Masters thesis on Approaches to formal verification of analog and mixed signal designs presented in June 2016 at International Institute of Information Technology, Bangalore (IIITB).

1. APPROACHES TO FORMAL
VERIFICATION OF
ANALOG AND MIXED SIGNAL
DESIGNS
Ambuj Mishra
MS2013002
Supervisor- Prof. Subir K. Roy

2. Content
•Introduction & Motivation
•Brief description of Tools involved in this work
•Formal Verification of AMS Designs using SPICE Simulation Traces
•Formal Verification of Adaptive Cruise Controller
•Formal Verification of Switched Capacitor DC to DC Power Converter
•Formal Verification of Sample and Hold Circuit
•Contributions and Future Work
•Publications
•References
•Appendix

3. Introduction & Motivation

4. •AMS blocks in SoC required at the
interface with the real world
environment.
•The complexity of AMS systems
has risen to such an extent that
verifying them through traditional
methods of Simulation and testing
is becoming increasingly
inefficient, ineffective and
unreliable in being able to ensure
safety critical and fail safe
behaviour in such systems.

5. Formal Verification of AMS Designs as Hybrid Systems
•Formal Verification is the process of proving or disproving the correctness
of a system against certain formal specification or property.
•AMS designs can be modeled as hybrid systems.
•Many tools that have been proposed over the years for verifying hybrid
systems. Each tool is based on different assumptions and notions of
hybrid automata, which makes it very difficult to compare them. Some of
these tools are PHAVer [1], CheckMate [2], C2E2 [3], and SpaceEx [4].

6. Mathematical
model
Analysis &
Verification
Continuous-time
Behaviour
Specifications
differential
equations
Discrete
Events
automat
a
• Currently available hybrid system tools do not support modeling of
system of equations common in AMS circuits and systems.
• To circumvent the problem of employing an abstract model of an AMS
design to carry out formal analysis in hybrid system tools, a method
based on using the exact model in the form of a SPICE netlist of the
AMS design has been proposed in [8] discussed in later sections of the
presentation.
Hybrid
System

7. Brief description of Tools
involved in this work

8. CheckMate
•Developed by CMU. Input
language is a subset of the Matlab
based Simulink-State-Flow (SSF)
modeling platform for hybrid
systems widely used in the
industry. CheckMate works on
Threshold Event Driven Hybrid
Systems (TEDHS) [2]

9. SpaceEx
• SpaceEx is another recent platform for
modeling hybrid systems with a view to
verifying them formally by computing
the set of reachable states from the state
transition graph model of the hybrid
system.
• It has features to act as a development
platform for implementing, exploring
and developing newer formal verification
algorithms, besides being scalable to the
order of being able to analyse large
hybrid systems with hundreds of state
variables. [4]

10. C2E2
•Compare Execute Check Enginer (C2E2) is a tool for verifying bounded-time
invariant properties of stateflow models. It supports models with nonlinear
dynamics, discrete transitions, and sets of initial states. The invariant
properties have to be specified by conjunctions of linear inequalities. [3]

11. Formal Verification of AMS Designs using
SPICE Simulation Traces
•The approach proposed in [8] employs simulation traces obtained from
actual design implementations of AMS circuit blocks to carry out formal
analysis and verification in CheckMate. This approach utilizes the simulation
traces generated from the implementation model in the SPICE circuit
simulator, and the thresholds on the design parameter and circuit state
variables in the formal verification environment of CheckMate.
•The system dynamics for different input constraints are instead obtained by
running the exact model in a circuit simulator such as SPICE.
•In this work, this approach is employed to verify AMS designs.

12. Formal Verification of Adaptive Cruise
Controller

13. Adaptive Cruise Controller Modeling
➢ACC : automated
highway speed
control and
monitoring system
➢Behaviour : HALT,
ACCELERATE,
CRUISE and RETARD
states.

14. First Attempt : Simplified Situation

15. SpaceEx Model for Simplified Situation

16. Results : Success Case
• The most general case
• Constants acceleration a=
1m/s2
;
Retardation r= -1.12m/s2
• Initial conditions x=
-3000m; v=0 m/s

17. Results : Failure Case
•Constants acceleration
a= 1m/s2
;
Retardation r= -1.12m/s2
•Initial conditions
x= -400m; v=35 m/s

18. •Initial Continuous Set (ICS)
-2000<=x<=-1000 and
10<=v<=20
•Constants acceleration a=
1m/s2
;
Retardation r= -1.12m/s2
Results with ICS : Success Case
IC
S

19. •ICS -2000<=x<=-400
and 0<=v<=35
•Constants acceleration
a= 1m/s2
;
Retardation
r= -1.12m/s2
Results with ICS : Failure Case
IC
S
Undesired
Trajectories
Part of ICS Causing the undesired
trajectories

20. Second Attempt : Complex (Full)
Situation

21. SpaceEx Model for Complex(Full) Situation
x & v values
from the
leading
vehicle are
given fed
as input to
the trailing
vehicle.

22. Limitations found in SpaceEx
•SpaceEx couldn’t analyse for many individual points in ICS as
well as entire ICS. We report our results and the analysis
based on these completed trajectories.
•the derivatives of x and v cannot be defined in both template
for leading vehicle and trailing vehicle. The composition
operator in SpaceEx merges these in a way that the result
corresponds to neither dynamics.
For the full case semantics

23. Results- Corner Case
Resulting in Failure
The failure
Case:
Leading Vehicle
x=-1500m,
v=10m/s,
Trailing Vehicle:
x1=-1600m,
v1=50m/s
Leading vehicle velocity
(v) vs distance (x) graph

24. Trailing vehicle velocity
(v1) vs distance (x1)
graph
The failure
Case:
Leading Vehicle
x=-1500m,
v=10m/s,
Trailing Vehicle:
x1=-1600m,
v1=50m/s
Results- Corner Case
Resulting in Failure

25. It shows the distance of the
leading (x) vehicle with respect
to the wall versus the distance
of the trailing (x1) vehicle with
respect to the wall.
Results- Corner Case
Resulting in Failure
Negative x-x1
region
x-x1 becomes negative after
some time elapse.

26. Formal Verification of Switched Capacitor DC to DC
Power Converter

27. Architecture of the SC DC to DC power
converter

28. Challenges in Formally Modeling of DC/DC power
Converter using SpaceEx, C2E2 or CheckMate
• DC to DC power converter using switched capacitor network involves multiple
nonlinear elements in any of its configuration, which makes the branch currents
and voltage relationships be non-linear. Tools such as SpaceEx, CheckMate, or
C2E2 do not support modeling of non-linear elements.
• To circumvent this problem of modeling complex dynamic behaviour, we can use
exact simulation traces from the SPICE model. None of the tools allow
incorporating simulation traces directly. However, using the method given in [8],
we can we can use exact simulation traces from the SPICE model in CheckMate.
• In order to do the same, we first need to prove the convexity of the SC DC to DC
Power Converter Circuit to enable formal analysis for reachability in CheckMate
with respect to the flow-pipes associated with the dynamic behaviour.

29. Changes Made in CheckMate Implementations [8] (to
introduce SPICE Simulation traces)
• While running verify script in the original Checkmate, user needs to define the
continuous dynamics of the system in terms of differential equations and then the
verify script takes these differential equations to call the MATLAB inbuilt ODE
solver. There after these solutions are used for the formal analysis in Checkmate.
• However, since CheckMate does not support modeling of system of differential
equations typically obtained to satisfy KCL and KVL of an AMS circuit, we get the
actual dynamics of the AMS circuit from its actual implementation model in
Cadence Spectre Circuit Simulator. These outputs from the simulator are used for
formal analysis in Checkmate and for running the verify routine.

30. Proof of Convexity

31. Verification of SC DC TO DC Power Converter using
CheckMate
Threshold Event Driven hybrid system model
for SC DC to DC Converter in CheckMate
State Transition Diagram for SC DC
to DC Converter

32. •Converter Property Specification: Since our target output voltage is 1V, that
property that needs to be satisfied by the converter is that whether its output
voltage (v out) lies within the band specified by the interval [0.9V, 1.1V].
•The Initial Continuous Set (ICS) and the Analysis Region(AR) of the power
converter circuit are considered to be the same as we are allowing the initial
condition to take any value from the entire AR, this being, 0.8<= vin<= 2.4 and
0.9<=vout<=1.1, respectively.
•On running verify command in CheckMate, it was found that the system never
enters the Avoid state. However, on further tightening the band to [0.9 V,1 V],
reachability analysis by CheckMate on the quotient transition system of the
unaltered SC DC to DC Converter, results in the Avoid state being reached,
thereby signifying that the property corresponding to this tightened band fails
that output voltage goes beyond 1 V or falls below 0.9 V.

33. Formal Verification of Sample and Hold Circuit

34. Sample and Hold Circuit
Folded Cascode OP-Amp
used in Sample and Hold
Circuit

35. SpaceEx
Modeling
SpaceEx Model for Sample and Hold Circuit
Input Voltage of the SpaceEx Model for
Sample and Hold Circuit

36. Hold Capacitor Voltage for SpaceEx
Model for Sample and Hold Circuit
Output Voltage of SpaceEx Model
for Sample and Hold Circuit

37. Proof of Convexity
Convexity Validation bottom and left side of ICS polytope

38. Verification of Sample and Hold Circuit
•Specifications
-Upper bound on the difference between the input and the
sampled value0(.15 V)
-Upper bound on the settling time of the output(2.10 µs)

39. 1. Upper bound on the difference between the input and the
sampled value0(.15 V) (shown for point 1)
Voltage
values
Number line

40. Upper bound on the settling time of the output(2.10 µs)
(for sample voltage 240 mV )

41. Contributions and Future Work

42. Contributions
•A comparative analysis of the latest Hybrid system modeling and
verification tools, such as, SpaceEx, CheckMate and C2E2 .
•Proposal for a new Hybrid System Model of an Adaptive Cruise Controller
(ACC) System and its formal verification using the SpaceEx Verification
Platform.
•Proposal for a new Hybrid System Model for Switched Capacitor based DC
to DC Power Converter and its formal verification in CheckMate using its
SPICE simulation traces.
•Proposal for a new Hybrid System Model in SpaceEx for the Sample and
Hold Circuit and its formal verification in the SpaceEx Verification Platform.
•Formal verification of the Sample and Hold circuit using its simulation traces
obtained from its actual design implementation model in the Cadence
Spectre circuit simulator.

43. Tabular summary of tools explored

44. Future Work
• SpaceEx Verification tool while being scalable, currently, can only deal with linear
dynamics. It needs to be enhanced to support non-linear dynamics commonly
present in AMS designs in order to increase its potential to be able to work with
more complex AMS designs.
• While C2E2 can handle non-linear dynamics, the need to manually compute or
specify the discrepancy function renders its application to the verification of AMS
designs almost impossible. The computation of the discrepancy function should
be done automatically and on the fly for any AMS design. This feature has been
recently introduced only for hybrid system models. It needs to be tried out in the
context of the AMS designs verified in the thesis.
• All the three tools are designed to work well on a single hybrid automata to model
any hybrid system. However, complex hybrid systems and complex AMS designs
need support for better and simpler models to capture the system component
hierarchy towards handling complexity. It will be possible if these tools can
support interacting and communicating hybrid automata frameworks towards
this. This is a very valuable direction of research to take forward the application of
formal verification for AMS designs.

45. Publications
• Ambuj Mishra and Subir K Roy. Towards Formal Verification of Adaptive Cruise Controller
using SpaceEx, VLSI Systems Architecture, Technology and Applications Conference
(SATA) Jan 2016, Bangalore, India.(Accepted and to appear in proceedings of VLSI-SATA
2016)
• Ambuj Mishra and Subir K Roy. Formal Verification of Switched Capacitor DC to DC
Power Converter Using Circuit Simulation Traces, 20th International Symposium on VLSI
Design and Test (VDAT) 2016, Guwahati, India. (Accepted and to appear in proceedings of
VDAT-2016)
• Ambuj Mishra and Subir K Roy. Formal Verification of Sample and Hold Circuit. (in
preparation)

46. References
1. Goran Frehse. Phaver: Algorithmic verification of hybrid systems past hytech. In Hybrid Systems: Computation and
Control, pages 258–273. Springer, 2005.
2. B Izaias Silva, Keith Richeson, Bruce Krogh, and Alongkrit Chutinan. Modeling and verifying hybrid dynamic systems
using checkmate. In Proceedings of 4th
International Conference on Automation of Mixed Processes, volume 4, pages
1–7. Citeseer, 2000
3. Parasara Sridhar Duggirala, Sayan Mitra, Mahesh Viswanathan, and Matthew Potok. C2e2: a verification tool for
stateflow models. In Tools and Algorithms for the Construction and Analysis of Systems, pages 68–82. Springer, 2015.
4. Goran Frehse. An introduction to spaceex v0. 8. http://spaceex.imag.
fr/documentation/user-documentation/introduction-spaceex-27, 12 2010. Verimag, Accessed: 2016-03-23.
5. Rajeev Alur and David L Dill. A theory of timed automata. Theoretical computer science, 126(2):183–235, 1994.
6. Rajeev Alur and Erdinc Altug. Linear hybrid automata. 2000.
7. Alongkrit Chutinan and Bruce H Krogh. Verification of polyhedral-invariant hybrid automata using polygonal flow pipe
approximations. In Hybrid Systems: Computation and Control, pages 76–90. Springer, 1999.
8. Kusum Lata, Subir K Roy, and HS Jamadagni. Towards formal verification of analog mixed signal designs using spice
circuit simulation traces. In Quality Electronic Design, 2009. ASQED 2009. 1st Asia Symposium on, pages 162–172. IEEE,
2009.

47. Appendix
Responses to the Examiners’ Comments
Examiner 1
Question - In this thesis figure numbers are given as FC... . Is there any specific reason for this?
Response - This comes from the standard format given by the IIIT-Bangalore.
Chapter 1
Question 1
On page 3 it is mentioned that
"Although the cost of formal verification is more than that of test, it remains...“
The terms in the cost are not included, is it the complexity, computer or monetary. This has also been mentioned
while discussing automated methods (Page 4), thus needs little more explanation.
Response
Since the context is of automated methods, it is its computation costs that increases which may involve more
computing power, human intervention and hence monetary cost also goes up. It has been edited in the thesis.

48. Chapter 2
Question 1
On page 21 Following sentence is written. "Transitions give the guard condition which needs to be satisfied for
transition from one state to the other." Does this mean that every transition is giving guard conditions which need to
be satisfied for "Next" transition? Is it not that for every state there will be guard condition independent of transition
from where it had come?
Response
As mentioned in Chapter 1: Invariants decide the boundary for their corresponding location, i.e. the conditions
specified by the invariants should be met for the system to remain inside the corresponding location. Transitions take
place when guard conditions are satisfied. Transitions model the discrete jumps within a hybrid system. Invariants and
guards are generally specified using inequalities (linear and non-linear).
Question 2
In the description of C2E2 system, it is written that the model is transformed and compiled with numerical library. Is
this numerical simulator solving the differential equations? What transformation is done?
Response
C2E2 takes as input the stateflow model (.mdl) and then transforms it to hybrid automata in order to analyse it. Yes,
numerical simulator needs to solve differential equations and do many other computations for reachability analysis.

49. Question 3
The description about Checkmate is not clear although the reference is mentioned. Is it that the MATLAB is replaced
by Spectre in the new implementation? Or in other words is SCSB block is connected to MATLAB?
Response
All the blocks are modeled within MATLAB because CheckMate itself is a tool that works on top of MATLAB. As
mentioned in the description ODE45 solver invocations are replaced by Spectre simulation runs, which clearly points
out that the role played by ODE45 solver is now played by Spectre, as the results of Spectre simulations have been
used rather than that of the ODE45 solver. The SCSB block takes its input from the Spectre simulation traces.
Chapter 3
Question 1
The ACC model description reverse velocity is not mentioned. Is it that the v is vector quantity?
Response
Yes, v is a vector quantity. Motion of the vehicle is assumed to take place along a straight line as shown in the figure.
We also assume that the ACC model is applicable to the trailing vehicle for collision avoidance. The leading vehicle
ACC model can be a similar model which is independent of the model used by the trailing vehicle. The trailing vehicle
either moves in forward direction or stops. Under this assumption, the same trailing vehicle ACC model is applicable
even for the situation when where the trailing vehicle reverses. However, for the situation where both the vehicles are
moving in the reverse direction their roles will need to be swapped.

50. Question 2
ACC has been compared with TDO model which is not very clear. This comparison is farfetched. In software modeling
most of the terms will be variables and code but generally it does not mean all the systems in the world are similar.
Response
The comparison of ACC and TDO models is based on their mathematical model characteristics arising out of their
dynamic and discrete behaviours. From the perspective of modeling a hybrid system, modeling either the ACC system
or the TDO circuit are identical because their underlying modeling process is exactly the same and both have been
modeled as hybrid automata with both systems being characterised by flow equations giving the invariants and guard
conditions allowing for discrete transitions to different locations.
Question 3
Please note that most of the figures in this chapter are of poor quality and some of them are not legible. This may be
due to pdf conversion also but I guess some attention need to be given.
Response
We have used SpaceEx, tool which is still in its infancy and going through many improvements with time. SpaceEx
generated the analysis results and depicts them graphically using its internal routines. Unlike CheckMate the user is
not able to access the internal data generated for formal analysis directly and therefore good quality figures cannot be
generated through other Matlab routines or other open domain public tools. However, based on examiner’s
suggestion we have increased the figure sizes to make it more readable.

51. Question 4
In the SpaceEx Transition Graph for the proposed Model fifth state is introduced? is it because of simulator features
or the AAC model is altered here?
Response
ACC SpaceEx has the ability to choose the right location as an initial location to begin the analysis based on the initial
velocity used by the ACC model. For the corner case situation where the initial velocity is larger than the cruise
velocity we had to introduce the additional fifth state to facilitate this in SpaceEx. However, the two models are
exactly identical as far as the overall ACC model is concerned.
Question 5
It is mentioned that in Fig. 3.7 critical condition is shown. But as model describes to attain the retardation starts as
velocity is above v_cru. They why is this critical condition?
Response
The above mentioned situation becomes a critical case when the velocity of the vehicle in the retardation state does
not fall below v_cru before the separation between the trailing vehicle is 500m from the wall (or the stationary
vehicle) as then collision is unavoidable. The proposed ACC model can easily accommodate and predict behaviours of
vehicles starting below v_cru.

52. Question 6
The long form of "STC" need to be mentioned, it is not defined in abbreviations also.
Response
STC is one of the scenarios that can be used for analysis in SpaceEx. It is not an acronym but a name given by the
researcher as given in the reference [14].
Chapter 4
Question 1
The long form of "SC" need to be mentioned, it is not defined in abbreviations also but used in this chapter many
times.
Response
This has been updated in the list of abbreviations.
Question 2
In the Figure FC4.1: Architecture of the SC DC to DC power converter is shown in terms unconnected blocks. Do they
not interact with each other? Similarly figure FC4.6 is not clear.
Response
Yes, they do interact with each other, which is pointed out in the description of the circuit. Reference has also been
given for the same.
Figure FC4.6 is control network of switches. It is used to control the switched capacitor network for switching on and
off certain current flow paths. For more details, reference for the circuit can be used.

53. Question 3
Please note that most of the figures in this chapter are of poor quality and some of them are not legible as in earlier
chapter. In most of the figures, axes of the figures are not labelled. This makes these figures difficult to read.
Response
Based on Examiner's suggestion changes have been made in the figures.
Question 4
Was the analysis performed with different values of loads? It appears that the load was taken as 1MOhm, which is a
light load.
Response
The purpose of the circuit is to use the concept of switched capacitor network in order to get dc-dc conversion. For
more details about the circuit itself reference has been given.
For our verification purpose, we used the given circuit itself. Our task was to verify whether the circuit does what is it
expected to do.

54. Chapter 5
Question 1
Reference 28 is incomplete which is major input to this chapter.
Response
Reference 28 is an unpublished work from within IIIT Bangalore. For more details on that the authors and the institute
both have been mentioned. If required they can easily be contacted for more details.
Question 2
Please see the comment about the figures above, which seems to be true for this chapter also.
Response
Based on Examiner's suggestion changes have been made in the figures.
Question 3
Figure FC5.1 is not clear, which is the input to the circuit and which is the output node?
Response
It shows the differential circuit; the left two nodes are the input nodes and the op-amp outputs on the right side are
the output node.

55. Question 4
In the description of model it is written that C=1us. This needs correction.
Response
It has been corrected.
Question 5
Output voltage in SpacEx model is 100 mV less than hold capacitor voltage. It is not very clear from the
discussions why this difference is there. This is not happening in the next example.
Response
The input waveform is triangular and capacitor voltage follows this input during the sampling period. However,
the capacitor can have an initial charge across it from the previous sampling period. This causes either a charging
or discharging across the sampling capacitor depending upon whether the new sampled value of the input is
higher or lower during the sampling period. As can be seen from the new sampled value the input voltage is 0.4V,
but the previous sampled value across the capacitor is 0.5V and therefore during the sampling period the voltage
across the capacitor reduces to 0.4V and this is also the value once the hold period starts.
Question 6
What was the motivation to choose the pulse with height 0.39V?
Response
Because it is one of the held outputs. It could have been any of the held outputs.

56. Question 7
Figures 9 and 12 and 10 and 13 could have been plotted together to show the contrast.
Response
These figures have been plotted with respect to the context of our analysis approaches being discussed in the chapter.
SpaceEx figures are featured in the context of SpaceEx discussions, while the circuit simulator figures are presented in
the context of discussions related to simulation results.
Question 8
To prove the convexity very small value of capacitor is taken? Is there any specific reason for this?
Response
All circuit element values that are used in the verification are those given by the designers of the various circuits. We
have not used any other values to present the analysis results as the task was to verify the circuit functionality of
whatever has been given by the AMS designers.
Question 9
This chapter ends very abruptly. I think few lines with concluding remarks is necessary.
Response
The chapter ending has been modified based on the examiners suggestion

57. Examiner 2
Question
State Transition diagram for DC to DC Converter should be added.
Response
State transition diagram is given in figure FC4.14.
Question
It would be good if author can add a tabular summary of tools with reference to different metrics.
Response
Table has been included in the 6th chapter. TC6.1
Question
Some of the figures need to be updated with more readable ones.
Response
Based on Examiner's suggestion changes have been made in the figures.
Examiner 3
No modifications were suggested and no clarifications requested.