺 is too abstract. Thus, it is necessary to refine 𝐺 into a refined assertion graph 𝐺^ref. If we can verify 𝐶⊨𝐺^ref, then we can conclude 𝐶⊨𝐺. But how can we guarantee that (𝐶⊨𝐺^ref)⇒(𝐶⊨𝐺) if the assertion graph is complex? We must establish 𝐺^ref⇒𝐺. We can verify 𝐺^ref⇒𝐺 by transforming it to an automata language containment test using Theorem 17.

A critical difficulty in checking the language containment, 𝐿(𝑀₁)⊆𝐿(𝑀₂), is the construction of a complement finite-state automaton 𝑀^𝑐₂ of 𝑀₂. Complementing a nondeterministic automaton with 𝑛 states resulted in an automaton with 2^2𝑂(𝑛) [23]. Some optimized complementing constructions were introduced with 2^{𝑂(𝑛log𝑛)} [16–22]. However, the complexity is still exponential.

Although we can transform deterministic assertion graphs to deterministic finite-state automata, in many cases, assertion graphs are nondeterministic. This may cause state space blowups when checking language containment between automata corresponding to these assertion graphs. We observe that in determining the implication relation between an assertion graph and its refinements constructed using the refinement strategies in [2], we can transform the nondeterministic assertion graph 𝐺 to deterministic assertion graph 𝐺_det by adding only one variable without adding any states and then apply the refinements to 𝐺_det. The requirement of our method is that the refinements applied to 𝐺_det will not cause nondeterminism. The refinement strategies in [2] satisfy our requirement. The language containment of deterministic finite state automata can be checked in polynomial time [19]. Therefore, the state space blowup problem can be avoided in determining the implication relation between a refined assertion graph and an original assertion graph.

For any given assertion graph 𝐺=⟨𝑄,Σ,𝐸,𝑞₀,ant,cons,𝐹⟩, let 𝐺^ref be a refined assertion graph of 𝐺. If 𝐺 is a non-deterministic assertion graph, we add an additional variable “det” to constrain the overlapped antecedents of the outgoing edges of every state in 𝐺 and the resulting assertion graph is denoted as 𝐺_det; that is, 𝐺_det=⟨𝑄,Σ×det,𝐸,𝑞₀,ant×det,cons×det,𝐹⟩. The value domain of “det” is from 1 to the maximal number 𝑛 that we need to distinguish the overlapped antecedents of the outgoing edges of every state in the assertion graph 𝐺, denoted as 𝐷(det).

Figure 3 illustrates the determinization process: there are three outgoing edges from state 𝑝: (𝑝,𝑞₁),(𝑝,𝑞₂), and (𝑝,𝑞₃). Two of these three antecedents ant((𝑝,𝑞₂))={3,4} and ant((𝑝,𝑞₃))={3,5} in Figure 3(a) are overlapped. So, it is a non-deterministic transition. We constrain these two antecedents by adding a variable “det” with a domain of  {1,2} and changing ant((𝑝,𝑞₂)) to {3,4}×{det=1} and ant((𝑝,𝑞₃)) to {3,5}×{det=2} in Figure 3(b), the determinized assertion graph 𝐺_det. For simplification, the consequents and the antecedents which are not needed to be constrained will not be followed by ×det.

Figure 3 

Assertion graph determinization.

The projection of the (finite or infinite) language of 𝐺_det is defined as 𝐿^∗_proj(𝐺_det)={𝑥₁𝑥₂⋯𝑥_𝑛∈Σ^∗∣∃𝑑_𝑖∈𝐷(det),s.t.(𝑥₁,𝑑₁)(𝑥₂,𝑑₂)⋯(𝑥_𝑛,𝑑_𝑛)∈𝐿^∗(𝐺_det)}, 𝐿^𝜔_proj(𝐺_det)={𝑥₁𝑥₂⋯∈Σ^𝜔∣∃𝑑_𝑖∈𝐷(det),s.t.(𝑥₁,𝑑₁)(𝑥₂,𝑑₂)⋯∈𝐿^𝜔(𝐺_det)}.

Lemma 18. 𝐿^∗(𝐺)=𝐿^∗_{𝑝𝑟𝑜𝑗}(𝐺_𝑑𝑒𝑡), 𝐿^𝜔(𝐺)=𝐿^𝜔_{𝑝𝑟𝑜𝑗}(𝐺_𝑑𝑒𝑡).

Proof. First, suppose 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈𝐿^∗(𝐺). For any finite path 𝜌=𝑞₀𝑞₁⋯𝑞_𝑛 in 𝐺_det, it is also a path in 𝐺 according to the construction of 𝐺_det (because it does not change the graph structure of the assertion graph 𝐺). If 𝑋⊨_ant𝜌, that is, 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖≤𝑛, then 𝑋⊨_cons𝜌, namely, 𝑥_𝑖∈cons((𝑞_𝑖−1,𝑞_𝑖)) for 1≤𝑖≤𝑛. According to the definition of 𝐺_det, there exists 𝑑_𝑖∈𝐷(det) such that ant((𝑞_𝑖−1,𝑞_𝑖))×𝑑_𝑖 is the antecedent of the edge (𝑞_𝑖−1,𝑞_𝑖) in 𝐺_det if there is a constraint det=𝑑_𝑖 for this antecedent, or a subset of the antecedent of the edge (𝑞_𝑖−1,𝑞_𝑖) in 𝐺_det if there is no constraint for this antecedent. Therefore, 𝑋_det=(𝑥₁,𝑑₁)(𝑥₂,𝑑₂)⋯(𝑥_𝑛,𝑑_𝑛)⊨_ant×det𝜌, and 𝑋_det⊨_cons×det𝜌 because there is no constraint for the consequents. Thus, 𝑋_det∈𝐿^∗(𝐺_det). According to the definition of the projection language of 𝐺_det, 𝑋∈𝐿^∗_proj(𝐺_det).
Second, suppose that 𝑋=𝑥₁𝑥₂⋯𝑥_𝑛∈𝐿^∗_proj(𝐺_det). Then there exists 𝑑_𝑖∈𝐷(det) such that 𝑋_det=(𝑥₁,𝑑₁)(𝑥₂,𝑑₂)⋯(𝑥_𝑛,𝑑_𝑛)∈𝐿^∗(𝐺_det), which implies that if (𝑥_𝑖,𝑑_𝑖)∈ant((𝑞_𝑖−1,𝑞_𝑖))×𝑑_𝑖 for 1≤𝑖≤𝑛, then (𝑥_𝑖,𝑑_𝑖)∈cons((𝑞_𝑖−1,𝑞_𝑖))×det. And (𝑥_𝑖,𝑑_𝑖)∈ant((𝑞_𝑖−1,𝑞_𝑖))×𝑑_𝑖 implies 𝑥_𝑖∈ant((𝑞_𝑖−1,𝑞_𝑖)), (𝑥_𝑖,𝑑_𝑖)∈cons((𝑞_𝑖−1,𝑞_𝑖))×det implies 𝑥_𝑖∈cons((𝑞_𝑖−1,𝑞_𝑖)).
Therefore 𝑋∈𝐿^∗(𝐺).
Combining these two cases, we have 𝐿^∗(𝐺)=𝐿^∗_proj(𝐺_det).
Similarly, 𝐿^𝜔(𝐺)=𝐿^𝜔_proj(𝐺_det) is also true.

Theorem 19. (𝐺^𝑟𝑒𝑓_𝑑𝑒𝑡⇒𝐺_𝑑𝑒𝑡)⇒(𝐺^𝑟𝑒𝑓⇒𝐺).

Proof. (𝐺^ref_det⇒𝐺_det)⇔(𝐿(𝐺^ref_det)⊆𝐿(𝐺_det)) (definition of implication).
⇒(𝐿_proj(𝐺^ref_det)⊆𝐿_proj(𝐺_det)) (definition of projection language).
⇒(𝐿(𝐺_ref)⊆𝐿(𝐺)) (Lemma 18).
⇒(𝐺^ref⇒𝐺) (definition of implication).

In the above proof, the language 𝐿(𝐺) can be finite language 𝐿^∗(𝐺) or infinite language 𝐿^𝜔(𝐺). Thus, Theorem 19 holds for both finite and infinite languages, respectively.

4.2. Case Study

An FIFO is a common circuit within a microprocessor design. The design requirements of an FIFO can be fairly complex due to the variable lengths, different rates of data throughput, and timing. Therefore, it makes a good practice to verify the FIFO design against these requirements. In general, the behavior of an FIFO must meet the following requirements: (1) correctness of full and empty flags, and (2) enqueued data must be dequeued in the correct order while maintaining uncorrupted data. The FIFO has 0 entry after the reset. If an enqueue only operation occurred, the total number of entries increases by 1. On the other hand, if a dequeue only operation occurred, the total number of entries decreases by 1 when the number of entries is bigger than 0. The empty flag is set when the number of entries is 0 and the full flag is set when contents reach the depth of the FIFO.

An assertion graph of a 3-deep FIFO circuit is shown in Figure 4 without determinization variable det.

Figure 4 

Determinized assertion graph for FIFO.

The top part of the assertion graph specifies the number of filled entries. However, it cannot guarantee whether the enqueued data is corrupted or not. In order to overcome this situation, an enqueued vector of distinct symbolic constants is used at an arbitrary time as shown in the bottom portion of the graph.

The assertion graph shown in Figure 4 without determinization variable det has the potential problem of overapproximation. In order to overcome this problem, a refined assertion graph shown in Figure 5 without determinization variable det is introduced.

Figure 5 

Determinized and refined assertion graph for FIFO.

It unfolds the graph at the states where the precision is lost.

Using the GSTE engine, we can verify the refined assertion graph on the FIFO circuit. To conclude that the original assertion graph also holds on the circuit, we must establish that the refined assertion graph implies the original assertion graph. Since both assertion graphs are non-deterministic, we first determinize the original assertion graph. A variable “det” whose domain is {1,2} is added to determinize the original assertion graph. We add “det=1” in the antecedents on the edges (𝑖-filled, (𝑖+1)-filled) and “det=2” in the antecedents on the edges (𝑖-filled, 𝑖-ahead), respectively, for 𝑖=0,1,2. And We add “det=1” in the antecedents on the edges (𝑖-filled, 𝑖-filled) and “det=2” in the antecedents on the edges (𝑖-filled, (𝑖−1)-ahead), respectively, for 𝑖=1,2. The determinized assertion graph is shown in Figure 4. We then refine the assertion graph in Figure 4 by applying the same refinements that refine the original assertion graph to the refined assertion graph and get the determinized and refined assertion graph shown in Figure 5.

We select COSPAN [24, 25] as the model checking engine to perform language containment test. We code the automata corresponding to the assertion graphs in Figures 4 and 5 in S/R, the input language of COSPAN, and use COSPAN to verify that the language of the automaton corresponding to the assertion graph in Figure 4 is contained in the language of the assertion graph in Figure 5. COSPAN establishes the language containment using 0.156 megabytes memory and 0.02 CPU seconds on a Pentium IV 2.8 GHz computer.

5. Conclusion

In this paper, we have established the complement relation between GSTE assertion graphs and finite-state automata with expressiveness of regular languages and 𝜔-regular languages. We present an algorithm that transforms a GSTE assertion graph to a finite-state automaton and vice versa. Using this algorithm, we transform the problem of GSTE assertion graphs implication to the problem of automata language containment. We avoid the exponential state space blowups in checking language containment of non-deterministic finite-state automata when determining the implication relation between a nondeterministic assertion graph and its refinement derived following the refinement strategies given in [2]. This avoidance is achieved by transforming the implication relation between nondeterministic assertion graphs to the implication relation between deterministic assertion graphs without adding any states. This application has been illustrated with a case study for verifying properties of an FIFO circuit.

Acknowledgments

This paper is partially supported by the National Natural Science Foundation of China (no. 60973016 and no. 61272175), and the National Basic Research Program of China (973 Program: no. 2010CB328004).