A Logic for GSTE
Edward Smith
University of Oxford
Generalized Symbolic
Trajectory Evaluation (GSTE)
• Based on gate-level simulation
• Ternary simulation over {0,1,X}
• Symbolic simulation layer
• Fine control over abstraction
X
0
0
s
1
s
• Fixed-points allow unbounded properties
• Regular properties
Traditional Specification
• Using assertion graphs
Drive input A
Assert correct output
Drive input B
• Shape and labels drive model checking
– Affect efficiency and abstraction level
Verification Process
High-level
Specification
An example specification
For a simple GSTE
property that isn’t too hard to verify
I hope, but you never really know,
Hopefully not
Assertion
Graph
Manually Refine
or Decompose
GSTE
Fails
Circuit
GSTE
Succeeds
Verification Process
High-level
Specification
Rules difficult to express,
apply and justify
An example specification
For a simple GSTE
property that isn’t too hard to verify
I hope, but you never really know,
Hopefully not
Assertion
Graph
Manually Refine
or Decompose
GSTE
Fails
Circuit
GSTE
Succeeds
Generalized Trajectory Logic
• A clean specification notation based on temporal logic
f
kf k
bf c
• Trace-based semantics
• GSTE simulation state
• Symbolic set of words
• Upper-approximation
• What we check
• How we simulate
Circuit Model
• Kripke structure
K = (S; T )
traces(K) µ S +
• Nodes
n2N
f
Formulas
of
GTL
kf k
bf c
tt
S+
ff
;
XXX : : : X
?
n
f¾:s 2 S + j s(n)g
X1X : : : X
:n
f¾:s 2 S + j : s(n)g
X0X : : : X
f
g ^h
Formulas
of
GTL
kf k
bf c
kg k\kh k
bg c u bh c
X1X u 0XX = 01X
g _h
kg k[kh k
bg c t bh c
01X t 0XX = 0XX
f
Yg
Yesterday
kf k
f¾:s 2 S + j ¾ 2 k g kg
bf c
step(b g c )
• Allows compositional simulation
simulate g
g
forward
step
Yg
Symbolic Formulas
Q ! g jh
If Q then g else h
e.g. b u ! n j :n c = XuX : : :
f (u := Q)
f where u has value Q
e.g. b (u ! n j :n)(u := 1) c = X1X : : :
Fixed-points
• Mu-calculus style fixed-points capture iteration
ff ; g(ff) ; g(g(ff)) : : : ¹Z:g(Z)
where Y binds every Z in g
Fixed-points
• Mu-calculus style fixed-points capture iteration
ff ; g(ff) ; g(g(ff)) : : : ¹Z:g(Z)
where Y binds every Z in g
• E.g. ‘Previously f’ and ‘f Since g’
Pf
:= ¹Z:f _ YZ
f S g := ¹Z:g _ (f ^ YZ)
Vector Fixed-points
• Nested mu-expressions are messy in practice
• Fixed-points are unique
• Can therefore use systems of recursive equations:
ZERO = reset _ :reset ^ Y(ONE)
:reset ^ Y(ZERO)
ONE =
Shorthand
• Quantification
(9u : f )
:=
(f (u := T)) _ (f (u := F))
(8u : f )
:=
(f (u := T)) ^ (f (u := F))
• Calculated directly using BDD quantification
• Symbolic node value
(n is Q)
:=
(Q ! n j :n)
GTL Properties
A)C
when, for every trace t and in every symbolic valuation:
t 2 k A k implies t 2 k C k
e.g. Register correctness:
read ^ ((:wr) S (wr ^ (in is d))) ) out is d
Model Checking
b A c v b C c implies A ) C
Upper-approximation
simulation
Precise simulation, when C
does not contain disjunction or Y
Reasoning with GTL
• Simple rules for traced-based equivalence
f ^g =g ^f
n ^ :n = ff
Yf ^ Yg = Y(f ^ g)
g ^ ff = ff
¹Z:f (Z) = f (¹Z:f (Z))
• Rules do not imply simulation equivalence
b f c 6= b g c
• Property-preserving simulation transformations
Optimization Rules
• Simplification, e.g.
g ^ ff = ff
• Symbolic/explicit conversion
f(u := Q) = f[Q/u]
Example
n
n
0
1
f
f
1
s
f
1
1
n _ :n
=
n
9s:(s ! n j :n)
=
((s ! n j :n)(s := 1)) _ ((s ! n j :n)(s := 0))
Decomposition Rules
• Transitivity connects simulations
A)B B)C
A)C
A
B
C
• Monotonicity connects branching simulations
A1 ) C1 A2 ) C2
A2 [A1 =C1 ] ) C2
A1
C1
A2
C2
Abstraction Refinement
• ‘Less abstract than’ relation
• Only
_
and
Y
f - g
lose information
Y(f ^ g) - Yf ^ Yg
Information loss occurs
earlier in simulation
f (g) _ f (h) - f (g _ h)
a 1
a
b
a
a
b
b
1
b
b
b
Ya
1
Y(a ^ b)
b
b
a
b
a
a
1
a
a
a
b
1
a^b
b
a 1
1
1
Yb
Ya ^ Yb
• Affects which circuit segments are simulated independently
Conclusions
• GTL is a temporal logic for GSTE
• Textual form is easier to manage
• Fine granularity induces algebraic nature
• Logical rules express sound refinements
• Simple rules exist for decomposition/refinement
•Previously f
•f Since g
Pf
:= ¹Z:f _ YZ
f S g := ¹Z:f _ (g ^ YZ)
• Fixed-points are unique
• Can also use systems of equations, e.g.
ZERO = :reset _ Y(ONE)
ONE =
Y(ZERO)
Our Approach
Assertion
Graph:
Simulation
Steps:
[
Im
[
\
Im
\
µ
• Describe these atomic steps in a logical form
• Hope to gain reasoning rules