1. Formal Verification of Synchronization Issues of SpecC Description with Automatic Abstraction Thanyapat Sakunkonchak Masahiro Fujita Department of Electronics Engineering University of Tokyo

2. Overview Introduction Verification Flows Example Summary & Outlooks

3. Synchronization in SpecC Ambiguous results on y causing from x = 10; /*st1*/ x = 20; /*st3*/ y = 20 (always)

4. Synchronization in SpecC (cont.) y = 20 (always) Tas=Tbs, Tae=Tbe Tas<=T1s<T1e<=T2s<T2e<=Tas Tbs<=T3s<T3e<=Tbe T2e<=T3s

5. Difference Decision Diagrams ( DDD ) Introduce by M Φ ller, et al. Symbolic representation of ‘ non-boolean ’, such as inequality: less efficient if using BDD DDD represents difference constraints (x- y≤c), x,y are integers, c is constant Represents graph for ¬(x−z<1)Λ(x−y≤0)Λ(y−z≤2)

6. Overview Introduction Verification Flows Example Summary & Outlooks

7. Verification Flows Goals:  Check whether given SpecC codes (with ‘ par ’, ‘ notify/wait ’ ) are properly synchronized  If checking fails, counter-examples should be generated (trace to source of errors) Based on:  Boolean SpecC, DDD, SVC, Program Slicing,...

9. Overview Introduction Verification Flows Example Summary & Outlooks

10. Example Sleeping barber problem barber customer empty chair barber chair barber: finished cutting->call customer barber: no customer->wait customer: barber wait->has hair cut customer: chairs occupied->come again customer: a chair empty->wait

11. Example behavior barber (inout event call, inout bool chairOccupied, inout int numCustomer) { void main() { while(1) { if (numCustomer == 0) DayDreaming(); else { if (chairOccupied == true) { KeepCutting(); chairOccupied = false; } else { notify call; chairOccupied = true; } }; behavior customer (inout event call, inout bool chairOccupied, inout int numCustomer) { void main() { while(1) { if (numCustomer == 3) GoBack(); else { numCustomer++; if (chairOccupied == false) { wait call; numCustomer--; } };

12. Example (verify) 1. SpecC => boolean SpecC & build Control Flow Graph (CFG) 2. Verify with DDDs if result is satisfied, terminate, else go to next step 3. Use CFG to find related path and use SVC to verify boolean variables and find the conditions imply infeasibility 4. Use those conditions and modify boolean SpecC 5. Go to 2

13. Example behavior barber (inout event call, inout bool chairOccupied, inout int numCustomer) { void main() { while(1) { if (numCustomer == 0) DayDreaming(); else { if (chairOccupied == true) { KeepCutting(); chairOccupied = false; } else { notify call; chairOccupied = true; } }; behavior customer (inout event call, inout bool chairOccupied, inout int numCustomer) { void main() { while(1) { if (numCustomer == 3) GoBack(); else { numCustomer++; if (chairOccupied == false) { wait call; numCustomer--; } }; Build boolean SpecC & CFG

14. Example (abstract) behavior barber () { void main() { while(a0) { if (a1)... else { if (a2) {... } else { notify call;... } }; behavior customer () { void main() { while(b0) { if (b1)... else {... if (b2) { wait call;... } }; Verify with DDDs

15. CFG Construction Entry barber whilenumCustomerchairOccupiedcall if numCustomer = 0 DayDreaming if numCustomer != 0 if chairOccupied = Tif chairOccupied = F KeepCuttingchairOccupied = Fnotify callchairOccupied = T Control flow (CF) Date flow (DF)

16. CFG Construction Entry customer whilenewCustomernumCustomer newCustomer = rand() % 1 numCustomer += newCustomer if numCustomer = 5if numCustomer != 5 callchairOccupied numCustomer++if chairOccupied = T wait call GoBack Control flow (CF) Date flow (DF) numCustomer--

17. Example (refine) behavior barber () { void main() { while(a0) { if (a1) //numCustomer == 0... else { if (a2) { //chairOccupied == true... !a2 //chairOccupied == false } else { notify call; a2 //chairOccupied == true } }; behavior customer () { void main() { while(b0) { if (b1) //numCustomer == 3... else {... //numCustomer++ if (b2) { //chairOccupied == false wait call;... //numCustomer-- } }; Check predicates for validity (SVC)Verify with DDDs

18. Example (verification) The synchronization of even ‘ call ’ is satisfied User-defined assertions can be used to verify for some properties, e.g. to see whether numCustomer is more than 3 The refinement process is not automatically done. Some efforts from users are needed to browse over CFG and find the locations numCustomer++; if (numCustomer > 3) assert(F); if (chairOccupied == false) {

19. Overview Introduction Verification Flows Example Summary & Outlooks

20. Summary & Outlook The verification of synchronization issues of SpecC is described The automatic abstraction is proposed Up to the current implementation:  The refinement process is not fully automatic (CFG cooperation needs to be manually done)  Cannot handle complex SpecC construct

21. Summary & Outlook (2) Future plans  Make the “abstraction refinement” to be automatically operated  Expand capability to support more complex SpecC structure, e.g. loop, functions, recursive