daniel e. gisselquist, ph.d. technology,llc · 2021. 3. 20. · basics Ź basics generalrule assert...
TRANSCRIPT
![Page 1: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/1.jpg)
GisselquistTechnology, LLC
An Introduction to
Formal Methods
Daniel E. Gisselquist, Ph.D.
![Page 2: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/2.jpg)
Lessons
Ź Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
2 / 285
Day one
1. Motivation2. Basic Operators3. Clocked Operators4. Induction5. Bus Properties
Day two
6. Free Variables7. Abstraction8. Invariants9. Multiple-Clocks10. Cover11. Sequences12. Final Thoughts
![Page 3: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/3.jpg)
Course Structure
Ź Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
3 / 285
˝ VHDL logic examples
![Page 4: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/4.jpg)
Course Structure
Ź Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
3 / 285
˝ VHDL logic examples˝ System Verilog assertion wrappers
![Page 5: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/5.jpg)
Course Structure
Ź Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
3 / 285
˝ VHDL logic examples˝ System Verilog assertion wrappers˝ Each lesson will be followed by an exercise
There are 12 exercises˝ My goal is to have 50% lecture, 50% exercises˝ Leading up to building a bus arbiter
and testing an synchronous FIFO
![Page 6: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/6.jpg)
Motivation
Welcome
Ź Motivation
Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
4 / 285
![Page 7: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/7.jpg)
Lesson Overview
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
5 / 285
1. Why are you here?2. What can I provide?3. What have I learned from formal methods?
Our Objectives
˝ Get to know a little bit about each other˝ Motivate further discussion
![Page 8: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/8.jpg)
Your expectations
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
6 / 285
What do you want to learn and get out of this course?
![Page 9: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/9.jpg)
From an ARM dev.
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
7 / 285
˝ “I think the main difference between FPGA and ASICdevelopment is the level of verification you have to gothrough. Shipping a CPU or GPU to Samsung or whoever,and then telling them once they’ve taped out that you have aCat1 bug that requires a respin is going to set them back$1M per mask.
˝ “. . . But our main verification is still done with constrainedrandom test benches written in SV.
˝ “Overall, you are looking at 50 man years per projectminimum for an average project size.”
![Page 10: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/10.jpg)
Would not exist
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
8 / 285
“If we would not do formal verification, we wouldno longer exist.”
– Shahar Ariel, now the former Head of VLSI design at Mellanox
![Page 11: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/11.jpg)
Pentium FDIV
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
9 / 285
One little mistake . . .
. . . $475M later.
![Page 12: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/12.jpg)
Personal Experience
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
10 / 285
I have proven such things as,
˝ Formal bus properties (Wishbone, Avalon, AXI, etc.)˝ Bus bridges (WB-AXI, Avalon-WB)˝ AXI DMA’s, firewalls, crossbars˝ Prefetches, cache controllers, memory controllers, MMU˝ SPI slaves and masters˝ UART, both TX and RX˝ FIFO’s, signal processing flows, FFT˝ Display (VGA) Controller˝ Flash controllers˝ Formal proof of the ZipCPU
![Page 13: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/13.jpg)
Some Examples
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
11 / 285
I’ve found bugs in things I thought were working.
1. FIFO2. Pre-fetch and Instruction cache3. SDRAM4. A peripheral timer
Just how hard can a timer be to get right? It’s just acounter!
![Page 14: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/14.jpg)
Ex: FIFO
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
12 / 285
˝ It worked in my test bench˝ Failed when reading and writing on the same clock while
empty
– Write first then read worked– R+W on full FIFO is okay– R+W on an empty FIFO
![Page 15: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/15.jpg)
Ex: FIFO
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
12 / 285
˝ It worked in my test bench˝ Failed when reading and writing on the same clock while
empty
– Write first then read worked– R+W on full FIFO is okay– R+W on an empty FIFO . . . not so much
˝ My test bench didn’t check that, formal did
![Page 16: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/16.jpg)
Ex: Prefetch
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
13 / 285
˝ It worked in my test bench˝ Ugliest bug I ever came across was in the prefetch cache
It passed test-bench muster, but failed in the hardware with astrange set of symptoms
˝ When I learned formal, it was easy to prove that this wouldnever happen again.
˝ Low logic has always been one of my goals.Always asking, “will it work if I get rid of this condition?”Formal helps to answer that question for me.
![Page 17: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/17.jpg)
Ex: SDRAM
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
14 / 285
˝ It worked in my test bench˝ It passed my hardware testing
– Test S/W: Week+, no bugs
![Page 18: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/18.jpg)
Ex: SDRAM
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
14 / 285
˝ It worked in my test bench˝ It passed my hardware testing
– Test S/W: Week+, no bugs– Formal methods found the bug– Full proof took less than ă 30 min
![Page 19: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/19.jpg)
Ex: SDRAM
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
15 / 285
˝ It worked in my test bench˝ It passed my hardware testing˝ Background
![Page 20: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/20.jpg)
Ex: SDRAM
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
15 / 285
˝ It worked in my test bench˝ It passed my hardware testing˝ Background
– SDRAM’s are organized into separate banks, each havingrows and columns
– A row must be “activated” before it can be used.– The controller must keep track of which row is activated.– If a request comes in for a row that isn’t activated, the
active row must be deactivated, and the proper row mustbe activated.
˝ A subtle bug in my SDRAM controller compared the activerow address against the immediately previous (1-clock ago)required row address, not the currently requested address.This bug had lived in my design for years. Formal methodscaught it.
![Page 21: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/21.jpg)
Problem with Test Benches
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
16 / 285
˝ Only examines a known good branch˝ Cannot check for every out of bounds conditions
![Page 22: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/22.jpg)
Problem with Test Benches
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
17 / 285
˝ Demonstrate design works˝ Through a normal working path
– or a limited number of extraneous paths
˝ Never rigorous enough to check everything˝ Not uniform in rigour
For the FIFO,
˝ I only read when I knew it wasn’t empty
For the Prefetch,
˝ I never tested jumping to the last location in a cache line
For the SDRAM,
˝ The error was so obscure, it would be hard to trigger
![Page 23: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/23.jpg)
Before Formal
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
18 / 285
This was my method before starting to work with formal.
˝ After . . .
– Proving my design with testbenches
– Directed simulation
˝ I was still chasing bugs in hard-ware
I still use this approach for DSP al-gorithms.
![Page 24: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/24.jpg)
Design Approach
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
19 / 285
˝ After finding the bug in myFIFO . . . I was hooked.
˝ Rebuilding everything. . . now using formal
˝ Formal found more bugs. . . in example after example
˝ I’m hooked!
![Page 25: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/25.jpg)
When to use it?
Welcome
Motivation
Ź Intro
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
20 / 285
˝ Bus componentI would not build a bus compo-nent without formal any more
˝ MultipliesFormal struggles with multipli-cation
![Page 26: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/26.jpg)
Formal VerificationBasics: assert and assume
Welcome
Motivation
Ź Basics
Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
21 / 285
![Page 27: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/27.jpg)
Lesson Overview
Welcome
Motivation
Basics
Ź Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
22 / 285
Let’s start at the beginning, and look at the very basics of formalverification.Our Objective:
˝ To learn the basic two operators used in formal verification,
– assert()
– assume()
˝ To understand how these affect a design from a state spaceperspective
˝ We’ll also look at several examples
![Page 28: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/28.jpg)
Basic Premise
Welcome
Motivation
Basics
Ź Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
23 / 285
Formal methods are built around looking for redundancies.
˝ Basic difference between mediocre and excellent:Double checking your work
˝ Two separate and distinct fashions
– First method calculates the answer– Second method proved it was right
˝ Example: Division
– 89, 321{499 “ 179
– Does it? Let’s check: 179 ˚ 499 “ 89, 321 — Yes
˝ Formal methods are similar
– Your design is the first method– Formal properties describe the second
![Page 29: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/29.jpg)
Basic Operators
Welcome
Motivation
Basics
Ź Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
24 / 285
Let’s start with the two basic operators
1. assume()
An assume(X) statement will limit the state space that theformal verification engine examines.
2. assert()
An assert(X) statement indicates that X must be true, or thedesign will fail to prove.
![Page 30: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/30.jpg)
VHDL
Welcome
Motivation
Basics
Ź Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
25 / 285
We’ll be using VHDL logic, System Verilog Assertions
˝ Proprietary Verific library gives Yosys access to VHDL˝ Formal properties will be written in System Verilog˝ System Verilog bind operator will connect the two
![Page 31: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/31.jpg)
Two basic forms
Welcome
Motivation
Basics
Ź Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
26 / 285
always @ (∗ )as se r t (X ) ;
// Use when your p r o p e r t y has c l o c k dependenc i e s ,// such as r e f e r e n c i n g an i t ems va l u e i n the pa s talways @ ( posedge clk )
as se r t (X ) ;
As an example,
always @ (∗ )as se r t ( counter < 20 ) ;
![Page 32: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/32.jpg)
General Rule
Welcome
Motivation
Basics
Basics
Ź General Rule
Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
27 / 285
![Page 33: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/33.jpg)
Assert
Welcome
Motivation
Basics
Basics
General Rule
Ź Assert
Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
28 / 285
˝ Assertions define the illegal state space.˝ Additional assertions will increase the size of the illegal state
space.
![Page 34: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/34.jpg)
Assume
Welcome
Motivation
Basics
Basics
General Rule
Assert
Ź Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
29 / 285
˝ Assumptions limit the universe of all possibilities˝ Additional assumptions will decrease the size of the total
state space˝ Caution: One careless assumption can void the proof
![Page 35: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/35.jpg)
The Careless Assumption
Welcome
Motivation
Basics
Basics
General Rule
Assert
Ź Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
30 / 285
s i gna l : unsigned (15 downto 0) := 0 ;´́ ´process ( clk )begin
i f ( rising_edge ( clk ) ) thencounter <= counter + 1 ;
end i f ;end process ;
always @ (∗ )begin
as se r t ( counter <= 100 ) ;assume ( counter <= 90 ) ;
end
Question: Will counter ever reach 120?
![Page 36: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/36.jpg)
restrict vs assume
Welcome
Motivation
Basics
Basics
General Rule
Assert
Ź Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
31 / 285
restrict () is very similar to assume()
Operator Formal Verification Traditional Simulation
restrict () Restricts search Ignoredassume() space Halts simulationassert() Illegal state with an error
![Page 37: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/37.jpg)
restrict vs assume
Welcome
Motivation
Basics
Basics
General Rule
Assert
Ź Assume
BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
31 / 285
restrict () is very similar to assume()
Operator Formal Verification Traditional Simulation
restrict () Restricts search Ignoredassume() space Halts simulationassert() Illegal state with an error
˝ restrict (): Like assume(X), it also limits the state space˝ But in a traditional simulation . . .
– restrict () is ignored– assume() is turned into an assert()
![Page 38: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/38.jpg)
Bounded Model Checking
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
32 / 285
For bounded model checking,
1. Start at the initial state2. Examine all possible states for N clocks3. Try to find a way to make an assert (); fail4. If it’s not possible in N clocks, then pass
![Page 39: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/39.jpg)
No Solution
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
33 / 285
Problem: initial assume(!initial_state);
Model fails, no line number given.
![Page 40: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/40.jpg)
No Solution
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
34 / 285
Problem: assume(!reachable_state);
Model fails, no line number given.
![Page 41: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/41.jpg)
Further thoughts
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
35 / 285
Unlike the rest of your digital design, formal properties . . .
˝ don’t need to meet timing˝ don’t need to meet a minimum logic requirement
We’ll discuss this more as we go along.
![Page 42: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/42.jpg)
Example Bus Slave
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
36 / 285
Here’s an example of a bus slave
˝ Inputs are assumed˝ Outputs are asserted
![Page 43: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/43.jpg)
Example Bus Master
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
37 / 285
Question: How would a bus master be different?
![Page 44: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/44.jpg)
Example Bus Master
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
37 / 285
Question: How would a bus master be different?
The slave’s outputs are the master’s inputs
˝ assume() the inputs from the slave˝ assert() the outputs from the master
![Page 45: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/45.jpg)
Internal Bus
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
38 / 285
Question: What if both slave and master signals were part of thesame design?
![Page 46: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/46.jpg)
Internal Bus
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
38 / 285
Question: What if both slave and master signals were part of thesame design?
˝ All of the wires are now internal˝ They should therefore be assert()ed
![Page 47: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/47.jpg)
Serial Port Transmitter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
39 / 285
˝ Whenever the serial port is idle, the output line should behigh
i f ( state == IDLE )as se r t ( o_uart_tx ) ;
˝ Whenever the serial port is not idle, busy should be high
i f ( state != IDLE )as se r t ( o_busy ) ;
e l s eas se r t ( ! o_busy ) ;
˝ The design can only ever be in a valid state
as se r t ( ( state <= TXUL_STOP )| | ( state == TXUL_IDLE ) ) ;
![Page 48: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/48.jpg)
Bus Arbiter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
40 / 285
˝ Arbiter cannot grant both A and B access
always @ (∗ )as se r t ( ( ! grant_A ) | | ( ! grant_B ) ) ;
˝ While one has access, the other must be stalled
always @ (∗ )i f ( grant_A )
as se r t ( stall_B ) ;
always @ (∗ )i f ( grant_B )
as se r t ( stall_A ) ;
![Page 49: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/49.jpg)
Bus Arbiter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
41 / 285
˝ While one is stalled, its outstanding requests must be zero
always @ (∗ )i f ( grant_A )begin
as se r t ( f_nreqs_B == 0 ) ;as se r t ( f_nacks_B == 0 ) ;as se r t ( f_outstanding_B == 0 ) ;
end
I use the prefix f_ to indicate a variable that is
˝ Not part of the design˝ But only used for Formal Verification
![Page 50: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/50.jpg)
Avalon bus
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
42 / 285
˝ Avalon bus: will never issue a read and write request at thesame time
always @ (∗ )assume ( ( ! i_av_read ) | | ( ! i_av_write ) ) ;
˝ The bus is initially idle
i n i t i a l assume ( ! i_av_read ) ;i n i t i a l assume ( ! i_av_write ) ;i n i t i a l assume ( ! i_av_lock ) ;i n i t i a l a s se r t ( ! o_av_readdatavalid ) ;i n i t i a l a s se r t ( ! o_av_writeresponsevalid ) ;
![Page 51: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/51.jpg)
Avalon bus
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
43 / 285
˝ Cannot respond to both read and write in the same clock
always @ (∗ )assume ( ( ! i_av_readdatavalid )
| | ( ! i_av_writeresponsevalid ) ) ;
Remember ! (A&&B) is equivalent to (!A )||(! B)
˝ Cannot respond if no request is outstanding
always @ (∗ )begin
i f ( f_wr_outstanding == 0)as se r t ( ! o_av_writeresponsevalid ) ;
i f ( f_rd_outstanding == 0)as se r t ( ! o_av_readdatavalid ) ;
end
![Page 52: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/52.jpg)
Wishbone
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
44 / 285
˝ o_STB can only be high if o_CYC is also high
always @ (∗ )i f ( o_STB )
as se r t ( o_CYC ) ;
˝ Count the number of outstanding requests:
f_outstanding <= ”0” when ( i_reset )e l s e f_nreqs ´ f_nacks ;
˝ Acks can only respond to valid requests
i f ( f_outstanding == 0)assume ( ! i_wb_ack ) ;
![Page 53: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/53.jpg)
Wishbone
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
45 / 285
˝ Well, what if a request is being made now?
i f ( ( f_outstanding == 0)&&((!o_wb_stb ) | | ( i_wb_stall ) ) )
assume ( ! i_wb_ack ) ;
˝ If not within a bus request, the ACK and ERR lines must below
i f ( ! o_CYC )begin
assume ( ! i_ACK ) ;assume ( ! i_ERR ) ;
end
˝ Following any reset, the bus will be idle˝ Requests remain unchanged until accepted
![Page 54: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/54.jpg)
Cache
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
46 / 285
Want a guarantee that the cache response is consistent?
˝ A valid cache entry must ...
always @ ( posedge i_clk )i f ( o_valid )begin
// Be marked v a l i d i n the cacheas se r t ( cache_valid [ f_addr [ CW´1:LW ] ] ) ;// Have the same cache tag as add r e s sas se r t ( f_addr [ AW´1:LW ] ==
cache_tag [ f_addr [ CW´1:LW ] ] ) ;// Match the v a l u e i n the cacheas se r t ( o_data ==
cache_data [ f_addr [ CW´1 : 0 ] ) ;// Must be i n r e s pon s e to a v a l i d// r e q u e s tas se r t ( waiting_requests != 0 ) ;
end
![Page 55: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/55.jpg)
Multiply
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
47 / 285
Consider a multiply
˝ Just because an algorithm doesn’t meet timing
![Page 56: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/56.jpg)
Multiply
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
47 / 285
Consider a multiply
˝ Just because an algorithm doesn’t meet timing, or˝ Just because it take up logic your FPGA doesn’t have
![Page 57: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/57.jpg)
Multiply
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
47 / 285
Consider a multiply
˝ Just because an algorithm doesn’t meet timing, or˝ Just because it take up logic your FPGA doesn’t have,
doesn’t mean you can’t use it now
always @ ( posedge i_clk )begin
f_answer = 0 ;f o r (k=0; k<NA ; k=k+1)begin
i f ( i_a [ k ] )f_answer = f_answer + (i_b<<k ) ;
end
as se r t ( o_result == f_answer ) ;end
![Page 58: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/58.jpg)
Multiply
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
48 / 285
Let’s talk about that multiply some more . . .
˝ The one thing formal solver’s don’t handle well is multiplies
![Page 59: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/59.jpg)
Multiply
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
48 / 285
Let’s talk about that multiply some more . . .
˝ The one thing formal solver’s don’t handle well is multiplies
Abstraction offers alternatives
![Page 60: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/60.jpg)
Memory Management Unit
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
49 / 285
˝ For a page result to be valid, it must match the TLB
always @ (∗ )i f ( last_page_valid )begin
as se r t ( tlb_valid [ f_last_page ] ) ;as se r t ( last_ppage ==
tlb_pdata [ f_last_page ] ) ;as se r t ( last_vpage ==
tlb_vdata [ f_last_page ] ) ;as se r t ( last_ro ==
tlb_flags [ f_last_page ] [ ROFLAG ] ) ;as se r t ( last_exe ==
tlb_flags [ f_last_page ] [ EXEFLG ] ) ;as se r t ( r_context_word [ LGCTXT´1:1]
== tlb_cdata [ f_last_page ] ) ;end
![Page 61: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/61.jpg)
SDRAM
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
Ź BMC
Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
50 / 285
˝ Writing requires the right row of the right bank to beactivated
always @ ( posedge i_clk )i f ( ( f_past_valid )&&(!maintenance_mode ) )case ( f_cmd )
// . . .F_WRITE : begin
// Response to a w r i t e r e q u e s tas se r t ( f_we ) ;// Bank i n qu e s t i o n must be a c t i v eas se r t ( bank_active [ o_ram_bs ] == 3 ’ b111 ) ;// Ac t i v e row must be f o r t h i s a dd r e s sas se r t ( bank_row [ o_ram_bs ]
== f_addr [ 2 2 : 1 0 ] ) ;// Must be s e l e c t i n g the r i g h t bankas se r t ( o_ram_bs == f_addr [ 9 : 8 ] ) ;end
// . . .
![Page 62: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/62.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
51 / 285
Let’s work through a counter as an example.
exercise-01/ Contains three filescounter.vhd This will be the HDL source for
our democounter vhd.sv This contains the formal prop-
ertiescounter vhd.sby This is the SymbiYosys script
for the demo
Our Objectives:
˝ Walk through the steps in the tool-flow˝ Hands on experience with SymbiYosys˝ Ensure everyone has a working version of SymbiYosys˝ Find and fix a design bug
![Page 63: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/63.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
52 / 285
ent i t y counter i sgener ic ( MAX_AMOUNT : natural := 22 ) ;
´́ ´́ . . . .s i gna l counts : unsigned (15 downto 0 ) ;
´́ ´́process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) theni f ( ( i_start_signal = ’1 ’ )
and (0 = counts ) ) thencounts <= to_unsigned ( MAX_AMOUNT´1, 1 6 ) ;
e l s ecounts <= counts ´ 1 ;
end i f ;end i f ;
end process ;
o_busy <= ’1 ’ when (0 = counts ) e l s e ’ 0 ’ ;
![Page 64: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/64.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
module counter_vhd ( i_clk , i_start_signal ,counts , o_busy ) ;
parameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;
input wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
always @ (∗ )as se r t ( counts < MAX_AMOUNT ) ;
endmodule
bind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 65: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/65.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
// VHDL Ports and internal signalsmodule counter_vhd ( i_clk , i_start_signal ,
counts , o_busy ) ;
parameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;
input wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
always @ (∗ )as se r t ( counts < MAX_AMOUNT ) ;
endmodule
bind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 66: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/66.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
module counter_vhd ( i_clk , i_start_signal ,counts , o_busy ) ;
// Generic declarationparameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;
input wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
always @ (∗ )as se r t ( counts < MAX_AMOUNT ) ;
endmodule
bind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 67: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/67.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
module counter_vhd ( i_clk , i_start_signal ,counts , o_busy ) ;
parameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;// All wrapper ports are inputsinput wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
always @ (∗ )as se r t ( counts < MAX_AMOUNT ) ;
endmodule
bind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 68: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/68.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
module counter_vhd ( i_clk , i_start_signal ,counts , o_busy ) ;
parameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;
input wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
// Formal properties start herealways @ (∗ )
as se r t ( counts < MAX_AMOUNT ) ;endmodule
bind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 69: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/69.jpg)
Ex: Counter
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
53 / 285
module counter_vhd ( i_clk , i_start_signal ,counts , o_busy ) ;
parameter [ 1 5 : 0 ] MAX_AMOUNT = 22 ;
input wire i_clk , i_start_signal ;input wire [ 1 5 : 0 ] counts ;input wire o_busy ;
always @ (∗ )as se r t ( counts < MAX_AMOUNT ) ;
endmodule// Connect the two modules togetherbind counter counter_vhd
#(.MAX_AMOUNT ( MAX_AMOUNT ) ) copy ( . ∗ ) ;
![Page 70: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/70.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 71: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/71.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc Bounded model checking mode[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 72: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/72.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc Run, using yosys-smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 73: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/73.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ] Yosys commandsread ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 74: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/74.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhd Read VHDL fileread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 75: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/75.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv Read SV file w/SVA# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 76: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/76.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter Prepare the file for formal[ f i l e s ]counter . vhdcounter_vhd . sv
![Page 77: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/77.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
54 / 285
In the file, exercise-01/counter vhd.sby, you’ll find:
[ opt ions ]mode bmc
[ engines ]smtbmc[ s c r i p t ]read ´vhdl counter . vhdread ´formal counter_vhd . sv# . . . o t h e r f i l e s would go he r eprep ´top counter
[ f i l e s ] List of files to be usedcounter . vhdcounter_vhd . sv
![Page 78: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/78.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20[ engines ]smtbmc yices
# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v
![Page 79: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/79.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc Other modes: prove, cover, livedepth 20[ engines ]smtbmc yices
# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v
![Page 80: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/80.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20 # of Steps to examine[ engines ]smtbmc yices
# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v
![Page 81: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/81.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20[ engines ]smtbmc yices Yices theorem prover (default)# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v
![Page 82: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/82.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20[ engines ]smtbmc yices
# smtbmc b o o l e c t o r Other potential solvers# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v
![Page 83: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/83.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20[ engines ]smtbmc yices
# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all We’ll discusss this later[ f i l e s ]counter . v
![Page 84: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/84.jpg)
Example: SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
55 / 285
Other usefull yosys commands
[ opt ions ]mode bmc
depth 20[ engines ]smtbmc yices
# smtbmc b o o l e c t o r# smtbmc z3[ s c r i p t ]read ´formal counter . v# . . . o t h e r f i l e s would go he r eprep ´top counter
opt_merge ´share_all[ f i l e s ]counter . v Full or relative pathnames go here
![Page 85: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/85.jpg)
Running SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
56 / 285
Run: % sby -f counter vhd.sby
![Page 86: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/86.jpg)
Running SymbiYosys
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
56 / 285
Run: % sby -f counter vhd.sby
![Page 87: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/87.jpg)
BMC Failed
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
57 / 285
Run: % sby -f counter vhd.sby
![Page 88: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/88.jpg)
Where Next
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
58 / 285
Look at source line 55, and fire up gtkwave
![Page 89: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/89.jpg)
GTKWave trace.vcd
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
59 / 285
Run: % gtkwave counter vhd/engine 0/trace.vcd
![Page 90: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/90.jpg)
Examine the source
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
60 / 285
Run: % gvim demo-rtl/counter vhd.v
What did we do wrong?
![Page 91: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/91.jpg)
Examine the source
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
61 / 285
Run: % demo-rtl/counter vhd.v
Notice anything wrong?
![Page 92: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/92.jpg)
Examine the source
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ź Ex: Counter
Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
61 / 285
Run: % demo-rtl/counter vhd.v
Notice anything wrong?
How about the missing initial value?
![Page 93: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/93.jpg)
Illegal Initial State
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Ź Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
62 / 285
˝ Problem: No initial statement˝ Solver finds an invalid initial state˝ Model fails
![Page 94: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/94.jpg)
Exercise
Welcome
Motivation
Basics
Basics
General Rule
Assert
Assume
BMC
Ex: Counter
Ź Sol’n
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
63 / 285
Try adding in the initial value, will it work?
![Page 95: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/95.jpg)
Clocked and $past
Welcome
Motivation
Basics
ŹClocked and$past
Past
$past Rule
Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
64 / 285
![Page 96: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/96.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
Ź Past
$past Rule
Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
65 / 285
Our Objective:
˝ To learn how to make assertions crossing time intervals
– $past()
˝ Before the beginning of time
– Assumptions always hold– Assertions rarely hold
˝ How to get around this with f_past_valid
![Page 97: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/97.jpg)
The $past operator
Welcome
Motivation
Basics
Clocked and $past
Ź Past
$past Rule
Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
66 / 285
˝ $past(X) Returns the value of X one clock ago.˝ $past(X,N) Returns the value of X N clocks ago.˝ Depends upon a clock
– This is illegal
always @ (∗ )i f (X )
as se r t (Y == $past (Y ) ) ;
No clock is associated with the $past operator.– But you can do this
always @ ( posedge clk )i f (X )
as se r t (Y == $past (Y ) ) ;
![Page 98: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/98.jpg)
$past Rule
Welcome
Motivation
Basics
Clocked and $past
Past
Ź $past Rule
Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
67 / 285
![Page 99: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/99.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
68 / 285
Let’s modify our counter, by creating some additional properties:
always @ (∗ )assume ( ! i_start_signal ) ;
always @ ( posedge clk )as se r t ( $past ( counter == 0 ) ) ;
˝ i_start_signal is now never true, so the counter shouldalways be zero.
˝ assert(counter == 0);
This should always be true, since counter starts at zero, andis never changed from zero.
˝ Will assert($past(counter == 0)); succeed?
You can find this file in exercise-02/pastassert.vhd
![Page 100: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/100.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
69 / 285
˝ This fails
always @ (∗ )assume ( ! i_start_signal ) ;
always @ ( posedge clk )as se r t ( $past ( counter == 0 ) ) ;
![Page 101: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/101.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
69 / 285
˝ This fails
always @ (∗ )assume ( ! i_start_signal ) ;
always @ ( posedge clk )as se r t ( $past ( counter == 0 ) ) ;
˝ Before time, counter is unconstrained.˝ The solver can make it take on any value it wants in order to
make things fail˝ This will not show in the VCD file
![Page 102: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/102.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
70 / 285
˝ This succeeds
always @ (∗ )assume ( ! i_start_signal ) ;
always @ (∗ )as se r t ( counter == 0 ) ;
![Page 103: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/103.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
71 / 285
Let’s try again:
always @ ( posedge clk )i f ( $past ( i_start_signal ) )
as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
This should work, right?
![Page 104: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/104.jpg)
Past Assertions
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Ź Past Assertions
Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
71 / 285
Let’s try again:
always @ ( posedge clk )i f ( $past ( i_start_signal ) )
as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
This should work, right? No, it fails.
˝ i_start_signal is unconstrained before time˝ counter is initially constrained to zero˝ If i_start_signal is one before time,
counter will still be zero when time begins
![Page 105: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/105.jpg)
f past valid
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Ź Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
72 / 285
We can fix this with a register I call, f_past_valid:
reg f_past_valid ;
i n i t i a l f_past_valid = 1 ’b0 ;always @ ( posedge clk )
f_past_valid <= 1 ’b1 ;
always @ ( posedge clk )i f ( ( f_past_valid)&&($past ( i_start_signal ) ) )
as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
Will this work?
![Page 106: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/106.jpg)
f past valid
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Ź Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
72 / 285
We can fix this with a register I call, f_past_valid:
reg f_past_valid ;
i n i t i a l f_past_valid = 1 ’b0 ;always @ ( posedge clk )
f_past_valid <= 1 ’b1 ;
always @ ( posedge clk )i f ( ( f_past_valid)&&($past ( i_start_signal ) ) )
as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
Will this work? Almost, but not yet.
![Page 107: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/107.jpg)
Fixing the counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Ź Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
73 / 285
˝ What about the case where i_start_signal is raised whilethe counter isn’t zero?
reg f_past_valid ;
i n i t i a l f_past_valid = 1 ’b0 ;always @ ( posedge clk )
f_past_valid <= 1 ’b1 ;
always @ ( posedge clk )i f ( ( f_past_valid)&&($past ( i_start_signal ) )
&&($past ( counter == 0) ) )as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
˝ Will this work?
![Page 108: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/108.jpg)
Fixing the counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Ź Past Valid
Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
73 / 285
˝ What about the case where i_start_signal is raised whilethe counter isn’t zero?
reg f_past_valid ;
i n i t i a l f_past_valid = 1 ’b0 ;always @ ( posedge clk )
f_past_valid <= 1 ’b1 ;
always @ ( posedge clk )i f ( ( f_past_valid)&&($past ( i_start_signal ) )
&&($past ( counter == 0) ) )as se r t ( counter == MAX_AMOUNT´1’b1 ) ;
˝ Will this work? Yes, now it will work˝ You’ll find lots of references to f_past_valid in my own
designs
![Page 109: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/109.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Ź Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
74 / 285
Let’s look at some practical examples
![Page 110: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/110.jpg)
Reset example, #1
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Ź Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
75 / 285
The rule: Every design should start in the reset state.
i n i t i a l assume ( i_RESET ) ;
always @ (∗ )i f ( ! f_past_valid )
assume ( i_RESET ) ;
What would be the difference between these two properties?
![Page 111: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/111.jpg)
Reset example, #2
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Ź Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
76 / 285
The rule: On the clock following a reset, there should be nooutstanding bus requests.
always @ ( posedge clk )i f ( ( f_past_valid)&&($past ( i_RESET ) ) )
as se r t ( ! o_CYC ) ;
![Page 112: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/112.jpg)
Reset example, #2
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Ź Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
77 / 285
Two times registers must have their reset value
˝ Initially˝ Following a reset
always @ ( posedge clk )i f ( ( ! f_past_valid ) | | ( $past ( i_reset ) ) )begin
as se r t ( ! o_CYC ) ;as se r t ( ! o_STB ) ;// e t c .
end
![Page 113: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/113.jpg)
Bus example
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Ź Examples
Ex: Busy Counter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
78 / 285
The rule: while a request is being made, the request cannotchange until it is accepted.
always @ ( posedge clk )i f ( ( f_past_valid )
&&($past ( o_STB ))&&($past ( i_STALL ) ) )begin
as se r t ( o_STB ) ;as se r t ( o_REQ == $past ( o_REQ ) ) ;
end
![Page 114: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/114.jpg)
Ex: Busy Counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Examples
ŹEx: BusyCounter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
79 / 285
Many of my projects include some type of “busy counter”
˝ Serial port logic must wait for a baud clockTransmit characters must wait for the port to be idle
˝ I2C logic needs to slow the clock down˝ SPI logic may also need to slow the clock down
Objectives:
˝ Gain some confidence using formal methods to prove thatalternative designs are equivalent
![Page 115: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/115.jpg)
Exercise: Busy Counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Examples
ŹEx: BusyCounter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
80 / 285
Here’s the basic design. It should look familiar.
process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) theni f ( i_reset ) then
counter <= to_unsigned (0 , 1 6 ) ;e l s i f ( ( i_start_signal = ’1 ’ )
and (0 = counter ) ) thencounter <= to_unsigned ( MAX_AMOUNT ´1 ,16) ;
e l s i f (0 /= counter ) thencounter <= counter ´ 1 ;
end i f ;end i f ;
end process ;
o_busy <= ’0 ’ when (0 = counter ) e l s e ’ 1 ’ ;
![Page 116: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/116.jpg)
Exercise: Busy Counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Examples
ŹEx: BusyCounter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
81 / 285
You can find the design in exercise-03/busyctr.vhd.Exercise: Create the following properties:
1. i_start_signal may be raised at any timeNo property needed here
2. Once raised, assume i_start_signal will remain high untilit is high and the counter is no longer busy.
3. o_busy will always be true while the counter is non-zeroMake sure you check o_busy both when counter == 0 andcounter != 0
This requires an assertion4. If the counter is non-zero, it should always be counting down
Beware of the reset!This requires another assertion
![Page 117: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/117.jpg)
Exercise: Busy Counter
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Examples
ŹEx: BusyCounter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
82 / 285
Let’s draw this requirement out
2. Once raised, assume i_start_signal will remain high untilit is high and the counter is no longer busy.
i clk
i start signal
o busy
counter 5 4 3 2 1 0 21
![Page 118: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/118.jpg)
Busy Counter, Part two
Welcome
Motivation
Basics
Clocked and $past
Past
$past Rule
Past Assertions
Past Valid
Examples
ŹEx: BusyCounter
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
83 / 285
Exercise:
1. Make o_busy a clocked register
process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) theno_busy <= ´́ Your l o g i c goes he r e
end i f ;end process ;
2. Prove that o_busy is true if and only if the counter isnon-zero
˝ You can use this approach to adjust your design to meettiming
– Shuffle logic from one clock to another, then– Prove the new design remains valid
![Page 119: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/119.jpg)
k Induction
Welcome
Motivation
Basics
Clocked and $past
Ź k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
84 / 285
![Page 120: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/120.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
85 / 285
If you want to formally verify your design, BMC is insufficient
˝ Bounded Model Checking (BMC) will only prove that yourdesign is correct for the first N clocks.
˝ It cannot prove that the design won’t fail on the next clock,clock N ` 1
˝ This is the purpose of the induction step: proving correctnessfor all time
Our Goals
˝ Be able to explain what induction is˝ Be able to explain why induction is valuable˝ Know how to run induction˝ What are the unique problems associated with induction
![Page 121: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/121.jpg)
From Pre-Calc
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
86 / 285
Proof by induction has two steps:
1. Base case: Prove for N “ 0 (or one)2. Inductive step: Assume true for N , prove true for N ` 1.
Example: ProveN´1ÿ
n“0
xn “1´ xN
1´ x
˝ For N “ 1, the sum is x0 or one
N´1ÿ
n“0
xn “ x0 “1´ x
1´ x
So this is true (for x ‰ 1).˝ For the inductive step, we’ll
– Assume true for N , then prove for N ` 1
![Page 122: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/122.jpg)
Proof, continued
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
87 / 285
ProveN´1ÿ
n“0
xn “1´ xN
1´ xfor all N
˝ Assume true for N , prove for N ` 1Nÿ
n“0
xn “ xN `N´1ÿ
n“0
xn “ xN `1´ xN
1´ x
˝ Prove for N ` 1
Nÿ
n“0
xn “1´ x
1´ xxN `
1´ xN
1´ x
“xN ´ xN`1 ` 1´ xN
1´ x“
1´ xN`1
1´ x
This proves the inductive case.˝ Hence this is true for all N (where N ą 0 and x ‰ 1)
![Page 123: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/123.jpg)
k Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
88 / 285
Suppose @n : P rns is what we wish to prove
˝ Traditional induction
– Base case: show P r0s– Inductive case: show P rns Ñ P rn` 1s
˝ k induction
– Base case: showN´1ľ
k“0
P rks
– k-induction step:
˜
nľ
k“n´N`1
P rks
¸
Ñ P rn` 1s
![Page 124: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/124.jpg)
k Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
88 / 285
Suppose @n : P rns is what we wish to prove
˝ Traditional induction
– Base case: show P r0s– Inductive case: show P rns Ñ P rn` 1s
˝ k induction
– Base case: showN´1ľ
k“0
P rks
This is what we did with BMC
– k-induction step:
˜
nľ
k“n´N`1
P rks
¸
Ñ P rn` 1s
![Page 125: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/125.jpg)
k Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
88 / 285
Suppose @n : P rns is what we wish to prove
˝ Traditional induction
– Base case: show P r0s– Inductive case: show P rns Ñ P rn` 1s
˝ k induction
– Base case: showN´1ľ
k“0
P rks
– k-induction step:
˜
nľ
k“n´N`1
P rks
¸
Ñ P rn` 1s
This is our next step
![Page 126: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/126.jpg)
k Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
88 / 285
Suppose @n : P rns is what we wish to prove
˝ Traditional induction
– Base case: show P r0s– Inductive case: show P rns Ñ P rn` 1s
˝ k induction
– Base case: showN´1ľ
k“0
P rks
– k-induction step:
˜
nľ
k“n´N`1
P rks
¸
Ñ P rn` 1s
Why use k induction?
![Page 127: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/127.jpg)
Induction in Verification
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Lesson Overview
vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
89 / 285
Formal verification uses k induction
˝ Base case:Assume the first N steps do not violate any assumptions, . . .Prove that the first N steps do not violate any assertions.The is the BMC pass we’ve already done.
˝ Inductive Step:Assume N steps exist that neither violate any assumptionsnor any assertions, andAssume the N ` 1 step violates no assumptions, . . .Prove that the N ` 1 step does not violate any assertions.
![Page 128: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/128.jpg)
BMC vs Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
Ź vs BMC
General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
90 / 285
BMC and induction are very different.
˝ BMC, the base case
˝ Induction step
˝ The number of BMC time-steps steps must be more than thenumber of inductive time-steps
˝ Register values at the beginning of the inductive step can beanything allowed by your assertions and assumptions
˝ This is where the work takes place.
![Page 129: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/129.jpg)
General Rule
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
91 / 285
The general rule hasn’t changed:
˝ assume inputs,˝ assert internal states and any outputs.
If you assume too much, your design will pass formal verificationand still not work.
![Page 130: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/130.jpg)
Checkers
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
92 / 285
Some assertions:
˝ Games are played on black squares˝ Players will never have more than 12 pieces˝ Only legal moves are possible˝ Game is over when one side can no longer move
Where might the induction engine start?
![Page 131: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/131.jpg)
Checkers in the Library
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
93 / 285
Black’s going to move and win
![Page 132: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/132.jpg)
Checkers in the Library
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
93 / 285
White’s going to move and win
![Page 133: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/133.jpg)
Checkers in the Library
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
93 / 285
Black’s going to . . . , huh?
![Page 134: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/134.jpg)
Checkers in the Library
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
93 / 285
Would this pass our criteria?
![Page 135: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/135.jpg)
Checkers and Induction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
Ź General Rule
The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
94 / 285
What can we learn from Checkers?
˝ Inductive step starts in the middle of the gameOnly the assumptions and asserts are used to validate thegame
˝ All of the FF’s (variables) start in arbitrary statesThese states are only constrained by your assumptions andassertions.
˝ Your formal constraints are required to limit the allowablestates
![Page 136: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/136.jpg)
The Trap
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
Ź The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
95 / 285
˝ If your formal properties are not strict enough,Induction may start in an unreachable state
˝ This is a common problem!
![Page 137: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/137.jpg)
The Solution
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
Ź The Trap
Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
96 / 285
To make induction work, you must . . .
˝ assume unrealistic inputs will never happen˝ assert any remaining unreachable states are illegal˝ Induction often requires more properties than BMC alone
![Page 138: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/138.jpg)
Results
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Ź Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
97 / 285
Unlike BMC, the results of induction might be inconclusive
kInduction Basecase (BMC)
FAIL PASS
FAIL Design UNKNOWNPASS Fails SUCCESS!
The k induction pass will fail if your design doesn’t have enoughassertions.
![Page 139: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/139.jpg)
Results
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Ź Results
Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
98 / 285
There’s also a difference in when BMC and induction finish
˝ BMC will finish early if the design FAILs˝ Induction will finish early if the design PASSes˝ In all other cases, they will take a full depth steps
You can use this fact to trim the depth of your proof
˝ Once induction succeeds, trim your proof depth to thatlength
˝ This will immediately make your proof run that much faster
![Page 140: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/140.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
99 / 285
˝ Let’s look at some examples
![Page 141: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/141.jpg)
Another Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
100 / 285
This design would pass many steps of BMC
s i gna l counter : unsigned (15 downto 0) := 0 ;´́ ´́process ( clk )begin
i f ( rising_edge ( clk ) ) thencounter <= counter + 1 ;
end i f ;end process ;
always @ (∗ )as se r t ( counter < 16 ’ d65000 ) ;
It will not pass induction.Can you explain why not?
![Page 142: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/142.jpg)
Another Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
101 / 285
Here’s another counter that will pass BMC, but not induction
s i gna l : counter : unsigned (15 downto 0) := 0 ;´́ ´́
i f ( rising_edge ( clk ) ) theni f ( counter = to_unsigned (22 , 16) ) then
counter <= 0 ;e l s e
counter <= counter + 1 ;end i f ;
end i f ;
always @ (∗ )as se r t ( counter != 16 ’ d500 ) ;
Can you explain why not?
![Page 143: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/143.jpg)
Another Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
102 / 285
With one simple change, this design will now pass induction
s i gna l : counter : unsigned (15 downto 0) := 0 ;´́ ´́
i f ( rising_edge ( clk ) ) theni f ( counter = to_unsigned (22 , 16) ) then
counter <= 0 ;e l s e
counter <= counter + 1 ;end i f ;
end i f ;
always @ (∗ )as se r t ( counter <= 16 ’ d22 ) ;
See the difference?
![Page 144: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/144.jpg)
Shift Register Comparison
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
103 / 285
These shift registers will be equal during BMC, but require atleast sixteen steps to pass induction
s i gna l sa : unsigned (15 downto 0) := 0 ;s i gna l sb : unsigned (15 downto 0) := 0 ;´́ ´́
i f ( rising_edge ( clk ) ) thenbegin
sa <= sa (14 downto 0) & i_bit ;sb <= sb (14 downto 0) & i_bit ;
end i f ;
always @ (∗ )as se r t (sa [ 1 5 ] == sb [ 1 5 ] ) ;
Can you explain why it would take so long?
![Page 145: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/145.jpg)
Shift Register Comparison
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
104 / 285
This design is almost identical to the last one, yet fails induction.The key difference is the if (i_ce = ’1’).
s i gna l sa : unsigned (15 downto 0) := 0 ;s i gna l sb : unsigned (15 downto 0) := 0 ;´́ ´́
i f ( rising_edge ( clk ) ) thenbegin
i f ( i_ce = ’1 ’ ) thensa <= sa (14 downto 0) & i_bit ;sb <= sb (14 downto 0) & i_bit ;
end i f ;end i f ;
always @ (∗ )as se r t (sa [ 1 5 ] == sb [ 1 5 ] ) ;
Can you explain why this wouldn’t pass?
![Page 146: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/146.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
![Page 147: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/147.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
![Page 148: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/148.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
Works for some designs3. assert(sa == sb);
![Page 149: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/149.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
Works for some designs3. assert(sa == sb);
Best, but only works when sa and sb are visible4. Insist on no more than M clocks between i_ce’s
![Page 150: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/150.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
Works for some designs3. assert(sa == sb);
Best, but only works when sa and sb are visible4. Insist on no more than M clocks between i_ce’s5. Use a different prover, under the [engines] option
˝ smtbmc
˝ abc pdr
˝ aiger suprove
![Page 151: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/151.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
Works for some designs3. assert(sa == sb);
Best, but only works when sa and sb are visible4. Insist on no more than M clocks between i_ce’s5. Use a different prover, under the [engines] option
˝ smtbmc Inconclusive Proof (Induction fails)˝ abc pdr Pass˝ aiger suprove Pass
![Page 152: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/152.jpg)
Fixing Shift Reg
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
105 / 285
Several approaches to fixing this:
1. assume(i_ce);
Doesn’t really test the design2. opt_merge ´share_all, yosys option
Works for some designs3. assert(sa == sb);
Best, but only works when sa and sb are visible4. Insist on no more than M clocks between i_ce’s5. Use a different prover, under the [engines] option
˝ smtbmc Inconclusive Proof (Induction fails)˝ abc pdr Pass˝ aiger suprove Pass
Most of these options work for some designs only
![Page 153: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/153.jpg)
SymbiYosys
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
106 / 285
Here’s how we’ll change our sby file:
[ opt ions ]mode prove
[ engines ]smtbmc[ s c r i p t ]read ´vhdl lfsr_fib . vhdread ´vhdl dblpipe . vhdread ´formal dblpipe_vhd . svprep ´top dblpipe
opt_merge ´share_all[ f i l e s ]lfsr_fib . vhddblpipe . vhddblpipe_vhd . sv
![Page 154: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/154.jpg)
SymbiYosys
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
106 / 285
Here’s how we’ll change our sby file:
[ opt ions ]mode prove Use BMC and k-induction[ engines ]smtbmc[ s c r i p t ]read ´vhdl lfsr_fib . vhdread ´vhdl dblpipe . vhdread ´formal dblpipe_vhd . svprep ´top dblpipe
opt_merge ´share_all[ f i l e s ]lfsr_fib . vhddblpipe . vhddblpipe_vhd . sv
![Page 155: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/155.jpg)
SymbiYosys
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
106 / 285
Here’s how we’ll change our sby file:
[ opt ions ]mode prove
[ engines ]smtbmc Other potential engines would go here[ s c r i p t ]read ´vhdl lfsr_fib . vhdread ´vhdl dblpipe . vhdread ´formal dblpipe_vhd . svprep ´top dblpipe
opt_merge ´share_all[ f i l e s ]lfsr_fib . vhddblpipe . vhddblpipe_vhd . sv
![Page 156: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/156.jpg)
SymbiYosys
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
106 / 285
Here’s how we’ll change our sby file:
[ opt ions ]mode prove
[ engines ]smtbmc[ s c r i p t ]read ´vhdl lfsr_fib . vhdread ´vhdl dblpipe . vhdread ´formal dblpipe_vhd . svprep ´top dblpipe
opt_merge ´share_all Here’s where opt merge would go[ f i l e s ]lfsr_fib . vhddblpipe . vhddblpipe_vhd . sv
![Page 157: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/157.jpg)
Ex: DblPipe
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
107 / 285
Exercise #4: dblpipe.vhd
one : lfsr_fib port map (i_clk => i_clk , i_reset => ’ 0 ’ ,i_ce => i_ce , i_in => i_data ,o_bit => a_data ) ;
two : lfsr_fib port map (i_clk => i_clk , i_reset => ’ 0 ’ ,i_ce => i_ce , i_in => i_data ,o_bit => b_data ) ;
process ( a_data , b_data )begin
o_data <= a_data xor b_data ;end process ;
![Page 158: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/158.jpg)
Ex: DblPipe
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
108 / 285
Exercise #4: dblpipe.vhd
˝ lfsr_fib just implements a Fibonacci linear feedback shiftregister,
sreg (LN´2 downto 0) <= sreg (LN´1 downto 1 ) ;sreg (LN´1) <= ( xor ( sreg and TAPS ) ) xor i_in ;
![Page 159: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/159.jpg)
Ex: DblPipe
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
109 / 285
Exercise #4: dblpipe.vhd, lfsr fib.vhd
process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) theni f ( i_reset = ’1 ’ ) then
sreg <= INITIAL_FILL ;e l s i f ( i_ce = ’1 ’ ) then
sreg (LN´2 downto 0) <= sreg (LN´1 downto 1 ) ;sreg (LN´1) <= ( xor ( sreg and TAPS ) )
xor i_in ;end i f ;
end i f ;end process ;
o_bit <= sreg ( 0 ) ;
˝ Both registers one and two use the exact same logic
![Page 160: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/160.jpg)
Ex: DblPipe
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
110 / 285
Exercise #4:
˝ Using dblpipe.vhd
– Prove that the output, o_data, is zero
![Page 161: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/161.jpg)
Ex: LFSRs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
111 / 285
Galois and Fibonacci are supposedly identical
˝ Galois
˝ Fibonacci
˝ Exercise #5 will be to prove these two implementations areidentical
![Page 162: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/162.jpg)
Ex: LFSRs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
112 / 285
Exercise #5:
˝ exercise-05/ contains files lfsr equiv.vhd,lfsr gal.vhd, and lfsr fib.vhd.
˝ lfsr gal.vhd contains a Galois version of an LFSR˝ lfsr fib.vhd contains a Fibonacci version of the same
LFSR˝ lfsr equiv.vhd contains an assertion that these are
equivalent
Prove that these are truly equivalent shift registers.
![Page 163: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/163.jpg)
Where is the bug?
Welcome
Motivation
Basics
Clocked and $past
k Induction
Lesson Overview
vs BMC
General Rule
The Trap
Results
Ź Examples
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
113 / 285
Following an induction failure, look over the trace
If you see a problem in section . . .
A You have a missing one or more assertionsYou’ll only have this problem with induction.
B You have a failing assert @(posedge clk)
C You have a failing assert @(∗)
These latter two indicate a potential logic failure, but theycould still be caused by property failures.
![Page 164: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/164.jpg)
Bus Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Ź Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
114 / 285
![Page 165: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/165.jpg)
Ex: WB Bus
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ź Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
115 / 285
We have everything we need now to write formal properties for abus
˝ This lesson walks through an example the Wishbone Bus
Our Objectives:
˝ Learn to apply formal methods to something imminentlypractical
˝ Learn to build the formal description of a bus component˝ Help lead up to a bus arbiter component
![Page 166: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/166.jpg)
AXI Channels
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
Ź AXI
Avalon
Wishbone
WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
116 / 285
![Page 167: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/167.jpg)
Avalon Channels
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Ź Avalon
Wishbone
WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
117 / 285
![Page 168: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/168.jpg)
Wishbone Channels
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Ź Wishbone
WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
118 / 285
˝ Why use the Wishbone? It’s simpler!
![Page 169: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/169.jpg)
WB Signals
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
119 / 285
From the master’s perspective:Specification name My name
CYC O o wb cycSTB O o wb stbWE O o wb we
ADDR O o wb addrDATA O o wb dataSEL O o wb sel
STALL I i wb stallACK I i wb ackDATA I i wb data
ERR I i wb err
![Page 170: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/170.jpg)
WB Signals
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
120 / 285
From the slave’s perspective:Specification name My name
CYC I i wb cycSTB I i wb stbWE I i wb we
ADDR I i wb addrDATA I i wb dataSEL I i wb sel
STALL O o wb stallACK O o wb ackDATA O o wb data
ERR O o wb errTo swap perspectives from master to slave . . .
˝ Swap the port direction˝ Swap the assume() statements for assert()s
![Page 171: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/171.jpg)
Single Read
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
121 / 285
CLK
o CYC
o STB
o WE
o ADDR A0
o DATA
i STALL
i ACK
i DATA D0
˝ STB must be low when CYC is low˝ If CYC goes low mid-transaction, the transaction is aborted˝ While STB and STALL are active, the request cannot change˝ One request is made for every clock with STB and !STALL
![Page 172: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/172.jpg)
Single Read
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
122 / 285
CLK
o CYC
o STB
o WE
o ADDR A0
o DATA
i STALL
i ACK
i DATA D0
˝ One ACK response per request˝ No ACKs allowed when the bus is idle˝ No way to stall the ACK line˝ The bus result is in i DATA when i ACK is true
![Page 173: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/173.jpg)
Three Writes
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
123 / 285
CLK
o CYC
o STB
o WE
o ADDR A1 A2 A3
o DATA D1 D2 D3
i STALL
i ACK
i DATA
Let’s start building some formal properties
![Page 174: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/174.jpg)
CYC and STB
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
124 / 285
˝ The bus starts out idle, and returns to idle after a reset
always @ ( posedge i_clk )i f ( ( ! f_past_valid ) | | ( $past ( i_reset ) ) )begin
assume ( ! i_wb_ack ) ;assume ( ! i_wb_err ) ;//as se r t ( ! o_wb_cyc ) ;as se r t ( ! o_wb_stb ) ;
end
![Page 175: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/175.jpg)
CYC and STB
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
124 / 285
˝ The bus starts out idle, and returns to idle after a reset
always @ ( posedge i_clk )i f ( ( ! f_past_valid ) | | ( $past ( i_reset ) ) )begin
assume ( ! i_wb_ack ) ;assume ( ! i_wb_err ) ;//as se r t ( ! o_wb_cyc ) ;as se r t ( ! o_wb_stb ) ;
end
˝ STB is low whenever CYC is low
always @ (∗ )i f ( ! o_wb_cyc )
as se r t ( ! o_wb_stb ) ;
![Page 176: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/176.jpg)
The Master Waits
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
125 / 285
˝ While STB and STALL are active, the request doesn’t change
ass ign f_request = { o_stb , o_we , o_addr ,o_data } ;
always @ ( posedge clk )i f ( $past ( o_wb_stb)&&($past ( i_wb_stall ) ) )
as se r t ( f_request == $past ( f_request ) ) ;
˝ Did we get it?
![Page 177: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/177.jpg)
The Master Waits
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
125 / 285
˝ While STB and STALL are active, the request doesn’t change
ass ign f_request = { o_stb , o_we , o_addr ,o_data } ;
always @ ( posedge clk )i f ( $past ( o_wb_stb)&&($past ( i_wb_stall ) ) )
as se r t ( f_request == $past ( f_request ) ) ;
˝ Did we get it? Well, not quiteo_data is a don’t care for any read request
![Page 178: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/178.jpg)
The Master Waits
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
Ź WB Basics
WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
126 / 285
˝ While STB and STALL are active, the request doesn’t change
ass ign f_rd_request = { o_stb , o_we , o_addr } ;ass ign f_wr_request = { f_rd_request , o_data } ;
always @ ( posedge clk )i f ( ( f_past_valid )&&($past ( o_wb_stb ))&&($past ( i_wb_stall ) ) )
begin// F i r s t , f o r reads ´́ o da ta i s a don ’ t c a r ei f ( $past ( ! i_wb_we ) )
as se r t ( f_rd_request == $past ( f_rd_request ) ) ;// Second , f o r w r i t e s ´́ o da ta must not changei f ( $past ( i_wb_we ) )
as se r t ( f_wr_request == $past ( f_wr_request ) ) ;end
![Page 179: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/179.jpg)
CYC and STB
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
127 / 285
˝ No acknowledgements without a request˝ No errors without a request˝ Following any error, the bus cycle ends˝ A bus cycle can be terminated early
![Page 180: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/180.jpg)
Bus example
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
128 / 285
The rule: the slave (external) cannot stall the master more thanF_OPT_MAXSTALL counts:
i f ( rising_edge ( i_clk ) ) theni f ( ( i_reset = ’1 ’ ) or ( o_CYC = ’0 ’ )
or ( ( o_STB= ’1 ’)and ( i_stall = ’0 ’ ) ) ) then
f_stall_count <= 0 ;e l s e
f_stall_count <= f_stall_count + 1 ;end i f ;
end i f ;
always @ ( posedge clk )i f ( o_CYC )
assume ( f_stall_count < F_OPT_MAXSTALL ) ;
This solves the i_ce problem, this time with the i_STALL signal
![Page 181: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/181.jpg)
Bus example
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
129 / 285
The rule: the slave can only respond to requests
process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) thenf_nreqs <= to_unsigned (0 , F_LGDEPTH ) ;
e l s i f ( ( i_STB = ’1 ’ ) and ( o_STALL = ’0 ’ ) ) thenf_nreqs <= f_nreqs + 1 ;
end i f ;end process ;
´́ Need a s i m i l a r coun t e r f o r acknowledgements
always @ (∗ )i f ( f_nreqs == f_nacks )
as se r t ( ! o_ACK ) ;
The logic above almost works. Can any one spot the problems?
![Page 182: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/182.jpg)
Two Exercises
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
130 / 285
Let’s build up to proving a WB arbiter
˝ Let’s prove (BMC + k-Induction) . . .
1. Exercise #6: A simple arbiterexercise-06/reqarb.vhd
2. Exercise #7: Then a Wishbone bus arbiterexercise-07/wbpriarbiter.vhd
˝ Given a set of bus properties: fwb slave.v
![Page 183: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/183.jpg)
Simple Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
131 / 285
The basics
˝ *_req requests a transaction˝ *_data, the contents of the transaction˝ *_busy, true if the source must wait
![Page 184: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/184.jpg)
Simple Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
132 / 285
˝ If (∗_req)&&(!∗_busy),the request is accepted
˝ If (∗_req)&&(∗_busy),the request may not change, except on reset
![Page 185: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/185.jpg)
Simple Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
133 / 285
To prove:
˝ No data will be lost, no requests will be droppedAssume all requests remain stable until accepted
˝ Only one source ever gets access at a timeAssert one busy line is always high
˝ Therefore, all requests go through . . . eventuallyThis is a natural consequence of the above. Don’t worryabout starvation here.
![Page 186: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/186.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
134 / 285
Shall we try this with Wishbone?
![Page 187: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/187.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
135 / 285
This request side is almost identical
˝ If (STB)&&(!STALL)
the request is accepted˝ If (STB)&&(STALL)
the request must not change
![Page 188: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/188.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
136 / 285
The difference is the acknowledgements
˝ The arbiter cannot change during an active transaction˝ All requests get responses˝ No response can be returned without a request
![Page 189: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/189.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
137 / 285
Now, prove that exercise-07/wbpriarbiter.vhd works.
˝ Use both BMC and k-induction (mode prove)˝ You’ll need to build fwb master.v properties
![Page 190: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/190.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
138 / 285
The fwb slave.v properties will
˝ Assume a behaving master˝ Assert a behaving slave
![Page 191: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/191.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
139 / 285
You’ll write the fwb master.v properties
˝ Swapping inputs with outputs
– Port names need not change
˝ Swapping assumptions with assertions
![Page 192: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/192.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
140 / 285
The magic is in how the files are connected
˝ If one interface is connected, both master and slave. . .
– Should see the same number of requests– Should see the same number of acknowledgements
![Page 193: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/193.jpg)
WB Arbiter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
141 / 285
The magic is in how the files are connected
˝ If one interface is connected, the other . . .
– Should not have made any successful requests– Should not have received any acknowledgements
![Page 194: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/194.jpg)
Multiple Files
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
142 / 285
˝ Design with multiple files˝ They were each formally correct˝ Problems?
![Page 195: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/195.jpg)
Multiple Files
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
142 / 285
˝ Design with multiple files˝ They were each formally correct˝ Problems? Yes! In induction˝ State variables needed to be formally synchronized (assert())
![Page 196: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/196.jpg)
Multiple Files
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ex: WB Bus
AXI
Avalon
Wishbone
WB Basics
Ź WB Basics
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
143 / 285
Proving properties for many components together can quicklyget out of hand!
![Page 197: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/197.jpg)
Free Variables
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Ź Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
144 / 285
![Page 198: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/198.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Ź Lesson Overview
Formal
Formal
Memory
So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
145 / 285
When dealing with memory, ...
˝ Testing the entire memory is not required˝ Testing an arbitrary value is
It’s time to discuss (∗ anyconst ∗) and (∗ anyseq ∗)
Objectives
˝ Understand what a free variable is˝ Understand how (∗ anyconst ∗) and (∗ anyseq ∗) can be
used to create free variables˝ Learn how you can use free variables to validate memory and
memory interfaces
![Page 199: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/199.jpg)
any*
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Ź Formal
Formal
Memory
So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
146 / 285
˝ (∗ anyconst ∗)
(∗ anyconst ∗) wire [ N´1:0] cval ;
– Can be anything– Defined at the beginning of time– Never changed
˝ (∗ anyseq ∗)
(∗ anyseq ∗) wire [ N´1:0] sval ;
– Can change from one timestep to the next
Both can still be constrained via assume() statements
![Page 200: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/200.jpg)
VHDL any* attributes
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Ź Formal
Memory
So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
147 / 285
These properties can be used from within VHDL as well:
˝ These are VHDL attributes in Yosys˝ anyconst
s i gna l cval : std_logic_vector (N´1 downto 0 ) ;
a t t r i bu te anyconst : bit ;a t t r i bu te anyconst of cval : s i gna l i s ’ 1 ’ ;
˝ anyseq
s i gna l sval : std_logic_vector (N´1 downto 0 ) ;
a t t r i bu te anyseq : bit ;a t t r i bu te anyseq of sval : s i gna l i s ’ 1 ’ ;
![Page 201: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/201.jpg)
Memory
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Ź Memory
So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
148 / 285
How might you verify a memory with this?
(∗ anyconst ∗) wire [ AW´1:0] f_const_addr ;reg [ DW´1:0] f_mem_value ;
// Handle w r i t e salways @ ( posedge i_clk )i f ( ( i_stb)&&(i_we)&&(i_addr == f_const_addr ) )
f_mem_value <= i_data ;
// Handle r e ad salways @ ( posedge i_clk )i f ( ( f_past_valid)&&($past ( i_stb ))&&(! $past ( i_we ) )
&&($past ( i_addr == f_const_addr ) ) )as se r t ( o_data == f_mem_value ) ;
![Page 202: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/202.jpg)
So what?
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
Ź So what?
Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
149 / 285
Consider the specification of a prefetch
˝ The contract
always @ ( posedge i_clk )i f ( ( o_valid)&&(o_pc == f_const_addr ) )
as se r t ( o_insn == f_const_data ) ;
˝ You’ll also need to assume a bus input
always @ ( posedge i_clk )i f ( ( i_ack)&&(ackd_address == f_const_addr ) )
assume ( i_data == f_const_data ) ;
![Page 203: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/203.jpg)
Rule of Free Variables
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Ź Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
150 / 285
How would our general rule apply here?
˝ Assume inputs, assert internal state and outputs˝ Both (∗ anyconst ∗) and (∗ anyseq ∗) act like inputs˝ You could have written
port ( . . . i_value : i n . . . ; . . . ) ;
always @ ( posedge i_clk )assume ( i_value == $past ( i_value ) ) ;
for the same effect as (∗ anyconst ∗)
˝ assume() them therefore, and not assert()
![Page 204: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/204.jpg)
Ex: Flash Controller
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Ź Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
151 / 285
This works for a flash (or other ROM) controller too:
a t t r i bu te anyconst of f_addr : s i gna l i s ’ 1 ’ ;a t t r i bu te anyconst of f_valid : s i gna l i s ’ 1 ’ ;
always @ (∗ )i f ( ( o_wb_ack)&&(f_request_addr == f_addr ) )
as se r t ( o_wb_data == f_value ) ;
Don’t forget the corollary assumptions!
always @ (∗ )i f ( f_request_addr == f_addr )
assume ( i_spi_miso== f_data [ controller_state ] ) ;
. . . or something similar
![Page 205: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/205.jpg)
Ex: Serial Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Ź Rule
Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
152 / 285
You can use this to build a serial port transmitter
a t t r i bu te anyseq of f_tx_start : s i gna l i s ’ 1 ’ ;a t t r i bu te anyseq of f_tx_data : s i gna l i s ’ 1 ’ ;
always @ (∗ )i f ( f_tx_busy )
assume ( ! f_tx_start ) ;
always @ ( posedge f_txclk )i f ( f_tx_busy )
assume ( f_tx_data == $past ( f_tx_data ) ) ;
You can then
˝ Tie assertions to partially received data˝ . . . and pass induction
![Page 206: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/206.jpg)
Discussion
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Rule
Ź Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
153 / 285
How would you use free variables to verify a cacheimplementation?
![Page 207: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/207.jpg)
Discussion
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Lesson Overview
Formal
Formal
Memory
So what?
Rule
Ź Discussion
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
153 / 285
How would you use free variables to verify a cacheimplementation?
Hint: you only need three properties for the cache contract
![Page 208: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/208.jpg)
Abstraction
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Ź Abstraction
Lesson Overview
Formal
Proof
Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
154 / 285
![Page 209: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/209.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Ź Lesson Overview
Formal
Proof
Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
155 / 285
˝ Proving simple modules is easy.˝ What about large and complex ones?
It’s time to discus abstraction.Objectives
˝ Understand what abstraction is˝ Gain confidence in the idea of abstraction˝ Understand how to reduce a design via abstraction
![Page 210: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/210.jpg)
Abstraction Formally
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Ź Formal
Proof
Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
156 / 285
Formally, if
AÑ C
then we can also say that
pABq Ñ C
![Page 211: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/211.jpg)
Formal Proof
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Ź Proof
Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
157 / 285
Shall we go over the proof?
AÑ C ñ A_ C “ True
True or anything is still true, so
p A_ Cq _ B
Rearranging terms
A_ B _ C
pABq _ C
Expressing as an implication
pABq Ñ C
Q.E.D.!
![Page 212: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/212.jpg)
So what?
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Ź Proof
Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
158 / 285
With every additional module,
˝ Formal verification becomes more difficult˝ Complexity increases exponentially˝ You only have so many hours and dollars
On the other hand,
˝ Anything you can simplify by abstraction . . .˝ is one less thing you need to prove
![Page 213: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/213.jpg)
In Pictures
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
159 / 285
Suppose your state space looked like this
˝ It takes many transitions required to get to interesting states
![Page 214: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/214.jpg)
In Pictures
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
160 / 285
Suppose we added to this design . . .
˝ Some additional states, and˝ Additional transitions
The real states and transitions must still remain
![Page 215: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/215.jpg)
In Pictures
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
161 / 285
If this new design still passes, then . . .
˝ Since the original design is a subset . . .˝ The original design must also still pass
If done well, the new design will require less effort to prove
![Page 216: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/216.jpg)
A CPU
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
162 / 285
Where would you start?
![Page 217: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/217.jpg)
A CPU
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
162 / 285
Where would you start?
At the interfaces!
![Page 218: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/218.jpg)
Prefetch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
163 / 285
Let’s consider a prefetch module as an example.
If you do this right,
˝ Any internally consistent Prefetch,˝ that properly responds to the CPU, and˝ interacts properly with the bus,˝ must work!
Care to try a different prefetch approach?
![Page 219: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/219.jpg)
Prefetch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
164 / 285
Suppose the prefetch was just a shell
It would still interact properly with
˝ The bus, and˝ The CPU˝ It just might not return values from the bus to the CPU
![Page 220: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/220.jpg)
Prefetch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Ź Pictures
Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
165 / 285
Suppose the prefetch was just a shell
If the CPU still acted “correctly”
˝ With either the right, or the wrong instructions, then˝ The CPU must act correctly with the right instructions
![Page 221: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/221.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝
IfAndThen
![Page 222: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/222.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ Prefetch is bus master, interfaces w/CPU
If (Prefetch responds to CPU insn requests)And (Prefetch produces the right instructions)Then (The prefetch works within the design)
![Page 223: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/223.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ The CPU is just a wishbone master within a design
If (The CPU is valid bus master)And (CPU properly executes instructions)Then (CPU works within a design)
![Page 224: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/224.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ The ALU must return a calculated number
If (ALU returns a value when requested)And (It is the right value)Then (The ALU works within the design)
![Page 225: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/225.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ A flash device responds in 8-80 clocks
If (Bus master reads/responds to a request)And (The response comes back in 8-80 clocks)Then (The CPU can interact with a flash memory)
![Page 226: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/226.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ The divide must return a calculated number
If (Divide returns a value when requested)And (It is the right value)Then (The divide works within the design)
![Page 227: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/227.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
166 / 285
Consider these statements:
˝ Formal solvers break down when applied to multiplies
If (Multiply unit returns an answer N clocks later)And (It is the right value)Then (The multiply works within the design)
![Page 228: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/228.jpg)
Abstracted CPU components
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
167 / 285
Looking at the CPU again,
˝ Replace all the components with abstract shells˝ . . . shells that might produce the same answers
![Page 229: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/229.jpg)
Back to the Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
168 / 285
Let’s consider a fractional counter:
s i gna l r_count : unsigned (31 downto 0) := 0 ;´́ ´́process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) then( o_pps , r_count ) <= resize ( r_count , 33) + 43 ;
end i f ;end process ;
The problem with this counter
˝ It will take 100ˆ 106 clocks to roll over and set o_pps
˝ Formally checking 100ˆ 106 clocks is prohibitive
We’ll need a better way, or we’ll never deal with this
![Page 230: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/230.jpg)
Back to the Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
169 / 285
How might we build an abstract counter?
˝ First, create an arbitrary counter increment
s i gna l increment : unsigned (31 downto 0):= to_unsigned ( 1 , 3 2 ) ;
a t t r i bu te anyseq of increment : s i gna l i s ’ 1 ’ ;´́ ´́process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) then( o_pps , r_count ) <= resize ( r_count , 33)
+ increment ;end i f ;
end process ;
rollover <= ´r_count ;
We’ll constrain this increment next
![Page 231: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/231.jpg)
Back to the Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
170 / 285
How might we build an abstract counter?
˝ First, create an arbitrary counter increment˝ Then constrain the arbitrary increment
always @ (∗ )begin
assume ( increment > 0 ) ;assume ( increment < { 2 ’h1 , 30 ’h0 } ) ;i f ( rollover < 32 ’ d43 )
assume ( increment == 32 ’ d43 ) ;e l s e
assume ( increment < rollover ) ;end
The correct increment, 43, must be a possibility
![Page 232: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/232.jpg)
Back to the Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
171 / 285
Will this work?
˝ Let’s try this to see!
always @ ( posedge i_clk )i f ( f_past_valid )
as se r t ( r_count != $past ( r_count ) ) ;
always @ ( posedge i_clk )i f ( ( f_past_valid)&&(r_count < $past ( r_count ) ) )
as se r t ( o_pps ) ;
![Page 233: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/233.jpg)
Other Possibilities
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Ź Examples
Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
172 / 285
How else might you use this?
˝ Bypassing the runup for an external peripheral˝ Testing a real-time clock or date
Or . . . how about that CPU?
![Page 234: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/234.jpg)
Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Examples
Ź Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
173 / 285
Let’s modify this abstract counter
˝ Increment by one, rather than fractionally
Exercise Objectives:
˝ Prove a design works both with and without abstraction˝ Gain some confidence using abstraction
![Page 235: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/235.jpg)
Exercise #8
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Examples
Ź Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
174 / 285
Your task:
˝ Rebuild the counter˝ Make it increment by one˝ Build it so that . . .
always @ (∗ )as se r t ( o_carry == ( r_count == 0 ) ) ;
// and
always @ ( posedge i_clk )i f ( ( f_past_valid )&&(!$past(&r_count ) ) )
as se r t ( ! o_carry ) ;
˝ Prove that this abstracted counter works
![Page 236: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/236.jpg)
Exercise #8
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Examples
Ź Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
175 / 285
Your task:
˝ Rebuild the counter˝ Make it increment by one˝ Prove that this abstracted counter works
![Page 237: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/237.jpg)
Exercise #8
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Lesson Overview
Formal
Proof
Pictures
Examples
Ź Exercise
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
175 / 285
Your task:
˝ Rebuild the counter˝ Make it increment by one˝ Prove that this abstracted counter works
Hints:
˝ &r_count must take place before r_count==0
˝ You cannot skip &r_count
˝ Neither can you skip r_count == 0
![Page 238: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/238.jpg)
Invariants
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Ź Invariants
Lesson Removed
Multiple-Clocks
Cover
Sequences
Parting Thoughts
176 / 285
![Page 239: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/239.jpg)
Lesson Removed
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Ź Lesson Removed
Multiple-Clocks
Cover
Sequences
Parting Thoughts
177 / 285
This lesson is currently being revised, and will be released againshortly
![Page 240: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/240.jpg)
Multiple-Clocks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Ź Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
178 / 285
![Page 241: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/241.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Ź Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
179 / 285
The SymbiYosys option multiclock . . .
˝ Used to process systems with dissimilar clocks˝ Examples
– A serial port, with a formally generated transmittercoming from a different clock domain
– A SPI controller that needs both high speed and lowspeed logic
Our Objective:
˝ To learn how to handle multiple clocks within a design
– (∗ gclk ∗)
– $stable, $changed– $rose, $fell
![Page 242: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/242.jpg)
SymbiYosys config change
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
Ź SBY File
(* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
180 / 285
[ opt ions ]mode prove
mult ic lock on
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 243: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/243.jpg)
SymbiYosys config change
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
Ź SBY File
(* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
180 / 285
[ opt ions ]mode prove
mult ic lock on Multiple clocks require this line
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 244: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/244.jpg)
Five Tools
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
Ź SBY File
(* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
181 / 285
˝ (∗ gclk ∗)
Provides access to the global formal time-step˝ $stable
True if a signal is stable (i.e. doesn’t change) with this clock.Equivalent to A == $past(A)
˝ $changed
True if a signal has changed since the last clock tick.Equivalent to A != $past(A)
˝ $rose
True if the signal rises on this formal time-stepThis is very useful for positive edged clocks transitions$rose(A) is equivalent to (A[0])&&(!$past(A[0]))
˝ $fell
True if a signal falls on this time-step, creating a negativeedge$fell (A) is equivalent to (!A[0])&&($past(A[0]))
![Page 245: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/245.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
182 / 285
˝ A global formal time step
(∗ gclk ∗) wire gbl_clk ;
˝ You can use this to describe clock properties
// Assume a s i n g l e c l o c k s i g n a l//reg f_last_clk ;
i n i t i a l f_last_clk = 0 ;always @ ( posedge gbl_clk )begin
f_last_clk <= ! f_last_clk ;assume ( i_clk == f_last_clk ) ;
end
![Page 246: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/246.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
183 / 285
always @ ( posedge gbl_clk )begin
f_last_clk <= ! f_last_clk ;assume ( i_clk == f_last_clk ) ;
end
f last clk
i clk
![Page 247: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/247.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
184 / 285
˝ Used to gain access to the formal time-step
(∗ gclk ∗) wire gbl_clk ;
˝ You can use this to describe clock properties
// Assume two r e l a t e d c l o c k s i g n a l s//reg [ 2 : 0 ] f_clk_counter ;
i n i t i a l f_clk_counter = 0 ;always @ ( posedge gbl_clk )begin
f_clk_counter <= f_clk_counter + 1 ’b1 ;assume ( i_clk_fast == f_clk_counter [ 0 ] ) ;assume ( i_clk_slow == f_clk_counter [ 2 ] ) ;
end
![Page 248: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/248.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
185 / 285
The clock logic on the last slide forces these two clocks to be insyncf clk counter 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0
i clk fast
i clk slow
![Page 249: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/249.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
186 / 285
˝ Used to gain access to the formal time-step˝ You can use this to describe clock properties
// Assume two c l o ck s , same speed ,// unknown con s t an t phase o f f s e t(∗ gclk ∗) wire gbl_clk ;(∗ anyconst ∗) wire [ 2 : 0 ] f_clk_offset ;
i n i t i a l f_clk_counter= 0 ;always @ ( posedge gbl_clk )begin
f_clk_counter <= f_clk_counter + 1 ’b1 ;f_clk_two <= f_clk_counter
+ f_clk_offset ;assume ( i_clk_one == f_clk_counter [ 2 ] ) ;assume ( i_clk_two == f_clk_two [ 2 ] ) ;
end
![Page 250: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/250.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
187 / 285
The formal tool will pick the phase offset between these twogenerated clock waveformsf clk counter 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
i clk one
i clk two
![Page 251: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/251.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
188 / 285
How might you describe two unrelated clocks?
![Page 252: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/252.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
188 / 285
How might you describe two unrelated clocks?
(∗ gclk ∗) wire gbl_clk ;(∗ anyconst ∗) wire [ 7 : 0 ] f_a_step ;always @ (∗ )assume ( ( f_a_step > 0) &&(f_a_step [ 7 ] == 1 ’b0 ) ) ;
always @ ( posedge gbl_clk )begin
f_a_counter <= f_a_counter + f_a_step ;
assume ( i_clk_a == f_a_counter [ 7 ] ) ;end
˝ The (∗ anyconst ∗) register may take on any constant value˝ You can repeat this logic for the second clock.
![Page 253: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/253.jpg)
(* gclk *)
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
Ź (* gclk *)
$rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
189 / 285
The timing relationship between these two clocks can beanything
˝ Each clock can have an arbitrary frequency˝ Each clock can have an arbitrary phase
Here’s a theoretical example trace
i_clk_a
i_clk_b
Don’t be surprised by the appearance of phase noise
Bonus: The trace above isn’t realistic. Why not?
![Page 254: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/254.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
190 / 285
Synchronous logic has some requirements
˝ Inputs should only change on a clock edgeThey should be stable otherwise
˝ $rose(i_clk) can be used to express this
Here’s an example using $rose(i_clk) . . .
always @ ( posedge gbl_clk )i f ( ! $rose ( i_clk ) )
assume ( i_input == $past ( i_input ) ) ;
![Page 255: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/255.jpg)
$fell
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
191 / 285
$fell is like $rose, only it describes a negative edge
i_clk
$rose(i_clk)
$fell (i_clk)
![Page 256: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/256.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
192 / 285
Let’s go back to the synchronous logic requirements
˝ Inputs only change on clock edges˝ $rose(i_clk) and $fell (i_clk) can be used to express this˝ Let’s try this out
Would this work?
always @ ( posedge gbl_clk )i f ( ! $rose ( i_clk ) )
as se r t ( i_input == $past ( i_input ) ) ;
![Page 257: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/257.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
192 / 285
Let’s go back to the synchronous logic requirements
˝ Inputs only change on clock edges˝ $rose(i_clk) and $fell (i_clk) can be used to express this˝ Let’s try this out
Would this work?
always @ ( posedge gbl_clk )i f ( ! $rose ( i_clk ) )
as se r t ( i_input == $past ( i_input ) ) ;
˝ No. The general rule hasn’t changed
![Page 258: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/258.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
193 / 285
Could we do it this way?
always @ ( posedge gbl_clk )i f ( $ f e l l ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
![Page 259: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/259.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
193 / 285
Could we do it this way?
always @ ( posedge gbl_clk )i f ( $ f e l l ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
˝ No, this doesn’t work either
i_clk
state Stable Unconstrained Stable Unconstrained
$fell (i_clk)
![Page 260: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/260.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
194 / 285
Is this equivalent?
always @ ( posedge gbl_clk )i f ( ! $past ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
![Page 261: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/261.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
194 / 285
Is this equivalent?
always @ ( posedge gbl_clk )i f ( ! $past ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
˝ Why not?
i_clk
state Unconstrained Stable Uncon No change Uncon
!$past(i_clk)
![Page 262: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/262.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
195 / 285
This fixes our problems. Will this work?
always @ ( posedge gbl_clk )i f ( ! $rose ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
![Page 263: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/263.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
195 / 285
This fixes our problems. Will this work?
always @ ( posedge gbl_clk )i f ( ! $rose ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
˝ Not quite. Can you see the problem?
![Page 264: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/264.jpg)
$rose
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
Ź $rose
$stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
196 / 285
˝ State/outputs should be clock synchronous
always @ ( posedge gbl_clk )i f ( ( f_past_valid )&&(!$rose ( i_clk ) )
as se r t ( state == $past ( state ) ) ;
˝ With f_past_valid this works
i_clk
state Stable Stable Stable
f_past_valid
!$rose(i_clk)
˝ $rose requires a clock, such asalways @(posedge gbl_clk)
![Page 265: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/265.jpg)
$stable
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
Ź $stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
197 / 285
Describes a signal which has not changed
always @ ( posedge gbl_clk )i f ( ( f_past_valid )&&(! $rose ( i_clk ) ) )
as se r t ( $stab le ( state ) ) ;
˝ Requires a clock edge
always @(posedge gbl_clk)
always @(posedge i_clk)
˝ This is basically the same as state == $past(state)
![Page 266: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/266.jpg)
$stable
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
Ź $stable
Examples
Exercises
Cover
Sequences
Parting Thoughts
198 / 285
Caution: $stable(X) might still change between clock edges
always @ ( posedge i_clk )assume ( $stab le ( i_value ) ) ;
The waveform below would satisfy the assumption above
i_clk
i_value 0 1 0 1 0 1 0 1 0 1 0
$past(i_value) 0 0 0
$stable(i_value)
The key to understanding what’s going on is to realize . . .
˝ The assumption is only evaluated on @(posedge i_clk)
˝ $past(i_value) is only sampled @(posedge i_clk)
˝ . . . and not on the formal (∗ gclk ∗) time step.
![Page 267: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/267.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
199 / 285
˝ Most logic doesn’t need the multiclock option˝ To help with logic that might need it, I use a parameter
parameter [ 0 : 0 ] F_OPT_CLK2FFLOGIC = 1 ’b0 ;
generate i f ( F_OPT_CLK2FFLOGIC )begin
(∗ gclk ∗) wire gbl_clk ;
always @ ( posedge gbl_clk )i f ( ( f_past_valid )&&(!$rose ( i_clk ) ) )begin
assume ( $stab le ( i_axi_awready ) ) ;assume ( $stab le ( i_axi_wready ) ) ;// . . .
endend endgenerate
![Page 268: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/268.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
200 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you formally describe the o_SCK and o_CS_n
relationship?
![Page 269: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/269.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
200 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you formally describe the o_SCK and o_CS_n
relationship?
i n i t i a l a s se r t ( o_CS_n ) ;i n i t i a l a s se r t ( o_SCK ) ;
always @ (∗ )i f ( ! o_SCK )
as se r t ( ! o_CS_n ) ;
![Page 270: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/270.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
201 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you formally describe the o_SCK and o_CS_n
relationship?
always @ ( posedge gbl_clk )i f ( ( f_past_valid )
&&(($rose ( o_CS_n ) ) | | ( $ f e l l ( o_CS_n ) ) ) )as se r t ( ( o_SCK)&&($stab le ( o_SCK ) ) ) ;
![Page 271: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/271.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
202 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you describe o_MOSI?
![Page 272: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/272.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
202 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you describe o_MOSI?
always @ ( posedge gbl_clk )i f ( ( f_past_valid )&&(!o_CS_n )&&(! $ f e l l ( o_SCK ) ) )
as se r t ( $stab le ( o_MOSI ) ) ;
![Page 273: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/273.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
203 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you describe i_MISO?
![Page 274: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/274.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
203 / 285
o CS n
o SCK
o MOSI
i MISO
˝ How would you describe i_MISO?
always @ ( posedge gbl_clk )i f ( ( ! o_CS_n)&&(o_SCK ) )
assume ( $stab le ( i_MISO ) ) ;
![Page 275: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/275.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
204 / 285
o CS n
o SCK
o MOSI
i MISO
˝ Should the i_MISO be able to change more than once perclock?
![Page 276: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/276.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
205 / 285
˝ A little logic will force i_MISO to have only one transition perclock
always @ ( posedge gbl_clk )i f ( ( o_CS_n ) | | ( o_SCK ) )
f_chgd <= 1 ’b0 ;e l s e i f ( i_MISO != $past ( i_MISO ) )
f_chgd <= 1 ’b1 ;
always @ ( posedge gbl_clk )i f ( ( f_past_valid)&&(f_chgd ) )
assume ( $stab le ( i_MISO ) ) ;
˝ How would we force exactly 8 o_SCK clocks?
![Page 277: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/277.jpg)
Ex SPI Port
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Ź Examples
Exercises
Cover
Sequences
Parting Thoughts
206 / 285
˝ Forcing exactly 8 clocks
always @ ( posedge gbl_clk )i f ( o_CS_n )
f_spi_bits <= 0 ;e l s e i f ( $rose ( o_SCK ) )
f_spi_bits <= f_spi_bits + 1 ’b1 ;
always @ ( posedge gbl_clk )i f ( ( f_past_valid)&&($rose ( o_CS_n ) ) )
as se r t ( f_spi_bits == 8 ) ;
˝ Don’t forget the induction requirement
always @ (∗ )as se r t ( f_spi_bits <= 8 ) ;
![Page 278: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/278.jpg)
Exercises
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
207 / 285
Three exercises, chose one to verify:
1. Input serdesexercises-09/iserdes.vhd
2. Clock gateexercises-10/clkgate.vhd
3. Clock Switchexercises-11/clkswitch.vhd
![Page 279: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/279.jpg)
Ex: Input Serdes
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
208 / 285
Getting a SERDES right is a good example of multiple clocks
i fast clk
i pin
i slow clk
o word 0x0b
![Page 280: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/280.jpg)
Ex: Input Serdes
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
209 / 285
Getting a SERDES right is a good example of multiple clocks
˝ Two clocks, one fast and one slow
Clocks must be synchronous$rose(slow_clk) implies $rose(fast_clk)
˝ exercise-09/ Contains the file iserdes.v˝ Can you formally verify that it works?
![Page 281: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/281.jpg)
Ex: Input Serdes
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
210 / 285
Be aware of the asynchronous reset signal!
i areset n
i fast clk
i pin
i slow clk
o word Prior value RESET RESET
˝ Can be asserted at any time˝ Can only be de-asserted on $rose(i_slow_clk)
˝ assume() these properties, since the reset is an input
![Page 282: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/282.jpg)
Ex: Clock Gate
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
211 / 285
The goal: a clock that can be gated, that doesn’t glitch
˝ exercise-10/ Contains the file clkgate.vhd
![Page 283: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/283.jpg)
Ex: Clock Gate
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
212 / 285
The goal: a clock that can be gated, that doesn’t glitch
i clk
i en
o clk
![Page 284: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/284.jpg)
Ex: Clock Gate
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
213 / 285
The goal: a clock that can be gated, that doesn’t glitch
˝ One clock, one unrelated enable˝ Prove that the output clock
– is always high for the full width, but– . . . never longer.– For any clock rate
See exercise-10/clkgate.v
![Page 285: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/285.jpg)
Ex: Clock Gate
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
214 / 285
Hints:
˝ The output clock should only rise if the incoming clock rises˝ The output clock should only fall if the incoming clock fall˝ If the output clock is ever high, it should always fall with the
incoming clock
Be aware of the reset! The output clock might fall mid-clockperiod due to the asynchronous reset.
![Page 286: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/286.jpg)
Ex: Clock Switch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
215 / 285
Goal: To safely switch from one clock frequency to another
![Page 287: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/287.jpg)
Ex: Clock Switch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
216 / 285
Goal: To safely switch from one clock frequency to another
˝ Inputs
– Two arbitrary clocks– One select line
Prove that the output clock
˝ Is always high (or low) for at least the duration of one of theclocks
˝ Doesn’t stop
You may need to constrain the select line.
![Page 288: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/288.jpg)
Ex: Clock Switch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Basics
SBY File
(* gclk *)
$rose
$stable
Examples
Ź Exercises
Cover
Sequences
Parting Thoughts
217 / 285
Hints:
˝ You may assume the reset is only ever initially true˝ Only one set of FF’s should ever change at any time
![Page 289: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/289.jpg)
Cover
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Ź Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
218 / 285
![Page 290: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/290.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Ź Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
219 / 285
The cover element is used to make certain something remainspossible
˝ BMC and induction test safety propertiesThey prove that something will not happen
˝ Cover tests a liveness propertyIt proves that something may happen
Objectives
˝ Understand why cover is important˝ Understand how to use cover
![Page 291: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/291.jpg)
Why Cover
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Ź Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
220 / 285
Personal examples:
˝ Forgot to set f_past_valid to oneMany assertions were ignored
˝ Av to WB bridge, passed FV, but couldn’t handle writes˝ Error analysis
The simulation trace doesn’t make sense. Can it bereproduced?
˝ As an anti-assertionCan this situation actually happen?
What is cover good for? Catching the careless assumption!What else? Ad hoc simulation traces!
![Page 292: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/292.jpg)
BMC vs Cover
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
Ź BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
221 / 285
Cover is more like BMC than Induction is
˝ BMC
˝ Cover
˝ BMC searches for failures˝ Cover searches for a success
Formally, we might say . . .
˝ BMC + k-Induction: proof for all@assume()ñ @assert()
˝ Cover: there exists one@assume()ñ Dcover()
![Page 293: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/293.jpg)
Cover in Verilog
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Ź Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
222 / 285
Just like an assumption or an assertion
// Make s u r e a w r i t e i s p o s s i b l ealways @ ( posedge i_clk )cover ( ( o_wb_stb )&&(!i_wb_stall)&&(o_wb_we ) ) ;
// Or
// What happens when a bus c y c l e i s abo r t ed ?always @ ( posedge i_clk )i f ( i_reset )
cover ( ( o_wb_cyc)&&(f_wb_outstanding >0)) ;
Well, almost but not quite.
![Page 294: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/294.jpg)
Cover in Verilog
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Ź Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
223 / 285
Assert and cover handle surrounding logic differently
˝ Assert logic
always @ ( posedge i_clk )i f (A )
as se r t (B ) ;
is equivalent to,
always @ ( posedge i_clk )as se r t ( ( ! A ) | | (B ) ) ;
This is not true of cover.
![Page 295: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/295.jpg)
Cover in Verilog
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Ź Cover in Verilog
State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
224 / 285
Assert and cover handle surrounding logic differently
˝ Assert logic˝ Cover logic
always @ ( posedge i_clk )i f (A )
cover (B ) ;
is equivalent to,
always @ ( posedge i_clk )cover ( (A ) && (B ) ) ;
// NOT the same as// a s s e r t ( ( !A) | | (B) ) ;
![Page 296: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/296.jpg)
State Space
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
Ź State Space
SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
225 / 285
˝ Goal is to prove certain state’s are reachable˝ Prover solves for example traces
![Page 297: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/297.jpg)
SymbiYosys
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
226 / 285
The SymbiYosys script for cover needs to change as well
˝ SymbiYosys needs the option: mode cover
˝ Produces one trace per cover() statement. . . or fail
![Page 298: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/298.jpg)
SymbiYosys cover config
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
227 / 285
[ opt ions ]mode cover
depth 40append 20
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 299: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/299.jpg)
SymbiYosys cover config
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
227 / 285
[ opt ions ]mode cover Run a coverage analysisdepth 40append 20
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 300: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/300.jpg)
SymbiYosys cover config
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
227 / 285
[ opt ions ]mode cover
depth 40 How far to look for a covered stateappend 20
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 301: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/301.jpg)
SymbiYosys cover config
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
227 / 285
[ opt ions ]mode cover
depth 40append 20 Follow each trace with 20 extra clocks
[ engines ]smtbmc
[ s c r i p t ]read ´vhdl module . vhdread ´formal module_vhd . svprep ´top module
[ f i l e s ]# f i l e l i s t
![Page 302: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/302.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove
cvr : mode cover
depth 40
# . . .
![Page 303: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/303.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf Run two tasks: prf and cvrcvr
[ opt ions ]prf : mode prove
cvr : mode cover
depth 40
# . . .
![Page 304: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/304.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove The prf tasks runs inductioncvr : mode cover
depth 40
# . . .
![Page 305: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/305.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove
cvr : mode cover The cvr tasks runs in cover modedepth 40
# . . .
![Page 306: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/306.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove
cvr : mode cover
depth 40 The same depth can apply to both
# . . .
![Page 307: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/307.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove
cvr : mode cover
depth 40
# . . .
% sby -f sbyfil.sby now runs both modes
![Page 308: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/308.jpg)
SymbiYosys tasks
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
228 / 285
[ tasks ]prf
cvr
[ opt ions ]prf : mode prove
cvr : mode cover
depth 40
# . . .
% sby -f sbyfil.sby cvr will run the cover mode alone
![Page 309: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/309.jpg)
Cover Failures
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
Ź SymbiYosys
Examples
Counter
Sequences
Parting Thoughts
229 / 285
Two basic types of cover failures
1. Covered state is unreachableNo VCD file will be generated upon failure
2. Covered state is reachable, but only by breaking assertionsVCD file will be generated
![Page 310: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/310.jpg)
Ex: I-Cache
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Ź Examples
Counter
Sequences
Parting Thoughts
230 / 285
Consider a CPU I-cache:
always @ ( posedge i_clk )cover ( o_valid ) ;
With no other formal logic, what will this trace look like?
˝ CPU must provide a PC address˝ Design must fill the appropriate cache line˝ Design returns an item from that cache line
That’s a lot of trace for two lines of HDL!
![Page 311: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/311.jpg)
Ex: Flash
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Ź Examples
Counter
Sequences
Parting Thoughts
231 / 285
Consider a Flash controller:
always @ ( posedge i_clk )cover ( o_wb_ack ) ;
With no other formal logic, what will this trace look like?The controller must,
˝ Initialize the flash device˝ Accept a bus request˝ Request a read from the flash˝ Accumulate the result to return on the bus
![Page 312: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/312.jpg)
Ex: MMU
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Ź Examples
Counter
Sequences
Parting Thoughts
232 / 285
Consider a Memory Management Unit (MMU):
always @ ( posedge i_clk )cover ( o_wb_ack ) ;
The MMU must,
˝ Be told a TLB entry˝ Accept a bus request˝ Look the request up in the TLB˝ Forward the modified request downstream˝ Wait for a return˝ Forward the value returned upstream
![Page 313: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/313.jpg)
Ex: SDRAM
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Ź Examples
Counter
Sequences
Parting Thoughts
233 / 285
How about an SDRAM controller?
always @ ( posedge i_clk )cover ( o_wb_ack ) ;
The controller must,
˝ Initialize the SDRAM˝ Accept a bus request˝ Activate a row on a bank˝ Issue a read (or write) command from that row˝ Wait for a return value˝ Return the result
![Page 314: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/314.jpg)
Counter
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
234 / 285
Remember our counter?
s i gna l counts : unsigned (15 downto 0):= to_unsigned ( 0 , 1 6 ) ;
´́ ´́ ´process ( i_clk )begin
i f ( rising_edge ( i_clk ) ) theni f ( ( i_start_signal = ’1 ’ )
and (0 = counts ) ) thencounts <= to_unsigned ( MAX_AMOUNT´1, 1 6 ) ;
e l s ecounts <= counts ´ 1 ;
end i f ;end i f ;
end process ;
o_busy <= ’1 ’ when (0 = counts ) e l s e ’ 0 ’ ;
![Page 315: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/315.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
235 / 285
Let’s add some cover statements. . .
// T r a n s i t i o n to busyalways @ ( posedge i_clk )i f ( ( f_past_valid )&&(!$past ( o_busy ) ) )
cover ( o_busy ) ;
// T r a n s i t i o n back to i d l ealways @ ( posedge i_clk )i f ( ( f_past_valid)&&($past ( o_busy ) ) )
cover ( ! o_busy ) ;
// Mid´c y c l ealways @ ( posedge i_clk )
cover ( counter == 3 ) ;
Will SymbiYosys find traces?
![Page 316: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/316.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
236 / 285
How about now?
always @ ( posedge i_clk )cover ( ( o_busy)&&(counter == 0 ) ) ;
![Page 317: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/317.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
236 / 285
How about now?
always @ ( posedge i_clk )cover ( ( o_busy)&&(counter == 0 ) ) ;
Or this one,
always @ ( posedge i_clk )cover ( counter == MAX_AMOUNT ) ;
Will these succeed?
![Page 318: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/318.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
236 / 285
How about now?
always @ ( posedge i_clk )cover ( ( o_busy)&&(counter == 0 ) ) ;
Or this one,
always @ ( posedge i_clk )cover ( counter == MAX_AMOUNT ) ;
Will these succeed? No. Both will fail
˝ These are outside the reachable state space
![Page 319: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/319.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
237 / 285
What if the state is unreachable?
// Keep the coun t e r from ev e r s t a r t i n galways @ (∗ )
assume ( ! i_start_signal ) ;
always @ ( posedge i_clk )cover ( counter != 0 ) ;
Will this succeed?
![Page 320: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/320.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
237 / 285
What if the state is unreachable?
// Keep the coun t e r from ev e r s t a r t i n galways @ (∗ )
assume ( ! i_start_signal ) ;
always @ ( posedge i_clk )cover ( counter != 0 ) ;
Will this succeed? No. This will fail with no trace.
˝ If i_start_signal is never true, the cover cannot be reached
![Page 321: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/321.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
238 / 285
What if an assertion needs to be violated?
always @ (∗ )as se r t ( counter != 10 ) ;
always @ ( posedge i_clk )cover ( counter == 4 ) ;
What will happen here?
![Page 322: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/322.jpg)
Examples
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
238 / 285
What if an assertion needs to be violated?
always @ (∗ )as se r t ( counter != 10 ) ;
always @ ( posedge i_clk )cover ( counter == 4 ) ;
What will happen here?
˝ Cover statement is reachable˝ But requires an assertion failure, so a trace is generated
![Page 323: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/323.jpg)
Clock Switch
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
239 / 285
Covering the clock switch
˝ Shows the clock switching from fast to slow,˝ and again from slow to fast
![Page 324: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/324.jpg)
Ex #7 Revisited
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
240 / 285
Return to your Wishbone arbiter. Let’s cover four cases:
1. Cover both A and B receiving the bus2. Cover how B will get the bus after A gets an
acknowledgement3. Cover how A will get the bus after B gets an
acknowledgement4. Add to the last cover
˝ B must request while A still holds the bus
Plot and examine traces for each cases. Do they look right?
˝ If everything works, the first case showing both A and Breceiving the bus will FAIL
˝ No trace is needed from that case˝ After getting this failure, you may want to remove it from
your cover checks
![Page 325: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/325.jpg)
Ex #7 Revisited
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
241 / 285
Notice what we just proved:
1. The arbiter will allow both sources to master the bus2. The arbiter will transition from one source to another3. The arbiter won’t starve A or B
This wasn’t possible with just the safety properties (assertstatements)
![Page 326: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/326.jpg)
Discussion
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Lesson Overview
BMC vs Cover
Cover in Verilog
State Space
SymbiYosys
Examples
Ź Counter
Sequences
Parting Thoughts
242 / 285
When should you use cover?
![Page 327: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/327.jpg)
Sequences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Ź Sequences
Overview
Clocking
Sequences
Exercise
Parting Thoughts
243 / 285
![Page 328: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/328.jpg)
Lesson Overview
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
244 / 285
SystemVerilog has some amazing formal properties
˝ property can be assumed or assertedBy rewriting our assert’s and assume’s as properties, we canthen control when they are asserted or assumed better.
˝ bind formal properties to a subset of your designAllows us to (finally) separate the properties from the modulethey support
˝ sequence – A standard property description language
Objectives
˝ Learn the basics of SystemVerilog Assertions˝ Gain confidence with yosys+verific
![Page 329: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/329.jpg)
Building on the past
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
245 / 285
Much of what we’ve written can easily be rewritten in SVA
always @ (∗ )i f (A )
as se r t (B ) ;
can be rewritten as,
as se r t property (@ ( posedge i_clk )A |´> B ) ;
Note that this is now a clocked assertion, but otherwise it’sequivalent
![Page 330: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/330.jpg)
Building on the past
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
246 / 285
Much of what we’ve written can easily be rewritten in SVA
always @ ( posedge i_clk )i f ( ( f_past_valid)&&($past (A ) ) )
as se r t (B ) ;
Can be rewritten as,
as se r t property (@ ( posedge i_clk )A |=> B ) ;
![Page 331: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/331.jpg)
Building on the past
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
246 / 285
Much of what we’ve written can easily be rewritten in SVA
always @ ( posedge i_clk )i f ( ( f_past_valid)&&($past (A ) ) )
as se r t (B ) ;
Can be rewritten as,
as se r t property (@ ( posedge i_clk )A |=> B ) ;
˝ Read this as A implies B on the next clock tick.˝ No f_past_valid required anymore. This is a statement
about the next clock tick, not the last one.
These equivalencies apply to assume() as well
![Page 332: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/332.jpg)
Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
247 / 285
You can also declare properties:
property SIMPLE_PROPERTY ;@ ( posedge i_clk ) a |=> b ;
endproperty
as se r t property ( SIMPLE_PROPERTY ) ;
This would be the same as
always @ ( posedge i_clk )i f ( ( f_past_valid)&&($past (a ) ) )
as se r t (b ) ;
![Page 333: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/333.jpg)
Assume vs Assert
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
248 / 285
You could also do something like:
parameter [ 0 : 0 ] F_SUBMODULE = 1 ’b0 ;
generate i f ( F_SUBMODULE )begin
assume property ( INPUT_PROP ) ;end e l s e begin
as se r t property ( INPUT_PROP ) ;end endgenerate
as se r t property ( LOCAL_PROP ) ;as se r t property ( OUTPUT_PROP ) ;
This would work quite nicely for a bus property file
![Page 334: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/334.jpg)
Parameterized Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
249 / 285
Properties can also accept parameters
property IMPLIES (a , b ) ;@ ( posedge i_clk )a |´> b ;
endproperty
as se r t property ( IMPLIES (x , y ) ) ;
![Page 335: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/335.jpg)
Parameterized Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Ź Overview
Clocking
Sequences
Exercise
Parting Thoughts
250 / 285
Properties can also accept parameters
property IMPLIES_NEXT (a , b ) ;@ ( posedge i_clk ) a |=> b ;
endproperty
as se r t property ( IMPLIES_NEXT (x , y ) ) ;
Remember, if you want to use |=>, $past, etc., you need todefine a clock.
![Page 336: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/336.jpg)
Clocking
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Ź Clocking
Sequences
Exercise
Parting Thoughts
251 / 285
Getting tired of writing @(posedge i_clk)?
˝ You can set a default clock
de fau l t c lock ing @ ( posedge i_clk ) ;endclocking
Assumes i_clk if no clock is given.
![Page 337: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/337.jpg)
Clocking
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Ź Clocking
Sequences
Exercise
Parting Thoughts
252 / 285
Getting tired of writing @(posedge i_clk)?
˝ You can set a default clock˝ You can set a default clock within a given block
c lock ing @ ( posedge i_clk ) ;// Your p r o p e r t i e s can go he r e// As wi th a s s e r t , assume ,// sequence , e t c .
endclocking
Assumes i_clk for all of the properties within the clockingblock.
![Page 338: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/338.jpg)
Sequences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
253 / 285
So far with properties,
˝ We haven’t done anything really all that new.˝ We’ve just rewritten what we’ve done before in a new form.
Sequences are something new
![Page 339: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/339.jpg)
Sequence
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
254 / 285
With sequences, you can
˝ Specify a series of actions
sequence EXAMPLE ;@ ( posedge i_clk ) a ##1 b ##1 c ##1 d ;
endsequence
In this example, b always follows a by one clock, c follows b,and d follows c
![Page 340: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/340.jpg)
Sequence
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
255 / 285
With sequences, you can
˝ Specify a series of actions, separated by some number ofclocks
sequence EXAMPLE ;@ ( posedge i_clk ) a ##2 b ##5 c ;
endsequence
In this example, b always follows a two clocks later, and cfollows five clocks after b
![Page 341: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/341.jpg)
Sequence
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
256 / 285
With sequences, you can
˝ Specify a series of predicates, separated in time˝ Can express range(s) of repeated values
sequence EXAMPLE ;@ ( posedge i_clk ) b [ ∗ 2 : 3 ] ##1 c ;
endsequence// i s e q u i v a l e n t to . . .sequence EXAMPLE_A_2x ; // 2x
@ ( posedge i_clk ) b ##1 b ##1 c ;endsequence// orsequence EXAMPLE_A_3x ; // 3x
@ ( posedge i_clk ) b ##1 b ##1 b ##1 c ;endsequence
![Page 342: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/342.jpg)
Sequence
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
257 / 285
With sequences, you can
˝ Specify a series of predicates, separated in time˝ Can express range(s) of repeated values
– [∗0:M] Predicate may be skipped– [∗N:M] specifies from N to M repeats– [∗N:$] Repeats at least N times, with no maximum
Ranges can include empty sequences, such as ##[∗0:4]
˝ Compose multiple sequences together
– AND, seq_1 and seq_2
– OR, seq_1 or seq_2
– NOT, not seq
![Page 343: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/343.jpg)
And vs Intersect
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
258 / 285
The and and intersect operators are very similar
˝ and is only true if both sequences are true˝ intersect is only true if both sequences are true and have the
same length
![Page 344: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/344.jpg)
Equivalences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
259 / 285
˝ Throughout
sequence A ;@ ( posedge i_clk )( EXP ) [ ∗ 0 : $ ] i n t e r s e c t SEQ ;
endsequence
is equivalent to
sequence B ;@ ( posedge i_clk )( EXP ) throughout SEQ ;
endsequence
The EXP expression must be true from now until SEQ ends
![Page 345: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/345.jpg)
Equivalences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
260 / 285
˝ Throughout˝ Until
property A ;@ ( posedge i_clk )(E1 ) [ ∗ 0 : $ ] ##1 (E2 ) ;
endproperty
is equivalent to
property B ;@ ( posedge i_clk )(E1 ) un t i l E2 ;
endproperty
˝ until can only be used in a property, not within a sequence
![Page 346: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/346.jpg)
Equivalences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
260 / 285
˝ Throughout˝ Until
property A ;@ ( posedge i_clk )(E1 ) [ ∗ 0 : $ ] ##1 (E2 ) ;
endproperty
is equivalent to
property B ;@ ( posedge i_clk )(E1 ) un t i l E2 ;
endproperty
˝ until can only be used in a property, not within a sequence
˝ There is an ugly subtlety here
– Must E2 ever take place?
![Page 347: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/347.jpg)
Equivalences
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
261 / 285
˝ Throughout˝ Until˝ Within
sequence A ;@ ( posedge i_clk )( 1 [ ∗ 0 : $ ] ##1 S1 ##1 1 [ ∗ 0 : $ ] )
i n t e r s e c t S2 ;endsequence
is equivalent to
sequence B ;@ ( posedge i_clk )(S1 ) with in S2 ;
endsequence
![Page 348: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/348.jpg)
Returning to Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
262 / 285
Properties can reference sequences
˝ Directly
as se r t property ( seq ) ;as se r t property ( expr |´> seq ) ;
˝ Implication: sequences can imply properties
as se r t property ( seq |´> some_other_property ) ;as se r t property ( seq |=> another_property ) ;
![Page 349: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/349.jpg)
Returning to Properties
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
263 / 285
Properties can include . . .
˝ if statements
as se r t property ( i f (A ) P1 e l s e P2 ) ;
˝ not, and, or even or statements
as se r t property ( not P1 ) ;as se r t property (P1 and P2 ) ;as se r t property (P1 or P2 ) ;
![Page 350: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/350.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
264 / 285
A bus request will not change until it is accepted
property BUS_REQUEST_HOLD ;@ ( posedge i_clk )( STB)&&(STALL )|=> ( STB)&&($stab le ( REQUEST ) ) ;
endproperty
as se r t property ( BUS_REQUEST_HOLD ) ;
![Page 351: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/351.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
265 / 285
A request persists until it is accepted
sequence BUS_REQUEST ;@ ( posedge i_clk )// Repeat up to MAX STALL c l k s( STB)&&(STALL ) [ ∗ 0 : MAX_STALL ]##1 ( STB )&&(!STALL ) ;
endsequence
as se r t property ( STB |´> BUS_REQUEST ) ;
You no longer need to count stalls yourself.
![Page 352: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/352.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
265 / 285
A request persists until it is accepted
sequence BUS_REQUEST ;@ ( posedge i_clk )// Repeat up to MAX STALL c l k s( STB)&&(STALL ) [ ∗ 0 : MAX_STALL ]##1 ( STB )&&(!STALL ) ;
endsequence
as se r t property ( STB |´> BUS_REQUEST ) ;
You no longer need to count stalls yourself.Could we do this with an until statement?
![Page 353: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/353.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
266 / 285
A request persists until it is accepted
sequence BUS_REQUEST ;@ ( posedge i_clk )( STB)&&(STALL ) un t i l ( STB )&&(!STALL ) ;
endsequence
as se r t property ( STB |´> BUS_REQUEST ) ;
What is the difference?
![Page 354: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/354.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
266 / 285
A request persists until it is accepted
sequence BUS_REQUEST ;@ ( posedge i_clk )( STB)&&(STALL ) un t i l ( STB )&&(!STALL ) ;
endsequence
as se r t property ( STB |´> BUS_REQUEST ) ;
What is the difference? The until statement goes forever, ourprior example was limited to MAX_STALL clock cycles.
![Page 355: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/355.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
266 / 285
A request persists until it is accepted
sequence BUS_REQUEST ;@ ( posedge i_clk )( STB)&&(STALL ) un t i l ( STB )&&(!STALL ) ;
endsequence
as se r t property ( STB |´> BUS_REQUEST ) ;
What is the difference?
But . . . what happens if RESET is asserted?
![Page 356: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/356.jpg)
Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
267 / 285
A property can be conditionally disabled
sequence BUS_REQUEST ;// Repeat up to MAX STALL c l k s( STB)&&(STALL ) [ ∗ 0 : MAX_STALL ]##1 ( STB )&&(!STALL ) ;
endsequence
as se r t property (@ ( posedge i_clk )d i sab l e iff ( i_reset )STB |´> BUS_REQUEST ) ;
The assertion will no longer fail if i_reset clears the requestWhat if the request is aborted?
![Page 357: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/357.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
268 / 285
A property can be conditionally disabled
sequence BUS_REQUEST ;@ ( posedge i_clk )// Repeat up to MAX STALL c l k s( STB)&&(STALL ) [ ∗ 0 : MAX_STALL ]##1 ( STB )&&(!STALL ) ;
endsequence
as se r t property (@ ( posedge i_clk )d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )STB |´> BUS_REQUEST ) ;
Will this work?
![Page 358: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/358.jpg)
Ex. Bus Request
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
268 / 285
A property can be conditionally disabled
sequence BUS_REQUEST ;@ ( posedge i_clk )// Repeat up to MAX STALL c l k s( STB)&&(STALL ) [ ∗ 0 : MAX_STALL ]##1 ( STB )&&(!STALL ) ;
endsequence
as se r t property (@ ( posedge i_clk )d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )STB |´> BUS_REQUEST ) ;
Will this work? Yes!
![Page 359: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/359.jpg)
Ex. Bus ACKs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
269 / 285
Some peripherals will only ever accept one request
sequence SINGLE_ACK ( MAX_DELAY ) ;@ ( posedge i_clk )( ! ACK)&&(STALL ) [ ∗ 0 : MAX_DELAY ]##1 ( ACK )&&(!STALL ) ;
endsequence
as se r t property (d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )( STB )&&(!STALL ) |=> SINGLE_ACK ( 3 2 ) ;) ;
This peripheral will
˝ Stall up to 32 clocks following any accepted request, until it˝ Acknowledges the request, and˝ Releases the bus on the same cycle
![Page 360: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/360.jpg)
Ex. Bus ACKs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
270 / 285
Some peripherals will
˝ Never stall the bus, and˝ Acknowledge every request after a fixed number of clock ticks
property NEVER_STALL ( DELAY ) ;@ ( posedge i_clk )d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )( STB ) |´> ##[∗DELAY ] ( ACK ) ;
endproperty
as se r t property ( NEVER_STALL ( DELAY )and ( ! STALL ) ) ;
This is illegal. Can you spot the bug?
![Page 361: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/361.jpg)
Ex. Bus ACKs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
270 / 285
Some peripherals will
˝ Never stall the bus, and˝ Acknowledge every request after a fixed number of clock ticks
property NEVER_STALL ( DELAY ) ;@ ( posedge i_clk )d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )( STB ) |´> ##[∗DELAY ] ( ACK ) ;
endproperty
as se r t property ( NEVER_STALL ( DELAY )and ( ! STALL ) ) ;
This is illegal. Can you spot the bug? What logic does thedisable iff apply to?
![Page 362: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/362.jpg)
Ex. Bus ACKs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
271 / 285
Some peripherals will
˝ Never stall the bus, and˝ Acknowledge every request after a fixed number of clock ticks
property NEVER_STALL ( DELAY ) ;@ ( posedge i_clk )d i sab l e iff ( ( i_reset ) | | ( ! CYC ) )( STB ) |´> ##[∗DELAY ] ( ACK ) ;
endproperty
as se r t property ( NEVER_STALL ( DELAY ) ) ;as se r t property ( ! STALL ) ;
This is valid
![Page 363: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/363.jpg)
Ex. Bus ACKs
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
272 / 285
Cannot ACK or ERR when no request is pending
as se r t property ( @ ( posedge i_clk )( ( ! i_CYC ) | | ( i_reset ) )##1 ( ( ! i_CYC ) | | ( i_reset ) )|´> ( ( ! o_ACK )&&(!o_ERR ) ) ;
Or as we did it before
always @ ( posedge i_clk )i f ( ( f_past_valid )
&&(($past ( i_reset ) ) | | ( ! $past ( i_CYC ) ) )&&((i_reset ) | | ( ! i_CYC ) )as se r t ( ( ! o_ACK )&&(!o_ERR ) ) ;
Which is simpler to understand?
![Page 364: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/364.jpg)
Ex. UART Tx
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
273 / 285
Let’s look at an serial port transmitter example.A baud interval is CKS clocks . . .
˝ Output data is constant˝ Logic doesn’t change state˝ Internal shift register value is known˝ Ends with zero_baud_counter
sequence BAUD_INTERVAL (CKS , DAT , SR , ST ) ;( ( o_uart_tx == DAT)&&(state == ST )
&&(lcl_data == SR )&&(!zero_baud_counter ) ) [ ∗ ( CKS´1)]
##1 ( o_uart_tx == DAT)&&(state == ST )&&(lcl_data == SR )&&(zero_baud_counter ) )
endsequence
![Page 365: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/365.jpg)
Ex. UART Tx
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
274 / 285
A byte consists of 10 Baud intervals
sequence SEND (CKS , DATA ) ;BAUD_INTERVAL (CKS , 1 ’b0 , DATA , 4 ’h0 )##1 BAUD_INTERVAL (CKS , DATA [ 0 ] ,
{{ (1){1 ’ b1 }} , DATA [ 7 : 1 ] , 4 ’h1 )##1 BAUD_INTERVAL (CKS , DATA [ 1 ] ,
{{ (2){1 ’ b1 }} , DATA [ 7 : 2 ] , 4 ’h2 )//##1 BAUD_INTERVAL (CKS , DATA [ 6 ] ,
{{ (7){1 ’ b1 }} , DATA [ 7 ] , 4 ’h7 )##1 BAUD_INTERVAL (CKS , DATA [ 7 ] ,
7 ’hff , DATA [ 7 ] , 4 ’h8 )##1 BAUD_INTERVAL (CKS , 1 ’b1 , 8 ’hff , 4 ’h9 ) ;
endsequence
![Page 366: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/366.jpg)
Ex. UART Tx
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
275 / 285
Transmitting a byte requires
always @ ( posedge i_clk )i f ( ( i_wr )&&(!o_busy ) )
fsv_data <= i_data ;
as se r t property (@ ( posedge i_clk )( i_wr )&&(!o_busy )|=> ( ( o_busy ) throughout
SEND ( CLOCKS_PER_BAUD , fsv_data ) )##1 ( ( ! o_busy)&&(o_uart_tx )
&&(zero_baud_counter ) ) ;
˝ A transmit request is received˝ The data is sent˝ The controller returns to idle
![Page 367: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/367.jpg)
Ex. UART Tx
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
276 / 285
Transmitting a byte requires
as se r t property (@ ( posedge i_clk )( i_wr )&&(!o_busy )|=> ( ( o_busy ) throughout
SEND ( CLOCKS_PER_BAUD , fsv_data ) )##1 ( ( ! o_busy)&&(o_uart_tx )
&&(zero_baud_counter ) ) ;
Make sure . . .
˝ The sequence has a defined beginningOnly ever triggered once at a time
˝ Doesn’t reference changing data˝ throughout is within parenthesis˝ You tie all relevant state information together
![Page 368: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/368.jpg)
SysVerilog Conclusions
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Ź Sequences
Exercise
Parting Thoughts
277 / 285
SystemVerilog Concurrent Assertions . . .
˝ can be very powerful˝ can be very confusing˝ can be used with immediate assertions
You can keep using the simpler property form we’ve beenusing
![Page 369: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/369.jpg)
Last Exercise!
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
278 / 285
Let’s formally verify a synchronous FIFO
ent i t y sfifo i sgener ic (BW : natural := 8 ;
LGFLEN : natural := 4 ) ;
port ( i_clk , i_reset : i n std_logic ;´́ The incoming ( w r i t e ) i n t e r f a c ei_wr : i n std_logic ;i_data : i n std_logic_vector (BW´1 downto 0 ) ;o_full : out std_logic := ’ 0 ’ ;´́ The outgo ing ( read ) i n t e r f a c ei_rd : i n std_logic ;o_data : out std_logic_vector (BW´1 downto 0 ) ;o_empty : out std_logic := ’ 1 ’ ;o_err : out std_logic := ’ 0 ’ ) ;
end ent i t y sfifo ;
![Page 370: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/370.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
279 / 285
Let’s formally verify a synchronous FIFO
arch i tec tu re behavior of sfifo i sconstant FLEN : natural := 2 ∗∗ LGFLEN ;
type data_type i sstd_logic_vetor (BW´1 downto 0 ) ;
type mem_type i sar ray (FLEN´1 downto 0) of data_type ;
type ptr_type i sunsigned ( LGFLEN downto 0 ) ;
s i gna l mem : mem_type ;
s i gna l r_first : ptr_type
:= to_unsigned (0 , LGFLEN+1);
See the problem?
![Page 371: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/371.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
279 / 285
Let’s formally verify a synchronous FIFO
arch i tec tu re behavior of sfifo i sconstant FLEN : natural := 2 ∗∗ LGFLEN ;
type data_type i sstd_logic_vetor (BW´1 downto 0 ) ;
type mem_type i sar ray (FLEN´1 downto 0) of data_type ;
type ptr_type i sunsigned ( LGFLEN downto 0 ) ;
s i gna l mem : mem_type ;
s i gna l r_first : ptr_type
:= to_unsigned (0 , LGFLEN+1);
See the problem? You can’t pass memories through ports!
![Page 372: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/372.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
280 / 285
How will you pass the memory to the formal tool?
˝ You might pass an arbitrary address and value instead
s i gna l test_address : ptr_type ;a t t r i bu te anyconst of test_address
: s i gna l i s ’ 1 ’ ;s i gna l test_value : data_type ;
´́ ´́test_value <= mem ( to_integer ( unsigned ( ´́ ´́
test_address ( LGFLEN´1 downto 0 ) ) ) ) ;
![Page 373: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/373.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
![Page 374: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/374.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
˝ Should never go from full to empty
![Page 375: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/375.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
˝ Should never go from full to empty except on a reset
![Page 376: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/376.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
˝ Should never go from full to empty except on a reset˝ Should never go from empty to full
![Page 377: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/377.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
˝ Should never go from full to empty except on a reset˝ Should never go from empty to full˝ The two outputs, o_empty and o_full, should properly reflect
the size of the FIFO
– o_empty means the FIFO is currently empty– o_full means the FIFO has 2N elements within it
![Page 378: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/378.jpg)
Last Exercise
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
281 / 285
Let’s formally verify a synchronous FIFOWhat properties do you think would be appropriate?
˝ Should never go from full to empty except on a reset˝ Should never go from empty to full˝ The two outputs, o_empty and o_full, should properly reflect
the size of the FIFO
– o_empty means the FIFO is currently empty– o_full means the FIFO has 2N elements within it
˝ Challenge: Use sequences to prove that
– Given any two values written successfully– Verify that those two values can (some time later) be read
successfully, and in the right order(Unless a reset takes place in the meantime)
![Page 379: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/379.jpg)
Hint
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
282 / 285
When using sequences,. . .
˝ It can be very difficult to figure out what part of thesequence failed.The assertion that fails will reference the entire failingsequence.
Suggestions:
˝ Sequences must be triggeredBe aware of what triggers a sequence
˝ Use combinational logic to define wires that will thenrepresent steps in the sequence
˝ Build the sequences out of these wires
![Page 380: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/380.jpg)
Hint continued
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Overview
Clocking
Sequences
Ź Exercise
Parting Thoughts
283 / 285
Here’s an example:
wire f_a , f_b , f_c ;//ass ign f_a = // your l o g i cass ign f_b = // your l o g i cass ign f_c = // your l o g i c//sequence ARBITRARY_EXAMPLE_SEQUENCE
f_a [ ∗ 0 : 4 ] ##1 f_b ##1 f_c [ ∗ 1 2 : 1 6 ] ;endsequence
If you use this approach
˝ Interpreting the wave file will be much easier˝ The f_a, etc., lines will be in the trace
![Page 381: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/381.jpg)
Parting Thoughts
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
ŹPartingThoughts
Questions?
284 / 285
![Page 382: Daniel E. Gisselquist, Ph.D. Technology,LLC · 2021. 3. 20. · Basics Ź Basics GeneralRule Assert Assume BMC Ex: Counter Sol’n Clockedand$past kInduction BusProperties FreeVariables](https://reader035.vdocuments.us/reader035/viewer/2022071501/611fad61ee4c2b669959fccd/html5/thumbnails/382.jpg)
Questions?
Welcome
Motivation
Basics
Clocked and $past
k Induction
Bus Properties
Free Variables
Abstraction
Invariants
Multiple-Clocks
Cover
Sequences
Parting Thoughts
Ź Questions?
285 / 285