Digital Design Verification Course Instructor Debdeep Mukhopadhyay Dept

Digital Design Verification Course Instructor: Debdeep Mukhopadhyay Dept of Computer Sc. and Engg. Indian Institute of Technology Madras 9/15/2020 IIT Madras, Even Semester Course No: CS 276 1

Verification ? ? ? • What is meant by “Formal Property Verification”? • Options : 1. Formal method of verifying a property 2. Verifying of Formal Properties 9/15/2020 • Ambiguity of English (natural) Language • Formal Specifications • Bugs are more costly than transistors !!! IIT Madras CS 276 2

Verification? ? Process used to demonstrate that the intent of design is preserved in its implementation l 70% of design effort goes behind verification l Verification Environment DESIGN UNDER VERIFICATION 9/15/2020 IIT Madras CS 276 3

Testing vs Verification l Testing verifies that the design was manufactured properly l Verification ensures that a design meets its functional intent HW Design Spec. verification Manufacturing Netlist Testing Silicon Reconvergence Model: Conceptual representation of the verification process 9/15/2020 IIT Madras CS 276 4

Types of Verification l Formal Property Verification l l Formal Technique to verify formal properties Verifies all properties of the design satisfy the properties Static Property Verification Assertion Based Verification l l l 9/15/2020 Properties checked during simulation Verification confined to those areas that are encountered during simulation Dynamic Property Verification IIT Madras CS 276 5

What is being verified? l Equivalence l Checking Mathematically proves that the origin and output of a transformation of a netlist are logically equivalent Synthesis RTL Or Or netlist Equivalence netlist Checking 9/15/2020 IIT Madras CS 276 6

Property Checking Assertions: Characteristics of a design RTL coding RTL Specifications assertions Interpretation Property Checking 9/15/2020 IIT Madras CS 276 7

Functional Verification l Ensures that a design implements intended functionality l Can show but not prove RTL coding Specification RTL Functional Verification 9/15/2020 IIT Madras CS 276 8

What is a test-bench? l Simulation code used to create a predetermined input sequence to a design and check the output response l Verification Challenge: What input patterns are to be applied to the DUV l What is the expected output response of a proper design under the applied stimuli l 9/15/2020 IIT Madras CS 276 9

Types of mistakes Fail Type II (False Positive) Bad Design Good Design 9/15/2020 Pass Type I (False negative) IIT Madras CS 276 10

Verification Methodolgies l Linting l Simulation: Most common tool for verification l Approximation of reality: 0, 1, x, z l Requires stimulus l Responses are validated against design intends 9/15/2020 IIT Madras CS 276 11

Event Driven Simulation l Simulators are always slow l Outputs change only when an input changes 0. . 0 1. . 1 9/15/2020 1. . 1 IIT Madras CS 276 12

1. . 0 0. . 1 1. . 1 The simulator could execute only when one of the inputs change assign out = in 1 ^ in 2; 9/15/2020 //verilog code snipet IIT Madras CS 276 13

What if both the inputs change? l Logical world vs physical world l Unknown or ‘x’ state l Black box simulation 9/15/2020 IIT Madras CS 276 14

Cycle Based Simulation 1 DFF AND Q 1 S 1 0 0 OR XOR DFF S 3 Q 2 S 2 • Assume Q 1 holds a zero and Q 2 holds a 1 initially • An Event Driven simulation requires 6 events and 7 models • If we are interested only in the final states of Q 1 and Q 2, the simulation could be optimized by acting only on the events for Q 1 and Q 2 • Simulation is based on clock cycles 9/15/2020 IIT Madras CS 276 15

CBS l When the circuit description is compiled all combinatorial functions are collapsed into a single expression that can be used to determine all the ff values depending on the current state of the fan-in flops l Ex: 9/15/2020 S 3 = Q 1 (check) IIT Madras CS 276 16

l During simulation, whenever the clock input rises the value of the ff-s are updated using the input value returned by the pre-compiled combinatorial input functions l CBS requires generation of 2 events and execution of one model l The number of logical computations does not change 9/15/2020 IIT Madras CS 276 17

l l l Gain when time required to perform logic computations are smaller than that required to schedule intermediate events Thumb rule: Large number of registers changing state at every clock cycle Loss: All timing and delay information is lost Assumes that setup and hold time are met Use a static timing analyzer Dynamic and static timing analysis 9/15/2020 IIT Madras CS 276 18

l Synchronous l Asynchronous inputs, latches or multipleclock domains cannot be simulated accurately 9/15/2020 IIT Madras CS 276 19

l Co-simulators l Avoid l Use 9/15/2020 wave-form viewers assertions IIT Madras CS 276 20

Tasks of a Verification Engineer l Development of the formal property specification l Check the consistency and completeness of the specifications l Verifying the implementation against the formal property specifications 9/15/2020 IIT Madras CS 276 21

Example of a priority arbiter mem-arbiter(input r 1, r 2, clk, output g 1, g 2) l Design Intent: l 1. 2. 3. 9/15/2020 Request r 1 has a higher priority. When r 1 goes high, grant g 1 goes high for the next two clock cycles When none of the request lines are high, g 2 is high in the next clock cycle The grant lines g 1 and g 2 are mutually exclusive IIT Madras CS 276 22

Writing Formal Specifications l Lots of languages l Temporal Languages Propositional logic l Temporal Operators: truth of propositions over time l Concept of time l 9/15/2020 IIT Madras CS 276 23

Linear Temporal Language (LTL) l X: l l F: l 9/15/2020 The Next Time Operator The property Xφ is true at a state if φ is true in the next cycle, where φ may be another temporal property or boolean property. The Future Operator The property Fφ is true at a state if φ is true at some time in the future IIT Madras CS 276 24

LTL (contd. ) l G: l The property Gφ is true at a state if the property φ is always true l U: l 9/15/2020 Global Operator Until Operator The property φUΨ is true at a state, if Ψ is true at some future state t, and φ is true at all states leading to t. IIT Madras CS 276 25

Property 1 in LTL 1. Request r 1 has a higher priority. When r 1 goes high, grant g 1 goes high for the next two clock cycles LTL Spec: G[ r 1 => Xg 1 Λ XXg 1] G : The property must hold at all states 9/15/2020 IIT Madras CS 276 26

Property 2 & 3 in LTL 2. When none of the request lines are high, g 2 is high in the next clock cycle: 3. The grant lines g 1 and g 2 are mutually exclusive: 9/15/2020 IIT Madras CS 276 27

Specification of correctness? l Very l No difficult to check. formal property to check against l However we may check for contradiction among the properties 9/15/2020 IIT Madras CS 276 28

In-consistencies Model: GAME Environment: r 1 is high at time t but low at time (t+1), r 2 is low at time t and (t+1) Hence, g 1 should be high at time (t+2), by property 1 g 2 should be high at time (t+2), by property 2 G[ r 1 => Xgproperty 1 Λ XXg Contradicts 3. 1] Environment Wins 9/15/2020 IIT Madras CS 276 29

Removing the In-consistency Model: GAME Environment: r 1 is high at time t but low at time (t+1), r 2 is low at time t and (t+1) Hence, g 1 should be high at time (t+2), by property 1 g 2 should be low at time (t+2), by property 2 G[ r 1 => 1 Λ XXg 1] Does not Xg contradict property 3. Environment Does not Win 9/15/2020 IIT Madras CS 276 30

Is the specification complete? Chicken and egg problem l Formal vs structural coverage l Look back at: l G[ r 1 => Xg 1 Λ XXg 1] Ask the following questions 1. Is g 1 ever high? 2. Is g 2 ever high? 3. Is r 1 required? 4. Is r 2 required? 9/15/2020 IIT Madras CS 276 31

Design under verification r 1 FF FF g 1 g 2 r 2 9/15/2020 IIT Madras CS 276 32

Verilog Code Snipet l module arbiter(r 1, r 2, g 1, g 2, clk); input clk, r 1, r 2; output g 1, g 2; reg g 1, g 2; always @(posedge clk) begin g 2<=r 2 & ~r 1 & ~g 1; g 1<=r 1; endmodule 9/15/2020 IIT Madras CS 276 33

How do you verify? ? Assertion based verification (ABV) l 1. 2. 3. Simulation based verification More close to the designer (as he has to learn less new techniques) More close to the old simulation framework Formal based verification (FBV) l 1. 2. 9/15/2020 Formal techniques to verify properties Mathematical Techniques involved IIT Madras CS 276 34

ABV Property Specs Property Checker Test Generation Engine Simulation Platform Clk gen r 1 g 1 DUV Master 1 r 2 Master 2 g 2 Test Bench DUT interface 9/15/2020 IIT Madras CS 276 35

Design under verification r 1=0 FF FF g 1=0 g 2=0 r 2=0 Contradicts the second property that g 2 is default grant!!! 9/15/2020 IIT Madras CS 276 36

Hurdles of ABV l Generating the test cases which lead to all the scenarios l Directed Testing vs Randomized Testing l We shall see one such language, called “e” in this course 9/15/2020 IIT Madras CS 276 37

FBV (FSM Extraction) State labels : g 1, g 2 Input Labels: r 1, r 2 r 1 FF 01 00 g 1 01 00 1 x 1 x FF 0 x 0 x g 2 10 r 2 11 1 x 1 x FSM models DUV 9/15/2020 IIT Madras CS 276 38

FBV (contd. ) 01 Model Checker Formal Properties 00 01 00 1 x 1 x 0 x 10 0 x 11 1 x State labels : g 1, g 2 Input Labels: r 1, r 2 9/15/2020 IIT Madras CS 276 39