Property Synthesis

Imagine you need to develop a new chip and all you have to do is to write its specification. Synthesizing hardware from its specification will take the design process to the next level of abstraction. On the block level, this vision is now getting closer to reality. Given a formal specification written in a temporal logic, property synthesis constructs a design on the RT level that adheres to the specification. The formal specification is given as a set of properties that are defined over input and output signals. The specification language is a linear logic such as LTL, PSL, or SVA. The generated design is described in an HDL (e.g., Verilog). Property synthesis provides the user with a functionally correct design right after the specification phase. The obvious advantage is that the generated system is guaranteed to be correct by construction. Thus, for blocks that have only functional requirements, hand-coding and design verification are obsolete. Blocks that are subject to non-functional requirements for instance on timing, space, or power usage need further optimizations. However, for those blocks a functional correct prototype is also useful. It allows for integration testing even if some blocks are not optimized completely. This helps to catch high-level design errors in a very early stage of the design phase. Another benefit is that property synthesis helps to validate the specification. Simulating the functional prototype provides a simple way to check whether the specification fulfills the design intent. Besides, the user gets an immediate feedback on the specification she has written. Furthermore, some properties in the specification can be unrealizable, which means that those properties are violated in all possible designs. Those properties are useless in a formal specification and should be left out. Property synthesis answers the question of realizability and can identify unrealizable parts of the specification. Property synthesis concentrates on specifications written in LTL, PSL, or SVA. These languages are wellknown, easy to write and understand, and still expressible enough. LTL synthesis is known to have doubly exponential worst case complexity. The doubly exponential completeness and the very complex algorithms (such as Safra’s determinization construction) used in the standard approach to LTL synthesis discouraged many researcher from pursuing the topic for practical use. Nevertheless, we found a way, described in Section 2, to handle the complexity. There is plenty of theoretical work on LTL synthesis and a few implementations covering subsets of LTL but to our knowledge no implementation for the complete language. Recent work of Amir Pnueli handles the most general subset. His approach is only applicable to specifications expressible with generalized Streett[1] acceptance condition. Besides, suitable specifications have to be rewritten to a particular syntax in order to be synthesized. My aim is to make property synthesis more practical by providing an implementation of a complete LTL synthesis approach. The implementation will provide a definite answer to the realizability question, a correct design if the specification is realizable, and debug information on the specification in the other case. Despite the high complexity, the implementation has to keep the intermediate data structures and the final design manageable. That means the doubly exponential blow-up will only occur if necessary. Since the problem is doubly exponential complete, there are properties that require the blow-up, i.e., the size of any design fulfilling those properties will be at least doubly exponential in the length of the specification. This implies that hand-design cannot do better. In addition, the complexity of LTL synthesis is given with respect to the specification and not with respect to the size of the generated design. In verification the limiting factor is always the size of the design and not the specification. So, if the size of the generated design is as small as possible, synthesis is not harder than verification.