Wu’s Characteristic Set Method for SystemVerilog Assertions Verification

We propose a verification solution based on characteristic set of Wu’s method towards SystemVerilog assertion checking over digital


Introduction
Currently, functional verification becomes an intensive challenge phase in the state-of-the-art digital systems development process. Assertion-based verification (ABV) has emerged as a promising solution to express and verify design properties.
SystemVerilog [1][2][3], the industry's first unified hardware description and verification language (HDVL), was developed originally by Accellera and can be viewed as an extension of the Verilog language with the added benefit of supporting object orientated constructs and assertions.
SystemVerilog was adopted as IEEE Standard 1800-2005 firstly in 2005, and the latest version is IEEE standard 1800-2009, the current version. SystemVerilog has been accepted by a wide variety of companies and has been supported by most EDA companies in their tools in practice which has totally changed the way designers specify and verify functional requirements and properties of digital systems.
Many efforts have been devoted to assertion checking solvers in recent years including model checking [4], theorem proving [5], and other simulation-based checking methods. In [6], an efficient approach to model check safety properties expressed in assertion property is studied. Proving SVA safety properties using induction-based BMC is studied in [7]. All these methods can be classified into two categories: formal and informal aspects.
On the one hand, formal method such as model checking often suffers from "state explosion" problem and cannot be applied to large scale cases. Model checking of SVAs is PSPACE complete even for a "simple subset. " If more elaborated features, like intersection of regular expressions or instantiation of properties, are used, the problem becomes EXPSPACE complete.
On the other hand, informal methods such as conventional simulation for assertion checking is a well-understood and most commonly used technique, but only feasible for very small scale systems and cannot provide exhaustive checking.
A promising semiformal technique, symbolic simulation, proposed by Darringer [8] as early as 1979, can provide exhaustive checking by covering many conditions with a single simulation sequence.
In our work, to address the challenge, we propose an alternative implementation mechanism based on Wu's characteristic set by combining symbolic computation with 2 Journal of Applied Mathematics symbolic simulation for assertions checking. This paper aims to verify whether an expected SVA property holds or not on the finite traces produced after several cycles running over a given sequential circuit.
The underlying idea is that, for any combinational circuit model, we can derive its data flow based on polynomial representation model. Meanwhile, for any sequential circuit model and a given running cycle number, we can also derive its polynomial representation by unrolling this sequential circuit for several times into a pure combinational model. In a similar way, we can get polynomial set representation model of a temporal assertion written in SVA.
By suitable restrictions of SVA and defining a constrained subset of SVA, we can get the polynomial set representations of the subset. Based on the polynomial set model, cycle-based symbolic simulation can be performed to produce symbolic traces. We then apply Wu's method symbolic algebra approach to check the zeros set relation between their polynomial representations and determine whether the expected assertion holds or not at current running cycle.
The rest of this paper is structured as follows. Preliminary knowledge with regarding to SystemVerilog used throughout this paper is introduced in Section 2. Section 3 introduces polynomial representation modeling for synchronous digital systems. Section 4 describes the cycle-based model and sequential unrolling. Section 5 will discuss sequential assertions modeling with polynomials. In Section 6, we will propose a complete verification algorithm framework based on Wu's characteristic set. Section 7 will demonstrate an example using MMP tool based on our method. In the last section, we make a short summary of our research and discuss the future work.

SystemVerilog Preliminary
In this section, we will give some preliminary knowledge which may be used in later sections of the paper.
SystemVerilog, as an IEEE approved hardware description language, has combined many of the best features of both VHDL and Verilog and provided superior capabilities for system architecture, design, and verification.
Therefore, on the one hand, VHDL users will recognize many of the SystemVerilog constructs, such as enumerated types, records, and multidimensional arrays.
On the other hand, Verilog users can reuse existing designs: SystemVerilog is a superset of Verilog so no modification of existing Verilog code is required.
SystemVerilog provides special language constructs and assertions [9,10], to verify design behavior. An assertion is a statement that a specific condition, or sequence of conditions, in a design is true. If the condition or sequence is not true, the assertion statement will generate an error message.
One important capability of SystemVerilog is the ability to define assertions outside of the Verilog modules and then bind them to a specific module or module instance. This feature allows test engineers to add assertions to existing Verilog models, without having to change the model in any way. One of the goals of SystemVerilog assertions is to provide a common semantic meaning for assertions so that they can be used to drive various design and verification tools.
In SystemVerilog, there are two types of assertions: immediate assertions and concurrent assertions.
Immediate assertions are primarily intended to be used with simulation and evaluate using simulation event-based semantics. While concurrent assertions are based on clock semantics and use sampled values of variables.
Concurrent assertions can be used in always block or initial block as a statement, a module as a concurrent block, an interface block as a concurrent block, a program block as a concurrent block.
An example of a property using sequence and formal argument is demonstrated as the following.
The property states that if holds then local variable V gets assigned the value of . Then within 3 to 5 cycles later, is TRUE and should be equal to the contents of the saved local variable V . The property fails if is FALSE or if it follows a successful ; the expression " && == V " fails to be TRUE within the range from 3 to 5 cycles after . As shown in this example, a concurrent assertion property in SystemVerilog will never be evaluated by itself except it is invoked by a verification statement. Therefore, only the statement assert property ( , , , ) can cause the checker to perform assertion checking.
The verification statement in SVA has three forms: assert, assume, and cover. In this paper, only assume and assert are involved: the statement assert to specify the property as a checker to ensure that the property holds for the design; the statement assume to specify the property as an assumption for the environment. The purpose of the assume statement is to allow properties to be considered as assumptions for formal analysis as well as for dynamic simulation tools.
Basically, SVA has four language layers: Boolean, sequence, property, and statement.
(1) Boolean layer. The boolean layer consists of boolean expressions in which each variable referenced is either a design variable or a local variable of the assertion.
(2) Sequence layer. The sequence layer consists of regular expressions over the boolean layer.
(3) Property layer. The property layer combines sequences to create temporal logic formulas.
(4) Statement layer. The statement layer defines whether a property is to be evaluated as an obligation, an assumption, or a coverage goal.
Moreover, SVA provides local variables as one of its distinguishing features. A local variable is used to capture the value of an expression at one point within a property and hold it for later reference, after which the local variable may be reassigned. We will provide an efficient way to handle this feature in later section of this paper.

Synchronous Digital System and Its Polynomial Representation
In this section, we will discuss polynomial set expressions for elementary units of combinational and sequential circuits. We mainly focus on the register transfer level (RTL) description of the circuit systems. Previous work [11,12] has shown that any combinational circuit can be uniquely represented by a minimum order polynomial.
Here, we give an alternative dataflow-based polynomial set representation model for our assertions checking purpose whose zero set can make such a data-flow model work well.

Combinational Logic Modeling.
In this paper, we only focus on arithmetic unit for calculating fixed-point operations. For any arithmetic unit, integer arithmetic operations (addition, subtraction, multiplication, and division) and basic logical operations, like "AND", "OR", and "NOT", can be modeled by the following polynomial forms in Table 1.
We will then discuss another important control structure in digital system, multiplexer, which can be used to join many small datapaths together to make bigger datapaths.
Basically, multiplexer provides a set of condition bits, (0 ≤ ≤ ), a set of target identifiers, (0, . . . , − 1), and a mapping from condition bit values to target identifiers. This mapping takes the form of a condition tree: Note that for any bit-level variable (0 ≤ ≤ ), a limitation { * − } should be added for each.

Sequential Unit Modeling.
In sequential circuits, flipflops (FF) and latches are fundamental building blocks which are used as data storage elements. In this paper, we will reduce all sequential units to a simple unified model described below.
The flip-flop can be equivalently modeled as a multiplexer. We have the following proposition to state this model. Proof. Let be the current state and denote the next state of the flip-flop. When the signal is 0, has the same value as so that the FF maintains its present state; when the signal

Cycle-Based Simulation and Sequential Unrolling
In this section, we will sketch the underlying system model for symbolic simulation used in our work. Basically, symbolic simulation takes in variables ( 1 , 2 , . . . , ), as shown in Figure 1, called free variables, as input and produces output expressions in terms of the variables ( 1 , 2 , . . . , ). The free variable can be either bit-level, integer, or constant 0 and 1. The symbolic simulator simulates simultaneously the entire set of the points that the input variables can take on.
Cycle-based symbolical simulation of a circuit for cycles can be regarded as unrolling the circuit times. The unrolled circuit is a pure combinational one, and the th copy of the circuit represents the circuit at cycle . Thus, the unrolled circuit contains all the symbolic results for cycles.
The simulation process can be described as follows. Firstly, cycle-based symbolical simulation is initialized by setting the state of the circuit to the initial vector. Each of the primary input signals will be assigned a distinct symbolic variable or a symbolic constant. Then, at the end of a simulation step, the expressions representing the next-state functions generally undergo a transformation-based optimization. Afterwards the newly generated functions are used as present state for the next state of simulation. Generally, for a sequential circuit, one time frame of a sequential circuit is viewed as a combinational circuit in which each flip-flop will be converted into two corresponding signals: a pseudo primary input (PPI) and a pseudo primary output (PPO). Time-frame expansion is achieved by connecting the PPIs of the current time frame to the corresponding PPOs of the previous time frame.

SVA Expressions with Polynomial Set
In this section, we will discuss concurrent assertions and their temporal layer representation models.
As mentioned previously, concurrent assertions express functional design intent and can be used to express assumed input behavior, expected output behavior, and forbidden behavior. That is, assertions define properties that the design must meet. Many properties can be expressed strictly from variables available in the design, while properties are often constructed out of sequential behaviors.
We begin with the introduction of polynomial notions for various layers modeling.

Polynomial Notions and Algebraization.
For clarity, we introduce the following symbolic notions for algebraic representation used in the rest of this paper.
(2) If a running cycle is given, its algebraic representation form can be denoted by ⟦ ⟧ [ ] .
(3) Furthermore, if a time range [ ⋅ ⋅ ⋅ ] is specified, its algebraic representation form can then be denoted by Note that more detailed description of time range will be discussed in next subsection. For a given sequential circuit, to illustrate the sequential modeling for a given cycle number clearly, we will define the following indexed polynomial representation model for the th cycle by using the above notions. In the following, we will discuss Boolean layer modeling based on above polynomial notions.
The Boolean layer of SVA forms an underlying basis for the whole assertion architecture which consists of Boolean expressions that hold or do not hold at a given cycle.
In SVA, the following are valid Boolean expressions: The state of a signal variable in current cycle will be viewed as a zero of a set of polynomials. We have the zero set building rules.
ZS-1 : for any signal which holds at a given timeframe , thus, the state of == 1 ( is active high at cycle ) can be represented by polynomial ZS-2 : alternatively, the state of == 0 ( is active low at time-frame ) can be represented by polynomial

ZS-3 :
For any signal and , we have: Where and are time frames.

Time Range and Its Unrolled
Model. We will then discuss the important feature of SVA, time range, and its signal constraint unrolled model.
In SVA, for each sequence the earliest time step for the evaluation and the latest time step should be determined firstly. The sequence is then unrolled based on above information. Finally, the unrolled sequence will be modeled with polynomial set.
In [7], a time range calculating algorithm is provided. Here, we will introduce some related definition and special handling for algebraization purpose. The syntax of "time range" can be described as follows: Note that is computed at compiling time, must result in an integer value, and can only be 0 or greater.
In this paper, we only focus on constant time range case. Thus, its form can be simplified as where, , are signals and 1 , 2 are sequences.
Let := " ##[ : ] " ( , ∈ N and ≥ ≥ 0) be a sequence; we will demonstrate how to equivalently derive its polynomial representation step by step through this example.
Assume the starting time frame is ; then: the sequence will start ( − + 1) sequences of evaluation which are respectively. ( Correspondingly, we can derive their algebraic forms as follows: Then we have the equivalent form of above representation set as Finally, we can have their polynomial set forms by following the zero set building rules discussed previously:

Sequential Depth Calculation.
The time range of a sequential is a time interval during which an operation or a terminal of a sequence has to be considered and is denoted by a closed bounded set of positive integers: Furthermore, the maximum of two intervals 1 and 2 is defined by In the same manner, the sum of two time range, of 1 and Definition 5 (maximum sequential depth). The maximum sequential depth of a SVA expression or a sequence, written ( ), is defined recursively: ), if 1 , 2 are sequences of SVA; ), if 1 , 2 are sequences of SVA;

Sequence Operator
Modeling. Temporal assertions define not only the values of signals but also the relationship between signals over time. The sequences are the building blocks of temporal assertions and can express a set of linear behavior lasting one or more cycles. These sequences are usually used to specify and verify interface and bus protocols.
A sequence is a regular expression over the boolean expressions that concisely specifies a set of linear sequences. The Boolean expressions must be true at those specific clock ticks for the sequence to be true over time.
SystemVerilog provides several sequence composition operators to combine individual sequences in a variety of ways that enhance code writing and readability which can construct sequence expressions from Boolean expressions.
In this paper, throughout operator, [1 : $] operator, and the first match operator are not supported by our method.
In the following, we will discuss the algebraic representation of the supported sequence operators.
(1) cycle delay operator. In SystemVerilog, the ## construct is referred to as a cycle delay operator.
"##1" and "##0" are concatenation operators: the former is the classical regular expression concatenation; the latter is a variant with one-letter overlapping. The cycle delay in SVA has two basic forms.
(a) A "## " followed by a number specifies the cycles delay from the current clock cycle to the beginning of the sequence that follows.
(b) A "##[ ⋅ ⋅ ⋅ ]" followed by a rang [ ⋅ ⋅ ⋅ ] specifies the [ ⋅ ⋅ ⋅ ] cycles delay from the current clock cycle to the beginning of the sequence that follows.
It is easy to derive the algebraic representation forms for this operator by following the method discussed in Section 5.2.

Journal of Applied Mathematics
(2) intersect operator. The two operands of intersect operator are sequences. The requirements for match of the intersect operation are as follows: (a) both operands must match, (b) the lengths of the two matches of the operand sequences must be the same.
" 1 intersect 2 " denotes that 1 starts at the same time as 2 . The intersection will match if 1 , starting at the same time as 2 , matches at the same time as 2 matches.
The sequence length matching intersect operator constructs a sequence like the and nonlength matching operator, except that both sequences must complete in same cycle.
(3) and operator. This operation " 1 and 2 " states that 1 starts at the same time as 2 and the sequence expression matches with the later of 1 and 2 matching. This binary operator is used when both operands are expected to match, but the end times of the operand sequences can be different.
That is, " 1 and 2 " denotes that both 1 and 2 hold for the same number cycles. Then, the matches of " 1 and 2 " must satisfy the following: (a) the start point of the match of 1 must not be earlier than the start point of the match of 2 ; (b) the end point of the match of 1 must not be later than the end point of the match of 2 .
The sequence nonlength matching and operator constructs a sequence in which two sequences both hold at the current cycle regardless of whether they complete in the same cycle or in different cycles.
(4) or operator. The sequence or operator constructs a sequence in which one of two alternative sequences holds at the current cycle. Thus, the sequence "( ##1 ) or ( ##1 )" states that either sequence " , " or sequence " , " would satisfy the assertion.
(5) repetition operator. SystemVerilog allows the user to specify repetitions when defining sequences of Boolean expressions. The repetition counts can be specified as either a range of constants or a single constant expressions.
The syntax of repetition operator can be illustrated as the following: The number of iterations of a repetition can be specified by exact count. From above discussion, we have the following rules for polynomial set-based representation.
Rule 1. Assume that , 1 , and 2 are valid SVA sequences; the rules in Table 2 can be used to construct the corresponding polynomial set representations.

Local Variables
Representation. An important feature in SVA is that variables can be used in assertions which is highly useful in pipelined designs. These local variables are optional and local to properties. They can be initialized, assigned or reassigned a value, operated on, and compared to other expressions.
The dynamic creation of a variable and its assignment are achieved by using the local variable declaration in a sequence or property declaration and making an assignment in the sequence.
A simple example of property with a local variable is specified below: property ; Thus, local variables of a sequence (or property) may be set to a value, which can be computed from a parameter or other objects (e.g., arguments. constants, or objects visible by the sequence (or property)).
For the algebraization of SVA properties with local variables, in our method these local variables will be taken as common signal variables (symbolic constant) without any sequential information.
Thus, the polynomial set representation for property will be translated in the following form: 5.6. Property Operator Modeling. In SVA, a property that is a sequence evaluates to true if, and only if, there is a nonempty match of the sequence. Property expressions are built using sequences, other sublevel properties, and simple Boolean expressions via property connectives. In general, property expressions are built using sequences, other sublevel properties, and simple Boolean expressions.
(1) Implication operators. The SystemVerilog implication operator supports sequence implication and provides two forms of implication: overlapped using operator | −> and nonoverlapped using operator | =>, respectively.
The implication operator takes a sequence as its antecedent and a property as its consequent. For each successful match of the antecedent sequence, the consequence sequence is separately evaluated, beginning at the end point of the matched antecedent sequence. All matches of antecedent sequence require a match of the consequence sequence.
(2) NOT operator. "NOT " states that the evaluation of the property returns the opposite of the evaluation of the underlying .
(3) AND operator. " 1 AND 2 " states that the property evaluates to true if, and only if, both 1 and 2 evaluate to true.
(4) OR operator. " 1 OR 2 " states that the property evaluates to true if, and only if, at least one of 1 and 2 evaluates to true.
(5) IF-ELSE operator. This operator has two valid forms which are listed as follows. Rule 2. Assume that , 1 , and 2 are valid SVA properties, denotes a SVA sequence, and denotes the system model to be checked; the following transformation rules in Table 3 are used to construct the corresponding verification process, where ℎ ( , ) : {ture, false} is a selfdefined justification function which can take either polynomial sets or original models as input arguments and is used to determine wether a given holds or not with respect to a circuit model . Additionally, ¬, ∨, and ∧ are standard logical connectives.

Constrained Subset of SVAs.
SystemVerilog assertions formally define the syntax and grammar of an assertion language that can define design properties and constraints, including temporal (i.e., spread over several cycles) characteristics. The atoms of the SVA concurrent assertions are so called sequences. A sequence is a regular expression that describes the behavior of signals over time. A property of SVA is composed of sequences by property operators. As described in [13], the total set of SVA can be divided into 4 subgroups, namely, simple sequence expression (SSE), interval sequence expression (ISE), complex sequence expression (CSE), and unbounded sequence expression (USE). Here, in our method, only a subset of these groups can be supported.
Formally, we will give the following definition for this subset.
Definition 6 (constrained subset of SVA). The constrained subset of SVA supported by algebraic symbolic polynomial representation is defined recursively as the following: where denotes a Boolean expression and all Boolean operators are supported, ( 1 , 2 ) denotes a sequence, ( 1 , For sequence operators, unspecified upper bound time range and first-match operator are excluded from the constrained subset. Additionally, property operator disable iff will not be supported also.
In this paper, only a constrained subset of SVA language defined above can be supported by our method.
Firstly, we translate the properties described by the constrained subset of SVA into flat sequences according to the semantics of each supported operator. 8

Journal of Applied Mathematics
Secondly, the unrolled flat sequences will be added temporal constraints to form proportional formulas with logical connectives (∨, ∧, and ¬).
Finally, the resulted proportional formulas will be translated into equivalent finite polynomial set.
Then, the verification problem is reduced to proving zero set inclusion relationship which can be resolved by characteristic set-based algebraic approaches.

Characteristic Set Based Verification Principle and Algorithm
In this section, we will discuss the checking algorithm based on Wu's characteristic set. We first recall some fundamental knowledge in Wu's method.

Wu's Method Preliminary.
Wu's method [14,15] is an efficient algorithm for solving multivariate polynomial equations introduced by Wen-Tsun Wu. It also has succeeded in mechanical geometry theorem proving. For further details and elementary introduction, we refer the reader to [16]. Let = k[ 1 , . . . , ] denote the polynomial ring in variables 1 , 2 , . . . , with coefficient k, for every in the range {1, . . . , }, and k is an algebraically closed field.
In what follows, without loss of generality, we assume that the given variables ordering is fixed as Assume ∈ k[ 1 , . . . , ] and let ( , ) be the maximum degree of with respect to . Definition 7. Let ∈ ; the greatest variable V ∈ { 1 , . . . , } is called the main variable of such that ( , V) ̸ = 0, denoted by V ( ). The biggest index is called the class, denoted by ( ). If we assume as a univariate polynomial with V ( ) = , we can write = + , where = ( , ). In this case, and are, respectively, the initial and the main degree and are denoted by ( ) and ( ).
Definition 8 (pseudo division). For any two polynomials , ∈ , with ( ) = . There exist a nonnegative number and polynomials and , such that ( ) = + . Where is denoted by ( , , ). We denote the remainder on pseudo division (pseudo remainder) of by with respect to the variable by ( , , ).
Definition 9 (Wu's characteristic set). Let and be two polynomial system, and is a triangular set; a triangular set is called a characteristic set of if ∀ ∈ , ( , ) = 0.
Now we briefly outline the essential steps about Wu's method on geometry theorem proving [17].
If this final remainder 0 ≡ 0, we will say that the conclusion follows from the hypotheses { 1 , . . . , }.
As mentioned above, the characteristic set of a polynomial system is a special triangular form. We can use the characteristic set of hypotheses equations as the triangular form, denoted by ℎ ( 1 , . . . , ). Roughly speaking, the soul of Wu's method on theorem proving is to check whether the zero set of the expected consequent equations includes the zero set of hypotheses equations or not.
Our checking method is based on algebraic geometry that studies of geometric objects arising as the common zeros of collections of polynomials. The aim is to find polynomials whose zeros correspond to pairs of states in which the appropriate assignments are made.
Let ( ) and ( ) denote the zero set for circuit polynomial set and assertions polynomial set respectively. Let ⊨ denote that assertion holds under model .
We aim to attempt to determine whether assertion holds or not. Therefore, we have Theorem 11. Suppose that = [A ⇒ C] is a property, A is the precondition of C, and is a system model. Let and be the polynomial set representations for A and , respectively, constructed by previous mentioned rules.
is the polynomial set representation for C.
Our aim is to attempt to determine whether assertion holds or not. Thus, we have As mentioned previously, Wu's method can be used to determine the inclusion relationship of zero sets. Thus we have Let = ℎ ( ), which denotes the characteristic set of ; according to (15) and (16), we have This establishes the theorem.

Checking Algorithm.
From above discussion, we have the following core decision algorithm.

Case Study and Experiment
In this section, we will firstly study a simple circuit to show how the SVA properties are verified by polynomial representations and characteristic set computation-based approaches. We then show a scalable experiment with the classic synchronous arbiter circuit to evaluate the performance of our approach.

Circuit and Assertion Modeling.
As an example, consider the synchronous circuit in Figure 2, whose polynomial set can be constructed as follows: Throughout this paper, an internal variable name [ ] refers to the corresponding signal in the original circuit, and the subscript denotes the time-frame (or the th clock cycle). For convenient, variable (i.e., [ +1] ) denotes the next state of ( [ ] ) by omitting time-frame .
To illustrate the problem clearly, we define polynomial set representation [ ] for the th time frame as follows: Assume 8 cycles are needed to check; therefore, we then have the model representation: The circuit produces 3-phase nonoverlapping outputs, which can decode the overlapping outputs V 1 , V 2 , and V 3 to nonoverlapping outputs , , and as shown in Figure 3.
Assume the initial values of the registers , , and are all 0, they will be {1, 0, 0}, respectively, after 1 cycle running and {1, 1, 0} after 2 cycles. This property can be specified by the following SVA assertions: Afterward, we will demonstrate the verification process step by step.

Assertion
Checking Using MMP. We ran this example by using MMP [18] (Mathematics Mechanization Platform). MMP is a group of symbolic computation and automated theorem proving softwares based on Wu's Method. Before running, we manually translated all models into polynomials for this example.
In this paper, all experiments are conducted on a PC with an intel 2.40 GHz CPU (intel i5 M450) and 1024 MB of memory.
The example took about 0.07 seconds and 810 KB of memory when applying Wu's method in MMP environment. This case can be a fairly complete illustration of how the checking algorithm works.

Experiment with Classic Arbiter Circuit.
The synchronous arbiter circuit [19], depicted in Figure 4, is one of the most popular test cases of model checkers. We also test our approach with this circuit currently to illustrate the performance of our approach. The convert algorithm which can automatically translate the circuit netlist into polynomial set has been implemented in C++.
This arbiter circuit is used to grant access on each clock cycle to a single client among a number of clients contending for the use of common resources.
Here, we briefly explain how the arbiter works. For more detailed information regards to the arbiter, please refer to [19]. The basic part of the arbiter is the colored cell which is repeated times to form a round robin chain. Each cell has a request input (1 ≤ ≤ , here, denotes the number of client) and an acknowledge output . The grant output of cell is passed to cell and indicates that no clients of index less than or equal to are requesting. Hence a cell may assert its acknowledge output if its grant input is asserted. Each cell has a register which stores one when the token is present. The registers form a circular shift register which shifts up one place each clock cycle.
Each cell also has a register for waiting which is set to one when the request input is asserted and the token is present.
The register remains set while the request persists until the token returns. At this time the cell's override and acknowledge outputs are asserted. For clarity, we use the first subscript of a variable name which denotes the cell number and the second subscript which denotes the current time-frame in this example.
The corresponding polynomial set for each cell (0 ≤ ≤ − 1) and time-frame (1 ≤ ≤ ) can then be constructed as follows: Additionally, the chain relation between cells can be modeled as below: The desired properties of the arbiter circuits can be described as follows: (1) no two acknowledge outputs are asserted simultaneously, (2) every persistent request is eventually acknowledged,  ( . Note that the arbiter can handle the access of clients to a common resource. If a client asserts a request, the client will wait at most 2 clock cycles before it is served. Therefore, in our test, it is sufficient to verify the properties that the circuit is unrolled 2 time frames.
Evidently, these properties can be equivalently expressed in SVA codes. In [7], the authors have provided a detailed assertion description for the case that client number is 3.
In this example, we will follow their idea and explain how to translate them into algebraic polynomials as below: In this experiment, we also tested the circuit with an artificial error that an " " gate is replaced by an "OR" gate by mistake, as shown in Figure 4. We mainly demonstrate whether or not our method is able to find bugs. The corresponding polynomial set model can be updated by replacing Consequently, in our test with 3 cells, it took only 9.37 MB of memory and 10.5 seconds to find the result ̸ = 0 which means the circuit did not meet the required property. Then we concluded that there must be some design errors in the circuit.
More detailed experimental results concerning polynomials and variables for safety property verification of the circuit are listed in Figure 5.
7.4. Discussion. So far, several methodologies are developed to address the verification problem. In this section, we will discuss these methods by the arbiter example shown in Figure 4.
(1) In [19], a BDD-based model checking is proposed. The performance of this method is fairly promising. The size of the transition relation increases linearly as the number of cells. But the OBDD representing the set of states grows exponentially in the number of cells. The performance of BDD-based symbolic model checking procedure is plotted in Figure 6. For more detailed information about this test case, please refer to [19].
(2) Due to advances in SAT-solving techniques [20], SATbased bounded model checking (for short, BMC) can often handle much larger designs than BDDs. In [7], the authors presented a SAT-based BMC to verify the arbiter circuit. They found that the size of the instance for the safety property is proportional to the number of arbiter clients and the liveness property has quadratic size.
(3) In our method, the worst case complexity of our symbolic algebraic method checking is very high due to intermediate expression swell. As shown in Figure 5, the number of polynomials to be generated for liveness property checking has quadratic size of the number of cells as well as the number of variables. Currently, from the runtime consumed, the SAT solver still shows better performance than our method. Fortunately, a great deal of optimization techniques can be applied to improve the performance.
As an example, we will explain how to apply variable projection technique to optimize the calculating process. Assume the given circuit has been modeled as polynomial set and variable order list is (its projection for the zero set on ⊆ is denoted by ). We will firstly calculate the projection to eliminate the unnecessary elements: and then the zero set: V ( , ). Correspondingly, the performance will be improved greatly.

Conclusion
In this paper, we presented Wu's method-based verification approach for SVA properties checking. Our approach is based on polynomial models construction for both circuit models and SVA assertions. This method is to eventually translate a simulation-based verification problem into a pure algebraic zero set determination problem by a series of proposed steps, which can be performed on MMP environment. For synchronous sequential circuits, we adapted a parameterized polynomial set modeling method based on time-frame expansion. We also defined a constrained subset of SVAs which is powerful enough for practical purpose and proposed a practical algebraization method for each sequence and property operator of this subset. This method allows users to deal with more than one state and many input combinations every cycle due to symbolic simulation. The advantage comes directly from the fact that many vectors are simulated at once using symbolic value.
Basically, our approach may provide a useful supplement to existing methods based on OBDD or SAT and may also provide important theoretical insights by allowing the application of important results in symbolic computation to the assertion checking problems. We plan to extend the work presented in several directions.
(1) We plan to optimize the solver based on Wu's method. As we know, Wu's method-based mathematics mechanization platform is a powerful computation environment for general purpose. On the one hand, we will apply variables projection and other mathematics approaches to improve the effectiveness of this algorithm. On the other hand, we also plan to implement our core steps by using the programming language in MMP.
(2) In this paper, we only test some classic cases mentioned in previous papers to illustrated the feasibility of our method currently. In the future, we plan to test the benchmarks from ISCAS'89 and ISCAS'85 and other industrial examples to provide a comprehensive evaluation of our approach and compare to the state-of-the-art where circuits with several thousands of gates and dozens of input signals.
(3) In this paper, we only concentrated our attention on the basic assertion checking algorithm, but the other important features such as counterexample generation were not discussed. We will also work on those issues in the future.
Furthermore, in the field of symbolic computation, there is a rich collection of solutions to solving polynomials, methods for inclusion of zero sets, and so forth. We are interested in applying some of the useful results and methods to verification area.