 Welcome to the lecture series on advanced VLSI design course. In last couple of lectures we were talking about VLSI design verification. So, now I will take you through remaining portion of the VLSI design verification. So, in the last class we discussed about equivalence checking. So, we discussed combinational equivalence checking and we also discussed how we can formulate a sequential equivalence checking problem as a combinational equivalence checking by unrolling sequential circuit and we can verify the unrolled combinational circuit which is the other design. So, the one of the problem that we discussed was the circuit size increases the number of input variables increases. So, then that is the problem. Then other problem other solution that we discussed was we can we have two finite state machines and then we if we can reduce these two finite state machine and we check the isomorphism of these two reduced finite state machine we can say that both of the machines are equivalent. So, these two techniques we already discussed. Now, I will discuss the third technique which is more common and more popular that is based on the reachability analysis. So, what do we do is that we have two machines machine M1 and machine M2 and then we generate a product machine out of these two and now for this product machine if we start from a say initial state as 0 of this machine and initially start a state as one of machine M2 then we check in the product machine whether we can we reach some illegal state by traversing this machine or not. If we reach to an illegal state in that case here both of the machines are not equivalent otherwise machines are equivalent to each other. So, as I mentioned that here we are constructing a product machine. So, say if one machine has say N number of states another machine has M number of states in that case here product machine will have total N into M number of states. So, say one has two and another has three. So, that means here we have all possible six combinations of these states and based on the state transition some of the combinations are legal some of the combinations are illegal if we end up to an illegal combination in that case that those two machines are illegal because otherwise these are not supposed to reach to that state. So, as I said that here this we use the symbolic FSM traversal of the product machine and figure out whether we are able to reach to the illegal state or not. So, then here how we formulate that. So, say these are the two machines one is machine M1 that has some combination part and sequential part the flip flops and the another machine is M2. So, now what do we do is we construct a product machine and whose output of both of the machines are connected to a XNOR gate and this XNOR gate is supposed to produce output 1 if both of the machines are equivalent otherwise it may produce 0. So, now you have two machines M1 and machine M2. So, we create a product machine M that is M1 cross M2 we traverse the states of M that is product machine and check if the output of is a check the output of each of the machine if the output of machine M is 1 output of machine M is 1 only when the output of both of the machines are 1 otherwise it is 0. If output of M if all output of M are 1 in that case here M1 and M2 are equivalent otherwise the these are not equivalent and then here we can reach to an error state and then this error trace will produce the counter example. So, that means, you are looking at the error trace we can find out what is the source of the bug. So, now let us come to how to construct such kind of product machine. So, there are two machines as M1 and M2 and say as one is the state set of machine M1 and as two is the state set of machine M2. Now here the product machine will have two machine state set as that is S1 cross F2. So, if S1 is 2, S2 is 3 that means here there would be total 6 states in the product machine and next state function that delta of S into X would be S1 cross S1 into X. So, and this will map to S1 cross S2 and output function lambda of S of X would be S1 cross S2 cross X to either 0 or 1. So, when O1 and O2 are same in that case here output is 1 otherwise it is 0. So, this construct this and then here this output is construction of this output is known as matrix. So, now here the lambda function that is the output function would be the output function of machine M1 and output of XNOR with output function of machine M2 sorry I mentioned earlier XOR this is XNOR operation. So, now here we look at the error trace if we are getting output as 0 and that error trace is the distinguishing sequence. So, that means here sequence that can produce two different outputs from the two different machines. So, it is sequence of input which produce one at the output and now say let us look at the how we can distinguish two machines say machine M1 has two states 0 and 1 and machine M2 has three states 0 1 and 2 and these are the state transitions. Now, here we would like to see whether both of the machines are equivalent or not. Now, what do we do? We need to construct a product machine and product machine will have say here this machine has two states this has three states. So, that means your product machine will have six states out of six states some are illegal some are legal and what we want we want that here all the legal machine state should be reachable and all the legal machines should not be reachable. So, now we create a combined state that is S1 into S2 and so say here we have state 0 and 1 here we have 0 1 and 2. So, now the combined state that we can create out of this this is 0 and 1 and this one has 0 1 and 2. So, now here the combined state would be 0 0 0 dot 1 0 dot 2 then 1 dot 0 1 dot 1 and 1 dot 2. So, these are the total six states a product machine will have some will be legal states some states are illegal states. Now, here we have to look at the state transition. So, these are the six states available and now we have to construct the state transition. So, the state transitions are labeled over these edges. So, that means here this is that if I apply 0 in that case here this will stay in the same state and output would be 1. So, let us say that initially this machine is in state 1 and this machine is also in state 1. So, now when it is in the state 1 in that case here on the arrival of 0 it will stay in the same state and produce output as 1 and on arrival of 1 here it will go to state 0 and produce output as 0. So, this is the state transition when it is in state 1. Now, here what are the state transitions of this machine m 2 when it is in the state 2. So, when it is in state 1 in that case here on arrival of 0 it will stay in state 1 and produces output as 1 and on the arrival of 1 here it will go to state 2 and produces output 0. So, now here say on the in the product machine that may have a state 1 1 and 0 2. So, now here on the on arrival of 0 this will stay in in in state 1 this will stay in in state 1. So, that means, your product machine will will have a state 1 dot 1 and on the arrival of 0 it will stay in the same state and now here output of this machine is 1 output of this machine is 1 and XNOR of these 2 outputs would be 1. So, output would be 1. Now here on arrival of 1 as input in that case here this machine will go to 0 this machine will go to 2 in that case here the product machine will go to a state that is labeled with 0.2. So, on arrival of the 1 here it will go to state 0.2 and because output in machine m 1 is 0 output in machine m 2 is 0 and XNOR of these 2 machine would be 1. So, in that case here output would be 1. This way here we construct the state transition in a product machine. So, output would be if output is 1 in that case here these are equivalent it is ok if output is 0 in that case here the product machine enters into a erroneous state. So, let us take example and see whether these 2 machines are equivalent or not. So, these are the 2 machines and I say I start from some state say initially state in this machine is 0 and initially state in this machine is 0. So, now here start to construct a product machine and see how far we can go and how many states we can reach. So, now we maintain a repository of states which are already reached and then the output on arrival of 0 and 1. So, if means initially both of these machines are in a state 0 in that case initially state is 0 0 that I can write as 0.0 and now on the arrival of 0 this machine stays in 0 state 0 this machine also stays in state 0. So, that means your product machine will stay in 0.0 state and output of machine M1 is 0 output of machine M2 is 0 and hence the output of the product machine would be 1 because this is XNOR of outputs of these 2 machines. Now on the arrival of 1 on the arrival of here. So, now here on the arrival of 0 as input output will be 1 now here look at the output on the arrival of 1. So, when it the arrival of 1 is there in machine M1 it will go to state 1 on the arrival of 1 on in this machine M2 it will also go to machine to state 1. So, that means here the product machine will go to a state that is 1.1 and what would be the output here this machine produces output 1 this machine produces output 1 and product of this XNOR of these 2 would be 1 hence here. So, XNOR is is 1. So, now here from this initially state I can reach to 2 state 0 0 or I can reach to state 1 1. Now here let us look at if I am in state 1 1 how it progresses. So, now if it is in state 1 1 on arrival of 0 it will stay in state 1 on arrival of 0 this also stays in state 1. So, then here the product machine will also stay in state 1.1. So, now it will stay in state 1.1 when arrival of 0 and in both of the cases both of the machines are producing output 1 hence XNOR of these 2 outputs would be 1. So, it will produce output 1. What happens when when you you get input as 1 in only the arrival of input as 1 this machine will go to state 0 and produces output 0 this machine will go to state 2 and produces output 1. So, that means here this so that then the the combined machine or product machine will produce output 1. So, it will produce output 1 and go to state 1 0 dot 2 because this goes to 0 this goes to 2. So, now here you will reach to the new state that is 0 dot 2. So, these are reachable states now in 0 dot 2 on the arrive. So, you are in 0 here and 2 here on arrival of 0 it will stay in 0 on arrival of 0 this will also stay in 0. So, that means here on the arrival of 0 it will stay back in 0 dot 2 state and produces output as 1 because 0 here and 0 here. Now, so this is the case when you have you receive 0 as input if you receive 1 as input in that case here from 0 it will go to state 1 from 2 it will go to state 0. So, now here it will go to state 1 dot 0 right this goes here this goes here. So, now here this will go to state 1 dot 0 and then here it will produce output 1. Now, when you are in state 0 dot 2 on arrival of 1 sorry on arrival of 0. So, it is 0 dot 2 on arrival of 0 it stays in stays back in 0 on arrival of 0 here it stays back in 0 sorry it is 1 0 1 dot 0. So, in 1 dot 0 here on the arrival of 0 it will stay back in 1 on arrival of 0 this also stays back in 0. So, now here the product machine will stay back in 1 dot 0 state, but this produces output 0 this produces output 1. So, these are producing output 0 output as 0 and 0 output is erroneous. So, now here you are able to reach a an erroneous state hence these 2 designs are not equivalent. So, now here you can further traverse like if it is 0 1 in that case here it can go to another state and produces again that the erroneous output. So, now here if you want to find out the error trace in that case here your error trace that can result into erroneous state would be 1 1 1 1 and 0 right or 1 1 1 and 1. So, these are the error trace. So, this error trace will tell you that these under this condition if these 2 machines are not equivalent. So, that means, under this condition these 2 machines are producing 2 different outputs hence these are not equivalent. So, when they. So, if this process stops either it result into erroneous output or so that means, your output is 0 or it is not able to include any more new states. In that case here you can say that now here all the reachable states are producing output as 1 and known means the other states which may be may produce output 0 are not reachable hence your machine is safe under the conditions this machine both of the machines will behave exactly in the same way hence you can verify these 2 machines. So, this way here we can use the straight traversal and we can verify the equivalence of 2 machines by converting a machine into a product machine. So, now so far we discussed about the equivalence checking the 3 methods of the equivalence checking first method by converting the sequential equivalence checking into a combinational equivalence checking by having the time frame expansion or by checking the isomorphism between the 2 state machines or by using the finite state machine traversal. So, we have to convert a both of the machines into a product machine and we have to traverse that product machine and check whether any of the illegal machine is state is reachable or not if illegal state is reachable in that case here both of the machines are not equivalent otherwise the 2 state machines are equivalent. So, this completes the sequential equivalence checking portion. Now, I switch to the next topic that is model checking or property checking where it is more convenient where it is more needed like here in the VLSI design flow I have shown you that at various locations we use the equivalence checking. So, that means, here you transform one design from one level of abstraction to another level of abstraction and then you check the equivalence between those 2. So, like here RTL and gate level net list you apply the equivalence checking and check whether both of the designs are equivalent or not. Now, it is now we are going at higher level of abstraction and that is system level design and at system level design we try to explore the architecture of the system and most of the time the effort from system level design to RTL is manual and if it is manual in that case here we are more error prone. So, that means, here we are likely to so this is your specification and now this is the transformation. So, from this to this if you are going manually in that case here we are likely to introduce some more error. So, this is the barrier to adopt the system level design methodology because this task is manual. Somehow if I can do this automatic in that case here I am likely to move myself to a higher level of abstraction where in the complexity is smaller and I can handle the larger design. That is the place where the model checker or if this is property checkers are more meaningful though these are meaningful at the other level of abstraction as well, but here your equivalence checking may not help so you have to go for that. So, now here what we want that here whatever properties we have we have to do check the model for that and then we have we can. So, if you can verify the properties of the system level design and make sure that this design is equivalent after that here you can have equivalence checking between these two and we can upgrade our self to higher level of abstraction. So, that means, here we can eliminate after that we can eliminate the manual effort. So, here what we want because here you have behavioral information about the system and we can have some specification about the system in terms of the properties like if it is an arbiter then we look for the property like deadlock like fair chance to each of the master or something like that. If it is traffic light controller in that case we are interested whether it is giving the it is not providing green signal to crossroads. So, this is the place where model checker can play an important role. Model checker was proposed in 1981 by Immersion and Clark. So, what it does is it uses or it modals the implementation in the form of finite state machine or state transition diagram. So, here you have a state transition diagram you convert that in little bit different form than state transition diagram that is known as creep case structure. I will tell you what that creep case structure is then because here if it is a sequential circuit in that case it has some temporal behavior. So, that means here we have to specify the specification in terms of the temporal logic. So, temporal logic is or specification is specified in terms of temporal formula and then we have to check whether in all these states of model M it satisfies your model that is your finite state machine or creep case structure satisfies this formula. If it satisfies in that case here this is equivalent to all case simulation for that kind of property or formula. So, the structure is as follows you have a creep case structure that is nothing but a variant of finite state machine or state transition diagram you pass it through a preprocessor and then you how to you write your specification in terms of formula F. You supply this to the model checker model checker will tell you whether this formula is respected by this model or design all the time or not if it is not in that case it produces counter example. I will show you an example how this can verify one particular design. So, the advantage of model checker are as follows like in theorem proving we need to prove a couple of theorems. So, and then the proven theorem we can use as axioms and then prove the remaining theorems. So, in this case and that is as I mentioned earlier that theorem proving is a semi-automatic process. Hence, here you need to have manual intervention and industry generally does not like that and again here the theorem provers have scalability problem. So, here you do not need any proof this is faster as compared to the other methodologies. It has diagnostic capability based on the counter example. So, counter example can tell you what could have gone wrong that is why your both of the design sorry your design is not respecting the specification and. So, other very important thing here is that you need not to worry about full specification even if you have partial specification you can check for that is the those specification and you can say that these partial specifications or properties can or properties are always respected by the design. So, it is not necessary that you need to supply all these specifications. One of the example I can tell you that for a traffic light controller you need not to define all the properties or all these specifications maybe you are mostly interested in checking a property something like that if you should not give green signal to cross roads that is most important that is defined as safety property. So, other things may still be ok, but that is never admissible. So, now if you say that please check for this property in that case here it will check for that property and tell you that whether that property is violated at any point in time or not and so now here for partially specifications are ok. Many times we do not have access to the complete specifications as the specifications are evolving. So, now here as I said that here you say this is my state space and then here these are the state points. I start from some initial state and then here if I hit some illegal state in that case here I can identify that here the property is not respected. So, now here in this case if you start from here if you hit to some stop state or bad state in that case here it should stop and then you can traverse back and come back to the initial state and that back traversal will tell you the counter example and that tells you that if you pass through this particular route or states you will encounter a bad state and hence your design is not respecting this property. This thing the hardware verification was first exercised by Misra and Clark from CMU in 85 and so this was the first model checker exercise for hardware verification though here the model checker was developed before that in 1981, but then here it model checker was explored for the software verification not for the hardware verification. And what Misra found out was that they were verifying the FIFO implementation from Mead and Conway book. I guess all of you must have gone through this book this was this is one of the standard text in VLSI design. So, now they find out a bug that was the first bug in standard FIFO implementation was explored. So, this was the first instance of hardware verification using model checker. So, now here how model checker process flow goes and what are the various steps how we can do that. So, as I mentioned that we need to supply two informations to model checker one is your design like here for example, your design may be a traffic light controller. So, now your design can be supplied as a finite state machine of traffic light controller. Then you have to specify some interesting properties that you would like to verify and those property could be like here you can say that it is never possible to have a green light for both north south and east west roads. It is safety violation because otherwise there could be an accident. So, you have to avoid that. So, now here it will either say that your properties always respected or it is true or if property fails in that case here it gives you the counter example that under this condition this property violates. So, in general in our hardware design we have this kind of sequential circuit wherein you have couple of leaf lobs and input output that I can from this design I can extract finite state machine. So, this is finite state machine and that is referred as finite state model for the given design. So, this process is extraction of finite state machine or model from the design itself. So, finite state machine all of you know that finite state machine can be may be Moore's machine or Milley machine and that can be represented by a 6 tuple that is I is input state number of state or set of states, set transition function, initial states, outputs and then the output function. So, this can be defined formally like this. Now, as I mentioned earlier your model checker process is three step process. In that you need to formally specify or I can say mathematically specify the behavior or the specification of the system. So, this is the precise statement and properties and generally we is because here sequential circuits are temporal in nature in that case here we have to specify this in temporal logic and the behavior of design or implementation is referred as models and that is defined as flexible model for a given design given a specified design. And so if it is modeled in that case here it will have transition system. So, transition system will have quintuple. So, a state transition and label. So, now here state is set of states. This is transition function and these are the labels. So, labels are the variables which holds good in that or which are true in that particular state. So, this way you define the model. Here you define model in terms of finite state machine. Here you define formally specification in temporal logic that can be computational tree logic or that can be linear temporal logic. So, and then here you have to submit this to the formal verification formal verification tool will check whether your model satisfies the property all the time or not. So, now if you have say finite state machine say this is your finite state machine and in this finite state machine I just two little bit changes in that finite state machine if you look at then machine is something like this may be the machine and now here when it may if it is in state this say as 0 as 1 as 2 this can go from this state to this state or this can go from as 1 to as 2 on arrival of some input. Now, here when it goes from this state to this state may be some variables may be may become valid or high. So, say here whatever variables which are true in that particular state we label in that state and this kind of conversion. So, see in this what we are interested in we are interested in that all the means whether all the states are respecting the properties specified in the specification and or in terms of temporal logic. So, now we are interested that whether these properties are respected in all these states. So, now we are not interested what output it is producing or what input it is it is getting to go from state as 0 to as 1 we know that this can go from state as 1 to as 0. So, now here we want to eliminate I O from the the edges just here we want to move this input output information from edges to the to the states and this conversion is known as conversion to creep case structure. So, now here say in this if say variable P and Q are true variable Q and R are true here and variable R is true in this. So, now here we have to argue or reason about this design based on these two variables. So, now here how the computation behavior progresses. So, if say this is the initial state wherein P and Q are true in that case here it always it will start from this state. Now here based on the value of input either it can go to state wherein the Q and R are true or it can go to a state where R is true. So, now it can go here or here in the next time from this Q R state it can either go to P Q state or it can go to a state where R is true. So, that means here it can go to P Q or R and from R it can stay with R only. So, now here this way the computation progresses computation of this state machine and this. So, now here it is constructing a tree and that is known as computation tree. So, now here we have to specify the specification based on this computation tree which is specified here. So, now here that logic is known as computation tree logic. Now here the behavior or timing behavior here would be either you can believe that time in every cycle it is going from this state to this state to this state to this state and then this here keep on going or. So, now here if I look at one path in this computation tree in that case here in every clock tick it advances to the next state to the next state to the next state. So, in that case here the behavior is linear or if I look at the sum in the computation tree in that case if I look at some state in that case here it can branch out to either this way or this way when it goes here in that case again it can branch out this way or this way. So, that means here behavior depends on the branching node. So, that is known as computation tree logic or branching tree logic. Now the question is so, this way we can construct a computation tree. Now the question is what kind of means how we can specify property or what kind of property we need to specify. So, there are couple of types of the properties we can specify say one is the safety property and safety property says that desirable things should always happen and undesirable things should never happen. So, that means like here for example if I have a bus arbiter in that case here bus arbiter should never grant request to two masters otherwise both will start to use the common shared resource that is illegal or if I send a message from sender in that case here the same message must be received at receiver. So, message received must be sent by somebody these are the safety property there are other properties like here lioness property that tells you about the progress of the system. So, what it says is that desirable state should eventually be reached. So, that means like here if I want if I desire to get to some state in that case here at some point in time that state must be reached. So, for example a bus arbiter request is eventually granted a car which arrives at a traffic light that should eventually be allowed to pass through. So, these are the kind of lioness properties we use there are say fairness properties what fairness property says that desirable state should repeatedly reached. So, that means here if I desire some state in that case here at some point in time that should be reached and then here again and again there should be at least one of the paths that can take you to that state again and again. So, a request states and grant state for each client must be visited infinitesimally often. So, like here for example in this traffic light controller I am sensing the vehicles by some of the detectors and now here what we can do is we have to make sure that here there should not be any collision and when there can be a collision if you provide green signal to both of the cross roads in that case here there may be a collision and we have to guarantee the service eventually. So, that means here if say some car arrives here it should be eventually be passed from this one. So, now here some of these properties we can specify like this some properties may be very static in nature. Let us say this is a finite state machine for traffic light controller wherein I have these three states red, green, yellow and then here I have a green, yellow and then here if there is an error in that case here it may go to the error on a state. This can be means it is shown here. So, now here if I say there are four states and if I represent two bits per state in that case here I can say statically that in any of the state these means these two bits which are representing these states should never be same. So, that means that can make sure that here at the same time I cannot have green and red sorry green and green signals. This is the repetition of the same slide that here you can represent a specification using a formula F and that is in terms of temporal logic or and you can represent your design using state machine. So, in this your M is the transition system as I said the transition system will have a set of states transition function and label of each and every state. And so now here M is defined as computation tree. So, it is a tree and F specify the formula. This verification checks whether these conditions holds for all the tree defined by this machine M. So, it computes the set of state of M satisfying formula F and M satisfies F if and only if initial state of M are in the same state. So, now in order to formally specify as a language here temporal logic that uses the linear semantics is defined as linear time temporal logic LTL and LTL is formally defined using Bacchus-Nor form that is being used in computer science. So, a phi is a formula that phi can be given as universal truth that can be that is totology then it can be given as negation of the universal truth that is inverse of totology and then this can be be a formula P. This can be negation of formula negation of of phi and this can be be be a formula intersection formula conjunction with another formula formula disjunction with another formula. This formula implies another formula and then there is some temporal operators those are are X. So, this operator dis conjunction disjunction and and implications are the the the static formula and then there are temporal formula that is X, F, Z until V until and R. So, now here I will I will explain you in detail what are the these formulas. So, now here we we specify a system as a transition system as is the set of states this is transition function and then here L are the the label. So, this is a set of states as endowed with a transition relation and in such a way that every state as has some state as this this has has a this function is specified as a transition system and that is as transition function and L and so and this is specified as as a set of state as endowed with a transition relationship on such that every a state small as a set of member of as has some state as this which belongs also to the state as wherein you have transition from as to as this and that is labeled by by label as. In that here we define a path that that that is in a model M which is a infinite sequence of states as 1, as 2, as 3, as n and this path is represented as a pi and when pi is starting from a path as 1 is defined as as 1, 2, as 2, as 3, as 4 and as n. So, these the this formula as we discussed earlier this formula those are called as LTL formula those are are defined here that this pi is can be a temporal formula T that can be be a temporal formula of inverse of totology that can be a formula that that is valid LTL formula this can be negation this can be conjunction, disjunction and implication. So, then there there are temporal operators x, g, f until v until. So, now now in this if we we we define the this formula say this phi, phi 1 means phi 1 is is 1 formula and and phi 2 is is is another another formula. So, now now now here phi 1 and and say phi 2. So, this formula holds good if phi 1 holds good and phi 2 holds good. So, phi 1 disjunction with phi 2 holds good if phi 1 holds good or phi 2 holds good and this the implication holds good if phi 1 satisfies so that means, here phi 2 holds good if and only if phi 1 holds good temporal. So, now here say in in in a transition computation tree if I go from state as 1 to state as 2 to state as 3 from as 1 I can go to to say state as 3 to 2 to state again as 1 and so on so forth. So, now if some formula holds good in exactly in the next state then I I defined that as x of phi this is next of phi that means here like here for example, if I get a request for a common resource and I acknowledge that in very next state in that case here acknowledgement holds good in very next state. Hence here I can can specify that acts of acknowledgement so that means here acknowledgement holds good in in very next state. Sometimes so if some master raises a request and that request may be enter trend trend after a while or granted after a while. So, in that case you have to wait until it it is it is granted. So, that means here we are not very sure whether it would be granted in the next cycle or next to next cycle or next to next cycle. So, in that case here those properties can be specified as using a future operator. So, that means here the formula will hold good sometimes in the future not necessarily exactly in the next state or next to next state or next to next to next state, but somewhere in the future then we have operator as until operator until operator says that say phi formula holds good until psi holds good. So, what it says that if this is the state transition in that case here my formula phi should remain hold good until I reach to a formula psi. So, the psi should hold good. So, that means here in this always here there must be some means at that at least in one of the states psi should hold good. This is little bit strong and there is a weaker version of that that is weak version phi weak until psi. What it says is that phi should hold good until psi arrive. So, that means here this phi should hold good phi should hold good. So, that means here like for example, one of the example could be your acknowledgement sorry the request should remain active until you get until it is granted. So, that means here at least at some point in time you will have grant that is that we can represent using the until. So, that means here request hold good until it is granted I can write that, but in some of the cases we need weaker version. So, that means here like either this phi should hold good until psi arrives or phi continue to hold good phi phi phi phi in finite. So, that means here phi psi never arrives in that case also this formula holds good this is which weaker version of of until and then there is another formula that is known as phi religious psi. So, phi religious psi this says that here when phi arrives in that case here psi would be released. So, that means here you have psi psi psi and there would be at least one state in which here the this phi releases psi. So, that this is the difference between psi and the release and until operator that here at least there should be one state in which both of the formula should hold good after that we cannot argue about that. So, now here if you look at the progression of this this show you that in computation path your x operator will say that here x of f means here in the very next state f should hold good and in this state f should not hold good f until g that means here f should keep on hold keep hold true until g arrives f of g will tell you that at some time in the future g will hold good g is another operator that is global operator that means it says that in every state in this path your f should hold good and release operator will say you that here g releases f. So, with this with the definition of the syntax of LTL formula I complete my lecture here and I will continue with this in the next class wherein we will see how we can specify a transition system using this formula and then here how we can verify that using model checker. Thank you very much. Good day.