Hardware/Software Co-verification Using Path-based Symbolic Execution
Related work
Previous work for co-verification have addressed the problem at the pre-RTL phase. However, we address the co-verification problem at the post-RTL phase where a key risk is divergence of the HW RTL from the behavior expected by the SW. Generating a unified co-verification model is a well-known technique in HW/SW co-verification. Notably, Kurshan et al. modeled HW and SW using finite state machines , Monniaux in modeled HW and SW as C programs which are formally pushdown systems (PDS), Li et al. in used Buchi Automata to abstractly model a hardware and PDS to abstractly model a software to generate a unified SW-HW model, called Buchi Pushdown System (BPDS). In this paper, we construct a unified sequential co-verification model in C language.
Common practice in industry for system-level co-verification is to either use emulators/accelerators or Instruction Set Simulators (ISS) . However, no rigorous formal verification effort is performed at the post-RTL phase to ensure the validity of the SW-HW interactions.
Concluding Remarks
In this paper, we presented a formal HW/SW co-verification tool called . In a typical HW/SW co-design, the software only exercises a fragment of the HW state-space. This renders many interactions between HW and SW modules infeasible. Our general observation is that the bounded model checking technique in cannot prune irrelevant logic, and hence generates formulas that are extremely difficult to solve with a SAT/SMT solver. In contrast, the path-based exploration strategy in is able to automatically prune design logic with respect to a given configuration (scenario), owing to domain-specific optimizations such as eager path pruning combined with incremental SAT solving and property-guided slicing. Our experiments show that is on average $`5\times`$ faster than for proving safety as well as for finding critical bugs. In the future, we plan to extend to support HW/SW co-designs that exhibit further interaction patterns as well as implement efficient domain-specific path-merging techniques.