Automated Generation of Directed Tests

Abstract

Increasing complexity combined with decreasing time-to-market requirement make the functional validation a major bottleneck in the HW/SW design flow. As a most widely used validation method, simulation employs tests in the following three categories: random, constrained-random tests, and directed tests. Random and constrained-random testing [1] are easy to implement; nevertheless, it is hard to guarantee the convergence to the testing target (i.e., functional coverage). In contrast, directed testing [2] uses fewer tests to obtain the required functional coverage since it exploits the design structure information. By applying the directed tests, the validation effort can be drastically reduced. However, most directed test generation methods assume the expert knowledge of the design under validation (DUV). Due to the inevitable human intervention, current directed test generation methods are laborious and error-prone. Therefore, it is necessary to develop efficient techniques to automate the process of directed test generation.Model checking [3] is a formal method which can verify whether a temporal property is satisfied for a finite state concurrent system. In model checking, a design is modeled as a state transition graph, called a Kripke structure [3], which is a fourtuple model M = (S, S 0 , R, L). S is a finite set of states. S 0 is a set of initial states, where S 0 ⊆ S. R : S → S is a transition relation between states, where for every state s ∈ S, there is a state s ∈ S such that the state transition (s, s ) ∈ R. L : S → 2 AP is the labeling function to mark each state with a set of atomic propositions (AP) that hold in that state. Properties are expressed as linear temporal logic (LTL) and computational tree logic (CTL) formulas to describe expected design behaviors. For a formal model M of the design and a property p, the model checking is to find whether all states in S satisfy p or not. If there does not exist a reachable error state from initial states, the design satisfies the property, i.e., M |= p. Otherwise, the property does not hold for the design, and a variable assignment trace (counterexample) from an initial state to the error state will be reported. Such a trace can be used as a test to activate the scenario described by the negation of the checked property p.M. Chen et al., System-Level Validation,