No full-text available
To read the full-text of this research,
you can request a copy directly from the authors.
Reachability analysis of large circuits using disjunctive partitioning and partial iterative squaring
Abstract
Reachability analysis is an orthogonal, state-of-the-art technique for the verification and validation of finite state machines (FSMs). Due to the state space explosion problem, it is currently limited to medium-small circuits, and extending its applicability is still a key issue. Among the factors that limit reachability analysis, let us list: the peak binary decision diagrams (BDD) size during image computation, the BDD size to represent state sets, and very high sequential depth. Following the promising trend of partitioning, we decompose a finite state machine into “functioning-modes”. We operate on a disjunctive partitioned transition relation. Decomposition is obtained heuristically based on complexity, i.e., BDD size, or functionality, i.e., dividing memory elements into “active” and “idle” ones. We use an improved iterative squaring algorithm to traverse high-depth subcomponents. The resulting methodology attacks the above problems, lowering intermediate peak BDD size, and dealing with high-depth subcomponents. Experiments on a few industrial circuits and on some large benchmarks show the feasibility of the approach.
... . On smaller examples it could be seen that the first few iterations run fairly quickly, as do the last iterations. Both the OBDD size of the set of reachable states found and run-time requirements drastically increase in the middle iterations. As this is a common problem in model checking, it was expected that there is previous work addressing it. [3], although concerned with hardware verification, provided the vital clue. It suggested decomposing complex hardware circuits into loosely coupled modules. Then, instead of performing a breadth-first search with the whole transition relation , an initial search is restricted to one of these modules. As before, this search will have peak r ...
... principle described in [3] and outlined above has been incorporated in gdlSMV by splitting the disjunctively par-titioned transition relation into two parts, one containing all transitions for route setting, and one containing all sub-route release transitions. The route setting transitions are applied iteratively, first to the initial states, and then to the set of reachable states found previously. ...
Geographic Data for Solid State Interlocking (SSI) systems detail site-specific behaviour of the railway interlocking. This
report demonstrates how five vital safety properties of such data can be verified automatically using model checking. A prototype
of a model checker for Geographic Data has been implemented by replacing the parser and compiler of NuSMV. The resulting tool,
gdlSMV, directly reads Geographic Data and builds a corresponding representation on which model checking is performed using
NuSMV’s symbolic model checking algorithms.
Because of the large number of elements in a typical track layout controlled by an SSI system, a number of optimisations had
to be implemented in order to be able to verify the corresponding data sets.
We outline how most of the model checking can be hidden from the user, providing a simple interface that directly refers to
the data being verified.
State space's explosion of Stochastic Petri Nets (SPN) is always one of the important problems to solve. In Stochastic Petri Nets, sequent and parallel transitions are primary structure. Simplification of sequent and parallel transitions can not only help to solve the problem of state space's explosion, but also make preparations for other simplification methods. Meanwhile, in some important SPN models, such as Workflow and Multimedia, there are a lot of sequent and parallel transitions, so simplifying sequent and parallel transition structure, especially deducing its equivalent equation will make a significant contribution to simplification of whole SPN. The authors discuss sequent and parallel transition model and simplification theory, deduce their performance equivalent equations, give an example of simplification of SPN model, and finally analyze the conclusion.
Stochastic Petri Net (SPN) are a powerful modeling and analyzing tool for system performance evaluation. But the problem of state space explosion of SPN limits its ability to analyze complex and large-scale systems. So it is more feasible to simplify SPN model on the basis of performance equivalence before analyzing it. The authors define a class of SPN-Elementary SPN (ESPN) which is composed of four elementary subnets including sequence subnet, parallel subnet, choice subnet and iteration subnet, and propose a group of performance equivalence formulas for the four elementary subnets, as well as a method of performance equivalence simplification and analysis for ESPN with linear time complexity. In addition, two transforming rules are put forward to transform non-elementary subnets into combined elementary subnets such that the proposed algorithm can be used in analysis of more general SPN.
In this paper, we address the emergency response decision-making process based on stochastic Petri net from an e-service perspective. The emergency response decision-making process is modeled and designed considering service management. The process is modeled based on stochastic Petri net and a solution methodology is proposed to solve the model. In addition, an isomorphic Markov Chain model and a service performance model are developed for measuring and evaluating the service performance of emergency response decision-making process. Finally, a case study is presented to show the viability of our method.
We address the problem of finite state machine (FSM) traversal, a key step in most sequential verification and synthesis algorithms. We propose the use of partitioned ROBDDs to reduce the memory explosion problem associated with symbolic state space exploration techniques. In our technique, the reachable state set is represented as a partitioned ROBDD (A. Narayan et al., 1996). Different partitions of the Boolean space are allowed to have different variable orderings and only one partition needs to be in memory at any given time. We show the effectiveness of our approach on a set of ISCAS89 benchmark circuits. Our techniques result in a significant reduction in total memory utilization. For a given memory limit, partitioned ROBDD based method can complete traversal for many circuits for which monolithic ROBDDs fail. For circuits where both partitioned ROBDDs as well as monolithic ROBDDs cannot complete traversal, partitioned ROBDDs can reach a significantly larger set of states
Symbolic Techniques have undergone major improvements but extending their applicability to new fields is still a key issue. A great limitation on standard Symbolic Traversals is represented by Finite State Machines with a very high sequential depth. A typical example of this behaviour are counters. On the other hand systems containing counters, e.g. embedded systems, are of great practical importance in several fields. Iterative squaring can produce solutions with a logarithmic execution time with respect to the sequential depth but a few drawbacks usually limit its application. We successfully tailored iterative squaring to allow its application for symbolic verification and synthesis of circuits containing counters. Experiments on large and complex home-made and industrials circuits containing counters show the feasibility of the approach
We present a new representation for Boolean functions called Partitioned ROBDDs. In this representation we divide the Boolean space into `k' partitions and represent a function over each partition as a separate ROBDD. We show that partitioned-ROBDDs are canonical and can be efficiently manipulated. Further they can be exponentially more compact than monolithic ROBDDs and even free BDDs. Moreover, at any given time, only one partition needs to be manipulated which further increases the space efficiency. In addition to showing the utility of partitioned-ROBDDs on special classes of functions, we provide automatic techniques for their construction. We show that for large circuits our techniques are more efficient in space as well as time over monolithic ROBDDs. Using these techniques, some complex industrial circuits could be verified for the first time
BDD-based symbolic traversals are the state-of-the-art technique for reachability analysis of finite state machines. They are currently limited to medium-small circuits for two reasons: peak BDD size during image computation and BDD explosion for representing state sets. Starting from these limits, this paper presents can optimized traversal technique particularly oriented to the exact exploration of the state space of large machines. This is possible thanks to: temporary simplification of a finite state machine by removing some of its state elements; and a “divide-and-conquer” approach based on state set decomposition. An effective use of secondary memory allows us to store relevant portions of BDDs and to regularize access to memory, resulting in less page faults. Experimental results show that this approach is particularly effective on the larger ISCAS'89 and ISCAS'89-addendum'93 circuits
In this paper we present a new data structure for representing Boolean functions and an associated set of manipulation algorithms. Functions are represented by directed, acyclic graphs in a manner similar to the representations introduced by Lee [1] and Akers [2], but with further restrictions on the ordering of decision variables in the graph. Although a function requires, in the worst case, a graph of size exponential in the number of arguments, many of the functions encountered in typical applications have a more reasonable representation. Our algorithms have time complexity proportional to the sizes of the graphs being operated on, and hence are quite efficient as long as the graphs do not grow too large. We present experimental results from applying these algorithms to problems in logic design verification that demonstrate the practicality of our approach.
Ordered Binary-Decision Diagrams (OBDDs) represent Boolean functions as directed acyclic graphs. They form a canonical representation, making testing of functional properties such as satisfiability and equivalence straightforward. A number of operations on Boolean functions can be implemented as graph algorithms on OBDD data structures. Using OBDDs, a wide variety of problems can be solved through symbolic analysis. First, the possible variations in system parameters and operating conditions are encoded with Boolean variables. Then the system is evaluated for all variations by a sequence of OBDD operations. Researchers have thus solved a number of problems in digital-system design, finite-state system analysis, artificial intelligence, and mathematical logic. This paper describes the OBDD data structure and surveys a number of applications that have been solved by OBDD-based symbolic analysis.
Extending the applicability of reachability analysis to large and real circuits is a key issue. In fact they are still limited for the following reasons: peak BDD size during image computation, BDD explosion for representing state sets and very high sequential depth. Following the promising trend of partitioning and problem decomposition, we present a new approach based on a disjunctive partitionedtransition relation and on an improved iterative squaring. In this approach a Finite State Machine is decomposed and traversed one "functioning--mode" at a time by means of the "disjunctive" partitioned approach. The overall algorithm aims at lowering the intermediate peak BDD size pushing further reachability analysis. Experiments on a few industrial circuits containing counters and on some large benchmarks show the feasibility of the approach. 1 Introduction State-of-the-art approaches for state space exploration of Finite State Machines (FSMs) exploit symbolic techniques based on Binar...
A data structure is presented for representing Boolean functions and an associated set of manipulation algorithms. Functions are represented by directed, acyclic graphs in a manner similar to the representations introduced by C. Y. Lee (1959) and S. B. Akers (1978), but with further restrictions on the ordering of decision variables in the graph. Although, in the worst case, a function requires a graph where the number of vertices grows exponentially with the number of arguments, many of the functions encountered in typical applications have a more reasonable representation. The algorithms have time complexity proportional to the sizes of the graphs being operated on, and hence are quite efficient as long as the graphs do not grow too large. Experimental results are presented from applying these algorithms to problems in logic design verification that demonstrate the practicality of the approach.
Symbolic traversals are state-of-the-art techniques for proving the input/output equivalence of finite state machines. Due to state space explosion, they are currently limited to medium-small circuits. Starting from the limits of standard techniques, this paper presents a mix of approximate forward and exact backward traversals that results in an exact exploration of the state space of large machines. This is possible, thanks to efficient pruning that restricts the search space during backward traversal using the information coming from the approximate forward traversal step. Experimental results confirm that we are able to explore for the first time some of the larger ISCAS'89 and MCNC circuits, that have been until now outside the scope of exact symbolic techniques. We are also able to generate the test patterns for or to tag as undetectable stuck-at faults with few exceptions.
We present a fast method for computing the observable equivalence relation of a jinite Mealy machine, which is required for many simplification techniques. Experimentations made for a large class of circuits h show a significant gain in time by a factor ranging from 1.5 to 12) and memory y a factor ranging from 1.5 to .9). We use the Binary Decision Diagrams to represent and to manipulate the machine, and the symbolic traversal of the machine for performing the computation. Commonly presented algorithms using this technique are based upon the computation of the inverse image of a set of equivalent states pairs by a boolean functional vector, which is a very expensive operation in time and memory. Our new method drastically minimizes the cost of the inverse image computation for computing these pairs. It consists in rewriting successively the machine for the k-equivalence relations.
Many different methods have been devised for automatically verifying finite state systems by examining state-graph models of system behavior. These methods all depend on decision procedures that explicitly represent the state space using a list or a table that grows in proportion to the number of states. We describe a general method that represents the state space symbolically instead of explicitly. The generality of our method comes from using a dialect of the Mu-Calculus as the primary specification language. We describe a model checking algorithm for Mu-Calculus formulas that uses Bryant's Binary Decision Diagrams (1986) to represent relations and formulas. We then show how our new Mu-Calculus model checking algorithm can be used to derive efficient decision procedures for CTL model checking, satisfiability of linear-time temporal logic formulas, strong and weak observational equivalence of finite transition systems, and language containment for finite !-automata.
A theory of sequential hardware equivalence [1] is presented, including the notions of gate-level model (GLM), hardware finite state machine (HFSM), state equivalence (∼), alignability, resetability, and sequential hardware equivalence (≈). This theory is motivated by (1) the observation that it is impossible to control the initial state of a machine when it is powered on, and (2) the desire to decide equivalence of two designs based solely on their netlists and logic device models, without knowledge of intended initial states or intended environments.
Binary decision diagrams are used to represent predicates about pairs of harware designs. Algorithms are given for computing pairs of equivalent states and sequential hardware equivalence as implemented in the MCC CAD Sequential Equivalence Tool (SET).
Symbolic model checking is an increasingly popular debugging tool based on Binary Decision Diagrams (BDDs). The size of the
diagrams, however, often prevents its application to large designs. The lack of flexibility of the conventional breadth-first
approach to state search is often responsible for the excessive growth of the BDDs. In this paper we show that the use of
hints to guide the exploration of the state space may result in orders-of-magnitude reductions in time and space requirements.
We apply hints to invariant checking. The hints address the problems posed by difficult image computations, and are effective in both proving and refuting invariants.
We show that good hints can often be found with the help of simple heuristics by someone who understands the circuit well
enough to devise simulation stimuli or verification properties for it. We present an algorithm for guided traversal and discuss
its efficient implementation.
This paper describes techniques for the formal verification of sequential circuits, based on a rigcwous theoretical background, that can be used to claisify a single stuck-at fault in a synchronous sequential circuit as redundant or non-redundant, and to identify a non-redundant stuck-at fault as testable or untestable. The treatment of the synchronous sequential circuits is the most general possible, since the techniques do not require the existence of a reset state. Our programs can be used to successfully complement the use of traditional test generation techniques. Using the methods presented in this paper, we have been able to classify as redundant or non-redundant faults in the ISCAS-89 sequential circuits, that were either aborted or classafied as untestable by test generation programs. We were also able to classify the non-redundant faults as untestable or testable.
Binary decision diagrams (BDD's) are a state-of-the-art core
technique for the symbolic representation and manipulation of Boolean
functions, relations and finite sets. Many computer-aided design (CAD)
applications resort to them, but size and time efficiency restrict their
applicability to medium-small designs. We concentrate on complex
operators used in symbolic manipulation. We analyze and optimize their
performance by means of new dynamic partitioning strategies. We propose
a novel quick algorithm for the estimation of cofactor size, and a
technique to choose splitting variables according to their
discrimination power, so that their cofactors may be optimized by
different variable orderings (tending to the more flexible FBDDs).
Furthermore, we analyze time efficiency and the impact of
hashing/caching on BDD-based operators. We finally include an
experimental observation of memory usage and running time for operators
applied in symbolic manipulation
Techniques for the computation of fixpoints are key to the success
of many formal verification algorithms. To be efficient, these
techniques must take into account how sets of states are represented.
When BDDs are used, this means controlling, directly or indirectly, the
size of the BDDs. Traditional fixpoint computations do little to keep
BDD sizes small, apart from reordering variables. In this paper, we
present a new strategy that attempts to keep the size of the BDDs under
control at every stage of the computation. Our contribution includes
also new techniques to compute partial images, and to speed up and test
convergence. We present experimental results that prove the
effectiveness of our strategy by demonstrating up to 40 orders of
magnitude improvement in the number of states computed
The ordered binary decision diagram (OBDD) has proven useful in many applications as an efficient data structure for representing and manipulating Boolean functions. A serious drawback of OBDD's is the need for application-specific heuristic algorithms to order the variables before processing. Further, for many problem instances in logic synthesis, the heuristic ordering algorithms which have been proposed are insufficient to allow OBDD operations to complete within a limited amount of memory. The paper proposes a solution to these problems based on having the OBDD package itself determine and maintain the variable order. This is done by periodically applying a minimization algorithm to reorder the variables of the OBDD to reduce its size. A new OBDD minimization algorithm, called the sifting algorithm, is proposed and appears especially effective in reducing the size of the OBDD. Experiments with dynamic variable ordering on the problem of forming the OBDD's for the primary outputs of a combinational circuit show that many computations complete using dynamic variable ordering when the same computation fails otherwise
We address the problem of reachability analysis for large finite state systems. Symbolic techniques have revolutionized reachability analysis but still have limitations in traversing large systems. We present techniques to improve the symbolic breadth-first traversal and compute a lower bound on the reachable states. We identify the problem as one of density during traversal and our techniques seek to improve the same. Our results show a marked improvement on the existing breadth-first traversal methods
Most symbolic state space exploration techniques for finite state
machines (FSMs) are exact and based on forward traversal, but limited to
medium-size circuits. Approximate forward traversal deals with bigger
circuits at the expense of exactness. Backward traversal focuses the
search process on the property under scrutiny, but it also takes into
account many unreachable states. For this reason, it works mainly on
small circuits. This paper presents novel techniques that make exact
symbolic backward traversal feasible also for large circuits. The key
point is an efficient pruning of the search space, exploiting
information coming from an approximate forward reachability analysis.
Experimental evidence shows that, for the first time, the larger
ISCAS'89 and MCNC circuits are symbolically manipulated in an exact way
and the test patterns for them are generated
A synchronization sequence for a synchronous design D is a sequence of primary input vectors which when applied to any initial state of D will drive D to a single state, called a reset state. The authors present efficient methods based upon the universal alignment theorem and binary decision diagrams to compute a synchronization sequence, to compute a tight lower bound for the length of such a sequence, and to check that an initial state given in the specification is a reset state. It was shown in the experiments that the proposed method can handle fairly large circuits and the length of the actual synchronization sequence computed is quite close to the lower bound
A novel representation called an equivalence class
characterization function is defined. It can implicitly represent all
equivalence classes with a compact characteristic function that will
have at most n outputs. Using binary decision diagrams (BDDs)
and the concept of the equivalence class characterization function, very
large problem instances can be represented. For manipulating equivalence
classes efficiently, a Boolean operator called a compatible projection
operator is proposed. Conceptually, the compatible projection operator
is used to uniquely select a single element from each equivalence class
to characterize the class. In manipulating equivalence classes, the
compatible projection operator is used to implicitly derive an encoding
function from the equivalence relation that encodes the equivalence
class information symbolically. An efficient implementation is described
based on BDDs that is applied to very large problem instances
A synchronous sequential design is resettable if there is a finite
sequence of primary input vectors (called a reset or synchronizing
sequence) and a single state (called a reset state) such that
application of the reset sequence to any initial state of the design
drives the design into the reset state. New, efficient algorithms are
presented to decide if a design is essentially and actually resettable,
to find essential and actual reset sequences, to find the set of
essential reset states and an actual reset state, and to check that an
alleged essential or actual reset sequence essentially or actually
resets a design. These algorithms are based on the results of a theory
of design equivalence presented by C. Pixley (1990), and C. Pixley and
G. Beihl (1991). The algorithms are implemented in the MCC CAD
Sequential Equivalence Tool and future optimizations among
well-established lines promise greater speed and applicability to much
larger designs
The authors address the problem of computing sequential don't
cares that arise in the context of multi-level sequential networks and
their use in sequential logic synthesis. The key to their approach is
the use of binary decision diagram (BDD)-based implicit state space
enumeration techniques and multi-level combinational simplification
procedures. Using the algorithms described, exact sequential don't care
sets for circuits with over 10<sup>68</sup> states have been
successfully computed
The authors propose a novel method based on transition relations
that only requires the ability to compute the BDD (binary decision
diagram) for f <sub>i</sub> and outperforms O. Coudert's (1990)
algorithm for most examples. The method offers a simple notational
framework to express the basic operations used in BDD-based state
enumeration algorithms in a unified way and a set of techniques that can
speed up range computation dramatically, including a variable ordering
heuristic and a method based on transition relations
The temporal logic model checking algorithm of Clarke, Emerson,
and Sistla (1986) is modified to represent state graphs using binary
decision diagrams (BDD's) and partitioned transition relations. Because
this representation captures some of the regularity in the state space
of circuits with data path logic, we are able to verify circuits with an
extremely large number of states. We demonstrate this new technique on a
synchronous pipelined design with approximately 5×10<sup>120</sup>
states. Our model checking algorithm handles full CTL with fairness
constraints. Consequently, we are able to express a number of important
liveness and fairness properties, which would otherwise not be
expressible in CTL. We give empirical results on the performance of the
algorithm applied to both synchronous and asynchronous circuits with
data path logic
Finite state machine (FSM) verification based on implicit state
enumeration can be extended to test generation and redundancy
identification. The extended method constructs the product machine of
two FSMs to be compared, and reachability analysis is performed by
traversing the product machine to find any difference in I/O behavior.
When an output difference is detected, the information obtained by
reachability analysis is used to generate a test sequence. This method
is complete, and it generates one of the shortest possible test
sequences for a given fault. However, applying this method
indiscriminately for all faults may result in unnecessary waste of
computer resources. An efficient method based on reachability analysis
of the fault-free machine (three-phase ATPG) in addition to the powerful
but more resource-demanding product machine traversal is presented. The
application of these algorithms to the problems of generating test
sequences, identifying redundancies, and removing redundancies is
reported
ion, and Compositional Verification David E. Long July 1993 Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy Thesis Committee: Edmund M. Clarke, Chair Randal E. Bryant Stephen D. Brookes Orna Grumberg, The Technion c fl 1993, David E. Long This research was sponsored in part by the Avionics Laboratory, Wright Research and Development Center, Aeronautical Systems Division (AFSC), U.S. Air Force, Wright-Patterson AFB, Ohio 45433-6543 under Contract F33615-90-C-1465, ARPA Order No. 7597, and in part by the National Science Foundation under Grant no. CCR-9005992, and in part by a National Science Foundation Graduate Fellowship, and in part by the Semiconductor Research Corporation under Contract 92-DJ-294. The views and conclusions contained in this document are those of the author and should not be interpreted as representing the official policies, either expressed or implied, of the National Science Foundation, the Semiconductor Research Corpo...
Efficient techniques for the manipulation of Binary Decision Diagrams (BDDs) are key to the success of formal verification tools. Recent advances in reachability analysis and model checking algorithms have emphasized the need for efficient algorithms for the approximation and decomposition of BDDs. In this paper we present a new algorithm for approximation and analyze its performance in comparison with existing techniques. We also introduce a new decomposition algorithm that produces balanced partitions. The effectiveness of our contributions is demonstrated by improved results in reachability analysis for some hard problem instances. 1 Introduction Symbolic state enumeration techniques based on Binary Decision Diagrams (BDDs [2]) have revolutionized formal verification [8, 4, 17, 1, 14]. They have two key features that make them suitable to the exploration of very large state graphs: They represent sets compactly, and they avoid explicit enumeration in image computation. Given the t...
We develop techniques for eciently searching the state space of control dominated hardware designs. Heuristics are used to guide the search to uncovered portions of the state space; mechanisms employed include adaptive random simulation, directed search, BDD subsetting, and interspersing symbolic methods with simulation. We dene a coverage metric based on a guarded command language; experiments demonstrate that our algorithms results in more coverage than conventional verication strategies, at a reduced computational eort. 1 Introduction In this paper we are concerned with the problem of design verication; specically, the problem of invariant checking over gate-level designs. Traditionally, designs have been veried by extensive simulation. A model is built (in software or hardware), and monitors may be added to check for bad behavior. Large numbers of test inputs are applied to this model; these tests are generated by (possibly biased) random test pattern generators, or by hand...
Ecient coverage directed state space search, in: IWLS'98: IEEE International Workshop on Logic Synthesis
- M Ganai
- A Aziz
M. Ganai, A. Aziz, Ecient coverage directed state space search, in: IWLS'98: IEEE International Workshop on Logic Synthesis, Lake Tahoe, CA, June 1998.
Sangiov-anni-Vincentelli, Implicit enumeration of ®nite state ma-chines using BDDs
- H Touati
- H Savoj
- B Lin
- R K Brayton
H. Touati, H. Savoj, B. Lin, R.K. Brayton, A. Sangiov-anni-Vincentelli, Implicit enumeration of ®nite state ma-chines using BDDs, in: Proceedings of IEEE ICCAD'90, San Jose, CA, November 1990, pp. 130±133.
Hints to accelerate symbolic traversal, in: Correct Hardware Design and Veri®cation Methods (CHARME'99)
- K Ravi
- F Somenzi
K. Ravi, F. Somenzi, Hints to accelerate symbolic traversal, in: Correct Hardware Design and Veri®cation Methods (CHARME'99), Berlin, September 1999, in: Lecture Notes in Computer Science, vol. 1703, Springer, Berlin, pp. 250±264.
Approximate ®nite state machine traversal: extensions and new results, in: IWLS'95: IEEE Interna-tional Workshop on Logic Synthesis
- H Cho
- G D Hatchel
- E Macii
- M Poncino
- K Ravi
- F Somenzi
H. Cho, G.D. Hatchel, E. Macii, M. Poncino, K. Ravi, F. Somenzi, Approximate ®nite state machine traversal: extensions and new results, in: IWLS'95: IEEE Interna-tional Workshop on Logic Synthesis, Lake Tahoe, CA, May 1995.
Improving the efficiency of BDD-based operators by means of partitioning
- Cabodi