Generating and Model Checking a Hierarchy of Abstract Models
- 格式:pdf
- 大小:293.47 KB
- 文档页数:34
GeneratingandModelCheckingaHierarchyofAbstractModels
ScottHazelhurst
ProgrammeforHighlyDependableSystems
DepartmentofComputerScience
UniversityoftheWitwatersrand,Johannesburg
2050Wits,SouthAfrica
scott@cs.wits.ac.za
2March1999
Abstract
Theuseofautomaticmodelcheckingalgorithmstoverifydetailedgateorswitchleveldesignsofcircuitsisveryattractivebecausethemethodisautomaticandsuchmodelscanaccuratelycapturede-tailedfunctional,timing,andevensubtleelectricalbehaviourofcircuits.Theuseofbinarydecisiondiagramshasextendedbyordersofmagnitudethesizeofcircuitsthatcanbesoverified,buttherearestillverysignificantlimitationsduetothecomputationalcomplexityoftheproblem.Verifyingabstractversionsofthemodelisattractivetoreducecomputationalcostsbutthisposestheproblemofhowtobuildabstractionseasilywithoutlosingtheaccuracyofthelow-levelmodel.Thispaperproposesamethodofbridgingthegapbetweendetaileddesignsandabstractmod-els,andpresentspreliminarytheoreticalandexperimentalresults.Startingwithadetailed,low-levelmodelofacircuit(whichusesBDDsforrepresentingdata),thehumanverifierpicksasetofprop-ertiesthats/hebelievescharacterisesthecircuit.Thesepropertiesareautomaticallyverifiedbyamodelcheckingalgorithm.Onceproved,thesepropertiesareusedtosynthesiseautomaticallyanabstractmodelofthecircuit,whichcanusesymbolicrepresentationofdata.Anautomaticmodelcheckingalgorithmcanthenbeappliedtotheabstractmodeltoverifymorepropertiesofthecircuit.Thepreliminaryresults,althoughlimited,werepromising:theabstractioncouldbeconstructedandverifiedwithrelativelymodestcost,therebyreducingthehumancostofverificationsignificantly.
1Introduction
1.1Motivation
Thedevelopmentofefficientmodelcheckingalgorithms(suchas[6,25])basedonbinarydecision
diagrams(BDDs)hasmeantthatautomaticverificationmethodsarenowapplicabletoawiderange
ofcircuits.However,althoughtheuseofBDDshasextendedthesizeofcircuitsthatcanbeverified
byordersofmagnitude,theydonotchangetheunderlyingcomputationalcomplexitycostsofmodel
checking,andatthesametimehavetheirownlimitations.
Thelastfewyearshaveseenconsiderableworkbeingputintoextendingmodelcheckingalgorithms
todealwiththeselimitations.Onetackhasbeentousemethodssuchasabstractionandcompositionality,
oftencombinedwiththeuseoftheoremproving[8,13,17,20,21,23].Thishasbeenveryeffective,but
hasthedrawbackthatsignificanthumaninterventionisoftenneeded,ordatapathortiminginformation
isabstractedaway(whichisnotalwaysappropriate).
Anothertackhasbeenextendingtherangeofdatastructuresusedinthemodelcheckingprocess,
andtheuseofmoreadvanceddecisiondiagramshasbeenveryeffective(forexamples,see[5,7]).The
difficultywiththisisthatoftenthestartingpointforverificationisadesigngivenatthegateorswitch
level,forwhichthenaturaldatarepresentationtouseisBDDs.Althoughworkisbeingdoneatbeing
abletogeneratemoreabstractmodelsdirectlyfromcircuitdescriptions,thisisnotalwayspossible,
particularlywhenitisimportanttocaptureelectricalordetailedtimingpropertiesofthecircuit.Thus
1astartingpointofthispaperisthatverifyingcircuitswhichhavemodelsthatarenaturallyrepresented
usingBDDs(orequivalentdatastructures)willremainanimportantproblemtobesolved.
1.2ResearchProblem
Thispaperproposesamethodofabstraction,therebybridgingthegapbetweenthelow-levelmodel
extractedautomaticallyfromacircuitdescriptionandhigherlevelmethodsofdatarepresentation.The
focusoftheabstractionmechanismistoidentifystructureinthecircuit,whichallowsmorepowerful
datarepresentationmethodstobeused.
Thebasicapproachisasfollows.Supposethatwehavesomemodelwhichwewishtoverify,
andthatisnaturallyrepresentedataverydetailedlevelusingdatastructuressuchasBDDs.
Thehumanverifierselectsasetofpropertieswhichs/hebelievesaretheimportant
propertiesthatcharacterisethecircuit.
Eachpropertyisverifiedautomaticallyusingamodelcheckingalgorithm.
Amodelisgeneratedautomaticallyfromtheproperties.isanabstraction
ofinthefollowingsense:everypropertythatistrueofistrueof,andeveryproperty
thatisfalseofisfalseof.(Therewillbesomepropertiesofthatareneithertruenor
falseof.)Eachandanypropertiesinferablefromthewillbetrueof.
Thekeyhereisthathasahigher-levelrepresentation.WhileBDDsmaystillbeusedto
representbooleandata,otherdatastructureswillbeusedfordatasuchasintegersandvectors.
Thehumanverifierusesanautomaticmodelcheckingalgorithmontoverifymoreproperties.
Inprinciple,theprocessofabstractingcouldbecarriedoutatanumberofdifferentlevels.
Theideaofconstructingamodelfromasetofpropertiesisacommononeinthestudyoflogic(es-
pecially,thestudyoflogicincomputerscience).Thecontributionofthispaperistoshowhowsuch
constructioncanbedoneforcircuitmodels.Thesignificanceofthisisthatitprovidesapracticalwayof
creatingabstractionwithrelativelyminimalhumanintervention.Thisabstractioninturncanbeusedfor