Efficient Modeling and Verification of Analog/Mixed-Signal Circuits

Transcription

1 Efficient Modeling and Verification of Analog/Mixed-Signal Circuits Scott R. Little University of Utah

2 Motivation 1 About 75 percent of all chips include analog circuits. These circuits make up 2 percent of the devices and 20 percent of the area but require 40 percent of the design effort. 50 percent of re-spins are due to errors in the analog portion. 1 Data on this slide is from IBS Corporation s industry reports (2003).

3 Industrial Perspectives...the business issue is that analog has to budget five or six respins. Silicon has become the validation vehicle for analog, and that s a problem. Sandipan Bhanot, CEO of Knowlent

4 Industrial Perspectives If the digital designers did verification the way analog designers do verification, no chip would ever tape out. Sandipan Bhanot, CEO of Knowlent

5 Analog Validation Today AMS validation is driven by designers running simulations. Global variation is explored via corner simulations. Local variation is explored via Monte Carlo simulation. Correctness of the simulations is validated manually. Design correctness is the responsibility of each designer.

6 Switched Capacitor Integrator Circuit C 2 Φ 1 Φ 2 V in Q 1 Q 2 + V out C 1 V in = ±1V freq(v in ) = 5 khz C 1 = 1 pf C 2 25 pf freq(φ 1 ) = freq(φ 2 ) = 500 khz dv out /dt ±20 mv/µs

7 Switched Capacitor Integrator Output Waveform Vout (mv) Time (us) Vout

8 Switched Capacitor Integrator Circuit C 2 Φ 1 Φ 2 V in Q 1 Q 2 + V out C 1 V in = ±1000 mv freq(v in ) = 5 khz C 1 = 1 pf C 2 = 25 ± 2.5 pf freq(φ 1 ) = freq(φ 2 ) = 500 khz dv out /dt = ±(18 to 22) mv/µs Does V out saturate? (i.e. 2000mV V out 2000mV )

9 Switched Capacitor Integrator Circuit C 2 Φ 1 Φ 2 V in Q 1 Q 2 + V out C 1 V in = ±1000 mv freq(v in ) = 5 khz C 1 = 1 pf C 2 = 25 ± 2.5 pf freq(φ 1 ) = freq(φ 2 ) = 500 khz dv out /dt = ±(18 to 22) mv/µs Does V out saturate? (i.e. 2000mV V out 2000mV )

10 Switched Capacitor Output Waveform Vout (mv) Time (us) Vout

11 Switched Capacitor Output Waveform Vout (mv) Time (us) Vout

12 Switched Capacitor Integrator (Correct) Φ 1 Φ 2 Q 3 Q 4 C 3 C 2 Φ 1 Φ 2 V in Q 1 V in = ±1000mV freq(v in ) = 5 khz Q 2 V out + C 1 C 1 = 1 pf C 2 = 25 pf C 3 = 0.5 pf freq(φ 1 ) = freq(φ 2 ) = 500 khz dv out /dt (±20 V out /100) mv/µs

13 Switched Capacitor (Correct) Output Waveform 2000 Vout 1000 Vout (mv) Time (us)

14 Switched Capacitor (Correct) Output Waveform 2000 Vout 1000 Vout (mv) Time (us)

15 Industrial Perspectives...are being solved because we have very good analog engineers. But in the future, if we want to improve time-to-market we will have to improve the tools. We cannot depend on experienced designers forever. James Lin, VP at National Semiconductor

16 Formal and Semi-formal Methods Exhaustively explores the design space for ranges of initial conditions and dynamically varying parameter values. Automatically checks the property over the entire state space. Produces an error trace upon finding a property violation. Formal methods have been successful for digital circuits.

17 AMS Formal Methods Challenges Creation of formal AMS circuit models. Representation of continuous variables, such as voltages and currents, during state space exploration.

18 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

19 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

20 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

21 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

22 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

23 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

24 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments {l 18} max := T, ẋ := 2 [1, 2] Rate assignments x := 0, ẋ := 1 [1, 2] p 0 p 1 {open} t 0 t 1

25 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments {l 18} max := T, ẋ := 2 Rate assignments x := 0, ẋ := 1 p 0 p 1 {open} t 0 [1, 2] t 1 [1, 2]

26 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

27 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

28 Labeled Hybrid Petri Nets (LHPNs) Composed of a Petri net and labels operating on continuous variables and Boolean signals. Label types are: Enablings Delay bounds Boolean assignments Value assignments Rate assignments p 0 {l 18} max := T, ẋ := 2 p 1 {open} x := 0, ẋ := 1 t 0 [1, 2] t 1 [1, 2]

29 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

30 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap;

31 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { fail Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F { fail} [100, 100] Vin := T p 1 t 2 t 3 p 0 t 0 { fail Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T p 3 p 2 { fail} [100, 100] Vin := F t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin} t 1

32 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { fail Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F { fail} [100, 100] Vin := T p 1 t 2 t 3 p 0 t 0 { fail Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T p 3 p 2 { fail} [100, 100] Vin := F t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin} t 1

33 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { Vin} V out := [18, 22] t 0 p 3 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 4 p 0 {Vin} V out := [ 22, 18] { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin} t 1

34 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F t 0 p 3 { fail} [100, 100] Vin := T p 1 {Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T t 2 t 3 p 2 { fail} [100, 100] Vin := F t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin, V out [18,22], V out [ 22, 18] } p 0 t 1

35 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F [100, 100] Vin := T p 1 t 2 [100, 100] Vin := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin, V out [18,22], V out [ 22, 18] } p 0 t 0 {Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T t 3 p 2 t 1

36 Switched Capacitor Integrator Model library IEEE; use IEEE.std logic 1164.all; use work.handshake.all; use work.nondeterminism.all; entity integrator is end integrator; architecture switchcap of integrator is signal Vin:std logic := 0 ; quantity Vout:real; begin break Vout => ; --Initial value if Vin= 0 use Vout dot == span(18.0, 22.0); elsif Vin = 1 use Vout dot == span(-22.0, -18.0); end use; process begin assign(vin, 1,100,100); assign(vin, 0,100,100); end process; assert (Vout above( ) and not Vout above(2000.0)) report error severity failure; end switchcap; { fail Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F { fail} [100, 100] Vin := T p 1 t 2 t 3 p 0 t 0 { fail Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T p 3 p 2 { fail} [100, 100] Vin := F t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T Q 0 = {Vout = 1000} R 0 = { V out = [18, 22]} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18] } t 1

37 Piecewise Linear Approximation mv µs

38 Piecewise Linear Approximation mv µs

39 Piecewise Linear Approximation mv µs

40 Piecewise Linear Approximation mv µs

41 LHPN Piecewise Transformation { fail Vin V out [18,22] } V out := [18, 22], V out [18,22] := T, V out [ 22, 18] := F p 0 t 1 t 0 { fail Vin V out [ 22, 18] } V out := [ 22, 18], V out [18,22] := F, V out [ 22, 18] := T

42 LHPN Piecewise Transformation { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F t 5 { fail v0}[0, ] V out := 22, v0 := F p 0 t 1 t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F

43 Abstract AMS Modeling Designers create abstract HDL models manually. Updating these models for circuit changes may be tedious. High quality abstract models require time and expertise. AMS designers typically use detailed transistor level models.

44 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

45 LHPN Model Generation Build abstract models of the circuit using: Simulation traces. Thresholds on the design variables. A property to verify. Thresholds Simulation Traces Safety Property 1. Assign data to bins 2. Generate rates for binned data 3. Detect discrete multi valued variables 4. Generate model VHDL AMS Model Verilog AMS Model LHPN Model

46 Model Generation Simulations V in V out (27pF ) V out (23pF ) 1 Voltage (V) 0-1 0e e 04 2e 04 3e 04 4e 04 Time (s)

47 Step 1: Data Binning Each data point is assigned a bin based upon thresholds. Each bin represents an operating region of the system mv 1 V out 0 mv mv V in V out mv 1 0 mv 0 V in 1000 mv 100µs 200µs 300µs 400µs

48 Step 1: Data Binning 1000 mv 1 V out 0 mv mv V in V out mv 1 V in 0 mv mv 100µs 200µs 300µs 400µs

49 Step 1: Data Binning 1000 mv 1 V out 0 mv mv V in V out mv 1 V in 0 mv mv 100µs 200µs 300µs 400µs

50 Step 1: Data Binning 1000 mv 1 V out 0 mv mv V in V out mv 1 V in 0 mv mv 100µs 200µs 300µs 400µs

51 Step 1: Data Binning 1000 mv 1 V out 0 mv mv V in V out mv 1 V in 0 mv mv 100µs 200µs 300µs 400µs

52 Step 2: Rate Calculation Rates are calculated for each eligible data point in each bin. Low pass filtering smooths edge effects and transitory pulses. Minimum and maximum rates are tabulated for each bin mv V out 23 pf 27 pf mv mv µs µs 150µs 200µs

53 Step 2: Rate Calculation 1000 mv V out 23 pf 27 pf mv mv µs µs 150µs 200µs ( )/( ) = 23.93mV /µs V out00 = [23, 24]

54 Step 2: Rate Calculation 1000 mv Vout 23 pf 27 pf mv mv µs 100µs 150µs 200µs ( )/( ) = 21.06mV /µs V out00 = [21, 24]

55 Step 2: Rate Calculation 1000 mv Vout 23 pf 27 pf mv mv µs 100µs 150µs 200µs No rate calculated. V out00 = [19, 24]

56 Step 2: Rate Calculation 1000 mv V out 23 pf 27 pf mv mv µs µs 150µs 200µs Final rate calculations after C 2 = 27pF. V out00 = [17, 24]

57 Step 3: Discrete Multi-Valued (DMV) Variables Stable signals are handled differently to aid efficiency. Stability is determined by: Remaining constant within an epsilon value for a specified time. Total percent of the entire signal marked stable. Delay is calculated for each constant value. Min/max delay and constant values are extracted. ɛ ɛ

58 Step 3: Discrete Multi-Valued (DMV) Variables 1V Vout 0V 1V 50µs 100µs 150µs 200µs Stability ratio: 100.1/100.1 = 1

59 Step 3: Discrete Multi-Valued (DMV) Variables 1V Vout 0V 1V 50µs 100µs 150µs 200µs Stability ratio: 100.1/100.2 =.99

60 Step 3: Discrete Multi-Valued (DMV) Variables 1V Vout 0V 1V 50µs 100µs 150µs 200µs Stability ratio: 199.9/200 =.99

61 Step 3: Discrete Multi-Valued (DMV) Variables 1V Vout 0V 1V 50µs 100µs 150µs 200µs Delay value for mv: [100,101]

62 Step 3: Discrete Multi-Valued (DMV) Variables 1V Vout 0V 1V 50µs 100µs 150µs 200µs Delay value for 1000 mv: [99,100]

63 Step 4: Generating Verilog-AMS include "disciplines.h" module swcap(vin io,vout io); inout Vin io, Vout io; electrical Vin io, Vout io; real Vout var, Vout rate; analog step) begin Vout var = -1.00; Vout rate = 0.020; io)-0.0,-1)) begin Vout rate = 0.020; io)-0.0,1)) begin Vout rate = ; begin Vout var = Vout var + Vout rate; end V(Vout io) <+ transition(vout var,1p,1p,1p); end endmodule

64 Step 4: Generating an LHPN Initial values = {V out = 1000mV, V in = 1000mV, fail = F }; Initial rates = { V in = 0, V out = [17, 24]} V out LHPN p 6 (00) {V in 0} [0, 0] V out := [ 24, 17] p 4 (11) p p 3 (01) 1 ( 1000) t 1 t 3 t 2 V in LHPN [0, 0] {V out 0} t 6 { V out 0} [0, 0] V V out := [17, 24] out := [ 24, 17] t 4 [99, 100] p 2 (1000) V in := 1000 t 5 { V in 0} [0, 0] V out := [17, 24] p 5 (10) p 0 t 0 [100, 101] V in := 1000 Property LHPN {( V out 2000) V out 2000} [0, 0] fail := T

65 LEMA VHDL AMS Subset Safety Property Simulation Traces Thresholds VHDL AMS Compiler Model Generator Labeled Hybrid Petri Net (LHPN) Verilog AMS Model VHDL AMS Model BDD Based Model Checker SMT Bounded Model Checker DBM Based Model Checker Pass or Fail + Error Trace

66 State Space Exploration Methods Hartong, et al. Little, et al. Frehse, Gupta, Krogh, Rutenbar

67 Zones Representation used by many timed state space verifiers. Efficiently represented using difference bound matrices (DBMs). Only allow polygons with 45 and 90 angles. Evolve at a rate of 1 along 45 angles. Uses variable substitutions to support other rates. Uses warping to ensure 45 and 90 angles are maintained.

68 Warping the Zone 9 p 0 3 y x 2 10 [2, 5] t 0 ẋ := 2 ẏ := 3

69 Warping the Zone p 0 3 y 3 x 2 4 [2, 5] t 0 ẋ := 2 ẏ := 3

70 Warping the Zone p 0 3 y 3 x 2 4 [2, 5] t 0 ẋ := 2 ẏ := 3

71 Warping the Zone p 0 3 y 3 x 2 4 [2, 5] t 0 ẋ := 2 ẏ := 3

72 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T c t2 = 0 Vout = 1000mV V out = 18mV /µs vin = F, V out [18,22] = T, V out [ 22, 18] = F, v0 = T, v1 = F, fail = F

73 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T 0µs c t2 100µs 1000mV Vout 800mV V out = 18mV /µs vin = F, V out [18,22] = T, V out [ 22, 18] = F, v0 = T, v1 = F, fail = F

74 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T 0µs c t2 100µs 1000mV Vout 1200mV V out = 22mV /µs vin = F, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = F

75 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T c t2 = 100µs 800mV Vout 1200mV V out = 22mV /µs vin = T, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = F

76 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T c t3 = 0µs 800mV Vout 1200mV V out = 22mV /µs vin = T, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = F

77 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T c t3 = 0µs 400mV Vout 1600mV V out = 22mV /µs vin = T, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = F

78 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T c t3 = 0µs 0mV Vout 2000mV V out = 22mV /µs vin = T, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = F

79 Switched Capacitor Integrator Example { fail Vin V out [18,22] } V out := 18, V out [18,22] := T, V out [ 22, 18] := F, v0 := T, v1 := F Q 0 = {Vout = 1000} t 5 { fail v0}[0, ] V out := 22, v0 := F R 0 = { V out = 18} S 0 = { Vin, fail, V out [18,22], V out [ 22, 18], v0, v1} p 0 t 1 { fail} [100, 100] Vin := T p 1 t 2 t 3 p 2 { fail} [100, 100] Vin := F t 0 { fail Vin V out [ 22, 18] } V out := 22, V out [18,22] := F, V out [ 22, 18] := T, v0 := F, { fail v1}[0, ] v1 := T V t 6 out := 18, v1 := F p 3 t 4 { (Vout 2000) Vout 2000} [0, 0] fail := T DEADLOCK 0mV Vout 2000mV V out = 22mV /µs vin = T, V out [18,22] = T, V out [ 22, 18] = F, v0 = F, v1 = F, fail = T

80 Switched Capacitor Integrator Verification Results V in V out 2000 Voltage (mv) Time (us)

81 Switched Capacitor Integrator (Correct) Φ 1 Φ 2 Q 3 Q 4 C 3 C 2 Φ 1 Φ 2 V in Q 1 V in = ±1000mV freq(v in ) = 5 khz Q 2 V out + C 1 C 1 = 1 pf C 2 = 25 pf C 3 = 0.5 pf freq(φ 1 ) = freq(φ 2 ) = 500 khz dv out /dt (±20 V out /100) mv/µs

82 Switched Capacitor Integrator (Correct) 1.5 V in V out (27pF ) V out (23pF ) 1 Voltage (V) e e 04 2e 04 3e 04 4e 04 Time (s)

83 Switched Capacitor Integrator (Correct) Model Initial values = {V out = 1000mV, V in = 1000mV, fail = F }; Initial rates = { V in = 0, V out = [18, 22]} V out LHPN p 3 (01) [0, 0] {V out 0} V out := [6, 24] p 6 (00) {V in 0} [0, 0] V out := [ 36, 15] t 3 t 6 t 4 t 5 { V in 0} [0, 0] V out := [14, 36] p 4 (11) { V out 0} [0, 0] V out := [ 24, 6] p 5 (10) p 1 [99, 101] V in := 999 t 1 t 2 [99, 100] V in := 1000 p 0 t 0 {( V out 2000) V out 2000} [0, 0] fail := T V in LHPN p 2 Property LHPN

84 Switched Capacitor Integrator (Correct) 1V V out 0V 1V 1V V in 0V 1V 100µs 200µs 300µs 400µs

85 Switched Capacitor Integrator (Correct) Model V out LHPN { V out 500} [0, 0] V out := [ 16, 9] { V in 0} [0, 0] V out := [23, 32] p 7 (10) t 6 t 7 p 0 (00) Q 0 = {V out = 1000, V in = 1000} R 0 = { V out = [26, 32]} S 0 = {fail = F } { V out 0} [0, 0] V out := [ 22, 14] p 6 (11) t 5 p 5 (12) t 0 p 1 (01) t 1 {V out 500} [0, 0] V out := [18, 27] {V out 0} [0, 0] V out := [14, 22] p 8 [100, 101] V in := 1000 t 8 t 9 [99, 100] V in := 1000 V in LHPN p 9 { V out 500} [0, 0] V out := [ 27, 18] t 4 p 4 (13) p 2 (02) t 2 {V out 500} [0, 0] V out := [9, 16] p 2 Property LHPN {V out 2000 V out 2000} [0, 0] fail := T t 3 p 3 (03) {V in 0} [0, 0] V out := [ 32, 23]

86 Verification Results DBM Model Checker HyTech PHAVer Example Ψ Time Verifies? Time Time Integrator (Sat.) No Integrator (No sat.) Yes Diode (Osc.) Yes o/f 72.8 Diode (No osc.) No o/f n/a R L I l V in C V c

87 PLL Phase Detector Example clk clk d rst q q up Combinational Logic gclk rst d clk q q down

88 PLL Phase Detector Model 4 simulations used for model generation: 1 µs piecewise linear simulation representing reasonable clock skew and periodic clock signal. 2 periodic signals that are out of phase. 8 signals are used for model generation. Verilog-AMS and LHPN models generated in less than 20 s.

89 PLL Phase Detector Simulation Times 0.5 µs and 1 µs simulations use the piecewise linear trace representing reasonable clock skew. 2 µs simulation uses two periodic signals out of phase. Verilog-AMS simulation is significantly faster in each case. Sim Length Verilog-AMS (s) Transistor-level (s) Speed-up 0.5 µs µs µs µs µs

90 PLL Phase Detector Simulation Traces Comparison of Verilog-AMS and transistor-level simulation output clk gclk Transistor-level down Verilog-AMS down Voltage (V) Time (ns)

91 PLL Phase Detector Verification The property (down up) verifies in 0.3 seconds. A more complex property: if gclk 1 0 then if up = 1 then up = 0 within 5 ns elsif down = 0 then down = 1 within 5 ns if clk 1 0 then if down = 1 then down = 0 within 5 ns elsif up = 0 then up = 1 within 5 ns Translates to an LHPN with 20 transitions and 14 places. Verifies correctly in 2.12 seconds.

92 Conclusions Improved verification methods are needed in the AMS space. Developed LHPN model to describe and analyze AMS circuits. Simulation data and VHDL-AMS can be translated to LHPNs. Abstract circuit models can be generated from simulation data. Developed an efficient LHPN analysis engine based on zones. Results on several examples are encouraging.

93 Future Work AMS Circuit monitors. Reliability and functional failures can be detected. Automatic property extraction can aid this effort. AMS Property Specification Language. Digital designers have mature property specification languages. Digital languages are not adequate for analog designers. A property specification language supporting time and frequency domain properties is needed.

94 Future Work Automatic Stability Verification. Stability is a critical property of many analog designs. Formal methods can prove stability of a system over ranges of parameter values and initial conditions. Automatic Model Abstraction. System-level simulation needs abstract models for efficiency. Abstract models can be used by formal tools and simulators. Model quality and efficiency concerns must be addressed. AMS Coverage metrics. Determining the number and type of simulations required to validate an AMS circuit is an art. Coverage metrics should be based on the type of circuit.

95 Future Work Hardware/Software Modeling and Co-verification. Modeling and verification of embedded systems requires low level modeling of software and AMS circuits. Compositional verification techniques will improve efficiency. Embedded Software Verification. The embedded software problem differs from the general software verification problem. Extensions to current techniques that address interrupts and work at the assembly language level are needed.