1© 2010 Cisco and/or its affiliates. All rights reserved. 1

How We Verified 5000 Lines of RTL with 3 Assertions

Nalin Nimavat (Cisco Systems) nnimavat@cisco.comVigyan Singhal (Oski Technology) vigyan@oskitech.com May 2012

2

The Device Under Test (DUT)

FED.vsd

Over 2N possible cases to verify!

3

DUT and Test Plan Implications for the Formal Verification• Key characteristics:

• First pass: (2N + 1) assertions to be formally verified.

• There are N fields, but all the fields are of different widths.

• Though the DUT is more like a register, can we apply memory abstractions to reduce the number of assertions and formal run time?

4

Memory Depth, Width Abstraction

5

Introduction to Symbolic Variables• Symbolic variables can sweep the whole range of variables.

• No change in RTL is required.

// If valid is high, for any given memory address, content of//the memory matches incoming data after 3 cycles.bit[15:0] formalAddr;

assert property P1 (vld == 1 |-> #3 mem[formalAddr] == $past(inData, 3);)

Symbolic Variable

6

How Symbolic Variables Are Used• All memory locations and bits are present.• An arbitrary address formalAddr, with the same

width as an actual address, is created.• An arbitrary bit fvBit, ranging from 0 to max width

of data, is created.• Symbolic variables are free running—they can point to anywhere.• No change in RTL is required.• As with abstractions, only one symmetric location and one symmetric data bit are used in the formal proof.

7

DUT: Create Symmetry

8

DUT: Hold Original Widths

9

Symbolic Variable for Depth

10

Symbolic Variable for Width

11

After Applying Symbolic Variables• Create helper code to determine the msb and lsb of

a field in the outVector, outVector(msb, lsb).

• Benefit of symmetry: We can now reduce the first and second requirements from N down to one assertion each!

After applying symbolic constants, only three assertions are used to completely verify the 5000 lines of DUT RTL.

12

Sample DUT Assertion// If there is space in input to accomodate full field, field // should be copied to the output

property fieldMatch; lsb >= 0 && dataSel[formalIndex] == 1 |-> ##n outVector[$past(lsb, n) + fvBit] == $past(field[formalIndex][fvBit] , n);endproperty

assert_fieldMatch : assert property(fieldMatch);

Symbolic Variable for Depth

Symbolic Variable for

Width

13

Bugs Found with the Formal Tool• All three assertions found bugs:

• Output for fieldM didn’t match • When there is no space for someId, all lsb's were not 0's.• When all N fields are on, 0's were not inserted in rest of lsb's

• Formal hit a bug instantly, took a long time in simulation.• In simulation, a lot of traffic was sent.• One field (in 2N) for which all lsb’s were not 0 for this condition.• Formal hit this bug right away.

• Formal guarantees regular and corner case coverage for all N fields – something impossible to achieve in simulation.

14

Limitations of symbolic variables

• Symbolic variables can be easily applied to memories and other designs with symmetry.

• For non-memory, non-symmetric designs, creating symmetry to exploit power of symbolic variables can be challenging.

• Symbolic variables needs to be properly constrained in order to achieve desired range.

15

Summary

• Applying symbolic variables can dramatically increase the scalability and decrease the run time of formal analysis.

• Creating symmetry and using helper code can dramatically simplify or reduce the number of assertions required.

• Bonus: No modifications to the original RTL are required!