CPROVER Manual TOC

## Hardware and Software Equivalence and Co-Verification

### Synchronizing Inputs

#### Driving Primary Inputs

The examples in the tutorial are trivial in the sense that the model has only one possible trace. The initial state is deterministic, and there is only one possible transition, so the verification problem can be solved by testing a single run. In contrast, consider the following Verilog module:

    module top(input clk, input i);

      reg [3:0] counter;

      initial counter=0;

      always @(posedge clk)
        if(i)
          counter=counter+1;

    endmodule

The module above has an input named `i`. The top-level inputs of the Verilog design have to be generated by the C program. This is done by assigning the desired values to the corresponding struct member, and then calling the `set_inputs()` function before calling `next_timeframe()`. Consider the following example:

    void next_timeframe();
    void set_inputs();
    extern const unsigned int bound;

    struct module_top {
      unsigned int counter;
      _Bool i;
    };

    extern struct module_top top;

    int main() {
      assert(top.counter==0);

      top.i=1;
      set_inputs(); next_timeframe();
      assert(top.counter==1);

      top.i=1;
      set_inputs(); next_timeframe();
      assert(top.counter==2);

      top.i=0;
      set_inputs(); next_timeframe();
      assert(top.counter==2);
    }

As an example, consider a Verilog module that has a signal `reset` as an input, which is active-low. The following C fragment drives this input to be active in the first cycle, and not active in any subsequent cycle:

      top.resetn=0;
      set_inputs(); next_timeframe();

      for(i=1; i<bound; i++) {
        top.resetn=1;
        set_inputs(); next_timeframe();
      }

Note that the value of the input must be set before calling `next_timeframe()`. The effect of the input values on values derived in a combinatorial way is immediately visible. The effect on clocked values becomes visible in the next time frame.

#### Using Nondeterminism

The examples above use particular, constant values to drive the primary inputs. In order to check the behavior of the Verilog model for more than one specific input, use nondeterminism.