Journal of Applied Mathematics

Volume 2013, Article ID 740194, 14 pages

http://dx.doi.org/10.1155/2013/740194

## Wu’s Characteristic Set Method for SystemVerilog Assertions Verification

^{1}School of Software of Dalian University of Technology, Dalian 116620, China^{2}School of Computer and Information Technology, Beijing Jiaotong University, Beijing 10044, China^{3}School of Electronic and Information Engineering, Lanzhou Jiaotong University, Lanzhou 730070, China^{4}Guangxi Key Laboratory of Hybrid Computation and IC Design Analysis, Guangxi University for Nationalities, Nanning 530006, China

Received 8 February 2013; Revised 9 April 2013; Accepted 9 April 2013

Academic Editor: Xiaoyu Song

Copyright © 2013 Xinyan Gao et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

We propose a verification solution based on characteristic set of Wu’s method towards SystemVerilog assertion checking over digital circuit systems. We define a suitable subset of SVAs so that an efficient polynomial modeling mechanism for both circuit descriptions and assertions can be applied. We present an algorithm framework based on the algebraic representations using characteristic set of polynomial system. This symbolic algebraic approach is a useful supplement to the existent verification methods based on simulation.

#### 1. Introduction

Currently, functional verification becomes an intensive challenge phase in the state-of-the-art digital systems development process. Assertion-based verification (ABV) has emerged as a promising solution to express and verify design properties.

SystemVerilog [1–3], the industry’s first unified hardware description and verification language (HDVL), was developed originally by Accellera and can be viewed as an extension of the Verilog language with the added benefit of supporting object orientated constructs and assertions.

SystemVerilog was adopted as IEEE Standard 1800–2005 firstly in 2005, and the latest version is IEEE standard 1800–2009, the current version. SystemVerilog has been accepted by a wide variety of companies and has been supported by most EDA companies in their tools in practice which has totally changed the way designers specify and verify functional requirements and properties of digital systems.

Many efforts have been devoted to assertion checking solvers in recent years including model checking [4], theorem proving [5], and other simulation-based checking methods. In [6], an efficient approach to model check safety properties expressed in assertion property is studied. Proving SVA safety properties using induction-based BMC is studied in [7]. All these methods can be classified into two categories: formal and informal aspects.

On the one hand, formal method such as model checking often suffers from “state explosion” problem and cannot be applied to large scale cases. Model checking of SVAs is PSPACE complete even for a “simple subset.” If more elaborated features, like intersection of regular expressions or instantiation of properties, are used, the problem becomes EXPSPACE complete.

On the other hand, informal methods such as conventional simulation for assertion checking is a well-understood and most commonly used technique, but only feasible for very small scale systems and cannot provide exhaustive checking.

A promising semiformal technique, symbolic simulation, proposed by Darringer [8] as early as 1979, can provide exhaustive checking by covering many conditions with a single simulation sequence.

In our work, to address the challenge, we propose an alternative implementation mechanism based on Wu’s characteristic set by combining symbolic computation with symbolic simulation for assertions checking. This paper aims to verify whether an expected SVA property holds or not on the finite traces produced after several cycles running over a given sequential circuit.

The underlying idea is that, for any combinational circuit model, we can derive its data flow based on polynomial representation model. Meanwhile, for any sequential circuit model and a given running cycle number, we can also derive its polynomial representation by unrolling this sequential circuit for several times into a pure combinational model. In a similar way, we can get polynomial set representation model of a temporal assertion written in SVA.

By suitable restrictions of SVA and defining a constrained subset of SVA, we can get the polynomial set representations of the subset. Based on the polynomial set model, cycle-based symbolic simulation can be performed to produce symbolic traces. We then apply Wu’s method symbolic algebra approach to check the zeros set relation between their polynomial representations and determine whether the expected assertion holds or not at current running cycle.

The rest of this paper is structured as follows. Preliminary knowledge with regarding to SystemVerilog used throughout this paper is introduced in Section 2. Section 3 introduces polynomial representation modeling for synchronous digital systems. Section 4 describes the cycle-based model and sequential unrolling. Section 5 will discuss sequential assertions modeling with polynomials. In Section 6, we will propose a complete verification algorithm framework based on Wu’s characteristic set. Section 7 will demonstrate an example using MMP tool based on our method. In the last section, we make a short summary of our research and discuss the future work.

#### 2. SystemVerilog Preliminary

In this section, we will give some preliminary knowledge which may be used in later sections of the paper.

SystemVerilog, as an IEEE approved hardware description language, has combined many of the best features of both VHDL and Verilog and provided superior capabilities for system architecture, design, and verification.

Therefore, on the one hand, VHDL users will recognize many of the SystemVerilog constructs, such as enumerated types, records, and multidimensional arrays.

On the other hand, Verilog users can reuse existing designs: SystemVerilog is a superset of Verilog so no modification of existing Verilog code is required.

SystemVerilog provides special language constructs and assertions [9, 10], to verify design behavior. An assertion is a statement that a specific condition, or sequence of conditions, in a design is true. If the condition or sequence is not true, the assertion statement will generate an error message.

One important capability of SystemVerilog is the ability to define assertions outside of the Verilog modules and then bind them to a specific module or module instance. This feature allows test engineers to add assertions to existing Verilog models, without having to change the model in any way. One of the goals of SystemVerilog assertions is to provide a common semantic meaning for assertions so that they can be used to drive various design and verification tools.

In SystemVerilog, there are two types of assertions: immediate assertions and concurrent assertions.

Immediate assertions are primarily intended to be used with simulation and evaluate using simulation event-based semantics. While concurrent assertions are based on clock semantics and use sampled values of variables.

Concurrent assertions can be used in always block or initial block as a statement, a module as a concurrent block, an interface block as a concurrent block, a program block as a concurrent block.

An example of a property using sequence and formal argument is demonstrated as the following. ; ; ;

The property states that if holds then local variable gets assigned the value of . Then within 3 to 5 cycles later, is **TRUE** and should be equal to the contents of the saved local variable . The property fails if is **FALSE** or if it follows a successful ; the expression “” fails to be **TRUE** within the range from 3 to 5 cycles after .

As shown in this example, a concurrent assertion property in SystemVerilog will never be evaluated by itself except it is invoked by a verification statement. Therefore, only the statement **assert property** can cause the checker to perform assertion checking.

The verification statement in SVA has three forms: assert, assume, and cover. In this paper, only **assume** and **assert** are involved: the statement **assert** to specify the property as a checker to ensure that the property holds for the design; the statement **assume** to specify the property as an assumption for the environment. The purpose of the assume statement is to allow properties to be considered as assumptions for formal analysis as well as for dynamic simulation tools.

Basically, SVA has four language layers: Boolean, sequence, property, and statement. (1)*Boolean layer*. The boolean layer consists of boolean expressions in which each variable referenced is either a design variable or a local variable of the assertion. (2)*Sequence layer*. The sequence layer consists of regular expressions over the boolean layer. (3)*Property layer*. The property layer combines sequences to create temporal logic formulas. (4)*Statement layer*. The statement layer defines whether a property is to be evaluated as an obligation, an assumption, or a coverage goal.

Moreover, SVA provides local variables as one of its distinguishing features. A local variable is used to capture the value of an expression at one point within a property and hold it for later reference, after which the local variable may be reassigned. We will provide an efficient way to handle this feature in later section of this paper.

#### 3. Synchronous Digital System and Its Polynomial Representation

In this section, we will discuss polynomial set expressions for elementary units of combinational and sequential circuits.

We mainly focus on the register transfer level (RTL) description of the circuit systems. Previous work [11, 12] has shown that any combinational circuit can be uniquely represented by a minimum order polynomial.

Here, we give an alternative dataflow-based polynomial set representation model for our assertions checking purpose whose zero set can make such a data-flow model work well.

##### 3.1. Combinational Logic Modeling

In this paper, we only focus on arithmetic unit for calculating fixed-point operations. For any arithmetic unit, integer arithmetic operations (**addition**, **subtraction**, **multiplication**, and **division**) and basic logical operations, like “**AND**”, “**OR**”, and “**NOT**”, can be modeled by the following polynomial forms in Table 1.

We will then discuss another important control structure in digital system, multiplexer, which can be used to join many small datapaths together to make bigger datapaths.

Basically, multiplexer provides a set of condition bits, , a set of target identifiers, , and a mapping from condition bit values to target identifiers. This mapping takes the form of a condition tree: , with .

Note that for any bit-level variable , a limitation should be added for each.

##### 3.2. Sequential Unit Modeling

In sequential circuits, flip-flops (FF) and latches are fundamental building blocks which are used as data storage elements. In this paper, we will reduce all sequential units to a simple unified model described below.

The flip-flop can be equivalently modeled as a multiplexer. We have the following proposition to state this model.

Proposition 1. *For a -typed flip-flop model ( is the next state of and is the output signal of the flip-flop) with an enable signal , then its equivalent combinational formal is , , whose polynomial representation form can be described as* , , *or * .

*Proof. *Let be the current state and denote the next state of the flip-flop. When the signal is 0, has the same value as so that the FF maintains its present state; when the signal is 1, takes a new value from the input (where denotes the new value of next state of the FF). Therefore, we have the 2-value multiway branch model and its polynomial set representation for FF.

This establishes the proposition.

Proposition 2. *Let be an FF model ( is the next state of and is the output signal of the flip-flop) without enable signal; then its equivalent combinational formal polynomial algebraic model can be described as .*

*Proof. *Straightforward.

Proposition 3. *Let be an FF model ( is the next state of and is the output signal of the flip-flop) with a reset signal; then its equivalent combinational formal polynomial algebraic model can be described as .*

*Proof. *Straightforward.

#### 4. Cycle-Based Simulation and Sequential Unrolling

In this section, we will sketch the underlying system model for symbolic simulation used in our work.

Basically, symbolic simulation takes in variables , as shown in Figure 1, called free variables, as input and produces output expressions in terms of the variables . The free variable can be either bit-level, integer, or constant 0 and 1. The symbolic simulator simulates simultaneously the entire set of the points that the input variables can take on.

Cycle-based symbolical simulation of a circuit for cycles can be regarded as unrolling the circuit times. The unrolled circuit is a pure combinational one, and the th copy of the circuit represents the circuit at cycle . Thus, the unrolled circuit contains all the symbolic results for cycles.

The simulation process can be described as follows. Firstly, cycle-based symbolical simulation is initialized by setting the state of the circuit to the initial vector. Each of the primary input signals will be assigned a distinct symbolic variable or a symbolic constant. Then, at the end of a simulation step, the expressions representing the next-state functions generally undergo a transformation-based optimization. Afterwards the newly generated functions are used as present state for the next state of simulation.

Generally, for a sequential circuit, one time frame of a sequential circuit is viewed as a combinational circuit in which each flip-flop will be converted into two corresponding signals: a pseudo primary input (PPI) and a pseudo primary output (PPO). Time-frame expansion is achieved by connecting the PPIs of the current time frame to the corresponding PPOs of the previous time frame.

#### 5. SVA Expressions with Polynomial Set

In this section, we will discuss concurrent assertions and their temporal layer representation models.

As mentioned previously, concurrent assertions express functional design intent and can be used to express assumed input behavior, expected output behavior, and forbidden behavior. That is, assertions define properties that the design must meet. Many properties can be expressed strictly from variables available in the design, while properties are often constructed out of sequential behaviors.

We begin with the introduction of polynomial notions for various layers modeling.

##### 5.1. Polynomial Notions and Algebraization

For clarity, we introduce the following symbolic notions for algebraic representation used in the rest of this paper.(1)For any symbolic (circuit, unit, signal, sequence, property, etc.) , its algebraic representation form is denoted by . (2)If a running cycle is given, its algebraic representation form can be denoted by . (3)Furthermore, if a time range is specified, its algebraic representation form can then be denoted by .

Note that more detailed description of time range will be discussed in next subsection.

For a given sequential circuit, to illustrate the sequential modeling for a given cycle number clearly, we will define the following indexed polynomial representation model for the th cycle by using the above notions.

*Definition 4 (indexed polynomial representation). *Let denote the input signals for the th clock cycle, denote the intermediate signals, and denote the output signals. We define the time-frame expansion model as **indexed polynomial representation** for the sequential circuit as the following:
where, denotes the th time-frame model of the original circuit and denotes the number of clock cycle.

In the following, we will discuss Boolean layer modeling based on above polynomial notions.

The Boolean layer of SVA forms an underlying basis for the whole assertion architecture which consists of Boolean expressions that hold or do not hold at a given cycle.

In SVA, the following are valid Boolean expressions:

For example, assertion is also a valid Boolean expression stating that the 16-bit vectors and are equal.

The state of a signal variable in current cycle will be viewed as a zero of a set of polynomials. We have the zero set building rules.** ** for any signal which holds at a given time-frame , thus, the state of ( is active high at cycle ) can be represented by polynomial . That is, . alternatively, the state of ( is active low at time-frame ) can be represented by polynomial . That is, . For any signal and , we have: and hold. Where and are time frames.

##### 5.2. Time Range and Its Unrolled Model

We will then discuss the important feature of SVA, time range, and its signal constraint unrolled model.

In SVA, for each sequence the earliest time step for the evaluation and the latest time step should be determined firstly. The sequence is then unrolled based on above information. Finally, the unrolled sequence will be modeled with polynomial set.

In [7], a time range calculating algorithm is provided. Here, we will introduce some related definition and special handling for algebraization purpose. The syntax of “time range” can be described as follows:

Note that is computed at compiling time, must result in an integer value, and can only be 0 or greater.

In this paper, we only focus on constant time range case. Thus, its form can be simplified as(1),(2),

where, , are signals and , are sequences.

Let “” be a sequence; we will demonstrate how to equivalently derive its polynomial representation step by step through this example.

Assume the starting time frame is ; then: the sequence will start () sequences of evaluation which are

Correspondingly, we can derive their algebraic forms as follows:

Then we have the equivalent form of above representation set as

Finally, we can have their polynomial set forms by following the zero set building rules discussed previously: , and .

Similarly, we can also derive the equivalent algebraic representation of by following the same steps.

##### 5.3. Sequential Depth Calculation

The time range of a sequential is a time interval during which an operation or a terminal of a sequence has to be considered and is denoted by a closed bounded set of positive integers:

Furthermore, the maximum of two intervals and is defined by .

In the same manner, the sum of two time range, of and is defined as .

*Definition 5 (maximum sequential depth). *The maximum sequential depth of a SVA expression or a sequence, written , is defined recursively:(1), if is a signal; (2), if is a signal; (3), if , are sequences of SVA; (4), if , are sequences of SVA; (5), if , are sequences of SVA; (6), if , are sequences of SVA; (7), if , are sequences of SVA; (8), if is a sequence of SVA.

Note that if , we have and .

##### 5.4. Sequence Operator Modeling

Temporal assertions define not only the values of signals but also the relationship between signals over time. The sequences are the building blocks of temporal assertions and can express a set of linear behavior lasting one or more cycles. These sequences are usually used to specify and verify interface and bus protocols.

A sequence is a regular expression over the boolean expressions that concisely specifies a set of linear sequences. The Boolean expressions must be true at those specific clock ticks for the sequence to be true over time.

SystemVerilog provides several sequence composition operators to combine individual sequences in a variety of ways that enhance code writing and readability which can construct sequence expressions from Boolean expressions.

In this paper, operator, operator, and the operator are not supported by our method.

In the following, we will discuss the algebraic representation of the supported sequence operators.

operator. In SystemVerilog, the construct is referred to as a cycle delay operator.

“” and “” are concatenation operators: the former is the classical regular expression concatenation; the latter is a variant with one-letter overlapping. The cycle delay in SVA has two basic forms.(a)A “” followed by a number specifies the cycles delay from the current clock cycle to the beginning of the sequence that follows.(b)A “” followed by a rang specifies the cycles delay from the current clock cycle to the beginning of the sequence that follows.

It is easy to derive the algebraic representation forms for this operator by following the method discussed in Section 5.2.

operator. The two operands of intersect operator are sequences. The requirements for match of the intersect operation are as follows: (a)both operands must match,(b)the lengths of the two matches of the operand sequences must be the same.

“" denotes that starts at the same time as . The intersection will match if , starting at the same time as , matches at the same time as matches.

The sequence length matching intersect operator constructs a sequence like the nonlength matching operator, except that both sequences must complete in same cycle.

operator. This operation “" states that starts at the same time as and the sequence expression matches with the later of and matching. This binary operator is used when both operands are expected to match, but the end times of the operand sequences can be different.

That is, “” denotes that both and hold for the same number cycles. Then, the matches of “” must satisfy the following: (a)the start point of the match of must not be earlier than the start point of the match of ;(b)the end point of the match of must not be later than the end point of the match of .

The sequence nonlength matching operator constructs a sequence in which two sequences both hold at the current cycle regardless of whether they complete in the same cycle or in different cycles.

operator. The sequence operator constructs a sequence in which one of two alternative sequences holds at the current cycle. Thus, the sequence “” states that either sequence “” or sequence “” would satisfy the assertion.

operator. SystemVerilog allows the user to specify repetitions when defining sequences of Boolean expressions. The repetition counts can be specified as either a range of constants or a single constant expressions.

The syntax of repetition operator can be illustrated as the following: .

The number of iterations of a repetition can be specified by exact count.

From above discussion, we have the following rules for polynomial set-based representation.

*Rule 1. *Assume that , , and are valid SVA sequences; the rules in Table 2 can be used to construct the corresponding polynomial set representations.

##### 5.5. Local Variables Representation

An important feature in SVA is that variables can be used in assertions which is highly useful in pipelined designs. These local variables are optional and local to properties. They can be initialized, assigned or reassigned a value, operated on, and compared to other expressions.

The dynamic creation of a variable and its assignment are achieved by using the local variable declaration in a sequence or property declaration and making an assignment in the sequence.

A simple example of property with a local variable is specified below: ;
* *; * * ;

Thus, local variables of a sequence (or property) may be set to a value, which can be computed from a parameter or other objects (e.g., arguments. constants, or objects visible by the sequence (or property)).

For the algebraization of SVA properties with local variables, in our method these local variables will be taken as common signal variables (symbolic constant) without any sequential information.

Thus, the polynomial set representation for property will be translated in the following form:

##### 5.6. Property Operator Modeling

In SVA, a property that is a sequence evaluates to true if, and only if, there is a nonempty match of the sequence. Property expressions are built using sequences, other sublevel properties, and simple Boolean expressions via property connectives.

In general, property expressions are built using sequences, other sublevel properties, and simple Boolean expressions.

These individual elements are combined using property operators which are listed as follows: (“sequence” form); (“parenthesis” form); (“negation” form); (“or” form); (“and” form); (“implication” form); (“implication” form); (“reset” form)

Note that **disable iff** will not be supported in this paper. Property operators construct properties out of sequence expressions.

operators. The SystemVerilog implication operator supports sequence implication and provides two forms of implication: overlapped using operator and nonoverlapped using operator , respectively.

The implication operator takes a sequence as its antecedent and a property as its consequent. For each successful match of the antecedent sequence, the consequence sequence is separately evaluated, beginning at the end point of the matched antecedent sequence. All matches of antecedent sequence require a match of the consequence sequence.

operator. “” states that the evaluation of the property returns the opposite of the evaluation of the underlying .

operator. “” states that the property evaluates to **true** if, and only if, both and evaluate to **true**.

operator. “” states that the property evaluates to **true** if, and only if, at least one of and evaluates to **true**.

operator. This operator has two valid forms which are listed as follows.(a). A property of this form evaluates to **true** if, and only if, either evaluates to **false** or evaluates to **true**.(b). A property of this form evaluates to **true** if, and only if, either evaluates to **true** and evaluates to **true** or evaluates to **false** and evaluates to **true**.

From the previous discussion, we have the checking rules for property reasoning.

*Rule 2. *Assume that , , and are valid SVA properties, denotes a SVA sequence, and denotes the system model to be checked; the following transformation rules in Table 3 are used to construct the corresponding verification process, where is a self-defined justification function which can take either polynomial sets or original models as input arguments and is used to determine wether a given holds or not with respect to a circuit model . Additionally, , , and are standard logical connectives.

##### 5.7. Constrained Subset of SVAs

SystemVerilog assertions formally define the syntax and grammar of an assertion language that can define design properties and constraints, including temporal (i.e., spread over several cycles) characteristics. The atoms of the SVA concurrent assertions are so called sequences. A sequence is a regular expression that describes the behavior of signals over time. A property of SVA is composed of sequences by property operators.

As described in [13], the total set of SVA can be divided into 4 subgroups, namely, simple sequence expression (SSE), interval sequence expression (ISE), complex sequence expression (CSE), and unbounded sequence expression (USE). Here, in our method, only a subset of these groups can be supported.

Formally, we will give the following definition for this subset.

*Definition 6 (constrained subset of SVA). *The constrained subset of SVA supported by algebraic symbolic polynomial representation is defined recursively as the following:(1),(2) ,

where denotes a Boolean expression and all Boolean operators are supported, (, ) denotes a sequence, (, ) denotes a property, denotes a local variable name, and denotes an expression.

For sequence operators, unspecified upper bound time range and **first-match** operator are excluded from the constrained subset. Additionally, property operator **disable iff** will not be supported also.

In this paper, only a constrained subset of SVA language defined above can be supported by our method.

Firstly, we translate the properties described by the constrained subset of SVA into flat sequences according to the semantics of each supported operator.

Secondly, the unrolled flat sequences will be added temporal constraints to form proportional formulas with logical connectives (, , and ).

Finally, the resulted proportional formulas will be translated into equivalent finite polynomial set.

Then, the verification problem is reduced to proving zero set inclusion relationship which can be resolved by characteristic set-based algebraic approaches.

#### 6. Characteristic Set Based Verification Principle and Algorithm

In this section, we will discuss the checking algorithm based on Wu’s characteristic set. We first recall some fundamental knowledge in Wu’s method.

##### 6.1. Wu’s Method Preliminary

Wu’s method [14, 15] is an efficient algorithm for solving multivariate polynomial equations introduced by Wen-Tsun Wu. It also has succeeded in mechanical geometry theorem proving. For further details and elementary introduction, we refer the reader to [16].

Let denote the polynomial ring in variables with coefficient , for every in the range , and is an algebraically closed field.

In what follows, without loss of generality, we assume that the given variables ordering is fixed as Assume and let be the maximum degree of with respect to .

*Definition 7. *Let ; the greatest variable is called the *main variable* of such that , denoted by . The biggest index is called the class, denoted by . If we assume as a univariate polynomial with , we can write , where . In this case, and are, respectively, the *initial* and the *main degree* and are denoted by and .

*Definition 8 (pseudo division). *For any two polynomials , with . There exist a nonnegative number and polynomials and , such that . Where is denoted by . We denote the remainder on pseudo division (pseudo remainder) of by with respect to the variable by .

*Definition 9 (Wu’s characteristic set). *Let and be two polynomial system, and is a triangular set; a triangular set is called a characteristic set of if

Theorem 10 (zero decomposition theorem). *Let denote the zero set of and be a characteristic set of ; then
**
where .*

Now we briefly outline the essential steps about Wu’s method on geometry theorem proving [17].

Algebraize a geometric theorem by converting it into a system of algebraic equations. We will translate the theorem’s hypotheses into a set of hypotheses equations , and the theorem’s conclusion into a polynomial .

Triangulize the system of hypotheses equations using pseudo-division. Then we will obtain the hypothesis equations denoted as

Perform successive pseudo division on the transformed hypotheses in triangular form by the conclusion equation , yielding a final remainder : If this final remainder , we will say that the conclusion follows from the hypotheses .

As mentioned above, the characteristic set of a polynomial system is a special triangular form. We can use the characteristic set of hypotheses equations as the triangular form, denoted by . Roughly speaking, the soul of Wu’s method on theorem proving is to check whether the zero set of the expected consequent equations includes the zero set of hypotheses equations or not.

Our checking method is based on algebraic geometry that studies of geometric objects arising as the common zeros of collections of polynomials. The aim is to find polynomials whose zeros correspond to pairs of states in which the appropriate assignments are made.

Let and denote the zero set for circuit polynomial set and assertions polynomial set respectively. Let denote that assertion holds under model .

We aim to attempt to determine whether assertion holds or not. Therefore, we have

Theorem 11. *Suppose that is a property, is the precondition of , and is a system model. Let and be the polynomial set representations for and , respectively, constructed by previous mentioned rules. is the polynomial set representation for .**Let , , ; denotes the characteristic set of , and is the function which computs the remainder by successive pseudo division; then we have
*

*Proof. *Firstly, let and denote the zero sets for circuit polynomial set and assertions polynomial set , respectively. Since , let denote the zero sets for . Let denote that the assertion holds under model .

Our aim is to attempt to determine whether assertion holds or not. Thus, we have
As mentioned previously, Wu’s method can be used to determine the inclusion relationship of zero sets. Thus we have

Let , which denotes the characteristic set of ; according to (15) and (16), we have
This establishes the theorem.

##### 6.2. Checking Algorithm

From above discussion, we have the following core decision algorithm.

*Algorithm 12 (Assertion Checking: ). * * ***Input**: Circuit model , an assertion ; * ***Output**: Boolean: or ; * ***BEGIN** /* Step 0: initialize input signals via testbench */ 00 ; 01 ; /* Step 1: build polynomial set for antecedent */ 02 ; /* Step 2: build polynomial set for consequent */ 03 ; /*Step 3: calculate the */ 04 ; /*Step 4: calculate the characteristic set of */ 05 ; /*Step 5: check the final remainder by successive pseudo-division */ 06 if(){ 07 return ; } 08 return ; /* Assertion does hold */ * ***END**

#### 7. Case Study and Experiment

In this section, we will firstly study a simple circuit to show how the SVA properties are verified by polynomial representations and characteristic set computation-based approaches. We then show a scalable experiment with the classic synchronous arbiter circuit to evaluate the performance of our approach.

##### 7.1. Circuit and Assertion Modeling

As an example, consider the synchronous circuit in Figure 2, whose polynomial set can be constructed as follows:

Throughout this paper, an internal variable name refers to the corresponding signal in the original circuit, and the subscript denotes the time-frame (or the th clock cycle). For convenient, variable (i.e., ) denotes the next state of () by omitting time-frame .

To illustrate the problem clearly, we define polynomial set representation for the th time frame as follows:

Assume 8 cycles are needed to check; therefore, we then have the model representation: .

For any boolean variable, we must add an extra constraint polynomial: for all .

The circuit produces 3-phase nonoverlapping outputs, which can decode the overlapping outputs , , and to nonoverlapping outputs , , and as shown in Figure 3.

Assume the initial values of the registers , , and are all , they will be , respectively, after 1 cycle running and after 2 cycles. This property can be specified by the following SVA assertions: ; ; ; ; ; ;

Afterward, we will demonstrate the verification process step by step.

##### 7.2. Assertion Checking Using MMP

We ran this example by using MMP [18] (Mathematics Mechanization Platform). MMP is a group of symbolic computation and automated theorem proving softwares based on Wu’s Method. Before running, we manually translated all models into polynomials for this example.

In this paper, all experiments are conducted on a PC with an intel 2.40 GHz CPU (intel i5 M450) and 1024 MB of memory.

As shown in MMP outputs, the given circuit has been modeled as polynomial set (its characteristic set is denoted by ), and the assertion results as . The checking process is listed below: ; /* Circuit Model */ , , ; ;

From the running result, the return value of is 0 which means can be pseudo divided with no remainder by . Similarly, the expected polynomials and both return 0. Thus, from the previously mentioned verification principles, it is easy to conclude that the assertion holds under this circuit model after 2 cycles.

The example took about 0.07 seconds and 810 KB of memory when applying Wu’s method in MMP environment. This case can be a fairly complete illustration of how the checking algorithm works.

##### 7.3. Experiment with Classic Arbiter Circuit

The synchronous arbiter circuit [19], depicted in Figure 4, is one of the most popular test cases of model checkers. We also test our approach with this circuit currently to illustrate the performance of our approach. The convert algorithm which can automatically translate the circuit netlist into polynomial set has been implemented in C++.

This arbiter circuit is used to grant access on each clock cycle to a single client among a number of clients contending for the use of common resources.

Here, we briefly explain how the arbiter works. For more detailed information regards to the arbiter, please refer to [19]. The basic part of the arbiter is the colored cell which is repeated times to form a round robin chain. Each cell has a request input (, here, denotes the number of client) and an acknowledge output . The grant output of cell is passed to cell and indicates that no clients of index less than or equal to are requesting. Hence a cell may assert its acknowledge output if its grant input is asserted. Each cell has a register which stores one when the token is present. The registers form a circular shift register which shifts up one place each clock cycle.

Each cell also has a register for waiting which is set to one when the request input is asserted and the token is present.

The register remains set while the request persists until the token returns. At this time the cell’s override and acknowledge outputs are asserted

For clarity, we use the first subscript of a variable name which denotes the cell number and the second subscript which denotes the current time-frame in this example.

The corresponding polynomial set for each cell and time-frame can then be constructed as follows:

Additionally, the chain relation between cells can be modeled as below:

The desired properties of the arbiter circuits can be described as follows:(1)no two acknowledge outputs are asserted simultaneously,(2)every persistent request is eventually acknowledged,(3)acknowledgment is not asserted without request.

In the following description, if clear from the context, the time-frame index will be omitted for convenience. Note that and . Intuitively, properties expressed in CTL can be listed as follows:(1), (2), (3).

Note that the arbiter can handle the access of clients to a common resource. If a client asserts a request, the client will wait at most clock cycles before it is served. Therefore, in our test, it is sufficient to verify the properties that the circuit is unrolled time frames.

Evidently, these properties can be equivalently expressed in SVA codes. In [7], the authors have provided a detailed assertion description for the case that client number is 3.

In this example, we will follow their idea and explain how to translate them into algebraic polynomials as below:

Let and . The polynomial representation of consequent can then be formulated as .

Assume and let and . If holds, then holds.

Similarly, the precondition of this property is that only one single token is present in this circuit chain. We have the polynomial representation of antecedent: ().

More specifically, if the subscript for time frame is considered, we can define and ; here, denotes the number of time frames and denotes the number of cells.

In this experiment, we also tested the circuit with an artificial error that an “” gate is replaced by an “OR” gate by mistake, as shown in Figure 4. We mainly demonstrate whether or not our method is able to find bugs. The corresponding polynomial set model can be updated by replacing with .

Consequently, in our test with 3 cells, it took only 9.37 MB of memory and 10.5 seconds to find the result which means the circuit did not meet the required property. Then we concluded that there must be some design errors in the circuit.

More detailed experimental results concerning polynomials and variables for safety property verification of the circuit are listed in Figure 5.

##### 7.4. Discussion

So far, several methodologies are developed to address the verification problem. In this section, we will discuss these methods by the arbiter example shown in Figure 4.

In [19], a BDD-based model checking is proposed. The performance of this method is fairly promising. The size of the transition relation increases linearly as the number of cells. But the OBDD representing the set of states grows exponentially in the number of cells. The performance of BDD-based symbolic model checking procedure is plotted in Figure 6. For more detailed information about this test case, please refer to [19].

Due to advances in SAT-solving techniques [20], SAT-based bounded model checking (for short, BMC) can often handle much larger designs than BDDs. In [7], the authors presented a SAT-based BMC to verify the arbiter circuit. They found that the size of the instance for the safety property is proportional to the number of arbiter clients and the liveness property has quadratic size.

In our method, the worst case complexity of our symbolic algebraic method checking is very high due to intermediate expression swell. As shown in Figure 5, the number of polynomials to be generated for liveness property checking has quadratic size of the number of cells as well as the number of variables. Currently, from the runtime consumed, the SAT solver still shows better performance than our method. Fortunately, a great deal of optimization techniques can be applied to improve the performance.

As an example, we will explain how to apply variable projection technique to optimize the calculating process. Assume the given circuit has been modeled as polynomial set and variable order list is (its projection for the zero set on is denoted by ). We will firstly calculate the projection to eliminate the unnecessary elements: and then the zero set: . Correspondingly, the performance will be improved greatly.

#### 8. Conclusion

In this paper, we presented Wu’s method-based verification approach for SVA properties checking.

Our approach is based on polynomial models construction for both circuit models and SVA assertions. This method is to eventually translate a simulation-based verification problem into a pure algebraic zero set determination problem by a series of proposed steps, which can be performed on MMP environment. For synchronous sequential circuits, we adapted a parameterized polynomial set modeling method based on time-frame expansion. We also defined a constrained subset of SVAs which is powerful enough for practical purpose and proposed a practical algebraization method for each sequence and property operator of this subset. This method allows users to deal with more than one state and many input combinations every cycle due to symbolic simulation. The advantage comes directly from the fact that many vectors are simulated at once using symbolic value.

Basically, our approach may provide a useful supplement to existing methods based on OBDD or SAT and may also provide important theoretical insights by allowing the application of important results in symbolic computation to the assertion checking problems. We plan to extend the work presented in several directions.

We plan to optimize the solver based on Wu’s method. As we know, Wu’s method-based mathematics mechanization platform is a powerful computation environment for general purpose. On the one hand, we will apply variables projection and other mathematics approaches to improve the effectiveness of this algorithm. On the other hand, we also plan to implement our core steps by using the programming language in MMP.

In this paper, we only test some classic cases mentioned in previous papers to illustrated the feasibility of our method currently. In the future, we plan to test the benchmarks from ISCAS’89 and ISCAS’85 and other industrial examples to provide a comprehensive evaluation of our approach and compare to the state-of-the-art where circuits with several thousands of gates and dozens of input signals.

In this paper, we only concentrated our attention on the basic assertion checking algorithm, but the other important features such as counterexample generation were not discussed. We will also work on those issues in the future.

Furthermore, in the field of symbolic computation, there is a rich collection of solutions to solving polynomials, methods for inclusion of zero sets, and so forth. We are interested in applying some of the useful results and methods to verification area.

#### Acknowledgments

The project is supported by the Fundamental Research Funds for the Central Universities (1600-852014) and partly by the National Natural Science Foundation of China under Grant no. 60973147, the Natural Science Foundation of Guangxi under Grant no. 2011GXNSFA018154, the Science and Technology Foundation of Guangxi under Grant no. 10169-1, Guangxi Scientific Research Project no. 201012MS274, and Grants (HCIC201102) of Guangxi Key Laboratory of Hybrid Computation and IC Design Analysis Open Fund. The authors would like to thank their colleagues for participating in the research. They also appreciate the anonymous reviewers for their helpful comments.

#### References

- IEEE System Verilog Working Group, “IEEE Standard for SystemVerilog C Unified Hardware Design, Specification, and Verification (IEEE Std 1800–2005),” IEEE, 2005.
- “IEEE draft standard for system verilog—unified hardware design, specification, and verification language,” in
*Proceedings of the IEEE P1800/D3*, pp. 1–1304, November2011. - “System Verilog,” http://www.systemverilog.org/.
- E. Clarke, O. Grumberg, and D. Peled,
*Model Checking*, MIT Press, 2000. - T. Tuerk, K. Schneider, and M. Gordon, “Model checking PSL using HOL and SMV,” in
*Proceedings of the 2nd International Haifa Verification Conference on Hardware and Software, Verification and Testing (HVC ’06)*, E. Bin, A. Ziv, and S. Ur, Eds., pp. 1–15, Springer, Berlin, Germany, 2006. - T. Launiainen, K. Heljanko, and T. Junttila, “Efficient model checking of PSL safety properties,”
*Computers & Digital Techniques*, vol. 5, no. 6, pp. 479–492, 2011. View at Google Scholar - R. Wille, G. Fey, M. Messing, G. Angst, L. Linhard, and R. Drechsler, “Identifying a subset of systemverilog assertions for efficient bounded model checking,” in
*Proceedings of the 11th EUROMICRO Conference on Digital System Design Architectures, Methods and Tools (DSD '08)*, pp. 542–549, September 2008. View at Publisher · View at Google Scholar · View at Scopus - J. A. Darringer, “Application of program verification techniques to hardware verification,” pp. 375–381, 1979. View at Google Scholar · View at Scopus
- C. Spears,
*System Verilog for Verification*, Springer. - J. Bergeron, E. Cerny, A. Nightingale, and A. Hunter,
*Verification Methodology Manual for System Verilog*, Springer. - J. Smith and G. De Micheli, “Polynomial circuit models for component matching in high-level synthesis,”
*IEEE Transactions on Very Large Scale Integration (VLSI) Systems*, vol. 9, no. 6, pp. 783–800, 2001. View at Publisher · View at Google Scholar · View at Scopus - J. Smith and G. De Micheli, “Polynomial methods for component matching and verification,” in
*Proceedings of the IEEE/ACM International Conference on Computer-Aided Design (ICCAD '98)*, pp. 678–685, November 1998. View at Scopus - S. Das, R. Mohanty, P. Dasgupta, and P. P. Chakrabarti, “Synthesis of system verilog assertions,” in
*Proceedings of the Design, Automation and Test in Europe Conference (DATE '06)*, pp. 70–75, European Design and Automation Association, Leuven, Belgium, March 2006. View at Scopus - W. T. Wu, “On the decision problem and the mechanization of theorem-proving in elementary geometry,”
*Scientia Sinica*, vol. 21, no. 2, pp. 159–172, 1978. View at Google Scholar · View at MathSciNet - W. T. Wu, “Basic principles of mechanical theorem proving in geometries,”
*Journal of Automated Reasoning*, vol. 2, no. 4, pp. 221–252, 1986. View at Google Scholar - D. Wang,
*Elimination Methods.*, Springer, Wien, NY, USA, 2001. - J. Elias, “Automated geometric theorem proving,”
*The Montana Mathematics Enthusiast*, vol. 3, no. 1, pp. 3–50, 2006. View at Google Scholar - X. S. Gao and Q. Lin, “MMP/geomete—a software package for automated geometric reasoning,” in
*Proceedings of the 4th International Workshop of the Automated Deduction in Geometry (ADG '02)*, vol. 2930 of*Lecture Notes in Computer Science*, pp. 44–66, September 2002. View at Scopus - K. McMillan,
*Symbolic Model Checking*, Kluwer Academic, 1993. - M. W. Moskewicz, C. F. Madigan, Y. Zhao, L. Zhang, and S. Malik, “Chaff: engineering an efficient SAT solver,” in
*Proceedings of the 38th Design Automation Conference*, pp. 530–535, June 2001. View at Scopus