From Signal Temporal Logic to FPGA Monitors
Total Page:16
File Type:pdf, Size:1020Kb
From Signal Temporal Logic to FPGA Monitors Stefan Jaksiˇ c´∗, Ezio Bartocci†, Radu Grosu†, Reinhard Kloibhofer∗, Thang Nguyen‡ and Dejan Nickoviˇ c´∗ ∗AIT Austrian Institute of Technology, Austria †Faculty of Informatics, Vienna University of Technology, Austria ‡Infineon Technologies AG, Austria Abstract— allows very long tests that are not possible with simulation- based methods. Design emulation is used both to explore Due to the heterogeneity and complexity of systems-of- systems (SoS), their simulation is becoming very time consuming, the behavior of digital and analog components. In the latter expensive and hence impractical. As a result, design simulation is case, the (possibly mixed signal) component is approximated increasingly being complemented with more efficient design em- with its discretized behavioral model. By combining these two ulation. Runtime monitoring of emulated designs would provide approaches, we provide a rigorous method for runtime verifi- a precious support in the verification activities of such complex cation of long executions resulting from mixed signal design systems. emulations. In addition to design emulations, our proposed We propose novel algorithms for translating signal temporal solution can be used to monitor real mixed-signal devices in logic (STL) assertions to hardware runtime monitors imple- post-silicon validation in real-time. mented in field programmable gate array (FPGA). In order to We choose Signal Temporal Logic (STL) [13] as our accommodate to this hardware specific setting, we restrict our- selves to past and bounded future temporal operators interpreted specification language. STL allows describing complex timing over discrete time. We evaluate our approach on two examples: relations between digital and analog “events”, where the latter the mixed signal bounded stabilization property; and the serial are specified via numerical predicates. In this paper, we restrict peripheral interface (SPI) communication protocol. These case ourselves to the rich subset of STL that contains past and studies demonstrate the suitability of our approach for runtime bounded future operators. Due to the FPGA hardware context, monitoring of both digital and mixed signal systems. we interpret STL formulas over the discrete time. We propose a compositional construction for STL monitors I. INTRODUCTION implemented on FPGA. An FPGA operates at a given max- Modern system-of-systems (SoS) merge a number of em- imum frequency and contains look-up tables (LUT) that can bedded elements that are often developed independently. Such compute complex combinatorial functions, and flip-flops (FF) components are heterogeneous, and combine digital controllers that are used as memory elements. Given its limited speed and with analogue sensors and actuators. They interact with their computational resources, it is imperative to implement STL physical environment and are interconnected via communica- monitors efficiently. In order to achieve this goal, we use a tion protocols. This results in complex interactions generating simple architecture for our STL monitors, ensuring that we emergent behaviors that are not predictable in advance. Correct minimize the usage of the resources. We base the STL monitor system integration is crucial to achieve high standards with generation on temporal testers [16]. Intuitively, a tester for an respect to safety and security. For instance, the ISO 26262 STL formula j is a transducer that observes an execution standard from the automotive domain obliges suppliers to trace w and outputs true at time t if and only if w satisfies j provide sufficient correctness evidence about their systems to at time t. In order to decide the satisfaction of the formula at the regulatory bodies. runtime, we restrict ourselves to deterministic testers, which have a natural translation to sequential circuits. Due to the heterogeneity and the complexity of modern SoS, verification and validation (V&V) poses a major chal- We use analog-to-digital converters (ADC) to handle nu- lenge and represents today the main bottleneck in the design merical predicates in STL. An ADC is a device that periodi- process. Verification by simulation and manual testing are cally transforms real-valued quantities to their digital numbers the dominant methods used in the V&V practice in many approximations. We then apply the predicate operations on industrial domains. However, these techniques have the fol- the quantized values of the input signal. The bounded future lowing weaknesses: (1) they are ad-hoc, inefficient and prone STL formulas do not naturally admit deterministic testers - to human errors; and (2) simulation of complex SoS is very the satisfaction of j at t depends on inputs at some future time consuming, especially when heterogeneous components t0 > t. Inspired by [15], we propose a procedure to transform are involved. Hence, not all required simulations can be done the bounded future STL formula j to an equisatisfiable past within the given limited time frame. STL formula y. The two formulas are related as follows - j is satisfied at time t if and only if y is satisfied at time We propose to improve this situation by combining t + b, where b is the bounded future horizon of j. It follows assertion-based runtime verification emulation with design on that instead of monitoring j, it is sufficient to monitor y and field programmable gate array (FPGA), an integrated circuit delay the verdict by b time units. We adapt the procedure that can be configured by a designer. Assertion-based runtime in [14] to the discrete time setting and directly translate the verification is a rigorous, yet practical method for checking past fragment of STL to deterministic testers. design correctness. Design emulation is a technique that com- plements and sometimes even replaces classical simulation. We implement the entire STL monitor generation and It enables execution of the design in real-time and thus deployment flow - from formal specifications to the lab en- vironment. We demonstrate our approach on two case studies valued domain. We denote by jwj = d the length of the signal coming from both the digital and the mixed signal domain: w. Let P = fp1;:::; pmg be the set of boolean variables and (1) the bounded stabilization: and (2) the serial peripheral X = fx1;:::;xng the set of variables defined over D. We denote interface (SPI) communication protocol. We summarize our by pe(w) the projection of w to e 2 P [ X. Given a signal w main contributions as follows: and its projection pp(w) to some p 2 P, we say that pp(w) has (D;l)-variability if within every interval [i;i+D−1], the value • We focus on monitoring both digital and mixed signal of p changes at most l times. designs; The syntax of a STL formula j over P [ X is defined by • We provide the hardware monitoring procedure which the grammar handles bounded future temporal logic formulas by transforming them into their past counterparts evalu- j := p j x ∼ u j :j j j1 _ j2 j j1 U Ij2 j j1 S Ij2 ated with a fixed delay; where p 2 P, x 2 X, ∼2 f<;≤g, u 2 D, I is of the form [a;b] • We implement and present the entire flow from spec- or [a;¥) such that a;b 2 N and 0 ≤ a ≤ b. For intervals of the ifications to hardware monitors and evaluate our ap- form [a;a], we will use the notation fag instead. proach in real lab environment. The semantics of a STL formula with respect to a signal w II. PROBLEM DESCRIPTION is described via the satisfiability relation (w;i) j= j, indicating that the signal w satisfies j at the time index i, according to The industrial V & V process includes the following the following definition where T = [0;jwj]. workflow of activities. (w;i) j= p $ pp(w)[i] = true Pre-silicon verification covers all type of simulation at differ- (w;i) j= x ∼ u $ px(w)[i] ∼ u ent design level using different techniques from mixed-signal (w;i) j= :j $ (w;i) 6j= j to mixed-abstraction simulation. (w;i) j= j1 _ j2 $ (w;i) j= j1 or (w;i) j= j2 (w;i) j= j1 U Ij2 $ 9 j 2 (i + I) \ T : (w; j) j= j2 and Emulation at integrated circuit (IC) and system level uses 8i < k < j;(w;k) j= j1 FPGA with mixed-signal test chip as an early prototype for (w;i) j= j1 S Ij2 $ 9 j 2 (i − I) \ T : (w; j) j= j2 and verifying long term test, stress test or sensor data transmission 8 j < k < i;(w;k) j= j1 test over a long period of time. Post-silicon Verification refers to the verification of the real IC From the basic definition of STL, we can derive the in the lab. It is an extension of those test scenarios which could following standard operators. not be checked during emulation that is used to cover mainly true = p _:p certain safety critical functions (e.g.: sensor interfaces or the false = :true deployment interfaces) but not the full design functionalities. j1 ^ j2 = :(:j1 _:j2) 1 Despite all the aforementioned activities are well estab- I j = true U Ij 0 1 lished, they still involve many simulation and manual testing I j = : I :j Q methods used in the practice of the industry in many ap- I j = true S Ij ` Q plication areas. Verification engineers usually need to create I j = : I :j input stimuli, to execute simulation models and to observe the correctness of the output waveforms. This process is typically We give strict semantics to the U I and S I operators from manual, hence repetitive, tedious and time-consuming. which we can derive classical future and past LTL operators1, using the following rules: Since the verification effort for complex System-on-Chip (SoC) IC products accounts for around 60%-70% of the total j1 U j2 = j2 _ (j1 ^ j1 U [1;¥)j2) development, any approach which would improve time-to- j1 S j2 = j2 _ (j1 ^ j1 S [1;¥)j2) market and product quality, boost up the verification process 2j = false U f1gj using hardware acceleration platform and automate verification j = false S f1gj is of extreme interest.