CPROVER Manual TOC

## Hardware and Software Equivalence and Co-Verification

### Mapping Variables

#### Mapping Variables within the Module Hierarchy

Verilog modules are hierarchical. The `extern` declarations shown above only allow reading the values of signals and registers that are in the top module. In order to read values from sub-modules, CBMC uses structures.

As an example, consider the following Verilog file (hierarchy.v):

    module counter(input clk, input [7:0] increment);

      reg [7:0] counter;

      initial counter=0;

      always @(posedge clk)
        counter=counter+increment;

    endmodule

    module top(input clk);

      counter c1(clk, 1);
      counter c2(clk, 2);

    endmodule

The file has two modules: a top module and a counter module. The counter module is instantiated twice within the top module. A reference to the register `counter` within the C program would be ambiguous, as the two module instances have separate instances of the register. CBMC and SATABS use the following data structures for this example:

    void next_timeframe();
    extern const unsigned int bound;

    struct counter {
      unsigned char increment;
      unsigned char counter;
    };

    struct module_top {
      struct module_counter c1, c2;
    };

    extern struct module_top top;

    int main() {
      next_timeframe();
      next_timeframe();
      next_timeframe();
      assert(top.c1.counter==3);
      assert(top.c2.counter==6);
    }

The `main` function reads both counter values for cycle 3. A deeper hierarchy (modules in modules) is realized by using additional structure members. Writing these data structures for large Verilog designs is error prone, and thus, HW-CBMC can generate them automatically. The declarations above are generated using the command line

`hw-cbmc --gen-interface --module top hierarchy.v`

#### Mapping Verilog Vectors to Arrays or Scalars

In Verilog, a definition such as

`wire [31:0] x;`

can be used for arithmetic (as in `x+10`) and as array of Booleans (as in `x[2]`). ANSI-C does not allow both, so when mapping variables from Verilog to C, the user has to choose one option for each such variable. As an example, the C declaration

`unsigned int x;`

will allow using `x` in arithmetic expressions, while the C declaration

`__CPROVER_bool x[32];`

will allow accessing the individual bits of `x` using the syntax `x[bit]`. The `--gen-interface` option of HW-CBMC will generate the first variant if the vector has the same size as one of the standard integer types, and will use the __CPROVER_bitvector[] type if not so. This choice can be changed by adjusting the declaration accordingly. Note that both SpecC and SystemC offer bit-extraction operators, which means that it unnecessary to use the declaration as array in order to access individual bits of a vector.