1 / 21

Enhancing and Integrating Model Checking Engines

Enhancing and Integrating Model Checking Engines. Robert Brayton Alan Mishchenko UC Berkeley. June 15, 2009. Overview. Sequential verification Integrated verification flow (“dprove”) Extended integrated verification flow (“dprove2”) Experimental results Ongoing and future work.

jamesengel
Download Presentation

Enhancing and Integrating Model Checking Engines

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Enhancing and Integrating Model Checking Engines Robert Brayton Alan Mishchenko UC Berkeley June 15, 2009

  2. Overview • Sequential verification • Integrated verification flow (“dprove”) • Extended integrated verification flow (“dprove2”) • Experimental results • Ongoing and future work

  3. Sequential Verification • Motivation • Verifying equivalence after synthesis (equivalence checking) • Checking specific sequential properties (model checking) • Design analysis and estimation • Our research philosophy • Developing scalable solutions aimed at industrial problems • Exploiting synergy between synthesis and verification • Experimenting with new research ideas • Producing public implementations

  4. Verification Problems and Solutions • Taxonomy of verification • Property and equivalence checking • Combinational and sequential verification • Satisfiable and unsatisfiable problems • Single-solver and multi-solver approach • Taxonomy of solvers/engines • Bug-hunters, provers, simplifiers, multi-purpose • Simulation, BDD-, AIG-, SAT-based, hybrid, etc • Fast/slow, weak/strong, etc

  5. Equivalence checking Property checking p 0 0 D2 D1 D1 Property / Equivalence Checking • Property checking • Takes design and property and makes a miter • Equivalence checking • Takes two designs and makes a miter • The goal is to prove that the output of the miter is always 0

  6. Verification Engines • Bug-hunters • random simulation • bounded model checking (BMC) • hybrids of the above two (“semi-formal”) • Provers • K-step induction, with or without uniqueness constraints • Interpolation (over-approximate reachability) • BDDs (exact reachability) • Transformers • Combinational synthesis • Retiming • Proving nodes sequentially equivalent • Abstraction • Speculative reduction

  7. Integrated Verification Flow • Preprocessing • Handling combinational problems • Starting with faster engines • Continuing with slower engines • Main induction loop • Last-gasp engines

  8. Command “dprove” Preprocessors • transforming initial state (“undc”, “zero”) • converting into an AIG (“strash”) • creating sequential miter (“miter -c”) • combinational equivalence checking (“iprove”) • bounded model checking (“bmc”) • sequential sweep (“scl”) • phase-abstraction (“phase”) • most forward retiming (“dret -f”) • partitioned register correspondence (“lcorr”) • min-register retiming (“dretime”) • combinational SAT sweeping (“fraig”) • for ( K = 1; K  16; K = K * 2 ) • signal correspondence (“scorr”) • stronger AIG rewriting (“dc2”) • min-register retiming (“dretime”) • sequential AIG simulation • interpolation (“int”) • BDD-based reachability (“reach”) • saving reduced hard miter (“write_aiger”) Combinational solver Faster engines Slower engines Main induction loop Last-gasp engines

  9. Extension 1: Abstraction • Counter-example guided abstraction-refinement • Start • First abstraction - replace all registers by primary inputs • Prove • If the number of remaining registers exceeds K% (default, K=90), return UNDECIDED • Try BMC limited to C conflicts • If unsat after C conflicts, return current abstracted model • If SAT, get counter-example, go to Refinement • Refinement • Use the counter-example to find what registers should be added • Add the registers • Go to Prove

  10. Extension 2: Speculative Reduction • Compute candidate equivalences • Perform reduction by transferring fanout • Record equality constraints as primary outputs • Try BMC with C conflicts • If UNSAT, return speculatively reduced model • If SAT, remove erroneous equivalences and outputs, repeat speculation • Advantages • Restructure the circuit • If can prove UNSAT of speculatively reduced model, then property is proved • Can use any other engines to try to prove 0 0 A A B B Adding assumptions with speculative reduction Adding assumptions without speculative reduction

  11. Command “dprove2” • Initial BMC • If counter-example, return SAT • “dprove” (result is stored in Save1) • If UNSAT, return UNSAT • If SAT, return SAT • If UNDECIDED, restore Save1 • Abstraction • If fails, restore Save1, to go Speculation • Trim PIs/POs • “dprove” (result is stored in Save2) • If UNSAT, return UNSAT • If SAT, restore Save1 // here our abstract model was not good • If UNDECIDED, restore Save2 • Speculation • If Speculation is already tried, go to Final BMC • Else compute and refine equiv classes, perform speculation • Trim PIs/POs • Signal correspondence, combinational synthesis, interpolation, reachability • If UNSAT, return UNSAT • If SAT, to go Final BMC • If UNDECIDED, go to Abstraction // we might get some abstraction now • Final BMC • Restore Save1, set the highest resource limit

  12. Example of dprove2 abc 01> r pdtvisns3p00.aig (unsolved by anyone in HWMCC’08 competition) abc 02> dprove2 Starting BMC... pdtvisns3p00 : pi = 21 po = 1 lat = 117 and = 3985 lev = 56 No output was asserted in 10 frames. Time = 5.45 sec - conflict limit (10000). Starting "dprove"... BDDs blew up during image computation. Time = 0.55 sec Networks are UNDECIDED. Time = 7.88 sec Problem size after dprove: pdtvisns3p00 : pi = 21 po = 1 lat = 88 and = 811 lev = 16 Abstraction... Init : pdtvisns3p00 : pi = 108 po = 1 and = 7 lev = 4 Refining abstraction... Output 0 was asserted in frame 0 (use "write_counter" to dump a witness). Time = 0.02 sec 0 : pdtvisns3p00 : pi = 103 po = 1 lat = 5 and = 122 lev = 11 Output 0 was asserted in frame 2 (use "write_counter" to dump a witness). Time = 0.02 sec 1 : pdtvisns3p00 : pi = 88 po = 1 lat = 21 and = 535 lev = 16 Output 0 was asserted in frame 3 (use "write_counter" to dump a witness). Time = 0.02 sec … Output 0 was asserted in frame 4 (use "write_counter" to dump a witness). Time = 0.02 sec 8 : pdtvisns3p00 : pi = 50 po = 1 lat = 59 and = 719 lev = 16 Output 0 was asserted in frame 7 (use "write_counter" to dump a witness). Time = 0.06 sec 9 : pdtvisns3p00 : pi = 35 po = 1 lat = 74 and = 761 lev = 16 No output asserted in 11 frames. Time = 7.67 sec - conflict limit (25000).

  13. dprove2 example - continued "dprove" pdtvisns3p00 : pi = 35 po = 1 lat = 74 and = 761 lev = 16 BDDs blew up during image computation. Time = 0.47 sec Networks are UNDECIDED. Time = 7.03 sec The unsolved reduced miter is (null) : pi = 35 po = 1 lat = 74 and = 756 lev = 16 Speculation... Performing sequential simulation of 1000 frames with 255 words. Output 27 was asserted in frame 6 (use "write_counter" to dump a witness). Time = 0.14 sec No output was asserted in 13 frames. Time = 11.75 sec Reached local conflict limit (25000). Problem size of speculative reduced circuit after trimming... (null) : pi = 35 po = 39 lat = 74 and = 775 lev = 16 After "scorr"... (null) : pi = 35 po = 39 lat = 65 and = 738 lev = 16 After "dc2"... (null) : pi = 35 po = 39 lat = 65 and = 713 lev = 16 Property proved by interpolation (106 sec). Total Time = 143.69 sec

  14. Experimental Results • Sequential verifier in ABC • First implemented in summer 2007 • Publicly available since September 2007 • Now working on second-generation code • Very active research area - lots of new ideas to try! • Test cases • Generated by applying sequential synthesis in ABC • Public benchmarks from various sources • Industrial problems from several companies

  15. Hardware Model Checking Competition at CAV (HWMCC’08) • Competition organizers • Armin Biere (Johannes Kepler University, Linz, Austria) • Alessandro Cimatti (IRST, Trento, Italy) • Koen Lindström Claessen (Chalmers University, Gothenburg, Sweden) • Toni Jussila (OneSpin Solutions, Munich, Germany) • Ken McMillan (Cadende Berkeley Labs, Berkeley, USA) • Fabio Somenzi (University of Colorado, Boulder, USA) • The total of 16 solvers from 6 universities • The total of 645 benchmarks • 344 old and 301 new • Resource limits per problem (on Intel Pentium IV, 3 GHz, 2 GB) • Runtime limit: 900 sec • Memory limit: 1.5 Gb

  16. Results Courtesy Armin Biere

  17. HWMCC’08: All Benchmarks Courtesy Armin Biere

  18. HWMCC’08: SAT Benchmarks Courtesy Armin Biere

  19. HWMCC’08: UNSAT Benchmarks Courtesy Armin Biere

  20. Competition Webpage

  21. Summary • Reviewed some basics • Described integrated flow • Described the recent extension of the flow • Reviewed the results of HWMCC’08

More Related