System Verilog

Assertions
by
Pankaj Badhe

12/19/2011 Pankaj Badhe 1

 AGENDA
Introduction to SVA
Immediate and Concurrent Assertions
Building blocks
SVA Coverage
Binding
SVA Examples

12/19/2011 Pankaj Badhe 2

 SVA Introduction
Assertions are primarily used to validate the
behaviour of a design. ("Is it working correctly?")
They may also be used to provide functional
coverage information for a design ("How good is
the test?").
Assertions can be checked dynamically by
simulation.

12/19/2011 Pankaj Badhe 3

 Examples of Assertions
Captures
Correct/Illegal behaviours
Assumptions/Constraints
Coverage Targets
Examples
Combo
An event should never/always occur.
A FSM State is always onehot encoded.
Temporal expressions
Event A is followed by event B
While ABC is true, sequence P->Q->R should never occur.

12/19/2011 Pankaj Badhe 4

 For whom
Design Engineers
Capture design assumptions
Record intentions/error conditions
Behaviour (mutex, one-hot, never, always etc.)

Verification engineers
Interface, cross block, higher level behaviour.

12/19/2011 Pankaj Badhe 5

 Where are Assertions placed
Interfaces.
Inside RTL modules.
Inside Testbenches.
Inside Protocol Monitors.

12/19/2011 Pankaj Badhe 6

 Why use Assertions?
Concise Description of Temporal behaviour.
Few lines of code. Easy to maintain.
Excellent control over time unlike verilog.
Reduced error. Faster Debug using built in functions.
Collects functional coverage.

Freely used in RTL as well as TB.

Block to system Portability.

12/19/2011 Pankaj Badhe 7

 Example of Concise Coding
The checker verifies that if signal "a" is high in the
current clock cycle, then signal "b" should be high
within 1 to 3 clock cycles.

12/19/2011 Pankaj Badhe 8

 Example of Concise Coding
// Sample Verilog checker // SVA
SVA Checker
Checker
always @ (posedge a) begin a_to_b_chk:
repeat(1) @ (posedge clk); assert property
fork: a_to_b @ (posedge clk)
begin $rose(a) |-> ##[1:3] $rose(b) );
@ (posedge b)
$display ("SUCCESS: b
arrived in time\n", $time);
disable a_to_b;
end
begin
repeat (3) @ (posedge clk);
$display ("ERROR:b did not
arrive in time\n", $time);
disable a_to_b;
end
join
end
12/19/2011 Pankaj Badhe 9
 Results
SUCCESS: b arrived in time 127
vtosva.a_to_b_chk:
started at 125s succeeded at 175s

SUCCESS: b arrived in time 427

vtosva.a_to_b_chk:
started at 325s succeeded at 475s

ERROR: b did not arrive in time 775

vtosva.a_to_b_chk:
started at 625s failed at 775s
Offending '$rose(b)'

12/19/2011 Pankaj Badhe 10

 SystemVerilog Scheduling
Preponed - Values are sampled for the assertion
variables in this region. In this region, a net or
variable cannot change its state. This allows the
sampling of the most stable value at the beginning
of the time slot.
Observed - All the property expressions are
evaluated in this region.
Reactive - The pass/fail code from the evaluation of
the properties are scheduled in this region.

12/19/2011 Pankaj Badhe 11

12/19/2011 Pankaj Badhe 12
 Immediate Assertions
Immediate assertions are procedural statements and
are mainly used in simulation. An assertion is
basically a statement that something must be true,
similar to the if statement. The difference is that an
if statement does not assert that an expression is
true, it simply checks that it is true, e.g.:
if (A == B) ... // Simply checks if A equals B
assert (A == B); // Asserts that A equals B; if
not, an error is generated

12/19/2011 Pankaj Badhe 13

assert (A == B)
$display ("OK. A equals B");
else $error("It's gone wrong");
Note that you can omit the pass statement and still
have a fail statement:

assert (A == B)
else $error("It's gone wrong");

12/19/2011 Pankaj Badhe 14

AeqB: assert (a == b)
else
begin
error_count++;
$error("A should equal B");
end

12/19/2011 Pankaj Badhe 15

 Another example
The always block executes
if either signal "a" or
signal "b" changes.

12/19/2011 Pankaj Badhe 16

 Building Blocks
Properties and Sequences
The properties being asserted are specified in the
assert property statements themselves. Properties
may also be declared separately, for example:
property not_read_and_write;
not (Read && Write);
endproperty

assert property (not_read_and_write);

12/19/2011 Pankaj Badhe 17

 Complex properties are often built using sequences.
Sequences, too, may be declared separately:
sequence request
Req;
endsequence

sequence acknowledge
##[1:2] Ack;
endsequence
12/19/2011 Pankaj Badhe 18
property handshake;
@(posedge Clock) request |-> acknowledge;
endproperty

assert property (handshake);

12/19/2011 Pankaj Badhe 19

 Another simple sequence
A sample waveform for signal "a" and how sequence s1 responds to
this signal during simulation. Signal "a" goes to zero on the positive
edge of clock cycle 7. This change in value is sampled in clock
cycle 8. Since concurrent assertions use the values sampled in the
"preponed" region of the scheduler, in clock cycle 7, the most stable
value of signal "a" sampled by the sequence si is 1. Hence, the
sequence succeeds. In clock cycle 8, the sampled value of signal "a"
is a 0 and hence the sequence fails.
sequence s1;
@ (posedge clk) a;
endsequence

12/19/2011 Pankaj Badhe 20

 Concurrent Assertions

The behaviour of a design may be specified using statements similar to

these:
"The Read and Write signals should never be asserted together."
assert property (!(Read && Write));
"A Request should be followed by an Acknowledge occurring no more
than two clocks after the Request is asserted.
assert property (@(posedge Clock) Req |-> ##[1:2] Ack);

12/19/2011 Pankaj Badhe 21

 Another example
a_cc: assert property ( @ (posedge clk) not (a && b));
All successes are shown with an up arrow and all failures
are shown with a down arrow. The key concept in this
example is that the property is being verified on every
positive edge of the clock irrespective of whether or not
signal "a" and signal "b" changes.

12/19/2011 Pankaj Badhe 22

 Implication

The implication construct (|->) allows a user to

monitor sequences based on satisfying some
criteria, e.g. attach a precondition to a sequence
and evaluate the sequence only if the condition is
successful. The left-hand side operand of the
implication is called the antecedent sequence
expression, while the right-hand side is called the
consequent sequence expression.

12/19/2011 Pankaj Badhe 23

 Implication
If there is no match of the antecedent sequence
expression, implication succeeds vacuously by
returning true. If there is a match, for each
successful match of the antecedent sequence
expression, the consequent sequence expression is
separately evaluated, beginning at the end point of
the match.

12/19/2011 Pankaj Badhe 24

 Implication
There are two forms of implication: overlapped
using operator |->, and non-overlapped using
operator |=>.
For overlapped implication, if there is a match for
the antecedent sequence expression, then the first
element of the consequent sequence expression is
evaluated on the same clock tick.
s1 |-> s2;
In the example above, if the sequence s1 matches,
then sequence s2 must also match. If sequence s1
does not match, then the result is true.
12/19/2011 Pankaj Badhe 25
 For non-overlapped implication, the first element
of the consequent sequence expression is
evaluated on the next clock tick.
s1 |=> s2;
The expression above is basically equivalent to:
define true 1
s1 ##1 true |-> s2;
where `true is a boolean expression, used for visual
clarity, that always evaluates to true.

12/19/2011 Pankaj Badhe 26

 Implication with fixed delay on consequent

12/19/2011 Pankaj Badhe 27

 Implication with a sequence as antecedant

12/19/2011 Pankaj Badhe 28

 Sequence with edge definitions
In sequence s1, the logical value of the signal was used.
SVA also has built-in edge expressions that let the user
monitor the transition of signal value from one clock cycle
to the next. This allows one to check for the edge
sensitivity of signals.

Srose (boolean expression or signalname)

This returns true if LSB of signal/expression changed to 1
$fell ( boolean expression or signalname)
This returns true if LSB of signal/expression changed to 0
$stable (boolean expression or signalname)
This returns true if the value of the expression did not
change.

12/19/2011 Pankaj Badhe 29

Sequence s2 checks that the signal "a" transitions to a value of 1 on every
positive edge of the clock. If the transition does not occur, the assertion
will fail.

sequence s2;
@(posedge clk) $rose(a);
endsequence

12/19/2011 Pankaj Badhe 30

 Sequence with logical relationship

12/19/2011 Pankaj Badhe 31

 Sequence Expressions

12/19/2011 Pankaj Badhe 32

 Sequence with timing relationship

12/19/2011 Pankaj Badhe 33

 Assertion Clocking
Concurrent assertions (assert property and cover
property statements) use a generalised model of a
clock and are only evaluated when a clock tick
occurs.
A clock tick is an atomic moment in time and a clock
ticks only once at any simulation time. The clock
can actually be a single signal, a gated clock (e.g.
(clk && GatingSig))
The clock for a property can be specified in several
ways:
12/19/2011 Pankaj Badhe 34
 Explicitly specified in a sequence:
sequence s;
@(posedge clk) a ##1 b;
endsequence

property p;
a |-> s;
endproperty

assert property (p);

12/19/2011 Pankaj Badhe 35

 Explicitly specified in the property:
property p;
@(posedge clk) a ##1 b;
endproperty

assert property (p);

12/19/2011 Pankaj Badhe 36

 Explicitly specified in the concurrent assertion:

assert property (@(posedge clk) a ##1 b);

12/19/2011 Pankaj Badhe 37

 Inferred from a procedural block:
property p;
a ##1 b;
endproperty

always @(posedge clk)

assert property (p);

12/19/2011 Pankaj Badhe 38

 Forbidding a property

12/19/2011 Pankaj Badhe 39

 Handling Asynchronous Resets
In the following example, the disable iff clause
allows an asynchronous reset to be specified.
property p1;
@(posedge clk) disable iff (Reset) not b ##1 c;
endproperty

assert property (p1);

12/19/2011 Pankaj Badhe 40

 Timing window in SVA Checkers
The ## operator delays execution by the specified number of clocking events, or clock
cycles.
a ##1 b // a must be true on the current clock tick
// and b on the next clock tick

a ##N b // Check b on the Nth clock tick after a

a ##[1:4] b // a must be true on the current clock tick and b

// on some clock tick between the first and fourth
// after the current clock tick
See example on next slide

12/19/2011 Pankaj Badhe 41

12/19/2011 Pankaj Badhe 42
 Overlapping timing window

12/19/2011 Pankaj Badhe 43

 Repetition
The * operator is used to specify a consecutive
repetition of the left-hand side operand.
a ##1 b [*3] ##1 c // Equiv. to a ##1 b ##1 b ##1 b ##1 c
(a ##2 b) [*2] // Equiv. to (a ##2 b ##1 a ##2 b)
(a ##2 b)[*1:3] // Equiv. to (a ##2 b)// or (a ##2 b ##1 a
##2 b)
// or (a ##2 b ##1 a ##2 b ##1 a ##2 b)

12/19/2011 Pankaj Badhe 44

Consecutive repetition - This allows the user to specify that a signal or
a sequence will match continuously for the number of clocks specified. A
hidden delay of one clock cycle is assumed between each match of the
signal. The simple syntax of consecutive repetition operator is shown
below.
signal or sequence [*n]
"n" is the number of times the expression should match repeatedly.

For example a [*3] will expand to the following.

a##1 a##1 a

A sequence such as (a ##1 b) [*3] will expand as follows.

(a ##1 b) ##1 (a ##1 b) ##1 (a ##1 b)

12/19/2011 Pankaj Badhe 45

Go to repetition - This allows the user to specify that an expression will
match the number of times specified not necessarily on continuous
clock cycles. The matches can be intermittent. The main requirement
of a "go to repeat is that the last match on the expression checked for
repetition should happen in the clock cycle before the end of the entire
sequence matching.
The simple syntax of "go to" repetition operator is shown below.
Signal [->n]
Consider the following sequence.
Start ##1 a[->3] ##1 stop
It is required that there is a match on signal "a" (the third and final
repetition of signal "a") just before the success of "stop.
In other words, signal "stop" succeeds on the last clock cycle of the
sequence match, and in the previous clock cycle, there should be a
match on signal "a.

12/19/2011 Pankaj Badhe 46

Non-consecutive repetition - This is very similar to
"go to" repetition except that it does not require
that the last match on the signal repetition happen
in the clock cycle before the end the entire
sequence matching. The simple syntax of a non-
consecutive repetition operator is shown below.
S i g n a l [=n]
Only expressions are allowed to repeat in "go to"
and "nonconsecutive repetitions. Sequences are
not allowed.
12/19/2011 Pankaj Badhe 47
Consecutive repetition operator [*]
Property p21 checks that two clock cycles after a valid start,
signal "a stays high for 3 continuous clock cycles and two
clock cycles after that, signal "stop" is high. One clock
cycle later signal "stop" is low.
Property p21;
@ (posedge clk) $rose(start) |->
##2 (a[*3]) ##2 stop ##1 !stop;
endproperty
a21: assert property(p21);

12/19/2011 Pankaj Badhe 48

Consecutive repetition operator [*] on a sequence
Property p22 checks that two clock cycles after a
valid start, sequence (a ##2 b) repeats 3 times and
two clock cycles after that, signal "stop" is high.
Property p2 2;
@ (posedge clk) $rose(start) |->
##2 ((a ##2 b)[*3]) ##2 stop;
endproperty
a22: assert property(p22);

12/19/2011 Pankaj Badhe 49

Consecutive repetition operator [*] on a sequence with a delay
window
Property p23 checks that two clock cycles after a valid start, sequence (a
##[1:4] b) repeats 3 times and two clock cycles after that, signal "stop" is
high. The fact that the sequence has a timing window makes this check
slightly complicated.
property p23;
@ (posedge clk) $rose(start) |-> ##2 ((a ##[1:4] b)[*3]) ##2 stop;
endproperty
a23: assert property(p23);
The main sequence (a ##[1:4] b) [*3] expands as follows.
((a ##1 b) or (a ##2 b) or (a ##3 b) or (a ##4 b)) ##1
((a ##1 b) or (a ##2 b) or (a ##3 b) or (a ##4 b)) ##1
((a ##1 b) or (a ##2 b) or (a ##3 b) or (a ##4 b))
12/19/2011 Pankaj Badhe 50
 Go to repetition operator [->]
Property p25 checks that, if there is a vahd start
signal on any given positive edge of the clock, 2
clock cycles later, signal "a" will repeat three
times continuously or intermittently before there is
a valid stop signal.
property p2 5;
@ (posedge clk) $rose(start) |->
##2 (a[->3]) ##1 stop;
endproperty
a25: assert property(p25);

12/19/2011 Pankaj Badhe 51

 Non-consecutive repetition operator [=]

Property p26 checks that if there is a valid start signal on any given
positive edge of the clock, 2 clock cycles later, signal "a" will repeat
three times continuously or intermittently before there is a valid stop
signal. One clock cycle later, the signal "stop" should be detected low.
It checks for the exact same thing as property p25 except that it uses a
"non-consecutive repeat operator in the place of a "go to" repeat
operator. This means that, in property p26, there is no expectation that
there is a valid match on signal "a"in the previous cycle of a valid
match on "stop" signal.
Property p2 6;
@ (posedge clk) $rose(start) | -> ##2 (a[=3]) ##1 stop ##1 !stop;
endproperty
a26: assert property(p26);

12/19/2011 Pankaj Badhe 52

 Last or eventuality operator
The $ operator can be used to extend a time
window to a finite, but unbounded range.

a ##1 b [*1:$] ##1 c // E.g. a b b b b c

12/19/2011 Pankaj Badhe 53

 Indefinate timing window

12/19/2011 Pankaj Badhe 54

 Combining Sequences
s1 and s2 // Succeeds if s1 and s2 succeed. The end time is the
// end time of the sequence that terminates last.
If s1 and s2 are sampled booleans and not sequences, the
expression above succeeds if both s1 and s2 are evaluated
to be true.

s1 intersect s2 // Succeeds if s1 and s2 succeed and if end

// time of s1 is the same with the end time of
// s2

12/19/2011 Pankaj Badhe 55

 The "and" construct
The binary operator "and" can be used to combine two sequences logically. The
final property succeeds when both the sequences succeed.
Both sequences must have the same starting point but they can have different
ending points. The starting point of the check is when the first sequence
succeeds and the end point is when the other sequence succeeds, ultimately
making the property succeed.
Sequence s27a and s27b are two independent sequences. The property p27
combines them with an and operator. The property succeeds when both the
sequences succeed.
sequence s27a;
@ (posedge clk) a##[l:2] b;
endsequence
sequence s2 7b;
@ (posedge clk) c##[2:3] d;
endsequence
property p2 7;
@ (posedge clk) s27a and s27b;
endproperty
a27: assert property(p27);
12/19/2011 Pankaj Badhe 56
 The "intersect" construct
The "intersect" operator is very similar to the "and" operator with one additional
requirement. Both the sequences need to start at the same time and complete
at the same time. In other words, the length of both sequences should be the
same.
Property p28 checks for the same condition as property p27. The only difference is
that it uses the intersect construct instead of the and construct.
sequence s28a;
@(posedge clk) a##[l:2] b;
endsequence
sequence s28b;
@(posedge clk) c##[2:3] d;
endsequence
property p2 8;
@ (posedge clk) s28a intersect s28b;
Endproperty
a28: assert property(p28);

12/19/2011 Pankaj Badhe 57

 The "or" construct
The binary operator "or" can be used to combine two sequences logically.
The final property succeeds when any one of the sequence succeeds.
Sequence s29a and s29b are two independent sequences. The property p29
combines them with an or operator. The property succeeds when any
one of the sequence succeeds.
sequence s29a;
@(posedge clk) a##[l:2] b;
endseguence
sequence s2 9b;
@ (posedge clk) c##[2:3] d;
endsequence
property p2 9;
@(posedge clk) s28a or s28b;
endproperty
a29: assert property(p29);

12/19/2011 Pankaj Badhe 58

 The "firstmatch" construct
Whenever a timing window is specified in sequences along with binary
operators such as and and or, there is a possibility of getting multiple
matches for the same check. The construct "first_match" ensures that
only the first sequence match is used and the others are discarded. This
becomes very help fill when combining multiple sequences together
wherein only the first match in the timing window is required to
evaluate the remaining part of the property.
In the example shown below, two sequences are combined with an or
operator. There are several possible matches for this property and they
are as follows.
a ##1 b
a ##2 b
c ##2 d
a ##3 b
c ##3 d

12/19/2011 Pankaj Badhe 59

When the property p30 gets evaluated, the first one to match
will be kept and every other match will be discarded.
sequence s30a;
@ (posedge clk) a ##[1:3] b;
endseguence
sequence s3 0b;
@ (posedge clk) c ##[2:3] d;
endsequence
property p3 0;
@(posedge clk) first_match(s3 0a or s3 0b);
Endproperty
a30: assert property(p30) ;

12/19/2011 Pankaj Badhe 60

 The "throughout" construct
Implication is one technique discussed so far that allows
defining preconditions.
For example, for a specific sequence to be tested, a certain
precondition must be true. There are also situations
wherein the condition must hold true until the entire test
sequence completes. Implication checks for precondition
once on the clock edge and then starts evaluating the
consequent part. Hence, it does not care if the antecedent
remains true or not. To make sure that certain condition
holds true during the evaluation of the entire sequence,
"throughout" operator should be used. The simple syntax
of a throughout operator is shown below.
(expression) throughout (sequence definition)

12/19/2011 Pankaj Badhe 61

Property p31 checks the following.
a. The check starts when signal "start" has a falling edge.
b. Test the expression ((!a&&!b) ##1 (c[->3]) ##1 (a&&b)).
c. The sequence checks that between the falling edge of signals "aand
"b," and the rising edge of signals "a" and "b," signal "c should repeat
itself 3 times continuously or intermittently,
d. During the entire test expression, signal "start" should always be low.
property p31;
@ (posedge clk) $fell(start) |->
(!start) throughout
(##1 (!a&&!b) ##1 (c[->3]) ##1 (a&&b));
endproperty
a31: assert property(p31);

12/19/2011 Pankaj Badhe 62

 The "within" construct
The "within" construct allows the definition of a sequence contained within
another sequence.
seql within seq2
This means that seql happens within the start and completion of seq2.
The starting matching point of seq2 must happen before the starting matching
point of seql. The ending matching point of seql must happen before the
ending matching point of seq2. Property p32 checks that the sequence s32a
happens within the rise and fall of signal "start." The rise and fall of signal
"start" is defined as a sequence in s32b.
sequence s32a;
@(posedge clk) ((!a&&!b) ##1 (c[->3]) ##1 (a&&b));
endsequence
sequence s32b;
@ (posedge clk) $fell(start) ##[5:10] $rose(start);
endsequence
sequence s32; @ (posedge clk) s32a within s32b; endsequence
property p3 2; @ (posedge clk) $fell(start) |-> s32; endproperty
a32: assert property(p32);

12/19/2011 Pankaj Badhe 63

 Variables in Sequences & Properties
Variables can be used in sequences and properties. A common use
for this occurs in pipelines:
`define true 1
property p_pipe;
logic v;
@(posedge clk) (`true,v=DataIn) ##5 (DataOut === v);
endproperty
A_local_var: assert property (p_pipe);
In this example, the variable v is assigned the value of DataIn unconditionally on
each clock. Five clocks later, DataOut is expected to equal the assigned value.
Each invocation of the property (here there is one invocation on every clock)
has its own copy of v. Notice the syntax: the assignment to v is separated from
a sequence expression by a comma, and the sequence expression and variable
assignment are enclosed in parentheses.
12/19/2011 Pankaj Badhe 64
The local variables can be stored and manipulated inside SVA.
1. A valid start occurs if a rising edge is detected on the signal "start on
any given positive edge of the clock.
2. One cycle later, a specific pattern or a sub-sequence is looked for. The
signal "enable 1" should be detected high and 2 cycles later signal
"enable2" should be detected high. This sub-sequence should repeat
itself 4 times continuously.
3. For every repeat of the sub-sequence, the value of the vector "aa" is
accumulated locally. At the end of the repetition, the local variable
holds a value accumulated from the vector "aa" four times.
4. One cycle after the repetition, it is expected that the signal "stop" is
detected high and the value held by the local variable is equal to the
value held by the output vector "aout."

12/19/2011 Pankaj Badhe 65

property p_lvar_accum;
int Ivar;
@(posedge clk) $rose(start)|=>
(enablel ##2 enable2, Ivar = Ivar +aa) [*4]
##1 (stop && (aout == Ivar));
endproperty
a_lvar_accum : assert property(p_lvar_accum);

12/19/2011 Pankaj Badhe 66

 The ended construct
Sequence s15a and s15b are two
simple sequences that take more than
1 clock cycle to match.
Property pl5a checks that sequence sl5a
and sequence si5b match with a delay
of one clock cycle in between them.
Property p15b checks the same
protocol but by using the keyword
ended. In this case, the end point of the
sequences does the synchronization.
Since the endpoints are used, a delay of
2 clock cycles is defined between the 2
sequences.

12/19/2011 Pankaj Badhe 67

 SVA Checker using parameters
module generic_chk (input logic a, b, clk);
parameter delay = 1;
property pl6;
@ (posedge clk) a |-> ##delay b;
endproperty
al6: assert property(pl6);
endmodule
// call checker from the top level module
module top( );
logic clk, a, b, c, d;
generic_chk #(.delay(2)) il (a, b, clk);
generie_chk i2 (c, d, clk);
endmodule

12/19/2011 Pankaj Badhe 68

SVA Checker using a select operator
property pi7;
@ (posedge clk) c ? d == a : d == b;
endproperty
a l 7 : assert property ( pl7 );

12/19/2011 Pankaj Badhe 69

 The "$past" construct
SVA provides a built in system task called $past that is capable of
getting values of signals from previous clock cycles. By default, it
provides the value of the signal from the previous clock cycle. The
simple syntax of this construct is as follows.
$past (signal_name, number of clock cycles)
This task can be used effectively to verify that, the path taken by the
design to get to the state in this current clock cycle is valid. Property pi9
checks that in the given positive clock edge, if the expression (c && d) is
true, then 2 cycles before that, the expression (a && b) was true.
Property pl9;
@ (posedge clk) (c && d) |-> ($past((a&&b), 2) == 1'bl);
Endproperty

al9: assert property(pl9);

12/19/2011 Pankaj Badhe 70

The system function $past returns the value of an
expression in a previous clock cycle. For example,
assert property
(@(posedge clk)
disable iff (reset) // Pl. NOTE the DISABLE IFF
enable |=> q == $past(q+1)
);
states that q increments, provided reset is low and
enable is high.
12/19/2011 Pankaj Badhe 71
 The $past construct with clock gating
The $past construct can be used with a gating signal. For example, on a
given clock edge, the gating signal has to be true even before checking for
the consequent condition. The simple syntax of a Spast construct with a
gating signal is as follows.
Spast (signal_name, number of clock cycles, gating signal)
the check is effective only if the gating signal "e' is valid on any given
positive edge of the clock.

Property p20;
@ (posedge clk) (c && d) |-> ($past((a&&b), 2, e) == 1'bl);
endproperty

a20: assert property(p20);

12/19/2011 Pankaj Badhe 72

This assertion,

assert property (@(posedge clk) enable == 0 |=> $stable(data));

states that data shouldnt change whilst enable is 0.

12/19/2011 Pankaj Badhe 73

 Deferred assertions
Deferred assertions are an improvement over
immediate assertions. They are similar to
immediate assertions in that they are nontemporal
and unrestricted in their use.
Two important differences make them useful over
immediate assertions: they do not produce
spurious failures, and they can be placed both
inside and outside procedural code.

12/19/2011 Pankaj Badhe 74

12/19/2011 Pankaj Badhe 75
 Built-in system functions
SVA provides several built-in functions to check for some of
the most common design conditions.
Sonehot(expression) - checks that the expression is one-hot,
in other words, only one bit of the expression can be high
on any given clock edge.
$onehotO(expression) - checks that the expression is zero
one-hot, in other words, only one bit of the expression can
be high or none of the bits can be high on any given clock
edge.
$isunknown(expresslon) - checks if any bit of the expression
is X or Z.
Scountones(expression) - counts the number of bits that are
high in a vector.
12/19/2011 Pankaj Badhe 76
 Using let
logic a, b, c, d, cond, clk;
let onecold(sig) = $onehot(sig);
// ...
always_comb begin
// ...
a1: assert (onecold({a, b, c}) || d);
end
a2: assert #0 (onecold({a, b, c}) -> d);
a3: assert property (@(posedge clk) cond |=>
onecold({a, b, c}));
12/19/2011 Pankaj Badhe 77
In this example, a parameterized expression $onehot(sig) is
named onecold using a let statement.
$onehot is a SVA system function returning true when
exactly one bit of its argument is set to 1. This let
expression checks for one cold encoding which means
exactly one bit of sig is 0.
Notice that an instance of the let expression is used in
assertions a1, a2, and a3. a1 is an immediate assertion
ensuring that exactly one signal among a, b, and c is low
when d is low.
a2 is a deferred assertion ensuring that when exactly one
signal among a, b, and c is low, d must be high. Another
variation is the concurrent assertion a3 which specifies that
after condition cond is true, exactly one signal among a, b,
and c is 0.
12/19/2011 Pankaj Badhe 78
 Nested implication
define f r e e (a && b && c && d)
property p_nest;
@ (posedge clk) $fell(a) |->
##1 (!b && Ic && !d) I->
##[6:10] "free;
endproperty
a_nest: assert property(p_nest);

12/19/2011 Pankaj Badhe 79

 Using if/else with implication
property p_if_else;
@(posedge clk)
($fell(start) ##1 (a||b)) |->
if (a)
(c[->2] ##1 e)
else
(d[->2] ##1 f) ;
endproperty
a_if_else: assert property(p_if_else);
12/19/2011 Pankaj Badhe 80
 Multiple clock definitions in SVA
SVA allows a sequence or a property to have
multiple clock definitions for sampling individual
signals or sub-sequences. SVA will automatically
synchronize between the clock domains used in
the signals or subsequences.
The following code shows a simple example of a
sequence using multiple clocks.
sequence s_multiple_clocks;
@ (posedge clkl) a ##1 (posedge clk2) b;
Endsequence // see next slide
12/19/2011 Pankaj Badhe 81
The sequence s_multiple_clocks checks that, on a given positive edge of
clock "clkl," signal "a" is high and then on a give positive edge of
clock "clk2," signal "b" is high. The sequence matches when signal "a"
is high on any given positive edge of clock "clkl." The ##1 delay
construct will move the evaluation time to the nearest positive clock
edge of clock "clk2" and then will check for signal "b" being high.
When multiple clocked signals are used in a sequence, only ##1 delay
construct is allowed.
The use of an overlapping implication operator between two multiple
clocked sequences is not allowed. Since the end of the antecedent
and the beginning of the consequent overlaps, it can lead to race
conditions; hence, it is illegal. The following code shows the illegal
coding style.
property p_multiple_clocks_implied_illegal;
@(posedge clkl) s1 |-> @(posedge clk2) s2;
endproperty

12/19/2011 Pankaj Badhe 82

 SVA for functional coverage
Functional coverage is a metric for measuring
verification status against design specification. It
is classified into two categories:
a. Protocol coverage.
b. Test plan coverage.
Assertions can be used to get exhaustive information
on protocol coverage. SVA provides a keyword
"cover" to specify this.

12/19/2011 Pankaj Badhe 83

 Coverage Statements
module Amod2(input bit clk);
bit X, Y;
sequence s1;
@(posedge clk) X ##1 Y;
endsequence

CovLavel: cover property (s1);

...
endmodule
12/19/2011 Pankaj Badhe 84
 Results
The results of the cover statement will provide the following
information:
1. Number of times the property was attempted.
2. Number of times the property succeeded.
3. Number of times the property failed.
4. Number of times the property succeeded vacuously.
A sample coverage log from a simulation for the checker "mutexchk" is
shown below.

c_mutex, 12 attempts, 12 match, 0 vacuous match

Just like the assert statement, the cover statement can also have an
action block. Upon a successful coverage match, a function or a task
can be called or a local variable update can be performed.

12/19/2011 Pankaj Badhe 85

 Connecting SVA to the design
SVA checkers can be connected to the design by two
different methods.
1. Embed or in-line the checkers in the module definition.
2. Bind the checkers to a module, an instance of a module or
multiple instances of a module.
Some engineers don't like adding any verification code within
the design. In this case, binding the SVA checkers
externally is the choice.
SVA code can be embedded anywhere in a module definition.

12/19/2011 Pankaj Badhe 86

module inline(clk, a, b, dl, d2, d ) ;
input logic clk, a, b;
input logic [7:0] dl, d2;
output logic [7:0] d;
always(posedge clk)
begin
if (a)
d <= dl;
if (b)
d <= d2;
end
property p_mutex;
(posedge clk) not (a && b);
endproperty
a_mutex: assert property(p_mutex);
endmodule

12/19/2011 Pankaj Badhe 87

If the user decides to keep the SVA checkers separate from the design,
then he has to create a separate checker module. By defining a
separate checker module, the re-usability of the checker increases.
The following code shows a checker module.
module mutex chk(a, b, clk);
input logic a, b, clk;
property p_mutex;
(posedge clk) not (a && b);
endproperty
a_mutex: assert property(p_mutex);
endmodule
Note that when a checker module is defined, it is an independent entity.
The checker is written for a generic set of signals. The checker can be
bound to any module or instance in the design.

12/19/2011 Pankaj Badhe 88

 Binding
module M (...);
// The design is modelled here
endmodule

program M_assertions(...);
// sequences, properties, assertions for M go here
endprogram

bind M M_assertions M_assertions_inst (...);

12/19/2011 Pankaj Badhe 89
For the example checker shown above, the binding can be done as
follows.
bind inline mutex_chk i2 (a, b, clk);
When the binding is done, the actual design signal names are used.
Let's say we have a top-level module as follows.
module t o p (. . ) ;
inline ul (clk, a, b, inl, in2, outl);
inline u2 (clk, c, d, in3, in4, out2);
endmodule
The checker mutexchk can be bound to the two instances of the module "inline" in
the top-level module as follows.
bind top.ul mutex_ehk il(a, b, clk);
bind top.u2 mutex_ehk i2(c, d, clk);

The design signals that are bound can contain cross module reference
to any signal within the scope of the bound instance.

12/19/2011 Pankaj Badhe 90

 A sample system under verification.doc

12/19/2011 Pankaj Badhe 91

SVA FOR FINITE STATE MACHINES

12/19/2011 Pankaj Badhe 92

12/19/2011 Pankaj Badhe 93
12/19/2011 Pankaj Badhe 94
12/19/2011 Pankaj Badhe 95
12/19/2011 Pankaj Badhe 96
12/19/2011 Pankaj Badhe 97
 SVA for memories
SVA FOR MEMORIES.doc

12/19/2011 Pankaj Badhe 98

 Thank you for being Patient!!!

12/19/2011 Pankaj Badhe 99