llvm / llvm/circt

[circt-bmc][LTLToCore] verif.assert on !ltl.property fails to legalize

Open
#10,907 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
2.2k
Forks
524
Avg merge
3d 2h
Merged PRs (30d)
46

Description

circt-bmc cannot check temporal properties. A verif.assert on an !ltl.property fails to legalize, so only immediate boolean assertions work.

LowerLTLToCore has been in the pipeline since #9735, but it leaves ltl.clock, ltl.delay, ltl.clocked_delay and ltl.concat untouched, so the failure surfaces late at the assert instead of at the unsupported operator. #9722 covers only ltl.delay, ltl.clock and ltl.implication, predates ltl.clocked_delay, and has been idle since March. The example in docs/Tools/circt-bmc.md fails for the same reason. It also came up in https://discourse.llvm.org/t/lowering-from-ltl-to-core/86263 and https://discourse.llvm.org/t/89621 without a tracking issue.

Reproduction, run with circt-bmc repro.mlir -b 6 --module LtlProbe --rising-clocks-only --shared-libs=libz3.so

```mlir
hw.module @LtlProbe(in %clock : !seq.clock, in %reset : i1, in %go : i1, out q : i1) {
%true = hw.constant true
%false = hw.constant false
%0 = seq.from_clock %clock
%q = seq.firreg %go clock %clock reset sync %reset, %false : i1
%1 = ltl.clock %go, posedge %0 : i1
%2 = ltl.clock %q, posedge %0 : i1
%3 = ltl.clock %true, posedge %0 : i1
%4 = ltl.clocked_delay %3, posedge %0, 1, 0 : !ltl.sequence
%5 = ltl.concat %1, %4 : !ltl.sequence, !ltl.sequence
%6 = ltl.implication %5, %2 : !ltl.sequence, !ltl.sequence
verif.assert %6 label "ltl_probe" : !ltl.property
hw.output %q : i1
}
```

A core lowering for the bounded sequence operators would help, or failing that a diagnostic naming the unsupported operator. Is anything in progress beyond #9722, and is extending LTLToCore preferred over handling these in VerifToSMT?

firtool-1.147.0g20260705, downstream build whose LTLOps.td and LTLToCore.cpp match llvm/circt main.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with the provided circt-bmc command and repro.mlir. Start with LowerLTLToCore in LTLToCore.cpp, the operator definitions in LTLOps.td, and the example in docs/Tools/circt-bmc.md; compare whether unsupported operators should be lowered or diagnosed. Done means bounded temporal assertions either legalize successfully or identify the unsupported operator clearly.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.