Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 2. BACKGROUND AND RELATED WORK 22
compile a design description into actual hardware then the operation of the hardware itself.
The limits of formal methods for verification must be kept in mind – the techniques do
not guarantee correct hardware but they do promise to remove or reduce error in the most
error-prone stages of the process.
2.4.1 Model Checking
Model checking is an automatic model based property-verification method that is widely
applicable for verification tasks. Checking starts with a model description and attempts to
discover whether hypotheses asserted by the user are valid in the model. In this way the
model checker can verify properties of the model (such as freedom from deadlocks), or can
provide counterexamples in the form of an execution trace which fails the test.
Modal checking is based on temporal logic [29] which allows the expression of formulae over
transition systems. Model checking is essentially the exploration of the full state space of a
system and thus can be highly automated but the size of the model that can effectively be
executed is limited by the practical constraints of computer processor power, memory, etc.
Despite this through considerable practical work on data structures (for example BDDs [11])
circuits of considerable size have been verified using model checkers.
Symbolic Trajectory Evaluation (STE) [73], for example, is a model checking approach de-
signed to verify circuits with very large state spaces since it is more sensitive to the property
being checked than to the size of the circuit. STE grew out of symbolic simulation and it
still close to traditional simulation as a verification method.
A number of commercially available tools for hardware verification through model checking
are available from EDA vendors such as Cadence and Synopsis. Model checking is increasingly
used in commercial circuit development as part of the verification process, although not
totally replacing simulation. Model checking is particularly useful even in systems that are
too large for full exhaustive checking (which is most full systems) because it finds counter-
examples - state transition traces that do not meet the specification - and so can be used
as part of a bug-fixing process. Simulation and model checking can be used in combination
to explore a large state space, with simulation used to reach an interesting state and then