## Symbolic model checking for sequential circuit verification (1994)

### Cached

### Download Links

- [www-cad.eecs.berkeley.edu]
- [w2.cadence.com]
- [reports.adm.cs.cmu.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS |

Citations: | 239 - 11 self |

### BibTeX

@ARTICLE{Burch94symbolicmodel,

author = {Jerry R. Burch and Edmund M. Clarke and David E. Long and Kenneth L. McMillan and David L. Dill},

title = {Symbolic model checking for sequential circuit verification},

journal = {IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS},

year = {1994},

volume = {13},

number = {4},

pages = {401--424}

}

### Years of Citing Articles

### OpenURL

### Abstract

The temporal logic model checking algorithm of Clarke, Emerson, and Sistla [17] is modified to represent state graphs using binary decision diagrams (BDD’s) [7] and partitioned trunsirion relations [lo], 1111. Because this representation captures some of the regularity in the state space of circuits with data path logic, we are able to verify circuits with an extremely large number of states. We demonstrate this new technique on a synchronous pipelined design with approximately 5 x 10^120 states. Our model checking algorithm handles full CTL with fairness constraints. Consequently, we are able to express a number of important liveness and fairness properties, which would otherwise not be expressible in CTL. We give empirical results on the performance of the algorithm applied to both synchronous and asynchronous circuits with data path logic.

### Citations

3153 | Graph-based algorithms for Boolean function manipulation
- Bryant
- 1986
(Show Context)
Citation Context ...: : : : : : : : : : : : : : : : 45 Abstract The temporal logic model checking algorithm of Clarke, Emerson, and Sistla [17] is modified to represent state graphs using binary decision diagrams (BDDs) =-=[7]-=- and partitioned transition relations [10, 11]. Because this representation captures some of the regularity in the state space of circuits with data path logic, we are able to verify circuits with an ... |

1372 |
Symbolic Model Checking
- McMillan
- 1993
(Show Context)
Citation Context ...appear nondeterministic even though it was originally deterministic. As an example of these two situations, consider the cache coherency protocol for the Encore Gigamax that McMillan has investigated =-=[29, 30, 31]-=-. The protocol was designed for a shared memory multiprocessor organized as a series of buses connected by an asynchronous hierarchical routing network. The caches on each bus are kept consistent usin... |

1246 | Automatic verification of finite-state concurrent systems using temporal logic specifications
- Clarke, Emerson, et al.
- 1986
(Show Context)
Citation Context ... : : : : : : : : : : : : 44 9.2 Degree of Automation : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 45 Abstract The temporal logic model checking algorithm of Clarke, Emerson, and Sistla =-=[17]-=- is modified to represent state graphs using binary decision diagrams (BDDs) [7] and partitioned transition relations [10, 11]. Because this representation captures some of the regularity in the state... |

547 |
Symbolic Model Checking: An Approach to the State Explosion Problem
- McMillan
- 1992
(Show Context)
Citation Context ...appear nondeterministic even though it was originally deterministic. As an example of these two situations, consider the cache coherency protocol for the Encore Gigamax that McMillan has investigated =-=[29, 30, 31]-=-. The protocol was designed for a shared memory multiprocessor organized as a series of buses connected by an asynchronous hierarchical routing network. The caches on each bus are kept consistent usin... |

470 | R.E.: Efficient implementation of a BDD package
- Brace, Rudell, et al.
(Show Context)
Citation Context ...a CTL model checker written mostly in the T dialect of LISP [33]. The actual BDD manipulation routines are written in C and are roughly comparable to the package described by Brace, Rudell and Bryant =-=[4]-=-. The model checker was run on a SPARCstation 1+. Figure 5 shows how the verification time depends on the parameters r, w, s and o. This plot (and the other plots in this paper) uses a log scale on bo... |

326 |
Symbolic Model Checking: 10 States and Beyond
- Burch, Clarke, et al.
- 1992
(Show Context)
Citation Context ...may be exponential in the number of components of the system. We have studied a method for computing fixed points called iterative squaring that can drastically reduce the number of iterations needed =-=[12, 13, 14]-=-. The direct iteration algorithm computes the least fixed point of F by computing F (;), F 2 (;), F 3 (;), etc., until a fixed point is reached. Iterative squaring depends on noting that the predicate... |

258 |
Trace Theory for Automatic Hierarchical Verification of Speed-Independent Circuits. ACM Distinguished Dissertations
- Dill
- 1988
(Show Context)
Citation Context ...e user in constructing a correctness proof. In contrast, the most effective techniques for reasoning about sequential behavior usually require a complete exploration of the state space of the circuit =-=[6, 21, 25]-=-. The state exploration techniques are attractive because they are highly automatic: the user simply provides a description of the circuit implementation and its specification; the system does the res... |

204 |
Synthesis of synchronization skeletons for branching time temporal logic
- Clarke, Emerson
- 1981
(Show Context)
Citation Context ... of the state space and depends in size more on the inherent complexity of the data path logic than simply the number of states it determines. In this paper, we show how temporal logic model checking =-=[12, 13, 14, 16, 17]-=- and reachability analysis algorithms can modified to represent state graphs using binary decision diagrams (BDDs) [7]. Because this representation captures some of the regularity in the state space d... |

183 |
Sequential circuit verification using symbolic model checking
- Burch, Clarke, et al.
- 1990
(Show Context)
Citation Context ... of the state space and depends in size more on the inherent complexity of the data path logic than simply the number of states it determines. In this paper, we show how temporal logic model checking =-=[12, 13, 14, 16, 17]-=- and reachability analysis algorithms can modified to represent state graphs using binary decision diagrams (BDDs) [7]. Because this representation captures some of the regularity in the state space d... |

166 | Symbolic model checking with partitioned transition relations - Burch, Clarke, et al. - 1991 |

165 | Verification of synchronous sequential machines based on symbolic execution,” in Automatic Verification Methods for Finite State Systems
- Coudert, Berthet, et al.
- 1989
(Show Context)
Citation Context ...In this method, a separate BDD is used for each Boolean state variable of the system. This BDD represents the function computed by the combinational logic driving the associated latch. Coudert et al. =-=[18, 20]-=- describe a number of algorithms for manipulating transition functions. Of these three methods of representing transitions (transition functions and monolithic and partitioned transition relations), w... |

157 |
B.: Implicit state enumeration of finite state machines using BDDs
- Touati, Savoj, et al.
- 1991
(Show Context)
Citation Context ...f BDDs [12], a technique we now call disjunctive partitioned transition relations. Adapting this technique to synchronous circuits requires conjunctive partitioned transition relations. Touati et al. =-=[34]-=- and Burch, Clarke and Long [10, 11] developed methods for computing an image of a conjunctive partitioned transition relation (the latter method is described in section 5). The efficiency of both tec... |

85 |
Introduction to a Computational Theory and Implementation of Sequential Hardware Equivalence
- Pixley
- 1990
(Show Context)
Citation Context ...d Z 0 are swapped. Reverse reachability analysis has been studied by Filkorn [24], and it can be viewed as a generalization of a earlier methods for finding equivalent states in finite state machines =-=[26, 32]-=-. In some cases, an invariant can be computed much more quickly with reverse reachability analysis than forward, even if both methods compute the same invariant. As an extreme example, consider using ... |

79 | Automatic verification of sequential circuits using temporal logic
- Browne, Clarke, et al.
- 1986
(Show Context)
Citation Context ...e user in constructing a correctness proof. In contrast, the most effective techniques for reasoning about sequential behavior usually require a complete exploration of the state space of the circuit =-=[6, 21, 25]-=-. The state exploration techniques are attractive because they are highly automatic: the user simply provides a description of the circuit implementation and its specification; the system does the res... |

71 |
Representing circuits more efficiently in symbolic model checking
- Burch, Clarke, et al.
- 1991
(Show Context)
Citation Context ...ct The temporal logic model checking algorithm of Clarke, Emerson, and Sistla [17] is modified to represent state graphs using binary decision diagrams (BDDs) [7] and partitioned transition relations =-=[10, 11]-=-. Because this representation captures some of the regularity in the state space of circuits with data path logic, we are able to verify circuits with an extremely large number of states. We demonstra... |

63 |
Verifying Temporal Properties of Sequential Machines Without Building their State Diagrams
- Coudert, Madre, et al.
- 1990
(Show Context)
Citation Context ...o CTL model checking [16, 17]. Burch, Clarke, McMillan and Dill [12] have developed a symbolic CTL model checker that uses transition relations to represent the circuit being verified. Coudert et al. =-=[20]-=- and Bose and Fisher [3] have described BDD-based algorithms for CTL model checking that use transition function vectors for this purpose. Since all three of these verification techniques are based on... |

48 |
The design of a self-timed circuit for distributed mutual exclusion
- MARTIN
- 1985
(Show Context)
Citation Context ...tributed Mutual Exclusion As another example, we considered the verification of an asynchronous circuit for ensuring mutually exclusive access to a shared resource. This circuit is also due to Martin =-=[27, 23]. The-=- circuit consists of a ring of c cells. Each cell communicates with a user of the resource and with its left and right neighbors in the ring. Mutual exclusion is ensured by having a single "token... |

47 | Formal hardware verification by symbolic ternary trajectory evaluation - Bryant, Beatty, et al. - 1991 |

34 |
Don’t care minimization of multi-level sequential logic networks
- Lin, Touati, et al.
- 1990
(Show Context)
Citation Context ...d Z 0 are swapped. Reverse reachability analysis has been studied by Filkorn [24], and it can be viewed as a generalization of a earlier methods for finding equivalent states in finite state machines =-=[26, 32]-=-. In some cases, an invariant can be computed much more quickly with reverse reachability analysis than forward, even if both methods compute the same invariant. As an extreme example, consider using ... |

29 |
New ideas on symbolic manipulations of finite state machines
- Berthet, Coudert, et al.
- 1990
(Show Context)
Citation Context ...ents of the circuit. Of the other groups mentioned above, only Bryant, Beatty and Seger [8] have demonstrated good asymptotic performance on a nontrivial class of circuits. Berthet, Coudert and Madre =-=[1]-=- did demonstrate verification times that were sublinear in the number of states in the system, but these times were still exponential in the number of components. The remainder of the paper is organiz... |

28 |
Formal verification of the encore gigamax cache consistency protocols
- McMillan, S
- 1991
(Show Context)
Citation Context ...appear nondeterministic even though it was originally deterministic. As an example of these two situations, consider the cache coherency protocol for the Encore Gigamax that McMillan has investigated =-=[29, 30, 31]-=-. The protocol was designed for a shared memory multiprocessor organized as a series of buses connected by an asynchronous hierarchical routing network. The caches on each bus are kept consistent usin... |

27 |
Automatic Verification of Synchronous Circuits Using Symbolic Logic Simulation
- Bose, Fisher
- 1989
(Show Context)
Citation Context ... 17]. Burch, Clarke, McMillan and Dill [12] have developed a symbolic CTL model checker that uses transition relations to represent the circuit being verified. Coudert et al. [20] and Bose and Fisher =-=[3]-=- have described BDD-based algorithms for CTL model checking that use transition function vectors for this purpose. Since all three of these verification techniques are based on CTL, they are able to h... |

25 | Formal verification of digital circuits using symbolic ternary system models
- Bryant, Seger
- 1991
(Show Context)
Citation Context ...ications that include unbounded liveness properties. Such specifications cannot be handled by other symbolic techniques for sequential circuit verification such as those described by Bryant and Seger =-=[9]-=-, Bose and Fisher [2], and Coudert et al. [18]. In addition, the algorithm of Burch et al. permits arbitrary CTL formulas to be used as fairness constraints [17]. A serious limitation of the approache... |

21 |
Verifying pipelined hardware using symbolic logic simulation
- Bose, Fisher
- 1989
(Show Context)
Citation Context ... unbounded liveness properties. Such specifications cannot be handled by other symbolic techniques for sequential circuit verification such as those described by Bryant and Seger [9], Bose and Fisher =-=[2]-=-, and Coudert et al. [18]. In addition, the algorithm of Burch et al. permits arbitrary CTL formulas to be used as fairness constraints [17]. A serious limitation of the approaches that use transition... |

17 |
ATPG aspects of FSM verification
- CHO, HACHTEL, et al.
- 1990
(Show Context)
Citation Context ...le transitions of the automata. For the latter, a transition function vector is used. This is a vector of BDDs, one for each state bit, that represents the next state logic of the circuit. Cho et al. =-=[15]-=- discuss a similar technique. Several groups have independently applied BDDs to CTL model checking [16, 17]. Burch, Clarke, McMillan and Dill [12] have developed a symbolic CTL model checker that uses... |

16 |
BSynthesis method for self-timed VLSI circuits
- Martin
(Show Context)
Citation Context ...nchronous Stack In this subsection, we compare conjunctive and disjunctive partitioned transition relations for verifying asynchronous circuits by considering an asynchronous lazy stack due to Martin =-=[28]-=-. To determine the asymptotic performance of the various methods discussed above, we performed a reachability analysis for stacks with varying depth d and word width w. This is sufficient to study the... |

14 |
A method for symbolic verification of synchronous circuits
- Filkorn
- 1991
(Show Context)
Citation Context ...ence between forward and reverse reachability analysis is that the transition relation is reversed, and the roles of S 0 and Z 0 are swapped. Reverse reachability analysis has been studied by Filkorn =-=[24]-=-, and it can be viewed as a generalization of a earlier methods for finding equivalent states in finite state machines [26, 32]. In some cases, an invariant can be computed much more quickly with reve... |

13 |
An improved algorithm for the automatic verification of finite state systems using temporal logic
- Browne
- 1986
(Show Context)
Citation Context .... If the model is represented as a state transition graph, the complexity of the algorithm is linear in the size of the graph and in the length of the formula. The algorithm is quite fast in practice =-=[5, 17]-=-. However, an explosion in the size of the model may occur when the state transition graph is extracted from a circuit, particularly if the circuit contains many registers or other memory elements. In... |

10 |
Testing containment of !-regular languages
- Kurshan
- 1986
(Show Context)
Citation Context ...e user in constructing a correctness proof. In contrast, the most effective techniques for reasoning about sequential behavior usually require a complete exploration of the state space of the circuit =-=[6, 21, 25]-=-. The state exploration techniques are attractive because they are highly automatic: the user simply provides a description of the circuit implementation and its specification; the system does the res... |

6 |
A unified framework for the formal verification of circuits
- Coudert, Madre
- 1990
(Show Context)
Citation Context ...tomata depend on the count j variables, so it is natural to put those variables at 1 There are actually two sequential benchmark circuits called KEY, one with 228 latches [34] and one with 56 latches =-=[19]-=-. We use the one with 228 latches. Width 4 8 16 32 64 128 Tenths of seconds 4 8 16 32 64 128 256 512 1024 2048 4096 2 3w TR partitions 3 TR partitions Figure 6: Verification times for MINMAX circuit t... |

2 | Symbolic model checking: lo2’ states and beyond - Burch, Clarke, et al. - 1990 |

1 | A method for symbolic verification of synchronous circuits - Filkom - 1991 |

1 | S’92-M’92) received the B.S. and M.S. degrees in computer science from the California Institute of Technology in 1984 and 1985, respectively, and the Ph.D. degree in computer science from Camegie Mellon University - Burch - 1992 |

1 | received the B.S. degree in computer science from the California - Long - 1993 |

1 | McMillsn received the Ph.D. in computer science from Camegie Mellon University in - Kenneth - 1992 |

1 | M’90) received the S.B. degree in computer science and engineering from the Massachusetts Institute of Technology in 1979 and the Ph.D. in Computer Science from Camegie Mellon University in 1987. He is an Assistant Professor of Computer Science at Stanfor - Dill |