Predicate Abstraction for Software and Hardware Verification Himanshu Jain Model checking seminar April 22, 2005

Introduction Scalable software verification Properties  Array bounds check, division by zero  Pointer safety  Assertion checking  Lock and unlocking Focus on partial specifications

Predicate Abstraction Extract a finite state model from an infinite state system Used to prove assertions or safety properties Successfully applied for verification of C programs  SLAM (used in windows device driver verification)  MAGIC, BLAST, F-Soft

Example for Predicate Abstraction int main() { int i; i=0; while(even(i)) i++; } + p 1  i=0 p 2  even(i) = void main() { bool p1, p2; p1=TRUE; p2=TRUE; while(p2) { p1=p1?FALSE:nondet(); p2=!p2; } } PredicatesC programBoolean program [Ball, Rajamani ’01] [Graf, Saidi ’97]

Computing Predicate Abstraction How to get predicates for checking a given property? How do we compute the abstraction? Predicate Abstraction is an over-approximation  How to refine coarse abstractions

Counterexample Guided Abstraction Refinement loop C Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

Abstraction 1 : x = ctr; 2 : y = ctr + 1; 3 : if (x = i-1){ 4 : if (y != i){ ERROR: } 1 : skip; 2 : skip; 3 : if (*){ 4 : if (*){ ERROR: } Abstract C programNo predicates available currently

Checking the abstract model 1 : skip; 2 : skip; 3 : if (*){ 4 : if (*){ ERROR: } Abstract model has a path leading to error state Is ERROR reachable? yes

Simulation 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : skip; 2 : skip; 3 : if (*){ 4 : if (*){ ERROR: } Does this correspond to a real bug? Not possible Concrete trace Check using a SAT solver

Refinement 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : skip; 2 : skip; 3 : if (*){ 4 : if (*){ ERROR: } Spurious Counterexample Initial abstraction

Refinement 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : skip; 2 : skip; 3 : if (*){ 4 : if (b0){ ERROR: } boolean b0 : y != i

Refinement 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : skip; 2 : skip; 3 : if (b1){ 4 : if (b0){ ERROR: } boolean b0 : y != i boolean b1 : x== i-1

Refinement 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : skip; 2 : b0 = b2; 3 : if (b1){ 4 : if (b0){ ERROR: } } boolean b0 : y != i boolean b1 : x== i-1 boolean b2 : ctr + 1 ! = i Weakest precondition of y != i

Refinement 1 : x = ctr; 2 : y = ctr + 1; 3 : assume(x == i-1) 4 : assume (y != i) 1 : b1 = b3; 2 : b0 = b2; 3 : if (b1){ 4 : if (b0){ ERROR: } boolean b0 : y != i boolean b1 : x== i-1 boolean b2 : ctr + 1 ! = i boolean b3: ctr == i -1

Refinement 1 : b1 = b3; 2 : b0 = b2; 3 : if (b1){ 4 : if (b0){ ERROR: } boolean b0 : y != i boolean b1 : x== i-1 boolean b2 : ctr + 1 ! = i boolean b3: ctr == i -1 b2 and b3 are mutually exclusive. b2 =1, b3 = 0 b2 =0, b3 = 1 What about initial values of b2 and b3? So system is safe!

Tools for Predicate Abstraction of C SLAM at Microsoft  Used for verifying correct sequencing of function calls in windows device drivers MAGIC at CMU  Allows verification of concurrent C programs  Found bugs in MicroC OS BLAST at Berkeley  Lazy abstraction, interpolation SATABS at CMU  Computes predicate abstraction using SAT  Can handle pointer arithmetic, bit-vectors F-Soft at NEC Labs  Localization, register sharing

Applications of Predicate Abstraction in Hardware Verification

System on chip design Increase in complexity Gate level (netlists) Structural Behavioral/RTL ………… Level Number of components 10E7 10E5 10E3 10E0 Abstraction System Level

Introduction Emergence of system design languages HardwareC, SpecC, Handel-C, and SystemC Based on C / C++ Allows joint modeling of both hardware and software components of a system Support for bit vectors, concurrency, synchronization, exception handling, timing

Verification support Most model-checkers used in hardware industry work at netlist level Higher abstraction levels offered by languages like SpecC or RTL Verilog are not yet supported Languages like SpecC are more closer to concurrent software Verification tools must reason about:  Programming languages constructs  Concurrency  Pointers, Objects  Bit vector operations like concatenation, extraction

Why predicate abstraction Many properties depend on relationship between registers, and not the values stored in them Predicate Abstraction  Keeps tracks of certain predicates on data  Successfully used in software verification Can handle larger designs

Abstraction-Refinement loop Verilog Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

An example module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Verilog program

Abstraction-Refinement loop Verilog Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

Predicate Abstraction module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Initial set of predicates: {x = 100, x = 200} Verilog program Word level predicates

Computing Most Precise Abstraction + x’ = y y’ = x + Current state Next state Equation passed to the SAT solver Transition Relation Computing abstract transitions

Obtain transitions Computing abstract transitions … and so on …

Abstract Model module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Initial set of predicates: {x = 100, x = 200} Verilog program Initial state Failure state

Abstraction-Refinement loop Verilog Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

Model checking module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Verilog program Failure state Initial state Abstract Model

Model checking module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Verilog program Failure state Initial state Abstract Model Counterexample

Abstraction-Refinement loop Verilog Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

u Counterexample in the abstract model s  (length = 1)  Each state is a valuation of h x = 100, x=200 i Simulation equation Simulation of the counterexample Initial values of the registers predicate values in the first state of the counterexample Transition relation predicate values in the second state of the counterexample equation is unsatisfiable So counterexample is spurious

Abstraction-Refinement loop Verilog Program Abstract model Model Checker Abstraction refinement Verification Initial Abstraction No error or bug found Simulator Property holds Simulation sucessful Bug found Refinement Spurious counterexample

Refinement u Let length of spurious counterexample be k u Take weakest pre-condition of property for k steps with respect to transition functions u Pick atomic predicates from weakest precondition

Refinement (x’ = 100 Ç x’ = 200) Holds after one step x’ = y y’ = x (y = 100 Ç y = 200) weakest precondition x’ = y y’ = x AG (x = 100 Ç x = 200) + Transition functions Property length =1 + spurious counterexample New predicates y = 100, y = 200

Abstract again module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Updated set of predicates: {x = 100, x = 200, y=100, y=200} Verilog program Initial state Model check New abstraction

Model checking module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Updated set of predicates: {x = 100, x = 200, y=100, y=200} Verilog program Initial state Property holds! New abstraction

Result module main (clk) input clk; reg [10:0] x, y; initial x= 100, y= 200; (posedge clk) begin x <= y; y <= x; end endmodule Property: AG (x = 100 or x = 200) Verilog program Property holds!

Experimental results (VIS benchmarks) Benchmark Lines of code #Latches#Variables Veracity Time #Predicates#Iteration cachecoherence s259 mpeg decoder s93 mpeg decoder s94 SDLX s4330 Miim s * 0.57s *42 PI-Bus s * 101 * Using lazy abstraction All use predicate partitioning

Bigger benchmarks Benchmark#Latches Veracity time Cadence SMV time ICU281.3s0.1s ICRAM2KB s25s ICRAM4KB sterminates ARITH s182.4s ARITH s2147s ARITH stimeout ARITH stimeout

Tools u VCEGAR (Verilog Counterexample Guided Abstraction Refinement) at CMU s

Questions