The Smv System Draft

The SMV system is a tool for checking nite state systems against speciications in the temporal logic CTL. The input language of SMV is designed to allow the description of nite state systems that range from completely synchronous to completely asynchronous, and from the detailed to the abstract. One can readily specify a system as a synchronous Mealy machine, or as an asychronous network of abstract, nondeterministic processes. The language provides for modular hierarchical descriptions, and for the deenition of reusable components. Since it is intended to describe nite state machines, the only data types in the language are nite ones { Booleans, scalars and xed arrays. Static, structured data types can also be constructed. The logic CTL allows a rich class of temporal properties, including safety, liveness, fairness and deadlock freedom, to be speciied in a concise syntax. SMV uses the OBDD-based symbolic model checking algorithm to eeciently determine whether speciications expressed in CTL are satissed. The primary purpose of the SMV input language is to describe the transition relation of a nite Kripke structure. Any expression in the propositional calculus can be used to describe this relation. This provides a great deal of exibility, and at the same time a certain danger of inconsistency. For example, the presence of a logical contradiction can result in a deadlock { a state or states with no successor. This can make some speciications vacuously true, and makes the description unimplementable. While the model checking process can be used to check for deadlocks, it is best to avoid the problem when possible by using a restricted description style. The SMV system supports this by providing a parallel-assignment syntax. The semantics of assignment in SMV is similar to that of single assignment data ow languages. By checking programs for multiple parallel assignments to the same variable, circular assignments, and type errors, the interpreter insures that a program using only the assignment mechanism is implementable. Consequently, this fragment of the language can be viewed as a hardware description language, or a programming language. The SMV system is by no means the last word on symbolic model checking techniques, nor is it intended to be a complete hardware description language. It is simply an experimental tool for exploring the possible applications of symbolic model checking to hardware veriication.