Formal Semantics for PSL Modeling Layer and Application to the Verification of Transactional Models

Transcription

1 Forma Semantics for PSL Modeing Layer and Appication to the Verification of Transactiona Modes Luca FERRO, Laurence PIERRE TIMA (CNRS-GrenobeINP-UJF) 46 Av. Féix Viaet Grenobe cedex - France Emai: Luca.Ferro@imag.fr, Laurence.Pierre@imag.fr Abstract The IEEE standard PSL is now a commony accepted specification anguage for the Assertion-Based Verification (ABV) of compex systems. In addition to its Booean and Tempora ayers, it is syntacticay extended with the Modeing ayer that borrows the syntax of the HDL is which the PSL assertions are incuded, to manage auxiiary variabes. In this paper we propose a forma, operationa, semantics of PSL enriched with the Modeing ayer. Moreover we describe the impementation of this notion in our too for the dynamic ABV of SystemC TLM modes. Iustrative exampes are presented. I. INTRODUCTION Assertion-Based Verification (ABV) aims at guaranteeing that designs obey properties, usuay expressed under the form of ogico-tempora formuas (assertions) that capture the design intent [1], [2]. ABV aows to take advantage of advanced verification techniques and to benefit from a significant reduction in simuation debugging time [3]. The assertions can be checked using static (mode-checking) or dynamic (simuation-based) techniques. Languages ike the IEEE standards SVA [4] and PSL (Property Specification Language) [5] are typicay used to formaize them. The Booean ayer of PSL enabes to buid basic expressions commony used by the other ayers. The core of the anguage is the Tempora ayer, that gives the possibiity to describe compex tempora reations. The Modeing ayer is defined to augment what is possibe using PSL aone, in particuar it aows to manage auxiiary variabes (not present in the design) to express more eaborate properties. According to the anguage reference manua, the Booean and Modeing ayers borrow the syntax of the HDL is which the PSL assertions are incuded (for instance, we tak about VHDL or Veriog favors ), but no forma semantics is given for the Modeing ayer. However this feature can be very usefu in practice (e.g., for the expression of properties at the transactiona eve) and needs to be more ceary formaized. TLM (Transaction Leve Modeing) is distinctive of the SystemC anguage [6], which is in fact a ibrary of C++ casses for modeing circuits. TLM is much more abstract than RTL (Register Transfer Leve), it provides communication modes for compex data types between the components of the System on Chip (SoC). TLM is gaining acceptance, in particuar because the simuation of TLM modes is severa orders of magnitude faster, thus consideraby improving productivity in SoC design [7]. Therefore TLM specifications tend to become goden reference modes [8] and must be reiabe. In [9] we have presented a methodoogy that enabes the dynamic verification of tempora properties for TLM specifications: we check the vaidity of PSL assertions that express properties on communications i.e., properties associated with transactiona operations. A prototype too, caed ISIS, and experimenta resuts are featured in [10]. The contribution of this paper is twofod. First we propose a forma, operationa, semantics of PSL endowed with the Modeing ayer. Then we refine it to fit the transactiona eve, and we describe the impementation of this notion in our ISIS too. We depict its usefuness on some iustrative exampes. Deaing with additiona variabes is aso addressed for instance in [11], [12], but they mainy concentrate on the concept of oca variabes and the issues reated to their semantics in SVA. This context of SVA oca variabes is considered at the RT eve in [11], and the purpose is to generate hardware components for static verification. The use of oca variabes is aso addressed in [12]. The authors discuss the notion of scope of a variabe to overcome some drawbacks of the semantics of oca variabes in SVA, ike the fact that the union and intersection operators do not competey conform to the notions of set union and intersection. In this paper we focus on the notion of goba variabes. Since PSL [5] has not been given semantics for auxiiary variabes yet (neither goba nor oca), considering goba variabes (which is moreover the soe notion supported by the Modeing ayer) is a natura starting point. A. Overview of PSL II. FORMAL SEMANTICS The semantics of PSL properties [5] is defined with respect to finite or infinite execution traces, or words over the aphabet Σ=2 P {, } (P is a non-empty set of atomic propositions, and are such that, for every booean expression b, b and b). The ength of a trace v is denoted v, thei th evauation point over v is denoted v i 1, and v i.. indicates the suffix of v starting at v i. In this paper, we focus on properties of the Foundation Language (FL) cass of PSL, /DATE EDAA

2 which essentiay represents the inear tempora ogic. In the foowing, ϕ and ψ are FL formuas. Here is a short overview of the trace semantics as given in the anguage reference manua (see [5] for more detais): Booean expressions v = b v =0or v 0 b where is the satisfaction reation for booean expressions. Logica connectives v = ϕ v ϕ v = ϕ ψ v = ϕandv = ψ Next operator: the meaning of the next! operator is that the sub-property denoted by its operand shoud be verified from the next evauation point of the execution trace (the weak version next is simiar, except that the existence of a next evauation point is not mandatory): v = next! ϕ v > 1 and v 1.. = ϕ Strong Unti, unti! or U (cassicay, the weak unti operator unti does not impose the occurrence of ψ): v = [ϕuψ] k < v s.t. v k.. = ψand j <k,v j.. = ϕ As usua, the PSL formua aways ϕ means that ϕ must be verified on each evauation point of the trace. The strong next event! operator requires the satisfaction of ϕ the next time a booean expression b is verified: next event!(b)(ϕ) def = [ bub ϕ] B. Forma Semantics with the Modeing Layer The Modeing ayer aows to decare and give behavior to auxiiary signas and variabes. For the Veriog and VHDL favors, it consists of the synthesizabe subset of these anguages, whereas the SystemC favor consists of those decarations and statements which woud be ega in the context of the SystemC modue to which the PSL vunit is bound [13]. Due to the ack of forma framework, this ayer is sti rarey used and few exampes are avaiabe. Here is a very simpe exampe given in the Veriog favor: an additiona signa vaid_read_request is decared and receives the vaue of an expression evauated using signas of the design [13]. vunit modeing_exampe { wire vaid_read_request; assign vaid_read_request = read && read_en &&!busy; assert aways (vaid_read_request -> eventuay! data_vaid); } In this exampe, the additiona signa is used for the sake of readabiity but is not actuay mandatory. The Modeing ayer can aso be used to manage indispensabe new variabes (e.g., counters that sum vaues). Significant exampes wi be given in section IV. The reference manua does not give detais about the semantics of Modeing ayer constructs. It is commony admitted that the statements of the Modeing ayer shoud be evauated at each step of the evauation of the property. To give a forma semantics to an assertion ϕ augmented with a bock of statements m in the Modeing ayer, we have to formaize that the assignments of m perform side effects on variabes that can be used in the expression of ϕ. To that goa, we adopt an operationa semantics inspired from the one of [14], instead of a trace semantics ike the one given in section II-A. As in [14], we consider that the negation operator ony appears at the booean eve, which is coherent with the simpe subset of PSL used in the context of dynamic verification. In the foowing operationa rues, ϕ, ϕ, ψ and ψ denote FL formuas, b is a booean expression, DV denotes the set of a the variabes decared in the Modeing ayer, m is the bock of statements of the Modeing ayer, and ρ is the current environment (association of variabes of DV with their current vaues). ϕ m ρ is the interpretation of ϕ in which the variabes of DV are substituted by their vaues in ρ. Likein[14],a derivation is used: ϕ m ρ ϕ m ρ means that, in order to check if a word starting with the etter satisfies ϕ m ρ, one can check that ϕ m ρ is satisfied by the word without. Logica and (simiary for the ogica or): ϕ m ρ Next operators: ϕ m ρ ϕ ψ m ρ ψ m ρ ϕ ψ m ρ X!ϕ m ρ ϕ m ρ Xϕ m ρ ϕ m ρ ψ m ρ Unti operators (simiar rues for weak and strong versions): ϕ m ρ ϕuψ m ρ ϕ m ρ ψ m ρ ψ m ρ ψ (ϕ (ϕuψ)) m ρ Booean expressions: { b m T if ρ b ρ F otherwise where ρ b b [DV ρ(dv )] b [DV ρ(dv )] is b in which every identifier of DV has been substituted by its vaue in ρ. In these rues, ρ = m ρ which denotes the environment obtained after executing the statement bock m in the environment ρ and in the context of the atomic propositions of. In accordance with [14], iterativey appying these rues on aformuaφ over the etters of a word w, in an environment

3 ρ, is written φ w ρ where φ ɛ ρ = φ φ w ρ = φ w ρ where φ m ρ φ m ρ Then the satisfaction reation, with the initia environment ρ 0, is defined as foows: w φ ok(φ w ρ0 ) where ok cacuates whether a given formua has not been contradicted yet w.r.t. the sequence of etters that has aready been visited. We use the same function ok and we extend it simiary for weak and strong versions of the operators i.e., ok(f ) = fase ok(t ) = true ok(b) = true ok(ϕ ψ) = ok(ϕ) and ok(ψ) ok(ϕ ψ) = ok(ϕ) or ok(ψ) ok(xϕ) = true ok(x! ϕ) = true ok(ϕw ψ) = ok(ϕ) or ok(ψ) ok(ϕuψ) = ok(ϕ) or ok(ψ) Since the work of [14] ony considers weak operators, the notion of satisfaction above is sufficient. However PSL defines four eves of satisfaction for the dynamic verification context (where traces are finite); these eves are reevant as soon as strong operators are invoved. Hods and Hods strongy are two satisfaction reations (for simpe Hods, the property may not hod on any given extension of the trace). Both of them required that No bad states have been seen and A future obigations have been met. The Pending eve is defined as No bad states have been seen and Future obigations have not been met. Finay, Fais means A bad state has been seen. The ok function of [14] corresponds to the goa No bad states have been seen. Here we define a new function met that expresses the second goa A future obigations have been met. Combining the two functions enabes to define the Hods, Pending and Fais eves over the etters of a word w: Hods w,ρ0 (φ) = ok(φ w ρ0 ) and met(φ w ρ0 ) P ending w,ρ0 (φ) = ok(φ w ρ0 ) and met(φ w ρ0 ) Fais w,ρ0 (φ) = ok(φ w ρ0 ) The met function is defined as foows: met(f ) = true met(t ) = true met(b) = true met(ϕ ψ) = met(ϕ) and met(ψ) met(ϕ ψ) = (ok(ϕ) and met(ϕ)) or (ok(ψ) and met(ψ)) or met(ϕ) and met(ψ) met(xϕ) = true met(x! ϕ) = fase met(ϕw ψ) = true met(ϕuψ) = met(ϕ) and ok(ψ) and met(ψ) III. MODELING LAYER AND THE VERIFICATION OF TLM MODELS A. Overview of the Method and Too A method for the automatic construction of SystemC checkers (monitors) from PSL assertions, and for the observation of communication events, has been specified and impemented in a prototype too with a graphica user interface [9], [10]. The monitors are inked to the design under test through the observation mechanism, and it remains to run the SystemC simuator on this combination of modues. Any property vioation during simuation is reported by the monitors. The too now supports the decarations and statements of the Modeing ayer, on the basis of the semantics described in section II-B, sighty refined as expained in section III-C. Figure 1 gives a screenshot of the ISIS window that aows to capture the assertion. If decarations and statements of the Modeing ayer are present, they are interpreted according to the semantics: since the observation mechanism wi trigger an activation of the monitors at each step of the evauation of their assertions, we automaticay insert the Modeing ayer statements at the beginning of the monitoring functions (to evauate the expressions in the appropriate environment). Our monitors for strong operators are aso equipped with a pending output [9] that encodes the notions discussed in section II-B. The approaches proposed in [15], [16] and [17] concentrate on mode checking SystemC designs. Abstraction techniques are required to get tractabe modes, or ony imited (pieces of) designs can be processed. Simuation-oriented soutions are given in [18], [19] and [20]. With regard to these reated works, our methodoogy has the foowing main attractive features: the statements of the assertions can invove severa channes, and this group of channes can be heterogeneous (signas and TLM channes), it is reativey few intrusive in the SystemC code, which is augmented with mechanicay generated new casses, and undergoes few modifications in its decarative parts, it provides a high eve of automation: the monitors are automaticay generated, and the code is mechanicay instrumented with user-guidance through a GUI, it is highy efficient, both for the construction of the checkers and during instrumented simuation. Moreover, to our knowedge, none of the above-mentioned reated approaches offer soutions to support the Modeing ayer. Some commercia toos aso provide for introducing PSL assertions in SystemC designs. The too Cadence Incisive Unified Simuator supports TLM, but ony signas can be invoved in the assertions. Other toos ike Synopsys VCS ony accept RTL descriptions. B. Booean Layer - Conditions on the Communications At the synchronous RT eve, the observations that constitute the traces are made on the cock edges but here, observation points are reated to the communication actions [9].

4 Fig. 1. The ISIS Too - Capture of the Observed Communications and of the Assertions According to the PSL reference manua, the SystemC favor of the Booean ayer shoud aow the use of any SystemC booean expressions. Thus, atomic propositions are C++ booean expressions. We give the user the possibiity to use these atomic propositions to express conditions on the communications and, through the GUI, we aso give him the possibiity to seect the reevant communications for each property (see on the eft side of Figure 1). Being abe to identify the critica communication events in a given context is crucia. For instance, depending on his confidence in a channe, the user may prefer to activate the verifications when this channe is written or when it is read. From the set of seected communication operations, the too automaticay generates ad hoc booean functions, e.g., write_call() here for each seected channe/port, to check the occurrence of write actions. Hence f.write_call(), where f is an instance of one of those seected eements, can then be used in assertions to express the occurrence of a write action. More generay, name.fctname_call() denotes that the communication function fctname of the eement name has just been caed. We aso use name.fctname_call.p# to denote the parameter in position # of function fctname (0 is used for the return vaue). C. Modeing Layer and TLM At the transactiona eve, observations points are reated to the communication actions, and etters of the execution traces are more compex than at the RT eve. In particuar, they can invove the parameters of these communications. To take that aspect into consideration, we sighty modify the notion of etter: we consider that etters are no more made of atomic propositions, but rather made of pairs (id, vaue) where id can be the identifier of a variabe of the design or an identifier ike name.fctname_call.p# (see section III-B), and vaue is the corresponding current vaue. Moreover, such a vaue may be undefined at a given observation point if the corresponding communication action does not occur at that point. To take this aspect into account, we refine the previous semantics with the notion of undefined vaue (denoted ϑ beow). The operationa rue for booean expressions has to be modified accordingy. It becomes: b m ρ where ρ = m ρ and { T if ρ b F otherwise { fase if a pair (id, ϑ) Ib ρ b b otherwise I b is the set of identifiers present in the booean expression b, and b = b [DV ρ(dv )][Ib (I b )] denotes b in which a the identifiers of DV have been substituted by their vaue in ρ and a the identifiers of I b have been substituted by their vaue in. With regard to atomic propositions q, the origina PSL semantics states that q iff q [5]. It now becomes q iff q [DV ρ(dv )][Iq (I q)] = true. IV. APPLICATIONS AT THE TRANSACTIONAL LEVEL A. DMA Exampe Let us consider a simpe DMA exampe deivered with the first draft of the TLM 2.0 ibrary and pictured in Figure 2. A master programs the DMA through a memory-mapped router (which is a TLM communication channe) in order to perform transfers between two memories.

5 Fig. 2. DMA Exampe A property P1 of interest is: any time a source address is transferred to the DMA, a read access in the first memory eventuay occurs and the right address is used. The expression of this property requires the memorization of the address transferred to the DMA (which is the second parameter of the write operation), to be abe to check that this address is actuay used when the memory is read. To avoid atering the origina description, the Modeing ayer is mandatory. In the property beow, req_src_addr is the variabe that memorizes this vaue each time the source register of the DMA is overwritten (we reca that initiator_port.write_call.p2 denotes the second parameter of function write): // ---- Modeing ayer ---- int req_src_addr; int dma_src_reg = 0x4000+pv_dma::SRC_ADDR; if (initiator_port.write_call() && initiator_port.write_call.p1 == dma_src_reg) req_src_addr = initiator_port.write_call.p2; // ---- Assertion ---- //PROPERTY P1: assert ALWAYS ((initiator_port.write_call() && initiator_port.write_call.p1 == dma_src_reg) -> NEXT_EVENT!(mem1.read_CALL()) (mem1.read_call.p1 == req_src_addr)); Test coverage anaysis can aso easiy be performed by the introduction of counters in the Modeing ayer, for instance here to evauate the repartition of read/write operations in different sectors of the memories. For this exampe, we ran various simuations in which memory transfers are performed, data of ength 64 bytes are transferred (each atomic transfer carries 4 bytes i.e., 16 transfers are needed). For instance, the monitor for P1 is evauated 4.2 miion times (21 times for each transfer: 5 writings to the DMA + 16 read operations). In that case, the CPU time for simuation without monitoring is 4.97 seconds 1, and 5.54 seconds for the same simuation with the verification of property P1. It takes 6.14 seconds if we both perform the verification of P1 and check coverage. 1 On an Inte Core2 Duo (3 GHz) under Debian Linux, 2 GB memory B. Protoco over Fauty Channe This case study is a SystemC version of the protoco over fauty channe described in [21]. A sender sends messages to a receiver through a channe that can oose or dupicate messages. The receiver sends back acknowedgements through a simpe signa ackr; each acknowedgement is the number of the ast received message. Depending on the vaue of the acknowedgment signa, messages are re-emitted or not by the sender. According to [21], two properties are verified: we aways have ackr nb sent ackr+1, where ackr is the acknowegment sent by the receiver and nb sent is the number of the ast message sent by the sender (P2), the acknowegment sent by the receiver is aways equa to the ength of the actua data (number of different messages) it received (P3). Both of them require the Modeing ayer. These properties are stated as foows: int nb_sent = 0; if (ch.write_call()) nb_sent = (ch.write_call.p1).number; //PROPERTY P2: assert ALWAYS (ack.read_call() -> (ack.read_call.p0 <= nb_sent && nb_sent <= (ack.read_call.p0+1))) int nmsg = 0; int n; if (ch.read_call()) n = (ch.read_call.p1).number; if (n!= nmsg) nmsg++; // new message arrived //PROPERTY P3: assert ALWAYS (ack.read_call() -> (ack.read_call.p0 == nmsg)) In the simuations we reaized, the sender sends 4000 times a random number of messages (between 1 and 4000). The CPU time for simuation without monitoring is 8.97 seconds; seconds are needed for the same simuation with the verification of property P2, and seconds with the verification of property P3 (ony seconds are needed for the simuation with the verification of both properties together, because the observation time is factorized ). C. Motion-JPEG Patform Let us finish with a more eaborate exampe, a Motion-JPEG decoding patform described at the Transaction Accurate eve [22], see Figure 3. It embeds a configurabe number of processors (here we use one processor), a goba memory, a hardware semaphore RAM, and hardware terminas (TTY). The traffic generator takes its data from a MJPEG fie, and RAMDAC is the viewer. Among the properties that can be verified to check the reiabiity of the communication channe, the foowing one aso needs the Modeing ayer: the data that are written on the RAMDAC are exacty the ones that have been transmitted

6 Fig. 3. M-JPEG Patform [22] by the EU (P4). The expression of this property requires the memorization of the data that are transmitted by the EU, to be compared to the data written on the RAMDAC: unsigned int req_data; unsigned int written_data; if (eu.write_call()) req_data = eu.write_call.p2; if (rdac.write_call()) written_data = rdac.write_call.p2; //PROPERTY P4: assert ALWAYS (eu.write_call() -> NEXT_EVENT(rdac.write_CALL()) (req_data==written_data)); In this property, req_data is the variabe that memorizes the transmitted data; it is updated when eu executes its method write. For the sake of carity, we aso use the Modeing ayer to manage a variabe written_data that stores the data written on the RAMDAC. It is not mandatory because its vaue is checked at the same time it is known (a ca to the method write of the RAMDAC occurs), therefore rdac.write_call.p2 coud be used directy in the NEXT_EVENT expression. Simuations that correspond to 10 s of SystemC time require about s of CPU time without monitoring, and s with the verification of property P4. Finay it is worth mentioning that, for a the exampes, simuations have been performed with and without introducing bugs in the design. A the situations that ead to a vioation of the properties have been detected, the monitors are correct by construction. Using the soution deveoped in [23], we can aso produce test programs with a variety of nomina and corner cases. V. CONCLUSION The use of auxiiary variabes using the Modeing ayer of PSL is a crucia issue for the assertion-based verification of TLM specifications. To make it possibe, we have both given a forma semantics for PSL augmented with the Modeing ayer, and impemented an associated soution in our runtime verification too. The forma semantics goes beyond the transactiona eve and can be used in any context. This work is a first step towards improving our assertionbased verification technique at the transactiona eve. Supporting the notion of goba variabes is not sufficient in genera. For exampe, with the Motion-JPEG decoding patform, memorizing the written data into req_data each time new data are transmitted by the EU is sufficient here because the patform does not work for instance in a pipeined way. We are working on a soution for considering simutaneousy severa evauations of the assertion when severa data are processed concurrenty (using different, oca, variabes). REFERENCES [1] H. Foster, A. Kronik, and D. Lacey, Assertion-Based Design. Kuwer Academic Pub., [2] J. Horgan, Assertion Based Verification, EDACafe Weeky, weeky.php?articeid=209195, October [3] H. Foster, Appied Assertion-Based Verification: An Industry Perspective, Foundations and Trends in Eectronic Design Automation, vo. 3, no. 1, January [4] IEEE Std , IEEE Standard for System Veriog: Unified Hardware Design, Specification and Verification Language. IEEE, [5] IEEE Std , IEEE Standard for Property Specification Language (PSL). IEEE, [6] IEEE Std , IEEE Standard System C Language Reference Manua. IEEE, [7] W. Kingauf, M. Burton, R. Günze, and U. Goze, Why We Need Standards for Transaction-Leve Modeing, SOC Centra, Apri [8] R. Goering, Transaction modes offer new dea for EDA, EETimes, March [9] L. Pierre and L. Ferro, A Tractabe and Fast Method for Monitoring SystemC TLM Specifications, IEEE Transactions on Computers, vo. 57, no. 10, October [10] L. Ferro and L. Pierre, ISIS: Runtime Verification of TLM Patforms, in Proc. Forum on specification & Design Languages (FDL 09), September [11] J. Long and A. Seawright, Synthesizing SVA Loca Variabes for Forma Verification, in Proc. DAC 07, [12] C. Eisner and D. Fisman, Augmenting a reguar expression-based tempora ogic with oca variabes, in Proc. FMCAD 08, November [13], A Practica Introduction to PSL. Springer, [14] K. Caessen and J. Martensson, An Operationa Semantics for Weak PSL, in Proc. FMCAD 04, November [15] A. Habibi and S. Tahar, Design and Verification of SystemC Transaction Leve Modes, IEEE Transactions on VLSI Systems, vo. 14, no. 1, January [16] M. Moy, F. Maraninchi, and L. Maiet-Contoz, LusSy: an open too for the anaysis of systems-on-a-chip at the transaction eve, Design Automation for Embedded Systems, [17] D. Karsson, P. Ees, and Z. Peng, Forma Verification of SystemC Designs Using a Petri-Net Based Representation, in Proc. DATE 2006, [18] B. Niemann and C. Haubet, Assertion-Based Verification of Transaction Leve Modes, in Proc. ITG/GI/GMM Workshop, February [19] Y. Lahbib, Extension of Assertion-Based Verification Approaches for the Verification of SystemC SoC Modes, Ph.D. dissertation, University of Monastir (Tunisia), [20] W. Ecker, V. Esen, and M. Hu, Impementation of a Transaction Leve Assertion Framework in SystemC, in Proc. DATE 07, [21] K. Chandy and J. Misra, Parae Program Design: A Foundation. Addison-Wesey, [22] P. Gerin, X. Guérin, and F. Pétrot, Efficient impementation of native software simuation for MPSoC, in Proc. DATE 08, 2008, pp [23] L. Ferro, L. Pierre, Y. Ledru, and L. Du Bousquet, Generation of Test Programs for the Assertion-Based Verification of TLM Modes, in Proc. IEEE Internationa Design and Test Workshop (IDT 08), December This work is party supported by the French projects SFINCS (ANR) and SoCKET (FCE)