Abstract: In testing a system, coverage of the testing is obtained by maintaining a store of information that is populated as the testing progresses. The store maintains information about the ranges of system variables that are employed during the testing. At the conclusion of the testing, the coverage of the testing is reported out, to permit the designer to assess whether other queries ought to be formulated, or whether portions of the system are superfluous. The testing can employ simulations, formal verifications, or some other techniques.

Abstract: A method for checking on cyclicity of a set of definitions employs a simple, non-computational definition of constructivity and a symbolic algorithm based on the new, simple to implement, formulation for variables with arbitrary finite types. This is accomplished by extending variable type to include the “undeterminable” value ⊥ (read as “bottom”). This formulation is non-computational and easily extensible to variables with any finite type. The formulation also handles definitions of indexed variables in the same manner. The set of definitions is then checked to determine whether any of the variables assume the value is ⊥.

Abstract: Efficient formal verification of a system model is obtained by performing a state reachability analysis of an unrestricted full system model that includes constraints selected by the tester for testing a given property, followed by an analysis that permits a reduction in the complexity of the tested system's model. The analysis involves determining variables of the system's model that do not change value in the course of the state reachability analysis, often because of the constraints imposed prior to performing the reachability analysis. The unchanging variables are replaced with constants, and those constants are propagated through the system model to simplify the state transition relations that define the system. The simplified system model is then applied to a verification tool to determine whether the liveness property is satisfied.

Abstract: A static partial order reduction generator and process result in a substantially reduced state space graph of a multi-process system, independently of the model checking process. The process of this invention creates a modified state graph generator with appended rules that allow any desired state searching tactic (breadth first, depth first, etc.) to be employed when states and transitions are considered in the course of verification. This permits use of existing model checking tools without needing to modify them. The static partial order reduction is made possible by realizing that a prior art condition that at least one state along each cycle of the reduced state graph must be fully expanded can be guaranteed by considering the individual processes that make up the system and identifying certain transitions in those processes.

Abstract: A method and apparatus that employs static partial order reduction and symbolic verification allow the design of a system that includes both hardware and software to be verified. The system is specified in a hardware-centric language and a software-centric language, as appropriate, and properties are verified one at a time. Each property is identified whether it is hardware-centric or software-centric. A hardware-centric property that contains little software is does not employ the static partial order reduction. Software-centric properties, and hardware-centric properties that have substantial amounts of software do employ the static partial order reduction. Following partial order reduction, the software-centric language specifications are converted to synchronous form and combined with the hardware-centric specifications. The combined specification is applied to a symbolic verification tool, such as COSPAN, and the results are displayed.

Abstract: Verification systems which employ automata-theoretic formal verification use a model automaton made from a system process (203) representing the system and a task automaton (205) representing the task and use the model automaton to test (217) whether the language of the system process is contained in the language of the task automaton. An improved technique reduces the computational complexity of the language containment testing by producing a model (216) which represents a system which has been automatically localized with regard to a task. Another technique reduces the computational complexity of stepwise refinement (208). In stepwise refinement, the system automaton is refined a step at a time until it reaches the complexity of a practical implementation. The computational complexity of the stepwise refinement is reduced by a technique which permits language containment to be tested using a set of models made from process-automaton pairs rather than process-process pairs.

Abstract: A method wherein a verification tool checks the properties of a system model by performing a partial search of the system-model state space. A partial search is a search wherein the verification tool inputs, at each state of the system-model state space, only a subset or fraction of the complete set of inputs that would have been used during a conventional search. Performing a partial search, instead of a conventional search, reduces the total number of inputs that the verification tool will input to the system model during a search of the system-model state space, thus reducing the amount of computational resources and/or time needed by the verification tool to verify given properties of the system model. Moreover, performing a partial search, instead of a conventional search, does not substantially reduce the ability of the verification tool to identify errors in the system-model.

Abstract: A method and apparatus for efficiently determining whether a set of constraints input to a verification tool are mutually contradictory or overconstraining. A set of constraints are mutually contradictory or overconstraining when they define values for system-model variables and/or inputs that are inconsistent with each other at a given state or group of states of a system-model state machine. It has been found that when a set of constraints assign inconsistent values at a given state or group of states of the system-model state space, the verification tool will treat the given state or group of states as a so-called non-returnable state. That is, the verification tool will not recognize any paths from the given state or group of states to a set of reset states.

Abstract: A method and apparatus for defining a system design specification by using a finite set of templates that have a format for accepting a set of system expression such that a selected template, when filled with the system expressions, defines an intended behavioral attribute of the system. In one illustrative embodiment, each template has a set of qualifiers and a set of entry blanks, wherein each qualifier is associated with an entry blank. In such an embodiment, the set of entry spaces may comprise a fulfilling condition entry space for accepting a system expression that defines a required or assumed event of the system model, an enabling condition entry space for accepting a system expression that defines a precondition for starting a check of the required or assumed event, and a discharging condition entry space for accepting a system expression that defines a condition after which said fulfilling condition is no longer required or assumed by the system model.

Abstract: The invention presents a method and apparatus for forming a restricted model from a system model to reduce the computational resources required to formally verify the system design, without substantially reducing the ability to test all system model functions, or properties. In general, the restricted model is formed by restricting the range of assumable values of system model variables and system model inputs to a restricted set of values, based on the values assumed by the system model variables and system model inputs during a partial search of the system model. The restricted model can then be fully searched by a conventional verification tool to identify system design errors. Advantageously, the restricted model requires less computational resources to verify the system design (i.e. through a full search) than the original system model.

Abstract: A method and apparatus for verifying the behavior of properties or functions of a system by forming a reduced model for each property of the system, and running a given simulation operation on the reduced model to verify the behavior of each said property. When a property or function does not behave as expected, the system model is adjusted, and only those functions having a property affected by the adjustment are rechecked. In one illustrative embodiment, a system model is reduced by eliminating all variables having no effect on the function or property being checked. The resulting reduced model can be further reduced by adjusting the range of each variable therein to a minimum range necessary to check the behavior of that specific property. If it becomes necessary to change the system model in order to fix a problem relative to one property, then only those properties having a reduced model affected by that change or fix are re-verified.

Abstract: The invention presents a method and apparatus for forming a restricted model from a system model to reduce the computational resources required to formally verify the system design, without substantially reducing the ability to test all system model functions, or properties. In general, the restricted model is formed by restricting the range of assumable values of system model variables and system model inputs to a restricted set of values, based on the values assumed by the system model variables and system model inputs during a partial search of the system model. The restricted model can then be fully searched by a conventional verification tool to identify system design errors. Advantageously, the restricted model requires less computational resources during a fall search than the original system model.

Abstract: Disclosed is a recursive circuit capable of serving as a signal detector or as a signal generator. The circuit comprises a shift register capable of storing multilevel signals, and a feedback network responsive to an input signal and to the output signals of selected stages of the shift register. In the feedback network, the output signals of the selected stages are each multiplied by prechosen integers, and then added with the input signal to form a sum signal which is applied to the first stage of the shift register. The sum signal is developed by nonmodulo addition, and the multiplying integers are prechosen to cause the characteristic function of the circuit to be a cyclotomic polynomial. Detection of the presence in the input signal of a signal having a chosen frequency is accomplished by the sum signal excluding a predetermined threshold level.

Abstract: Disclosed are signal generators for developing multilevel output signal sequences of a preselected period of repetition. In their general form, the generators comprise a shift register capable of storing multilevel signals, and feedback means. The feedback means multiply the output signal of prescribed shift register stages by selected integers, add the multiplied signals in nonmodulo arithmetic, and apply the added signals to the first stage of the shift register. The multiplying integers within the feedback means are selected to cause the characteristic functions of the signal generator to be a cyclotomic polynomial. For descriptive convenience, the disclosed generator is termed a "cyclotomic circuit." The disclosed cyclotomic circuits are particularly useful in a minimum memory, prescribed-period, signal generator applications. The minimum memory is achieved by separating the prescribed period into power-of-prime factors, and by associating with each factor a cyclotomic circuit.