Introduction to System Verilog Assertions

1. Introduction to System Verilog Assertions Erik Seligman CS 510, Lecture 8, January 2009

2. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

3. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

4. What is an Assertion? • Statement about your RTL • “Executable Comment” • Usable both in simulation and formal • Simulation: check if vectors obey • Formal: mathematically prove

5. Who Creates Assertions? • RTL Authors • Recommend: enable/teach to all designers • Write assertions during RTL creation • Part of design process, like comments • Validators • Include assertions in testplans • FEV • Create assertions for FEV constraints

6. Other Assertion Statements • Assumptions • = Assertion used as FPV constraint • In simulation treated like regular assert • Cover point (“Anti-Assertion”) • Condition you want to see in some test • Useful for checking completeness of env • Simulation: monitor cumulative coverage of tests • Formal: make sure covers reachable under constraints • General term “assertion statement” includes assumes and covers • To avoid long-windedness in discussions

7. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

8. SVA Assertion Language • Part of p1800 SystemVerilog Standard • SVA popular even if SV not used for design • This lecture covers 2005 syntax • Currently implemented in most tools • 2009 syntax improves, but not official yet! • SVA assertions are part of language • May include in design, or ‘bind’ external file • Assertions appear within module

9. Types of SVA Assertions • Immediate assertions A1: assert (foo && bar || baz); • Boolean only, no clocks or reset • Usable in arbitrary procedures, functions • Concurrent assertions A2: assert property (@(posedge clk) disable iff (rst) (foo ##1 bar |=> baz)); • Full use of sequences & properties • Limited legal locations in procedural code • Usable outside procedures

10. Clocks and Resets • Feature of concurrent assertions • Clocks can be explicit, or • May inherit from default clocking statement default clocking @(posedge clk) endlocking; • May inherit from enclosing always always @(posedge clk …) • Reset (‘disable iff’) explicitly, or • May inherit from enclosing always always @(posedge clk or posedge rst) … • No default for reset, but added in SVA 2009

11. Assumes and Covers • Only for concurrent assertions • Immediate assume/cover added in 2009 • Change ‘assert’ keyword • Examples AS1: assume property (@(posedge clk) disable iff (rst) (foo ##1 bar |=> baz)); C1: cover property (@(posedge clk) disable iff (rst) (foo ##1 bar ##1 baz));

12. SVA assertion layers Assertion Statements Properties Sequences Booleans

13. Comments on Layers • Booleans: simple expressions • Sequences: set of booleans over time • Properties: implications of sequences • Assertion statements: actual usage in code • Bool, seq, prop does nothing unless in an assertion statement • Immediate: assert <bool> • Concurrent: assert property…, assume property…, cover property…

14. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

15. SVA assertion layers Assertion Statements Properties Sequences Booleans

16. Boolean Expressions in Assertions • Just use directly • Immediate Assertion a1: assert (foo && bar || baz); • Checked when reached in code • Concurrent assertion a2: assert property (foo && bar || baz); • Checked at each clock

17. Examples in context always @(*) begin // watch out for glitches! a1: assert (foo && bar || baz); end always @(posedge clk) begin a2: assert property (foo && bar || baz); end default clocking @(posedge clk2); endclocking; // Is a3 equivalent to a2? a3: assert property (foo && bar || baz);

18. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

19. SVA assertion layers Assertion Statements Properties Sequences Booleans

20. Sequences • Usable only in concurrent assertion • Inherit clock from usage • Default clocking / procedure clock • Or clock of property that uses • Basic sequence operations • s1 ##[m:n] s2: delay <m>to<n> cycles (0 = overlap) • s1[*m:n]: repeat from <m> to <n> times • s1 or s2: one sequence is true • s1 and s2: same start, both eventually true • s1 intersect s2: must both end on same cycle • bool throughout s1: bool true for all of s1

21. Sequence Examples foo ##1 bar ##1 baz (foo ##1 bar) or (foo ##1 baz) (foo ##1 bar)[*5] ##1 baz foo throughout (bar[*5] ##1 baz)

22. Sequence Examples foo ##1 bar ##1 baz • foo, then bar, then baz (foo ##1 bar) or (foo ##1 baz) • foo, then either bar or baz (foo ##1 bar)[*5] ##1 baz • foo bar 5 times, then baz foo throughout (bar[*5] ##1 baz) • foo = 1 during (bar 5 times and then baz)

23. Other Useful Building Blocks • In bounds, ‘$’ = infinity foo[*3:$] ##1 bar • Special system functions $past(sig) $rose(sig) $fell(sig) $stable(sig)

24. Named Sequences sequence s1(a); a ##1 foo; endsequence • Then the following are equivalent a1: assert property (s1(bar) |-> baz) a2: assert property ((bar ##1 foo) |-> baz));

25. Asserting a Sequence • What does this mean? assert property (foo ##1 bar); • Checks the sequence *every cycle* • Usually not useful! • Also expensive in simulation • Sequences mainly to help build properties • Negated sequence is very useful assert property (not(foo ##1 bar));

26. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

27. SVA assertion layers Assertion Statements Properties Sequences Booleans

28. Creating Properties • Basic operation: triggered implication seq |-> prop // overlapping seq |=> prop // non-overlapping • Trigger must be a sequence • Corresponds to intuition • Easy to check in simulation

29. Property Examples foo |=> bar foo ##1 bar |-> baz foo [*5] |-> not (bar ##1 baz) foo ##0 bar |-> $rose(baz)

30. Property Examples foo |=> bar • If we see foo, we see bar the next cycle foo ##1 bar |-> baz • If we see foo and then bar, we also see baz (same cycle as bar) foo [*5] |-> not (bar ##1 baz) • If we see foo 5 times, then if bar is true during the 5th, baz will be false next cycle foo ##0 bar |-> $rose(baz) • If foo and bar are true at the same time, baz must have just risen

31. Named Properties • Similar to named sequences property p1(e1,e2); e1 |=> e2; endproperty • The following are equivalent: • assert property (p1(foo,bar)); • assert property (foo |=> bar);

32. Property operators • AND, OR, NOT available • Don’t confuse with boolean &&, ||, ! • Some examples: assert property (a |-> b) AND (a |-> c); assert property (NOT (a ##1 b)); assert property (p1(a,b) OR (a |-> b));

33. Other Useful Building Blocks • $onehot (expr) • true ifexactlyone bit of the expression is high • $onehot0 ( expr ) • true if at most one bit of the expression is high. • $isunknown (expr) • true if any bit of expression is (4 state logic) X or Z. • $countones ( expr) • counts the number of bits set in a bit vector

34. Agenda • Introduction: What Is An Assertion? • SVA Overview • Boolean Layer • Sequence Layer • Property Layer • Gotchas

35. Immediate Assertions Are Glitchy! always @(a or b) a1: assert (a==b); always @(a) b = a; • What is order of always blocks? • Can a1 be evaluated twice?

36. Immediate Assertions Are Glitchy! always @(a or b) a1: assert (a==b); always @(a) b = a; • What is order of always blocks? • Can a1 be evaluated twice? Yes! • Order of blocks not defined in Verilog / SV • Solution in SVA 2009 (“deferred assertion”), but not there yet…  Don’t use immediate assertions unless really needed! • If you have clock, why not use it: A1: assert property (@(posedge clk) (a==b));

37. Watch Those Parentheses • SVA syntax is fussy • Legal: assert property (foo |=> bar); • Illegal: assert property foo |=> bar; • Good idea to group anyway • Extra layer of () usually can’t hurt • Why depend on order of ops?

38. seq1 seq2 AND vs INTERSECT • Two similar sequence ops • AND = same start • INTERSECT = same start and end seq1 seq2

39. Sequences vs Properties • A sequence is a property… BUT • The property is “sequence matched starting every cycle” • Don’t confuse “a ##1 b” (continuously checked) with “a |=> b” (only checked when a is true) • Exception: initial block • assert property @(posedge clk) (foo ##1 bar); // Useful? == foo is always true, and so is bar starting on cycle 2 Negated Sequences are properties, not sequences “This sequence is never matched” Sometimes useful– but remember, it’s no longer a sequence

40. Sequences vs Properties • A sequence is a property… BUT • The property is “sequence matched starting every cycle” • Don’t confuse “a ##1 b” (continuously checked) with “a |=> b” (only checked when a is true) • Exception: initial block • assert property @(posedge clk) (foo ##1 bar); // Useful? == foo is always true, and so is bar starting on cycle 2 • Negated Sequences are properties, not sequences • “This sequence is never matched” • Sometimes useful– but remember, it’s no longer a sequence

41. Be Careful With $stable, etc • $stable, $changed, $past see previous values • But what is “previous” at start of sim? • Default value for type, often X • So what does this property do? wire foo; A1: assert property ($stable(foo)) A1 claims foo is always X! Rethink property, add delay or reset Safer version: A2: assert property (##1 $stable(foo));

42. Be Careful With $stable, etc • $stable, $changed, $past see previous values • But what is “previous” at start of sim? • Default value for type, often X • So what does this property do? wire foo; A1: assert property ($stable(foo)) • A1 claims foo is always X! • Rethink property, add delay or reset • Safer version: A2: assert property (##1 $stable(foo));

43. Triggered Implication • How to read a |-> b? • “a implies b”? Not exactly. • “a triggers b”: Better! • Some consequences of this definition • Left side must be a sequence, not a property • Negated sequence cannot be the left side • Negated sequence is property, not sequence! • If you want a negated sequence to trigger property, need to rethink • assert property (!s1) |-> p1; // illegal • assert property (p1 or s1); // OK… but different

44. Negating Properties • What does not (a |-> b) mean? • Doesn’t mean: b never happens when a does • Does mean: sometime, a happens and b doesn’t • Discuss using followed-by (#-#) operator • not(a |-> b) rewritten as a #-# not b • Read as “At some point, ‘a’ is followed by ‘!b’”. • #-# not in language yet– don’t use in code! • Another 2009 extension

45. Make Assertions Part of the Design Process • Define standard assertion note // Assertion a123: Check for legal grants; • Designer adds: spec, testplans, RTL • Assertion idea != interrupt thought flow • OK to add note if no time to write assertion • Assertion expert role • Scripts to collect assertion notes • Help designer implement/focus • Assertions: casual & easy • Pitfall: Treat as “out-of-band” process • Pitfall: Avoid requirements seen as penalty • “Must eventually prove X% formally”

46. References / Further Reading • http://www.chipdesignmag.com/display.php?articleId=1448&issueId=23 • http://www.doulos.com/knowhow/sysverilog/tutorial/assertions/ • http://www.cadence.com/rl/Resources/application_briefs/Vhowto_SVA_EZ_StartGuide.pdf • http://www.toomuchsemi.com/Docs1/SVAOverview.pdf • https://www.syosil.com/files/publications/bsnug04_ecker_esen_kruse_steininger_jensen.pdf?PHPSESSID=fdcf823af22a7c9f4bddfa13b8646915