A serial design-oriented scalable formal verification method and test method
By modeling the data input and output of serial designs using transaction counters and sampling registers, the problem of not being able to fully inspect data packets in existing technologies is solved, achieving efficient formal verification and improving verification quality and efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XIAN ROADVISION TECH CONSULTING CO LTD
- Filing Date
- 2022-10-20
- Publication Date
- 2026-04-28
AI Technical Summary
Existing technologies cannot cover all possible states of a serial design, resulting in the inability to fully check for issues such as data packet loss, damage, reordering, and duplication. Furthermore, dynamic simulation verification methods have the drawback of not being able to cover boundary conditions.
The data input and output of the serial design are modeled using a transaction counter and a sampling register. The number of input data values and the output time are obtained through the transaction counter. The data is checked in conjunction with the SystemVerilog Assertion module to achieve full coverage of the design space.
It significantly reduces the amount of code, shortens the verification process time, improves verification quality and efficiency, effectively detects design defects, and reduces the consumption of computing resources.
Smart Images
Figure CN115630010B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of chip verification and testing, specifically to a scalable verification and testing method for serial designs. Background Technology
[0002] Serial multiple data packet designs are ubiquitous in System-on-Chip (SoC), such as buses, bus bridges, on-chip interconnects, SoC peripherals, load memory units in the CPU, and memory subsystems. After chip design is completed, thorough verification is required to ensure the correctness of the design functionality and whether it meets the required design specifications.
[0003] The basic characteristic of serial multi-data packet design is that one or more data packets can be written, but the amount of data in each data packet is not fixed. This greatly increases the combination of scenarios that need to be verified, which brings great challenges to the verification of serial design.
[0004] Currently, the most commonly used verification method in actual project development is dynamic simulation. Traditional verification methods based on constraint-based random dynamic simulation require pre-simulating the chip's operating scenarios and manually generating certain stimuli. However, verification personnel typically cannot anticipate all extreme operating scenarios. Therefore, dynamic simulation often suffers from the drawback of not generating sufficiently comprehensive input stimuli to cover all boundary conditions. Even for smaller design modules, dynamic simulation cannot completely exhaustively enumerate the design's state combination space.
[0005] Formal verification is a method that can be used mathematically to prove or disprove the completeness of a design. Formal verification is a comprehensive verification method. We can define certain properties, and it will exhaustively attempt to prove whether our design satisfies or does not satisfy these properties in a rigorous logical manner. Formal verification relies on translating the functional description of the design into an SVA (SystemVerilog Assertion) language description. Because the analysis of formal verification tools is based on Boolean equations for all possible signal inputs, the final result given by formal verification tools is an exhaustive result in a mathematical sense.
[0006] Formal verification, however, becomes increasingly complex as it involves traversing all possible states of the data packets, leading to a state space explosion during runtime. While formal verification can theoretically thoroughly test the correctness of a design, in practice, unless sophisticated methods are employed, it is extremely difficult to traverse all possible states and detect all packet loss, corruption, reordering, and duplication issues throughout the entire data transmission path. Summary of the Invention
[0007] The purpose of this invention is to provide a scalable form verification and testing method for serial designs, overcoming the problems of existing technologies that cannot traverse all possible states and are difficult to detect the loss, damage, reordering, and duplication of all data packets throughout the data transmission path. Compared with commonly used methods for building dynamic simulation verification environments, this invention significantly reduces the amount of code, shortens the time required for the entire verification process, and solves the problem of not being able to cover boundary conditions. The method of predicting and checking the data output position and accurate period reduces the consumption of computing resources, shortens the simulation running time, and improves the quality and efficiency of verification.
[0008] To achieve the above objectives, the present invention provides the following technical solution:
[0009] A scalable formal verification method for serial designs includes the following steps:
[0010] S1: Select any path of a serial design with multiple input channels and multiple output channels for modeling. Predetermine a labeled data packet or a single data, and observe it when it enters and leaves the DUT. During the data input process, use a transaction counter to obtain the number of data inputs before the labeled data value, and then use a transaction counter to predict when the labeled data value appears at the output port, and perform data checking at this time.
[0011] S2: Repeat S1 to obtain all marked data values and the data inspection results when all marked data values enter and leave the DUT, and insert all marked data values from inside the DUT to achieve full coverage of the entire design space.
[0012] Preferably, the tagged data packets or individual data are predefined by the logic data type in SystemVerilog.
[0013] Preferably, if a single data point is predetermined, then for a serial design of single data transmission, a marker data with a maximum bit width is defined.
[0014] Preferably, a transaction counter is used to count at the beginning of the transmission. Each time data is written, if the pre-marked data value is not observed at the input end, the transaction counter is incremented by 1 until the marked data appears on the input port.
[0015] At the output, or anywhere in the middle of the DUT where data needs to be read, the transaction counter is decremented by 1 each time data is read. When the transaction counter value is reduced to 1, the marked data will appear at the currently observed output position in the current clock cycle.
[0016] Preferably, if a multi-data packet is predetermined, it is a serial design for multi-data transmission. If the size of the tag data packet is variable, a tag array with a maximum data bit width and an element count limited by the maximum number of packets is defined.
[0017] Preferably, for a serial design of multi-data packet transmission, four sampling registers are defined: two for monitoring when a marked data packet enters the input port, and the other two for monitoring when a marked data packet leaves the output port.
[0018] At the input end, the start and end conditions of the monitoring data value sampling are obtained through some key signals on the port, so as to model the two sampling registers of the input port: one register is used to sample when the marked data packet starts to be input, and the other register is used to sample when the marked data packet finishes to be input. Only when both registers have completed sampling is the marked data packet considered to have successfully completed input.
[0019] At the output end, the start and end conditions of the monitoring data value sampling are obtained through some key signals on the port. This is used to model the two sampling registers of the output port: one register is used to sample when the marked data packet starts to be output, and the other register is used to sample when the marked data packet finishes to be output. When the sampling start register finishes sampling, but the sampling finish register has not finished sampling, the marked data packet is considered to be being transmitted on the output port. At this time, each piece of data being transmitted on the port can be checked.
[0020] Preferably, another output sampling counter needs to be defined, which is used only to calculate the number of marked data that have appeared on the output port when the marked data packets have been fully input but not all output. Each time the value of this sampling counter changes, it indicates that the newly output marked data needs to be sampled.
[0021] Preferably, the method for checking the marked data packets or individual data during transmission at the output port is to model the behavior of sending data packets received by the input interface to the output within the correct clock cycle through the attributes in the sva module, ensuring that the data is not lost, out of order, or duplicated.
[0022] Preferably, the transaction counter is defined by auxiliary glue logic in Verilog.
[0023] A test method for scalable forms of serial designs, based on the above verification method, includes the following steps:
[0024] First, select a smaller design configuration for the third-party IP, check all the data of the smaller design configuration, set the data buffer depth, packet count and data bit width to very small values, manually inject any possible faults, and capture this design flaw.
[0025] Then, continuously add design configurations, check all data after adding design configurations, continue to manually inject faults, and test whether the test platform's ability to capture design defects can be expanded.
[0026] A scalable testing method for serial designs, based on the above method, includes the following specific steps:
[0027] First, select a smaller design configuration for the third-party IP, set the data buffer depth, number of packets, and data bit width to very small values, and manually inject any possible faults to capture this design flaw.
[0028] Then, we continued to add design configurations and manually inject faults to test whether the test platform's ability to capture design defects could be expanded.
[0029] Compared with existing technologies, the present invention has the following advantages: The present invention provides a scalable formal verification method for serial designs. By selecting any path of a serial design with multiple input and output channels for modeling, a labeled data packet or a single data is pre-determined and observed when it enters and leaves the DUT. During the data input process, a transaction counter is used to obtain the number of data inputs before the labeled data value. Based on the number of data inputs before the labeled data value obtained by the transaction counter, the time when the labeled data value appears at the output port is predicted, and data checks are performed at this time. The above steps are repeated to obtain all labeled data values and the data check results when all labeled data values enter and leave the DUT. All labeled data values are then inserted from inside the DUT. Compared with the commonly used existing dynamic simulation verification environment, this method greatly reduces the amount of code, shortens the time required for the entire verification process, and solves the problem of not being able to cover boundary cases. The method of predicting the data output position and accurate period and performing checks reduces the consumption of computing resources, shortens the simulation running time, and improves the quality and efficiency of verification.
[0030] This invention also provides a scalable testing method for serial designs, which can effectively detect whether the ability of a testing platform to capture design defects can be expanded. Attached Figure Description
[0031] Figure 1 The diagram shows the structure of the verification platform provided by this invention.
[0032] Figure 2 This is a flowchart illustrating the operation of each component in the verification method for single data transmission.
[0033] Figure 3 This is a flowchart illustrating the operation of each component in the verification method for multi-data packet transmission.
[0034] Figure 4 This invention provides logic for checking non-tail data in multi-data packet transmission.
[0035] Figure 5 This invention provides tail data checking logic for multi-data packet transmission.
[0036] Figure 6 This is a schematic diagram of the test methods used to test this verification platform. Detailed Implementation
[0037] The present invention will be further described in detail below with reference to specific embodiments. These descriptions are for explanation purposes only and are not intended to limit the scope of the invention.
[0038] like Figure 1-6 As shown, this invention provides a scalable formal verification method and testing method for serial designs, the specific method of which is as follows.
[0039] like Figure 1 The diagram shows the verification structure built using the scalable formal verification method for serial designs. The DUT (Design Under Test) represents the serial design to be verified. The three input channels and three output channels are only used to explain the implementation of this method and are not a fixed configuration. During application, the number of input and output channels needs to be reduced or increased based on the actual number of input and output channels of the design to be verified.
[0040] The verification structure for serial designs built using this method includes:
[0041] 1) A set of transaction counters.
[0042] During a series of data input processes, a transaction counter is used to accumulate how many data or data packets were input before the marked data or data packet, monitor how many data or data packets were output from the output port, and predict at what time the marked data value is expected to appear at the output port based on the calculated value accumulated by the transaction counter.
[0043] For serial designs with multiple input multiple output channels, each path from an input channel to an output channel should have a corresponding transaction counter defined. The number of transaction counters should be defined by iterating through all combinations of inputs to outputs.
[0044] 2) Four sets of sampling registers.
[0045] A set of input start registers. When the first valid data of a tagged data packet is observed at the input port, the input start register is set to 1, meaning that sampling begins at the start of the input of the tagged data packet. This register value is used to form the lookahead operator in the attribute, serving as one of the judgment conditions for data checking. Each input channel should define its corresponding input start register.
[0046] A set of input completion registers. Once the input start register has finished sampling, it begins observing whether each data point appearing at the input port within a fixed period corresponds one-to-one with the data in the marked data packet. After all marked data has been observed, the input completion register is set to 1, meaning that the input completion time of the marked data packet is sampled. This register value is used to form the lookahead operator in the attribute, serving as one of the judgment conditions for data checking. Each input channel should define its corresponding input completion register.
[0047] A set of output start registers. When the input start register has finished sampling and the transaction counter of the corresponding data channel has decremented to 1, the timing for setting the output start register to 1 is determined based on the valid data signal at the output port. This means sampling is performed at the start of the output of the marked data packet, which forms the lookahead operator in the attribute and serves as one of the judgment conditions for data inspection. Each output channel should define its corresponding output start register.
[0048] A set of output completion registers is used. Once the output start register has finished sampling, the clock cycles required for the output of this data packet to complete are calculated based on the valid data signal at the output port and the number of data packets marked. After a fixed clock cycle, the output completion time of the marked data packet is sampled to form the lookahead operator in the attributes, serving as one of the judgment conditions for data checking. Each output channel should define its corresponding output completion register.
[0049] 3) A set of output sampling counters.
[0050] It is used to calculate how much marked data has appeared on the output port during the sampling process when all the marked data packets have been input but not all output. During the sampling period of a single data packet output, each clock cycle determines whether to increment this counter based on the valid data signal at the output port. Each tick of this counter's value indicates that a new sample of the output marked data is to be taken. In each sampling cycle, elements from the marked data packets are selected based on the value of the output sampling counter and compared with the actual output value.
[0051] Figure 2 The diagram shows the flowchart of each component in the verification method for single data transmission.
[0052] In this paper, single-data transmission specifically refers to a serial design where data is transmitted not in a packet mode, but in units of a single data item with a maximum data bit width during each transmission. This serial design for single-data transmission can significantly reduce the complexity of verification methods and processes.
[0053] In single-data transmission verification methods, there is no need to model the sampling register and output sampling counter. Predicting the output data clock cycle and checking the data can be accomplished using only a transaction counter.
[0054] A predefined tag data value is determined by the logic data type in SystemVerilog. A tag data of the same bit width can be directly defined based on the maximum data bit width specified by the data channel.
[0055] The labeled data must remain stable after each system reset, which allows the formal verification tool to guarantee the stability and uniqueness of these values during each run.
[0056] A transaction counter is used at the start of the transmission. Each time data is written, if the pre-marked data value is not observed at the input, the transaction counter is incremented by 1 until the marked data appears on the input port. At the output, or anywhere data needs to be read in the DUT, the transaction counter is decremented by 1 each time data is read, until the transaction counter reaches 1. At this point, the marked data will appear at the currently observed output position in the current clock cycle. The values of the marked data and the actual output data can then be checked using properties in the SVA (SystemVerilog Assertion) module.
[0057] Figure 3 The diagram shows the flowchart of each component in the verification method for multi-data packet transmission.
[0058] In this paper, multi-data packet transmission specifically refers to a serial design for data transmission in which data packets with a maximum data bit width and a random data volume within a defined range are used as units during each transmission process.
[0059] A predefined tag data packet is defined using the logic data type in SystemVerilog. The tag data packet can be defined as an array limited by the maximum bit width and the maximum number of elements, based on the maximum data width specified by the data channel and the maximum data volume in each packet.
[0060] The tagged data packets must remain stable after each system reset, which allows the formal verification tool to guarantee the stability and uniqueness of these values during each run.
[0061] The transaction counter is defined by auxiliary glue logic in Verilog. Each clock cycle, the system determines whether to increment or decrement the counter based on the valid data signals from the input and output ports.
[0062] At the start of a transmission, a transaction counter is used. Each time a data packet is written, if the pre-marked data packet is not observed at the input, the transaction counter is incremented by 1 until the marked data packet appears on the input port. At the output, or anywhere data needs to be read in the middle of the DUT, the transaction counter is decremented by 1 each time a data packet is read, until the transaction counter reaches 1. At this point, the marked data packet should appear at the currently observed output position within the specified clock cycle of this transmission.
[0063] The prediction of the clock cycle specified for this transmission is accomplished by defining four sampling registers: two for monitoring when the marked data packet enters the input port, and the other two for monitoring when the marked data packet leaves the output port.
[0064] In each sampling period, the attributes in the sva module are used, with the values of the four sampling registers as the criteria, to select which element in the marked data packet to check and compare with the actual output value based on the value of the output sampling counter.
[0065] Figure 4 The diagram shows the logic for checking non-tail data in multi-data packet transmission.
[0066] In this article, "tail data" specifically refers to the last data in each data packet during transmission. In other words, "non-tail data" refers to all data in each data packet except for the last data.
[0067] For the inspection of non-tail data, a loop is used to model the properties of the data inspection. The number of loops is determined by the amount of data in the tagged packets.
[0068] In each loop, the value of the output sampling counter and the status of the four sets of sampling registers are used as the judgment conditions. Only when the input start register, input completion register, and output start register have completed sampling at the same time, and the output completion register has not been sampled, can the corresponding marked data and the actual output data be compared and checked based on the value of the output sampling counter.
[0069] Figure 5 The diagram shows the logic for checking the tail data in multi-data packet transmission.
[0070] For checking the tail data, only the attributes of one data point need to be modeled. The value of the output sampling counter and the state of the four sets of sampling registers are used as the judgment conditions. Only when the input start register, input completion register, and output start register have completed sampling simultaneously, and the rising edge of the output completion register has been reached, can the corresponding marked tail data and the actual output tail data be compared and checked based on the value of the output sampling counter.
[0071] Figure 6 The diagram shows the test method used to test this verification platform.
[0072] First, a third-party IP with serial design features, multiple input channels, and multiple output channels should be selected. The above verification method should be used to model and check it, and a detailed proof should be made to observe whether all the attributes modeled using this method can pass.
[0073] In practice, the third-party IP is generated using the open-source kit provided by ARM. The configuration of three input channels and three output channels is only for explaining this implementation method and is not a fixed configuration. During application, it is necessary to reduce or increase the number of input channels and output channels according to the actual number of input channels and output channels of the design to be tested.
[0074] It is necessary to select a combination of multiple input and output channels to complete a comprehensive check of the entire design IP.
[0075] The correctness of the platform was tested and verified using a manual fault injection method. First, a smaller design configuration was selected for the third-party IP, with the data buffer depth and packet count set to 2 and the data bit width set to 32. On each data transmission path within the design, any possible faults, including data loss, corruption, reordering, and duplication, were manually injected to verify whether the properties in the test platform could assert failure and successfully capture this design flaw.
[0076] By increasing the design configuration, setting the data buffer depth, number of data packets, and data bit width to larger values, and continuing to manually inject faults, the test platform's ability to capture design defects still meets the requirements, and the verification method has good scalability.
[0077] Although embodiments of the present invention have been described above in conjunction with the accompanying drawings, the present invention is not limited to the specific embodiments and application fields described above. The specific embodiments described above are merely illustrative and instructive, and not restrictive. Those skilled in the art, guided by the specification, can make many other modifications without departing from the scope of the claims of the present invention, and all of these modifications are within the scope of protection of the present invention.
Claims
1. A scalable formal verification method for serial designs, characterized in that, Includes the following steps: S1: Select any path of a serial design with multiple input channels and multiple output channels for modeling. Predetermine a labeled data packet or a single data, and observe it when it enters and leaves the DUT. During the data input process, use a transaction counter to obtain the number of data inputs before the labeled data value, and then use a transaction counter to predict when the labeled data value appears at the output port, and perform data checking at this time. S2: Repeat S1 to obtain all marked data values and the data inspection results when all marked data values enter and leave the DUT, and insert all marked data values from inside the DUT to achieve full coverage of the entire design space; The process involves using a transaction counter to obtain the number of data inputs before the marked data value appears, then using the transaction counter to predict when the marked data value will appear at the output port, and performing data checks at that moment. Specifically: For checking non-tail data, a loop is used to model the attributes of the data being checked. The number of loops is determined by the amount of data in the marked data packet. In each loop, the value of the output sampling counter and the state of the four sets of sampling registers are used as the judgment conditions. Only when the input start register, input completion register, and output start register have completed sampling simultaneously, and the output completion register has not been sampled, is the corresponding marked data and the actual output data compared and checked based on the value of the output sampling counter. For checking tail data, only one data item needs to be modeled. The value of the output sampling counter and the state of the four sets of sampling registers are used as the judgment conditions. Only when the input start register, input completion register, and output start register have completed sampling simultaneously, and the rising edge of the sampling of the output completion register is waited for, is the corresponding marked tail data and the actual output tail data compared and checked based on the value of the output sampling counter.
2. The scalable formal verification method for serial designs according to claim 1, characterized in that, Predetermined tagged data packets or individual data are defined by the logic data type in SystemVerilog.
3. The scalable formal verification method for serial designs according to claim 1, characterized in that, If a single data point is predetermined, then for a serial design of single data transmission, a marker data with a maximum bit width is defined.
4. The scalable formal verification method for serial designs according to claim 3, characterized in that, A transaction counter is used to count at the beginning of the transmission. Each time data is written, if the pre-marked data value is not observed at the input end, the transaction counter is incremented by 1 until the marked data appears on the input port. At the output, or anywhere in the middle of the DUT where data needs to be read, the transaction counter is decremented by 1 each time data is read. When the transaction counter value is reduced to 1, the marked data will appear at the currently observed output position in the current clock cycle.
5. The scalable formal verification method for serial designs according to claim 1, characterized in that, If a multi-data packet is predetermined, it is a serial design for multi-data transmission. If the size of the tag data packet is variable, then a tag array with a maximum data bit width and the number of elements is limited by the maximum number of packets is defined.
6. The scalable formal verification method for serial designs according to claim 5, characterized in that, For a serial design with multiple data packets, four sampling registers are defined: two for monitoring when a marked data packet enters the input port, and the other two for monitoring when a marked data packet leaves the output port. At the input end, the start and end conditions of the monitoring data value sampling are obtained through some key signals on the port, so as to model the two sampling registers of the input port: one register is used to sample when the marked data packet starts to be input, and the other register is used to sample when the marked data packet finishes to be input. Only when both registers have completed sampling is the marked data packet considered to have successfully completed input. At the output end, the start and end conditions of the monitoring data value sampling are obtained through some key signals on the port. This is used to model the two sampling registers of the output port: one register is used to sample when the marked data packet starts to be output, and the other register is used to sample when the marked data packet finishes to be output. When the sampling start register finishes sampling, but the sampling finish register has not finished sampling, the marked data packet is considered to be being transmitted on the output port. At this time, each piece of data being transmitted on the port is checked.
7. The scalable formal verification method for serial designs according to claim 6, characterized in that, Another output sampling counter needs to be defined, which is used only to count the number of marked data that have appeared on the output port when the marked data packets have been fully input but not all output. Each time the value of this sampling counter changes, it indicates that the newly output marked data needs to be sampled.
8. The scalable formal verification method for serial designs according to claim 1, characterized in that, The method for checking the marked data packets or individual data during transmission at the output port is to model the behavior of sending data packets received by the input interface to the output within the correct clock cycle through the attributes in the sva module, ensuring that the data is not lost, out of order, or duplicated.
9. The scalable formal verification method for serial designs according to claim 1, characterized in that, The transaction counter is defined by auxiliary glue logic in Verilog.
10. A test method for scalable forms of serial designs, based on the verification method according to any one of claims 1-9, comprising the following steps: First, select a smaller design configuration for the third-party IP, check all the data of the smaller design configuration, set the data buffer depth, packet count and data bit width to very small values, manually inject any possible faults, and capture this design flaw. Then, continuously add design configurations, check all data after adding design configurations, continue to manually inject faults, and test whether the test platform's ability to capture design defects can be expanded.
Citation Information
Patent Citations
Verifying a hardware design for a component that implements a permutation respecting function
CN110321522A
Computer-implemented method for providing data, in particular for conformity tracking
CN112119417A