## Formal Methods in VLSI System Design (1996)

Citations: | 3 - 1 self |

### BibTeX

@TECHREPORT{Aziz96formalmethods,

author = {Adnan Aziz},

title = {Formal Methods in VLSI System Design},

institution = {},

year = {1996}

}

### OpenURL

### Abstract

We apply mathematical logic to a number of problems arising in very large scale integration (VLSI) design automation. The first stage of this dissertation is concerned with techniques for the efficient verification of digital systems. We introduce heuristics based on Binary Decision Diagrams for efficiently representing designs specified as gate-level circuits. We also present an approach to verifying hierarchical designs which uses novel notions of state equivalence to simplify components. The second stage addresses the problem of synthesizing digital designs. We use the logic S1S to demonstrate that the flexibility available for optimizing components in hierarchical designs can be characterized by a finite state automaton. This approach is extended to the problem of synthesizing p...

### Citations

8513 |
Introduction to algorithms
- Gormen, Leiserson, et al.
- 1990
(Show Context)
Citation Context ...red by checking CHAPTER 6. SYNTHESIZING FINITE STATE MACHINES 60 the existence an accepting state which is reachable from the initial state; this can be tested in linear time using depth first search =-=[33]-=-. For a language L over \Sigma 1 \Theta \Sigma 2 defined by a -automaton M , it is natural to ask if L projected down to \Sigma 1 is also definable by a -automaton. The answer is in the affirmative. T... |

3825 |
Introduction to Automata Theory, Languages, and Computation
- Hopcroft, UlIman
- 1979
(Show Context)
Citation Context ...ich the output depends not only on the current input, but also on past values of the input, while possessing only a bounded amount of memory. Theoretical and practical aspect of FSMs are described in =-=[61]-=-; below we develop enough theory to suffice for this dissertation. Definition 3 A Finite state machine (FSM) is a quintuple (Q; I ; O; ; ffi ) where Q is a finite set referred to as the states, I , an... |

3202 |
Communication and Concurrency
- Milner
(Show Context)
Citation Context ... been projected is PSPACE--complete [110]. This motivates the search for conservative approximations to trace equivalence which are efficiently computable. We first studied the notion of bisimulation =-=[83]-=-, which can be viewed as a structural equivalence on the states of an FSM, when there are no fairness constraints. In Section 2.2 we defined bisimulation for different machines; this definition can be... |

2921 | Graph-based algorithms for Boolean function manipulation
- Bryant
- 1986
(Show Context)
Citation Context ...ns succinctly, while allowing efficient manipulation of these relations, is the reduced ordered many-valued decision diagram [111]. This is an extension on the reduced ordered binary decision diagram =-=[21]-=-. In order to keep the exposition in this chapter simple, we will restrict our attention to binary decision diagrams, while noting that the results immediately generalize to the many-valued case. Bina... |

2402 | Model checking
- Clarke, Schlingloff
- 2001
(Show Context)
Citation Context ...re 5.4: FSM M on inputs 0; 1 and outputs fREQ, ACK, IDLE, EOTg bisimulation equivalence can be used to identify equivalent states to derive smaller component machines. This technique has been used by =-=[31]-=-. However, in general we are interested in model checking a design with respect to a few formulas, and hence preserving all CTL formulas is unnecessary. In [7] we investigate a formula dependent equiv... |

2332 | Computational complexity
- Papadimitriou
- 1994
(Show Context)
Citation Context ... onto the end of a sequence in 2 and the operation of tacking on a 1 onto the end of a sequence in 2 ). A survey level treatment of these languages is given in [93]; a deeper analysis is available in =-=[85, 87]-=-. CHAPTER 1. INTRODUCTION 6 Deduction Grammar Language Calculus Logic Semantics Figure 1.2: Outline of a logical system In the discussion above there are literally, for example, many languages S1S, de... |

1499 |
The Temporal Logic of Reactive and Concurrent Systems, Specification
- Manna, Pnueli
- 1992
(Show Context)
Citation Context ...tion attempt to show that there is a formal proof of the formula defining the correctness criterion from the formulas characterizing the design and the axioms underlying the associated logical system =-=[75]-=-. This process is referred CHAPTER 1. INTRODUCTION 8 to as theorem proving, and the tools are referred to as theorem provers. The benefit of this approach is its generality. However generating the pro... |

1294 |
Symbolic Model Checking
- McMillan
- 1993
(Show Context)
Citation Context ... a decision procedure for FOE 2 -logic, which heuristically performs well on a number of applications related to verifying netlists. This observation was made independently by a number of researchers =-=[34, 79, 89, 115]-=-. 4.1 BDD variable ordering Recall that the graph of the transition function of a netlist j can be defined by a formula OE ffi j (x 1 ; x 2 ; : : : ; xn ; u 1 ; u 2 ; : : : ; u k ; y 1 ; y 2 ; : : : ;... |

1108 | Temporal and Modal Logic
- Emerson
- 1990
(Show Context)
Citation Context ... as proof checkers: the designer provides a proof, and the tool checks it. As a result theorem proving lacks the level of automation that is essential for a CAD tool to be very useful. Model checking =-=[41]-=- provides a different approach to the verification problem. The system is characterized by a finite labeled graph, sometimes referred to as a state transition graph (STG). Intuitively, the vertices re... |

794 |
Design and Synthesis of Synchronization Skeletons Using Branching-Time Temporal Logic
- CLARKE, EMERSON
- 1982
(Show Context)
Citation Context ...rs to use. The underlying computational techniques and issues are very similar, making an argument for providing both, an approach taken by the tool VIS [19]. 3.2 Complexity issues Clarke and Emerson =-=[30]-=- describes an efficient procedure for determining all states in an FSM that satisfy a formula f . The running time is proportional to j M j \Theta j f j. Thus the model checking problem can be solved ... |

598 |
A Mathematical Introduction to Logic
- Enderton
- 2002
(Show Context)
Citation Context ...show that the set of formulas derived from the rules given above exhibit the unique readability property -- given a formula in this class, it can be decomposed according to exactly one of these rules =-=[44]-=-. The use of underlines and 's, while necessary to avoid ambiguity, is cumbersome and is visually unappealing. We will henceforth discard use of them -- in all cases the meaning should be clear from t... |

503 |
Synthesis and Optimization of Digital Circuits
- Micheli
- 1994
(Show Context)
Citation Context ...ts (ASICs), digital signal processors (DSPs), microprocessors, etc. Indeed, some 85% of the integrated circuit market (in excess of 200 billion U.S. dollars in the year 1995) is made up of such chips =-=[82]-=-. For the reader interested in the issues arising in analog IC design, Gray and Meyer [49] give an excellent account of them. VLSI system design takes place in stages, starting from an abstract descri... |

477 |
Automata on infinite objects
- Thomas
(Show Context)
Citation Context ...nuum, and the class of liveness properties is identified with the collection of sets which are dense in the Cantor discontinuum. A detailed description of this treatment of properties is available in =-=[2, 114]-=-. 3.1 Verification paradigms In this section we describe three approaches that can be used to specify properties of designs. We also describe algorithms for checking these properties. 3.1.1 Invariant ... |

412 |
Computer-Aided Verification of Coordinating Processes: The AutomataTheoretic Approach
- Kurshan
- 1994
(Show Context)
Citation Context ...n (the subset construction) exponential in the number of states in M P . One approach to avoiding this complexity is the specification of the complement of the property, as is done in the tool COSPAN =-=[70]. This tak-=-es the form of an FSM M P with an initial state, no outputs, and a fairness constraint f ; an input sequence for which there is a corresponding fair path corresponds to "bad" behavior. In th... |

408 |
Introduction to VLSI systems
- Mead, Conway
- 1980
(Show Context)
Citation Context ...esentations. Optimization is critical in the synthesis process -- failure to do it yields designs which are unacceptable in terms of area, timing characteristics, testability, power consumption, etc. =-=[80]-=-. Clearly, there is much interplay between synthesis and analysis -- feedback from analysis tools is used to determine which components of the design need to be optimized, and synthesized designs are ... |

360 |
Sangiovanni_Vincentelll ""Logic Minimization Algorithms for VLSI Synthesis" Kluwer Academic Pub
- Brayton, Hachte, et al.
- 1984
(Show Context)
Citation Context ...be defined using a Boolean function. The second phase of synthesis consists of choosing a least cost implementation. This is typically achieved by solving some kind of an algorithmic covering problem =-=[18]-=-). Manipulating the complete set of permissible implementations is usually very difficult, since the representation becomes very large. Similarly, finding a least cost implementation is usually comput... |

336 |
On a decision method in restricted second order arithmatic. In Proceeding of the 1960 international Congress on Logic, Methodology. and Philosophy of Science
- Büchi
- 1962
(Show Context)
Citation Context ...s, i.e., the worst case blowup involved in translating from one to the other. 6.2.2 S1S S1S is a logistical system concerned with sequences over finite alphabets. It was studied in detail by Buchi in =-=[24]-=-; in particular it was shown to be decidable. S1S provides an extremely powerful mechanism for analyzing and manipulating sequential systems -- the expressiveness of logic (conjunction, negation, and ... |

334 |
On the Synthesis of a Reactive Module
- Pnueli, Rosner
- 1989
(Show Context)
Citation Context ... a logical specification, and finding an implementation (if one exists) which conforms to it; this implementation could take the form of a program for a Turing machine [76], a finite state transducer =-=[90]-=-, code for a digital signal processor [15], etc. In the VLSI CAD community, the specification comes from a higher level in the design process; generating a lower level realization is essentially a tri... |

319 |
Real Analysis
- Royden
- 1988
(Show Context)
Citation Context ...i.e. the class of subsets of U s 0 to which probabilities can be assigned. The transition probability matrix T yields the probability measure �� s 0 : C s 0 ! [0; 1]; by the measure extension theo=-=rem [99], ��-=-�� s 0 : C s 0 ! [0; 1] is well defined. Given a set fi of sequences over the alphabet 2 AP , we will abuse notation and refer to the probability of fi when we mean the probability of the set of all... |

303 |
Analysis and Design of Analog Integrated Circuits, 4 th Edition
- Gray, Hurst, et al.
- 2001
(Show Context)
Citation Context ...e integrated circuit market (in excess of 200 billion U.S. dollars in the year 1995) is made up of such chips [82]. For the reader interested in the issues arising in analog IC design, Gray and Meyer =-=[49]-=- give an excellent account of them. VLSI system design takes place in stages, starting from an abstract description, CHAPTER 1. INTRODUCTION 2 and proceeding to a concrete implementation. The process ... |

274 |
Topology, a First Course
- Munkres
- 1975
(Show Context)
Citation Context ...the system. The notions of safety and liveness can be made mathematically precise. Observe that there is a natural isomorphism between the set of finite valued ! sequences and the Cantor discontinuum =-=[86]-=-. Technically, the class of safety properties is identified with the collection of sets which are closed with respect to the topology of the Cantor discontinuum, and the class of liveness properties i... |

271 | Model checking and modular verification
- GRUMBERG, LONG
- 1994
(Show Context)
Citation Context ...he formulation for language containment is given in Section 5.1; extensions to model checking are sketched in Section 5.2. Many other compositional strategies exist for forming a reduced product e.g. =-=[72, 29, 50, 17]-=-. In the language containment paradigm our primary contribution is defining equivalences in the presence of fairness, and identifying a subset of these that can be easily computed. In the model checki... |

245 | A logic for reasoning about time and reliability
- Hansson, Jonsson
- 1994
(Show Context)
Citation Context ...maton; the proof of correctness is nontrivial due to the density of the underlying model of time. Formulations of quantitative approaches to probabilistic verification also exist. Hansson and Jonsson =-=[53]-=- describes an extension of CTL, referred to as PCTL, capable of expressing numerical bounds on the probability of specified properties; it is essentially identical to the logic pCTL defined in Section... |

234 | Protocol Verification as a Hardware Design Aid
- Dill, Drexler, et al.
- 1992
(Show Context)
Citation Context ...ngs. For example, there is some evidence that for loosely coupled asynchronous systems, such as cache coherency protocols, careful use of explicit data structures may be superior to BDD based methods =-=[38]-=-. This is because constants count -- asymptotically BDDs are as good as truth tables for representing relations; however the overhead associated with the underlying data structures results in the BDD ... |

232 | On the complexity of VLSI implementations and graph representations of Boolean functions with application to integer multiplication
- Bryant
- 1991
(Show Context)
Citation Context ... with a large data-path component. For example, it has been proved that representing the bits of the output of a circuit for an n bit multiplier takes \Theta(2 n ) BDD nodes for any variable ordering =-=[22]-=-. Bryant [23] has recently reported promising results on BDD-like data structures that can represent arithmetical relations on n-bit words efficiently. Similarly, Jones et al. [63] describe techniques... |

198 |
Temporal logic can be more expressive
- Wolper
- 1983
(Show Context)
Citation Context ...ffable in model checking and vice versa. An example of the former is the property stating that a particular output is high at each even time step; an example of the latter is initializability. Wolper =-=[123]-=- describes the exact trade-offs involved. As we saw in Section 2.2, a language can be associated with an FSM with a specified initial state. In the language containment paradigm in its most general fo... |

189 |
Software Synthesis from Dataflow Graphs
- Bhattacharyya, Murthy, et al.
- 1996
(Show Context)
Citation Context ...mplementation (if one exists) which conforms to it; this implementation could take the form of a program for a Turing machine [76], a finite state transducer [90], code for a digital signal processor =-=[15]-=-, etc. In the VLSI CAD community, the specification comes from a higher level in the design process; generating a lower level realization is essentially a trivial process. In this context, synthesis r... |

183 |
The equivalence problem for regular expressions with squaring requires exponential space
- Meyer, Stockmeyer
- 1972
(Show Context)
Citation Context ...rojected) languagessL (j;s) and L (j 0 ;s 0 ) equal? Complexity: EXPSPACE-complete; hardness follows by a reduction from a word problem, namely universality of regular expressions with exponentiation =-=[81]. In each -=-case, the complexity of verifying a compositional design is substantially higher than that of verifying a singe "flattened" component. Summary In this chapter we introduced several paradigms... |

179 | Recognizing safety and liveness
- Alpern, FB
- 1987
(Show Context)
Citation Context ...nuum, and the class of liveness properties is identified with the collection of sets which are dense in the Cantor discontinuum. A detailed description of this treatment of properties is available in =-=[2, 114]-=-. 3.1 Verification paradigms In this section we describe three approaches that can be used to specify properties of designs. We also describe algorithms for checking these properties. 3.1.1 Invariant ... |

177 |
Sipser M.: The Complexity of Finite Functions
- Boppana
- 1989
(Show Context)
Citation Context ...ell as allowing basic logical operations on relations to be performed efficiently. Succinctness issues related to the definability of finite relations are an area of deep research; Boppana and Sipser =-=[16]-=- provide a good survey of this subject. Below, we discuss some elementary facts about representing functions definable in FOE k -logic. The simplest way of representing a relation is by a table enumer... |

160 |
Introduction to probabilistic automata
- Paz
- 1971
(Show Context)
Citation Context ...ling systems where the transition probabilities are not completely specified; these systems allow notions of abstraction and refinement. Using characterizations of discrete Markov chains developed in =-=[88]-=- and results on the decidability of real closed fields (RCF) [14] we derive an elementary decision procedure for model checking pCTL over generalized discrete Markov chains. There is a body of past wo... |

146 | Implicit state enumeration of finite state machines using bdd’s - Touati, Savoj, et al. - 1990 |

139 |
Logic Verification Using Binary Decision Diagrams in a Logic Synthesis Environment
- Malik, Brayton, et al.
- 1988
(Show Context)
Citation Context ...on computations is the size of the BDD for the transition relation. The size of the BDD can critically depend on variable ordering; much work has gone into developing heuristics for variable ordering =-=[74, 47, 62, 100]-=-. Below, we describe a heuristic for deriving a variable order which often leads to a small BDD for the transition relation. Bounding BDD size McMillan [79] proved upper bounds on the size of BDDs for... |

131 |
The complementation problem for Büchi automata with applications to temporal logic
- Sistla, Vardi, et al.
- 1987
(Show Context)
Citation Context ... time provided the language of M P is not projected over any inputs. When the language of M P is projected over inputs, deciding CHAPTER 3. FORMAL VERIFICATION 32 containment becomes PSPACE--complete =-=[110]-=-; the only known ways require a construction (the subset construction) exponential in the number of states in M P . One approach to avoiding this complexity is the specification of the complement of t... |

118 |
The complexity of elementary algebra and geometry
- Ben-Or, Kozen, et al.
- 1986
(Show Context)
Citation Context ...y specified; these systems allow notions of abstraction and refinement. Using characterizations of discrete Markov chains developed in [88] and results on the decidability of real closed fields (RCF) =-=[14]-=- we derive an elementary decision procedure for model checking pCTL over generalized discrete Markov chains. There is a body of past work on applying formal methods to stochastic systems. An early app... |

116 | VIS: A system for Verification and Synthesis
- Brayton, Hachtel, et al.
(Show Context)
Citation Context ...3 which does not pass through a latch), while the node w 1 is driven by both primary inputs and latches. The definition given above of a netlist is essentially the data structure used by the tool VIS =-=[19]-=- to internally represent designs derived from HDL descriptions of gate/RTL level designs. Given a set of assignments to each input node and a state, one can uniquely compute the values of each node in... |

101 |
The monadic theory of order
- Shelah
- 1975
(Show Context)
Citation Context ...hese problems are undecidable. For example, the second order theory of the reals, which superficially at least, is the natural logic for synthesis of timed systems is undecidable by results of Shelah =-=[104]-=-. The challenge then would be to find fragments which are tractable, e.g. [63]. There is a deep relationship between synthesis and verification. Some of the theoretical aspects of this nexus are seen ... |

99 |
Cylindric algebras
- Henkin, Monk, et al.
- 1971
(Show Context)
Citation Context ...are described in [109]. Formalizing finite state systems using nondeterministic FSMs has the advantage of being mathematically simpler --- the entire theory can be developed using relational calculus =-=[58]-=-. We chose to employ deterministic FSMs for two reasons. Firstly, hardware designs naturally give rise to deterministic FSMs. Secondly, in practice it is computationally more efficient to compose func... |

99 | Formal Verification by Symbolic Evaluation of Partially-Ordered Trajectories
- Seger, Bryant
- 1995
(Show Context)
Citation Context ...rifying hardware. As mentioned previously, there are approaches which are rooted in theorem proving [112] which are more expressive, but harder to automate efficiently. Symbolic trajectory evaluation =-=[103]-=- is less expressive than CTL, but allows for more efficient verification. The PSPACE completeness of the model checking problem, (often referred to as state explosion) even in its simplest forms, simp... |

95 |
Finding the optimal variable ordering for binary decision diagrams
- Friedman, Supowitz
- 1990
(Show Context)
Citation Context ....2: Reduced ordered BDD for the relation defined by OE Ex (x 1 ; x 2 ; x 3 ; x 4 ) truth table, it is NP-complete to determine if an ordering exists which leads to a BDD of less than a specified size =-=[45]-=-. ffl A BDD representation is canonical; thus comparing two relations for equality is as simple as comparing two pointers. ffl Representation of the universal relation, and of the relation x i = 0 tak... |

93 | Verification of Arithmetic Circuits with Binary Moment Diagrarns
- Bryant, Chen
- 1995
(Show Context)
Citation Context ... data-path component. For example, it has been proved that representing the bits of the output of a circuit for an n bit multiplier takes \Theta(2 n ) BDD nodes for any variable ordering [22]. Bryant =-=[23]-=- has recently reported promising results on BDD-like data structures that can represent arithmetical relations on n-bit words efficiently. Similarly, Jones et al. [63] describe techniques for represen... |

93 |
Formal Hardware Verification Methods: A Survey". Formai Methods
- Gupta
- 1992
(Show Context)
Citation Context ...Similarly, Jones et al. [63] describe techniques for representing designs with uninterpreted functions. BDDs are not the only approach for coping with state explosion. There are many other approaches =-=[51]-=-. In the next Chapter we describe an approach that attempts to exploit the property being checked to simplify the design during the verification process. 45 Chapter 5 Compositional Methods In this cha... |

92 | sometimes" and "not never" revisited: on branching versus linear time temporal logic - Emerson, Halpern - 1983 |

91 | Verifying continuous time markov chains
- Aziz, Singhal, et al.
- 1996
(Show Context)
Citation Context ...corresponding results for CTL . Timing and fairness can also be analyzed in conjunction with probabilities; an extension of the results in this chapter have been made to continuous time Markov chains =-=[6]-=-. Several issues related to general Markov chains remain open. We would like to study restricted classes of general Markov chains in which the transition probabilities CHAPTER 8. STOCHASTIC SYSTEMS 10... |

87 |
Techniques for Automatic Verification of RealTime Systems
- Alur
- 1991
(Show Context)
Citation Context ...jor bottleneck in product development; in many cases the group performing verification is comparable in size to the design team itself. A formal methodology for verification consists of the following =-=[4]-=-: 1. A set of rules to generate formulas describing systems, and semantic functions that assign meaning to the formulas. 2. A set of rules to generate formulas defining the properties that are to be c... |

83 |
Model Checking, Abstraction, and Compositional Verification
- Long
- 1993
(Show Context)
Citation Context ...arge class of interesting properties, such reductions are conservative i.e. the property holds of the original design if it is true of the reduced design; however the converse it not necessarily true =-=[70, 72, 101]. Intuitiv-=-ely, this class consists of "universal" properties, i.e. properties which make some claim about all computational paths in the design satisfying some constraint. When the design is an FSM wh... |

78 |
A theory and implementation of sequential hardware equivalence
- Pixley
- 1992
(Show Context)
Citation Context ... a decision procedure for FOE 2 -logic, which heuristically performs well on a number of applications related to verifying netlists. This observation was made independently by a number of researchers =-=[34, 79, 89, 115]-=-. 4.1 BDD variable ordering Recall that the graph of the transition function of a netlist j can be defined by a formula OE ffi j (x 1 ; x 2 ; : : : ; xn ; u 1 ; u 2 ; : : : ; u k ; y 1 ; y 2 ; : : : ;... |

77 |
Algorithms for Discrete Function Manipulation
- Srinivasan, Kam, et al.
- 1990
(Show Context)
Citation Context ...data structure that can compactly represent a large class of useful relations succinctly, while allowing efficient manipulation of these relations, is the reduced ordered many-valued decision diagram =-=[111]-=-. This is an extension on the reduced ordered binary decision diagram [21]. In order to keep the exposition in this chapter simple, we will restrict our attention to binary decision diagrams, while no... |

74 |
Markov Chains
- Revuz
- 1975
(Show Context)
Citation Context ...uage defined by the linear specification, and composing it with the Markov chain -- the measure of the set of accepting states of this composed structure can be computed using accumulation techniques =-=[97]-=-. In order to give some intuition for the proof, we demonstrate the result for the pCTL model checking problem. We will abuse notation by implicitly extending the labeling of states to include subform... |

62 |
Analysis of cyclic combinational circuits
- Malik
- 1994
(Show Context)
Citation Context ...ame environment they yield different results. Our modeling of hardware in terms of finite state machines is not rich enough; the correct models require knowledge of the ternary behavior of the design =-=[25, 73, 107]-=- A Moore netlist is a netlist where there is no path from an input to an output which does not pass through a latch. Such a netlist can be put in the form shown on the left in Figure 2.8; it has the p... |