Design for Verication at the Register Transfer Level Indradeep Ghosh Fujitsu Labs. of Aerica, Inc. Sunnyvale, CA 94085 USA Krishna Sekar Departent of ECE Univ. of California, San Diego La Jolla, CA 92093 Vasi Boppana Zenasis Tech. Inc. Capbell, CA 95008 USA Abstract In this paper we introduce a novel concept that can be used for augenting siulation based verication at the Register Transfer Level (RTL).In this technique the designer of an RTL circuit introduces soe well understood extra behavior (through soe extra circuitry) into the circuit under verication. This can be tered as design for verication. During RTL siulation this extra behavior is utilized in conjunction with the original behavior to exercise the design ore thoroughly thus aking it easier to detect errors in the original design. Once the circuit is throughly veried for functionality the extra behavioral constructs can be reoved to produce the original veried design. Extensive experients on a nuber of industrial circuits deonstrate that the ethod isproising. 1. Introduction As VLSI circuits becoe larger, saller and ore coplex the proble of design verication is becoing increasingly intractable. There are two types of design verication ethods currently used - siulation based and foral verication. Currently, the ost prevalent and widely used one is siulation based verication though foral verication in certain areas is gaining acceptance. The ain proble of foral verication is its inability to tackle large designs within a reasonable aount of tie and coputing resources. Though a lot of research is going on in this eld, experts agree that siulation based verication will reain a ajor verication ethod in the future. In siulation based verication the design to be veried is siulated at various levels of abstraction (RTL, gate or circuit) with a suite of test vectors and the output responses or soe interediate responses are copared for correctness with that of a golden odel or an executable specication (refer to Figure 1). The test vectors used are usually hand generated to target functionality or just rando vectors. The ain proble in this ethod is to obtain a test suite that will exercise the design copletely. In particular the test suite should be able to expose design errors (bugs) in corner cases or dicult to reach states. This is still a very dicult proble and the fact reains that it is ipossible to guarantee that all errors have been discovered in this kind or scenario even for interediate size circuits. However, with the absence of a viable alternative, siulation based verication is still the priary verication ethod used in the industry. RTL Testbench l l Specification or Golden RTL Model RTL Circuit Under Verification If "1" in any cycle for any output circuit ay be incorrect Copare Corresponsding Output Responses for n cycles Figure 1: Typical siulation based verication for a l-input -output RTL circuit In this paper, we present atechnique that can be used to augent siulation based verication. In this ethod the designer of an RTL circuit ebeds a sall aount of well understood extra functionality orbehavior into the circuit under verication. This extra behavior isinsertedinto both the golden odel/executable specication of the circuit and the also circuit under verication. Note that we assue the existence of such a odel without which this technique will not succeed. During siulation based verication this extra behavior is used along with the existing behavior of the circuit to exercise the design ore thoroughly. Incontrast to traditional foral verication techniques where behavior is reduced by abstraction this ethod works by slight augentation of existing behavior. Due to the extra behavior, state space exploration becoes easier and dicult to reach states and corner cases becoe ore easily accessible. We present three dierent types of extra behavioral odications that the designer ay use. However, other ecient structures ay also be used. Extensive experiental results deonstrate that this technique leads to cutting down the siulation tie by ore that 50% on an average for a wide range of errors in a nuber of large industrial RTL circuits. It also helps in exposing ore design errors than those detected by siulating on the original behavior alone. We should ephasize here that soe exaples used in this paper have thousands of latches and hundred thousand gates which are beyond the scope of current foral verication techniques. There is no proble of scalability for this ethod for even larger designs. Also unlike traditional foral verication techniques that work on BDD representation of the logic ipleentation of the circuit this ethod can work at the RTL before synthesis is done. Thus it can save a lot of tie and eort used to generate the logic level design before bugs can be found. The extra circuitry used can siply be reoved once the functional verication is coplete. More conve-
niently they can be encased in \synthesis o" praga directives that synthesis tools allow so that they will never be synthesized. 2. Previous Work Though we could not nd an exact parallel to the concept that we are proposing here there has been soe ideas put forward in siilar lines. The need for design for verication techniques to augent current verication ethods has been extensively discussed in [1]. Fro the testability doain the IEEE 1149.1 test bus has been used for testing as well as debug and can be tered as a kind of design for verication [2]. There has been a lot of research on eective forulation and placeent of assertions and checkers during siulation [3]-[7]. In fact soe verication copanies already have products in the arket that utilize these ideas [4]. This can also be thought of as a type of design for verication that increases the observability of the syste. A technique for autoatic placeent of assertions has been discussed in context of a particular design environent [6]. In [5] the authors propose an abstraction technique that separates the control-ow of a circuit fro the data ow and does validation on this abstracted achine where new state transitions are added. The test vectors generated are tested for validity on the original design. This ethod requires lot of designer intervention to separate control ow fro data ow and this is not a trivial task. Also the exaples provided in the paper are sall unlike our work. Finally, there has been a lot of research and well established industrial standards in the design for testability (DFT) doain [8]. Though, these techniques deal with anufacturing level stuck-at faults they provide soe helpful insights into the design for verication proble. 3. Design for Verication This section describes the concept behind our verication technique. This technique does not supplant existing verication ethods. It suppleents the. The existence of a correct golden odel or executable specication is assued so that the siulation results can be veried and errors can be caught. Suppose we need to check the correctness of a coplex, dicult to verify circuit of uncertain functionality. A circuit of known functionality isebedded within this coplex circuitry as shown in Figure 2. During verication using siulation, the functionality of the known ebedded circuit is used along with that of the circuit under verication to aid in design error detection. We will deonstrate that any design errors, which would otherwise be very dicult to nd, can easily and quickly be detected by using the extra behavior of the ebedded circuit. Uncertain Functionality + Known Functionality Sei Certain Functionality Figure 2: Adding a known ckt. in an uncertain ckt. Consider Figure 3 which represents the state transition graphs (STG) of the original circuit and the ebedded circuit. They have only one input i. The state 100 011 000 i =0 i =1 i =1 i =0 010 001 (a) STG of the original circuit 100 011 000 010 (b) STG of ebedded circuit 001 Figure 3: STGs of the circuits transition table of the nal ebedded syste is shown in Figure 4. An extra ode signal, M, is added to control which transitions occur. When M=0 then the original circuit transitions are taken and when M=1 then the ebedded circuit transitions are executed. As can be seen fro the table, soe of the transitions are coon for both the original and the ebedded circuit. For exaple, state 000 => state 010 when i=0 irrespective of the ode signal. Hence by just verifying the ebedded circuit transitions we can verify any of the original circuit transitions as well. Specically for the exaple shown, 6 out of the 10 original transitions can be veried using this ethod. Moreover the state transitions allowed by the extra circuit can result in easier reachability of hard to reach states in the original circuit. If corner case bugs exist which only gets activated in these states then they can be exposed with less diculty. Itisinteresting to note that unreachable states ay be used as steps to reach the hard to reach states while using the extra behavior. Thus the ethod ight detect an error but ay not be able to provide a valid counter exaple. This is discussed in detail in Section 5. The scope of this verication technique lies ostly in RTL to RTL coparison or while coparing an RTL ipleentation with that of a cycle accurate executable specication. The two circuits that are being copared needs to have the sae state encoding or siilar state encoding so that the extra circuitry that
Present State 000 001 010 011 100 (i,m) =00 Next State (i,m) =01 (i,m) =10 (i,m) =11 010 010 001 010 100 000 100 000 100 100 100 100 000 001 001 001 011 011 011 011 Figure 4: State transition table of ebedded syste is introduced does not behave dierently in the two circuits. In case of RTL to logic-level coparison of a particular design the schee ay be used only if the state encoding of the circuit reains the sae for both the levels and if the ip-op correspondences between the gate level and RTL circuit is known and also if it is possible to ebed the extra circuitry at the gate level. The extra ebedded circuit ay also be synthesized if the gate-level circuit is derived fro an RTL description. However, we believe that in that case it would be best to use boolean equivalence checking after anual apping of the state eleents have been done. This schee is ore suitable for RTL to RTL coparison or a RTL to specication coparison if there exist a cycle accurate executable specication that can be siulated. This ethod can lead to early detection of bugs even before a full synthesis is done of the design. Also since it is siulation based technique it can scale well to any size designs. For any given circuit, the proble then is to nd the appropriate circuit to ebed in it. This circuit should have as any transitions as possible which coincide with the original circuit but with the constraint that it should be easily veriable. This is a non-trivial proble and we provide soe solutions in the next section 4. Soe exaple ebedded circuits In this section soe exaples of ebedded circuits that we have used in our experients are provided. This is by no eans a coplete set of possible circuits that can be used. In fact ore ecient circuits ay be devised that exercise the design better and is better able to sealessly integrate into the original design. The goal over here for the new ebedded circuit is to share as uch as possible of the original behavior and not to perturb the original design too uch. In that way there will be less chances of errors being introduced while the extra circuit is being added. Also a large part of the design can be veried while siulating the behavior of the extra circuit which should be correct by construction. It should be possible to verify this extra circuit just by visual inspection for correctness as it should be siple and sall. After the functional verication is coplete these extra circuitry ay be reoved fro the RTL description before synthesis. Alternatively these odications ay be encased in a \synthesis o" parga directive that all RTL synthesis tools allow. Then they will never M Module1 Reg LFSR Logic +n Module2 n Reg Figure 5: RTL ebedding of an LFSR be synthesized. Note that soe of these behavioral odications can be done by odifying the test bench to directly load state eleents with predeterined values in the iddle of the siulation. This is denitely an alternative ethod of ipleenting this technique. However, this will usually result in coplicated and uch larger test benches. The siulation will also becoe slower due to the coplex behavior of the test bench. We believe that slight odication of the original RTL is uch easier. Also note that in case of designs with tri-state buses, bus contention prevention logic has to inserted to accoodate the extra behavior. This is very siilar to what is done for scan design in the testability doain. 4.1 A linear feedback shift register The rst approach taken was to ebed a Linear Feedback Shift Register in the original circuit. The LFSR is congured with a priitive polynoial. A ode signal, M, is added to the circuit to take either LFSR transitions (M=1) or original transitions (M=0). A ultiplexer at the input of each state eleent or register is used to choose between the original circuit valuesandthelfsrvalues depending upon whether the ode signal M is 0 or 1 respectively. During siulation M is suitably set or reset. Hence the circuit either akes original transitions or LFSR transitions. Since at the RTL, the state eleents/registers can be distributed across dierent odules, the inputs/outputs of the odules have to be congured appropriately so that all the ip-ops of the circuit can be chained together to ipleent a LFSR. This is illustrated by Figure 5. Due to the ebedded LFSR, the state transition graph now becoes uch ore dense and the diaeter of the graph (longest distance between any two nodes) is also likely to decrease. Hence any given state is uch orelikely to be reached during rando vector siulation. 4.2 Extra read/write ports for eory eleents Another approach taken was to introduce external read/write ports for all eory banks and regis- n
Mode Signal M Original Inputs Priary Inputs Original inputs 0 1 R/W 0 1 Register File or Meory Bank Outputs Priary Inputs Data & Address Priary Outputs Figure 6: RTL ipleentation of extra eory ports Table 1: Circuit size statistics for the exaple circuits Circuit RTL Logic level Modication HDL Design #Gates #FFs Schee Lines Type HRCC 837 hier 16205 70 LFSR EXE 8075 hier 12327 939 LFSR MCM16 28828 hier 105430 6570 Me Ports ALM 3504 hier 8265 1490 Counter Loads ter les so that all eory locations are controllable/observable fro the outside. Again a ode signal and a set of ultiplexers are used to activate these external read/write ports. This is shown in Figure 6. This extra circuitry allows the designer to view the interediate results inside a eory during siulation. Also it allows the conguration of the eory as needed fro outside for executing a critical corner case. The extra circuitry required for the odication is quite siple as it should be. 4.3 Parallel loading of counters Counters are very bad for verication as they are very dicult to control. To set the ost signicant bit of a counter a sequence of length 2 n is required where n is the bit-width of the counter. To alleviate this proble each counter can be odied with a parallel load fro the priary inputs. Easy controllability of a counter can lead to better verication of all downstrea logic that the counter feeds. The ipleentation was siilar as before with a set of ultiplexers and a ode signal. 5. Proble of false negative and counter exaples Though the above technique is quite proising in detecting errors through siulation, there are soe potential disadvantages and soe workarounds are necessary to alleviate the probles. These are discussed next. As stated earlier the extra behavior of the circuit ebedded in the original circuit will usually increase the reachable state space in the design. One potential proble is an error being detected in an unreachable state. This ay or ay not result in a false negative (if the error is again detected in a reachable state then the error is not a false negative). Hence once an error is agged it needs to be checked whether it is valid or not. In order to do this, the state in which the error is agged has to be checked for validity. First the state eleents (ip-ops/latches) which feed the logic cone where the error resides need to be deterined. This can be done by back-tracing fro the erroneous output(s). The state residing in the other eleents is a don't care and is to be ignored for this error. Once these state eleents are found the ones inside the which correspond to control-state registers need to be further separated. The bit patterns residing in these registers need to be checked as valid state encodings in the RTL circuit. This is a siple check which will iediately deterine an invalid state if a bit-pattern is an invalid encoding. All eory banks and register les are to be ignored as it is possible to take the to any state using a appropriate nuber of loads. If all the above tests pass the registers inside a pipeline are to be checked for consistency as any states inside a pipeline are invalid states. A backward trace using the original behavior fro the values present in the registers of the pipeline will catch any inconsistency quickly. Finally the ost dicult proble is to verify the validity of dierent data path register bit-patterns with respect to the dierent control states and the interaction of control states in dierent state achines. To alleviate this proble soe checkers ay be inserted into the RTL circuit that checks for invalid control state cobinations in dierent FSMs. If anyone of these checkers is asserted in the state where the error is detected then the state is invalid. Finally the ebedded circuit ay be constrained by adding extra circuitry to avoid known invalid states. Using the above set of rules we believe that it will be possible to lter out errors detected in invalid states in the circuit. Another proble is the generation of a valid counter exaple or input sequence that will detect the error in the original circuit. As stated earlier the extra behavior ay reach hard to reach states where an error is detected by stepping through unreachable states. Hence the siulated sequence will usually not be useful to redetect the errors using the original behavior. Thus this technique will be useful in detecting errors if they exist. Once they are found, diagnosis and debugging ight require extra inspection and eort. 6. Experiental results In this section, we present the experients done to validate our technique and the results obtained. We have done extensive siulation runs on four industrial RTL circuits written in VHDL or Verilog. The rst one, HRCC is a cache coherence controller. EXE is a eory controller. MCM16 isaulti-chip odule with lot of ebedded eories. ALM is a part of an ATM switch andhasanuber ofcounters in the design. The characteristics of the circuits are shown in Table 1. The circuits are synthesized fro HDL descriptions using the Synopsys Design Copiler to gate-level netlists. The synthesized results are for inforation purposes only as they provide a notion of the coplexity of the circuits. All the experients are done at the RTLusinganRTL HDL siulator. The last colun in Table 1 shows the odication schee used on the circuits for the design for verication experients which we elaborate next.
Table 2: Siulation results for Circuit HRCC Error Error #Siulation Vectors Type i 1 11 15 2 - - 3-24 4-30 5 2 2 Type ii 1-831 2-32 3 6 204 4-277 5-32 Type iii 1 - - 2 - - 3-274 5 - - Type iv 1 17 10 2 8 15 3 13 86 4 13 471 5 12 10 Type v 1-495 2-666 4-123 5-309 Average a - 6803 2556 Table 3: Siulation results for Circuit EXE Error Error #Siulation Vectors Type i 1-652 2-954 3-321 4 26-5 - 98 Type ii 1 32 54 2 17 782 3-654 5-541 Type iii 1 - - 2 45 40 3-87 4 101 109 5-56 Type iv 1 - - 2 56 786 3 7 19 4 350 64 5-698 Type v 1-56 2 78 54 4 12 65 5-876 Average - 6028 2276 a considering all errors and using the total nuber of vectors siulated for an undetected error to be 10000 The experiental ethodology is as follows. The original circuit is odied by ebedding soe extra circuitry in it as described in the previous sections. A Mode signal is used to switch between the original behavior and the odied behavior. A rando input vector set (Vector Set1) is generated for the original circuit. The input vector set for the odied circuit is the sae as this rando vector set with the Mode signal randoly activated (Vector Set2). Thus during siulation using Vector Set2 we are siulating the original behavior and the odied behavior randoly and in an interleaved fashion. These two circuits are now siulated with these input vectors respectively and their output responses captured. Now an identical error is introduced in both the original circuit and the odied circuit. These erroneous circuits are also siulated with the vector sets Vector Set1 and Vector Set2 respectively and the output responses captured. These output responses are then copared with the corresponding good circuit responses to check whether the error introduced has been detected. i.e. whether the output responses dier for the good and erroneous circuit in any clock cycle. The nuber ofsiulation cycles required to catch the error in either case is noted. In the RTL circuits the following types of errors were introduced : i) issing cases in case stateents. ii) issing clause in a conditional expression. iii) issing assign stateents. iv) erroneous output values inside case stateents. v) incorrect state transitions inside an FSM All experients were done using a rando pattern sequence of 1000 vectors. For the rst two exaples an LFSR was ebedded into the circuit coprising of ost of the state eleents in the circuit. For the third exaple the eories and register les were randoly loaded fro the priary inputs and observed at the priary outputs. For the last exaple parallel loads were introduced into the four counters present in the circuit. The results are shown in the Tables 2-5. In Colun 1 of the Tables the type of error introduced is shown and this corresponds to the errors discussed in the previous paragraph. Colun 2 just provides a counter for each kind of error. In Colun 3 the nuber of siulation vectors required to detect the error in the original circuit is shown. A \-" eans the error has not been detected in the 1000 rando vector siulation run. In Colun 4 the corresponding nuber is presented for the circuit odied by the design for verication hardware. At the end of the table the average nuber of vectors required to catch an error in either case is shown assuing a penalty of10000 vectors for each undetected error. Though this coparison is not very scientic it gives a notion of the overall iproveent in siulation run ties. Fro the tables we can ake the following observations. Out of the 100 errors in the dierent circuits 22 are undetected by both schees. The nuber of undetected errors becoes larger for the ore coplex circuits as is to be expected in a rando testing scenario. Only 4 errors are detected in the original circuits that reain undetected in the odied circuits whereas as any as 34 errors are detected in the odi- ed circuits but are undetected in the original circuits. Though a direct coparison is ipossible because of so any undetected errors, by looking at the averages we can say with soe degree of condence that the
Table 4: Siulation results for Circuit MCM16 Error Error #Siulation Vectors Type i 1 - - 2-675 4-567 5 98 76 Type ii 1 - - 2 675-3 - 832 5-560 Type iii 1 431 234 2-753 4-239 5 87 320 Type iv 1 - - 2 765 89 4-673 5 - - Type v 1-340 2 - - 4 453 679 5 352 981 Average 7298 4680 siulation tie can be shortened by ore than 50% by using the design for verication odications. The probability of an error being detected is also increased signicantly by using this technique. Note that this reduction is achieved by rando vectors only which are usually quite bad for detecting errors in sequential circuits. More savings ay be obtained by directed tests that use the design for verication hardware to control and observe the internals of the circuit better. In the experiental setup we never encountered the proble of false negatives as we introduced the errors ourselves and if the siulation outputs did not atch an error was guaranteed to be present. Also we did not need to do any diagnosis or debugging as we knew the location of the error. At the present tie it is therefore dicult to coent on the proble of counter exaple generation and the aount of eort required after an error has been detected. 7. Conclusions In this paper we have proposed a novel design for veri- cation technique that can be used to augent siulation based verication for RTL circuits. In this ethod the designer of an RTL circuit ebeds soe extra circuitry into the original circuit and uses this during siulation based verication to access corner cases and hard to reach states in the design. Once the functional verication is coplete this extra circuitry ay be reoved fro the design. Soe exaples of ebedded circuits that ay be used were provided. Experiental results deonstrate the ecacy of the technique where even through rando siulation we were able to detect randoly introduced design errors in less than half the tie on the odied circuits copared to the nonodied circuits. Soe disadvantages of the ethod like generation of false negatives were also discussed Table 5: Siulation results for Circuit ALM Error Error #Siulation Vectors Type i 1-453 2 32 14 3 563 474 5 19 80 Type ii 1 67 153 2 5 42 3-76 5 95 72 Type iii 1 452 32 2 315 924 3-79 4 430-5 65 - Type iv 1-18 2 211 605 3-790 4-310 5 453 232 Type v 1 28 85 2 92 156 3-872 4 67 13 5 604 884 Average 3739 1854 and a possible workaround proposed. As part of future work various other ebedded circuits are currently under investigation which ight lead to even saller verication ties with less perturbation on the original circuit. References [1] D.L. Dill and S. Tasiran, \Ebedded Tutorial: Foral veri- cation eets siulation," Int. Conf. Coputer-Aided Design, pp. 221, Nov. 1999. http://sprout.stanford.edu/talks.htl [2] A. Cron, \IEEE 1149.1 use in design for verication and testability at Texas Instruents," White paper: Texas Instruents, Nov. 1990. http://www.edta.co/scribe/ reference/appnotes/d003e9f.ht [3] M. Pandey, R. Raii, R.E. Bryant, and M.S. Abadir, \ Foral verication of content addressable eories using sybolic trajectory evaluation," in Proc. Design Autoation Conf., pp. 167-172, June 1997. [4] 0-In Design Autoation. Inc., \White-box verication for coplex designs," White Paper, Mar. 2000. http://www.0in.co [5] D. Moundanos, J.A. Abraha, and Y.V. Hoskote, \ Abstraction techniques for validation coverage analysis and test generation," IEEE Trans. on Coputer, Vol. 47-1, pp. 2-14, Jan. 1998. [6] L.C. Wang, M.S. Abadir, and N. Krishnaurthy, \Autoatic generation of assertions for foral verication of PowerPC icroprocessor arrays using sybolic trajectory evaluation," in Proc. Design Autoation Conf., pp. 534-537, June 1998. [7] S. Switzer and D. Landoll, \Using ebedded checkers to solve verication challenges," in Proc. DesignCon IP World Foru, Feb. 2000. [8] M. Abraovici, M.A. Breuer, and A.D. Friedan, Digital Systes Testing and Testable Design, IEEE Press, New York, 1990.