Self - Consistency

We introduce the notion of self-consistency checking, a new methodology for applying formal methods in the debugging process. Intuitively , self-consistency checks functional consistency of a circuit in two diierent modes or environments. Self-consistency can (1) simplify property veriication and (2) enable the use of symbolic simulation in the absence of a concrete speciication. We present a correctness model for property veriication with self-consistency checking and the formal framework for the technique. Finally, we provide illustrative examples and partial veriication results using self-consistency checking on circuits with many thousands of latches. 1 Motivation As hardware designs become more complex, the cost of validation is becoming a larger fraction of the total design cost. Validation currently consumes a large fraction of design teams and requires massive simulation eeorts. In fact, one industry expert predicts that there will soon be two or three validation engineers for every design engineer on major microprocessor design projects Wil95]. Formal veriication has been suggested as a remedy for the increasing dii-culty of design validation. For a broad survey of this eld, the reader is referred to Gupta Gup92]. Formal veriication methods always check the consistency of two descriptions of behavior. For example, one description may be a state graph and the other a set of temporal logic properties. Most work in formal veriica-tion rests on the assumption that one description represents the implementation of the design, while the other is a requirements speciication, which captures the important correctness properties of the design (while usually disregarding eeciency and performance issues). Unfortunately, many interesting properties are not veriiable in practice. There are two main problems. The rst is that the system speciication is often incomplete or absent. In fact, our experience indicates that speciications are rarely written; when they are written, they are rarely precise; and when they are precise, they rapidly become obsolete as the design implementation