Sugar 2.0 Formal Specification Language

1
Sugar 2.0Formal Specification Language

• Dana Fisman1,2 Cindy Eisner1
• 1IBM Haifa Research Laboratory
  
• 2Weizmann Institute of Science

2
Sugar2.0

• Sugar 2.0 is a formalism to reason about behavior
  over time
• Uses of Sugar
• For documentation easy to read, yet precise
  specification
• Input to formal verification tools (model
  checker, theorem prover)
• Input to simulation tools (source of
  automatically generated monitors )

3
Goals (in designing the language)

• easy to learn, read and write
• mathematically precise
• rigorously well defined formal syntax and
  semantics
• sufficiently expressive
• permitting the specification of a large class of
  real world
• design properties
• known efficient underlying algorithms
• in simulation
• in model checking (with reasonable complexity)

4
History

• 1994
• Syntactic sugaring of CTL for RuleBase model
  checker
• 1995
• Addition of regular expressions
• 1997
• Automatic generation of simulation monitors
• 2001
• Move to linear (LTL-based) semantics
• 2002
• Selected by Accellera for IEEE standardization

Sugar 1.0
Sugar 2.0
5
Track Record (Sugar 1.0)

• IBM products
• Main Frame line (S/390)
• Mid-range line (AS/400)
• Workstation line (RS/6000)
• PC line (Netfinity)
• Super Computers (ASCI)
• ASIC/OEM business
• External licensees
• University program

6
Structure of Sugar

• Boolean layer
• Used to reason about states of the design
• Temporal layer
• Used to reason about behavior of the design over
  time
• Modeling layer
• Used to model auxiliary state variables and
  state machines
• Verification layer
• Directives to the verification tool

7
Structure of Sugar
Sugar comes in three flavors Verilog/VHDL/EDL

• Boolean layer
• Used to reason about states of the design
• Temporal layer
• Used to reason about behavior of the design over
  time
• Modeling layer
• Used to model auxiliary state variables and
  state machines
• Verification layer
• Directives to the verification tool

8
The Temporal Layer

• Boolean Expressions
• expressions evaluated over a single state
• Sugar Extended Regular Expressions (SERE)
• expressions evaluated over a bounded sequence of
• states
• Sugar Foundation Language
• expressions evaluated over finite or infinite
  sequence
• of states
• Optional Branching Extension (OBE)
• expression evaluated over infinite trees of
  states
• (relevant for formal verification only)

s
9
The Temporal Layer

• Boolean Expressions
• Sugar Extended Regular Expressions (SERE)
• expressions evaluated over a bounded sequence of
• states
• Sugar Foundation Language
• expressions evaluated over finite or infinite
  sequence
• of states
• Optional Branching Extension (OBE)
• expression evaluated over infinite trees of
  states
• (relevant for formal verification only)

s
10
The Temporal Layer

• Boolean Expressions
• Sugar Extended Regular Expressions (SERE)
• expressions evaluated over a bounded sequence of
• states
• Sugar Foundation Language
• expressions evaluated over finite or infinite
  sequence
• of states
• Optional Branching Extension (OBE)
• expression evaluated over infinite trees of
  states
• (relevant for formal verification only)

s
11
The Temporal Layer

• Boolean Expressions
• Sugar Extended Regular Expressions (SERE)
• expressions evaluated over a bounded sequence of
• states
• Sugar Foundation Language
• expressions evaluated over finite or infinite
  sequence
• of states
• Optional Branching Extension (OBE)
• expression evaluated over infinite trees of
  states
• (relevant for formal verification only)

s
12
The Temporal Layer

• Boolean Expressions
• Sugar Extended Regular Expressions (SERE)
• Sugar Foundation Language
• Optional Branching Extension (OBE)

s
13
The Temporal Layer

• Boolean Expressions
• Sugar Extended Regular Expressions (SERE)
• Sugar Foundation Language
• Temporal formulas where the atoms are Booleans
• Temporal formulas where the atoms are SEREs
• Temporal formulas where the atoms are Booleans
  and/or SEREs
• Optional Branching Extension (OBE)

14
SEREs Example1
A SERE describes a set of sequences of states
(which we represent using timing diagrams)
This diagram is described by the SERE
15
SEREs Example1
This diagram is also described by the SERE
16
SEREs Example1
expressions evaluated over a bounded sequence
of states
expressions evaluated over a bounded sequence
of states
If we want to describe only this diagram we have
to change the SERE
17
2SEREs Example
expressions evaluated over a bounded sequence
of states
expressions evaluated over a bounded sequence
of states
18
2SEREs Example
expressions evaluated over a bounded sequence
of states
expressions evaluated over a bounded sequence
of states
19
3SEREs Example
expressions evaluated over a bounded sequence
of states
expressions evaluated over a bounded sequence
of states
20
Examples

• Until now we saw examples for SEREs, which are
  not properties on their own, but rather building
  blocks of properties
• We will now see examples of properties composed
  from the SERE building blocks

21
Examples Properties
The suffix implication operator
if the path starting now matches then its
continuation should match
22
Properties Example1
23
Properties Example1
24
Properties Example1
Overlapping is also possible!
then
if
then
if
25
Properties Example1
then
if
then
if
26
Properties Example2
But what if data does not hold in contiguous
cycles?
27
Properties Example2
28
Properties Example2
then
if
29
Properties Example2
then
if
30
Properties Example2
1
3
2
then
if
31
Expressiveness

• Theory
• At least as expressive as
• LTL
• CTL
• regular expressions
• Practice
• All properties suggested by FVTC of Accellera are
• concisely and intuitively expressible in Sugar

32
Implementation

• Sugar has a core of operators which determine its
  expressive power
• Other operators are syntactic sugaring
  (abbreviations) of the core operators
• A tool needs to implement
• Only the core operators
• Macro expansion of the syntactic sugaring
  operators

33
Implementation (of the core)

• Any Sugar property can be reduced to an LTL or
  CTL property using auxiliary state machines.
• CTL and LTL have known model checking algorithms.
• For simulation we consider the subset that can be
  verified on-the-fly. For this subset there are
  simple transformation rules that transform the
  formula to a state machine describing all
  possible counter examples.

34
Sugar Home Page

• More information available on the sugar home page
  at
• Complete definition
• Tutorial
• Sugar parser
• Formal syntax and semantics
• More

www.haifa.il.ibm.com/projects/verification/sugar/i
ndex.html