The device was verified in parallel by two teams. One team went the conventional, simulation-based route while the other team verified design blocks with formal methods. The simulation team used tests automatically generated and analyzed by in-house testbench tools. The formal verification team used OneSpin's formal verification tool 360MV* with formal coverage analysis, provided by the EDA partner. At first, we defined the properties in the tool’s proprietary language ITL, but later we migrated to SVA, because this is a standardized language, supported by both 360MV and other formal tools, as well as by simulators. We will return to this aspect in a later section of this article.
It was not possible to check the entire design with formal methods because – at the time – we lacked sufficient trained people for this job. Thus, we formally checked only a selection of blocks, based on the following criteria:
• Block complexity
The more complex a block is, the harder it is to verify thoroughly using simulation. Thus, complex blocks are the most promising ones to find additional bugs with formal verification.
• Block importance
The formal verification approach developed in the HERKULES project ensures 100 percent coverage of the complete design behavior. Naturally, we used this formal verification and formal coverage analysis approach particularly on the most important blocks, that is, blocks which implement the main functionality, to ensure a deployable device.
• Block suitability
We used formal verification on blocks of a complexity that would not exceed the capacity of state-of-the-art formal tools, using workarounds for long checks. For example, the frame length of the input data stream is in the range of several thousand clock cycles and, basically, this directly translates to the cycle count of the verification window. In order to achieve short proof times, we split some of the properties into parts of equal characteristics. Later, we checked the correctness of the split by means of techniques developed in the HERKULES project.
Formal verification typically was applied to blocks that were already verified with simulation. The status of most of the blocks was “verification completed.” Why? Because we wanted to measure the additional quality achieved by formal verification in comparison with the traditional simulation approach. And the results were a real surprise.
*OneSpin 360 MV is an integrated family of formal assertion-based
verification (ABV) tools for ASIC, SoC and FPGA designs. For additional
information on OneSpin's 360 MV, click here.