Modeling and formal verification of the Fairisle ATM switch fabric using MDGs

Abstract

In this paper, we present several techniques for modeling and formal verification of the Fairisle asynchronous transfer mode (ATM) switch fabric using multiway decision graphs (MDG's). MDG's represent a new class of decision graphs which subsumes Bryant's reduced ordered binary decision diagrams (ROBDD's) while accommodating abstract sorts and uninterpreted function symbols. The ATM device we investigated is in use for real applications in the Cambridge University Fairisle network. We modeled and verified the switch fabric at three levels of abstraction: behavior, and register transfer level (RTL) and gate levels. In a first stage, we validated the high-level specification by checking specific safety properties that reflect the behavior of the fabric in its real operating environment. Using the intermediate abstract RTL model, we hierarchically completed the verification of the original gate-level implementation of the switch fabric against the behavioral specification. Since MDG's avoid model explosion induced by data values, this work demonstrates the effectiveness of MDG-based verification as an extension of ROBDD-based approaches. All the verifications were carried out automatically in a reasonable amount of CPU time. I. INTRODUCTION T HE consequence of errors in the design or implementation of communication networks and components is increasingly critical. This is especially so if networks are used in safety-critical applications where communications problems could cause loss of life. Simulation and testing have traditionally been used for checking the correctness of those systems. However, it is practically impossible to run an exhaustive test or simulation for such large and complex systems. The use of formal verification for determining the correctness of digital systems is, thus, gaining interest, as the correctness of a formally verified design implicitly involves all cases regardless of the input values. One obstacle of formal verification is, however, the fact that existing techniques either require a deep

Design and verification of an ATM Knockout switch concentrator

“…Other related work in the area of the formal verification of communications devices using equivalence checking include the verifications in the MDG (Multiway Decision Graphs) tool [3] of the Fairisle ATM switch fabric [10] and a Telecom System Block from PMC-sierra Inc. [12]. In [10], the authors achieved a three level equivalence checking between behavioral, RT and gate levels.…”

“…In [10], the authors achieved a three level equivalence checking between behavioral, RT and gate levels. In [12], the sequential equivalence checking between behavioral model and RTL is described.…”

First-Order LTL Model Checking Using MDGs

“…We use an RTLd esign of this ATMs witchf abric with 4i nputs and4 outputs defineda s8variableso fa bstract sort ( n -bit) modeled in MDG-HDL [18]. In the following we discussfi ve sample properties, P1-5.…”

The impact of design changes on verification using MDGs

“…For instance, the formal verification of the Cambridge Fairisle switch fabric had been done by Curzon [3] using the HOL theorem prover. Tahar et al [13] verified the same switch in an automatic fashion using the MDG (Multiway Decision Graphs) tools by property checking and equivalence checking. Lu et al [10] also formally verified this same ATM switch fabric using VIS.…”

“…In addition to the suggested modification, we changed the original environment state machine which was used in Original Fairisle 4 by 4 switch fabric verification using MDG tools [13]. The new verification of the Cleaned version of the design has been performed by property checking and equivalence checking provided by the MDG tools.…”