Manual annotation (MA) of sensor data for Human Activity Recognition (HAR) is labor-intensive, error-prone, and limits scalability. This paper proposes a multi-sensor methodology to automatically generate training labels (aka. soft labels) for HAR systems without human intervention. The approach integrates data from inertial measurement units glued to objects of daily life with the Received Signal Strength Indicator (RSSI) information derived from BLE beacon anchors for estimating both the performed activity and the subject’s location. We validate the quality of the generated soft labels against video-based MA ground truth. Experimental results show that a deep learning model for HAR trained on a Wi-Fi Channel State Information (CSI) dataset annotated with soft labels achieves comparable results with respect to the same model trained on the corresponding manually-annotated dataset.

Indoor and outdoor localization systems are now essential tools for delivering Internet of Things (IoT)-based services across a range of fields, including smart buildings, industrial automation, and healthcare. These systems primarily aim to determine the position of users or objects within a given environment. Due to the abundance of electronic devices in these settings, localization techniques that utilize device interactions, such as fingerprinting, offer a cost-effective and accurate solution. However, the fingerprinting approach involves a time-intensive mapping phase, and training and executing the associated localization algorithm can impose demanding time, energy, and computational resource requirements. In this context, our paper introduces a practical system that eliminates the need for time-consuming environment mapping by leveraging radio signal emitters within the environment. Our approach achieved localization accuracy with an error range between 1.5 $m^2$ (best) - 6.5 $m^2$ (worst). Additionally, we collect human activity data from accelerometer, gyroscope, and magnetometer sensors to develop pattern recognition models for everyday activities.

The runtime verification of multi-domain software applications implementing the behaviors of modern robots is a challenging task. On the one hand, assertion-based verification (ABV) has shown great potential to check the correctness of complex systems at runtime. On the other hand, the computational overhead introduced by runtime ABV can be substantial, variable and non-deterministic. As a consequence, applying accurate ABV at runtime to autonomous robots, which are often characterized by resource-constrained computing architectures, can lead to severe slowdowns of the software execution and failures of temporal constraints, thus compromising the overall system’s correctness. We address this challenge by proposing a platform for runtime ABV that implements monitor synthesis from signal temporal logic assertions and dynamic monitor migration across edge devices and the cloud. The synthesized monitors are wrapped into ROS-compliant nodes and connected to the system under verification. The overall ABV framework and the related migration mechanism are then containerized with Docker for both edge and cloud computing. To evaluate the proposed platform, we present the results obtained with a set of synthetic benchmarks and with an industrial case study, which implements the mission of a Robotnik RB-Kairos mobile robot in a smart manufacturing production line. Note to Practitioners . This article was motivated by the need for accurate and runtime verification of robotic systems software. Verification and validation of intelligent systems are often incomplete, as they cannot anticipate all potential scenarios, including errors or unexpected events. On top of this, assertion-based verification can also be resource-intensive; therefore, careful use of resources is required to avoid overloading the robot’s computational resources with the monitors. To achieve this, we used signal temporal logic, a widely accepted solution to monitor robotic and distributed applications. The main contribution of this work is a framework that can automatically synthesize the monitors that interface with the Robot Operating System (ROS) and also the capability of optimizing the end-to-end latency of verification at runtime by exploiting a distributed computing architecture (i.e., edge-cloud). In future work, we will address not only the minimization of end-to-end latency but also the timing upper bound of monitors to achieve runtime deterministic verification.

Over the past few decades, the verification community has developed several specification miners as an alternative to manual assertion definition. However, assessing their effectiveness remains a challenging task. Most studies evaluate these miners using predefined ranking metrics, which often fail to ensure the quality of the inferred specifications, especially when no fixed ground truth exists and the relevance of the specifications varies depending on the use case. This paper presents a comprehensive framework aimed at facilitating the evaluation and comparison of Linear Temporal Logic (LTL) specification miners. Unlike traditional approaches, which struggle with subjective analyses and complex tool configurations, our framework provides a structured method for assessing and comparing the quality of specifications generated by multiple sources, using both semantic and syntactic techniques. To achieve this, the framework offers users an easy-to-extend environment for installing, configuring, and running third-party miners via Docker containers. Additionally’ it supports the inclusion of new evaluation methods through a modular design. Miner comparison can be based either on user-defined designs or on synthetic benchmarks, which are automatically generated to serve as a non-subjective ground truth for the evaluation of the miners. We demonstrate the utility of our framework through comparative analyses with four well-known LTL miners, illustrating its ability to standardize and enhance the specification mining evaluation process.

Falls can have significant and far-reaching effects on various groups, particularly the elderly, workers, and the general population. These effects can impact both physical and psychological well-being, leading to long-term health problems, reduced productivity, and a decreased quality of life. Numerous fall detection systems have been developed to prompt first aid in the event of a fall and reduce its impact on people's lives. However, detecting a fall after it has occurred is insufficient to mitigate its consequences, such as trauma. These effects can be further minimized by activating safety systems (e.g., wearable airbags) during the fall itself—specifically in the pre-impact phase—to reduce the severity of the impact when hitting the ground. Achieving this, however, requires recognizing the fall early enough to provide the necessary time for the safety system to become fully operational before impact. To address this challenge, this paper introduces a novel lightweight convolutional neural network (CNN) designed to detect pre-impact falls. The proposed model overcomes the limitations of current solutions regarding deployability on resource-constrained embedded devices, specifically for controlling the inflation of an airbag jacket. We extensively tested and compared our model, deployed on an STM32F722 microcontroller, against state-of-the-art approaches using two different datasets.

The measurement of breath rate (BR) is essential for comprehensive human health monitoring across a wide range of scenarios. Several studies in the literature have explored the estimation of BR using millimeter wave (mmWave) technology. However, these approaches typically focus on a single subject at a time. To enable multi-person estimation, researchers have often relied on data fusion with camera systems or employed specialized hardware configurations. On the contrary, this paper proposes a methodology that employs only one Frequency Modulated Continuous Wave (FMCW) radar to estimate the BR of multiple subjects stationary in the environment. The proposed methodology includes a pre-processing pipeline to refine the radar-captured signals, followed by frequency-domain analysis to distinguish between subjects. Finally, phase variations in the reflected signals caused by chest movements are analyzed to estimate the BR. Advantages and limitations of the approach are discussed on the basis of an experimental campaign.

In the context of smart environments, crafting remote monitoring systems that are efficient, cost-effective, user-friendly, and respectful of privacy is crucial for many scenarios. Recognizing and tracing individuals via markerless motion capture systems in multi-person settings poses challenges due to obstructions, varying light conditions, and intricate interactions among subjects. In contrast, methods based on data gathered by Inertial Measurement Units (IMUs) located in wearables grapple with other issues, including the precision of the sensors and their optimal placement on the body. We claim that more accurate results can be achieved by mixing Human Pose Estimation (HPE) techniques with information collected by wearables. To do that, we introduce a real-time platform that fuses HPE and IMU data to track and identify people. It exploits a matching model that consists of two synergistic components: the first employs a geometric approach, correlating orientation, acceleration, and velocity readings from the input sources. The second utilizes a Convolutional Neural Network (CNN) to yield a correlation coefficient for each HPE and IMU data pair. The proposed platform achieves promising results in identification and tracking, with an accuracy rate of 96.9%.

Using WiFi's Channel State Information for human activity recognition—referred to as WiFi sensing—has attracted considerable attention. But despite this interest and many publications over a decade, WiFi sensing has not yet found its way into practice because of a lack of robustness of the inference results. In this paper, we quantitatively show that even “microchanges” in the environment can significantly impact WiFi signals, and potentially alter the ML inference results. We therefore argue that new training and inference techniques might be necessary for mainstream adoption of WiFi sensing.

Several approaches have been proposed over the years to automatically generate specifications of digital systems by means of dynamic techniques, which are now ripe to be applied in large-scale industrial scenarios. On the other hand, the automatic extraction of specifications for the hybrid domain, where systems express both discrete and continuous behaviours, remains mainly unexplored. Therefore, in this paper, we propose a tool for dynamically mining the specifications of hybrid systems in the form of assertions compliant with the Signal Temporal Logic (STL), which has been proven to be effective at capturing the behaviours of such systems. Our approach takes as input a set of execution traces of the target system and mixes clustering and decision-tree algorithms to generate STL assertions that describe what has been actually implemented.

Approximate Computing (AxC) paradigm was introduced to achieve higher power efficiency, lower area and better performances w.r.t. a “classical” computing system at the cost of a degraded, but still acceptable, output accuracy [1]. AxC can be applied at several abstraction levels of a given computing system: from circuit to algorithm [1], leading to a wide design exploration space that quickly became the bottleneck for successfully deploying AxC. Indeed, the literature proposes many works to automatically trade-off between output accuracy and performances [2]. However, most of them lack the capability to identify resilient elements (e.g, HW component, HDL statements, etc.) of the design to be approximated. Consequently, exploring the design for AxC generally results in a long and tedious procedure. Existing approaches generate approximate variants of the Design Under Exploration (DUE). Every variant is then executed/simulated in order to determine the accuracy degradation [3], which depends on the application and requires a specific metric to be computed (e.g., similarity index, hamming distance, etc.).

In the context of smart buildings and smart cities, the design of low-cost and privacy-aware solutions for recognizing the presence of humans and their activities is becoming of great interest. Existing solutions exploiting wearables and video-based systems have several drawbacks, such as high cost, low usability, poor portability, and privacy-related issues. Consequently, more ubiquitous and accessible solutions, such as WiFi sensing, became the focus of attention. However, at the current state-of-the-art, WiFi sensing is subject to low accuracy and poor generalization, primarily affected by environmental factors, such as humidity and temperature variations, and furniture position changes. Such is-sues are partially solved at the cost of complex data preprocessing pipelines. In this paper, we present a highly accurate, resource-efficient deep learning-based occupancy detection solution, which is resilient to variations in humidity and temperature. The approach is tested on an extensive benchmark, where people are free to move and the furniture layout does change. In addition, based on a consolidated algorithm of explainable AI, we quantify the importance of the WiFi signal w.r.t. humidity and temperature for the proposed approach. Notably, humidity and temperature can indeed be predicted based on WiFi signals; this promotes the expressivity of the WiFi signal and at the same time the need for a non-linear model to properly deal with it.

Obesity is a real health emergency with significant consequences for individuals and society, reducing expectations and quality of life or even the death for 2.8 million people each year. Being a chronic condition with limited pharmacological options, weight loss therapies are mainly based on dietary and cognitive-behavioral interventions delivered at specialist public and/or private centers. In order to promote and facilitate weight loss, this paper proposes a virtual coaching system to motivate and guide the patients during the therapy and to support the clinicians in monitoring its effectiveness. The system has three components: a) the clinician's web application, which is used to monitor and modify the therapy for each patient; b) a mobile application for patients, used to log nutrition intakes and physical activities, and to consult motivational documents/videos; and c) a cloud server, which collects data and implements smart monitoring features. The platform is adopted in a clinical trial involving 120 patients with obesity (Body Mass Index 2> 30) that has recently started.

Over the last decade, Human Activity Recognition (HAR) has become a vibrant research field in various applications scenarios, ranging from sports, healthcare and well-being to smart cities, smart homes, and industry, mainly due to the widespread availability of devices as smartphones, smartwatches, and wearables. A key ingredient for sophisticated HAR systems is represented by the availability of high-quality datasets. These are generally gathered by dedicated Body Area Networks (BANs), and further elaborated through machine learning and deep learning algorithms. Thus, the BAN design plays a central role in such a context, where the main challenges are related to easiness of use, costs and energy constraints of their components. In this context, our paper presents a highly configurable HAR system, based on a low-cost and easy-to-use BAN. The system includes a CNN-based algorithm validated over a dataset, collected through the proposed BAN, on 12 persons performing 7 different human activities.

Identity recognition is increasingly used to control access to sensitive data, restricted areas in industrial, healthcare, and defense settings, as well as in consumer electronics. To this end, existing approaches are typically based on collecting and analyzing biometric data and imply severe privacy con-cerns. Particularly when cameras are involved, users might even reject or dismiss an identity recognition system. Furthermore, iris or fingerprint scanners, cameras, microphones, etc., imply installation and maintenance costs and require the user's active participation in the recognition procedure. This paper proposes a non-intrusive identity recognition system based on analyzing WiFi's Channel State Information (CSI). We show that CSI data attenuated by a person's body and typical movements allows for a reliable identification - even in a sitting posture. We further propose a lightweight deep learning algorithm trained using CSI data, which we implemented and evaluated on an embedded platform (i.e., a Raspberry Pi 4B). Our results obtained using real-world experiments suggest a high accuracy in recognizing people's identity, with a specificity of 98% and a sensitivity of 99%, while requiring a low training effort and negligible cost.

State-of-the-art mining tools generate assertions that either describe the temporal relations between Boolean expressions, or extract non-temporal logic formulas between more complex propositions involving arithmetic and/or relational operators. This paper presents a method for generating Linear Temporal Logic (LTL) assertions containing both the temporal dimension and the complexity of non-Boolean expressions. Starting from a set of simulation traces of the design under verification (DUV), our approach generates LTL assertions where the Boolean layer contains expressions of the form c = ne, c ≤ ne, c ≥ ne, cl≤ ne ≤ cr, where c, cl, crare constants of numeric type, and ne is a numerical expression predicating over the variables of the DUV. The method exploits a clustering algorithm to mine a meaningful set of propositions following the aforementioned structure. After that, the propositions are used to generate temporal assertions through a decision tree algorithm. Experimental results show real improvements with respect to the state-of-the-art in terms of fault coverage and readability of the mined assertions.

This article presents HARM, a tool to generate linear temporal logic (LTL) assertions starting from a set of user-defined hints and the simulation traces of the design under verification (DUV). The tool is agnostic with respect to the design from which the trace was generated, thus the DUV source code is not necessary. The user-defined hints involve LTL templates, propositions, and ranking metrics that are exploited by the assertion miner to reduce the search space and improve the quality of the generated assertions. This way, the tool supports the work of the verification engineer by including his/her insights in the process of automatically generating assertions. The experimental results show real improvements with respect to the state-of-the-art in terms of assertion coverage and scalability.

This paper proposes an architecture and a related automatic flow to generate, orchestrate and deploy a ROS-compliant verification environment for robotic systems. The architecture enables assertion-based verification by exploiting monitors automatically synthesized from LTL assertions. The monitors are encapsulated in plug-and-play ROS nodes that do not require any modification to the system under verification (SUV). To guarantee both verification accuracy and real-time constraints of the system in a resource-constrained environment even after the monitor integration, we define a novel approach to move the monitor evaluation across the different layers of an edge-to-cloud computing platform. The verification environment is containerized for both cloud and edge computing using Docker to enable system portability and to handle, at run-time, the resources allocated for verification. The effectiveness and efficiency of the proposed architecture have been evaluated on a complex distributed system implementing a mobile robot path planner based on 3D simultaneous localization and mapping.

This article presents a low-cost system for distance estimation, occupancy counting, and presence detection based on Bluetooth Low Energy radio signal variation patterns that mitigates the limitation of existing approaches related to economic cost, privacy concerns, computational requirements, and lack of ubiquitousness. To explore the approach effectiveness, exhaustive tests have been carried out on four different datasets by exploiting several pattern recognition models.

Many verification strategies have been proposed to identify unexpected behaviours in system-level implementations. However, when one of such behaviours is found, the verification engineer still has to understand its cause to fix the originating error. This requires a tedious and long process, generally based on manual inspection of the execution traces of the design under verification. Nevertheless, usually only a few instructions in the execution traces are relevant to understand the cause of the unexpected behaviour. To help the verification engineers identifying and focusing on such instructions, we present a tool that automatically removes the irrelevant ones. It works by combining dynamic program slicing with a clustering procedure on the execution traces corresponding to unexpected behaviours. Firstly, program slicing is applied to remove instructions not belonging to the cone of influence of the unexpected behaviour. Then, clusters of instructions based on store operations at the LLVM intermediate representation are created to guide the heuristic in removing further irrelevant instructions.

This paper presents MIST, an all-in-one tool capable of generating a complete environment to verify C/C++ firmwares starting from informal specifications. Given a set of specifications written in natural language, the tool guides the user in translating each specification into an XML formal description, capturing a temporal behavior that must hold in the design. Our XML format guarantees the same expressiveness of linear temporal logic, but it is designed to be used by designers that are not familiar with formal methods. Once each behavior is formalized, MIST automatically generates the corresponding test-bench and checker to stimulate and verify the design. In order to guide the verification process, MIST employs a clustering procedure that classifies the internal states of the firmware. Such classification aims at finding an effective ordering to check the expected behaviors and to advise for possible specification holes. MIST has been fully integrated into the IAR System Embedded Workbench. Its effectiveness and efficiency have been evaluated to formalize and check a complex test-plan for an industrial firmware.

Likely invariants model properties that hold in operating conditions of a computing system. Dynamic mining of invariants aims at extracting logic formulas representing such properties from the system execution traces, and it is widely used for verification of intellectual property (IP) blocks. Although the extracted formulas represent likely invariants that hold in the considered traces, there is no guarantee that they are true in general for the system under verification. As a consequence, to increase the probability that the mined invariants are true in general, dynamic mining has to be performed to large sets of representative execution traces. This makes the execution-based mining process of actual IP blocks very time-consuming due to the trace lengths and to the large sets of monitored signals. This article presents Mangrove, an efficient implementation of a dynamic invariant mining algorithm for GPU architectures. Mangrove exploits inference rules, which are applied at run time to filter invariants from the execution traces and, thus, to sensibly reduce the problem complexity. Mangrove allows users to define invariant templates and, from these templates, it automatically generates kernels for parallel and efficient mining on GPU architectures. The article presents the tool, the analysis of its performance, and its comparison with the best sequential and parallel implementations at the state of the art.

Some wearable solutions exploiting on-body acceleration sensors have been proposed to recognize Freezing of Gait (FoG) in people affected by Parkinson Disease (PD). Once a FoG event is detected, these systems generate a sequence of rhythmic stimuli to allow the patient restarting the gait. While these solutions are effective in detecting FoG events, they are unable to predict FoG to prevent its occurrence. This paper fills in the gap by presenting a machine learning-based approach that classifies accelerometer data from PD patients, recognizing a pre-FOG phase to further anticipate FoG occurrence in advance. Gait was monitored by three tri-axial accelerometer sensors worn on the back, hip and ankle. Gait features were then extracted from the accelerometer's raw data through data windowing and non-linear dimensionality reduction. A k-nearest neighbor algorithm (k-NN) was used to classify gait in three classes of events: pre-FoG, no-FoG and FoG. The accuracy of the proposed solution was compared to state-of-the-art approaches. Our study showed that: (i) we achieved performances overcoming the state-of-the-art approaches in terms of FoG detection, (ii) we were able, for the very first time in the literature, to predict FoG by identifying the pre-FoG events with an average sensitivity and specificity of, respectively, 94.1% and 97.1%, and (iii) our algorithm can be executed on resource-constrained devices. Future applications include the implementation on a mobile device, and the administration of rhythmic stimuli by a wearable device to help the patient overcome the FoG.

People affected by the Parkinson's disease are often subject to episodes of Freezing of Gait (FoG) near specific areas within their environment. In order to prevent such episodes, this paper presents a low-cost indoor localization system specifically designed to identify these critical areas. The final aim is to exploit the output of this system within a wearable device, to generate a rhythmic stimuli able to prevent the FoG when the person enters a risky area. The proposed localization system is based on a classification engine, which uses a fingerprinting phase for the initial training. It is then dynamically adjusted by exploiting a probabilistic graph model of the environment.

We present a three-step flow to improve Assertion-based Verification methodology with integrated RTL-to-TLM abstraction: First, an automatic assertion miner generates a large set of possible assertions from an RTL design. Second, automatic assertion qualification identifies the most interesting assertions from this set. Third, the assertions are abstracted to the transaction level, such that they can be re-used in TLM verification. We show that the proposed flow automatically chooses the best assertions among the ones generated to verify the design components when abstracted from RTL to TLM. Our experimental results indicate that the proposed methodology allows us to re-use the most interesting set at TLM without relying on any time consuming or error-prone manual transformations with a considerable amount of speed up and considerable reduction in the execution time.

Dynamic Partial Reconfigurable FPGAs (DPRFPGA) are integrated programmable circuits that are dynamically reconfigurable: the designer can reconFigure them runtime, depending on the (dynamic) environment. This paper presents a new model-based design flow for DPR-FPGAs, based on the creation of a specific Extended Finite State Machine (EFSM) which formally describes the hardware. The design flow uses Pyngu, a tool which automatizes the generation of code and simulation through SystemC. This methodology is applied to a reconfigurable robot deployed in different scenarios, which can reconFigure its kinematics in order to overcome obstacles: the kinematics depends on the robots shape, enabling different movement types like trotting, crawling and getting up. Experiments show that the model-based design flow leads to effective adaptable robots design.

Several approaches exist for specification mining of hardware designs, both at the RTL and system levels (e.g, TLM). These approaches mine assertions that specify the behavior of the design. Some of the techniques require the source code itself while others can extract assertions directly from simulation traces. The performance of some approaches is highly dependent on the number of simulation traces/use cases while there exist approaches which can extract assertions from a limited number of simulation traces. Apart from this aspect, the core of each assertion miner is different from the other ones. Some use expression templates to define assertions while some are based on the static analysis or information flow analysis. Unfortunately, it has been rarely considered which of the current approaches are more effective in describing functionality of particular types of designs. Thus, in this work, we analyze assertion miners which are template based and dynamic dependency graph based, respectively. We generate assertions from both approaches. The evaluation considers fault analysis on both assertion sets of extracted assertions. Moreover, both sets are combined and fault analysis has been applied on them. Experimental results show that each set approximately detects the same number of faults while when the two sets are combined the number of detected faults increases. Finally, a new, more efficient architecture for an effective assertion miner has been developed based on the study in this work.

This paper presents DOVE, a validation framework to identify points of vulnerability inside IP firmwares. The framework relies on the symbolic simulation of the firmware to search for corner cases in its computational paths that may hide vulnerabilities. Then, DOVE automatically mine a compact set of formal assertions representing these unlikely paths to guide the analysis of the verification engineers. Experimental results on two case studies show the effectiveness of the generated assertions in pinpointing actual vulnerabilities and its efficiency in terms of execution time.

In the last decade, several localization systems have been proposed, some of them achieving an accuracy in the order of decimeters. Nonetheless, a broad range of these methods may reveal unattractive for low-cost and resource-bounded mobile application scenarios. Indeed, significant constraints stem from costs and availability of the required technological infrastructure for the target environment. In addition, resources necessary to train and run the localization algorithm may pose stringent requirements in terms of time, power and computational. In the aforementioned context, this paper presents an effective radio-based positioning algorithm able to localize the user by exploiting a graph-based representation of the environment. The graph is created by analyzing the received signal level and the movement directions of a mobile device with respect to a set of real and virtual landmarks. The comparison with a commercial localization system proves the effectiveness and accuracy of the proposed approach.

Different mining approaches have been proposed in literature for the automatic generation of temporal assertions from execution traces of digital systems. However, in most cases, existing tools can only mine assertions compliant with a limited set of pre-defined templates. Furthermore, they tend to generate a huge amount of assertions, while they still lack an effective way to measure their coverage in terms of design behaviours. To fill in the gap, this paper presents A-TEAM, a tool for the automatic extraction of temporal assertions starting from a set of user-defined assertion templates. Our method involves a combination of data mining and coverage analysis for mining a compact and expressive set of LTL formulas.

Only few solutions for Hardware Trojan (HT) detection work at Register-Transfer Level (RTL), thus delaying the identification of possible security issues at lower abstraction levels of the design process. In addition, the most of existing approaches work only for specific kinds of HTs. To overcome these limitations, we present a verification approach that detects different types of HTs in RTL models by exploiting an efficient control-flow subgraph matching algorithm. The prototypes of HTs that can be detected are modelled in a library by using Control-Flow Graphs (CFGs) that can be parametrised and extended to cover several variants of Trojan patterns. Experimental results show that our approach is effective and efficient in comparison with other state-of-the-art solutions.

This paper presents an approach to automatically generate transactors that implement TLM protocols for RTL IPs, such that the RTL IPs can be abstracted towards corresponding TLM models and easily integrated inside a TLM virtual prototype. The obtained transactor is self-adaptive, since it allows plugging the target IP in the virtual prototype independently from the protocol implemented by the corresponding TLM initiator. The transactor is automatically created from the set of PSL assertions that describe the temporal behaviour of the communication protocol of the original RTL IP.

A pre-condition for any verification technique based on simulation is the generation of a high-quality set of stimuli that effectively and efficiently cover the whole state space of the Design Under Verification (DUV), including hard-to-reach corner cases. To cope with this necessity, several approaches for the automatic generation of stimuli have been proposed for both embedded software and high-level descriptions of hardware components. Most of these approaches use constraint solvers to generate the sequences of stimuli that trigger specific conditions, enabling the analysis of corner cases. However, the automatic identification of those conditions is still an open problem, especially for black-box designs. To fill in the gap, this paper proposes a stimuli generator, based on a dynamic invariant miner, that identifies and stresses DUV areas that are not deeply analysed by traditional pseudo-random high-level Automatic Test Pattern Generators (ATPGs), thus guaranteeing an higher coverage of corner cases during black-box verification.

Dynamic mining of invariants is a class of approaches to extract logic formulas from the execution traces of a system under verification (SUV), with the purpose of expressing stable conditions in the behaviour of the SUV. The mined formulas represent likely invariants for the SUV, which certainly hold on the considered traces, but there is no guarantee that they are true in general. A large set of representative execution traces must be analysed to increase the probability that mined invariants are generally true. However, this becomes extremely time-consuming for current sequential approaches when long execution traces and large set of SUV variables are considered. To overcome this limitation, the paper presents a parallel approach for invariant mining that exploits GPU architectures for processing an execution trace composed of millions of clock cycles in few seconds.

Different mining approaches have been proposed in the past for automatic generation of assertions. However, in most cases, existing tools generate a set of over-constrained assertions. As a consequence, each assertion in the set is a long formula that describes a very specific behaviour of the design under verification (DUV). Thus, in the effort of covering as much DUV behaviours as possible, these approaches generate a huge amount of assertions with a negative impact on the total time required for their verification. To overcome this drawback, we introduce a dynamic approach that incrementally analyses control signals on DUV execution traces for mining more expressive temporal assertions that better capture the I/O communication protocol. Experimental results show that our approach allows generating a compact set of assertions without penalizing the coverage of DUV behaviours.

The definition of assertions is a fundamental phase for formal and semi-formal verification strategies as well as for documenting purposes. Assertions are generally manually defined, but several (semi-) automatic approaches have been also proposed that mine assertions directly from execution traces of the design under verification (DUV). In both cases, assertion qualification is necessary to evaluate the quality of the defined assertions. Current approaches evaluate the interestingness of a set of assertions by measuring the percentage of DUV's behaviours covered by the assertions, mainly by adopting techniques based on mutation analysis, which require long simulation time. On the contrary, this work proposes an automatic technique to estimate the interestingness of assertions by ranking them according to metrics typically adopted in the context of data mining, which reveals to be a faster approach. Experimental results that compare the proposed assertion ranking strategy with assertion qualification based on mutation analysis are reported.

Several approaches have been proposed for cosimulation between QEMU and SystemC. On the contrary, no paper addresses integration between Open Virtual Platform (OVP) and SystemC. Indeed, OVP models and the related simulator can be integrated into SystemC designs by using TLM 2.0 wrappers and opportune OVP APIs. However, this solution presents some disadvantages, like the incapability of supporting cycle-accurate models, and the necessity of re-design, in terms of SystemC modules, all OVP components that should be integrated in the target platform. To avoid such drawbacks, and provide an easy way to port SystemC models from a QEMU-based to an OVP-based virtual platform and vice versa, this paper presents a common co-simulation approach that works for integrating SystemC components with both QEMU and OVP.

Transaction-level modeling (TLM) has become the de-facto reference modeling style for system-level design and verification of embedded systems. It allows designers to implement high-level communication protocols for simulations up to 1000 × faster than at register-transfer level (RTL). To guarantee interoperability between TLM IP suppliers and users, designers implement the TLM communication protocols by relying on a reference standard, such as the standard OSCI for SystemC TLM. Functional correctness of such protocols as well as their compliance to the reference TLM standard are usually verified through user-defined testbenches, whose high quality and completeness play a key role for an efficient TLM design and verification flow. This article presents a methodology to apply mutation analysis, a technique applied in literature for SW testing, for measuring the testbench quality in verifying TLM protocols. In particular, the methodology aims at (i) qualifying the testbenches by considering both the TLM protocol correctness and their compliance to a defined standard (i.e., OSCI TLM), (ii) optimizing the simulation time during mutation analysis by avoiding mutation redundancies, and (iii) driving the designers in the testbench improvement. Experimental results on benchmarks of different complexity and architectural characteristics are reported to analyze the methodology applicability.

Fault injection is fundamental to evaluate the dependability of embedded software. Analyzing the interaction between the software and hardware components when hardware faults occur is efficient, but it is only possible once physical prototypes are available. On the other hand, fault injection on Hardware Description Language (HDL) models is a common practice that can significantly improve the verification phases, but HDL simulation speed constitutes a bottleneck of the design flow. In such a context, executing software on a virtual CPU providing fault-injection capabilities allows engineers to anticipate Embedded Software (ESW) dependability analysis at an earlier design stage. Thus, we present a non-intrusive approach that offers high speed for simulating hardware faults affecting CPU behaviors. This is obtained through dynamic translation of ESW binary code. In this work, hardware fault models (i.e., stuck-at, transient and delay faults) have been abstracted to an instruction-accurate CPU emulator without losing quality for ESW dependability analysis. Experimental results proves both the efficiency and effectiveness of the proposed approach.

Designers are more and more forced to define innovative models and methodologies for managing integration of heterogeneous components and heterogeneous Chip Multiprocessors (CMPs) in modern embedded systems. In this context, component-based design seems the more promising approach, but it suffers from the lack of a widely adopted Model of Computation (MoC) able to capture component heterogeneity. This paper proposes univerCM, a new model of computation based on the Heterogeneous Intermediate Format (HIF) with the aim of supporting bottom-up design and system integration from a set of heterogeneous components. HW and SW components can be described by means of different languages and according to different MoCs, toward a uniform intermediate description based on a rigorous semantics. A mapping from univerCM to SystemC is proposed then to obtain a homogeneous description intended for fast simulation, that can be also used as starting point for CMP design flows. Experimental results show the effectiveness of univerCM in managing system heterogeneity.

This work proposes an advanced methodology based on an open source virtual prototyping framework for verification of complex Heterogeneous Embedded Systems (HES). It supports early rapid modelling of complex HES through smooth refinements, an open interface based on IP-XACT extensions for secure composition of HES components, and automatic testbench generation over different abstraction levels.

Assertion-based verification (ABV) is more and more used for verification of embedded systems concerning both HW and SW parts. However, ABV methodologies and tools do not apply to HW and SW components in the same way: for HW components, both static ABV and dynamic ABV are widely used; on the contrary, SW components are traditionally verified by means of static ABV, because dynamic approaches are based on simulation assumptions which could not be true during execution of general embedded SW and which cannot be controlled by the assertion language. This paper proposes to exploit model-driven design for guaranteeing such simulation assumptions. Then, it describes an ABV framework for embedded SW, that automatically synthesizes assertion checkers to verify the embedded SW accordingly to the simulation assumptions.

Assertion-based verification (ABV) affirmed as an effective methodology for functional verification, i.e., design specification conformance, of embedded systems. Academia and industry have throughly investigated formal ABV for high-budget or safety-critical hardware and software projects, while the scalability of dynamic ABV has led to the introduction of standard languages and commercial tools addressing hardware design verification, emulation, and silicon debug. However, up to now, there were only limited studies concerning the application of dynamic ABV to embedded-software design and verification flow. We propose an analysis aiming to bridge such a gap. In particular, we illustrate how dynamic ABV can integrate and improve the various stages of the embedded-software verification flow. The analysis leads us to develop a comprehensive ABV environment that integrates the still missing automatic synthesis of executable checkers for embedded software. Experiments show that the proposed environment reduces the verification-team efforts and makes dynamic ABV practical for embedded-software design.

Verification is increasingly becoming the bottleneck in designing digital systems. In fact, most of the verification cycle is not spent on detecting the occurrences of errors but on debugging, consisting of locating and correcting the errors. However, automated design-error debug, especially at the system-level, has received far less attention than error detection. Current paper presents an automated approach to correcting system-level designs. We propose dynamic-slicing and location-ranking-based method for accurately pinpointing the error locations combined with a dedicated set of mutation operators for automatically proposing corrections to the errors. In order to validate the approach, experiments on the Siemens benchmark set have been carried out. The experiments show that the proposed method is able to correct three times more errors compared to the state-of-the-art mutation-based correction methods while examining fewer mutants.

We present an approach for optimization of assertion placement in time-constrained HW/SW modules for detection of errors due to transient and intermittent faults. During the design phases, these assertions have to be inserted into the executable code and, hence, will always be executed with the corresponding code branches. As the result, they can significantly increase execution time of a module, in particular, contributing to a much longer execution of the worst case, and cause deadline misses. Assertions have different characteristics such as tightness (or "local error coverage") and execution latency. Taking into account these properties can increase efficiency of assertion checks in time-constrained embedded HW/SW modules. We have developed a design optimization framework, which (1) identifies candidate locations for assertions, (2) associates a candidate assertion to each location, and (3) selects a set of assertions in terms of performance degradation and assertion tightness. Experimental results have shown the efficiency of the proposed techniques.

State-of-the-art approaches for testing of system-level design of embedded systems generally work at source-code level, thus they require an implementation of the system to be tested. For this reason, they cannot be applied in the context of model-driven design, where code is available only at end of the design process. Moreover, traditional approaches based on combined concrete and symbolic execution (concolic) suffer two main drawbacks: they are limited in width and depth of the search and not corner-cases oriented. To address such limitations, this paper presents a concolic testing approach for model-driven design of embedded systems. It explores a model of the system, i.e., the extended finite state machine (EFSM), and it relies on weight-oriented analysis of the EFSM paths to achieve high controllability of EFSM transitions, by interleaving longrange concrete approach with symbolic multi-level backjumping strategy. The experimental evaluation on several case studies demonstrates the competitiveness of the proposed approach, which achieves higher transition and instruction coverage than other approaches in significantly reduced time.

Transaction-level modeling (TLM) is the most promising technique to deal with the increasing complexity of modern embedded systems. However, modeling a complex system completely at transaction level could be inconvenient when IP cores are available on the market, since they are usually modeled at register transfer level (RTL). In this context, modeling and verification methodologies based on transactors allow designers to reuse RTL IPs into TLM-RTL mixed designs, thus guaranteeing a considerable saving of time. Practical advantages of such an approach are evident, but mixed TLM-RTL designs cannot completely provide the well-known effectiveness in terms of simulation speed provided by TLM. This paper presents a methodology to automatically abstract RTL IPs into equivalent TLM descriptions. To do that, the paper first proposes a formal definition of equivalence based on events, showing how such a definition can be applied to prove the correctness of a code manipulation methodology, such as code abstraction. Then, the paper proposes a technique to automatically abstract RTL IPs into TLM descriptions. Finally, the paper shows that the TLM descriptions obtained by applying the proposed technique are correct by construction, relying on the given definition of event-based equivalence. A set of experimental results is reported to confirm the effectiveness of the methodology.

High performance provided by multi-processor System-on-Chips (MPSoCs) often induces designers to choose customized processors to execute specific functions rather than using dedicated hardware. On the other hand, reuse of pre-designed and pre-verified IP cores is the key strategy to meet time-to-market while at the same time reducing the error risk during the development of MPSoC designs. In this context, it becomes convenient to translate an existent RTL IP description, originally dedicated to implement an HW component, into pure SW code (i.e., C/C++) to be executed by one or more processors of the MPSoC. This work proposes a methodology to automatically generate SW code by abstracting RTL IP models implemented in hardware description language (HDL). The methodology exploits an abstraction algorithm to eliminate many implementation details typical of the HW descriptions, in order to improve the performance of the generated code.

Refinement of untimed TLM models into a timed HW/SW platform is a step by step design process which is a trade-off between timing accuracy of the used models and correct estimation of the final timing performance. The use of an RTOS on the target platform is mandatory in the case real-time properties must be guaranteed. Thus, the question is when the RTOS must be introduced in this step by step refinement process. This paper proposes a four-level RTOS-aware refinement methodology that, starting from an untimed TLM SystemC description of the whole system, progressively introduce HW/SW partitioning, timing, device driver and RTOS functionalities, till to obtain an accurate model of the final platform, where SW tasks run upon an RTOS hosted by QEMU and HW components are modeled by cycle accurate TLM descriptions. Each refinement level allows the designer to estimate more and more accurate timing properties, thus anticipating design decisions without being constrained to leave timing analysis to the final step of the refinement. The effectiveness of the methodology has been evaluated in the design of two complex platforms.

The paper tackles the problem of property qualification focusing in particular on the identification of vacuous properties. It proposes a methodology based on a combination of dynamic and static techniques that, given a set of properties defined to check the correctness of a design implementation, performs vacuity detection. Existing approaches for vacuity checking are as complex as model checking, and they require to define and model check further properties, thus increasing the verification time. Moreover, for some formulae they fail to detect vacuity, as for example in case of tautology. These problems are overcome by our approach. It is based on mutation analysis, thus, it does not require the definition of new properties granting a speed-up of the vacuity analysis process. Moreover, it provides highly accurate vacuity alerts which capture also propositional and temporal tautologies.

The paper proposes DDPSL (Drag and Drop PSL) a template library and a tool which simplifies the definition of PSL (Property Specification Language) formal properties by exploiting PSL-based templates. DDPSL allows users not expert in formal methods to define PSL properties by dragging and dropping logical and temporal operators, and variables from the design under verification (DUV) into predefined templates. Moreover, confident users or experts can extend the set of templates, reducing the effort required for formalizing complex properties. From the methodological point of view, DDPSL combines the advantages of both Open Verification Library (OVL) and PSL. Note that the templates are characterized by a parametric interface that separates the formal definition from its semantics, as provided by OVL. Moreover, the adoption of PSL as reference language guarantees the expressiveness of popular temporal logics such as Linear Temporal Logic (LTL) and Computational Tree Logic (CTL), which, on the contrary, are not fully supported by OVL. DDPSL has been successfully used to define properties for verifying an embedded application running on the microcontroller of an industrial oven.

The topic will cover the use of functional qualification for measuring the quality of functional verification of TLM models. Functional qualification is based on the theory of mutation analysis but considers a mutation to have been killed only if a test case fails. A mutation model of TLM behaviors is proposed to qualify a verification environment based on both testcases and assertions. The presentation describes at first the theoretic aspects of this topic and then it focuses on its application to real cases by using actual EDA tools, thus showing advantages and limitations of the application of mutation analysis to TLM.

The generation of device drivers is a very time consuming and error prone activity. All the strategies proposed up to now to simplify this operation require a manual, even formal, specification of the device driver functionalities. In the system-level design, IP functionalities are tested by using testbenches, implemented to contain the communication protocols to correctly interact with the device. The aim of this paper is to present a methodology to automatically generate device drivers from the testbench of any RTL IP. The only manual step required is to tag the states corresponding to the different device functionalities. The Extended Finite State Machines (EFSMs) are then used to create a correct-by-construction two-level device driver: the lower level deals with architectural choices, while the higher one is derived from the EFSMs and it implements the communication protocols. The effectiveness of this methodology has been proved by applying it to a platform provided by STMicroelectronics.

The effectiveness and the efficiency of functional ATPGs based on deterministic strategies is influenced by the computational model adopted to represent the design under test. In this context the extended finite state machine (EFSM) is a valuable model which reduces the risk of state explosion preserving relevant features of more traditional FSMs. This paper. defines a particular variant of EFSMs to manage properly both synchronous and asynchronous modules in a uniform way, and then it proposes theoretical basis to perform their composition by bounding state and transition growth. The aim of composition is to improve functional ATPG whose effectiveness and efficiency may be limited when separate EFSMs are used to model the design under test. Experimental results confirm this conjecture.

The paper proposes a comprehensive methodology for property qualification based on a combination of dynamic and static techniques. In particular, given a set of properties defined to check the correctness of a design implementation, the methodology first evaluates property coverage, property overspecification, and it identifies vacuous properties. This is commonly performed by exploiting mutation analysis and automatic testbenches generation, i.e., dynamic strategies. This phase allows us to quickly evaluate the quality of properties with respect to the use of formal approaches. Then, a second phase, based on model checking, is applied to the restricted number of situations, where the dynamic approach is not exhaustive. Experimental results show the effectiveness and efficiency of the proposed methodology.

Cosimulation strategies allow us to simulate and verify HW/SW embedded systems before the real platform is available. In this field, there is a large variety of approaches that rely on different communication mechanisms to implement an efficient interface between the SW and the HW simulators. However, the literature lacks a comprehensive methodology which addresses the need for integrating and synchronizing heterogeneous simulators, like, for example, the SystemC simulation kernel for HW modules and an instruction set simulator for SW applications, without being intrusive for the HW and SW descriptions involved in the simulation. In this context, this article presents, compares, and integrates in a system-level framework two different co-simulation strategies for modeling, analyzing, and validating the performance of a HW/SW embedded system. Moreover, for both of them, a mechanism is proposed to provide an accurate time synchronization of the HW/SW communication. The first strategy is intended to provide an early cosimulation environment where HW/SW interaction can be validated without involving the operating system. The communication is implemented between a single SW task and a SystemC description of an HW module by exploiting the features of the remote debugging interface of a debugger (the GNU GDB), and by modifying the SystemC simulation kernel. On the other hand, the second strategy is intended to be used in further development steps, when the operating system is introduced to validate the cosimulation between HW modules and multitasking SW applications. In this approach, the communication is implemented via interrupts by using the features offered by the operating system. Experimental results are reported on two different case studies to analyze and compare the effectiveness of both the approaches.

Mutation analysis is a widely-adopted strategy in software testing with two main purposes: measuring the quality of test suites, and identifying redundant code in programs. Similar approaches are applied in hardware verification and testing too, especially at RTL or gate level, where mutants are generally referred as faults, and mutation analysis is performed by means of fault modeling and fault simulation. However, in modern embedded systems there is a close integration between HW and SW parts, and verification strategies should be applied early in the design flow. This requires the definition of new mutation analysis-based strategies that work at system level, where HW and SW functionalities are not partitioned yet. In this context, the paper proposes a mutation model for perturbing transaction level modeling (TLM) SystemC descriptions. In particular, the main constructs provided by the SystemC TLM 2.0 library have been analyzed, and a set of mutants is proposed to perturb the primitives related to the TLM communication interfaces.

Vacuum cleaning is a mandatory process when an implementation is verified with respect to a specification modeled by means of formal properties. In fact, vacuum cleaning looks for properties that, passing vacuously (e.g., an implication whose antecedent is always false), may lead verification engineers to a false sense of safety. Current approaches to vacuum cleaning, generally, exploit formal methods to provide an interesting witness proving that a property does not pass vacuously. However, such approaches are as complex as model checking, and they require to define and model check further properties, thus increasing the verification time. This paper proposes an alternative approach, based on fault simulation, that requires neither the definition of new properties, nor the use of model checking. Experimental results show the high efficiency of this approach.

In transaction-level modeling (TLM), verification methodologies based on transactions allow testbenches, properties, and IP cores in mixed TL-RTL designs to be reused. However, no papers in the literature analyze the effectiveness of transaction-based verification (TBV) in comparison to the more traditional RTL approach. The first contribution of this article is the introduction of a functional-fault-model-based methodology for demonstrating the effectiveness of reuse through TBV. A second contribution is the introduction of a similar methodology for efficient property checking which identifies and removes redundant properties prior to assertion-based verification or model checking.

Transaction-level modeling (TLM) has been proposed as the leading strategy to address the always increasing complexity of digital systems. However, its introduction arouses a new challenge for designers and verification engineers, since there are no mature tools to automatically synthesize an RTL implementation from a transaction-level (TL) design, thus manual refinements are mandatory. In this context, the paper presents an incremental assertion-based verification (ABV) methodology to check the correctness of the TL-to-RTL refinement. The methodology relies on reusing assertions and already checked code, and it is guided by an assertion coverage metrics

Separation of HW and SW design flows represents a critical aspect in the development of embedded systems. Co-verification becomes necessary, thus implying the development of complex co-simulation strategies. This paper presents a refinement flow that delays as much as possible the separation between HW and SW concurrent entities (threads), allowing their differentiation, but preserving an homogeneous simulation environment. The approach relies on SystemC as the unique reference language. However, SystemC threads, corresponding to the SW application, are simulated outside the control of the SystemC simulation kernel to exploit the typical features of multi-threading real-time operating systems running on embedded systems. On the contrary HW threads maintain the original simulation semantics of SystemC. This allows designers to effectively tune the SW application before HW/SW partitioning, leaving to an automatic procedure the SW generation, thus avoiding error-prone and time-consuming manual conversions

The always increasing complexity of digital system is overcome in design flows based on transaction level modeling (TLM) by designing and verifying the system at different abstraction levels. The design implementation starts from a TLM high-level description and, following a top- down approach, it is refined towards a corresponding RTL model. However, the bottom-up approach is also adopted in the design flow when already existing RTL IPs are abstracted to be reused into the TLM system. In this context, proving the equivalence between a model and its refined or abstracted version is still an open problem. In fact, traditional equivalence definitions and formal equivalence checking methodologies presented in the literature cannot be applied due to the very different internal characteristics of the models, including structure organization and timing. Targeting this topic, the paper presents a formal definition of equivalence based on events, and then, it shows how such a definition can be used for proving the equivalence in the RTL vs. TLM context, without requiring timing or structural similarities between the modules to be compared. Finally, the paper presents a practical use of the proposed theory, by proving the correctness of a methodology that automatically abstracts RTL IPs towards TLM implementations.

Verification engineers cannot guarantee the correctness of the system implementation by model checking if the set of proven properties is incomplete. However, the use of model checking lacks widely accepted coverage metrics to evaluate the property completeness. The already existing metrics are based on time-consuming formal approaches that cannot be efficiently applied to medium/large systems. In this context, the paper proposes a coverage methodology based on a combination of static and dynamic verification that allows us to reduce the evaluation time with respect to pure formal approaches. The joining point between static and dynamic verification is represented by a fault model targeting functional descriptions. Functional fault simulation and dynamic automatic test pattern generation are used to quickly estimate the capability of properties in detecting functional faults. This provides a first estimation of the property completeness. Then, if necessary, model checking is used to complete the analysis, avoiding the underestimation of the property coverage that can be obtained due to the lack of exhaustiveness of dynamic verification. The proposed approach is theoretically founded and its effectiveness is compared with already existing techniques. In addition, experimental results to confirm the theoretical results are provided

Transaction level modeling (TLM) is becoming a usual practice for simplifying system-level design and architecture exploration. It allows the designers to focus on the functionality of the design, while abstracting away implementation details that will be added at lower abstraction levels. However, moving from transaction level to RTL requires redefining TLM test benches and assertions. Such a wasteful and error prone conversion can be avoided by adopting transactor-based verification (TBV). Many recent works adopt this strategy to propose verification methodologies that allow: (1) mixing TLM and RTL components; and (2) reusing TLM assertions and test benches at RTL. Even if practical advantages of such an approach are evident, there are no papers in the literature that evaluate the effectiveness of the TBV compared to a more traditional RTL verification strategy. This paper is intended to fill in the gap. It theoretically compares the quality of the TBV towards the rewriting of assertions and test benches at RTL with respect to both fault coverage and assertion coverage

The paper describes a functional ATPG that explores the DUT state space by exploiting an easy-to-traverse extended FSM model. The ATPG engine relies on learning, backjumping and constraint logic programming to deterministically generate test vectors for traversing all transitions of the EFSM

Transaction-level modeling (TLM) has been proposed as the leading strategy to address the always increasing complexity of digital systems. However, modeling a complex system completely at transaction level (TL) could be inconvenient when IP cores are available on the market, usually modeled at RT level. In this context, modeling and verification methodologies based on transactors allow one to reuse RTL IP-cores in TL-RTL mixed designs, thus guaranteeing a considerable saving of time. Even if practical advantages of such an approach are evident, mixed TL-RTL designs cannot completely benefit from the well-known effectiveness provided by TLM. Thus, this paper proposes a methodology to abstract RTL IPs into corresponding TL descriptions. The possibility of automating the methodology is deeply analyzed. In particular, the paper shows which abstraction levels can be reached without requiring human intervention, according to the characteristics of the design to be refined. A set of experimental results are finally reported to confirm the effectiveness of the methodology

The paper describes a high-level pseudodeterministic ATPG that explores the DUT state space by exploiting an easy-to-traverse extended FSM model. Testing of hard-to-detect faults is thus improved. Generated test sequences are very effective in detecting both high-level faults and gate-level stuck-at faults. Thus, the reuse of test sequences generated by the proposed ATPG allows to improve the stuck-at fault coverage and to reduce the execution time of commercial gate-level ATPGs.

The use of model checking to validate descriptions of digital systems lacks a coverage metrics. If the set of formal properties defined to prove the correctness of the design is incomplete, the verification can lead to a false sense of security. This paper refines, extends, and compares with other symbolic approaches, a methodology to estimate the incompleteness of formal properties, which exploits a high-level fault model and functional ATPG.

This paper presents an EFSM-based approach for functional automatic test pattern generation (ATPG). It shows how a particular kind of extended FSM (EFSM) can be efficiently traversed by a pseudo-determinist ATPG to control and propagate faults for a functional description of a design. Functional ATPG on such EFSM models have been showed to be more efficient than the ATPG on the original design. However, test sequences generated on such an EFSM can lose their efficacy when simulated on the original description, since they may show some timing discrepancies. To solve this problem, this paper propose a strategy that manipulates the EFSM model.

Logical consequence between properties is generally examined by using theorem proving, which may require a large amount of time and space resources. This paper proposes a faster approach, which analyzes logical consequences by observing the property capability of revealing high-level faults. We consider a set of properties defined to check the correctness of a design (DUV) with respect to the specification. The paper proves that if there is only one property that distinguishes between a faulty and a fault-free behavior of the DUV, and then it cannot be a logical consequence of the remaining properties. It is shown that the reverse implication of such a theorem depends on the selected high-level fault model. According to these theoretical results, the paper proposes a method to analyze logical consequence of properties based on high-level fault simulation and theorem proving.

Recently a lot of multimedia applications have been emerging on portable appliances. They require both the flexibility of upgradeable devices (traditionally software based) and a powerful computing engine (typically hardware). In this context, programmable HW and dynamic reconfiguration allow novel approaches to the migration of algorithms from SW to HW. Thus, in the frame of the Symbad project, we propose an industrial design flow for reconfigurable SoC. The goal of Symbad consists of developing a system level design platform for hardware and software SoC systems including formal and semi formal verification techniques.

More and more functional verification is attracting EDA researchers and industrial companies interested in digital system validation. Coverage metrics and functional fault models are used to guide the generation of functional tests achieving high fault coverage in a relatively short time with respect to traditional gate-level ATPGs. However, what is the effectiveness of test sequences generated at functional level with respect to the more traditional gate-level stuck at fault model? The paper presents an accurate analysis of the correlation between the high-level bit coverage fault model and the gate-level stuck-at fault model.

Many high-level fault models have been proposed in the past to perform verification at functional level, however high-level automatic test pattern generators (ATPGs) are still in a prototyping phase, while very efficient logic-level ATPGs are available. This paper proposes a strategy to map high-level faults into logic-level faults. Thus, functional verification, based on a high-level fault model, can be performed by exploiting the capability of state of the art logic-level ATPGs.

A critical part of the design of HW/SW systems concerns the definition of the HW/SW interface. Such interfaces do not directly map a functionality of the system description, but they are inferred by the characteristics of the selected programmable device (CPUs, DSPs, ASIPs, etc.). Their addition to the design can modify the behavior of the original system, thus their verification is a hard task. The proposed verification methodology joins functional verification and property checking in order to avoid their respective limitations. The methodology is focused on SystemC descriptions that can be automatically synthesized. This is particularly important since commercial model checking tools work on structural hardware descriptions, which can be obtained by performing rapid prototyping of both HW and SW parts of SystemC models. The proposed approach has been verified on the SystemC model that is the reference synthesis example of one of the most powerful SystemC synthesis environment.

The use of model checking to validate descriptions of digital systems lacks a coverage metrics. The set of proven properties can be incomplete, thus not guaranteeing the behavioral checking completeness of the digital system implementation with respect to the specification. This paper proposes a coverage methodology based on a combination of model checking, high-level fault simulation and automatic test pattern generation, to estimate the incompleteness of a set of formal properties. The adopted high-level fault model allows to join dynamic and formal verification.

Verification of the functionality of VHDL specifications is one of the primary and most time consuming tasks of design. However, it must necessarily be an incomplete task because it is impossible to completely exercise the specification by exhaustively applying all input patterns. We present a two-step strategy based on symbolic analysis of the VHDL specification, using a behavioral error model. First, we generate a reduced number of functional test vectors for each process of the specification by using a new analysis metric which we call bit coverage. The error model based on this metric allows the identification of possible design errors represented by redundancies in the VHDL code. Then, through the definition of a controllability measure, we verify if these functional test vectors can be applied to the process inputs when it is interconnected to other processes. If this is not the case, the analysis of the nonapplicable inputs provides identification of possible design errors due to erroneous interconnections. The bit-coverage provides complete statement, condition and branch coverage; and we experimentally show that it allows the identification of possible design errors. Identification and removal of design errors improves the global testability of a design.

Many approaches have been proposed for digital system verification, either based on simulation strategies or on formal verification techniques. Both of them show advantages and drawbacks and new mixed approaches have been presented in order to improve the verification process. Specifically, the adoption of formal methods still lacks a coverage metrics to let the verification engineer get a measure of which portion of the circuit is already covered by the written properties that far and which parts still need to be addressed. The present paper describes a new simulation based methodology aimed at measuring the error coverage achieved by temporal assertions proved by model checking. The approach has been applied to the description of a protocol converter block, and some preliminary results are presented in the paper.

More and more people are starting to use the SystemC description language to model and simulate new designs. This is due mainly to the simplicity and power of the language. The number of models written in SystemC currently available is still very limited and testing SystemC descriptions is still an open issue, since the language is new and researchers are looking for efficient error models and coverage metrics. This paper presents AMLETO, a multi-language environment developed to efficiently test embedded systems and IP-Cores. Using IIR, an HDL language independent representation, it supplies: fast translation from VHDL to SystemC of design descriptions and viceversa, generation and setup of customized TPGs for the design under test and generation of erroneous models capable of simulating the presence of design errors.