Generating and Model Checking a Hierarchy of Abstract Models

  • 格式:pdf
  • 大小:293.47 KB
  • 文档页数:34

GeneratingandModelCheckingaHierarchyofAbstractModels

ScottHazelhurst

ProgrammeforHighlyDependableSystems

DepartmentofComputerScience

UniversityoftheWitwatersrand,Johannesburg

2050Wits,SouthAfrica

scott@cs.wits.ac.za

2March1999

Abstract

Theuseofautomaticmodelcheckingalgorithmstoverifydetailedgateorswitchleveldesignsofcircuitsisveryattractivebecausethemethodisautomaticandsuchmodelscanaccuratelycapturede-tailedfunctional,timing,andevensubtleelectricalbehaviourofcircuits.Theuseofbinarydecisiondiagramshasextendedbyordersofmagnitudethesizeofcircuitsthatcanbesoverified,buttherearestillverysignificantlimitationsduetothecomputationalcomplexityoftheproblem.Verifyingabstractversionsofthemodelisattractivetoreducecomputationalcostsbutthisposestheproblemofhowtobuildabstractionseasilywithoutlosingtheaccuracyofthelow-levelmodel.Thispaperproposesamethodofbridgingthegapbetweendetaileddesignsandabstractmod-els,andpresentspreliminarytheoreticalandexperimentalresults.Startingwithadetailed,low-levelmodelofacircuit(whichusesBDDsforrepresentingdata),thehumanverifierpicksasetofprop-ertiesthats/hebelievescharacterisesthecircuit.Thesepropertiesareautomaticallyverifiedbyamodelcheckingalgorithm.Onceproved,thesepropertiesareusedtosynthesiseautomaticallyanabstractmodelofthecircuit,whichcanusesymbolicrepresentationofdata.Anautomaticmodelcheckingalgorithmcanthenbeappliedtotheabstractmodeltoverifymorepropertiesofthecircuit.Thepreliminaryresults,althoughlimited,werepromising:theabstractioncouldbeconstructedandverifiedwithrelativelymodestcost,therebyreducingthehumancostofverificationsignificantly.

1Introduction

1.1Motivation

Thedevelopmentofefficientmodelcheckingalgorithms(suchas[6,25])basedonbinarydecision

diagrams(BDDs)hasmeantthatautomaticverificationmethodsarenowapplicabletoawiderange

ofcircuits.However,althoughtheuseofBDDshasextendedthesizeofcircuitsthatcanbeverified

byordersofmagnitude,theydonotchangetheunderlyingcomputationalcomplexitycostsofmodel

checking,andatthesametimehavetheirownlimitations.

Thelastfewyearshaveseenconsiderableworkbeingputintoextendingmodelcheckingalgorithms

todealwiththeselimitations.Onetackhasbeentousemethodssuchasabstractionandcompositionality,

oftencombinedwiththeuseoftheoremproving[8,13,17,20,21,23].Thishasbeenveryeffective,but

hasthedrawbackthatsignificanthumaninterventionisoftenneeded,ordatapathortiminginformation

isabstractedaway(whichisnotalwaysappropriate).

Anothertackhasbeenextendingtherangeofdatastructuresusedinthemodelcheckingprocess,

andtheuseofmoreadvanceddecisiondiagramshasbeenveryeffective(forexamples,see[5,7]).The

difficultywiththisisthatoftenthestartingpointforverificationisadesigngivenatthegateorswitch

level,forwhichthenaturaldatarepresentationtouseisBDDs.Althoughworkisbeingdoneatbeing

abletogeneratemoreabstractmodelsdirectlyfromcircuitdescriptions,thisisnotalwayspossible,

particularlywhenitisimportanttocaptureelectricalordetailedtimingpropertiesofthecircuit.Thus

1astartingpointofthispaperisthatverifyingcircuitswhichhavemodelsthatarenaturallyrepresented

usingBDDs(orequivalentdatastructures)willremainanimportantproblemtobesolved.

1.2ResearchProblem

Thispaperproposesamethodofabstraction,therebybridgingthegapbetweenthelow-levelmodel

extractedautomaticallyfromacircuitdescriptionandhigherlevelmethodsofdatarepresentation.The

focusoftheabstractionmechanismistoidentifystructureinthecircuit,whichallowsmorepowerful

datarepresentationmethodstobeused.

Thebasicapproachisasfollows.Supposethatwehavesomemodelwhichwewishtoverify,

andthatisnaturallyrepresentedataverydetailedlevelusingdatastructuressuchasBDDs.

Thehumanverifierselectsasetofpropertieswhichs/hebelievesaretheimportant

propertiesthatcharacterisethecircuit.

Eachpropertyisverifiedautomaticallyusingamodelcheckingalgorithm.

Amodelisgeneratedautomaticallyfromtheproperties.isanabstraction

ofinthefollowingsense:everypropertythatistrueofistrueof,andeveryproperty

thatisfalseofisfalseof.(Therewillbesomepropertiesofthatareneithertruenor

falseof.)Eachandanypropertiesinferablefromthewillbetrueof.

Thekeyhereisthathasahigher-levelrepresentation.WhileBDDsmaystillbeusedto

representbooleandata,otherdatastructureswillbeusedfordatasuchasintegersandvectors.

Thehumanverifierusesanautomaticmodelcheckingalgorithmontoverifymoreproperties.

Inprinciple,theprocessofabstractingcouldbecarriedoutatanumberofdifferentlevels.

Theideaofconstructingamodelfromasetofpropertiesisacommononeinthestudyoflogic(es-

pecially,thestudyoflogicincomputerscience).Thecontributionofthispaperistoshowhowsuch

constructioncanbedoneforcircuitmodels.Thesignificanceofthisisthatitprovidesapracticalwayof

creatingabstractionwithrelativelyminimalhumanintervention.Thisabstractioninturncanbeusedfor