Design Process. Design : specify and enter the design intent. Verify: Implement: verify the correctness of design and implementation

Transcription

1 Design Verification 1

2 Design Process Design : specify and enter the design intent Verify: verify the correctness of design and implementation Implement: refine the design through all phases Kurt Keutzer 2

3 Design Verification HDL RTL Synthesis manual design specification Library/ module generators netlist logic optimization netlist physical design layout Is the design consistent with the original specification? Is what I think I want what I really want? Kurt Keutzer 3

4 Implementation Verification HDL RTL Synthesis manual design Library/ module generators netlist logic optimization netlist a b 0 1 d a b 0 d 1 s clk q q Is the implementation consistent with the original design intent? physical design layout s clk Is what I implemented what I wanted? Kurt Keutzer 4

5 Manufacture Verification (Test) Library/ module generators HDL RTL Synthesis netlist logic optimization netlist physical design manual design a b 0 1 s d clk a b 0 1 s q d clk q Is the manufactured circuit consistent with the implemented design? Did they build what I wanted? layout Kurt Keutzer 5

6 Design Verification HDL RTL Synthesis manual design specification Library/ module generators netlist logic optimization netlist physical design layout Is the design consistent with the original specification? Is what I think I want what I really want? Kurt Keutzer 6

7 Verification is an Industry-Wide Issue Intel: Sun: Processor project verification: Billions of generated vectors Our VHDL regression tests take 27 days to run. Sparc project verification: Test suite ~1500 tests > 1 billion random simulation cycles A server ranch ~1200 SPARC CPUs Bull: Simulation including PwrPC 604 Our simulations run at between 1-20 CPS. We need cps. Cyrix : An x86 related project We need 50x Chronologic performance today. 170 CPUs running simulations continuously Kodak: Xerox: Ross: hundreds of 3-4 hour RTL functional simulations Simulation runtime occupies ~3 weeks of a design cycle 125 Million Vector Regression tests Design Teams are Desperate for Faster Simulation Kurt Keutzer 7

8 Verification Gap Logic Transistors per Chip (K).10m.35m 2.5m 10,000,000 1,000, ,000 10,000 1, Logic Tr./Chip Tr./S.M. 58%/Yr. compound Complexity growth rate x x x x x x x Verification Gap 100,000 10,000 1,000 21%/Yr. compound 100 Productivity growth rate ,000,000 10,000,000 1,000,000 Productivity Trans./Staff - Mo. Source: SEMATECH Kurt Keutzer 8

9 Why the Gap? logic_transistors chip X lines_in_design logic_transistors X bugs line_of_design = bugs chip Kurt Keutzer 9

10 Filling in Reasonable Numbers logic_transistors chip X lines_of_design logic_transistors X bugs lines_of_design 10,000,000 trs chip X 1 10 X 1 10,000 = 100 bugs chip Kurt Keutzer 10

11 Raising the Level of Abstraction logic_transistors chip X lines_of_design logic_transistors X bugs lines_of_design 10,000,000 trs chip X X 1 10,000 = 10 bugs chip this year!! Kurt Keutzer 11

12 Moore s Law Implies More Bugs logic_transistors chip X lines_of_design logic_transistors X bugs lines_of_design 100,000,000 trs chip X X 1 10,000 = 100 bugs chip within 5 years!! Kurt Keutzer 12

13 The Verification Bottleneck Verification problem grows even faster due to the combination of increased gate count and increased vector count 10,000x more Vectors Required to Validate 10B 100M 1M x 10,000 = 1 million times more Simulation Load 100k 1M 10M 100x Gate Count Kurt Keutzer 13

14 Aspects of Design Verification Specification Validation Functional Verification (interactive) Functional Verification (regressions) In-System Verification Implementation Verification Event-driven Simulation Cycle-base simulation Emulation Equivalence Checking Event Driven Interactive Phase High flexibility Quick turnaround time Good debug capabilities Cycle -based simulation Regression Phase Highest performance Highest capacity Emulation and Acceleration In-System Verification Highest performance Highest Capacity Real system environment Kurt Keutzer 15

15 Approaches to Design Verification Software Simulation Application of simulation stimulus to model of circuit Hardware Accelerated Simulation Use of special purpose hardware to accelerate simulation of circuit Emulation Emulate actual circuit behavior - e.g. using FPGA s Rapid prototyping Create a prototype of actual hardware Formal verification Model checking - verify properties relative to model Theorem proving - prove theorems regarding properties of a model Kurt Keutzer 16

16 Simulation: The Current Picture Simulation driver Simulation engine Monitors SHORTCOMINGS: Hard to generate high quality input stimuli A lot of user effort No formal way to identify unexercised aspects No good measure of comprehensiveness of validation Low bug detection rate is the main criterion Only means that current method of stimulus generation is not achieving more. Kurt Keutzer 17

17 Simulation Drivers Simulation driver Simulation engine Symbolic simulation Monitors Input stimuli consistent with circuit interface must be generated Environment of circuit must be represented faithfully Tests can be generated pre-run (faster, hard to use/maintain) on-the-fly (better quality: can react to circuit state) Environment and input generation programs written in HDL or C, C++, or Object-oriented simulation environment VERA, Verisity Vector generation Sometimes verification environment and test suite come with product, e.g. PCI implementations, bridges, etc. Diagnosis of unverified portions Coverage analysis Kurt Keutzer 18

18 Monitors Simulation driver Simulation engine Symbolic simulation Monitors Reference models (e.g. ISA model) Temporal and snapshot checkers Can be written in C, C++, HDLs, and VERA and Verisity: A lot of flexibility Assertions and monitors can be automatically generated: 0-in s checkers Protocol specification can be given as a set of monitors a set of temporal logic formulas (recent GSRC work) Vector generation Diagnosis of unverified portions Coverage analysis Kurt Keutzer 20

19 Types of software simulators Circuit simulation Spice, Advice, Hspice Timemill + Ace, ADM Event-driven gate/rtl/behavioral simulation Verilog - VCS, NC-Verilog, Turbo-Verilog, Verilog-XL VHDL - VSS, MTI, Leapfrog Cycle-based gate/rtl/behavioral simulation Verilog - Frontline, Speedsim VHDL - Cyclone Domain-specific simulation SPW, COSSAP Architecture-specific simulation Kurt Keutzer 21

20 Approaches to Design Verification Software Simulation Application of simulation stimulus to model of circuit Hardware Accelerated Simulation Use of special purpose hardware to accelerate simulation of circuit Emulation Emulate actual circuit behavior - e.g. using FPGA s Rapid prototyping Create a prototype of actual hardware Formal verification Model checking - verify properties relative to model Theorem proving - prove theorems regarding properties of a model Kurt Keutzer 30

21 FPGAs as logic evaluators Today: 2 trillion gate evaluations per second per FPGA (200K gates, 10M cps) Growing with Moore s Law as designs do $1.5B industry behind it (XLNX+ALTR+ACTL) Potent tool for logic verification and validation How best to put the FPGA to use? M. Butts - Synopsys Kurt Keutzer 31

22 Verification using Emulation RTL or Gate design Compiler Mapper SBUS i/f Emulation Box System Hardware Customized parallel processor system for emulating logic In-circuit target interface Software Compiler Mapping RTL & Gate designs to emulator Runtime Software C-API Open SW architecture for tight integration Flexible modes of stimulus up In-circuit Target Board Kurt Keutzer 33

23 Logic Emulation M. Butts - Synopsys Ultra-large FPGA Live hardware, gate-for-gate. Entire design or major module is flattened, and compiled at once into multi-fpga form. Logically static circuit-switched interconnect. In-circuit or vector-driven Regular clock rate, > 1M cps. Kurt Keutzer 32

24 Emulation Conclusions M. Butts - Synopsys Market is flat at $100M/year Expensive HW, SW, cost of sales High-end supercomputer-like business Current competition Simulation farms have similar $/cycle/sec for regression vector sets FPGA-based rapid prototyping for validation, SW execution Good solution for large projects that can afford it Ultimately the basic concept is limited by IC packaging Kurt Keutzer 40

25 How to make it smarter: Intelligent Simulation Simulation driver Conventional Novel Simulation engine Symbolic simulation Monitors Vector generation Diagnosis of unverified portions Coverage analysis Kurt Keutzer 47

26 Symbolic Simulation Simulation driver Simulation engine Symbolic simulation Monitors IDEA: One symbolic run covers many runs with concrete values. Vector generation Diagnosis of unverified portions Coverage analysis Some inputs driven with symbols instead of concrete values 2 (# symbols) equivalent binary coverage Kurt Keutzer 48

27 Symbolic Simulation Simulation driver Simulation engine Symbolic simulation Monitors INNOLOGIC: Limitations Capacity limits: ~ 1 million gate equivalents # of symbols - design dependent. < 50 in worst cases (multipliers) several thousand in the best cases (memory, data movement). When out of memory, turn symbols into binary values - coverage lost but simulation completes. Roughly 10 times slower than Verilog-XL Vector generation Can t use in conjunction with Vera or Verisity currently. Definitely worth a shot: Extra cost of symbols offset quickly, doesn t require major change in framework. Full benefits of technology have not been realized yet. Diagnosis of unverified Kurt Keutzer 50 portions Coverage analysis

28 Coverage Analysis Simulation driver Simulation engine Symbolic simulation Monitors Why? To quantify comprehensiveness of validation effort Tells us when not to stop Even with completely formal methods, verification is only as complete as the set of properties checked To identify aspects of design not adequately exercised Guides test/simulation vector generation Coordinate and compare verification efforts Different sets of simulation runs Vector generation Different methods: Model checking, symbolic simulation,... Diagnosis of unverified portions Coverage analysis Kurt Keutzer 51

29 Status of Design Verification Software Simulation Too slow Moving to higher levels is helping but not enough Hardware Accelerated Simulation Too expensive Emulation Even more expensive Rapid prototyping Too ad hoc Formal verification Not robust enough Intelligent Software Simulation Symbolic simulation not robust enough Coverage metrics useful, but not useful enough Automatic vector generation not robust enough Kurt Keutzer 52