Beruflich Dokumente
Kultur Dokumente
Vigyan Singhal
Harry D. Foster
Agenda
• Jasper introduction
• Model checking
• Block-level verification
- High-level requirements
- Formal testplan
- Coverage
• Formal Testplanner
• PSL (Property Specification Language)
1
Jasper Design Automation
• Management
- Kathryn Kranen President and CEO (Verisity, Quickturn)
- Vigyan Singhal CTO (Cadence, UC Berkeley)
- Harry Foster Chief Methodologist (Verplex, HP)
- Craig Cochran VP Marketing (Synopsys)
- Craig Shirley VP Sales (Verisity)
- Nafees Qureshy VP Engineering (CoWare)
2
Sequential Satisfiability (model checking)
Is there a sequence of input assignments such that
p is 1 at any finite time time?
00 q
a
00 p
00 q
a 10
00 p
3
Sequential Satisfiability (model checking)
Is there a sequence of input assignments such that
p is 1 at any finite time time?
10
10 00 00 q
a 10
00 00 p
10 11 q
a
00 01 p
4
Sequential Satisfiability (model checking)
Is there a sequence of input assignments such that
p is 1 at any finite time time?
01
01 11 01 q
a 11
11 01 p
02 02 q
a
12 p
10
5
Sequential Satisfiability (model checking)
Is there a sequence of input assignments such that
p is 1 at any finite time time?
00 q
a
00 p
11
Properties
and
Constraints Verified
Model
Model or
Checker
Checker CounterExample
p
Design under test q
• Properties - Specification
• Constraints - Assumptions needed to prove
Properties
• Design under test - Implementation
12
6
Functional Verification Today
13
SRAM CPU
Chip Chip testbench
Test IP I/F SRAM CPU
Refine &
Partition Test IP I/F
FIFO Algorithm M
Super- U
X
Most of today’s verification
Block Controller Sync is performed at the chip level
Unit or FSM
Module
Timer Timer Actions
FSM
Actions
FSM
7
What is necessary for FV to succeed in industry?
1. High Return-on-Effort
- Measurable proof of quality
2. Ease of use (FV expert not require for successful)
- Encapsulate formal expert knowledge into the tool
- Strong engines + advance abstraction techniques
- Guide the user to success
3. Sophisticated debug capabilities
- Design illumination--enabling user to learn the design
4. Means to overcome the “blank page” syndrome
- Specification challenge
- Methodology challenge
5. Metrics to measure progress and success
15
16
8
JasperGold Manages Proof Capacity
Tunneling, Monitors, and Abstraction
High-level requirement
Inputs Outputs
JasperGold Refines the Proof Space Counter
17
RTL Design
High-Level
High-Level Design
Design
Block
Jasper Formal requirements
requirements
Testplanner™
• Static, exhaustive
JasperGold™ proofs without
Knowledge base of simulation
design-specific methodology
and requirements templates • Proof navigation
Precognitive
Precognitive Proof
Proof
TM suggests next steps
Engine
Engine TM engines
engines
• Isolates the root cause
JasperGold
of each bug to the
Proving Environment TM
faulty line of RTL
- OR -
Functional Bugs Proven
Isolated 100% Correct
Interactive, context-sensitive
debugging environment
18
9
In-line assertions (PSL example)
module btrack (clk,allocate,deallocate,set);
19
Tx
One-hot
Increment output
by 1
TLP A A
Seq_num
From Tx FIFO Over
Fabric Flow To
LCRC A PHY
Packet
Retry buffer arbiter
From Rx
RX
DLLP
10
Illustrating with an Example
AHB to MSIF
bridge
X ?
From AHB
Master
To
Wishbone
via MSIF
21
Data Transport
3 2 1
TLP
Tx Seq_num A 1 2 C
From
Wishbone LCRC
Packet To
C B A Retry buffer arbiter
PHY
From
Rx
DLLP
RX DLL
C
B ×
write_ptr A read_ptr
22
11
HLR example
always @(posedge clk or posedge rst) datain dataout
if (rst) begin din[7:0] dout[31:0]
wrPtr <= 4’d0; rdPtr <= 4’d0;
for (i = 0; i < 4; i = i + 1)
stored[i] = 64’b0;
end else begin
if (datain) begin
wrPtr <= wrPtr + 4’d1;
store[wrPtr] <= din;
end
if (dataout) rdPtr <= rdPtr + 4’d1; C
end B ×
wrPtr A rdPtr
store[]
prove { ~ ((dataout) && (dout != store[rdPtr])) }
prove { ~ (((wrPtr + 4’d1) == rdPtr) && ~dataout && datain) }
prove { ~ ((wrPtr == rdPtr) && (dataout)) }
High-level
Requirements
• End-to-end
• Black box
• Based on design intent Intent
• Are harder to prove Implementation
Increment
Low-level One FIFO FIFO
By 1
Assertions Hot Overflow Overflow
• Localized
• Implementation-specific
• Can find bugs faster
Design Behavior
24
12
High-Level Formal vs. Conventional Formal
JasperGold
operates here
High-Level
µ-architecture Specification Requirements
Intent
Implementation
25
Requirements
checklist
4
Requirements
inputs Formal
outputs 5
description
Block
26
13
Formal Testplan Example
• Transmit Path (tx)
- Packets should not lose ordering or get dropped
- Packets should not get duplicated
- Packets headers should not get corrupted
- Link Credits sent are less than or equal to Network Credits received
- No Link Credits received from the network are lost (every credit is
sent downstream, or recorded locally)
- No packets are retried until timer expires
- Any packet not ack’ed is retried
- Retried packets should not lose ordering or get dropped
- Retried packets should not get duplicated
• Receive Path (rx)
- Alignment
- Packet Latency
- …
27
28
14
JasperGold Proving Environment - Sophisticated Debug
29
30
15
Control, data transport
• Concurrent
• Handles multiple streams
• “Corner-case” bug is missed because randoms never excited that
timing combination
• Bug example: during the first 3 cycles of a transaction start from one
side of the interface, a second transaction came in on the other side of
the interface and changed the config register.
• Design examples: arbiters, standard interface protocols (PCI), DMA
controller
31
Data transform
• Sequential, functional
• Single-stream
• “Corner-case” bug is missed because testplan was not complete (spec
was large)
• Bug example: the IFFT result is incorrect if both inputs are negative
• Designs: floating point unit, graphics shading unit, convolution unit in a
DSP chip, MPEG decoder
32
16
On-chip Bridge (e.g. AHB-AHB)
HTRANSA
Master A HREADYA
HRESPA HTRANS
AHB-AHB
bridge HREADY
Slave
HRESP
HTRANSB
Master B HREADYB
HRESPB
• HLRs
- Bridge transfers data correctly from one end to the other (accounting for 16-bit to 64-bit data
width change, and splitting of long burst packets)
- Bridge is fair to both masters
- …
• Complexity
- Timing relationship between the two masters
- Error responses from the slave with arbitrary timing relationship to what is happening in the
master
• Corner-case
- Bridge locks up if slave issues error on 2nd cycle of a 4-beat request from master A, and
master B makes a new request on the same cycle the error is passed on to master A
33
• Today, design concurrency and complexity are explored late in the flow
• The problem is that at this state massive design interdependencies
exist fully-developed RTL
• Late stage bugs can have significant collateral damage
System-level
Verification
Block-level
Verification
Time
34
17
JasperGold Delivers “Provably Correct Design”
100%
verified
Arbitration Fairness
Packet Ordering
Error Handling
Data Integrity
Flow Control
time
High-Level Requirements
from Micro-Architecture Spec.
“Prove-as-you-design”
Incrementally add design functionality, prove its correctness, and
then ensure that it remains correct through final regressions
35
Typical Debug
Bugs Remaining
Bug-Hunting
Assurance
Find Last bug
Time
“By far, we [at Intel] have found that the greatest value of
formal verification is assurance” – John O’Leary, Intel
Full proof provides the most value
36
18
Design and Verification Flow
Design Validate
Spec
SRAM CPU
Chip Chip testbench
Test IP I/F SRAM CPU
Refine &
Partition Test IP I/F
FIFO Algorithm M
Super- U
X
Most of today’s verification
Block Controller Sync is performed at the chip level
Unit or FSM
Module
Timer Timer Actions
FSM
Actions
FSM
Simulation Flow
Design Sanity Create
System Simulation
Blocks Check Testbenches
Months
Weeks
38
19
Retrun on Investment
TAPE More
OUT!
Easy Bugs Corner Case Bugs Corner
Simulation Methodology Cases!
Block Unit-level
System-level Testing – Simulations Silicon Testing
Design Testing
Identify Block
Tape-out Early
Identify Fix
Complete Verification with
JasperGold during Design
Tape-out Right Re-run All
0 6 10 26 32 Weeks*
39
• Higher returns
- Block verification on real-sized designs
- Expectation and predictability of results
- For even higher results:
• Interactivity and methodology support
• User creativity always adds more
• Higher investment from the user
- Lower investment ) marginal payoff
- Cannot be factored in project schedules
- Need predictable effort estimates
- User interaction is acceptable, if effort can be quantified and
estimated up front
- Today, simulation can be replaced: launch-and-forget will not
replace simulation
- Don’t short-change formal by applying only to local assertions
40
20