Proving transaction and system-level properties of untimed SystemC TLM designs

Abstract

Abstract-Electronic System Level (ESL) design manages the enormous complexity of todays systems by using abstract models. In this context Transaction Level Modeling (TLM) is state-of-theart for describing complex communication without all the details. As ESL language, SystemC has become the de facto standard. Since the SystemC TLM models are used for early software development and as reference for hardware implementation their correct functional behavior is crucial. Admittedly, the best possible verification quality can be achieved with formal approaches. However, formal verification of TLM models is a hard task. Existing methods basically consider local properties or have extremely high run-time. In contrast, the approach proposed in this paper can verify "true" TLM properties, i.e. major TLM behavior like for instance the effect of a transaction and that the transaction is only started after a certain event can be proven.Our approach works as follows: After a fully automatic SystemC-to-C transformation, the TLM property is mapped to monitoring logic using C assertions and finite state machines. To detect a violation of the property the approach uses a BMC-based formulation over the outermost loop of the SystemC scheduler. In addition, we improve this verification method significantly by employing induction on the C model forming a complete and efficient approach. As shown by experiments state-of-the-art proof techniques allow proving important non-trivial behavior of SystemC TLM designs.

Towards analyzing functional coverage in SystemC TLM property checking

“…In this section we briefly review the approach presented in [8] for proving properties of untimed SystemC TLM models. The Property Specification Language (PSL) [15] with extension of TLM primitives (begin/end of transaction, notification of event) [16] is used as the property language.…”

“…The notion of states and how the transition relation is formed with respect to M P is also detailed in [8] The property P holds in the original design, iff no assertion fails during each iteration of the main loop, or in other words during each transition T (s i , s i+1 ). Such a transition is called safe and written as safe(s i , s i+1 ).…”

“…Synchronized by events, transactions carry out the communication between modules of a design. With the property language and the verification method from [8], one can specify and prove properties about when a transaction should be initiated, for example after a certain event notification or after the design reaches a given internal state. However, especially for safety-critical transactions (e.g.…”

“…Thus, formal verification approaches have been proposed to prove properties of a TLM model in a mathematical sense (see e.g. [5], [6], [7], [8]) which is a much stronger result than simulation-based methods can provide. In this context, the work in [8] introduced a Bounded Model Checking (BMC) [9] based verification approach to check transaction-and systemlevel properties of untimed TLM SystemC designs.…”

“…the basics of SystemC including a running example are described and the TLM property checking approach of [8] is briefly reviewed. The proposed transaction-based coverage approach is presented in Section III.…”