Sugar 2.0 Formal Specification Language

1. Sugar 2.0Formal Specification Language Dana Fisman1,2 Cindy Eisner1 1IBM Haifa Research Laboratory 2Weizmann Institute of Science

2. Sugar2.0 • Sugar 2.0 is a formalism to reason about behavior over time • Uses of Sugar: • For documentation: easy to read, yet precise specification • Input to formal verification tools (model checker, theorem prover) • Input to simulation tools (source of automatically generated monitors )

3. Goals(in designing the language) • easy to learn, read and write • mathematically precise rigorously well defined formal syntax and semantics • sufficiently expressive permitting the specification of a large class of “real” world design properties • known efficient underlying algorithms • in simulation • in model checking (with reasonable complexity)

4. History 1994 Syntactic sugaring of CTL for RuleBase model checker 1995 Addition of regular expressions 1997 Automatic generation of simulation monitors 2001 Move to linear (LTL-based) semantics 2002 Selected by Accellera for IEEE standardization Sugar 1.0 Sugar 2.0

5. Track Record (Sugar 1.0) • IBM products: • Main Frame line (S/390) • Mid-range line (AS/400) • Workstation line (RS/6000) • PC line (Netfinity) • Super Computers (ASCI) • ASIC/OEM business • External licensees • University program

6. Structure of Sugar • Boolean layer Used to reason about states of the design • Temporal layer Used to reason about behavior of the design over time • Modeling layer Used to model auxiliary state variables and state machines • Verification layer Directives to the verification tool:

7. Structure of Sugar Sugar comes in three flavors: Verilog/VHDL/EDL • Boolean layer Used to reason about states of the design • Temporal layer Used to reason about behavior of the design over time • Modeling layer Used to model auxiliary state variables and state machines • Verification layer Directives to the verification tool:

8. s1 s2 s3 s4 … s1 s2 s3 s4 s5 s6 s7 The Temporal Layer • Boolean Expressions expressions evaluated over a single state • Sugar Extended Regular Expressions (SERE) expressions evaluated over a bounded sequence of states • Sugar Foundation Language expressions evaluated over finite or infinite sequence of states • Optional Branching Extension (OBE) expression evaluated over infinite trees of states (relevant for formal verification only) s

9. s1 s2 s3 s4 … s1 s2 s3 s4 s5 s6 s7 The Temporal Layer • Boolean Expressions • Sugar Extended Regular Expressions (SERE) expressions evaluated over a bounded sequence of states • Sugar Foundation Language expressions evaluated over finite or infinite sequence of states • Optional Branching Extension (OBE) expression evaluated over infinite trees of states (relevant for formal verification only) s

10. s1 s2 s3 s4 … s1 s2 s3 s4 s5 s6 s7 The Temporal Layer • Boolean Expressions • Sugar Extended Regular Expressions (SERE) expressions evaluated over a bounded sequence of states • Sugar Foundation Language expressions evaluated over finite or infinite sequence of states • Optional Branching Extension (OBE) expression evaluated over infinite trees of states (relevant for formal verification only) s

11. s1 s2 s3 s4 … s1 s2 s3 s4 s5 s6 s7 … … … … … The Temporal Layer • Boolean Expressions • Sugar Extended Regular Expressions (SERE) expressions evaluated over a bounded sequence of states • Sugar Foundation Language expressions evaluated over finite or infinite sequence of states • Optional Branching Extension (OBE) expression evaluated over infinite trees of states (relevant for formal verification only) s

12. Building Blocks (atoms) s1 s2 s3 s4 Properties … s1 s2 s3 s4 s5 s6 s7 … … … … … The Temporal Layer • Boolean Expressions • Sugar Extended Regular Expressions (SERE) • Sugar Foundation Language • Optional Branching Extension (OBE) s

13. Building Blocks (atoms) Properties The Temporal Layer • Boolean Expressions • Sugar Extended Regular Expressions (SERE) • Sugar Foundation Language • Temporal formulas where the atoms are Booleans • Temporal formulas where the atoms are SEREs • Temporal formulas where the atoms are Booleans and/or SEREs • Optional Branching Extension (OBE)

14. SEREs – Example1 A SERE describes a set of sequences of states (which we represent using timing diagrams) This diagram is described by the SERE

15. SEREs – Example1 This diagram is also described by the SERE

16. expressions evaluated over a bounded sequence of • states • expressions evaluated over a bounded sequence of • states SEREs – Example1 If we want to describe only this diagram we have to change the SERE

17. expressions evaluated over a bounded sequence of • states • expressions evaluated over a bounded sequence of • states 2SEREs – Example

18. expressions evaluated over a bounded sequence of • states • expressions evaluated over a bounded sequence of • states signal holds 4 times 2SEREs – Example

19. expressions evaluated over a bounded sequence of • states • expressions evaluated over a bounded sequence of • states signal holds any number of times between 3 to 5 signal holds any number of times 3SEREs – Example

20. Examples • Until now we saw examples for SEREs, which are not properties on their own, but rather building blocks of properties • We will now see examples of properties composed from the SERE building blocks

21. Examples – Properties The suffiximplicationoperator ifthe path starting now matches thenits continuation should match

22. But the property makes a requirement only for that holds at the very first cycle Add to the beginning of the first SERE then if Properties – Example1

23. Now the property makes a requirement for every no matter the cycles where it holds Note that the requirement is made for more than one (the first) then if Properties – Example1

24. Properties – Example1 Overlapping is also possible! then if then if

25. Properties – Example1 then if then if

26. Use instead of then if Properties – Example2 But what if data does not hold in contiguous cycles?

27. But what if the signals are only sampled when holds? 7 2 3 4 5 6 8 1 Apply to the entire property then if Properties – Example2

28. Now the property is evaluated only on the cycles where the holds Properties – Example2 then if

29. Properties – Example2 then if

30. Properties – Example2 1 2 3 then if

31. Expressiveness • Theory At least as expressive as • LTL • CTL • regular expressions • Practice All properties suggested by FVTC of Accellera are concisely and intuitively expressible in Sugar

32. Implementation • Sugar has a core of operators which determine its expressive power • Other operators are syntactic sugaring (abbreviations) of the core operators • A tool needs to implement • Only the core operators • Macro expansion of the syntactic sugaring operators

33. Implementation (of the core) • Any Sugar property can be reduced to an LTL or CTL property using auxiliary state machines. • CTL and LTL have known model checking algorithms. • For simulation we consider the subset that can be verified on-the-fly. For this subset there are simple transformation rules that transform the formula to a state machine describing all possible counter examples.

34. Sugar Home Page • More information available on the sugar home page at: • Complete definition • Tutorial • Sugar parser • Formal syntax and semantics • More … • www.haifa.il.ibm.com/projects/verification/sugar/index.html