We present RFN, a formal property verification tool based on abstraction refinement. Abstraction refinement is a strategy for property verification. It iteratively refines an abstract model to better approximate the behavior of the original design in the hope that the abstract model alone will provide enough evidence to prove or disprove the property.However, previous work on abstraction refinement was only demonstrated on designs with up to 500 registers. We developed RFN to verify real-world designs that may contain thousands of registers. RFN differs from the previous work in several ways. First, instead of relying on a single engine, RFN employs multiple formal verification engines, including a BDD-ATPG hybrid engine and a conventional BDD-based fixpoint engine, for finding error traces or proving properties on the abstract model. Second, RFN uses a novel two-phase process involving 3-valued simulation and sequential ATPG to determine how to refine the abstract model. Third, RFN avoids the weakness of other abstraction-refinement algorithms ---finding error traces on the original design, by utilizing the error trace of the abstract model to guide sequential ATPG to find an error trace on the original design.We implemented and applied a prototype of RFN to verify various properties of real-world RTL designs containing approximately 5,000 registers, which represents an order of magnitude improvement over previous results. On these designs, we successfully proved a few properties and discovered a design violation.

The median absolute deviation (MAD) is a statistic measuring the variability of a set of quantitative elements. It is known to be more robust to outliers than the standard deviation (SD), and thereby widely used in outlier detection. Computing the exact MAD however is costly, e.g., by calling an algorithm of finding median twice, with space cost O ( n ) over n elements in a set. In this paper, we propose the first fully mergeable approximate MAD algorithm, OP-MAD, with one-pass scan of the data. Remarkably, by calling the proposed algorithm at most twice, namely TP-MAD, it guarantees to return an (ϵ, 1)-accurate MAD, i.e., the error relative to the exact MAD is bounded by the desired ϵ or 1. The space complexity is reduced to O ( m ) while the time complexity is O ( n + m log m ), where m is the size of the sketch used to compress data, related to the desired error bound ϵ. To get a more accurate MAD, i.e., with smaller ϵ, the sketch size m will be larger, a trade-off between effectiveness and efficiency. In practice, we often have the sketch size m ≪ n , leading to constant space cost O (1) and linear time cost O ( n ). The extensive experiments over various datasets demonstrate the superiority of our solution, e.g., 160000× less memory and 18x faster than the aforesaid exact method in datasets pareto and norm . Finally, we further implement and evaluate the parallelizable TP-MAD in Apache Spark, and the fully mergeable OP-MAD in Structured Streaming.

This paper describes techniques for efficiently handling a subset of SystemVerilog Assertion(SVA) safety properties with local variables in formal verification. The techniques produce checker circuits using datapath logic and pipeline registers for handling the local variables where the datapath logic and pipeline registers scales lineally to the size of the property expressed in the SVA abstract grammar.A high level specification for describing and synthesizing protocol monitors using regular expression, storage vasiables and pipeline operators is proposed in 161. A notion of dynamic threads is introduced, however, the language has different language semantics where the choice operators can't bifurcate threads compared to SVA.Recent work in SVA compilation[7l is bssed on translating SVA assertions into Blnespec constructs and uses Dluespec compiler to generate the checker circuit. Their work does C.4 [Performance of Systems]: Modeling techniques not describe how to model SVA local variable constructs. Apart from the local variable constructs, the most direct General Terms Verification Keywords SVA, Assertion Synthesis influence on the present work is earlier work from [Z] and 181. Our compilation model is similar to on-thefly RCTL model checking work [2]. Our compilation flow is similar to [8]where an extended regular expression language with action statements t o specify state machines, which are synthesized in polynomial time into circuits, however the semantics of Permission to make digital or hard copies of all or pan of this work for pemnnal or elarsmom use is granted without fee provided that copies are PRELIMINARIESnot made or distributed for profit or commencial advantage and that copies Given a set C of an alphabet, C' denotes the set of finite hear this notice and the full citation on the fint page. To copy othenvire, to over C, C" denotes the set of infinite words over C, republish. to post on servers or to distribute to lists. requires prior specific and Em denotes the C* x u , ~h~ length of word permission andlor a fee.

Based on the traits of the four-wheel drive EV, a self-adaptive Kalman filter was applied to gain the information of vehicle velocity and traction forces on four wheels. With the estimated vehicle velocity and the driving forces on four wheels, the slope k of the curves of adhesion coefficient versus slip rate could be calculated and consequently the road adhesion condition could be accurately identified. Through calculating the difference between the estimated slope k with the optimized slope k as a control reference, the output torques of the motors were adjusted instantaneously to improve the using rate of the adhesion as well as the rationality of the traction control strategy. Simulation results illustrate that whether on high adhesion or low adhesion roads the vehicle is passing, the strategy can estimate the k effectively.