Using SystemVerilog Assertions in Gate-Level Verification Environments

Transcription

1 Uing SytemVerilog Aertion in Gate-Level Verification Environment Mark Litterick, Verilab, Munic, Germany. Abtract Real-world requirement uc a multiple clock domain and low-power mode of operation, including frequency and voltage caling, often neceitate gate-level Sytem-on-Cip (SoC) verification environment to complement te tandard RTL baed imulation. If te verification environment relie on aertion-baed cecker to validate grey-box operation ten gate-level imulation will alo benefit from reue of tee aertion. Ti paper provide an overview of te problem related to gate-level timing and connectivity wit a focu on ow tee affect te operation of te SVA code. A metodology i preented tat enable reliable operation and reue of te SVA in imulation environment tat upport RTL and gate-level implementation of te deviceunder-tet. Te paper alo dicue SVA timing ceck tat can be added to te gate-level environment to improve cecking and coverage. 1 Introduction In order to maximize te benefit of an aertionbaed verification metodology in a imulation environment tat upport bot RTL and gate-level implementation of te device under tet (DUT), SytemVerilog Aertion (SVA) [1] mut take account of gate-level connectivity and timing iue. Ti paper provide an overview of te generic gate-level iue wic directly affect te operation of propertie and aertion. A metodology i preented tat enable ucceful reue of aertion (from te RTL environment) and upport enanced cecking of pecific functional feature targeted for validation by back-annotated gate-level imulation. Te paper ten dicue upplementary timing ceck written in SVA tat can be ued to enance te quality of te gate-level cecking and functional coverage. Example SytemVerilog code implementation are provided to illutrate te olution and retriction. 2 Gate-Level Simulation SoC deign wit feature uc a complex clock relationip and elaborate power management (including dynamic frequency caling and multivoltage iland) often neceitate gate-level imulation to upplement te RTL verification environment [2]. In uc imulation environment te RTL model for te device i replaced wit a gatelevel netlit uing back-annotated timing information wic i extracted after tak uc a yntei, clock-tree inertion, can inertion and place-androute are complete. Gate-level imulation are ued to: Validate Static Timing Analyi (STA) Verify critical pat timing Verify reet operation witout RTL filtering Detect dynamic timing defect Gate-level imulation ould not be ued to replace STA, by attempting to dynamically validate all timing pat in te deign. Nor ould gate-level imulation be ued to ceck for correct yntei; tat role i performed by equivalence cecking. Were gate-level imulation are deemed neceary it i important to apply an appropriate metodology to maximize te return on effort: Identify feature targeted for gate-level validation in te verification plan Identify correponding functional coverage point and upplement if required Hit tee feature ard during imulation wit intentional and tre tet cenario Do (only) a few moke tet for normal operation Only ue accurate pot clock-tree yntei timing 3 Role of Aertion Aertion-Baed Verification (ABV) i a metodology for improving te effectivene of a verification environment. ABV involve te definition of propertie, wic pecify te expected beavior of te deign, and cecking te aertion of tee propertie by imulation or formal analyi. Aertion are ued to clarify pecification Copyrigt 2006 Verilab & DVCon DVCon 2006

2 requirement, capture deign intent and to validate correct operation and uage of te deign. Te benefit of ABV include improved error detection and reduced debug time due to increaed obervability. Refer to [3] for more detail on aertion-baed deign and verification metodologie. In ti analyi we are mainly concerned wit aertion-baed cecker tat monitor grey-box intermodule interface; owever te requirement for aertion embedded in te RTL ource are alo dicued. In te context of gate-level imulation tere are tree main role of aertion tat need to be conidered: reue of aertion from RTL verification environment additional aertion dedicated to gate-level ynteizable aertion 3.1 Reuing Aertion in Gate-Level If a verification environment relie on aertionbaed cecker to validate internal operation or meaure functional coverage ten it i important tat tee aertion continue to operate if gate-level imulation are required. Oterwie te benefit of ABV are lot and correponding level of cecking during gate-level imulation i muc le tan te original RTL level environment - wic mean defect could go un-noticed or be difficult to debug. We mut enure tat tee aertion operate reliably wen reued in te gate-level environment; in particular tere mut be no fale failure or mied defect due to ignal integrity and timing iue. Many of te connectivity and timing problem detailed in [2] are till relevant for gate-level SytemVerilog imulation in general; owever mot are not an iue for SytemVerilog Aertion ince tey tend to be yncronou and paive. Te mot important gate-level attribute wic directly affect te reliability of aertion are clock-tree ditribution and negative old-time Clock-Tree Ditribution A gate-level netlit a te clock net replaced wit a buffer-tree tructure during a back-end proce called clock-tree yntei. Te clock tree a many buffer (and/or invertor) wit te drive-trengt and fanout load balanced uc tat te clock edge arriving at eac flip-flip, witin te ame clock domain, ave an acceptable clock-kew relative to one anoter. A ide effect of clock-tree yntei i tat te gate-level module ierarcy will typically ave multiple clock port, one of wic will retain te original port name, but none of tee clock port will be on te terminu of te clock tree a own in Figure 1. Figure 1: Clock Tree Ditribution Since data ignal are only guaranteed to meet te etup time for te clock edge at te balanced terminal point of te clock tree, aertion tat ue te module clock port can ave unreliable ampling a own in Figure 2. A a reult tee aertion can indicate fale failure or pae due to incorrect equence timing or corrupted data reg module ignal DATA old module clock-tree delay unreliable ampling Figure 2: Incorrect Sampling Uing Port Clock An example of te type of SVA property tat could generate a fale failure under tee condition i own in Figure 3. In ti cae count i expected to increment wenever it cange; owever, ince ome of te bit ave canged to te new value and ome ave not wen te value i ampled, te aertion fail. property clk)!$table(count) -> (count == $pat(count)+1 b1); etup Copyrigt 2006 Verilab & DVCon DVCon 2006

3 port reg count[5:0] b bit cange at different time Figure 3: Fale Aertion Failure An example of te type of SVA property tat could generate a fale pa under tee condition i own in Figure 4. In ti cae ig_b i meant to be ig wen ig_a i ig; owever, te defective ig_b i one clock late, but ince te aertion incorrectly ample te value of ig_a, te aertion pae. property clk) ig_a -> ig_b; Figure 4: Fale Aertion Pa For reliable operation te clock ued for te SVA mut be connected to a terminal point of te clock tree. For SVA tat i connected to te DUT uing te bind tatement ti can be acieved by connecting to te clock port of a regiter in te appropriate clock domain a own in Figure 5. Note tat ti connection i conditional (baed on a `define RTL in ti example) ince te regiter doe not exit in te RTL netlit. bind tb.top.mod va_ck va_ck_int ( `ifdef RTL.clk (clk), `ele // GATE.clk (regiter.ck), `endif.ig (ig),.bu (bu)); Figure 5: Conditional Binding to Clock b u $ample(bu) b b port reg ig_a ig_b ould ave failed ere... u u fale pa For SVA tat i coded in-line wit te RTL; it i reaonable to expect SVA-aware yntei tool to (optionally) preerve te aertion in te generated gate-level netlit and to enure tat te clock i connected to te terminu of te clock tree wilt automatically preerving all oter aertion ignal in te netlit. Downtream tool wic read te netlit would alo ave to recognize te SVA contruct and ignore tem Negative Hold-Time In a normal model for a flip-flop te data i expected to be table ome time before te active clock edge (te etup-time) and eld table until ome time after ti clock edge (te old-time) a own in Figure 6(a). Mot target librarie upport te concept of Negative Hold-Time (NHT); wic allow data intended for te clock cycle to cange prior to te current clock edge a own in Figure 6(b). D etup + Figure 6: Hold-Time Negative old-time eae te tak of clock-tree yntei ince tey enable reliable operation wit increaed clock-kew. Te output from a flip-flop wit an early clock, intended for te clock cycle, i allowed to arrive at te input to a flip-flop wit a late clock prior to te clock edge witout violating te timing (provided it arrive after te negative old-time) a own in Figure 7. early early Q / late D etup late late Q + old (a) Poitive Hold-Time clock-kew current previou old Figure 7: Clock-Skew wit NHT current Te problem for SVA in te context of backannotated gate-level imulation wit negative oldtime i tat ampling in te preponed region i not reliable. Figure 8 illutrate te problem, wic D etup + _ old (b) Negative Hold-Time Copyrigt 2006 Verilab & DVCon DVCon 2006

4 typically occur under bet-cae timing condition; in ti cae te 1-bit SIG and ome of te N-bit BUS bit tranition after te negative old-time but before te riing clock edge, wic i legal timing. If te SVA ample in te preponed region, jut before te clock edge, ten it would detect te tranition on te ingle bit ignal at te wrong time (one clock too early) and data integrity would be wrong for te bu value (ince ome bit cange fat and oter more lowly). 1-bit SIG N-bit BUS current u not triggered $ample(sig) $ample(bus) previou u pa current property ) $roe(sig) -> (BUS==`) && ($pat(bus)==`current); 1-bit SIG N-bit BUS current $ample(sig) $ample(bus) u fale fail previou not current or Figure 8: Preponed Sampling wit NHT Te SytemVerilog mecanim for reliable ampling under tee condition i called te clocking block. A clocking block i a et of ignal yncronized to a particular clock and it allow (amongt oter ting) te input ampling kew to be pecified. In te preence of negative old-time, SVA mut operate witin te cope of a clocking block were input kew value are greater tan te negative oldtime, but le tan te etup-time, for te target library a own in Figure 9. Clocking block wit input kew value of #0 or te default value of #1tep are alo unreliable. Note tat altoug te input-kew i tecnology dependant, te clocking block and correponding SytemVerilog operate reliably for bot RTL and gate-level imulation. u expected pa not low Figure 9: Clocking Block Sampling wit NHT Tere are a number of different way to code uing clocking block; one poibility i own in Figure 10, were te property i defined inide te clocking block. In ti cae bot SIG and BUS are ampled 50p before te riing edge of. clocking ); input #50p SIG, BUS; property p_nt_example; $roe(sig) -> (BUS==`) && ($pat(bus)==`current); endclocking Figure 10: SVA in Clocking Block Note tat one of te retriction of coding aertion inide a clocking block i tat multipleclocked aertion are not upported. It i probably too muc to expect SVA-aware yntei tool to infer and connect a clocking block for you; owever it i reaonable to expect any clocking block contruct and aociated aertion to be preerved into te gate-level netlit. 3.2 Dedicated Aertion for Gate-Level It i poible tat te feature targeted by gatelevel imulation in an aertion-baed verification flow are not well addreed by exiting aertion and coverage from te RTL part of te flow. In uc cae it may be appropriate to define additional aertion and coverage wic are only ued during te gate-level imulation. A well a additional cycle-baed functional aertion for te gate-level environment it i alo poible to ue SVA to perform non-cycle-baed timing ceck a illutrated by te following example. In Figure 11 a defective clock multiplexer operate correctly during bot RTL and bet-cae Copyrigt 2006 Verilab & DVCon DVCon 2006

5 gate-level imulation; owever, under wort-cae condition an illegal narrow pule i preent but it i ufficiently wide tat it doe not violate te timing ceck on te gate-level flip-flop model. Te problem i tat real-world operation will be omewere between bet and wort-cae and it i quite likely tat ti circuit will generate illegal narrow pule on te clock network during real-life operation. It i poible tat an intermediate gate-level condition (typical or teter) would caue a timing ceck fail, but not guaranteed. clk0 clk1 elect RTL mux_clk BC mux_clk WC mux_clk Figure 11: Undetected Clock Glitc One poible olution to detect uc dynamic timing defect i to add additional HDL timing ceck to te clock ignal uing Verilog ytem tak in a pecify block (e.g. $widt) or correponding VITAL ceck for VHDL; owever it i alo poible to perform tee ceck uing SVA, wic a te advantage of containing te ceck in te verification environment. Figure 12 illutrate two generic multiple-clock SVA propertie wic can be ued for timing ceck; tee property definition are poible ince SVA allow EventExpreion and time variable to be paed a formal argument. property p_min_time(tart,top,duration); time (1, leading = $time) (($time - leading) >= duration); : p_min_time property p_max_time(tart,top,duration); time (1,leading = $time) (($time - leading) < duration); : p_max_time Tere are a number of poible application of te propertie own in Figure 12, including detecting ig level glitce and incorrect operating frequency for te current environmental condition (for example baed on dynamic voltage caling), a own in Figure 13. Notice tat te complete EventExpreion (e.g. poedge clk) i paed a te formal argument. Te p_min_ig property intantiate p_min_time to ceck tat te minimum time between a riing and a ubequent falling edge i not violated. Te p_pin_period property perform a imilar ceck baed on two ucceive riing edge of clk. Note alo tat te actual value for te duration argument can be a variable tat cange during imulation; for example to model dynamic frequency caling or voltage controlled power management. property p_min_ig; p_min_time(poedge clk, negedge clk, 10p); : p_min_ig time minp = 6n; property p_min_period; p_min_time(poedge clk, poedge clk, minp); : p_min_period a_min_ig : aert property (p_min_ig) ele $error( too narrow"); a_min_period : aert property (p_min_period) ele $error(...too fat"); Figure 13: SVA Timing Aertion Te timing ceck propertie from Figure 12 can alo be ued to define functional coverage point uing SVA cover tatement. For example, wen interaction between clock domain i targeted for gate-level imulation, we migt want to enure tat te tetbenc environment actually created clock relationip wic allowed key ignal to cange cloe to te detination clock. In ti cae te p_max_time property can be ued a own in Figure 14. Note tat one of te EventExpreion in eac property wic mean any tranition of te data value. Since te coverage i recorded wen te propertie old true, tee cover point will only record a it of te data tranition witin +/- 30p of te riing edge of te clock. Figure 12: SVA Timing Ceck Propertie Copyrigt 2006 Verilab & DVCon DVCon 2006

6 property p_jut_before; p_max_time(data, poedge clk, 30p); : p_jut_before property p_jut_after; p_max_time(poedge clk, data, 30p); : p_jut_after c_jut_before : cover property (p_jut_before); c_jut_after : cover property (p_jut_after); Figure 14: SVA Timing Coverage Ti approac i contrary to popular text on aertion-baed deign, uc a [3], wic normally guard againt uing aertion for glitc detection, non-yncronou ue of aertion and alo aertion tat potentially trigger every clock cycle. In general ti advice i valid; owever te aertion preented ere ave uccefully been ued to detect and iolate defect during gate-level imulation wic would not oterwie ave been oberved. Te important ting to be aware of are imulation performance and fale failure. Te firt ting to note i tat te performance overead from aving an aertion trigger on every clock edge i muc le in gate-level, tan it i in RTL imulation, ince tere are many more imulation event occurring anyway. In oter word te performance i bad anyway - o a few aertion reult in minimal additional performance degradation. Nonetele care i required, particularly were coverage i concerned, and te verification engineer ould be careful about ow timing ceck aertion are ued. In order to avoid fale failure, particularly at te tart of imulation, it migt be neceary to dynamically control te operation of uc aertion and coverage uing te diable tatement, te $aerton, $aertoff and $aertkill ytem tak, or te diable iff claue. Care ould be exercied to avoid over contraining wic could reult in mied defect during critical pae of operation. 3.3 Synteizable Aertion Certain type of aertion can be extended into ardware-aited verification flow uc a acceleration, emulation and FPGA prototyping [4]. By retricting te aertion coding to a ynteizable ubet of te language (in muc te ame way a RTL i a coded in a ynteizable ubet of Verilog or VHDL) it i poible to embed aertion logic in te pyical netlit for te DUT (or indeed ynteize part of te tetbenc environment into te target ardware). Note tat te aertion pyically become part of te netlit, i.e. te aertion are converted into gate, and terefore iue related to clock-tree yntei and connectivity a well a upport for negative-old-time i guaranteed. Ti i a different cenario to enuring tat a tetbenc environment operate correctly wit bot RTL and gate-level implementation of te DUT. It a been included ere for completene and clarity but i not te focu for ti paper. 4 Concluion Ti paper a demontrated tat it i poible to reue SytemVerilog Aertion in a gate-level imulation environment provided clocking block are ued wit appropriate input kew and care i taken wit te clock connectivity. In addition te poible application of SVA to perform non-cycle-baed timing ceck and related functional coverage wa preented. A combination of tee tecnique can be ued to enure tat te benefit of aertion-baed verification are extended to te gate-level imulation environment wic elp to maximize te correponding return on effort. 5 Reference [1] Accellera, SytemVerilog 3.1a Language Reference Manual, ttp:// [2] Litterick & Geiauer, Robut Vera Coding Tecnique for Gate-Level and Teter-Compliant SoC Verification Environment, SNUG Europe 2004 & MTV [3] Foter, Krolnik & Lacey, Aertion-Baed Deign 2nd Edition, Kluwer Academic Publier, ISBN: [4] Newell & Scutten, Bringing aertion into ardware-aited verification, EE Time Available from: ttp:// Copyrigt 2006 Verilab & DVCon DVCon 2006