SMT SOLVERS:

In computer science and mathematical logic, satisfiability modulo theories (SMT) is the problem of
determining whether a mathematical formula is satisfiable. It generalizes the Boolean satisfiability
problem (SAT) to more complex formulas involving real numbers, integers, and/or various data
structures such as lists, arrays, bit vectors, and strings. The name is derived from the fact that these
expressions are interpreted within ("modulo") a certain formal theory in first-order logic with
equality (often disallowing quantifiers). SMT solvers are tools which aim to solve the SMT problem
for a practical subset of inputs. SMT solvers such as Z3 and CVC4 have been used as a building
block for a wide range of applications across computer science, including in automated theorem
proving, program analysis, program verification, and software testing.
Third Printing Introduction - BNDHEP.NET
 A GOOD CONCLUSION

Unknown Mutual Exclusion Counter Example

UNKNOWN: Solver returns a possible counter-example of k time steps that do not violate
assertions followed by a state that does. This counter-example does not start with an initial state.
The user must decide if the counter-example represents a reachable sequence and must strengthen
the assertions accordingly.

Assertion:
mutual_ex_masters_bus_grant: assert always not(vm_device_granted_bus_s and
vm_device_granted_bus_sb) ;

Observations:
1. We observed that increasing the depth of K-Induction has no use and it still shows unknown. This
is because there must be one or more loops of non-bad states followed by a bad state.

We need to break the loop by adding assertions.

2. Initial State considered is: Requester A is in State WAIT_FOR_BGXIN_RELEASE and also
rq_bg3out_o is active(‘0’), which is not a reachable state for our design.

This happened because: For the solver, the above specified initial state is a non-bad state as it is
following the specified assertion. It does not check whether the state is reachable or not. For K-
Induction, all it shows in the counter example is that a non-bad state is followed by a bad state.

Since the state is unreachable, we have three options: Increase the induction length(which we can’t
due to observation 1) or Add restrictions or Strengthen asserts.
So we have to strengthen the assertion or add another assertion to make sure that the initial state
considered is always reachable in the counter example so that the bug is genuine and not a spurious
one.
So we add another assertion:
Addition_Assertion: assert always ar_br3_sa or rq_bg3out_s ;
 dsff

Citation:
Vmebus Specification Manual. http://www.bndhep.net. (1985, October). Retrieved January 4, 2022,
from http://www.bndhep.net/Electronics/Data/VME32.pdf