Assertion-Based Verification

Assertion-Based Verification ABV and Formal Property Checking Harry Foster Chief Scientist Verification info@verificationacademy.com www.verificationacademy.com

Session Overview After completing this session you will... Understand a systematic approach to create a formal testplan Understand classes of designs that lend themselves to formal property checking Understand different use models for formal property checking

Need for Formal Verification How long would it take to exhaustively simulate this example? 1000000011101011011011110111 A [31:0] 101010001000110101110100101 B [31:0] E assert_implication u1 ( clk, rst_n, (A==B), E ); assert_implication u2 ( clk, rst_n, E, (A==B) );

Need for Formal Verification How long would it take to exhaustively simulate this example? A [31:0] B [31:0] E assert_implication u1 ( clk, rst_n, (A==B), E ); assert_implication u2 ( clk, rst_n, E, (A==B) ); 2 64 vectors X 1 vector every micro-second = 584,941 years An extremely fast simulator by today s standards!

How is formal different than simulation? initial states // SystemVerilog Assertion property p_comp; @(posedge clk) E -> (A==B); endproperty assert property (p_comp);

How is formal different than simulation? initial states // SystemVerilog Assertion property p_comp; @(posedge clk) E -> (A==B); endproperty assert property (p_comp); Very fast!

How is formal different than simulation? initial states // SystemVerilog Assertion property p_comp; @(posedge clk) E -> (A==B); endproperty assert property (p_comp); Very fast!

How is formal different than simulation? initial states // SystemVerilog Assertion property p_comp; @(posedge clk) E -> (A==B); endproperty assert property (p_comp); Very fast!

Types of Assertions Verification Engineer Design Engineer High-Level Assertions Requirement focused Black-box assertions Accounted for in testplan Compliance traceability Create reusable ABV IP Low-Level Assertions Implementation focused White-box assertions Not accounted for in testplan Improve observability Reduce debugging time

Formal Bug Hunting vs. Assurance Bugs Found Bug hunting Assurance Rev 0 RTL Tapeout Time Bug Hunting Many RTL assertions Success: # bugs found Productivity focus Assurance A few spec focused assertions Success: Design meet spec Quality focus

Maturity an Organization s Formal Capabilities Could an organization with ad hoc methodologies successfully build a reusable, object-oriented, constrained-random, coverage-driven testbench... repeatedly? Could an organization lacking sufficient skills formally prove a cache controller?

Formal Planning Identify Candidates Identify Candidate Executable Spec Encoder Channel Compressed Audio Decoder Define Closure Execution Strategy Sequential in nature Potentially involves data transformation (math) Not a good candidate for formal!

Formal Planning Good Candidates Identify Candidate TX Data Link Layer PHY Executable Spec Define Closure Execution Strategy RX Concurrency Multiple streams Good candidates for formal!

Formal Planning to Identify Requirements Identify Candidate Describe Executable Spec Define Closure Execution Strategy

Formal Planning to Identify Requirements Identify Identify Candidate Describe Document Interfaces Executable Spec Define Closure Execution Strategy

Formal Planning to Identify Requirements Identify Identify Candidate Describe Document Interfaces Capture Executable Spec Requirements Define Closure Execution Strategy

Formal Planning Creating Properties Identify Identify Candidate Describe Document Interfaces Capture Executable Spec Requirements Formalize Properties Define Closure Execution Strategy // --------------------------------------------- // SVA : Bus legal states // --------------------------------------------- property p_valid_inactive_transition; @(posedge clk) disable iff (bus_reset) ( bus_inactive) => (( bus_inactive) (bus_start)); endproperty a_valid_inactive_transition: assert property (p_valid_inactive_transition);

Formal Planning Creating Properties Identify Identify Candidate Describe Document Interfaces Capture Executable Spec Requirements Formalize Properties Define Coverage Closure Execution Strategy // --------------------------------------------- // SVA : Bus legal states // --------------------------------------------- property p_valid_inactive_transition; @(posedge clk) disable iff (bus_reset) ( bus_inactive) => (( bus_inactive) (bus_start)); endproperty a_valid_inactive_transition: assert property (p_valid_inactive_transition);

Formal Planning Execution Strategy Identify Identify Candidate Describe Document Interfaces Capture Executable Spec Requirements Formalize Properties Order your list of properties: Did a respin previously occur for a similar property? Are you concerned about achieving high coverage for a particular property? Define Coverage Closure Execution Select Strategy Is the property control-intensive? Is there sufficient access to the design team for a particular property?

Formal Planning Bug Hunting vs. Assurance Identify Identify Candidate Describe Document Interfaces Capture Executable Spec Requirements Formalize Properties Define Coverage Closure Execution Select Strategy Formal Verification Your strategy will depend on the goal, resources, and level of maturity Exhaustive proofs for critical logic Bug hunting in complex logic Interface compliance testing Coverage improvement

Bus-Based Design Example CPU 1 CPU 2 Bridge Datapath Control UART Arbiter Bus A I/F FIFO I/F Bus B Memory Controller Graphics Controller Datapath FIFO Timer

Nonpipelined Bus Interface clk rst_n sel[0] en I/F addr write rdata I/F Master wdata Slave 0

Non-Burst Write Transaction 0 1 2 3 4 addr Addr 1 write sel[0] en wdata Data 1 state INACTIVE START ACTIVE INACTIVE

Non-Burst Read Transaction 0 1 2 3 4 addr Addr 1 write sel[0] en rdata Data 1 state INACTIVE START ACTIVE INACTIVE

Conceptual Bus States INACTIVE sel[0] == 0 en == 0 setup no transfer no transfer START sel[0] == 1 en == 0 transfer setup ACTIVE sel[0] == 1 en == 1

Interface Requirements Property Name Description Bus legal treansitions p_state_reset_inactive p_valid_inactive_transition Initial state after reset is INACTIVE ACTIVE state does not follow INACTIVE p_valid_start_transition Only ACTIVE state follows START p_valid_active_transition ACTIVE state does not follow ACTIVE p_no_error_state Bus state must be valid:!(se==1 & en==1) Bus stable signals no transfer INACTIVE sel[0] == 0 en == 0 setup START sel[0] == 1 en == 0 p_sel_stable p_addr_stable Slave select signals remain stable from START to ACTIVE Address remains stable from START to ACTIVE transfer ACTIVE sel[0] == 1 en == 1 setup p_write_stable p_wdata_stable Control remains stable from START to ACTIVE Data remains stable from START to ACTIVE

Use Modeling Code to Simplify Coding `ifdef ASSERTION_ON //Map bus control values to conceptual states if (rst_n) begin bus_reset = 1; bus_inactive = 1; bus_start = 0; bus_active = 0; bus_error = 0; end else begin bus_reset = 0; bus_inactive = ~sel & ~en; bus_start = sel & ~en; bus_active = sel & en; end `endif bus_error = ~sel & en; no transfer INACTIVE sel[0] == 0 en == 0 setup START sel[0] == 1 en == 0 ACTIVE sel[0] == 1 en == 1 transfer setup

Formalize Properties Property Name Bus legal treansitions p_state_reset_inactive Description Initial state after reset is INACTIVE // --------------------------------------------- // REQUIREMENT: Bus legal states // --------------------------------------------- property p_state_reset_inactive; @(posedge clk) disable iff (bus_reset) $past(bus_reset) -> (bus_inactive); endproperty no transfer INACTIVE sel[0] == 0 en == 0 setup START sel[0] == 1 en == 0 transfer setup a_reset_state: assert property (p_state_reset_inactive); ACTIVE sel[0] == 1 en == 1

OVL Assertions Example Property Name Bus legal treansitions p_valid_inactive_transition Description ACTIVE state does not follow INACTIVE // --------------------------------------------- // REQUIREMENT: Bus legal states // --------------------------------------------- assert_next p_valid_inactive_transition (clk, rst_n, bus_inactive, (bus_inactive bus_start)); no transfer INACTIVE sel[0] == 0 en == 0 setup START sel[0] == 1 en == 0 ACTIVE sel[0] == 1 en == 1 transfer setup

SVA Examples property p_valid_inactive_transition; @(posedge clk) disable iff (bus_reset) ( bus_inactive) => ((bus_inactive) (bus_start)); endproperty a_valid_inactive_transition: assert property (p_valid_inactive_transition); INACTIVE sel[0] == 0 en == 0 property p_valid_start_transition; @(posedge clk) disable iff (bus_reset) (bus_start) => (bus_active); endproperty a_valid_start_transition: assert property (p_valid_start_transition); no transfer setup START sel[0] == 1 en == 0 ACTIVE sel[0] == 1 en == 1 transfer setup

Easy to Hard to Formally Verify Arbiter Design Block Easy Difficulty Timing Controller AHB Bus Bridge SRAM Controller AXI Bus Bridge SDRAM Controller DDR Controller DDR2 Controller USB Controller Cache Controller PCI-Express JPEG/MPEG DSP Encryption Floating-Point Unit Easy Easy Easy OK OK (more difficult with data integrity) OK (more difficult with data integrity) Medium Difficult (long latency) More Difficult Hard (complex & long latency) NOT-GOOD-FOR-FORMALPROPERTY-CHECKING NOT-GOOD-FOR-FORMALPROPERTY-CHECKING NOT-GOOD-FOR-FORMALPROPERTY-CHECKING NOT-GOOD-FOR-FORMALPROPERTY-CHECKING

Processor Example & Assurance Difficulty Bus Interface Unit (BIU) Instruction Cache Unit (ICU) Data Cache Unit (DCU) Integer Unit (IU) Floating Point Unit (FPU) PwrDwn, Clock Scan Unit (PCSU) Stack Manager Unit (SMU) Memory Management Unit (MMU)

Bug Hunting Hot Spots with Assertions Bus Interface Unit (BIU) Instruction Cache Unit (ICU) Data Cache Unit (DCU) Integer Unit (IU) Floating Point Unit (FPU) PwrDwn, Clock Scan Unit (PCSU) Stack Manager Unit (SMU) Memory Management Unit (MMU) = Embedded RTL assertions for hot spot

Formal Bug Hunting vs. Assurance Bugs Found Bug hunting Assurance Rev 0 RTL Tapeout Time

Session Recap In this session you session we introduced... A systematic approach to create a formal testplan Classes of designs that lend themselves to formal property checking Different formal property checking use models

Training and Consulting Resources Mentor Graphics Training Scalable Verification Courses - A wide range of instructor led classes - Located in public training centers in major cities or onsite at your workplace - Web-based events with live instructors are also available. Mentor Graphics Consulting Questa Verification Methodology JumpStart Knowledge-Sourcing Model - Infuse knowledge into your organization while addressing your immediate product development challenges

Other Resources Assertion-Based Design Harry Foster, Adam Krolnik, David Lacey Springer, 2004 Creating Assertion-Based IP Harry Foster, Adam Krolnik Springer, 2008

Assertion-Based Verification ABV and Formal Property Checking Harry Foster Chief Scientist Verification info@verificationacademy.com www.verificationacademy.com