1. 1 © 2010 Cisco and/or its affiliates. All rights reserved. 1 Nalin Nimavat (Cisco Systems) nnimavat@cisco.com Vigyan Singhal (Oski Technology) vigyan@oskitech.com May 2012

2. 2  Over 2 N possible cases to verify!

3. 3 Key characteristics: First pass: (2N + 1) assertions to be formally verified. There are N fields, but all the fields are of different widths. Though the DUT is more like a register, can we apply memory abstractions to reduce the number of assertions and formal run time?

4. 4

5. 5 Symbolic variables can sweep the whole range of variables. No change in RTL is required. // If valid is high, for any given memory address, content of //the memory matches incoming data after 3 cycles. bit[15:0] formalAddr; assert property P1 (vld == 1 |-> #3 mem[formalAddr] == $past(inData, 3);) Symbolic Variable

6. 6 All memory locations and bits are present. An arbitrary address formalAddr, with the same width as an actual address, is created. An arbitrary bit fvBit, ranging from 0 to max width of data, is created. Symbolic variables are free running—they can point to anywhere. No change in RTL is required. As with abstractions, only one symmetric location and one symmetric data bit are used in the formal proof.

7. 7

8. 8

9. 9

10. 10

11. 11 Create helper code to determine the msb and lsb of a field in the outVector, outVector(msb, lsb). Benefit of symmetry: We can now reduce the first and second requirements from N down to one assertion each!  After applying symbolic constants, only three assertions are used to completely verify the 5000 lines of DUT RTL.

12. 12 // If there is space in input to accomodate full field, field // should be copied to the output property fieldMatch; lsb >= 0 && dataSel[formalIndex] == 1 |-> ##n outVector[$past(lsb, n) + fvBit] == $past(field[formalIndex][fvBit], n); endproperty assert_fieldMatch : assert property(fieldMatch); Symbolic Variable for Depth Symbolic Variable for Width

13. 13 All three assertions found bugs: Output for fieldM didn’t match When there is no space for someId, all lsb's were not 0's. When all N fields are on, 0's were not inserted in rest of lsb's Formal hit a bug instantly, took a long time in simulation. In simulation, a lot of traffic was sent. One field (in 2 N ) for which all lsb’s were not 0 for this condition. Formal hit this bug right away. Formal guarantees regular and corner case coverage for all N fields – something impossible to achieve in simulation.

14. 14 Symbolic variables can be easily applied to memories and other designs with symmetry. For non-memory, non-symmetric designs, creating symmetry to exploit power of symbolic variables can be challenging. Symbolic variables needs to be properly constrained in order to achieve desired range.

15. 15 Applying symbolic variables can dramatically increase the scalability and decrease the run time of formal analysis. Creating symmetry and using helper code can dramatically simplify or reduce the number of assertions required. Bonus: No modifications to the original RTL are required!