Automata-theoretic verification of systems

• US 6,185,516 B1
• Filed: 10/07/1997
• Issued: 02/06/2001
• Est. Priority Date: 03/06/1990
• Status: Expired due to Fees

• Current Assignee: Nokia of America Corporation (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Hardin, Ronald H., Kurshan, Robert Paul
• Primary Examiner(s): Teska, Kevin J.
• Assistant Examiner(s): Sergent, Douglas W.
• Application Number:
  US08/946,473
• Time in Patent Office: 1,218 Days
• Field of Search: 395/500.23, 395/500.35, 395/500.36, 395/500.05, 395/500.06, 395/500.07, 703/2, 703/14, 703/15, 716/4, 716/5, 716/6
• US Class Current: 703/2
• CPC Class Codes: G06F 30/3323 using formal methods, e.g. equivalence checking or property checking

Abstract

Verification systems which employ automata-theoretic formal verification use a model automaton made from a system process (203) representing the system and a task automaton (205) representing the task and use the model automaton to test (217) whether the language of the system process is contained in the language of the task automaton. An improved technique reduces the computational complexity of the language containment testing by producing a model (216) which represents a system which has been automatically localized with regard to a task. Another technique reduces the computational complexity of stepwise refinement (208). In stepwise refinement, the system automaton is refined a step at a time until it reaches the complexity of a practical implementation. The computational complexity of the stepwise refinement is reduced by a technique which permits language containment to be tested using a set of models made from process-automaton pairs rather than process-process pairs.

Claims

1. Improved design testing apparatus for making a determination whether a design performs a task, the design testing apparatus being of the type which includes means for making the determination by testing a model automaton including variables and the improvement comprising:

a processor operable to create a directed graph of dependency relations of the variables; and

means for using the directed graph to make a reduced version of the model automaton,

wherein said means for using the directed graph comprises means for reducing the size of the directed graph to form a reduced version of the directed graph,

wherein said means for reducing comprises means for resizing variables having a value upon which the performance of the reduced version of the model automaton does not depend,

the design testing apparatus making the determination by testing the reduced version of the model automaton.

2. Improved design testing apparatus for making a determination whether a design performs a task, the design testing apparatus being of the type which includes means for making the determination by testing a model automaton including variables and the improvement comprising:

a processor operable to create a directed graph of dependency relations of the variables;

means for using the directed graph to make a reduced version of the model automaton, wherein said means for using the directed graph comprises means for reducing the size of the directed graph to form a reduced version of the directed graph; and

means for freeing a set of variables each said freed variable thereby being treated as a primary input for said reduced model automaton.

3. The improved design testing apparatus of claim 2 further comprising:

means for revising said set of freed variables if said task is performable by said reduced version of the model automaton.

4. A method for testing a design to determine whether the design defines a task, the method comprising:

constructing a model automaton, the model automaton being of the type that includes variables;

creating a directed graph of dependency relations of the variables;

using the directed graph to make a reduced version of the model automaton,

wherein said step of using comprises the step of reducing the size of the directed graph to form a reduced version of the directed graph,

wherein said step of reducing comprises the step of resizing variables having a value upon which the reduced version of the model automaton does not depend; and

determining whether the design defines the task using the reduced version of the model automaton.

5. A method for testing a design to determine whether the design defines a task, the method comprising:

constructing a model automaton, the model automaton being of the type that includes variables;

creating a directed graph of dependency relations of the variables;

using the directed graph to make a reduced version of the model automaton, wherein said step of using comprises the step of reducing the size of the directed graph to form a reduced version of the directed graph;

freeing a set of variables, each said freed variable thereby being treated as a primary input for said reduced model automaton; and

determining whether the design defines the task using the reduced version of the model automaton.

6. The method of claim 5 further comprising the step of:

revising said set of freed variables of said task performable by said reduced version of the model automaton.

7. A method used in design verification apparatus for verifying that a first process is a valid refinement of a second process, the design verifications apparatus being of the type which tests whether a process'"'"'s language is contained in an automaton'"'"'s language, there being a language homomorphism between the language of the first process and the language of the second process and the method comprising the steps performed in the design verification apparatus of:

making a set of simple strongly deterministic automata which have languages such that the intersections of the languages is equivalent to the language of the second process; and

testing whether the language of the first process is contained in the language of each of the simple strongly deterministic automata, wherein the testing step determines whether the first process is a valid refinement of the second process.

8. A design testing apparatus for determining whether a design performs a task, the design testing apparatus including means for testing a model automaton having variables, the apparatus comprising:

a processor operable to create a directed graph of dependency relations of the variables; and

a reducer for using the directed graph to make a reduced version of the model automaton, the reduced version of the model automaton being localized with respect to the task, wherein the apparatus determines whether the reduced version of the model automaton performs the task.

9. Improved design testing apparatus for making a determination whether a design performs a task, the design testing apparatus being of the type which includes means for making the determination by testing a model including variables and the improvement comprising:

a processor operable to create a directed graph of dependency relations of the variables;

means for using the directed graph to make a reduced version of the model, wherein said means for using the directed graph includes means for reducing the size of the directed graph to form a reduced version of the directed graph, wherein said means for reducing includes means for resizing variables having a value upon which the performance of the reduced version of the model does not depend, wherein the apparatus determines whether the reduced version of the model performs the task.

10. Improved design testing apparatus for making a determination whether a design performs a task, the design testing apparatus being of the type which includes means for making the determination by testing a model including variables and the improvement comprising:

a processor operable to create a directed graph of dependency relations of the variables;

means for using the directed graph to make a reduced version of the model, wherein said means for using the directed graph includes means for reducing the size of the directed graph to form a reduced version of the directed graph, wherein said means for reducing comprises means for freeing a set of variables each said freed variable thereby being treated as a primary input for said reduced model, wherein the apparatus determines whether the reduced version of the model performs the task.

11. The improved design testing apparatus of claim 10 further comprising means for revising said set of freed variables if said task is performable by said reduced version of the model.

12. A method for testing a model of a design to determine whether the design defines a task, the model being of the type that includes variables, the method comprising:

creating a directed graph of dependency relations of the variables;

using the directed graph to make a reduced version of the model, wherein said means for using the directed graph includes means for reducing the size of the directed graph to form a reduced version of the directed graph, wherein said means for reducing includes means for resizing variables having a value upon which the performance of the reduced version of the model does not depend; and

determining whether the reduced version of the model performs the task.

13. A method for testing a model of a design to determine whether the design defines a task, the model being of the type that includes variables, the method comprising:

creating a directed graph of dependency relations of the variables;

using the directed graph to make a reduced version of the model, wherein said means for using the directed graph includes means for reducing the size of the directed graph to form a reduced version of the directed graph;

freeing a set of variables, each said freed variable thereby being treated as a primary input for said reduced model; and

determining whether the reduced version of the model performs the task.

14. The method of claim 13 further comprising the step of:

revising said set of freed bariables of said task performable by said reduced version of the model.