Computer

ScienceUniversity

of

Manchester

The

State

Evolution

Method

for

Verifying

Hardware

Systems

Howard

Barringer

Graham

Gough

Brian

Monahan

Alan

Williams

Technical

Report

FORMAL

VERIFICATION

SUPPORT

FOR

ELLA

IED

The

State

Evolution

Method

for

Verifying

Hardware

Systems

Howard

Barringer

Graham

Gough

Brian

Monahan

Alan

Williams

Department

of

Computer

Science

University

of

Manchester

Oxford

Road

Manchester

UK

email

howard@cs.man.ac.uk

July

Copyright

c

All

rights

reserved

Reproduction

of

all

or

part

of

this

work

is

permitted

for

educational

or

research

purposes

on

condition

that

-LRB-

-RRB-

this

copyright

notice

is

included

-LRB-

-RRB-

proper

attribution

to

the

author

or

authors

is

made

and

-LRB-

-RRB-

no

commercial

gain

is

involved

Recent

technical

reports

issued

by

the

Department

of

Computer

Science

Manchester

University

are

available

by

anonymous

ftp

from

ftp.cs.man.ac.uk

in

the

directory

pub/TR

The

files

are

stored

as

PostScript

in

compressed

form

with

the

report

number

as

filename

They

can

also

be

obtained

on

WWW

via

URL

Alternatively

all

reports

are

available

by

post

from

The

Computer

Library

Department

of

Computer

Science

The

University

Oxford

Road

Manchester

UK

Brian

Monahan

is

now

with

Harlequin

Ltd.

Alderley

Edge

Alan

Williams

acknowledges

additional

support

from

DRA

-LRB-

Malvern

-RRB-

and

Harlequin

Ltd

-LRB-

Cambridge

-RRB-

The

University

of

Manchester

acknowledges

support

from

the

SERC

via

research

grant

GR/F

A

poster

presentation

of

this

paper

will

be

given

at

CHARME

Frankfurt

Germany

October

Abstract

We

present

a

novel

state

evolution

method

for

establishing

standard

-LRB-

strong

-RRB-

bisimulation

which

gives

a

tractable

verification

approach

for

deterministic

machines

possibly

with

infinite

state-spaces

and

operates

at

an

abstract

level

The

problem

of

establishing

equivalence

is

reduced

to

one

of

proving

the

validity

of

a

set

of

simpler

-LRB-

first-order

-RRB-

logical

verification

conditions

generated

from

the

state

evolution

expressions

The

approach

maintains

a

high

degree

of

automation

a

feature

of

state-based

methods

whilst

offering

the

potential

of

containing

the

usual

growth

in

complexity

of

verification

one

advantage

of

using

theorem-proving

techniques

Introduction

One

approach

commonly

used

for

establishing

the

behavioural

equivalence

of

hardware

systems

uses

state-space

exploration

to

establish

a

bisimulation

relation

between

the

systems

modelled

as

labelled

transition

systems

-LSB-

-RSB-

It

has

the

distinct

advantage

of

being

automatic

and

can

produce

counter-example

information

when

a

verification

fails

although

this

is

usually

in

low

level

terms

of

traces

leading

to

divergence

However

it

suffers

from

the

problem

of

combinatorial

explosion

even

though

its

domain

of

applicability

can

be

significantly

extended

with

the

introduction

of

special

encodings

such

as

binary

decision

diagrams

-LRB-

BDDs

-RRB-

A

second

method

represents

system

behaviour

using

logical

expressions

and

then

establishes

equivalence

by

employing

theorem-proving

techniques

It

operates

abstractly

at

a

high

level

thus

not

necessarily

suffering

from

combinatorial

explosion

Further

when

two

systems

are

shown

to

be

different

it

may

be

possible

to

give

structured

debugging

feedback

information

at

the

level

of

the

initial

system

representation

Although

the

approach

can

be

automated

to

varying

degrees

it

currently

requires

significant

user

input

in

order

to

be

able

to

establish

design

equivalence

We

introduce

a

novel

verification

approach

which

effectively

merges

the

above

techniques

We

take

Park

and

Milner

's

standard

-LRB-

strong

-RRB-

bisimulation

equivalence

-LSB-

-RSB-

as

our

basic

notion

of

equivalence

between

labelled

transition

systems

We

present

the

transition

systems

abstractly

as

deterministic

machines

so

that

each

system

is

expressed

as

a

pair

of

-LRB-

response

and

evolution

-RRB-

functions

together

with

an

initial

state

The

between

the

systems

can

then

be

established

semi-automatically

through

a

state

evolution

rule

proceeding

in

a

truly

symbolic

manner

at

the

level

at

which

the

designs

are

expressed

The

state

evolution

rule

defines

a

pair

of

logical

expressions

whose

validity

establishes

the

strong

bisimulation

between

the

systems

However

because

of

the

structure

of

the

response

and

evolution

functions

in

the

deterministic

machines

each

logical

expression

can

be

further

analysed

and

decomposed

into

a

set

of

smaller

-LRB-

first-order

-RRB-

verification

conditions

-LRB-

VCs

-RRB-

the

conjunction

of

these

is

equivalent

to

the

original

expression

Each

VC

has

a

regular

form

which

significantly

eases

the

task

of

establishing

its

validity

using

a

standard

theorem-prover/proof

assistant

currently

we

use

the

PVS

proof

system

-LSB-

-RSB-

which

includes

decision

procedures

for

equalities

and

linear

arithmetic

reasoning

with

the

potential

for

a

high

degree

of

automation

The

problem

of

checking

for

bisimilarity

has

therefore

been

broken

down

via

the

state

evolution

rule

into

one

of

validating

sets

of

smaller

regularly

structured

VCs

In

fact

each

VC

fact

we

define

a

state

bisimulation

relation

between

the

state

spaces

of

the

two

machines

This

is

provably

equivalent

to

a

strong

bisimulation

between

the

derived

transition

systems

for

the

machines

can

be

generated

and

analysed

separately

if

any

is

found

to

be

invalid

then

the

two

systems

are

immediately

determined

to

be

different

without

any

further

work

being

necessary

The

user

can

therefore

monitor

and

control

the

progress

of

the

state

evolution

It

is

also

possible

for

the

user

to

apply

specific

design

knowledge

within

the

verification

process

thus

possibly

reducing

the

size

of

the

verification

task

expressions

can

be

abstracted

and

their

behaviour

represented

by

axioms

introduced

into

the

VCs

The

approach

described

offers

the

possibilityof

containingthe

usual

growth

in

complexity

of

verification

whilst

maintaining

a

high

degree

of

automation

Indeed

it

offers

the

possibility

of

verifying

bounded

diameter

systems

which

may

have

unbounded

state-spaces

such

systems

can

not

of

course

be

analysed

by

state-based

verification

methods

even

using

state-space

encodings

without

first

applying

transformations

to

the

systems

such

as

data-set

reduction

-LSB-

-RSB-

this

essentially

comes

for

free

with

our

method

Viewed

as

a

state-based

approach

the

method

establishes

bisimulation

in

a

truly

symbolic

way

thus

avoiding

many

aspects

of

combinatorial

explosion

The

logical

expressions

for

the

state

evolution

rule

effectively

characterise

the

bisimulation

relation

between

the

two

systems

Viewed

as

a

theorem-proving

approach

the

method

offers

automatic

generation

of

a

set

of

regularly

structured

VCs

from

the

original

design

descriptions

thus

decomposing

the

verification

task

The

VCs

are

simple

enough

to

be

amenable

to

automatic

validation

Note

that

we

have

restricted

the

method

described

here

to

apply

to

deterministic

systems

in

order

to

simplify

the

presentation

Of

course

this

means

that

-LRB-

strong

-RRB-

bisimulation

coincides

with

trace

equivalence

between

two

systems

However

the

method

can

be

extended

to

the

non-deterministic

case

although

there

will

be

an

associated

increase

in

complexity

Context

and

Related

Work

Our

work

on

foundations

and

verification

support

has

formed

part

of

a

collaborative

project

involving

Manchester

DRA

-LRB-

Malvern

-RRB-

Harlequin

Ltd.

-LRB-

Cambridge

-RRB-

and

GEC

Plessey

Semiconductors

-LRB-

Swindon

-RRB-

and

sponsored

by

the

DTI

and

SERC

In

this

we

have

developed

a

hardware

design

and

verification

environment

to

support

the

commercial

hardware

description

language

-LRB-

HDL

-RRB-

ELLA

-LSB-

-RSB-

A

formal

process

algebra

semantics

has

been

developed

for

ELLA

and

a

compiler

based

on

this

translates

ELLA

expressions

into

process

terms

representing

their

behaviour

The

process

terms

can

in

turn

be

translated

into

deterministic

machine

representations

The

aim

of

the

project

is

to

introduce

verification

support

into

industrial

design

methods

for

commercially

sized

systems

by

providing

semi-automatic

tools

which

can

be

operated

by

the

hardware

designer

and

do

not

require

extensive

formal

methods

expertise

A

second

requirement

is

that

the

verification

tool

can

provide

structured

debugging

information

at

the

ELLA

level

when

designs

are

found

to

be

different

The

methods

described

in

this

paper

fulfil

many

of

these

requirements

An

overview

of

work

from

the

project

appears

in

-LSB-

-RSB-

Background

to

the

work

presented

here

is

found

in

Milner

's

work

on

CCS

and

bisimilarity

-LSB-

-RSB-

More

recently

Hennessy

-LSB-

-RSB-

has

developed

techniques

for

modelling

infinite

data-spaces

and

constructing

their

bisimulations

the

VPAM

system

-LSB-

-RSB-

is

somewhat

similar

to

our

approach

of

proving

conditions

which

are

generated

when

constructing

a

state

bisimulation

Other

work

related

to

these

include

CIRCAL

-LSB-

-RSB-

There

has

been

extensive

research

into

state-based

verification

methods

such

as

model-checking

-LSB-

-RSB-

Although

these

have

been

traditionally

restricted

by

the

problem

of

state-explosion

the

capabilities

of

these

techniques

have

been

enhanced

by

the

introduction

of

compact

state-space

encodings

namely

ELLA

Project

World-Wide

Web

page

is

at

URL

BDDs

see

-LSB-

-RSB-

for

key

expositions

Commercial

verification

systems

are

now

emerging

based

on

such

techniques

for

example

the

VFORMAL

system

-LRB-

COMPASS

-RRB-

checks

equivalence

for

synchronous

systems

described

using

VHDL

However

the

state-spaces

of

the

systems

under

analysis

must

be

identical

here

Our

work

is

clearly

related

to

that

of

theorem-proving

sharing

many

of

the

benefits

of

this

approach

although

our

method

has

additional

advantages

in

terms

of

potential

ease

of

-LRB-

automated

-RRB-

proof

The

HOL

system

-LSB-

-RSB-

is

an

extensive

example

of

theorem-proving

tools

development

which

can

be

applied

to

design

verification

The

work

also

includes

a

system

for

semantically

embedding

HDLs

including

ELLA

into

HOL

-LSB-

-RSB-

The

related

MEPHISTO

tool

-LSB-

-RSB-

is

embedded

within

HOL

and

has

been

incorporated

into

a

hardware

design

framework

offering

partially

automated

verification

via

the

development

of

proof

tactics

suitable

for

hardware

systems

At

Edinburgh

operational

semantics

are

provided

for

simplified

versions

of

ELLA

and

embedded

into

the

LAMBDA

system

-LSB-

-RSB-

which

supports

the

semi-automated

synthesis

of

circuits

from

logical

constraints

The

PVS

proof

system

utilised

here

can

be

employed

to

model

systems

directly

and

then

to

support

the

required

proof

task

-LSB-

-RSB-

Currently

these

tools

based

on

theorem-proving

require

formal

methods

expertise

in

order

to

operate

them

In

-LSB-

-RSB-

a

symbolic

simulation

technique

for

high-level

processor

verification

is

described

which

performs

symbolic

reachability

analysis

on

the

product

state

machine

of

the

two

designs

Currently

however

this

can

lead

to

false

negatives

because

it

relies

on

syntactic

identity

to

determine

equality

between

the

expressions

involved

this

problem

does

not

arise

with

our

state

evolution

method

Structure

of

Paper

This

paper

has

the

following

structure

in

section

we

define

a

state

bisimulation

for

deterministic

synchronous

systems

and

relate

this

to

strong

bisimilarity

An

integer

latch

example

illustrates

the

approach

and

is

introduced

in

section

In

section

the

state

evolution

rule

is

presented

The

method

for

establishing

the

rule

using

verification

condition

generation

is

described

in

section

and

its

implementation

is

outlined

in

section

Section

shows

the

verification

of

the

latch

example

Deterministic

Machines

and

Labelled

Transition

Systems

We

describe

a

state

bisimulation

relation

for

deterministic

machines

P

and

Q

which

is

equivalent

to

strong

bisimilarity

between

processes

in

the

derived

labelled

transition

systems

TP

and

TQ

for

the

two

machines

An

accompanying

state

evolution

rule

defines

two

logical

expressions

whose

validity

establishes

state

bisimilarity

We

use

a

simple

example

of

integer

latch

designs

as

illustration

Note

that

even

in

this

example

the

bisimulation

relation

is

infinite

and

so

could

not

be

established

directly

using

standard

state

exploration

techniques

even

with

special

encodings

of

the

transition

relations

Deterministic

Machines

We

consider

a

system

described

as

a

deterministic

machine

D

in

the

following

way

let

I

O

be

sets

for

input

and

output

values

and

let

StD

be

the

state-space

for

D

Then

D

hiD

rD

eDi

where

iD

StD

initial

state

rD

-LRB-

I

StD

-RRB-

O

response

function

eD

-LRB-

I

StD

-RRB-

StD

evolution

function

State

Bisimulation

In

order

to

establish

the

equivalence

between

two

deterministic

machines

P

and

Q

we

introduce

the

following

state

bisimulation

relation

on

the

state

spaces

of

P

and

Q

Definition

State

Bisimulation

SB

is

a

state

bisimulation

for

deterministic

machines

P

Q

when

hiP

iQi

SB

If

hsP

sQi

SB

then

x

I

-LRB-

a

-RRB-

rP

-LRB-

x

sP

-RRB-

rQ

-LRB-

x

sQ

-RRB-

and

-LRB-

b

-RRB-

heP

-LRB-

x

sP

-RRB-

eQ

-LRB-

x

sQ

-RRB-

i

SB

Two

systems

P

and

Q

are

said

to

be

state

bisimilar

denoted

P

SB

Q

whenever

there

exists

a

state

bisimulation

SB

for

P

and

Q.

Derived

Labelled

Transition

Systems

State

bisimulation

can

be

related

to

the

standard

-LRB-

strong

-RRB-

bisimulation

between

processes

First

we

define

the

input/output

labelled

transition

system

TD

hPrcD

ActD

TransDi

corresponding

to

a

deterministic

machine

D

Here

PrcD

is

a

set

of

process

objects

ActD

-LRB-

I

O

-RRB-

is

the

set

of

input/output

actions

and

TransD

-LRB-

PrcD

ActD

PrcD

-RRB-

is

the

transition

relation

for

the

system

which

describes

how

a

process

p

PrcD

evolves

into

another

process

q

PrcD

by

making

an

input/output

transition

-LRB-

x

y

-RRB-

for

some

x

I

y

O

PrcD

fpD

-LRB-

sD

-RRB-

j

sD

StDg

TransD

fp

x

y

q

j

sD

StD

x

I

p

pD

-LRB-

sD

-RRB-

q

pD

-LRB-

eD

-LRB-

x

sD

-RRB-

-RRB-

y

rD

-LRB-

x

sD

-RRB-

g

where

pD

is

a

suitably

injective

mapping

from

the

state

space

of

D

into

process

Note

that

TD

will

be

input

deterministic

so

that

if

two

transitions

in

TransD

have

the

same

starting

process

and

the

example

if

the

set

of

process

objects

is

chosen

to

coincide

with

the

state-space

i.e.

PrcD

StD

then

the

mapping

pD

from

states

to

processes

may

be

the

identity

however

this

particular

correspondence

between

states

and

processes

is

not

a

necessary

condition

same

input

value

on

their

labels

then

they

will

have

the

same

destination

process

and

have

the

same

output

value

on

their

labels

Definition

-LRB-

Strong

-RRB-

Bisimilarity

We

take

equivalence

on

processes

to

be

the

strong

bisimilarity

of

Park

and

Milner

-LSB-

-RSB-

We

fix

the

transition

system

T

and

let

S

The

relation

S

is

a

-LRB-

strong

-RRB-

bisimulation

if

and

only

if

ffl

S

is

symmetric

ffl

hP

Qi

S

-RRB-

If

P

a

then

there

is

some

Q

such

that

Q

a

and

S

Two

processes

P

Q

are

said

to

be

bisimilar

denoted

P

Q

whenever

there

exists

a

strong

bisimulation

S

such

that

hP

Qi

S

The

required

association

between

the

state

bisimulation

relation

on

deterministic

machines

P

and

Q

and

the

-LRB-

strong

-RRB-

bisimulation

for

the

corresponding

labelled

transition

systems

TP

and

TQ

is

expressed

in

the

following

way

Theorem

Correctness

of

State

Bisimulation

Let

P

Q

be

deterministic

machines

-LRB-

pP

-LRB-

iP

-RRB-

pQ

-LRB-

iQ

-RRB-

-RRB-

-LRB-

P

SB

Q

-RRB-

where

pP

pQ

are

suitable

injective

mappings

from

the

state

spaces

of

P

Q

and

pP

-LRB-

iP

-RRB-

and

pQ

-LRB-

iQ

-RRB-

are

the

processes

derived

from

the

initial

states

of

the

two

machines

P

and

Q

This

says

that

there

is

a

state

bisimulation

between

machines

P

and

Q

if

and

only

if

there

is

a

strong

bisimulation

between

the

processes

derived

from

their

initial

states

with

respect

to

the

derived

transition

systems

TP

and

TQ

The

proof

is

straightforward

Example

Integer

Latch

As

a

simple

example

consider

the

following

two

implementations

of

an

enabled

integer

latch

The

basic

design

P

has

the

standard

structure

It

takes

a

data

input

in

Zand

an

enable

control

en

control

and

outputs

the

last

stored

value

m

When

en

old

then

the

latch

retains

the

old

value

and

when

en

new

the

current

input

value

in

is

stored

A

second

design

Q

is

intended

to

have

the

same

behaviour

as

P.

Here

the

latch

store

consists

of

two

registers

and

before

being

stored

an

input

value

is

first

split

into

its

low

and

high

components

using

the

arithmetic

operators

div

and

mod

and

an

offset

constant

A

Z.

On

output

the

original

value

is

retrieved

in

the

following

way

output

low

A?high

Deterministic

Machines

The

deterministic

machines

for

the

two

designs

are

as

follows

control

fnew

oldg

I

Z

control

O

Z

StP

Z

StQ

Z?Z

rP

-LRB-

hin

eni

m

-RRB-

m

eP

-LRB-

hin

eni

m

-RRB-

if

en

new

then

in

else

m

rQ

-LRB-

hin

eni

hlow

highi

-RRB-

low

A?high

eQ

-LRB-

hin

eni

hlow

highi

-RRB-

if

en

new

then

-LRB-

in

mod

A

in

div

A

-RRB-

else

-LRB-

low

high

-RRB-

for

some

constant

A

Z

with

the

initial

states

given

by

iP

iQ

Derived

Labelled

Transition

System

The

derived

labelled

transition

system

for

latch

designP

is

given

by

TP

hPrcP

IOActP

TransPi

where

PrcP

fpP

-LRB-

m

-RRB-

j

m

StPg

ActP

-LRB-

Z

control

-RRB-

Z

TransP

fpP

-LRB-

m

-RRB-

in

en

m

pP

-LRB-

n

-RRB-

j

m

in

n

Z

en

control

n

-LRB-

if

en

new

then

in

else

m

-RRB-

g

A

transition

system

for

design

Q

can

be

derived

in

a

similar

way

State

Bisimulation

We

claim

that

the

following

relation

SB

is

a

state

bisimulation

between

P

and

Q

and

that

the

two

designs

are

therefore

equivalent

in

the

sense

that

the

derived

labelled

transition

systems

TP

and

TQ

are

strongly

bisimilar

SB

StP

StQ

Z

-LRB-

Z?Z

-RRB-

fhx

-LRB-

v

w

-RRB-

i

j

x

StP

hv

wi

StQ

-LRB-

x

v

A?w

-RRB-

g

The

equivalence

of

P

and

Q

is

established

in

using

the

methods

presented

below

State

Evolution

The

problem

of

establishing

the

equivalence

of

two

systems

P

and

Q

has

now

been

defined

as

one

of

establishing

a

state

bisimulation

between

the

state

spaces

of

P

and

Q

This

can

be

performed

in

a

truly

symbolic

manner

by

using

the

state

evolution

rule

This

generates

a

set

of

verification

conditions

from

the

response

and

evolution

functions

for

P

and

Q

whose

validity

ensures

that

the

systems

are

-LRB-

state

-RRB-

bisimilar

The

idea

is

to

take

an

arbitrary

point

hsP

sQi

in

the

product

state

space

-LRB-

StP

StQ

-RRB-

As

we

know

nothing

about

this

point

to

start

with

we

can

simply

name

it

using

appropriate

symbolic

variables

We

then

proceed

to

symbolically

evolve

both

of

the

systems

checking

that

for

all

inputs

the

responses

produced

by

each

system

are

in

agreement

at

each

stage

Now

either

we

show

that

for

some

input

the

responses

disagree

at

some

stage

meaning

that

P

and

Q

are

different

or

we

demonstrate

that

the

symbolic

simulation

is

sufficiently

complete

implying

that

the

systems

P

and

Q

are

behaviourally

equivalent

So

the

main

issues

become

ffl

what

needs

to

be

proven

at

each

stage

ffl

what

are

the

criteria

for

termination

Let

us

imagine

that

we

are

at

stage

N

in

applying

the

method

and

so

we

consider

the

comparison

of

responses

for

the

current

step

based

upon

previous

steps

RN

-LRB-

sP

sQ

-RRB-

xN

rP

-LRB-

xN

spN

-RRB-

rQ

-LRB-

xN

sqN

-RRB-

where

spN

and

sqN

are

expressions

dependent

upon

inputs

and

initial

product

state

hsP

sQi

describing

symbolically

the

state

that

is

reached

after

input

steps

Therefore

RN

will

hold

if

the

responses

are

equal

at

step

N

in

the

symbolic

simulation

We

also

require

the

accumulating

version

of

R

ARN

-LRB-

sP

sQ

-RRB-

N

i

Ri

-LRB-

sP

sQ

-RRB-

We

should

now

check

two

things

check

that

we

continue

to

achieve

agreement

assuming

that

we

had

begun

from

the

initial

product

state

hiP

iQi

This

amounts

to

instantiating

the

above

formula

with

the

initial

state

and

showing

that

it

is

valid

check

to

see

if

we

can

show

that

on

the

basis

of

agreement

on

earlier

steps

N

agreement

of

response

is

actually

forced

for

the

next

step

N

If

the

first

check

fails

then

we

have

shown

that

the

systems

are

different

-LRB-

after

iterating

from

the

initial

state

-RRB-

and

so

we

should

then

abort

If

both

the

first

and

second

check

are

positive

then

we

stop

with

success

since

intuitively

we

have

shown

that

the

next

step

is

implied

by

the

immediate

past

history

Hence

the

systems

will

continue

to

behave

identically

if

a

starting

product

state

can

be

found

where

they

will

agree

for

N

steps

of

course

the

success

of

the

first

check

shows

that

this

has

already

been

achieved

from

the

initial

state

If

the

second

check

fails

then

we

proceed

to

the

next

stage

of

the

iteration

since

we

have

not

been

able

to

show

one

way

or

another

whether

the

two

systems

are

equivalent

or

not

Definition

State

Evolution

rule

We

now

give

the

State

Evolutioninference

rule

for

deterministic

systemsP

hiP

rP

ePi

and

Q

hiQ

rQ

eQi

For

some

fixed

N

N

-LRB-

a

-RRB-

G

ARN

-LRB-

iP

iQ

-RRB-

-LRB-

b

-RRB-

G

sP

sQ

ARN

-LRB-

sP

sQ

-RRB-

-RRB-

RN

-LRB-

sP

sQ

-RRB-

SE

G

P

SB

Q

The

theory

G

apart

from

containing

process

definitions

may

also

contain

design

assumptions

in

the

form

of

axioms

This

rule

says

that

if

we

can

establish

for

some

fixed

N

-LRB-

a

-RRB-

equivalent

responses

for

N

steps

from

the

initial

states

hiP

iQi

and

-LRB-

b

-RRB-

equivalent

response

for

step

N

from

states

hsP

sQi

follows

from

equivalent

responses

for

all

preceding

steps

from

the

states

hsP

sQi

then

we

can

conclude

that

the

two

machines

P

and

Q

are

state

bisimilar

This

also

means

by

Theorem

that

the

two

processes

pP

-LRB-

iP

-RRB-

and

pQ

-LRB-

iQ

-RRB-

are

strongly

bisimilar

as

required

with

respect

to

the

labelled

transition

systems

TP

and

TQ

derived

from

the

deterministic

machines

P

and

Q.

Soundness

of

State

Evolution

Rule

We

outline

the

strategy

for

demonstratingsoundness

which

is

to

show

that

if

the

premises

of

the

rule

hold

then

this

information

can

be

used

to

construct

a

state

bisimulation

between

the

deterministic

machines

P

and

Q

We

first

give

a

useful

property

of

the

step

predicate

AR

ARn

-LRB-

sP

sQ

-RRB-

-LRB-

sP

sQ

-RRB-

y

I

ARn

-LRB-

eP

-LRB-

y

sP

-RRB-

eQ

-LRB-

y

sQ

-RRB-

-RRB-

This

can

be

used

to

show

closure

properties

for

the

following

family

of

state-space

relations

Cn

-LRB-

StP

StQ

-RRB-

for

n

defined

by

Cn

fhsP

sQi

-LRB-

StP

StQ

-RRB-

j

ARn

-LRB-

sP

sQ

-RRB-

g

Observe

from

the

definition

that

the

Ci

relations

are

monotonically

decreasing

i.e.

Ci

Ci

for

all

i

Furthermore

we

can

show

that

y

I

hsP

sQi

Ci

heP

-LRB-

y

sP

-RRB-

eQ

-LRB-

y

sQ

-RRB-

i

Ci

It

can

be

shown

that

Ci

Ci

y

I

hsP

sQi

Ci

heP

-LRB-

y

sP

-RRB-

eQ

-LRB-

y

sQ

-RRB-

i

Ci

using

the

step

predicate

for

AR

which

relates

closure

under

step

with

containment

properties

between

them

It

is

now

relatively

straightforward

to

obtain

the

desired

theorem

Theorem

State

Evolution

as

State

Bisimulation

Suppose

that

we

have

established

the

following

for

some

fixed

N

-LRB-

a

-RRB-

G

ARN

-LRB-

iP

iQ

-RRB-

-LRB-

b

-RRB-

G

sP

sQ

ARN

-LRB-

sP

sQ

-RRB-

-RRB-

RN

-LRB-

sP

sQ

-RRB-

Then

with

respect

to

G

CN

is

a

state

bisimulation

for

P

and

Q

This

follows

because

clause

-LRB-

a

-RRB-

says

that

the

initial

states

are

in

CN

and

clause

-LRB-

b

-RRB-

says

that

CN

is

closed

under

step

Termination

The

state

evolution

method

described

above

will

terminate

for

any

two

deterministic

systems

P

and

Q

when

they

are

not

equivalent

The

method

will

also

always

terminate

when

P

and

Q

are

finite

However

clearly

termination

is

not

always

guaranteed

for

arbitrary

equivalent

systems

since

the

problem

is

undecidable

A

sufficient

condition

for

termination

involves

considering

the

form

of

the

product

machine

-LRB-

P

Q

-RRB-

a

deterministic

machine

has

bounded

diameter

whenever

it

requires

a

bounded

number

of

steps

to

proceed

from

any

-LRB-

reachable

-RRB-

state

to

any

other

state

that

is

reachable

from

it

The

state

evolution

method

will

then

terminate

when

the

product

machine

has

a

bounded

diameter

and

the

set

of

its

reachable

states

covers

the

product

state-space

For

example

for

machines

which

are

finite

state

or

have

a

bounded

history

then

the

product

machines

will

have

bounded

diameter

and

the

state

evolution

rule

will

therefore

terminate

A

machine

P

has

a

bounded

history

if

its

starts

in

a

state

sP

and

when

it

has

received

a

finite

number

of

inputs

then

the

response

of

the

system

is

independent

of

sP

Pseudo-code

for

the

method

Taking

P

and

Q

to

be

fixed

from

now

on

the

following

response

formula

Rsp

-LRB-

v

sP

sQ

-RRB-

is

the

basic

property

of

interest

and

asserts

that

the

responses

of

deterministic

systems

P

and

Q

agree

when

stepping

from

a

given

pair

of

states

hsP

sQi

via

input

v

I.

Rsp

-LRB-

v

sP

sQ

-RRB-

rP

-LRB-

v

sP

-RRB-

rQ

-LRB-

v

sQ

-RRB-

Using

the

above

notation

the

pseudo-code

for

the

method

is

presented

in

Figure

Note

that

StateEvolution

simultaneously

checks

the

validity

of

the

two

premises

-LRB-

a

-RRB-

and

-LRB-

b

-RRB-

in

the

state

evolution

rule

The

logical

expressions

Inst-Resp-Form

and

Response-Form

represent

respectively

the

response

formulae

for

premises

-LRB-

a

-RRB-

and

-LRB-

b

-RRB-

at

step

i

Ng

the

former

starts

from

the

initial

state

pair

hiP

iQi

of

machines

P

and

Q

whereas

the

latter

starts

from

an

arbitrary

state

pair

hsP

sQi

i.e.

variables

universally

quantified

over

the

two

state-spaces

The

auxiliary

functions

used

have

the

following

behaviour

program

StateEvolution

-LRB-

G

P

Q

N

-RRB-

begin

G

hiP

rP

ePi

P

hiQ

rQ

eQi

Q

Input-Var-List

-LSB-

-RSB-

State-Term-P

sP

State-Term-Q

sQ

loop

for

i

in

N

do

calculate

new

input

variable

Input-Var

New-Var

-LRB-

-RRB-

Var-List

Input-Var

Input-Var-List

calculate

response

formulae

Response-Form

Compute-Response

-LRB-

Input-Var

State-Term-P

State-Term-Q

-RRB-

Response-Form

Close-Vars

-LRB-

Var-List

Response-Form

-RRB-

Inst-Resp-Form

Instantiate

-LRB-

Response-Form

fsP

iP

sQ

iQg

-RRB-

perform

simplification/validity

checks

if

-LRB-

Check-Valid

-LRB-

Inst-Resp-Form

-RRB-

and

Check-Valid

-LRB-

G

Response-Form

-RRB-

-RRB-

then

G

fResponse-Formg

-LSB-

G

else

return

-LRB-

false

-RRB-

end

calculate

next

state

expressions

State-Term-P

Next-State

-LRB-

G,eP,Input-Var

State-Term-P

-RRB-

State-Term-Q

Next-State

-LRB-

G,eQ,Input-Var

State-Term-Q

-RRB-

endloop

calculate

new

input

variable

for

N

Input-Var

New-Var

-LRB-

-RRB-

Var-List

Input-Var

Input-Var-List

calculate

response

formula

Response-Form

Compute-Response

-LRB-

Input-Var

State-Term-P

State-Term-Q

-RRB-

Response-Form

Close-Vars

-LRB-

Var-List

Response-Form

-RRB-

perform

final

validity

check

Check-Valid

-LRB-

G

Response-Form

-RRB-

end

Figure

State

Evolution

method

Pseudocode

Compute-Response

-LRB-

i

sP

sQ

-RRB-

computes

the

formula

Rsp

-LRB-

i

sP

sQ

-RRB-

Check-Valid

-LRB-

G

;P

-RRB-

in

principal

checks

for

first-order

validity

of

G

j

P.

Next-State

-LRB-

G

e

x

s

-RRB-

computes

the

term

e

-LRB-

x

s

-RRB-

and

simplifies

it

relative

to

appropriate

definitions

in

G.

Close-Vars

-LRB-

vars

;P

-RRB-

calculates

the

universal

closure

vars

P

Instantiate

-LRB-

P

q

-RRB-

calculates

the

instantiation

of

P

by

the

substitution

q

New-Var

-LRB-

-RRB-

delivers

a

fresh

variable

Verification

Condition

Generation

We

consider

deterministic

systems

where

the

task

of

checking

the

agreement

of

the

response

forms

at

each

stage

performed

by

Check-Valid

-LRB-

G

;P

-RRB-

is

greatly

simplified

due

to

their

regular

nature

Function

expressions

for

the

response

and

evolution

functions

use

a

case

statement

as

their

control

structure

where

the

chooser

sets

or

guards

on

the

case

arms

are

disjoint

and

covering

Functions

F

and

G

which

depend

on

an

input

x

can

be

written

as

follows

F

-LRB-

x

-RRB-

k

i

-LRB-

Ai

-LSB-

x

-RSB-

-RRB-

ti

-RRB-

G

-LRB-

x

-RRB-

m

j

-LRB-

Bj

-LSB-

x

-RSB-

-RRB-

uj

-RRB-

where

Ai

-LSB-

x

-RSB-

Bj

-LSB-

x

-RSB-

are

the

control

guards

possibly

dependent

on

input

x

and

ti

uj

are

the

-LRB-

case-less

-RRB-

expressions

to

be

evaluated

for

each

guard

This

means

that

for

any

particular

selection

value

precisely

one

branch

will

be

chosen

The

function

equalities

from

the

state

evolution

rule

can

then

be

converted

into

a

functional

normal

form

in

the

following

way

F

-LRB-

x

-RRB-

G

-LRB-

x

-RRB-

FNF

i

j

-LRB-

Ai

-LSB-

x

-RSB-

Bj

-LSB-

x

-RSB-

-RRB-

ti

uj

-RRB-

where

the

terms

ti

and

uj

are

case-less

Each

equality

is

translated

into

a

conjunction

of

verification

conditions

-LRB-

VCs

-RRB-

A

VC

is

regularly

structured

as

an

implication

where

the

conclusion

is

an

equality

and

the

premise

is

a

conjunction

of

constraints

and

equalities

as

follows

-LRB-

-LRB-

constrk

-RRB-

-LRB-

equalitym

-RRB-

-RRB-

concl

-RRB-

where

i

kg

constri

-LRB-

vari

seti

-RRB-

i

mg

equalityi

-LRB-

lhs-expri

rhs-expri

-RRB-

concl

-LRB-

-RRB-

All

variables

are

universally

quantified

over

appropriate

data

sets

This

simple

structure

enables

the

validity

checking

for

each

VC

to

be

highly

automated

using

a

standard

algebraic-solving

tool

without

the

need

to

resort

to

the

more

general

capabilities

of

a

first-order

theorem-prover

Complexity

The

number

of

VCs

which

are

generated

for

a

particular

pair

of

designs

is

naturally

highly

dependent

on

the

exact

structure

of

the

designs

involved

Let

design

P

have

a

total

control

branching

of

m

and

Q

have

a

branching

of

n.

Let

N

be

the

-LRB-

fixed

-RRB-

number

of

steps

required

by

the

state

evolution

rule

this

is

usually

related

to

the

latency

within

the

designs

and

to

their

testability

The

worst-case

number

of

VCs

will

then

be

O

-LRB-

-LRB-

mn

-RRB-

N

-RRB-

This

assumes

that

the

control

structures

of

the

two

designs

are

effectively

independent

so

that

every

control

branch

in

one

design

must

be

checked

against

every

branch

in

the

other

design

However

in

practice

if

the

systems

have

been

designed

with

the

intention

of

their

being

equivalent

then

it

is

likely

that

the

control

structures

will

intersect

certain

VCs

will

be

trivially

true

and

can

be

discarded

because

the

constraints

on

control

variables

are

contradictory

So

consider

the

case

when

the

control

structures

coincide

completely

then

the

number

of

VCs

generated

will

be

O

-LRB-

mN

-RRB-

This

can

be

observed

with

the

latch

example

in

Implementation

A

verification

condition

generation

-LRB-

VCG

-RRB-

tool

has

been

implemented

in

Common

Lisp

and

installed

into

a

design

and

verification

environment

-LSB-

-RSB-

for

the

commercial

hardware

description

language

ELLA

To

check

the

equivalence

of

ELLA

designs

they

are

first

compiled

into

deterministic

machines

according

to

the

formal

semantics

of

ELLA

-LSB-

-RSB-

The

VCG

then

constructs

the

logical

expressions

for

the

premises

of

the

state

evolution

rule

the

user

supplies

the

number

of

steps

required

It

then

converts

the

function

expressions

representing

the

machines

into

functional

normal

form

and

merges

the

resulting

elements

for

each

control

branch

to

form

a

set

of

VCs

The

VCG

also

performs

extensive

simplification

discarding

those

VCs

which

is

can

determine

to

be

true

The

remaining

set

of

VCs

is

then

converted

into

a

format

suitable

for

the

PVS

theorem

prover

-LSB-

-RSB-

which

can

be

used

to

establish

the

validity

of

the

VCs

If

the

VCs

are

satisfiable

but

not

valid

then

the

VCG

may

be

re-run

for

a

larger

number

of

state

evolution

steps

For

further

details

of

the

implementation

of

the

VCG

together

with

several

examples

of

design

verification

see

-LSB-

-RSB-

Latch

Example

Verification

For

the

latch

example

described

in

the

state

evolution

rule

-LRB-

Definition

-RRB-

needs

to

be

applied

for

a

single

step

i.e.

N

The

step

premise

-LRB-

b

-RRB-

from

the

state

evolution

is

given

by

rP

-LRB-

-RRB-

rQ

-LRB-

-RRB-

-LRB-

-RRB-

eP

-LRB-

-RRB-

eQ

-LRB-

-RRB-

-RRB-

rP

-LRB-

-RRB-

rQ

-LRB-

-RRB-

-RRB-

-LRB-

-RRB-

The

left-hand

side

gives

the

step

premise

in

terms

of

the

response

and

evolution

functions

of

P

and

Q

and

the

right-hand

side

simply

restates

the

logical

expression

for

the

premise

Note

also

that

the

initial

premise

-LRB-

a

-RRB-

from

the

state

evolution

rule

contains

the

antecedents

from

above

with

i.e.

it

is

given

by

-LRB-

-RRB-

design

and

verification

environment

is

built

on

top

of

the

LispWorks

programming

environment

-LSB-

-RSB-

which

is

a

trademark

of

and

produced

by

Harlequin

Ltd.

-LRB-

Cambridge

UK

-RRB-

Functional

Normal

Form

Each

equality

from

above

can

be

translated

into

functional

normal

form

For

example

the

FNF

for

the

expression

eQ

-LRB-

-RRB-

is

given

by

Z

control

fnewg

-RRB-

mod

A

div

Ai

control

fnewg

-RRB-

Verification

Conditions

The

other

expressions

are

expanded

in

a

similar

way

and

the

resulting

FNFs

are

then

merged

and

simplified

This

results

in

the

following

two

VCs

for

the

step

premise

of

the

state

evolution

rule

fnewg

A

mod

A

div

Ai

-RRB-

A

control

fnewg

A

-RRB-

A

Note

that

merging

of

the

FNFs

initially

results

in

four

VCs

two

each

result

from

expanding

eP

and

eQ

since

the

control

variable

en

can

make

two

choices

However

two

of

the

VCs

contain

contradictions

in

the

constraints

for

when

-LRB-

fnewg

-RRB-

from

eP

and

-LRB-

control

fnewg

-RRB-

from

eQ

and

vice

versa

The

VCG

can

detect

the

contradictions

in

the

set

expressions

and

immediately

discard

the

two

VCs

Also

note

that

the

disjointness

and

covering

of

the

control

branches

of

the

two

evolution

functions

eP

eQ

is

exploited

when

merging

the

FNFs

to

generate

the

VCs

Figure

shows

the

implemented

VCG

tool

displaying

the

second

VC

from

above

having

performed

further

simplifications

to

remove

the

variable

bindings

The

VC

has

been

converted

into

a

format

suitable

for

PVS

Proof

of

VCs

In

order

to

prove

the

second

VC

then

the

following

axiom

is

required

by

PVS

which

characterises

exactly

the

property

of

div

and

mod

used

to

develop

latch

Q

AXIOM

-LRB-

FORALL

-LRB-

x

int

-RRB-

-LRB-

y

int

-RRB-

-LRB-

-LRB-

y

-RRB-

IMPLIES

-LRB-

y

div

-LRB-

x

y

-RRB-

mod

-LRB-

x

y

-RRB-

x

-RRB-

-RRB-

-RRB-

Both

VCs

can

now

be

proved

in

PVS

in

at

most

two

user

steps

once

the

expressions

have

been

converted

into

sequent

form

and

the

universally

quantified

variables

replaced

by

Skolem

names

First

the

axiom

div

ax

is

installed

as

a

rewrite

rule

and

then

the

automated

PVS

simplification

routines

and

arithmetic

decision

procedures

-LSB-

-RSB-

are

invoked

to

complete

the

proof

without

further

user

intervention

So

the

two

latch

designs

are

therefore

equivalent

as

claimed

in

Here

the

VCG

has

already

automatically

discarded

two

VCs

during

merging

because

the

constraints

were

contradictory

The

two

remaining

VCs

generated

have

a

regular

structure

and

designer

knowledge

is

used

during

the

proof

via

the

div

ax

axiom

Notice

also

how

the

size

of

the

input

data

set

does

not

affect

the

proof

in

any

way

the

number

of

VCs

generated

is

dependent

on

the

size

of

the

control

branching

and

the

pure

data

components

have

been

abstracted

Figure

Verification

Condition

Generator

Summary

We

have

introduced

a

novel

state

evolution

approach

for

determining

the

behavioural

equivalence

in

the

sense

of

Park

and

Milner

's

strong

bisimulation

of

state-machine-like

representations

of

two

deterministic

synchronous

hardware

systems

The

approach

can

operate

on

bounded

diameter

systems

which

may

have

unbounded

state-space

due

to

perhaps

infinite

data-sets

The

state

evolution

rule

is

used

to

determine

whether

a

bisimulation

holds

This

effectively

generates

a

set

of

regularly

structured

verification

conditions

which

can

be

presented

to

standard

first

order

logic

theorem

proving

tools

The

method

offers

the

potential

of

a

high

degree

of

automation

and

also

of

containing

the

usual

growth

in

complexity

of

verification

When

systems

are

found

to

be

different

then

debugging

feedback

information

can

be

presented

at

the

level

of

the

original

design

descriptions

A

verification

condition

generation

tool

has

been

implemented

and

embedded

into

a

design

and

verification

environment

for

the

commercial

HDL

ELLA

with

encouraging

results

A

description

of

an

extension

to

the

state

evolution

method

to

non-deterministic

systems

will

be

presented

in

a

future

paper

References

-LSB-

-RSB-

R.

Milner

Communication

and

Concurrency

Prentice

Hall

-LSB-

-RSB-

N.

Shankar

S.

Owre

and

J.

M.

Rushby

The

PVS

Proof

Checker

A

Reference

Manual

-LRB-

Beta

Release

-RRB-

Technical

report

Computer

Science

Laboratory

SRI

International

March

-LSB-

-RSB-

R.

Kurshan

Reducibility

in

Analysis

of

Coordination

In

Lecture

Notes

in

Control

and

Information

Sciences

volume

pages

Springer

-LSB-

-RSB-

J.

D.

Morison

and

A.

S.

Clarke

A

Language

for

Electronic

System

Design

McGraw-Hill

-LSB-

-RSB-

H.

Barringer

G.

Gough

B.

Monahan

and

A.

Williams

A

Process

Algebra

Foundation

for

Reasoning

about

Core

ELLA

Technical

Report

University

of

Manchester

December

-LSB-

-RSB-

M.

Hennessy

and

H.

Lin

Proof

Systems

for

Message-Passing

Process

Algebras

Technical

Report

University

of

Sussex

-LSB-

-RSB-

H.

Lin

A

Verification

Tool

for

Value-Passing

Processes

Technical

Report

University

of

Sussex

April

-LSB-

-RSB-

G.

A.

McCaskill

and

G.

Milne

Hardware

Description

and

Verification

Using

the

Circal-System

Technical

Report

Department

of

Computer

Science

University

of

Strathclyde

June

-LSB-

-RSB-

E.M.

Clarke

E.A.

Emerson

and

A.P.

Sistla

Automatic

Verification

of

finite

state

concurrent

systems

using

Temporal

Logic

Specifications

ACM

Transactions

on

Programming

Languages

and

Systems

-LRB-

-RRB-

-LSB-

-RSB-

H.

Barringer

M.

Fisher

and

G.D.

Gough

Fair

SMG

and

Linear

Time

Model

Checking

In

Sifakis

-LSB-

-RSB-

-LSB-

-RSB-

R.E.

Bryant

Graph-Based

Algorithms

for

Boolean

Function

Manipulation

IEEE

Transactions

on

Computers

-LRB-

-RRB-

-LSB-

-RSB-

J.R.

Burch

E.M.

Clarke

and

D.E.

Long

Representing

Circuits

More

Efficiently

in

Symbolic

Model

Checking

In

-LSB-

-RSB-

O.

Coudert

C.

Berthet

and

J-C

Madre

Verification

of

Synchronous

Sequential

Machines

based

on

Symbolic

Execution

In

Sifakis

-LSB-

-RSB-

-LSB-

-RSB-

M.

Gordon

and

A.

Pitts

The

HOL

logic

and

system

-LRB-

Chapter

-RRB-

In

J.

Bowen

editor

Towards

Verified

Systems

pages

Elsevier

October

-LSB-

-RSB-

R.

Boulton

M.

Gordon

J.

Herbert

and

J.

Van

Tassel

The

HOL

Verification

of

ELLA

Designs

Technical

report

University

of

Cambridge

Computer

Laboratory

-LSB-

-RSB-

K.

Schneider

R.

Kumar

and

T.

Kropf

Automating

Most

Parts

of

Hardware

Proofs

in

HOL

In

K.

Larsen

editor

Computer

Aided

Verification

-LRB-

CAV

-RRB-

LNCS

volume

Aarlborg

Denmark

July

SpringerVerlag

-LSB-

-RSB-

K.G.W.

Goossens

Embedding

Hardware

Description

Languages

in

Proof

Systems

PhD

thesis

University

of

Edinburgh

-LSB-

-RSB-

N.

Shankar

Verification

of

Real-Time

Systems

Using

PVS

In

C.

Courcoubetis

editor

Computer

Aided

Verification

-LRB-

CAV

-RRB-

LNCS

volume

Elounda

Greece

June

Springer-Verlag

-LSB-

-RSB-

F.

Corella

Automated

High-Level

Verification

against

Clocked

Algorithmic

Specifications

In

D.

Agnew

L.

Claesen

and

R.

Camposano

editors

CHDL

Canada

North-Holland

-LSB-

-RSB-

H.

Barringer

G.

Gough

B.

Monahan

and

A.

Williams

The

ELLA

Verification

Environment

A

Tutorial

Introduction

Technical

Report

University

of

Manchester

December

-LSB-

-RSB-

Harlequin

Ltd

Cambridge

UK

Information

about

LispWorks

is

available

on

the

World-Wide

Web

URL

-LSB-

-RSB-

H.

Barringer

G.

Gough

B.

Monahan

and

A.

Williams

Formal

Verification

Support

for

the

ELLA

Hardware

Description

Language

A

Review

To

appear

in

Frankfurt

Germany

October

-LSB-

-RSB-

J.

Sifakis

editor

Automatic

Verification

Methods

for

Finite

State

Systems

LNCS

volume

Grenoble

France

Springer-Verlag

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

automatic hardware verification
hardware design aids
symbolic verification
theorem-proving