SymbiYosys Formal Hardware Verification with OpenSource Tools - PowerPoint PPT Presentation

SymbiYosys – Formal Hardware Verification with OpenSource Tools Clifford Wolf Symbiotic EDA

Yosys, Yosys-SMTBMC, SymbiYosys ● Yosys – FOSS Verilog Synthesis tool and more – highly flexible, customizable using scripts ● Formal Verification (Safety Properties, Liveness Properties, Equivalence, Coverage) ● FPGA Synthesis for iCE40 (Project IceStorm), Xilinx 7-series (Vivado for P&R), GreenPAK4 (OpenFPGA), Xilinx Coolrunner-II, Gowin Semi FPGAs, MAX10, … ● ASIC Synthesis (full FOSS flows: Qflow, Coriolis2) ● Yosys-SMTBMC – A flow with focus on verification of safety properties using BMC and k- induction, using SMT2 circuit descriptions generated by Yosys ● SymbiYosys – A unified front-end for many Yosys-based formal verification flows

SymbiYosys Features ● Bounded verification of safety properties ● Unbounded verification of safety properties ● Generation of test benches from cover statements ● Verification of liveness properties ● Formal equivalence checking [TBD] ● Reactive Synthesis [TBD] Solvers: – SMT2 ● Yices, Boolector, Z3, CVC4, Mathsat ● easy to extend to any SMT2 solver with QF_AUFBV, QF_ABV, QF_BV, or QF_UFBV support – AIGER ● super_prove, Avy, everything in ABC (including pdr ) ● easy to extend to any AIGER solver for safety and/or liveness properties – BTOR2 [TBD] ● new word-level HW model checking format (see CAV 2018 paper)

Types of Properties Supported in SymbiYosys ● Safety properties – Verilog assume(…) and assert(…) statements – a CEX trace satisfies all assumptions and violates at least one assertion ● Fairness and Liveness – Fairness: if (…) assume property (s_eventually …); – Liveness: if (…) assert property (s_eventually …); – a CEX trace contains a loop that satisfies all fairness properties (and all assumptions) and violates at least one liveness property ● Cover – Verilog cover( … ) statements – Produces a trace for each cover statement that satisfies that cover statement.

Availability of various EDA tools for students, hobbyists, enthusiasts ● FPGA Synthesis ● Formal Verification – Free to use: – Free to use: ● Xilinx Vivado WebPack, etc. ??? ● – Free and Open Source: – Free and Open Source: ● Yosys + Project IceStorm ● VTR (Odin II + VPR) ??? ● ● HDL Simulation .. and people in the industry are complaining they can't find – Free to use: any verification experts to hire! ● Xilinx XSIM, etc. – Free and Open Source: ● Icarus Verilog, Verilator, etc.

“Formal first” vs. traditional use of formal methods Cost of (fixing) a bug Traditional use-case for formal Most formal tools are priced and advertised for the traditional use case. Number of found Formal new bugs first Time Development Verification / Testing Production

Formal First → designing better digital circuits faster and cheaper ● Formal First is a set of design methodologies focusing on using formal methods during development, as early as possible. – Target user base is design engineers, not verification engineers ● Not necessarily for creating complete correctness proofs. Instead run simple BMC for “low hanging fruits” safety properties, such as – standard bus interfaces like AXI/APB/etc. – simple data flow analysis to catch reset issues and/or pipeline interlocking problems – use cover() statements to replace hard-to-write one-off test benches for trying things with the design under test ● Can be as simple as: always @(posedge i_clk) cover(o_wb_ack); ● Formal methods can help to find a vast range of bugs sooner and produces shorter (and thus easier to analyze) counter example traces. ● Let’s not limit our thinking to “formal is for XYZ ”! Formal is a set of fairly generic technologies that have applications everywhere in the design process! – But we cannot unleash the full potential formal has to offer unless we make sure that every digital design and/or verification engineer has access to formal tools. (Like each of those people has access to HDL simulators.)

Formal First ● Here are a few example use cases for formal tools during the development phase of a new circuit: – Verification of embedded “sanity check” assertions ● E.g. “write and read pointers never point to the same element after reset” – Verification of standardized interface using standardized “off-the-shelf” formal properties ● E.g. standardized bus interfaces such as AXI. – Using cover statements to create test benches quickly. ● E.g. cover “done signal goes high (some time after reset)” – Using cover statements during debugging to make sense of trace data from FPGA based test runs. ● E.g. cover “done signal goes high while NAK is active” ● Or assert “done signal never goes high while NAK is active” – Note that this are the same techniques that are employed in the traditional use case for formal. – This is similar to how simulators are used by design and verification engineers alike. – Nobody would claim that simulators are “only for verification (of few very special designs)”.

HDL features in Yosys (Open Source) and Symbiotic EDA Suite (Commercial) ● Yosys ● Symbiotic EDA Suite – Verilog 2005 – Everything in Yosys – Memories / Arrays + SystemVerilog 2012 – Immediate assert(), + VHDL 2008 assume(), and cover() + Concurrent assert(), – checkers, rand [const] regs assume(), and cover() + SVA Properties – Special attributes: ● anyconst, anyseq, allconst, allseq, gclk

Safety Properties: Are the bad states reachable from the initial states ? assertions (explicit) unreachable non- bad states. many of those usually implies reachable states a difficult proof. (implicit)

Bounded Model Check (BMC) In steps 1 .. k-1: Step 1: 0 UNSAT → next step SAT → FAIL Step 2: 0 1 Step 3: 0 1 2 Step 4: 0 1 2 3 In step k: Step k: UNSAT → PASS 0 1 2 k-1 3 SAT → FAIL BMC proves that no bad state is reachable within k cycles.

k-Induction In steps 1 .. k: Step 1: k SAT → next step UNSAT → PASS Step 2: k-1 k Step 3: k-2 k-1 k Step 4: k-3 k-2 k-1 k In step k+1: SAT → UNKNOWN Step k+1: 0 k-3 k-2 k-1 k UNSAT → PASS k-induction proves that a sequence of k non-bad states is always followed by another non-bad state. The k used for induction must be ≤ the k used in BMC for a valid complete proof.

SymbiYosys flow with Yosys-SMTBMC Verilog Design Yosys PASS / FAIL Verilog Asserts SMT-LIB2 Code Trace / counterexample formats VCD File Verilog Testbench Constraints File Yosys-SMTBMC Constraints File SMT-LIB2 Solver

SymbiYosys flow with AIGER model checker unoptimized word-level representation, good for creating human readable Verilog Design counter examples SMT-LIB Yosys code Verilog Asserts SMT-LIB2 Solver Model Checker AIGER AIGER Yosys-SMTBMC (e.g. pdr, avy) witness optimized bit-level model PASS/FAIL Yosys-SMTBMC is only used here as a post- Counter Example processor, turning the AIGER witness into a useful human readable counter example (e.g. VCD).

Custom SMT-LIB Flows Verilog Design Yosys Verilog Asserts Options for writing custom proofs: SMT-LIB2 Code - Hand-written SMT2 code - Custom python script using smtio.py (the python lib ? ? ? implementing most of yosys- smtbmc) - Any other app using any SMT- LIB2 solver (e.g. using C/C++ API for proofs that involve many SMT-LIB2 Solver (check-sat) calls.

Hello World hello.sv hello.sby module hello ( [options] input clk, rst, mode prove output [3:0] cnt depth 10 ); reg [3:0] cnt = 0; [engines] smtbmc z3 always @(posedge clk) begin if (rst) [script] cnt <= 0; read_verilog -formal hello.sv else prep -top hello cnt <= cnt + 1; end [files] hello.sv `ifdef FORMAL always @* assume (cnt != 10); always @* assert (cnt != 15); `endif endmodule

Hello World $ sby -f hello.sby SBY 14:45:35 [hello] Removing direcory 'hello'. SBY 14:45:35 [hello] Copy 'hello.sv' to 'hello/src/hello.sv'. SBY 14:45:35 [hello] engine_0: smtbmc z3 … … … SBY 14:45:35 [hello] engine_0.induction: finished (returncode=0) SBY 14:45:35 [hello] engine_0: Status returned by engine for induction: PASS SBY 14:45:36 [hello] engine_0.basecase: finished (returncode=0) SBY 14:45:36 [hello] engine_0: Status returned by engine for basecase: PASS SBY 14:45:36 [hello] summary: Elapsed clock time [H:MM:SS (secs)]: 0:00:00 (0) SBY 14:45:36 [hello] summary: Elapsed process time [H:MM:SS (secs)]: 0:00:00 (0) SBY 14:45:36 [hello] summary: engine_0 (smtbmc z3) returned PASS for induction SBY 14:45:36 [hello] summary: engine_0 (smtbmc z3) returned PASS for basecase SBY 14:45:36 [hello] summary: successful proof by k-induction. SBY 14:45:36 [hello] DONE (PASS, rc=0) - The sby option -f causes sby to remove the output directory if it already exists. - The output directory contains all relevant information, including copies of the HDL design files.