Increasing the Robustness of Bounded Model Checking by Computing Lower Bounds on the Reachable States

Many formal verification tools today are based on Boolean proof techniques. The two most powerful approaches in this context are binary decision diagrams (BDDs) and methods based on Boolean satisfiability (SAT). Recent studies have shown that BDDs and SAT are orthogonal, i.e. there exist problems where BDDs work well, while SAT solvers fail and vice versa. Beside this, the techniques are very different in general. E.g. SAT solvers try to find a single solution and BDDs represent all solutions in parallel. In this paper the first integrated approach is presented that combines BDDs and SAT within a single data structure. This hybrid approach combines the advantages of the two techniques, i.e. multiple solutions can be computed while the memory requirement remains small. First experimental results demonstrate the quality of the approach in comparison to BDDs and SAT solvers.

The rapid growth in hardware complexity has lead to a need for formal verification of hardware designs to prevent bugs from entering the final silicon. Model-checking [3] is by far the most popular technique for automatically verifying properties of designs. In model-checking, a model of a design is exhaustively checked against a property, often specified in some temporal logic. Today, all major hardware companies use model-checkers in order to reduce the number of bugs in their designs. Most model-checking techniques are state-based. This means that some kind of representation of all reachable states of the design is used when checking that the temporal properties are fulfilled. One popular way of representing the set of reachable states of a design is by using Binary Decision Diagrams (BDDs) [2]. A BDD is a canonical way of representing a boolean formula over a fixed set of variables. When the set of reachable states of a design can be calculated using BDDs, state-based model-checking techniques work very well. However, for some types of designs, it is very hard to represent all reachable states by BDDs; they grow exponentially in size and lead to a BDD blow-up.

Using binary decision diagrams for representation and analysis of communication protocols

A novel technique for obtaining lower bounds for the time versus space complexity of certain functions in a general input oblivious sequential model of computation is developed. This is demonstrated by studying the intrinsic complexity of the following set equality problem SE(n,m): Given a sequence x1,x2,....,xn, y1,....,yn of 2n numbers of m bits each, decide whether the sets [x1,....,xn] and [y1,...,yn] coincide. We show that for any log log n ≤ m ≤1/2log n and any 1 ≤ s ≤ log n, any input oblivious sequential computation that solves SE(n,m) using 2m/s space, takes Ω(n ? s) time. This result is sharp for all admissible values of n,m,s and is the first known nontrivial time space tradeoff lower bound (for space = ω (log n) of a set recognition problem on such a general model of computation. Our method also supplies lower bounds on the length of arbitrary (not necessarily input oblivious) branching programs for several natural symmetric functions, improving results of Chandra, Furst and Lipton, of Pudlák and of Ajtai et. al. For example we show that for the majority - function any branching program of width w(n) has length ω(n · log w/n (n) · log w (n)), in particular for bounded width we get length ω (n log n) (independently of our work Babai et. al. [BPRS] have simultaneously proved this last result). Our lower bounds for branching programs imply lower bounds on the number of steps that are needed to pebble arbitrary computation graphs for the same computational problems. To establish our lower bounds we introduce the new concept of a meander that captures superconcentrator-type properties of sequences. We prove lower bounds on the length of meanders via a new Ramsey theoretic lemma that is of interest in its own right. This lemma has other applications, including a tight lower bound on the size of weak superconcentrators of depth 2 that strengthens the known lower bound of Pippenger [Pi]. A surprising new feature of these applications of Ramsey theory in lower bound arguments is the fact that no numbers are required to be unusually large and that several of the resulting superlinear lower bounds are in fact optimal.

Although model checking has proven remarkably effective in detecting errors in hardware designs, its success in the analysis of software specifications has been limited. Model checking algorithms for hardware verification commonly use Binary Decision Diagrams (BDDs) to represent predicates involving the many Boolean variables commonly found in hardware descriptions. Unfortunately, BDD representations may be less effective for analyzing software specifications, which usually contain not only Booleans but variables spanning a wide range of data types. Further, software specifications typically have huge, sometimes infinite, state spaces that cannot be model checked directly using conventional symbolic methods. One promising but largely unexplored approach to model checking software specifications is to apply mathematically sound abstraction methods. Such methods extract a reduced model from the specification, thus making model checking feasible. Currently, users of model checkers routinely analyze reduced models but often generate the models in ad hoc ways. As a result, the reduced models may be incorrect. This paper, an expanded version of (Bharadwaj and Heitmeyer, 1997), describes how one can model check a complete requirements specification expressed in the SCR (Software Cost Reduction) tabular notation. Unlike previous approaches which applied model checking to mode transition tables with Boolean variables, we use model checking to analyze properties of a complete SCR specification with variables ranging over many data types. The paper also describes two sound and, under certain conditions, complete methods for producing abstractions from requirements specifications. These abstractions are derived from the specification and the property to be analyzed. Finally, the paper describes how SCR requirements specifications can be translated into the languages of Spin, an explicit state model checker, and SMV, a symbolic model checker, and presents the results of model checking two sample SCR specifications using our abstraction methods and the two model checkers.

We investigate Ordered Binary Decision Diagrams (OBDDs) — a model for computing Boolean functions. It is known that OBDD’s complexity can extremely depend on the order of reading variables. There are techniques for constructing functions that do not allow choosing the optimal order for reading the input, one of which we use in this paper. A function “Shuffled Inequality” NEQS is presented, for which a lower and an upper bounds for the complexity of nondeterministic OBDD are proved. The upper bound is an improvement of a previously known result. A quantum measure-many non-deterministic OBDD is constructed that is more efficient than the classical one. The hierarchy of complexity classes defined on the basis of OBDD models is clarified.

Ordered Binary Decision Diagrams (BDDs) are a data structure for efficient representation and manipulation of Boolean functions. They are frequently used in logic synthesis and formal verification. The size of BDDs depends on a chosen variable ordering, i.e. the size may vary from linear to exponential, and the problem of improving the variable ordering is known to be NP-complete. In this paper we present a new exact branch & bound technique for determining an optimal variable order. In contrast to all previous approaches, that only considered one lower bound, our method makes use of a combination of three bounds and by this avoids unnecessary computations. The lower bounds are derived by generalization of a lower bound known from VLSI design. They allow to build the BDD either top down or bottom up. Experimental results are given to show the efficiency of our approach.

Multiplier circuit covers a more extensive area of embedded system application in digital signal processing, cryptography, and multimedia. Nonstandard implementations and custom optimization are being done to reduce the size of multipliers. The circuit became prone to a buggy, and hence the demand for verification increased. Formal verification methods, such as satisfiability (SAT), symbolic computer algebra (SCA), and binary decision diagrams (BDDs) have made massive progress over the last few decades. However, these methods are insufficient to verify the optimized multipliers. SAT-based equivalence checking is computationally expensive. SCA-based backward rewriting is limited to algebraic-friendly multipliers. The complexity of BDDs is exponential with the input size. Although, by allowing an additional variable method, the size of the BDD is limited to 4th degree polynomial of the number of the inputs, this method is not explored to verify optimized multipliers. This article focus on verifying integer multipliers with diverse architectures. We propose an algorithm for the direct construction of BDDs without traversing circuits and generate BDDs up to 1024 bits. We utilize the additional variable method and constructing BDDs using high-to-low variable ordering. We reduce the complexity of BDD size to a 3rd degree polynomial. We generate BDDs and verify the multipliers with various architectures up to 64 bits. We propose a method to verify optimized multipliers by checking equivalence and verifying up to 32-bits optimized multipliers. We do the error tolerance analysis of our approach by inserting bugs in a circuit at various locations.

Chapter 2 Satisfiability Solvers

Decision diagrams, such as binary decision diagrams, multi-terminal binary decision diagrams and multi-valued decision diagrams, play an important role in various fields. They are especially useful to represent the characteristic function of sets of states and transitions in symbolic model checking. Most implementations of decision diagrams do not parallelize the decision diagram operations. As performance gains in the current era now mostly come from parallel processing, an ongoing challenge is to develop datastructures and algorithms for modern multi-core architectures. The decision diagram package Sylvan provides a contribution by implementing parallelized decision diagram operations and thus allowing sequential algorithms that use decision diagrams to exploit the power of multi-core machines. This paper discusses the design and implementation of Sylvan, especially an improvement to the lock-free unique table that uses bit arrays, the concurrent operation cache and the implementation of parallel garbage collection. We extend Sylvan with multi-terminal binary decision diagrams for integers, real numbers and rational numbers. This extension also allows for custom MTBDD leaves and operations and we provide an example implementation of GMP rational numbers. Furthermore, we show how the provided framework can be integrated in existing tools to provide out-of-the-box parallel BDD algorithms, as well as support for the parallelization of higher-level algorithms. As a case study, we parallelize on-the-fly symbolic reachability in the model checking toolset LTSmin. We experimentally demonstrate that the parallelization of symbolic model checking for explicit-state modeling languages, as supported by LTSmin, scales well. We also show that improvements in the design of the unique table result in faster execution of on-the-fly symbolic reachability.

Model checking is the process of verifying whether a model of a concurrent system satisfies a specified temporal property. Symbolic algorithms based on Binary Decision Diagrams (BDDs) have significantly increased the size of the models that can be verified. The main problem in symbolic model checking is the image computation problem, i.e., efficiently computing the successors or predecessors of a set of states. This paper is an in-depth study of the image computation problem. We analyze and evaluate several newheuristics, metrics, and algorithms for this problem. The algorithms use combinatorial optimization techniques such as hill climbing, simulated annealing, and ordering by recursive partitioning to obtain better results than was previously the case. Theoretical analysis and systematic experimentation are used to evaluate the algorithms.

The single‐electron transistor (SET) is considered as a promising alternative to CMOS devices and integrated circuits due to its ultra‐low‐power consumption. The authors propose an automatic methodology by utilising SET‐based multiway decision graph (MDG) for implementing SET architecture. MDG provides a powerful means of abstraction and can be used to manipulate a certain type of first‐order logic formula called directed formula (DF). An automatic tool has been developed that is capable of transferring the SET array into MDG DF to generate all paths of all possible reachable states, drawing an abstract diamond‐shaped network for the SET array, producing a reduced DF generated by the MDG tool and converting the reduced DF into a conjunctive normal form formula. Then, the authors use the satisfiability approach as a verification engine to verify the correctness of these conversions. The method is tested and verified using MCNC benchmarks. The results outperform approaches based on binary decision diagrams in terms of verification time, number of clauses and variables.

Multiway Decision Graph (MDG) is a canonical representation of a subset of many-sorted first-order logic. It generalizes the logic of equality with abstract types and uninterpreted function symbols. The area of Satisfiability (SAT) ha s been the subject of intensive research in recent years, with significant theoretical and practical contributions. From a practical perspective, a large number of very effective SAT solvers have recently been proposed, most of which based on improvements made to the original Davis-Putnam algorithm. Local search algorithms have allowed solving extremely large satisfiable instances of SAT. The combination between various verification methodologies will enhance the capabilities of each and overcome their limitations. In this paper, we introduce a model checking methodology for MDG based models using MDG tool and SAT solver. We use SAT solver searching for feasible paths of reachable states satisfying the property under certain encoding constraints. Finally, we provide a case study showing the correctness and the efficiency of our approach.

Boolean Satisfiability (SAT), the first problem proven to be NP-complete, is intractable on digital computers based on the von Neumann architecture. An efficient SAT solver can benefit many applications such as artificial intelligence, circuit design, and functional verification. Recently, a SAT solver approach based on a deterministic, continuous-time dynamical system (CTDS) was introduced [1]. This approach shows polynomial analog time-complexity on even the hardest k-SAT (k ≥ 3) problem instances, but at an energy cost dependent on exponentially growing auxiliary variables. This paper reports a novel analog hardware SAT solver, AC-SAT, implementing the CTDS via incorporating novel, analog circuit design ideas. AC-SAT is intended to be used as a co-processor and is programmable for handling different problem specifications. Furthermore, with its modular design, AC-SAT can be readily extended to solve larger size problems. SPICE simulation results show that AC-SAT can indeed solve the SAT problems, and it has speedup factors of ~10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">4</sup> on even the hardest 3-SAT problems, when compared with a state-of-the-art SAT solver on digital computers.

Functional dependency is concerned with rewriting a Boolean function f as a function h over a set of base functions {g <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> , ..., g <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> ), i.e. f = h(g <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> , ..., g <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> ). It plays an important role in many aspects of electronic design automation (EDA), ranging from logic synthesis to formal verification. Prior approaches to the exploration of functional dependency are based on binary decision diagrams (BDDs), which may not be easily scalable to large designs. This paper proposes a novel reformulation that extensively exploits the capability of modern satisfiability (SAT) solvers. Thereby, functional dependency is detected effectively through incremental SAT solving, and the dependency function h, if it exists, is obtained through Craig interpolation. The main strengths of the proposed approach include: (1) fast detection of functional dependency with modest memory consumption and thus scalable to large designs, (2) a full capacity to handle a large set of base functions and thus discovering dependency whenever exists, and (3) potential application to large-scale logic optimization and verification reduction. Experimental results show the proposed method is far superior to prior work and scales well in dealing with the largest ISCAS89 and ITC99 benchmark circuits with up to 200 K gates.