Symbol track value counting method and system based on satisfiability model theory solver and limit model detection

Abstract

The invention belongs to the field of model detection and symbol simulation, and relates to a symbol track value counting method and system based on a satisfiability model theory solver and limit model detection. The method comprises the following steps of: taking a hardware description language Chisel and a circuit specification described by extended track counting logic as input, reading the extended track counting logic through a preprocessing module, and performing logic synthesis and SMT (Surface Mount Technology) coding on a Chisel circuit; and the model detection rear-end module verifies the circuit specification based on SMT coding in combination with an STE algorithm and a BMC algorithm. According to the method, the respective advantages of the BMC and the STE are combined to enhance the solving capability of the symbol track value, the efficiency and the reliability of model detection are improved, meanwhile, the standard description capability of the STE is expanded on the Chisel level, and the verification process is greatly simplified.

Description

Technical Field

[0001] The present invention belongs to the field of model detection and symbolic simulation, and specifically relates to a symbolic trajectory evaluation method and system based on a satisfiability modulo theory solver and bounded model detection. Background Art

[0002] In the field of hardware design verification, model checking is an important verification method that uses automated formal verification to check hardware models in order to find errors. Its origin can be traced back to the 1980s, when it was mainly used to verify the correctness of hardware circuit modules. However, with the passage of time, its scope of application has continued to expand, and it is now widely used in various aspects of hardware design such as communication protocols, security protocols, control systems, and chip design. The main idea of ​​model checking is to convert hardware design into a mathematical model, and then use a model checking algorithm to perform automated formal verification on it. Among the many theories and tools used to verify hardware design, model checking has attracted much attention due to its concise and clear strategy and high degree of automation of the tool.

[0003] In the field of model checking, how to model and solve the model is the core technology that the algorithm relies on. Binary Decision Diagram (BDD), Satisfiability Problem (SAT) of Boolean Logic and Satisfiability Modulo Theories (SMT) are three important technologies, each of which plays a key role in the development of model checking algorithms. The history of BDD can be traced back to the 1980s, and it attracted attention due to the work of Randal Bryant. BDD is a data structure used to represent Boolean functions, which represents different decision paths by constructing a binary tree. This representation makes it possible to perform efficient model checking of Boolean functions, especially in the field of hardware verification and formal verification. SAT is a method to solve the satisfiability problem, that is, to determine whether a logical formula has a solution. In hardware model checking, SAT is widely used to verify the consistency and correctness of system design. By converting hardware design problems into SAT problems, existing SAT solvers can be used to quickly solve the problems. SMT is developed on the basis of SAT, which takes into account the situation where theories are included in logical formulas. In hardware model checking, SMT can handle more complex problems, such as taking into account properties of first-order logic and real number theory. It provides a more flexible way to describe and verify the properties of hardware systems. In general, BDD, SAT, and SMT have made outstanding contributions to the historical development of model checking and promoted the continuous evolution of formal verification technology. Different model checking methods often choose appropriate technologies from BDD, SAT, and SMT as the underlying engine for auxiliary verification based on their algorithmic characteristics.

[0004] With the rapid increase in the complexity and criticality of hardware design, the demand for efficient verification technology is also growing. Model checking algorithms verify the correctness of a system by fully exploring its state space, thus avoiding the tediousness and errors of manual verification. However, as the complexity of hardware continues to expand, problems such as state explosion and difficulty in solving large-scale circuits have brought considerable challenges to the development of model checking in the field of hardware design. In order to cope with the increasingly complex verification problems, a variety of excellent algorithms have emerged in the field of model checking, including but not limited to bounded model checking algorithms (Bounded Model Checking, referred to as BMC) and symbolic trajectory evaluation algorithms (STE).

[0005] STE is a model checking method combined with symbolic simulation, which is mainly used to analyze the behavior of the system, especially in the formal verification of large-scale circuits. Traditional model checking methods require accurate description of the state of a circuit as a Boolean value of 0 or 1, which causes the state space to increase sharply with the increase of the system scale (that is, the number of bits of all state variables), thus requiring a lot of computing resources and time. To solve this problem, STE introduces the "X+symbol" representation. By using X values ​​to describe one bit (unknown state) of the system and allowing the introduction of symbolic variables, an abstract symbolic representation method is used instead of explicitly enumerating all possible states, which greatly reduces the computing resources and time required for analysis. The state transition function of STE is based on the formal representation of the circuit netlist. Each register variable node represents the state of the system, and the input corresponds to a combinational circuit function. STE uses trace-valued logic to describe the specifications that the circuit should meet, which greatly enhances its specification expression ability. A complete STE specification is described by trace-valued logic and contains two parts: antecedent (Ant) and consequence (Cons), which represent the input constraints of the circuit at a certain moment and the property specifications that the circuit should meet at a certain moment, respectively. The underlying core technology of STE lies in how to efficiently perform symbolic simulation based on the trace evaluation logic. The overall circuit model is modeled and calculated using BDD. According to the register status at each moment and the value of the external input, symbolic simulation is used for calculation, and the calculated value is used to update the value of the register. By uniformly introducing the symbolic representation of Boolean values ​​and X values, STE can abstract the state into a higher-level representation and perform calculations at this abstract level, thereby achieving efficient symbolic simulation and model detection. At present, STE has been widely used in Intel's processor, chip, and memory designs. However, as the scale of circuits continues to expand, the BDD engine used in STE has begun to show its shortcomings, and there are too many states and problems that cannot be calculated.

[0006] BMC is a general model checking algorithm, which is a method to verify the properties of a system by exploring a finite state space. Although BMC is an incomplete verification algorithm, it has been widely used in the industry due to its easy implementation and efficient verification strategy. At present, the underlying solution engine of BMC is generally SAT solver and SMT solver. The algorithm strategy of BMC is not complicated. It takes the initial state, migration relationship and safety property of the circuit as input, and the migration relationship is an expression. If the SAT solver is used, it is a Boolean logic expression; if the SMT solver is used, it is an expression after theoretical expansion. First, the solver will determine whether the initial state satisfies the safety property. The judgment method is to negate the safety property and merge it with the initial state into a new expression, which is solved by the solver. If there is a solution, it means that the safety property is not satisfied in the initial state, and a counterexample is directly obtained and returned; if there is no solution, it means that the initial state satisfies the safety property, and the safety property can be verified in the next k steps. BMC will start from the initial state and expand the k-step transfer relationship (initial 1) to determine whether the circuit satisfies the transfer relationship at the kth step. If not, a counterexample is found and returned; if satisfied, it will continue to iterate and increase the number of steps until it reaches the set step threshold or terminates when resources are exhausted.

[0007] Generally speaking, hardware model checking tools need to use standard hardware description languages ​​as hardware model input. Verilog, as one of the most commonly used languages ​​for hardware design, is usually the first choice for standard input in model checking tools. Taking the STE open source tool VOSS as an example, it uses Verilog files as hardware model input. However, with the rise of more and more hardware description languages, while enhancing the hardware design process, there is also a problem of lack of corresponding verification tool ecology. In recent years, the Chisel program developed by Berkeley, as a powerful design tool for hardware agile development, has been integrated into the high-level programming language Scala, which has greatly improved development efficiency and has been widely accepted by hardware designers for the design of multiple processor chips. However, there is currently no verification tool directly based on Chisel hardware design with the backend as the STE engine. Summary of the invention

[0008] In order to solve the problems of insufficient computing power of existing STE tools due to BDD engines and lack of STE ecology in the new hardware description language Chisel, the present invention implements a new model checking system, called BMCSTE. Although traditional STE tools use trajectory evaluation logic to enhance specification description capabilities and accommodate forward property specifications and backward property specifications, they are limited by the BDD engine and are often unable to verify when processing large-scale circuits due to the excessive number of states. Although the traditional BMC does not have trajectory evaluation logic, its efficient verification strategy has been widely recognized by the industry. Therefore, BMC and STE are highly complementary in function. In addition, traditional STE tools cannot be directly applied to hardware description languages ​​and require additional functional languages ​​as auxiliary, which increases the complexity of the verification process and lacks support for the new hardware description language Chisel. Therefore, the BMCSTE system proposed in the present invention integrates a set of model checking tools based on SMT solvers, with STE as the main body and BMC as auxiliary, designed specifically for the Chisel platform. It expands the trace evaluation logic in STE at the Chisel syntax level, and innovatively expands the circuit model to better adapt to the application of STE's abstract ideas in SMT, and applies the strategy of using the SMT solver in BMC to calculate migration within a given number of steps to the idea of ​​STE trace evaluation and symbolization. The system combines the respective advantages of BMC and STE to enhance the symbolic trace evaluation solution capability, improve the efficiency and reliability of model detection, and expand the specification description capability of STE at the Chisel level, greatly simplifying the verification process.

[0009] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0010] A symbolic trajectory evaluation method based on a satisfiability modulo theory solver and bounded model detection comprises the following steps:

[0011] Taking the hardware description language Chisel and the circuit specification described by the extended trace evaluation logic as input, the extended trace evaluation logic is read through the preprocessing module and the Chisel circuit is logically synthesized and SMT encoded;

[0012] The circuit specifications are verified through the model detection back-end module based on SMT coding combined with STE algorithm and BMC algorithm.

[0013] Furthermore, in the model detection backend module, first for the kth step (initial 1), extract the premise and result of the kth moment in the extended trace evaluation logic, convert it into an equivalent SMT expression, add the premise to the first k steps, if there is a contradiction, it means that the circuit specification designer has written the circuit specification incorrectly and return, if there is no contradiction, then add the result to the first k steps to verify whether the result is satisfied. If the result is not satisfied, it means that the circuit design is wrong, find a counterexample and return, if the result is satisfied, then continue to iterate and increase the number of steps until the entire extended trace evaluation logic is verified or terminated after the resources are exhausted.

[0014] Specifically, the above method of the present invention comprises the following steps:

[0015] 1) One of the program inputs is a hardware description language in Chisel format. As a powerful design tool for hardware agile development, it has been used in the design of multiple processors and chips and is accepted by many designers. Chisel language is widely used in digital circuit and chip design. Compared with other hardware description languages, it has excellent extensions in terms of expression ability, abstraction level and parameterized design to better describe the behavior of circuits and systems. Usually, a Chisel file requires wires, logic gates, registers, input and output signals to describe circuit behavior and form a complete circuit.

[0016] 2) One of the program inputs is the STE circuit specification (STE Specification, referred to as STE-Spec). The specification syntax follows the trajectory evaluation logic, and in the present invention, it is extended to a certain extent according to the syntax rules of Chisel, called Extended Trajectory Evaluation Logic (ETEL). A complete circuit specification consists of two parts, the premise (Ant) and the result (Cons). The specific circuit specification format is as follows:

[0017] N={signal node in Chisel V={free variable / constant}

[0018]

[0019] ETEL=ETEL and ETEL

[0020] =Nt ETEL

[0021] =n is v,where n∈N and v∈V

[0022] =n is_fixedpoint v,where n∈N and v∈V

[0023] =n[Int:Int]is_bv v,where n∈N and v∈V

[0024] =n[Int][Int:Int]is_vec v,where n∈N and v∈V

[0025] =n is_bundle v,where n∈N and v∈V

[0026] =p→ETEL,where p∈V

[0027] Symbol explanation: N represents the set of all nodes in the circuit; V represents the set of all free symbolic variables or constants; n represents a node in the circuit, belonging to the set N; v represents a free symbolic variable or constant, belonging to the set V; p represents a free symbolic variable or constant, belonging to the set V.

[0028] Explanation: Line 2 indicates that a complete STE-Spec consists of a precondition (Ant) and a result (Cons). Ant and Cons are both expressions of Extended Trace Evaluation Logic (ETEL). The meaning of the formula is: if the precondition Ant is true, then the result Cons is also true. Line 3 indicates that two ETEL logics can be combined into a new ETEL logic through the "and" operator. This combinational logic is used to represent the situation where multiple conditions are true at the same time. Line 4 represents the sequential logic, which is represented by the keyword Nt (Next-time) to mark the circuit clock cycle corresponding to the current ETEL logic. It is used to describe the state of the ETEL logic in the next clock cycle. Line 5 binds the circuit node n (belonging to the set N, that is, the signal node in Chisel) with a free symbolic variable or constant v (belonging to the set V, that is, free variables / constants), which is the basic form of symbolic binding. Line 6 binds the circuit node n with a fixed-point number v, which is often used in image processing and neural network circuits. This is an extension of the fixed-point number type. Line 7 represents bit vector binding. A bit range of circuit node n is bound to the bit vector symbol variable v. Bit vectors are often used in hardware descriptions to represent multi-bit signals. Line 8 represents array type binding. An array element of circuit node n is bound to the symbol variable v. Array types are often used in hardware descriptions to represent a group of signals. Line 9 represents Chisel-specific type nested binding. Circuit node n is bound to the symbol variable v to represent complex data structures, such as nested record types. Line 10 represents index logic. Symbol p belongs to set V (representing free symbolic variables or constants), and the segmentation of different situations in the circuit is achieved by artificially constructing indexes.

[0029] 3) Among them, a complete STE-Spec consists of The composition represents whether the circuit based on Ant will produce the result corresponding to Cons. Among them, Ant and Cons are both extended trace evaluation logic (ETEL). ETEL contains eight kinds of logic. The first is connection logic, which means that two ETELs can be combined into a new ETEL. The second is sequential logic, which is referred to by the Nt keyword (Next-time, the next moment), marking the circuit clock cycle corresponding to the current ETEL. The third to seventh kinds are the core of the symbolic idea in STE. In a broad sense, it is to bind each node of the circuit, including register nodes, input and output signal nodes, to free symbolic variables or constants. In the traditional trace evaluation logic, since BDD technology is used as the technology of symbolic simulation, only one kind of Boolean symbolic variable is included. In the present invention, SMT solver is used as the underlying computing technology, and Chisel is type-expanded on the basis of traditional hardware description language. Therefore, the present invention similarly expands the trace evaluation logic according to the type definition of Chisel, corresponding to the third to seventh kinds of logic respectively. The third kind represents the symbolic variable binding of Boolean variables, signed integers, and unsigned integer type circuit nodes. The fourth type represents fixed-point numbers, which are often used in image processing and neural network circuits. The fifth and sixth types represent bit vectors and array types, respectively. The seventh type represents Chisel-specific type nesting. The eighth logic is the idea of ​​indexing in STE, which achieves the segmentation of different situations in the circuit by artificially constructing indexes.

[0030] STE-Spec is a specification description form designed by STE for hardware. Compared with the safety property in the traditional BMC specification description "the circuit should satisfy an invariant at every moment", its most outstanding advantage is that it can express both the forward property "what kind of output should there be for a certain input and state in the circuit" and the backward property "if a certain output appears in the circuit, what kind of input and state should exist at the previous moment", which greatly increases the expressive power of the specification.

[0031] 4) Use logic synthesis tools to synthesize the circuit and obtain a netlist-level circuit represented in Btor2 format. Btor2 is a quantifier-free formula format based on bit vectors and arrays, with general SMT semantics, and is often used in the field of hardware model detection. The circuit in Btor2 format constructs a circuit model equivalent to Chisel through a series of state variables and word-level operators. After that, the Btor2 netlist is encoded through SMT to obtain the transfer relationship of the circuit model, denoted as T.

[0032] 5) The encoding of the transition relationship T follows the common transition relationship in traditional model checking, instead of using the dual-track encoding in traditional STE or the illegal bit encoding in some new SMT tools to express X. The X encoding using dual-track encoding or illegal bit encoding may have a better effect in symbolic simulation at the bit level or word level. However, according to the experiments of the present invention, the general transition relationship and X encoding are respectively realized under the framework of the present invention. The experimental results show that under the framework of the present invention combined with BMC, the disadvantage of X encoding bringing additional state variables is far greater than the advantage of introducing X in the solution, so the general transition relationship has a better effect.

[0033] 6) For the premise (Ant) and result (Cons) in the STE circuit specification, the extended trace evaluation logic represented by the premise and result is converted into an equivalent SMT expression through SMT encoding. In particular, each circuit node appearing in the premise and result is marked according to the time, while the free variable does not need to retain the time information, in order to maintain equivalence with the transfer relationship T of the circuit model. The premise and result after SMT encoding are obtained, which are denoted as A and C respectively.

[0034] 7) For a given circuit specification, which implies a limit on the maximum number of state transition steps, the method of iteratively increasing the number of state transition steps is used to verify whether the entire circuit meets the specification in all cases. Assuming that it has been verified that the circuit meets the specification under the current state transition step number k=N, a similar bounded model detection algorithm is used to verify whether the circuit model meets the specification after N+1 step transition. First, for the transfer relationship T encoded in the Btor2 format circuit obtained by logic synthesis, N+1 steps are expanded to obtain a combinational circuit representing the N+1 step transition of the original circuit. Secondly, for A encoded by SMT in the STE circuit specification, the premise constraints of the previous N+1 moments are obtained for the SMT solver to call. For the premise constraints, it is necessary to judge whether the description is reasonable, that is, whether the premise itself may be inconsistent and conflicting with the circuit. The following SMT solution formula is used for judgment:

[0035]

[0036] Among them, ∧ represents logical AND, x i represents the state variable x in step i in BMC, x i+1 represents the state variable x at step i+1 in the BMC algorithm, and T represents the transition relationship of the circuit model. If the SMT formula has a solution, it means that the premise constraint description in the circuit specification is correct; otherwise, it means that there is a conflict between the premise and the circuit itself, and the circuit specification should be modified. i It means the following:

[0037]

[0038] Finally, the incremental SMT solver is used to determine whether the actual result of the circuit model is consistent with the result in the specification after the N+1 step transfer under the premise constraints of the previous N+1 moments. The solution formula is as follows:

[0039]

[0040] Among them, C N Indicates the SMT formula corresponding to the result when the clock cycle is N in the STE circuit specification, Indicates logical negation. If the SMT formula has no solution, it means that the circuit model meets the specification at the previous N+1 time points, and the current number of verified steps is increased to k=N+1, and the iteration continues; otherwise, it means that there is at least one counterexample path starting from the initial state, and the algorithm terminates.

[0041] The present invention also provides a symbolic trajectory evaluation system based on a satisfiability modulo theory solver and bounded model detection, which is a STE model detection system based on SMT and BMC, comprising a specification description front-end module, a preprocessing module, and a model detection back-end module;

[0042] The specification description front-end module is used by circuit specification designers to write circuit specifications based on the expanded trace evaluation logic;

[0043] The preprocessing module is used to perform logic synthesis and SMT coding on the circuit and circuit specification;

[0044] The model detection back-end module is used to verify the circuit specification based on SMT coding combined with BMC algorithm and STE algorithm.

[0045] Furthermore, the specification describes the front-end module, which is integrated in the Chisel project, expands the verification module according to the Chisel native test module, and uses the extended trace evaluation logic to write the circuit specification for verification.

[0046] Furthermore, the preprocessing module is used to perform high-level synthesis and logic synthesis on the circuit in Chisel format to obtain an equivalent circuit in Btor2 format at the netlist level, and encode the circuit specifications written in Btor2 and the specification description front-end module through SMT.

[0047] Furthermore, the model detection backend module is used to verify whether the Chisel circuit meets the written circuit specifications. Based on the SMT solver and the extended trace evaluation logic, the module continuously iterates and expands according to the maximum moment defined in the specification, and uses the premise in the circuit specification as a constraint to verify whether the expected results of the circuit specification are met at all times in the SMT solution method. The computing power of the traditional STE algorithm is enhanced by the BMC algorithm and the SMT solver.

[0048] With the development of STE, many similar tools have emerged to optimize STE based on traditional STE. Among them, the STEWord tool is more outstanding, which combines symbol simulation and invalid bit encoding to perform STE. Compared with these existing tools and technologies, the beneficial effects of the present invention are as follows:

[0049] 1. Underlying engine and computing power:

[0050] (1) Existing Work: Traditional STE tools rely on BDD engines for symbolic simulation. However, as the scale of circuits increases, BDD engines are often unable to handle large-scale circuits due to the state explosion problem. In addition, although STEWord introduces an SMT solver and combines abstraction and structural decomposition to improve verification efficiency, the verification strategy of symbolic simulation brings a bottleneck to verification efficiency.

[0051] (2) The present invention adopts a model checking tool based on an SMT solver, combining the advantages of STE and BMC. BMCSTE combines the verification strategies of STE and BMC, calculates the migration within a given number of steps through the SMT solver, and applies the strategy of BMC to the idea of ​​STE trajectory evaluation and symbolization. This combination not only improves the verification efficiency, but also enhances the solving ability of symbolic trajectory evaluation. And through the innovative transfer relationship encoding method, the verification efficiency is further improved.

[0052] 2. Hardware Description Language Support:

[0053] (1) Existing Work: Existing STE tools cannot be directly applied to hardware description languages ​​and require additional functional languages ​​such as FL as an aid, which increases the complexity of the verification process.

[0054] (2) The present invention is designed for the Chisel platform and is directly extended at the Chisel syntax level. Chisel is a new hardware description language that is widely used in digital circuit and chip design. The BMCSTE system simplifies the verification process by extending the trace evaluation logic at the Chisel syntax level, making it easy for engineers familiar with Chisel to use the tool.

[0055] 3. Ability to describe specifications:

[0056] (1) Existing Work: Traditional STE tools are limited to bit-level trace evaluation logic and mainly focus on three-valued logic models. Although STEWord has been expanded at the word level, its specification description capabilities are still relatively simple.

[0057] (2) The present invention: BMCSTE is extended on the basis of trace evaluation logic, which is called extended trace evaluation logic. It not only supports Boolean variables, but also supports signed integers, unsigned integers, fixed-point numbers, bit vectors, array types, and Chisel-specific type nesting. This greatly enhances the expressive power of the specification, and can more comprehensively describe circuit behavior and verify complex circuit designs. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is the overall flow chart of the symbolic trajectory evaluation model detection method based on the satisfiability modulo theory solver and bounded model detection of the present invention.

[0059] Figure 2 It is a structural schematic diagram of the symbolic trajectory evaluation system based on the satisfiability modulo theory solver and bounded model detection of the present invention.

[0060] Figure 3 It is the first-in-first-out queue circuit code written in Chisel in the embodiment.

[0061] Figure 4 It is an STE specification example of a first-in-first-out circuit written using the STE specification description interface provided by the present invention in the embodiment.

[0062] Figure 5 It is the STE specification code of the first-in-first-out circuit written using the STE specification description interface provided by the present invention in the embodiment. DETAILED DESCRIPTION

[0063] The scheme of the present invention is described in more detail below by way of examples:

[0064] The present invention is a method for evaluating symbolic trajectories based on a satisfiability modulo theory solver and bounded model detection, the process of which is as follows: Figure 1As shown. This method takes Chisel circuit and STE specification as input, performs logic synthesis of the circuit into Btor2 through the preprocessing module, and reads the migration relationship and STE specification corresponding to the circuit through SMT and encodes. In the model detection backend module, first verify whether the premise in the STE specification is valid within the k-step transfer of the circuit model. If the premise conflicts, it means that the specification description is incorrect. Otherwise, continue to verify whether the expected result is met under the premise. If not, it means that the circuit is wrong, and a counterexample path is obtained, and the program terminates; if it is satisfied, the number of transfer steps is increased by one, and it continues to iterate until the maximum depth is reached. Figure 1 In the example, Solver represents the solver, SmtSolver() represents the SMT solver, Solver.push() represents creating a new decision layer and saving the current solver state to the stack, Solver.pop() represents restoring the solver state to the state saved by the previous push() command, and C i It represents the SMT formula corresponding to the result when the clock cycle is i in the STE circuit specification.

[0065] The present invention provides a symbolic trajectory evaluation system based on a satisfiability modulo theory solver and bounded model detection, including a specification description front-end module, a preprocessing module and a model detection back-end module, such as Figure 2 The specific operation steps of each module are as follows:

[0066] 1. Standardize the front-end module

[0067] Taking the first-in-first-out queue circuit commonly used in industry as an example, the corresponding Chisel circuit code is as follows Figure 3 As shown, the circuit maintains a first-in, first-out queue. Given parameter w is 2 and parameter size is 2, the queue can store a maximum of two elements, and the number of bits of each element is two. For a queue, there are several input and output signals: rst reset signal, push queue input signal, pop queue input signal, dataIn data input signal, dataOut data output signal, and full queue full output signal.

[0068] For the first-in-first-out queue, construct the following STE specification, the schematic diagram and the corresponding code are as follows Figure 4 , Figure 5As shown. For a first-in-first-out queue, it is necessary to ensure that the elements are popped out in the correct order. Therefore, for this FIFO (which can store up to two elements), two data are pushed into it after reset. To express this situation using the trajectory evaluation logic in STE, the premise needs to be encoded. From time 0 to time 1, we want to express the reset logic, that is, "rst". At time 1-2 and 2-3, we want to express the data inflow, that is, "!rst&push&!pop". To express the specific data flowing in, we can bind the dataIn signal to the free variable, that is, "dataIn is d1 / d2". Then at time 3-4 and 4-5, we hope to pop data from the queue, and also encode the result, that is, "!rst&!push&pop". At this time, we need to verify whether the output signal meets expectations, so we need to encode the result, that is, "dataOut is d1&full", "dataOut is d2&!full", that is, the data pushed in at time 1 is popped out at time 3, and the data pushed in at time 2 is popped out at time 4. At time 3, the queue is full. When data is popped out at time 4, the queue is not full.

[0069] 2. Preprocessing module

[0070] According to the existing technology, the above Chisel code is synthesized using a logic synthesis tool to synthesize the above FIFO queue circuit to obtain the netlist-level circuit Btor2. The netlist-level circuit Btor2 and the STE specification written in the specification description front-end module are SMT-encoded using SMT to obtain the circuit transfer relationship T, the encoded premise A and the encoded result C. This becomes an instance that can be called by the SMT solver.

[0071] 3. Model detection backend module

[0072] (1) First, initialize the state transition step number to 1, expand the circuit transition relationship T by one step, and check the premise A under the current step number. 0 Is it legal, that is, whether it will conflict with the circuit, solve the following SMT expression:

[0073] T(x 0 , x 1 )∧Fst 0

[0074] Among them, rst 0 Represents the "rst" signal at time 0.

[0075] The above SMT expression has a solution, which means the premise is legal at the current step. We continue to check the expected result C at the current step. 1 Whether it is satisfied, since the expected result at time 1 is not defined in the STE specification, it is stipulated that C1 The default value is true, and the following SMT expressions are evaluated:

[0076]

[0077] The above SMT expression has no solution, which means that the expected result is met in the current situation. Increase the number of state transition steps by one.

[0078] (2) The current verified state transition is established when the number of steps is 1. Based on this, we continue to verify the transition when the number of steps is 2, expand the circuit transition relationship in two steps, and check the premise A under the current number of steps. 1 , that is, whether there will be a conflict with the circuit, solve the following SMT expression:

[0079]

[0080] Among them, rst 1 Indicates the "rst" signal at the first moment, push 1 Indicates the "push" signal at the first moment, pop 1 Indicates the "pop" signal at the first moment, data 1 It represents the "data" signal at the first moment, and d1 represents the free variable "d1".

[0081] The above SMT formula has a solution, which means the premise is legal at the current step. We continue to check the expected result C at the current step. 2 Whether it is satisfied, since the expected results at 2 moments are not defined in the STE specification, it is stipulated that C 2 The default value is true, and the following SMT expressions are evaluated:

[0082]

[0083] The above SMT expression has no solution, which means that the expected result is met in the current situation. Increase the number of state transition steps by one.

[0084] (3) The verification logic for state transition step 3 is similar to step 2, and data is also pushed in, as shown in step (2).

[0085] (4) The situation in the first three steps has been verified. Based on this, we can start to check whether the output of the queue meets the expected result. We continue to verify the situation when the number of transfer steps is 4, expand the circuit transfer relationship by two steps, and check the premise A under the current number of steps. 3 , that is, whether there will be a conflict with the circuit, solve the following SMT expression:

[0086]

[0087] Among them, rst 3 Indicates the "rst" signal at the third moment, push 3 Indicates the "push" signal at the third moment, pop 3 Indicates the "pop" signal at the third moment.

[0088] The above SMT expression has a solution, which means the premise is legal at the current step. We continue to check the expected result C at the current step. 4 To check whether the following SMT expression is satisfied, we need to solve it:

[0089]

[0090] Among them, data 4 Indicates the "data" signal at the 4th moment, full 4 Indicates the "full" signal at the 4th moment.

[0091] The above SMT expression has no solution, which means that the expected result is met in the current situation. Increase the number of state transition steps by one.

[0092] (5) The verification logic of the state transition step number 5 is similar to 4, which also verifies whether the output data meets expectations, as shown in (4).

[0093] (6) When the number of state transition steps reaches the maximum depth, a complete STE specification is verified and the result is returned: the circuit satisfies the given STE specification and the algorithm terminates.

[0094] In the above implementation, the present invention uses a satisfiability modulo theory solver and bounded model detection to improve the computational power of symbolic trajectory evaluation, effectively dealing with problems such as state space explosion that are difficult to handle with traditional model detection methods, and improving model verification efficiency. In addition, the present invention simplifies the difficulty of writing STE specifications and greatly improves the degree of automation of model detection.

[0095] Another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0096] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk), wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.

[0097] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. It can be understood by those skilled in the art that various replacements, changes and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the scope of protection of the present invention shall be subject to the scope defined in the claims.

Claims

1. A symbolic trajectory evaluation method based on satisfiability modulo theory solver and bounded model detection, characterized in that: The following steps are involved: Taking the hardware description language Chisel and the circuit specification described by the extended trace evaluation logic as input, the extended trace evaluation logic is read through the preprocessing module and the Chisel circuit is logically synthesized and SMT encoded; The circuit specifications are verified through the model detection back-end module based on SMT coding combined with STE algorithm and BMC algorithm.

2. The method according to claim 1, characterized in that In the model detection back-end module, first for the kth step, the premise and result of the kth moment in the extended trace evaluation logic are extracted, converted into an equivalent SMT expression, and the premise is added to the first k steps. If there is a contradiction, it means that the circuit specification designer has made an error in writing the circuit specification and returns. If there is no contradiction, the result is added to the first k steps to verify whether the result is satisfied; if the result is not satisfied, it means that the circuit design is wrong, find a counterexample and return. If the result is satisfied, continue to iterate and increase the number of steps until the entire extended trace evaluation logic verification is completed or the resources are exhausted.

3. The method according to claim 1, characterized in that The circuit specification described in the extended trace valued logic includes the premise Ant and the result Cons. The specific circuit specification format is as follows: N={signal node in Chisel V={free variable / constant} ETEL=ETEL and ETEL =Nt ETEL =n is v,where n∈N and v∈V =n is_fixedpoint v,where n∈N and v∈V =n[Int:Int]is_bv v,where n∈N and v∈V =n[Int][Int:Int]is_vec v,where n∈N and v∈V =n is_bundle v,where n∈N and v∈V =p→ETEL,where p∈V Among them, N represents the set of all nodes in the circuit; V represents the set of all free symbolic variables or constants; n represents a node in the circuit, belonging to the set N; v represents a free symbolic variable or constant, belonging to the set V; p represents a free symbolic variable or constant, belonging to the set V.

4. The method according to claim 3, characterized in that The premise Ant and the result Cons are both extended trace evaluation logic ETEL, which includes eight types of logic: the first is connection logic, indicating that two ETELs can be combined into a new ETEL; the second is timing logic, marking the circuit clock cycle corresponding to the current ETEL; the third represents symbolic variable binding of Boolean variables, signed integers, and unsigned integer type circuit nodes; the fourth represents fixed-point numbers, which are used in image processing and neural network circuits; the fifth and sixth represent bit vectors and array types respectively; the seventh represents Chisel-specific type nesting; the eighth is to achieve segmentation of different situations in the circuit by artificially constructing indexes.

5. The method according to claim 1, characterized in that The logic synthesis and SMT coding of the Chisel circuit include: The circuit is synthesized using a logic synthesis tool to obtain a netlist-level circuit represented in the Btor2 format; Encode the Btor2 netlist through SMT to obtain the transfer relationship of the circuit model, denoted as T; For the premise Ant and result Cons in the STE circuit specification, the extended trace evaluation logic represented by the premise and result is converted into an equivalent SMT expression through SMT encoding; each circuit node appearing in the premise and result is marked according to the time; free variables do not retain the information of the time to maintain equivalence with the transfer relationship T of the circuit model; The premise and result obtained after SMT encoding are denoted as A and C respectively.

6. The method according to claim 5, characterized in that The circuit specification verification based on SMT coding combined with STE algorithm and BMC algorithm includes: Assuming that it has been verified that the circuit meets the specification under the current state transfer step number k=N, then verify whether the circuit model meets the specification after N+1 step transfer, including: first, perform N+1 steps on the transfer relationship T to obtain the combinational circuit representing the N+1 step transfer of the original circuit; second, for A obtained by SMT encoding, obtain the premise constraints of the previous N+1 moments, and judge whether the premise constraints are reasonable through the following SMT solution formula: Among them, ∧ represents logical AND, x i represents the state variable x at step i in BMC, x i+1 represents the state variable x in the i+1th step of the BMC algorithm; if the SMT solution formula has a solution, it means that the description of the premise constraint in the circuit specification is correct; otherwise, it means that there is a conflict between the premise and the circuit itself, and the circuit specification should be modified; where A i It means the following: Then, the incremental SMT solver is used to determine whether the actual result of the circuit model is consistent with the result in the specification after the N+1 step transfer under the premise constraints of the previous N+1 moments. The solution formula is as follows: Among them, C N Indicates the SMT formula corresponding to the result when the clock cycle is N in the STE circuit specification, Indicates logical negation; if the SMT formula has no solution, it means that the circuit model meets the specifications at the previous N+1 moments, and the current number of verified steps is increased to k=N+1, and the iteration continues; otherwise, it means that there is at least one counterexample path starting from the initial state, and the algorithm terminates.

7. A symbolic trajectory evaluation system based on satisfiability modulo theory solver and bounded model detection, characterized in that: Includes specification description of front-end module, pre-processing module and model detection back-end module; The specification description front-end module is used by circuit specification designers to write circuit specifications based on the expanded trace evaluation logic; The preprocessing module is used to perform logic synthesis and SMT coding on the circuit and circuit specification; The model detection backend module is used to verify the circuit specification based on SMT coding combined with BMC algorithm and STE algorithm.

8. The system according to claim 7, characterized in that The preprocessing module performs high-level synthesis and logic synthesis on the circuit in Chisel format to obtain an equivalent circuit in Btor2 format at the netlist level, and encodes the circuit specifications written in Btor2 and the specification description front-end module through SMT; the model detection back-end module is based on the SMT solver and extended trace evaluation logic, and continuously iterates and expands according to the maximum moment defined in the specification, and uses the premise in the circuit specification as a constraint, and verifies whether the expected results of the circuit specification are met at all times by SMT solving.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 6 is implemented.

Images