Formal property verification by abstraction refinement with formal, simulation and hybrid engines

Abstract

We present RFN, a formal property verification tool based on abstraction refinement. Abstraction refinement is a strategy for property verification. It iteratively refines an abstract model to better approximate the behavior of the original design in the hope that the abstract model alone will provide enough evidence to prove or disprove the property.However, previous work on abstraction refinement was only demonstrated on designs with up to 500 registers. We developed RFN to verify real-world designs that may contain thousands of registers. RFN differs from the previous work in several ways. First, instead of relying on a single engine, RFN employs multiple formal verification engines, including a BDD-ATPG hybrid engine and a conventional BDD-based fixpoint engine, for finding error traces or proving properties on the abstract model. Second, RFN uses a novel two-phase process involving 3-valued simulation and sequential ATPG to determine how to refine the abstract model. Third, RFN avoids the weakness of other abstraction-refinement algorithms ---finding error traces on the original design, by utilizing the error trace of the abstract model to guide sequential ATPG to find an error trace on the original design.We implemented and applied a prototype of RFN to verify various properties of real-world RTL designs containing approximately 5,000 registers, which represents an order of magnitude improvement over previous results. On these designs, we successfully proved a few properties and discovered a design violation.

Automated Abstraction Refinement for Model Checking Large State Spaces Using SAT Based Conflict Analysis

“…This is shown to be a minimal abstraction. However, this leaves a large number of input variables in the abstract system and, consequently, BDD based model checking even on this abstract system becomes very difficult [19]. We propose an efficient method to pre-quantify these variables on the fly during image computation.…”

“…When dealing with systems with a large number of registers, quantifying so many variables for each image computation is expensive (e.g. [19]). An invisible variable can in the support of multiple partitions of the transition relation.…”

“…A static circuit minimum cut based structural method to reduce the number of invisible variables was proposed in [12] and used in [19]. Our method introduces approximations as needed based on actual image computation, while there method removes the variables statically.…”

Automatic assume guarantee analysis for assertion-based formal verification

“…We have enhanced the counterexample guided localization reduction algorithm in [12], and the proof-based without counterexample algorithm in [8], [6] to identify useful assumptions. The refinement algorithm in [12] is based on simulating the abstraction counterexamples on the concrete machines using 3-value simulation.…”

“…The refinement algorithm in [12] is based on simulating the abstraction counterexamples on the concrete machines using 3-value simulation. Our enhancement of this algorithm is very simple.…”