Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Tel. : 408-215-6049
Fax. : 408-990-0296
Email: subir@synplicity.com
Tel. : +91-22-576-7722
Fax. : +91-22-572-0290
Email: ramesh@cse.iitb.ac.in
Tel. : +91-22-576-7721
Fax. : +91-22-572-0290
Email: supratik@cse.iitb.ac.in
Tel. : +81-44-754-2663
Fax. :+81-44-754-2664
Email: nakata@flab.fujitsu.co.jp
Tel. : 408-530-4519
Fax. : 408-530-4515
Email: sree@fla.fujitsu.com
Simulation
Degree of Automation
• Interface Definition
• Component Selection
• ASIC & Software Implementation
• Glue Logic Implementation
• PCB Layout Implementation
• Integration & Validation of Software into System
• Debugging
• Board - Manufacturing & Test
• Drawbacks
• Specification Errors - susceptible to late
detection
• Correlating validations at Behavioral & RTL level
difficult
• Common interface between system & hw
designers based on natural language
• Semiconductor houses
• I/O Pad, Processor Core, Custom Logic, Memory,
Peripheral Interface
• IP/Core Suppliers
• Processor Core, Peripheral Interface, Analog
/Mixed Signal blocks (DAC, ADC, PLL)
• System Designer
• Controller, Custom Logic, AMS blocks
• Implication
• Rigorous verification of each individual SoC
component seperately
• Extensive verification of full system
• Requirements
• Efficient Verification Methodologies
• Efficient Tools
• High Level of Automation
Simulation +
Formal Verification
Modify RTL Source
RTL/logic Synthesis
Modify Script
Timing Analysis
NOT OK
OK
ASPDAC / VLSI 2002 - Tutorial 34
on "Functional Verification of
Current Design Cycle
• Methodology
• fixed parameter modeling
• large-scale simulation (expensive)
• synthesis
• large-scale validation (expensive)
• Design cycle iteration expensive for changes in
design parameters
• Does RTL Description satisfy Specification?
• Verification
• Checking that model satisfies specification
• Static and exhaustive checking
• Automatic or semi-automatic
Formal Verification
• Applies to mathematical models and not to real
objects (hence called Design Verification)
• Faithful models essential
• False negatives (Spurious Errors)
• False positives (Models pass but System fails)
Features
Limited and High Level Data Types
• Nondeterminism (arising out of abstractions)
• Concurrency (to structure large systems)
• Communication (for internal and external interaction)
• Fairness (abstraction of real concurrency and
schedulers)
ASPDAC / VLSI 2002 - Tutorial 54
on "Functional Verification of
Example Modeling Languages
• 2-master arbiter,
• reqi - request from Master i
• This machine is nondeterministic
• In Idle state when req1 and req2 arrive.
• Non-determinism due to abstraction
• More than one behaviour for a given input
ASPDAC / VLSI 2002 - Tutorial 62
on "Functional Verification of
Concurrency
• A concurrent (and hierarchical) description of
Counter
Example
Deadlock
• Look at state (1,1)
• Unspecified Receptions
• State (1,1)
• P1 can send message 2
• P2 cannot receive this
• Non executable interaction - 'Dead code‘
• State 3 of P1 cannot be reached at all
ASPDAC / VLSI 2002 - Tutorial 68
on "Functional Verification of
Live lock/Divergence
• An example:
Specification
• Describes unambiguously and precisely the
expected behavior of a design.
• In general, a list of properties.
• Includes environment constraints.
• Symbolic logic or automata formalisms
• Consistency and Completeness
ASPDAC / VLSI 2002 - Tutorial 71
on "Functional Verification of
Specification of Hardware blocks
• Properties and Constraints specify possible
states and transitions
• They state set of possible valid `runs'
• Valid runs are infinite sequences (or trees) of
states and transitions
• Formal specifications are finitistic and precise
descriptions
Classification of Properties:
Safety properties
• "undesirable states are never reached",
• "desirable things always happen".
• Progress or Liveness Properties
• "desirable state repeatedly reached"
• "desirable state eventually reached"
ASPDAC / VLSI 2002 - Tutorial 72
on "Functional Verification of
Examples
Safety Properties
• A bus arbiter never grants the requests to two
masters
• Message received is the message sent
• Elevator does not reach a floor unless it is requested
• At any time traffic is let either in the farm road or on
the highway
• every received message was sent
Liveness Properties
• car on the farm road is eventually allowed to pass
• Elevator attends to every request eventually
• every bus request is eventually granted
• every sent message was received
ASPDAC / VLSI 2002 - Tutorial 73
on "Functional Verification of
Specification Formalisms
• Temporal in nature
• At any time only one units is accessing the
bus
• every request to access the bus is granted
ultimately.
• Two Kinds of TL
M╞ F
EF p = p EX p EX(EX p)
EG p = p EX p EX(EX p)
E (q U p) = p (q EX p)
(q EX(q EX p))
• EF p = p EX(p) EX(EX(p)) . . .
• III step :
• Computation terminates
• EF p Holds in all striped states
• Computation involves backward breadth first
traversal and calculation of Strongly Connected
Subgraphs (cycles)
EG p = p EX p EX(EX p) . . .
I iteration
III iteration
Iteration terminates
ASPDAC / VLSI 2002 - Tutorial 92
on "Functional Verification of
Complexity of CTL model checking
• Classical technique
• Most general and powerful
• non-automatic (in general)
Idea
• Properties specified in a Logical Language
(SPEC)
• System behavior also in the same language
(DES)
• Establish (DES SPEC) as a theorem.
A Theorem
• `follows' from axioms by application of inference
rules has a proof
• Syntactic object
A1, A2, . . . , An
• A1: axiom instance
• An: theorem
• Ai+1 - Syntactically obtainable from
• A1, . . . , Ai using inference rules.
• sum := (x y) cin
• cout := (x y) ((x y) cin)
x3 x3 x3 x3
• Number of nodes can be
1 0 1 0 1 0 1 1
exponential in number of
arguments f = x1.x2 + x3’
4
2 2 2 2
4 5
4
6
6
0 1 0 1
ASPDAC / VLSI 2002 - Tutorial 107
on "Functional Verification of
Variable Ordering Problem
• ROBDD size extremely sensitive to variable ordering
• f = x1.x2 + x3.x4 + … + x2n-1.x2n
• 2n+2 vertices for order 1, 2, 3, 4…2n-1, 2n
• 2n+1 vertices for order 1, n+1, 2, n+2,…n, 2n
• f = x1.x2.x3….xn
• n+2 vertices for all orderings
• Output functions of integer multipliers
Exponential size for all orderings [Bryant ‘91]
• Apply O(|G1||G2|)
• Any binary Boolean op: AND, XOR …
• Compose O(|G1|2|G2|)
• g1(x1, x2, x5) composed with g2(x3, x4)
at position of x2: g1(x1, g2(x3,x4), x5)
• Restrict O(|G|)
• ROBDD for f(x1, x2, …,1, ... xn)
or f (x1, x2, … 0 … xn)
Design 1 Design 2
Design 1
F
A1 B1 A2 B2
• Stop when
• Internal signals reached are known to be
equivalent
• Conclude out1 out2 is unsatisfiable
• So, out1 is equivalent to out2
• Some pairs of signals can be quickly identified as
not equivalent by random simulation
NO VEP: Verified
More pairs
to verify? equivalent
YES pairs
Verify pair, update VEP list
and CEP list,
Restructure circuit
FF FF
Given Equivalence
ASPDAC / VLSI 2002 - Tutorial 130
on "Functional Verification of
Equivalence Checking - Extensions
• For best results, knowledge about structure
crucial
• Divide and conquer
• Learning techniques useful for determining
implication
• State of the art tools claim to infer information
about circuit structure automatically
• Potentially pattern matching for known
subcircuits -- Wallace Tree multipliers,
Manchester Carry Adders
X0 x0 Property
State x0, x1, x2 = 111
is reached infinitely
often starting from
state 000
Clk
ASPDAC / VLSI 2002 - Tutorial 135
on "Functional Verification of
Basic Approaches
• Explicit state model checking
• Requires explicit enumeration of states
• Impractical for circuits with large state spaces
• Useful tools exist: EMC, Murphi, SPIN, SMC …
• Symbolic model checking
• Represent transition relations and sets of states
implicitly (symbolically)
• BDDs used to manipulate implicit representations
• Scales well to large state spaces (few 100 flip flops)
• Fairly mature tools exist: SMV, VIS, FormalCheck ...
x0
• Set of state transitions can be represented
by N (x0, x1, x2, X0, X1, X2) = N (x, X) =
(X0 x0’) (X1 x1 x0)
(X2 x2 (x1. x0)) BDD:
1 0
Reachable
states
S0 S0
B
R
Z Z
• Under-approximation :
• Bug found Real bug
• No bugs found Circuit may still contain bugs
ASPDAC / VLSI 2002 - Tutorial 153
on "Functional Verification of
Related techniques
• Bounded model checking
• Check property within k steps from given set S0 of
states
• S0 F(S0) F2(S0) … Fk(S0)
• Unroll sequential machine for k time steps
PI1 PI2
PI PO
PI0
PS NS
S0 S1 S2 S3
Diagnosis of
Guided vector Coverage Extension
Unverified
generation Analysis
Portions
Input Module
constraints under
verification
Verification engine
• Constraints problem in a case study
• Not specified by the designers
• Defined by verification team through verification process
Result: # of constraints=1818, # of properties=118
(# of constraints < 50 if correctly specified)
// PSE_BGN
Module
// PSE_ERR
[ data == ‘CLD ] Specify constraints by
[ data != ‘CB ]{,1} under
[ data == ‘CB ]
Interface a certain language
// PSE_END
verification
specification
language
ASPDAC / VLSI 2002 - Tutorial 166
on "Functional Verification of
Category of I/F Spec. Languages
• Verification languages
e, VERA, TestBuilder, …
Sim. pattern
generation Spec. sheet
generator
Checker I/F
Coverage generation Synthesis
criteria
Module
Good
pattern
Module
do {
Scenario Comparison
wait();
} while
(!grant);
m1.write(d);
Module Level
converter
word;
nop : N ;
reset : I ;
read(a,d) : Q(a) W* S(d) ;
endword
sentence;
reset [ nop | read ]+ ;
endsentence
read2 read2
read3 read3
sentence;
INITIAL:
reset;
FOREGROUND:
read;
BACKGROUND:
nop;
endsentence
Next states
Initial state S
G1(a,S), G2(a,b,S), G3(a,b,S)
Basic
Model Checker Decision
Model-Check
Procedures
Simplify Hardware
Specification Decision BDD
Procedures
data-structures
Rewrite Arith
Properties
to be
Assert
Verified
Rewriter
ASPDAC / VLSI 2002 - Tutorial 190
on "Functional Verification of
PVS System Overview
Error
Verilog Gate
Behavioral Netlist
RTL Level
Simulation Synthesis
Code Simulation
Host LAN
Emulation
Hardware
Target
Interface WorkStation
Module
Target ViewStore
PC
Board
Target
System
Clock
Power
Source
• Software
• Specialized compiler/synthesizer for mapping
flattened RTL/gate netlists to emulation
hardware.
• Mapper uses Multiway, Multilevel partitioning
s/w to Multi-FPGA, Multi-Board emulator
target architecture.
• Specialized timing analysis for clocking
issues related to Multi-FPGA mapping.
• Execution software.
• Motivation
• Has verification been done comprehensively?
• All expected behavior excited & observed?
• Compare runs based on different approaches.
• Semi-Formal (Simulation + Model Checking)
• Stopping criteria (Intelligent Simulation)
• Formal (Model Checking)
• Adequacy of set of properties?
• A subset of Verilog
• VHDL and Esterel planned
• The back-end language is BLIFF-MV
Specification Language
• AG ((Req = 1) AF (Ack = 1) )
Every Req is greeted with an Ack eventually
• Home page:
• http://www-cad.eecs.berkeley.edu/ kenmcmil/smv/
• Experimental Research tool from Cadence Berkeley
Labs. (McMillan)
• Originally from CMU (McMillan's Ph.D.thesis)
• Modelling Language: Interacting State Machines,
Synchronous Verilog
• Specification Language: CTL, LTL
• Verification Approach: Symbolic Model Checking
• Compositional and Symmetry-based Verification
Strategy
Home page:
http://www-sop.inria.fr/meije/verification/
• Automatic Verification of Finite State
Communicating systems
• Form the basis for Esterel verification
• Developed at INRIA and Ecole de Mines, Sophia
Antipolis
• Based upon process algebra notation
• Modeling Language: CSP/CCS, Esterel (Xeve
tool)
• Specification language: abstract state machines
ASPDAC / VLSI 2002 - Tutorial 236
on "Functional Verification of
Verification Approach
User
Automatic Prover
PROPERTY
P2 : l3 ((b – a) 127 ) ((b – a) - 128)
PROPERTY
P3 : l4 (-(b + 1) 127 ) (-(b + 1) - 128)
PROPERTY
P4 : l5 ((a + b) 127 ) ((a + b) - 128)
ASPDAC / VLSI 2002 - Tutorial 244
on "Functional Verification of
Examples
• Leader-Election algorithms
• Problem:
• Developing concurrent reactive systems is
hard! (many possible interactions); Traditional
testing is of limited help! (poor coverage);
Scenarios leading to errors are hard to
reproduce!
• Alternative: Systematic StateSpace
Exploration
2 x 2 Switch 2 x 2 Switch
2 x 2 Switch 2 x 2 Switch
RAF0
Write Read
Control Control
(WC) RAF1 (RC)
WAF
Cell Counter
(wBC)
Copy Cell
Flag ccf
• 2 X 2 switch
• multiple clocks: faster external HW_clk; slower
internal SW_clk
• 1 cell-buffer shared by 2 ports
• address-FIFO for supplying cell addresses
• addresses recycled
• ~ 20 Communicating Processes
• ~1500 lines of VHDL code at high-level
• ~20000 lines of VHDL at gate-level after synthesis
…...
iHW0_bword(t)(0,i) = iHW0_cell_word(t) AND
IF n > 1 THEN
(i = n-1 IMPLIES iHW0_cycle_counter(t+1) =
iHW0_cycle_counter(t)^(n-1,1)
o b1)
ELSE iHW0_cycle_counter(t+1) = b1
ENDIF
END sp_conversion_theory
I/F specification
MPU DSP Module
I/F Pattern/property gen.
Integrated
ROM Module verification
DRAM I/O engine
GDC Checker
Design Black-box
White-box Verification
under spec.
spec. scenario
verification I/F spec.
Design Input
Properties Scenarios
model constraints
• Basic strategy
• As formal as possible*
• Semi-formal verification for the whole unit
• Formal verification for an important unit:
instruction decoder
* Simulation completed before this attempt
ASPDAC / VLSI 2002 - Tutorial 298
on "Functional Verification of
Verification of MU (1st)
41 constraints
4 properties
augmented MU
by
Insufficient
0-In Search
constraints
Pseudo models
(I/F spec. lang. and HDL)
Test
Testpatterns
pattern I/F spec. HDL
augmented
by
MU
0-In Search
clock
m0_valid
m1_valid
i0_valid
m0_rd xxx 0xf
m0_rs1 xxx 0x0
m1_rd 0x0
i0_rd xxx 0x0
e_wait
Converter
Properties/constraints
(HDL+0-In Check)
0-In compile
Model checker
Note:
No abstraction/
reduction required
in this example
o1
i1 o2
P Q
i2
Decompose
Guarantee Assumption
o1 o1
P Q
i2 i2
Assumption Guarantee
Design Spec
Behavioral (Behav Level
simulator Description)
Block System
Constraints
= Properties
Interface
Target System
Blocks Blocks
Block = System
Properties Constraints
Query-Specific
Reduction Results &
Error Traces
Query
Template
Results Display
Library
Inputs Outputs
HDL SIMULATION
Target Areas Current Cycle’s HDL
Weights/Probabilities
Corner Case Tests Signal & Register Values
Structured Sequences
e-language
Information
Semiformal on
Amplification New Firings
Tool
Spec.
design
support
Validation
Wrong Misunderstanding
Formalization
Does specification
specification Isof
specification defined
specification
match requirement? clearly?
We need:
• Methodology for specification analysis
• Standard language with formal semantics
ASPDAC / VLSI 2002 - Tutorial 327
on "Functional Verification of
UML
UML is:
• Standard in object-oriented software design
• Devised and designed under the object-oriented
analysis theory
• A set of diagrams that represent components of a
system and relationships among them
• Modeling a system from multiple angles with
use-case/class/object/state/sequence/
activity/collaboration/component/deployment
Requirement Use-case
Use-case Sequence
diagram diagram
Requirement Use-case Use-case
Message
Channel
Encoder Noise Decoder
Systematic Errors
code
Sender <<extend>>
Send Encode B
Receiver
Receive
Decode A <<extend>>
Decode
Channel
Decode B <<extend>>
Assign(r1)
Generate()
s1: syndrome
IsZero()
Calc_coef(s[])
Calc_loc(coef)
Correct (location, value)
Calc_error(root)
ASPDAC / VLSI 2002 - Tutorial 342
on "Functional Verification of
Complete Class Diagram
Decode
Input for A Input Coefficient * Polynomial
+Receive() +Receive()
Root * +Assign(val)
Input for B
Received word Received
+Receive()
-Code length code
-Corrections polynomial
Galois field +Correct(loc, val)
Error location polynomial
+Order
+Calc_coef(syndrome)
+sum() Syndrome * -Calc_loc(coef)
+multiply()
+divide() -Index
+exp(power) -Value
+IsZero() Error loc. poly. for A Error loc. poly. for B
-Calc_error(root) -Calc_error(root)
ASPDAC / VLSI 2002 - Tutorial 343
on "Functional Verification of
Analysis and Design Flow
• Step 1 Extract functions
• Step 2 Build structure
• Step 3 Enumerate scenarios
• Step 4 Identify hardware modules
• Input: class diagram
• Flow
• Correspond methods to hardware modules
• Define messages from relationships among
modules
• Define interfaces from messages
• Outputs: class diagram, block diagram (in
hardware design context)
ASPDAC / VLSI 2002 - Tutorial 344
on "Functional Verification of
Methods to Hardware Modules
• Disband classes
• Map each methods to modules
• Re-bundle modules if possible
Error loc. poly.
Coefficient calculator
+Calc_coef(syndrome)
-Calc_loc(coef) Error loc. calculator
Galois field
+Order Galois adder
+sum()
...
+IsZero()
Galois 0 checker
HW
design
C++ / HDL
ASPDAC / VLSI 2002 - Tutorial 347
on "Functional Verification of
Block Diagram of Decoder
Correction
Code A
receiver
Assignment
Code B
receiver
Error location
Coefficient calculation for
calculation Code A
Error location
Location calculation for
calculation Code B
enable
ASPDAC / VLSI 2002 - Tutorial 348
on "Functional Verification of
Conclusions
• Is object-oriented analysis by UML effective?
• For common understandings
• For validation
• For analyses of specification changes
• http://www.comlab.ox.ac.uk/archive/formal-methods.html
• http://www.csl.sri.com
• http://dimacs.rutgers.edu/Workshops/SYLA-Tutorials/program.html
• http://www-cad.eecs.Berkeley.edu/ vis
• http://godel.ece.utexas.edu/texas97-benchmarks/
• http://citeseer.nj.nec.com/
• http://www.rational.com/uml (Universal Modelling Language HOME-PAGE)
Syntax
• Atomic propositions are formulae
• If f, g are formulae then so are
• ¬f, f g, f g, f g, f g
• □ f - Henceforth f
• ◊ f - Eventually f
• f U g - f until g
• f W g - f unless g
• Of - next f
• state formulae - no temporal operators
• Notation: s ╞ A
stands for A holds in s.
• s ╞ A iff (s ,0) ╞ A
• (s , j) ╞ A - defined inductively
• Base case:
(s , j) ╞ f for any state formula f iff f holds in
the state s [j]
• (s , j) ╞ f W g iff (s , j) ╞ f U g or
(s , j) ╞ □ f
• (s , j) ╞ Ο f iff (s , j + 1) ╞ f
• □(p □q)
Whenever p holds there is a future instant in
which q holds
• □◊p
p holds infinitely often
• ◊□p
p holds at all but finitely many positions
• □¬(farm_go high_go)
• □ (farm_car ◊ farm_go)
• □ (mem_rd ◊ mem_ack)
• It is a model of □ p.
ASPDAC / VLSI 2002 - Tutorial 404
on "Functional Verification of
Another Example
Check whether the following automaton satisfies □
◊¬p
Home page:
http://www.cadence.com/datasheets/formalcheck.html
• Commercial model-checking tool (Cadence)
• Originated from COSPAN (Bell Labs.)
• Modeling languages: synthesizable subsets of
Verilog and VHDL
• Specification Language: FQL – FormalCheck Query
language (A variant of LTL, Syntax same as HDL)
• Verification Approach: Automata Containment
• Powerful compositional reduction strategies
• Clever representation for specifications
• after { Req == 1 }
eventually { Ack == 1 }
• after { Timer.Start == 1 }
always { Timer.counting == 1 }
unless { Timer.Restart == 1 }
• after { Counter.bit[0] == 1 }
eventually { Counter.bit[0] == 0 }
within -delay 0 -duration 2
{Clock.rising }
Buy a juice
Customer
Refill products
Supplier
Gather changes
Services
Employee PC
uses
Name: string Name: string
ID: integer 0..1 1..* CPU: string
Arrived Up(fl)
Descend Arrived
to floor fl Stop
Down(fl) timer=0
inc timer
[timer=time_out]/Down(0)
ASPDAC / VLSI 2002 - Tutorial 424
on "Functional Verification of