7.3. Formal Verification Methods

There are several formal verification methods used to verify RTL designs. These methods involve mathematical techniques that are applied to the design to check its correctness.

Formal verification methods are systematic approaches that use mathematics to ensure the correctness of hardware designs at the Register Transfer Level (RTL). Instead of relying on simulations, which can only cover a limited number of scenarios, formal verification exhaustively checks all possible behaviors of a system. This guarantees that the designs are verified against their specifications under all conditions.

Think of formal verification like a thorough safety inspection on a bridge before it opens to traffic. Instead of just checking to see if it stands up under normal conditions (like traditional testing), formal verification examines every possible scenario—like heavy winds, earthquakes, or wear over the years—to ensure that the bridge will always be safe.

Equivalence checking is the process of verifying that two different descriptions of a design (e.g., RTL and synthesized gate-level netlist) are functionally equivalent. This is useful when comparing the design at different stages of the design flow, such as ensuring that the synthesized netlist matches the original RTL design.

● Process: ○ RTL vs. Gate-Level Comparison: Formal tools compare the RTL description with the synthesized gate-level netlist to ensure that the two designs behave identically. ○ Guarantee: If the tool proves equivalence, it guarantees that the design will function identically at both levels. ● Tools: Synopsys Formality, Cadence Conformal, and Mentor Graphics Questa Formal are commonly used for equivalence checking.

Equivalence checking is a specific formal verification method that ensures two representations of the same design (one at the RTL level and another at the gate-level) behave the same way. This verification is crucial when a design is modified or transformed through different stages, such as synthesis. If equivalence is maintained, it means that any implementation of the design will perform as intended, regardless of the representation used.

Consider equivalence checking as ensuring two different recipes produce the same dish. If you have two versions of a chocolate cake recipe—one is written with measurements in grams and the other in cups—equivalence checking ensures that when followed correctly, they yield the same delicious cake. This gives chefs (engineers) confidence that they can use either recipe (representation) without altering the outcome.

Property checking is the process of verifying that a given set of properties (or assertions) hold true throughout the design. These properties are often specified using temporal logic, such as Linear Temporal Logic (LTL) or Computation Tree Logic (CTL).

● Property Types: ○ Safety Properties: Ensure that something bad never happens (e.g., a signal should never go high unless certain conditions are met). ○ Liveness Properties: Ensure that something good eventually happens (e.g., a process should eventually complete). ● Process: ○ Assertions: Assertions are written in the design code to define desired behavior. Formal verification tools then check whether these assertions hold true in all possible states of the design. ● Tools: Cadence JasperGold, Mentor Graphics Questa Formal, Synopsys Formality, and Xilinx Vivado are widely used for property checking.

Property checking focuses on validating specific desired behaviors of a design through a set of defined properties. These properties are typically expressed in formal languages like LTL or CTL and are categorized into safety properties (which prevent bad outcomes) and liveness properties (which ensure positive outcomes eventually happen). Verification tools check every possible state to ensure these properties are consistently adhered to throughout the design's behavior.

Consider property checking like a traffic management system that must ensure safety on the roads. A safety property might stipulate that traffic lights should never turn green when there’s a pedestrian crossing. A liveness property could ensure that, after a car has stopped at a red light, it eventually gets a green light to go. If these rules hold true in all situations, we can ensure smooth traffic flow and safety.

Model checking is a formal method used to verify that a design satisfies a given set of specifications. It involves checking the state space of a design to ensure that it adheres to all defined properties.

● Process: ○ The model checker exhaustively explores all possible states of the design to verify that the design satisfies the given specifications. ○ State Space Exploration: The tool systematically explores all possible states of the system to detect violations of safety and liveness properties. ● Tools: Cadence JasperGold, Cadence Incisive Formal, Mentor Graphics Questa Formal provide model checking capabilities.

Model checking is a comprehensive process that examines all potential states of a design against a set of specifications. This method diagrams every conceivable scenario the design might encounter and checks whether it meets required safety and liveness properties. This exhaustive exploration helps catch design flaws that could lead to failures in real-world applications.

Imagine model checking like a fire drill for a school. To prepare, the school models every scenario: what happens if there's a fire in the basement, the kitchen, or the gym? They check to make sure that every possible escape route is safe and suitable for the students to exit. This thorough preparation ensures that in any case of emergency, students can evacuate safely.

Symbolic execution is a formal method used to analyze the possible values that variables in a program or design can take. It uses symbolic values (e.g., x or y) instead of concrete values to explore all potential execution paths of a design.

● Process: ○ The design is executed symbolically, and the tool tracks how variables propagate through the design, ensuring that all execution paths are covered. ● Tools: Cadence JasperGold and Mentor Graphics Questa Formal use symbolic execution techniques for RTL verification.

Symbolic execution involves running a design by substituting real values with symbolic variables. This allows the verification tool to explore multiple execution paths and outcomes without specifying exact values. By doing this, it can reveal potential issues and identify scenarios where specific variables might impact the design negatively.

Think of symbolic execution like planning a journey using a map. Instead of picking specific roads (concrete values), you're assessing different routes to determine where traffic might be heavy or where you might encounter road closures. By considering every possible path on the map (execution path), you can find the most efficient route for your journey.

--