Compositional Verification for SystemonChip Designs SRC Student Symposium Paper 16'5

1
Compositional Verification for
System-on-Chip Designs SRC Student
SymposiumPaper 16.5

• Nishant Sinha
• Edmund Clarke
• Carnegie Mellon University

2
Overview

• Compositional Reasoning
• Verifying HDL challenges
• Synchronous Intermediate Language (SIL)
• Automated Compositional Reasoning for SIL
• An example
• Making it efficient

3
Compositional Reasoning

• Verification of a concurrent hardware/software
  system by direct composition does not scale
• State space explosion
• Compositional Reasoning is a divide-and-conquer
  approach to alleviate the state space explosion

4
HDL Verification

• Hardware Description Languages (HDLs)
• Verilog, SystemC, SystemVerilog
• Basis of industrial SoC design
• Towards formal verification
• Problems informally specified semantics,
  language peculiarities
• Need standard formal semantics
• Although informal semantics differ, several
  notions/operators are common
• Synchronous execution via delta-cycles,
  blocking/non-blocking assignments
• We define a synchronous intermediate language
  (SIL) with common HDL operators and constructs

5
Synchronous Intermediate Lang. (SIL)

• A SIL Program consists of one or more modules
• Modules execute synchronously
• Communicate by global shared variables
• Each module specified in an imperative style
• Initialization and Combinational Logic blocks
• Variable Types bit-vectors, integers
• Guarded control flow
• Blocking (Immediate)/ Non-blocking (Delayed)
  assignments

6
A SIL Program Example
bvlt2gt ack bool req, err
Module node INIT req false err
false LOGIC do true ! req lt true if
ack0 ! err lt false else ! err lt
true fi pause od

• Module bus
• INIT ack 0
• LOGIC
• do true !
• if
• !req ! ack lt 0
• else ! ack lt 2
• fi
• pause
• od

7
SIL Safety Property Checking

• We have defined SIL program semantics in terms of
  composition of Kripke Structures
• The specification is provided as a Communicating
  Finite Automata (CFA)
• Alphabet ? (I,O) I and O are constraints
  on previous and next states
• Kripke M µ CFA P
• Finite language containment L(M) µ L(P)

(err0, ack X)
(err1, ack X)
8
Automated Compositional Reasoning

• Assume-Guarantee Reasoning (AGR)
• M1, M2 are Kripke structures, P is a CFA

M1 A ? P M2 ? A M1
M2 ? P
AG - Non Circular

• Automatically generate assumption CFA A
• Based on work by Cobleigh et al. 03
• Use learning algorithm for regular languages, L
• L is assisted by a model checker

9
Learning Regular languages L

• Proposed by D. Angluin, improved by Rivest et al.
  
• Learning regular sets from queries and
  counterexamples, Information and Computation,
  75(2), 1987.
• Learns the minimal DFA corresponding to an
  unknown regular lang.

Minimally adequate Teacher
L learner
IsMember( trace ? )
IsCandidate( DFA D )
Modelchecker
Minimum DFA

• Polynomial in the number of states and length of
  max counterexample

10
Automated AGR using L
-CE for A
Teacher
R1 M1 A ? P
L Assumption Generation
A
true
true
R2 M2 ? A
M1 M2 ? P
CE
Actual CE M1 M2 ? P
CE Analysis
CE for A
11
AGR for SIL programs

• Continued from previous example ..
• M1 node, M2 bus,
• P checks for (err1)
• An assumption CFA A for module M1 is

M1 A ? P M2 ? A M1 M2 ? P
(req X, ack 0)
Environment should never write (ack ! 0)
(req X, ack ! 0)
(req X, ack X)
12
Making it efficient

• Two main problems
• Each module itself has a huge state space
• Idea Use Bounded model checker as a teacher
• Fast membership query replies
• Naïve learning suffers from alphabet explosion
• Idea Cluster alphabet during learning
• Fewer membership queries
• Ongoing implementation in SYMODA
• SYnchronous MODular Analyzer

13
Related Work

• RTL Verilog program verification
• Via Predicate abstraction
• Andraus et al., Jain et al.
• Via Symbolic Simulation
• Kolbl et al.
• Via Translations to SMV-like languages
• Verilog VIS, Brayton et al.
• SystemC Moy et al., Tahar et al.
• None of these approaches are compositional

14
Related Work

• Compositional Hardware Verification
• Mcmillan 99 (using SMV)
• Khashidashvili et al. 06 (net-list level)
• Chen et al. 06 (using Murphi)
• None of the above approaches are automated