1. Bounded Model Checking EECS 290A Sequential Logic Synthesis and Verification

2. Overview  Introduction  Computational methods  Recent improvements

3. Philosophy of Model Checking  It is impossible to know whether the specification of a system is correct or complete How can we know whether what we wrote fully captures what we meant? (the problem is nobody knows what we meant :) How can we know whether what we wrote fully captures what we meant? (the problem is nobody knows what we meant :)  It is only possible to check whether the specification satisfies certain properties We need to provide properties, which describe what we meant We need to provide properties, which describe what we meant  Therefore, model checking looks for some bugs (counter-examples to the properties), rather than to prove that the system is “correct” in general Equivalence checking can prove correctness-in-general but we need to have the “golden model” (a trustworthy specification) Equivalence checking can prove correctness-in-general but we need to have the “golden model” (a trustworthy specification)

4. Brief History of Model Checking  Model checking The term was coined in 1981 by Clarke and Emerson The term was coined in 1981 by Clarke and Emerson The algorithm explicitly enumerated reachable states (limited to a few million states) The algorithm explicitly enumerated reachable states (limited to a few million states)  Symbolic model checking The symbolic formulation was introduced by introduced around 1990 (McMillan, Clarke, Burch, Coudert et al) The symbolic formulation was introduced by introduced around 1990 (McMillan, Clarke, Burch, Coudert et al) Motivated by the use of discovery of BDDs in 1986 Motivated by the use of discovery of BDDs in 1986 It was a break-through to the wide usage of model checking It was a break-through to the wide usage of model checking  Bounded model checking (BMC) Proposed by Biere at al in 1999 Proposed by Biere at al in 1999 The basic idea is to search for counter-examples of length k The basic idea is to search for counter-examples of length k Led to even wider industrial use Led to even wider industrial use

5. BMC in a Nutshell  I is initial state(s); T(s i, s i+1 ) is transition relation; P is property  Base n = I 0  T 0  …  T n-1  P n  Uniqueness constraints: Unique n =  0<i<j  n (s i  s j )  The problem is symmetric w.r.t. forward and backward traversal I P

6. Model Checking as Search  Model checking is a search problem find an assignment of input variables at each time-frame, which leads to the violation of the property after k frames find an assignment of input variables at each time-frame, which leads to the violation of the property after k frames  If we finished exploring the search space and did not find the violation, the property holds for k frames  If we proved that the property holds for any k, we proved the unbounded case (the subject of future lectures)

7. BDDs vs. SAT  BDD package  Builds the canonical representation of the problem up to a point  Tends to run out of memory  SAT solver  Explores one branch at a time  Tends to run out of time  Both exhaustively explore the search space

8. Search Problem

9. Different Ways of Exploring Search Space BDD approachSAT approach   

10. Other Representations  Truth table Implemented using bit strings Implemented using bit strings Convenient for functions up to 5 variables Convenient for functions up to 5 variables Useful for functions up to 8 variables Useful for functions up to 8 variables  Sums-of-products Cubes are represented in positional notation Cubes are represented in positional notation Implemented using bit strings Implemented using bit strings The main data structure to represent SOPs in Espresso and SIS The main data structure to represent SOPs in Espresso and SIS  Common features Are explicit in nature Are explicit in nature Exploit bit parallelism Exploit bit parallelism Traditionally used in many applications Traditionally used in many applications

11. Use of Functional Representations Historical Perspective Problem Size Time Period1950-1970198019902000 +AIG Truth table +SOP +BDD +CNF

12. Recent Improvements to BMC  Combining SAT and BDDs Aarti Gupta, Malay Ganai, Chao Wang, Zijiang Yang, Pranav Ashar, “Learning from BDDs in SAT-based bounded model checking”, DAC 2003. Aarti Gupta, Malay Ganai, Chao Wang, Zijiang Yang, Pranav Ashar, “Learning from BDDs in SAT-based bounded model checking”, DAC 2003.  Efficient framework for incremental solving Niklas Een, Niklas Sorensson, “Temporal induction by incremental SAT solving”, Intl. Workshop on BMC 2003. Niklas Een, Niklas Sorensson, “Temporal induction by incremental SAT solving”, Intl. Workshop on BMC 2003.  Improvements to variable ordering and the use of learned clauses Liang Zhang, Mukul Prasad, Michael Hsiao, "Incremental deductive and inductive reasoning for SAT-based bounded model checking“, ICCAD 2004 Liang Zhang, Mukul Prasad, Michael Hsiao, "Incremental deductive and inductive reasoning for SAT-based bounded model checking“, ICCAD 2004  Preprocessing of the transition relation Andreas Kuehlmann, “Dynamic transition relation simplication”, ICCAD 2004. Andreas Kuehlmann, “Dynamic transition relation simplication”, ICCAD 2004.