Reasoning about GSTE Assertion Graphs

Abstract

Abstract. Generalized symbolic trajectory evaluation (GSTE) is a new modelchecking approach that combines the industrially-proven scalability and capacity of classical symbolic trajectory evaluation with the expressive power of temporallogic model checking. GSTE was originally developed at Intel and has been used successfully on Intel's next-generation microprocessors. However, the supporting theory and algorithms for GSTE are still immature. In particular, GSTE specifications are given as assertion graphs, a variety of ∀-automata, and although an efficient model-checking algorithm exists to verify whether a circuit model obeys a specification assertion graph, there is no work on reasoning about assertion graphs themselves. This paper presents new algorithms to leverage GSTE model checking to efficiently decide whether one assertion graph implies another, and to model check one assertion graph under the assumption that another is true (under regular GSTE acceptance conditions). These two operations -deciding whether one specification implies another and verifying under an assumption -are the fundamental building blocks of compositional verification and any higher-level reasoning about model-checking results, so the algorithms presented here are key steps to using GSTE in a broader verification framework. Preliminary experimental results applying our algorithms to real, industrial circuits and specifications show that our algorithms are useful in practice.

Efficient generation of monitor circuits for GSTE assertion graphs

“…Because the GSTE model-checking algorithm verifies a relationship between a circuit and a specification, the ability to convert specifications into monitor circuits creates the possibility of using GSTE to verify relationships involving multiple specifications (e.g., assume one assertion graph while verifying another). We have preliminary results along these lines, showing that the construction presented here is a valuable building block toward efficient compositional verification with GSTE [9].…”

“…We also envision the generated monitors connecting GSTE-based and monitor-based verification methodologies. In addition, our monitor construction is a building block for initial work on compositional verification with GSTE [9]. …”

GSTE is partitioned model checking

“…The fundamental relation between GSTE and SMC, however, has not been completely clarified. The basic relationship between AGs and BAs is sketched in (Hu et al, 2003), but the algorithmic relationship between GSTE and SMC has not been studied.…”

“…(We deal neither with abstraction nor with the state main.tex; 18/10/2005; 9:02; p.2 representation, which are orthogonal issues.) We first fill in the details not given in (Hu et al, 2003) to show that assertion graphs are essentially universal ω-automata (Manna and Pnueli, 1987), which require all runs to be accepting. Universal automata enjoy the advantage of easy complementation; in fact, they can be viewed as nondeterministic automata for the complementary property (this feature is attained in the COSPAN system by using deterministic automata (Hardin et al, 1996)).…”

Transition-by-transition FSM traversal for reachability analysis in bounded model checking

“…Here the property under verification is specified as assertion graph and is used for decomposing the problem [18], [19], [20], [21]. As highlighted in [19], the GSTE algorithm decomposes the set of states satisfying the property using the assertion graph.…”