JP4577475B2 - Method and apparatus for property verification of synchronous sequential circuit - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a property verification apparatus that verifies whether or not a synchronous sequential circuit satisfies a functional specification, and in particular, uses a computation tree logic (CTL) which is a kind of temporal logic as a functional specification description language. The present invention relates to a formal verification apparatus based on a symbol model checking method.
[0002]
[Prior art]
Conventional property verification devices are generally based on a symbolic model checking method using computation tree logic (CTL) which is a kind of temporal logic as a functional specification description language. (Note; Reference: Information Processing 35 (8) “Formal Verification Method Based on Logical Function Processing” by Hiromi Hiraishi and Kiyoji Hamaguchi)
Hereinafter, a property verification apparatus using a conventional symbol model checking method will be described.
[0003]
First, the model checking method will be described. For details, refer to the above-mentioned note “Formal verification method based on logical function processing”.
[0004]
The model checking method is for determining whether the temporal logic called CTL (Computation Tree Logic) is true or false on a directed graph called Kripke structure.
[0005]
The Kripke structure is expressed by using a set of nodes V, R representing transition relations between nodes (directed branches), I representing the truth of a primitive proposition at each node, and V ₀ representing an initial node. It is defined as (1).
K = (V, R, I, V ₀ ) (1)
The synchronous sequential circuit is modeled as a Kripke structure as follows. As shown in FIG. 3, the synchronous sequential circuit includes an input signal (x ₁ ,..., X _n ), an output signal (z ₁ ,..., Z _l ), an FF signal (y ₁ ,. , y _m ), and a combinational circuit that determines the value of the next clock of the FF signal.
[0006]
One combination of values in the input signal and FF signal is represented by one node, each of the input signal and FF signal is represented as a primitive proposition, its true / false is represented by a signal value, and the initial node corresponds to the signal value in the reset state. By using nodes, synchronous sequential circuits can be modeled as Kripke structures.
[0007]
The transition relationship between nodes corresponds to representing a combination of signal values that can be transitioned from a certain signal value to the next clock in a synchronous sequential circuit, and is obtained from the logic of the combinational circuit that determines the value of the next clock of the FF signal. It is possible.
[0008]
CTL is a temporal logic that can describe the true and false temporal changes of primitive propositions. In addition to ordinary logical operators such as logical sum, logical product, and logical negation, CTL represents "in all transition sequences". Operator A, operator E representing "in a certain transition series", time phase operator F representing "someday in the future", time phase operator G representing "always in the future", time phase representing "at the next time" It is described using the operator X, a temporal operator U representing “always to”.
[0009]
For example, the CTL description EFp represents the proposition “p is true sometime in the future in a certain transition sequence”.
[0010]
In order to determine whether or not EFp is true at the initial node of the Kripke structure, all the nodes for which EFp is true are obtained and it is determined whether or not the initial node is included therein.
[0011]
To find all nodes for which EFp is true, first find the set of nodes for which p is true, then find and add nodes that have transitions to that node (that is, have directional branches) one after another. good.
[0012]
If you continue this process until there are no new nodes added, you will be asked for all nodes for which EFp is true.
[0013]
Figure 2 is a diagram showing a state of the task, the node p is true when the a q ₈ and q _9, first, the node set [q _8, q _9] and T _0, to T ₀ Find a set of nodes with transitions. The nodes with transitions to T ₀ are q ₆ and q ₇ . Next, node q _3, q ₄ with a transition node set obtained by adding the q ₆ and q ₇ to _{T 0 [q 8, q 9} , q 6, q 7] a to T ₁ When T _1, q ₅ , q ₆ , q ₇ , q ₈ , q ₉ and the node set added to T ₁ is T ₂ = [q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _4, q ₅ ] .
[0014]
Similarly, T ₃ = [q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _4, q ₅ , q _1, q ₂ ] is obtained in the third step, and T ₄ = [q in the fourth step. ₈ , q _9, q ₆ , q ₇ , q ₃ , q _4, q ₅ , q _1, q _2, q ₀ ] are obtained. In the 5th step, nodes with transition to T ₄ are obtained as q ₀ , q ₁ , q ₂ , q ₃ , q ₄ , q ₅ , q ₆ , q ₇ , q ₈ , q ₉ working in this step is stopped because the longer the new node is included in all the T ₄ will not be added.
[0015]
The node set T ₄ obtained by the above operation is all nodes for which EFp is true. Since T ₄ includes the initial node q ₀ , it can be verified that EFp is true at the initial node.
[0016]
Next, the symbol model check will be described.
[0017]
The operation of obtaining a set of nodes [r] that can be reached from a set of nodes [q] by one transition is called “image calculation” and is expressed as follows.
Img ([q]) = [r] (2)
On the other hand, the task of obtaining a set of nodes [q] that can reach a set of nodes [r] with a single transition is called “inverse image calculation” and is expressed as follows.
Img ^-1 ([r]) = [q] (3)
The above-described operation for finding a node for which EFp is true can be achieved by starting with a node set for which p is true and repeatedly applying inverse image calculation.
[0018]
The symbol model checking method performs the above image calculation and inverse image calculation by logical function processing. For this purpose, each node of the Kripke structure is represented by a unique binary number, and a logical variable vector v = [v ₀ , v ₁ ,.., V _n ] is prepared for expressing this. A set S of nodes is represented by the following logical function F _S (v) using v.
F _S (v) = 1 iff v∈q (4)
For example, when the nodes q ₀ , q ₁ , q ₂ , q ₃ are represented by binary numbers 000, 001, 010, 011 respectively, the node set S1 = [q ₁ , q ₂ ] is Represented by the logical function F _S1 .
F _S1 =! V ₀ *! V ₁ * v ₂ +! V ₀ * v ₁ *! V ₂ ... (5)
Here,! Represents a logical negation, * represents a logical product, and + represents a logical sum.
[0019]
On the other hand, the transition relationship between nodes is also expressed by a logical function. The start point of the transition branch is represented by a logical variable vector v = [v ₀ , v ₁ , .., v _n ], and the end point is represented by a logical variable vector v = [v ₀ , v ₁ , .., v _n ]. Then, the transition relation between the nodes is expressed by the following logical function R (v, v).
R (v, v) = 1 iff (v, v) is a transition branch (6)
When these logical function expressions are used, the above image calculation and inverse image calculation can be performed by logical function processing.
[0020]
Here, inverse image calculation will be described.
[0021]
A logical function process of inverse image calculation of Expression (3) will be described. A logical function representing the node set [r] is F _r (v), and a logical function representing the node set [q] is F _q (v). The inverse image [q] of [r] is obtained by the following logical function processing.
F _q (v) = ∃v. (R (v, v) * F _r (v))… (7)
Here, ∃v. Is called a smoothing operator and is defined as follows.
∃v _i .f (v) = f _{vi = 1} (v) + f _{vi = 0} (v) (8)
∃vf (v) = ∃v ₀ .f (v) * ∃v ₁ .f (v) * ... * ∃v _n .f (v)… (9)
In equation (8), f _{vi = 1} (v) represents f (v) substituted with v _i = 1, and f _{vi = 0} (v) represents f (v) substituted with v _i = 0.
[0022]
Next, symbol model checking for a synchronous sequential circuit will be described. Consider a synchronous sequential circuit as shown in FIG.
[0023]
This synchronous sequential circuit consists of n external input signals [x ₁ , ..., x _n ], m flip-flops [y ₁ , ..., y _m ], and the value of the next clock flip-flop A combinational circuit for determining
[0024]
In order to model this sequential circuit into a Kripke structure, a vector obtained by connecting [x ₁ , ..., x _n ] and [y ₁ , ..., y _m ] is associated with the logical variable vector v.
[0025]
This means that each combination of flip-flop and external input signal value corresponds to a node of the Kripke structure.
[0026]
Also, the value of the input signal and the value of the flip-flop at the next clock are represented by [x ₁ , ..., x _n ] and [y ₁ , ..., y _m ], respectively, and the concatenated vector is associated with v.
[0027]
Using these, a transition relation R (v, v) between nodes is generated.
[0028]
The transition relation between the nodes is obtained by the following calculation from a combinational circuit that determines the value of the flip-flop of the next clock.
[0029]
Assume that a combinational circuit that determines the value of the next clock of the flip-flop y _i is represented by a logical function N _i (v).
R (v, v) = Π ₁ ≤ _i ≤ _m (y≡ N _i (v))… (10)
As described above, the synchronous sequential circuit can be modeled into a Kripke structure, and verification by symbol model checking becomes possible.
[0030]
The logical function processing in the symbol model checking method is generally executed using binary decision diagrams (BDD).
[0031]
Japanese Patent Application Laid-Open No. 10-301963 describes a method for inspecting a large-scale logic circuit by dividing a state set when a symbol model checking method is used as a logic device verification method. Yes.
[0032]
In Japanese Patent Laid-Open No. 10-63537, a single state set indicating a state set in which an infinite loop is connected to a property set to be verified is connected in order to reduce the memory scale and processing time in the symbol model checking method. It describes a method of executing a path expression by converting it into a procedure group that can be executed only by image calculation processing in the automaton.
[0033]
[Problems to be solved by the invention]
However, these conventional techniques have a first problem that verification cannot be performed with a limited processing time.
[0034]
Further, there is a second problem that when the processing memory and the processing CPU time are limited, a logic circuit having a predetermined scale or larger cannot be verified.
The present invention has been made in view of these problems, and an object of the present invention is to provide a method capable of performing inspection regardless of the size of the scale even when the processing time and the processing memory are limited.
[0035]
[Means for Solving the Problems]
According to a first aspect of the present invention, the property checking method property checking device performs to verify whether they meet the properties of synchronous sequential circuit represents the functional specification, the property checking device, the synchronization verified Receiving a description defining the operation of the expression sequence circuit and an input of a CTL expression representing the reachability to the target circuit internal state as a property to be verified; and A step of executing a symbolic model checking method for determining whether the CTL expression is true or false in a description defining the operation of the circuit; and the property verification device is unable to execute the symbolic model checking method within a limited time or a limited amount of memory. when such, the CTL formula based on the time limit or information node set that can be obtained within limits the amount of memory is true The Rukoto proof state to extract information of possible state set reached, the steps of the internal state of the synchronous sequential circuit automatically generates a determining testbench whether included in the set of states and the extraction, the A property verification apparatus comprising: performing a logic simulation using the test bench to complement the result of the symbolic model checking method.
[0036]
Oite above property checking how the addition to the test bench the generated in logic simulation, using the pattern given from the random pattern or an external as an input vector to be given to external input signals, during execution of the logic simulation, the The logic simulation is performed by determining that the CTL expression is true when it is detected that the internal state of the synchronous sequential circuit to be simulated has reached an internal state corresponding to the extracted state set. May be a property verification method characterized by
[0037]
DETAILED DESCRIPTION OF THE INVENTION
The first embodiment will be described in detail with reference to the flowchart of FIG. 1 showing the processing procedure of the present invention and FIG. 2 which is a conceptual diagram showing an example of the processing procedure of the conventional symbol model checking method. .
[0038]
It is assumed that the synchronous sequential circuit to be verified input in the procedure of S102 is modeled into a Krike structure as shown in FIG. Further, the functional specification input in S102, and was CTL that EFP, nodes p is true among the nodes of FIG. 2 is assumed to be q ₈ and q _9. Property verification for this functional specification is intended to confirm that internal states corresponding to q ₈ and q ₉ can be reached among the internal states in the synchronous sequential circuit to be verified. It is.
[0039]
In the symbol model check in S103, as shown in FIG. 2, a node set that can reach T ₀ starting from the node set T ₀ is obtained by iterative processing.
[0040]
If symbolic model checking of S103 has limited time and limited amount of memory in the process is complete, that is, when it is possible to obtain the node set T _4, the property checking is terminated.
That is, it is confirmed that the internal states corresponding to q ₈ and q ₉ among the internal states in the synchronous sequential circuit to be verified can be reached from the initial state.
[0041]
On the other hand, let us consider a case where the process of the symbol model check in S103 is not completed within the time limit and the limited memory amount. As an example, assume that the symbol model checking exceeds either the time limit or restrict the amount of memory at the time of obtaining the node set T ₂ in FIG.
[0042]
In this case, the time of completion of S103, out of the internal state of a synchronous sequential circuit to be verified, it can not be confirmed reachable from the initial state to the internal state corresponding to q ₈ and q _9.
[0043]
Here, S107 receives the information of the node set T ₂ = [q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _4, q ₅ ] from the symbol model check of S103, and “synchronization formula to be verified” A test bench is generated that detects that the sequential circuit has reached an internal state corresponding to q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _{4, and} q ₅ .
[0044]
Next, in S106, using the test bench generated in S107, a logic simulation is executed using a random pattern or a pattern given by a designer as an input vector to be given to an external input signal. During execution of the logic simulation, the test bench detects that the internal state of the synchronous sequential circuit to be simulated has an internal state corresponding to q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _{4, and} q ₅ . Inspect whether one has been reached. If it was detected that such an internal state was reached, it was confirmed that the internal states corresponding to q ₈ and q ₉ among the internal states in the synchronous sequential circuit to be verified can be reached from the initial state. It will be.
[0045]
Next, the second embodiment of the present invention will be described with reference to the example of FIG. 2, which is a conceptual diagram showing the processing procedure of the conventional symbol model checking method, with reference to the logic simulation of the present invention.
[0046]
As shown in FIG. 2, in the logic simulation, in order to confirm that the internal states corresponding to q ₈ and q ₉ can be reached from the initial state, a simulation of at least 4 steps is required.
[0047]
However, it is possible to confirm that one of the internal states corresponding to q ₈ , q _9, q ₆ , q ₇ , q ₃ , q _{4, and} q ₅ can be reached from the initial state with a minimum two-step simulation. It is.
[0048]
A state that requires a long step to reach is often difficult to reach with a random pattern or an input pattern created by the designer, but a state that can be reached with a short step can be reached with high probability. .
[0049]
Therefore, the property verification method of the present invention has a short time or high probability of property verification compared to the case where the property verification method based on the conventional symbol model checking method cannot be verified due to limitations on the processing time and the amount of memory used. Can be made possible.
[0050]
【The invention's effect】
The first effect of the present invention is that the property verification method by the conventional symbol model checking method can be verified even when it cannot be verified due to limitations on the processing time and the amount of memory used.
[0051]
The second effect of the present invention is that it can be confirmed in a short time that the internal state that proves whether or not the sequential circuit to be verified satisfies the functional specification can be reached from the initial state by logic simulation.
[Brief description of the drawings]
FIG. 1 is a flowchart showing a processing procedure in a first embodiment of the present invention.
FIG. 2 is a conceptual diagram showing an example of a processing procedure of a conventional symbol model checking method.
FIG. 3 is a diagram illustrating an example of a synchronous sequential circuit.

Claims (4)

In the property verification method performed by the property verification device that verifies whether the synchronous sequential circuit satisfies the property indicating the functional specification,
The property verification device accepting a description defining the operation of the synchronous sequential circuit to be verified and an input of a CTL expression representing reachability to a target circuit internal state as a property to be verified;
The property verification device executing a symbol model checking method for determining the authenticity of the CTL expression in a description defining the operation of the synchronous sequential circuit to be verified ;
When the symbol model checking method cannot be executed within the time limit or the amount of limited memory , the property verification apparatus can perform the CTL based on the node set information that can be obtained within the time limit or the amount of limited memory. Information on a state set that can reach a proof state that the expression is true is extracted, and a test bench that determines whether an internal state of the synchronous sequential circuit is included in the extracted state set is automatically generated Steps,
The property verification device using the test bench to perform a logic simulation to complement the results of the symbolic model checking method;
A property verification method comprising: The property verification method according to claim 1,
  In the logic simulation, in addition to the generated test bench, a random pattern or an externally given pattern is used as an input vector given to an external input signal.
  Determining that the CTL expression is true when it is detected during execution of the logic simulation that the internal state of the synchronous sequential circuit to be simulated has reached an internal state corresponding to the extracted state set. The logic verification is performed by the property verification method. In the property verification device that verifies whether the synchronous sequential circuit satisfies the property that represents the functional specification,
It means for accepting an input of CTL expression representing the reachability to the circuit internal state of interest as said description and verified properties defines the operation of the synchronous sequential circuit to be verified,
Means for executing a symbolic model checking method for determining the authenticity of the CTL expression in the description defining the operation of the synchronous sequential circuit to be verified ;
Said When symbolic model checking method is impractical in time limit or restrict the amount of memory in the CTL formula based on the time limit or information node set that can be obtained within limits the amount of memory is true Means for automatically generating a test bench that extracts information on a state set that can reach the proof state of the test and determines whether an internal state of the synchronous sequential circuit is included in the extracted state set ;
Means for performing a logic simulation to complement the result of the symbolic model checking method using the test bench;
A property verification apparatus comprising:   The property verification device according to claim 3,
  In the logic simulation, in addition to the generated test bench, a random pattern or an externally given pattern is used as an input vector given to an external input signal.
  Determining that the CTL expression is true when it is detected during execution of the logic simulation that the internal state of the synchronous sequential circuit to be simulated has reached an internal state corresponding to the extracted state set. The property verification apparatus according to claim 1, wherein the logic simulation is performed.

Images