No Limit for Equivalency Checking with Conformal

Ramakrishnan V Sivaprasad Embanath

Conexant Systems, Inc.

Agenda
Introduction Handling Module Compiler (MC) gates Handling Pipeline Re-timed gates Case study MC Generated and Pipeline Re-Timed Gates Multipliers Case study Multiplier Abort Case study Multiplier Non-equivalence Modeling Automatic port conversion Multiple driven net Disabled clock ports Black box Best Practices Conclusion

Conexant Systems, Inc.

Introduction
System on Chips (SoCs) are becoming more complex to build; ASIC design methodologies are becoming more and more rigorous to build them. Golden RTL is taken through implementation flow synthesis, power optimization, Design For Test (DFT), Placement and Route (P&R),Engineering Change Orders (ECO). Add to these, design circuitry implemented using compilers.

Conexant Systems, Inc.

Introduction
Logical equivalency checking between the golden RTL and final silicon-ready circuit is a challenging task. Challenges faced in the logical equivalency checking process and how to make things work with Encounter Conformal LEC. The examples and case studies explained are taken from Conexants SoC projects.

Conexant Systems, Inc.

Handling MC Generated Gates

MC accepts the design specifications in a high-level language. Conformal LEC does not support this language. Write out a behavioral verilog file from MC and read as golden design in LEC.

Conexant Systems, Inc.

Handling Pipeline Re-Timed Gates

Introduce new flops as pipeline stages to increase the throughput. Insertion of the flops are optimally done and the number of flops introduced depends upon the design requirements and the implementation algorithm. LEC has specific command to handle this kind of design comparison requirements. pipeline re-time attribute should be set on the particular design module. This option makes LEC to check the design for any pipelineretiming and if identified, remodel the design.

Conexant Systems, Inc.

Handling Pipeline Re-Timed Gates

o Remodeling of the pipeline-retimed circuit: 1) DFF2Buffer switch is ON, extra flops are modeled as buffers 2) DFF2Buffer switch is OFF, extra flops are modeled as primary outputs.
------------------------------------------------------------------Pipeline-retimed DFF(s) to outputs (Occurence: 4) -------------------------------------------------------------------

Conexant Systems, Inc.

MC Generated and Pipeline Re-Timed Gates

Problem: Design under consideration has 328 primary inputs (PI), 26 primary outputs (PO), 104 D-Flipflops in the golden and 432 D-Flipflops in the revised design. (The extra flops in the revised design are due to pipeline retiming.)

Conexant Systems, Inc.

MC Generated and Pipeline Re-Timed Gates

Formal run without any pipeline-re-time attributes results in not-mapped points.
============================================== Mapped points: SYSTEM class ------------------------------------------------------------------------------Mapped points PI PO DFF Total ------------------------------------------------------------------------------Golden 330 26 104 460 ------------------------------------------------------------------------------Revised 330 26 104 460 ============================================== Unmapped points: ============================================== Revised: -----------------------------------------------------------------------Unmapped points DFF Total -----------------------------------------------------------------------Not-mapped 328 328 ------------------------------------------------------------------------

Solution:
-----------------------------------------------------------------------//add module attribute module_name -pipeline_retime -DFF2Buffer -revised //add pin constraints 1 pipeline_enable_input -both ------------------------------------------------------------------------

Conexant Systems, Inc.

MC Generated and Pipeline Re-Timed Gates

Trace taken from the successful comparison run by LEC is as shown below:
-----------------------------------------------------------------------// Command: set sys mode lec // Processing Golden ... // Modeling Golden ... // Pipeline-retimed 104 DFF(s) as 104 DFF(s) in 4 stage // Converted 104 DFF(s) to BUF(s) // Processing Revised ... // Modeling Revised ... // Pipeline-retimed 432 DFF(s) as 104 DFF(s) in 4 stage // Converted 104 DFF(s) to BUF(s) // Mapping key points ... ============================================== Mapped points: SYSTEM class -------------------------------------------------------------------------------Mapped points PI PO Total -------------------------------------------------------------------------------Golden 328 26 354 -------------------------------------------------------------------------------Revised 328 26 354 ============================================== // Command: add compared points -all // 26 compared points added to compare list // Command: compare ============================================== Compared points PO Total -------------------------------------------------------------------------------Equivalent 26 26 ==============================================

Conexant Systems, Inc.

MC Generated and Pipeline Re-Timed Gates

Limitation: The behavioral RTL cannot be taken directly as golden design. It needs to be studied briefly with reference to the high-level language description for correctness. LEC requires the circuit to be without any feedbacks and feedforwards for pipeline retime modeling. The pipeline-retimed module should be available stand alone for comparison. No provision is availble for logic equivalency checking, if the design is flattened out along with other design modules.

Conexant Systems, Inc.

Multipliers
Steps taken for generic multiplier comparison:
Study of the multiplier circuit. Identify the number of inputs, the type of algorithm implemented and the type of multiplication signed or unsigned. Initial formal run is done with compare effort low. Design similarity is studied. Resource sharing, if any done is taken into consideration. If needed, use the key-point partitioning feature of LEC. Use Divide and Conquer approach.

Conexant Systems, Inc.

Multiplier Abort
Problem: A multiplier with an 8-bit input and 9-bit input and 17-bit output. DesignWare (DW) multiplier component is instantiated for multiplier operation. Formal run took long runtime and ended identifying 17 flops as abort points. Comparison made simpler, one flop (Least Significant Bit) out of the 17 flops is chosen for comparison. Trial runs were done with compare effort low, medium and high. All resulted in abort points.
Conexant Systems, Inc.

Multiplier Abort
Solution: The key-point partitioning feature is tried along with the maximum compare effort option available with LEC as shown below:
--------------------------------------------------------------------------//add pin constraints 0 TC -golden //set compare option -partition flow //set compare effort super ---------------------------------------------------------------------------

Limitation: Equivalency checking of the above multiplier took 15days on a linux64 machine.

Conexant Systems, Inc.

Multiplier Non-equivalence
A signed multiplication circuit is implemented in RTL without any DW component instantiation. Sign extension of the operand variables is done using signed function supported in verilog 2001.

Conexant Systems, Inc.

Multiplier Non-equivalence
Formal run detects non-equivalent points. Diagnosis schematics show hundreds of corresponding and non-corresponding support points. Debugging can be very difficult with diagnosis schematics, in this kind of scenario.

Conexant Systems, Inc.

Multiplier Non-equivalence

Solution:
Use Source Debug and Annotation feature. See the RTL source code and the gate level netlist with test pattern values annotated. Debugging is easier. By default the Source debugging feature is turned off.
-----------------------------------------------------------------set hdl diagnosis ON -------------------------------------------------------------------

Conexant Systems, Inc.

Multiplier Non-equivalence
During diagnosis, Source Debug is available in Diagnosis Manager window

Conexant Systems, Inc.

Multiplier Non-equivalence
Solution: Particular version of synthesis tool doesnt support signed construct. Issue fixed when the version of the synthesis tool is changed.

Conexant Systems, Inc.

Gotchas to Lookout For

Special attention to be given on the messages from LEC. Design is read, modeled and built correctly. Attention needed on: Automatic port conversion Multiple driven nets Black box modeling Disabled clock ports

Conexant Systems, Inc.

Automatic Port Conversion

If an output port is used as an input, LEC models the port as inout. No warnings issued.
-----------------------------------------------------------------------------// Command: set system mode lec // Processing Golden ... // Modeling Golden ... // Added 3 output Z gates // Created 1 Z gate(s) for floating net(s) and floating pin(s) // Converted 4 internal output port(s) to inout port(s) -------------------------------------------------------------------------------

Prevention of automatic port conversion:

set_flatten_model -noin_to_inout/noout_to_inout>

No unwanted port conversion happen.

report messages modeling

Conexant Systems, Inc.

Multiple Driven Nets

Common in the post-layout netlists with ECO fixes being done. Appear with one active driver and one inactive driver. Functionally clean design. But when taken through LEC without automatic port conversion, it will result in non-equivalent points.
LEC treats the high-impedance driver as a valid key point and forces different logic values as an active driver.

Conexant Systems, Inc.

Multiple Driven Nets

Problem: In the example shown, an ECO fix moves an XOR logic to two levels up the design hierarchy.

Conexant Systems, Inc.

Multiple Driven Nets:

The earlier driver net remains as a floating net. When written out as logical netlist in verilog format and taken for formal comparison, non-equivalent points are reported. User can review the non-equivalent point and close the formal verification

(or)
Turn on the port conversion feature here. When automatic port conversion is allowed, LEC modeled SignalA as inout port and formal run passes.

Conexant Systems, Inc.

Multiple Driven Nets:

Limitation: Set flatten model option is applicable for both golden and revised design Cannot be selectively enabled for either of golden or revised design.

Conexant Systems, Inc.

Disabled Clock Ports

All possible key points must be compared. In certain cases, some flops are skipped from comparison because of disabled clock ports.
// Command: compare ============================================== Compared points PO DFF Total --------------------------------------------------Equivalent 128 5656 5784 --------------------------------------------------Non-equivalent 0 7 7 ============================================== // Warning: 356 DFFs/DLATs have 1 disabled clock port: skipped data cone comparison

Track the disabled clock port and identify the reason for clock not reaching these flops. User can use the following command to report all the flops not considered for comparison:
----------------------------------------------------------report message compare -verbose -----------------------------------------------------------

Conexant Systems, Inc.

Black Box Modeling

Black boxes need to be modeled properly to make sure that the interface connections are verified formally. LEC provides two ways to define the black boxes. (1) add no-translate module for the specific module. Description of the module not required. (2) Create dummy wrapper module description with correct port definitions port direction and port width.
Conexant Systems, Inc.

Black Box Modeling

Problem:

A 10-bit address input is taken to a memory macro as shown:

Conexant Systems, Inc.

Black Box Modeling

By the first method, non-equivalent points are reported. Without any port information the black box, LEC has modeled the address line with only 7-bits which are being explicitly used in the design and tied the Address[9:8] inputs to Zero at Module B boundary. By the second method, the formal run is clean as expected.

Conexant Systems, Inc.

Best Practices

Identify issues efficiently - run formal in 3 stages:

RTL Pre-scan netlist
Focus on the issues with logic synthesis Ensures the effective reproduction of the intended logic in RTL. Maximum problems expected. Hierarchical comparison run is preferable.

Pre-scan netlist Post-scan netlist

Issues, if any introduced by DFT tool. Scan enable signal must be constrained. Flat comparison run is preferable.

Post-scan netlist Post-layout netlist

Concentrate on the problems introduced during Place and Route (P&R) Scan enable need to be constrained if scan chain re-ordering is done during P&R Flat comparison run is preferable.

In most cases, Built In Self Test (BIST) mode can also be compared as a part of normal functional circuit.
Conexant Systems, Inc.

Best Practices
Scan Mode signal need not be constrained unless there is a specific requirement. Report all the modeling messages Report not compared points. Avoid using add no-translate module and use dummy wrapper modules for black boxes.

Conexant Systems, Inc.

Conclusion
Complexity of the SoCs is ever-increasing. Requires more complicated analysis and debugging. Matured tools providing these features are very less in the current market. Covered some of the critical equivalency checking exercises demanded by our SoCs designs and how LEC is used to solve all these challenges. With new technological advances in the silicon compilers, compiler generated gates are going to be the next big challenge in formal verification. Design and verification community expects the formal verification tools to stay focused and fine tune to support various upcoming features in synthesis process.
Conexant Systems, Inc.

Reference
1. 2. EncounterTM Conformal Equivalence Checking Reference Guide, Product version 5.0, November 2004. EncounterTM Conformal Equivalence Checking User Guide, Product version 5.0, November 2004.
-----------------------------------------------------------------------------------------------------------

EncounterTM is the trademark of Cadence Design Systems, Inc. Module CompilerTM is the trademark of Synopsys,Inc. DesignWareTM is the trademark of Synopsys, Inc.

Conexant Systems, Inc.

Question & Answer

Conexant Systems, Inc.