Synthesizing Environment Invariants for Modular Hardware Verification

Word level property directed reachability

“…We considered benchmarks from the Grain suite [34] on discovering adequate environment abstractions for instruction-based (ILA) equivalence checking. Grain adopts an abstraction-refinement strategy to refine the environment by blocking spurious counterexamples that are found during equivalence checking, i.e., by solving a sequence of safety-verification tasks (encoded as CHC systems).…”

“…Table 1 outlines an experimental comparison of GSpacerbv, different versions of Spacer, and Eldarica. Additionally, the comparison to Grain itself and ABC [17] can be derived from [34]. While Grain can solve all the instances, it should be parametrized by tailor-made templates for invariants.…”

“…Another approach to get bit-precise invariants, proposed in [16], suggests to unsoundly translate machine integers by unbounded integers, use the LIA-verification tool and finally validate the resulting invariants on the original problem. Recently, in [34], it was proposed to to use user-given templates and Syntax-Guided Synthesis (SyGuS) [1] to guess-and-check bitprecise invariants. Our approach, in contrast, enjoys the native support for quantifier elimination and does not rely on predetermined predicates or templates, as well as on any external tools.…”

“…Automated verification makes extensive use of decision procedures for different theories in first-order logic. Whether a safety invariant or a counterexample is going to be found in software programs or in hardware designs, their first-order logic encodings are processed by solvers for satisfiability (SAT) [4,6,10,13,30] or satisfiability modulo theories (SMT) [17,19,[27][28][29]34]. Existing verification frameworks are designed such that plugging a theory solver does not require changing the verification workflow.…”

“…We refer the reader to[34] for a complete description of designs 7. https://github.com/Z3Prover/z3/releases/tag/z3-4.8.8.…”