Assertion-Based Verification ABV. 2 Assertion Assertion: ïƒ is a conditional statement...

download Assertion-Based Verification ABV. 2 Assertion Assertion: ïƒ is a conditional statement that checks for specific behavior and displays a message if it does

of 39

  • date post

  • Category


  • view

  • download


Embed Size (px)

Transcript of Assertion-Based Verification ABV. 2 Assertion Assertion: ïƒ is a conditional statement...

  • Assertion-Based VerificationABV

  • AssertionAssertion:is a conditional statement that checks for specific behavior and displays a message if it does not occur.

    In Traditional Languages:Designers historically had the ability to craft assertions using both the Verilog and VHDL design languages.

    Lacking an assertion statement, the Verilog designer used a conditional statement to trigger the output of an error message.

    The VHDL designer used the assert statement inherent in VHDL to check for the violation of a condition and to output a message.

  • BenefitsProviding internal test points in the design.Simplifying the diagnosis and detection of bugs by localizing the occurrence of a suspected bug to an assertion monitor, which is then checked.Allowing designers to verify the same assertions using both simulation and formal verification.Increasing observability in both simulation and formal verification.Since the assertions were included in the design as it was created, formal verification could be started earlier, before any test vectors had been written.Assertions are also used at the design boundaries to provide checks for interface behavior. Useful when modules from different designers are integrated. Such interface-checking assertions make modules more portable. Modules with embedded assertions become self-checking wherever they are later reused.

  • Assertion in VHDLSyntax:

    assert desired_condition report repot message severity severity_level

    Modeling properties of the hardware system via assert is hard and tedious

  • Example1

  • Example2:

  • PSL (Property Specification Language)What is PSL?A declarative language for describing behavior and properties of system over timeKey characteristics of PSL :Mathematically precise well-defined formal semantics. Known efficient underlying verification algorithms.Intuitive and easy to learn, read, and write.A layered language, ideal for reuse, and supports multiple HDL flavorsVHDLVerilogSystemCSystemVerilog

  • Use of PSLDocumentation: easy to read and write but precise and executable property description instead of ambiguity of natural languages is omitted

    Driving Assertion-Based Verification:Formal verification ( Static verification )Simulation ( Dynamic verification ) Assertion based verification helps us in defining bugs at an earlier stage, before propagating to other parts of design

  • HistoryFVTC: Formal Verification Technical Committee.

  • PSL: A Layered Language

  • PSL: A Layered Language( not (A and B) )alwaysassert

  • Boolean Layer The Boolean layer is used to:Specify logic expressions without specific timing information using a standard HDL syntax such as Verilog and VHDLExample (Verilog):// A and B are mutually exclusive ( !(A & B) )

    Example (VHDL):-- A and B are mutually exclusive ( not (A and B) )

  • Boolean Layer Any subprograms, overloaded functions etc. allowed in a VHDL boolean expression can be used.Example:always (unsigned(ASLV)
  • Temporal Layer The temporal layer is used to:Specify when the Boolean expression must be valid

    Example:// A and B are always mutually exclusive always ( not (A and B) )t.!(A(t) & B(t))

    There are many temporal operators:always propertynever propertynext propertyuntil property

  • Temporal Layer Operators Occurrence operators:

    always: the property should hold in every cycle. never: the property should not hold during any cycle. eventually!: the property shall hold in some cycle in the future but before the end of verification process. next: the property shall hold in the next cycle(s). Clock Cycle Definition:never (GNT and BUSY)@falling_edge(CLK);always (EN1 or EN2)@(CLKevent and CLK = 1);always(ACK -> next (not BUSY))@rising_edge(CLK);

    It is possible to define a default clock and thus avoid the need to repeat the explicit clock operator @ in every single assertion.

    default clock = (rising_edge (clk)); assert always CONDITION;

  • Temporal Layer Operators

    until operator:requires that first property hold till the second property holds. pkt_startop |-> not pkt_xfer_en_n until pkt_endop

    once a packet is started, the pkt_xfer_en_n shall be low until the packet ends. before operator:requires that one property hold before another. opcode_fetch before execute_opcode;

    an opcode_fetch process should occur before an execute_opcode phase abort operator:there is a need to abort the checking in case of a reset, soft reset, pkt_abort etc. ({pkt_sop} |-> {not pkt_xfer_en_n until pkt_eop}) abort pkt_abort;

    aborts checking once a pkt_abort is seen.

  • Verification LayerThe verification layer is used to:Specify how to use the property:assert: the tool should attempt to prove the property,assume: the tool may assume the given property is true,cover: the tool should measure how often the given property occurs during simulation.Example1:// A and B must always be mutually exclusive assert always ( not (A and B) ); Example2:assert (always CONDITION) @(rising_edge (clk));

  • Modeling LayerThe modeling layer is used to:allows extra code fragments from the underlying language (VHDL) to be included with the properties to augment what is possible using PSL alone.For example, the modeling layer could be used to calculate the expected value of an output.

    Example:// If req is asserted, ack must be asserted in the next cycle SIGNAL req;req next (ack and gnt)) @rising_edge(clk);

  • PSL Layerssignal req;req next (ack AND gnt))Boolean layerTemporal layerVerification layerModeling layer

  • Usage-- psl property ENABLED is always Can break over several lines as long as each line is commented.Verification directives can be embedded in the HDL code as comments.

    -- These assertions are complete!-- psl property NOT_GNTBUSY is-- never (GNT and BUSY)@falling_edge(CLK);-- psl property P1 is-- always(ACK -> next (not BUSY))@rising_edge(CLK);-- psl assert NOT_GNTBUSY;-- psl assert P1;Note: VHDL comments are not allowed inside a PSL assertion, i.e. between psl and the semi-colon terminating the assertion.

  • Usage Assertions can be placed anywhere in a VHDL component, but it is better to group them together at the begining or end of your design code.

    2.Alternatively, verification directives can be grouped into verification units, or vunits, and placed in a separate file.Note: PSL keywords are case sensitive.

  • PSL SequencesSERE:Sequential Extended Regular Expressions:Where enabling and fulfilling conditions extended over several cycles.PSL sequences enable us to describe a sequence of Boolean expressions (i.e. states)

    PSL sequences are marked by curly braces { and }.Advancement of time occurs with each concatenation operator ;

    Example:{ req; busy; gnt }

  • PSL Sequences MatchingA PSL sequence can have multiple matching diagramsExample:{ req; busy; gnt }

  • Temporal Operators for SequencesPSL supports the following temporal operators for sequences: Overlapping implication|->Non-overlapping implication |=>Equivalent to next |->

    Example(s):sequence S1 = { req; ack } ;sequence S2 = { start; busy; end } ;

    // Event start occurs on the same clock cycle as ackproperty P1 = always S1 |-> S2 ;

    // Event start occurs on the next clock cycle after ackproperty P2 = always S1 |=> S2 ;

  • Temporal Operators for Sequencesfifo_almost_full |=> fifo_push |-> fifo_full;

    Once the fifo is almost full, a push in the next clock cycle shall make the fifo_full to be asserted (in the same clock as the fifo_push occurred).

  • Liveness Properties assert always req -> eventually! ack; i.e. whenever req is true, ack must go true at some future cycle, but there is no upper limit on the time by which ack is required to go true. This is known as a liveness property. Liveness properties are characterized by the fact that they do not possess a finite counter-example, and hence in principle they cannot be disproved by simulation.However, liveness properties can in principle be proved or disproved by static model checking tools.

  • Evaluation of SERE AssertionA SERE assertion, evaluated over several cycles, can pass through several states:An assertion starts inactive.At every evaluation point (e.g. clock edge), the first condition in the enabling SERE is checked.If this condition is true, the assertion becomes active. If the enabling SERE fails to complete, then the assertion becomes inactive without any error message.If the enabling SERE completes, then the assertion is enabled and the fulfilling SERE is checked.If this completes then the assertion passes. If the fulfilling SERE of an enabled assertion does not complete, the assertion fails.

  • Operators for SEREPSL supports the following operators for SERE: Repetition in n consecutive clock cycles[*n]Repetition in n non-consecutive clock cycles [=n]Repetition in n non-consecutive clock cycles [->n]we want to go to the nth repetition and immediately (1 clock after) after the occurrence of that last repetition we would like to check for the next expression in sequence. The intermediate repetitions may be non-consecutive i.e. can be spread across multiple cycles Repetition for 0 or any number of clock cycles [*]Repetition for 1 or any number of clock cycles [+]Repetition for n to m clock clock cycles [*n:m]The number of repetitions must be a positive integerKeyword inf stands for an infinite number of clock cycles

  • Operators for SERE{a[*2]} means {a;a}{S; T[*3]; V} Equivalent to {S; T; T; T; V}{a[*]} means {a;a;...;a} with a repeated zero or more times{a[+]} means {a;a;...;a} with a repeat