Form verification method of integrated circuit

Abstract

The invention discloses a formal verification method for an integrated circuit, and the method comprises the steps: obtaining to-be-verified attributes, and sequentially analyzing each attribute; if the analyzed attribute does not exist, or the current attribute and the analyzed attribute do not have an association relationship, directly generating an influence cone corresponding to the current attribute for the current attribute, and recording a signal set; if the current attribute and the analyzed attribute are associated attributes, the influence cone sharing degree of the current attribute and the analyzed attribute is judged; if the influence cone sharing degree of the two is lower than a preset sharing degree, directly generating an influence cone corresponding to the current attribute for the current attribute, and recording a signal set corresponding to the influence cone; otherwise, generating an extended influence cone as an influence cone of the current attribute and the analyzed attribute, and recording a signal set corresponding to the influence cone; the extended cones are influence cones generated by adding signals of the current attributes on the basis of the corresponding influence cones; and when all attributes are analyzed, performing form verification based on an influence cone. According to the invention, repeated verification can be reduced and verification efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of formal verification of integrated circuits, and in particular to a formal verification method for integrated circuits. Background Art

[0002] As the complexity of integrated circuits increases, formal verification needs to check a large number of properties on the same design. Attributes include assertion attributes, constraint attributes, and coverage attributes.

[0003] Assertion properties are used to check whether the actual behavior of the design meets expectations. Common assertion properties include the following cases.

[0004] Safety Assertions: Ensure that the system will not enter an undesirable state under certain conditions. For example, "If input A of the circuit design is high, output B must remain high for 100 clock cycles."

[0005] Liveness Assertions: Ensure that certain events will eventually occur. For example, "If a request signal in a circuit design is activated, a response should be obtained within a limited time."

[0006] Temporal Assertions: Check the relationship between signals in time, for example, "Signal X must go high within 3 clock cycles after the rising edge of signal Y."

[0007] Constraint attributes are used to define the prerequisites for design behavior. Common constraint attributes include the following.

[0008] Environmental Assumptions: Assumptions about the behavior of certain input signals under certain circumstances. For example, "the valid state of input signal A is between clock cycles 0 and 10".

[0009] Interface Assumptions: Specifies the interaction with external interfaces. For example, "external signal X should not be high and low at the same time in a clock cycle."

[0010] Coverage attributes are used to monitor whether a specific event occurs. Common coverage attributes include the following.

[0011] State Coverage: Checks whether all possible states in the design are triggered.

[0012] Condition Coverage: Ensure that all conditions have experienced all possible truth value combinations.

[0013] Cross Coverage: Monitors the occurrence of events for multiple signal combinations, for example, "Signals A and B are high at the same time."

[0014] However, conventional formal verification tools currently usually solve all attributes at the same time or at one time. That is, COI (cone of influence) is used for division, and each attribute is divided into a single COI, and then the verification is performed multiple times in succession. This method requires multiple traversals of the COI and calls to the verification engine. Or the entire design is verified at one time in combination with all attributes. This method can avoid multiple traversals, but each verification is the entire design, the verification space is too large, and there is a phenomenon of repeated verification. If you want to use a metaphor to illustrate that the verification space is too large, the process of formal verification can be understood as solving an equation. The verification space is the number of variables in the equation. The more variables, the larger the verification space, and the greater the computational complexity. For the one-time verification of the entire circuit design combined with all attributes, this is because the COI obtained at this time involves all signals of the integrated circuit. The larger the signal volume, the larger the verification space and the more complex the verification.

[0015] Therefore, how to efficiently verify a large number of attributes within a limited verification cycle is a technical problem to be solved. Summary of the invention

[0016] In order to solve the technical problems of either too many traversal times or too many repeated verifications in the prior art, the present invention proposes a formal verification method for integrated circuits.

[0017] The formal verification method of the integrated circuit proposed by the present invention comprises:

[0018] Obtaining properties of the integrated circuit to be verified, and analyzing each property in turn;

[0019] If there is no analyzed attribute, or there is no correlation between the current attribute and any analyzed attribute, then directly generate the corresponding influence cone for the current attribute and record the signal set corresponding to the influence cone;

[0020] If the current attribute is related to any of the analyzed attributes, the degree of sharing of the influence cones of the two is determined;

[0021] If the degree of sharing of the influence cones of the two is lower than the preset degree of sharing, the corresponding influence cone is directly generated for the current attribute, and the signal set corresponding to the influence cone is recorded; otherwise, based on the influence cone of the corresponding analyzed attribute, an extended influence cone is generated as the influence cone of the current attribute and the analyzed attribute, and the signal set corresponding to the influence cone is recorded; the extended cone is an influence cone generated by adding the signal of the current attribute on the basis of the corresponding influence cone;

[0022] When all properties are analyzed, formal verification is performed based on the influence cone of the properties.

[0023] Further, analyzing the attribute includes analyzing a signal and a state related to the attribute.

[0024] Further, determining whether the current attribute and any analyzed attribute are mutually related attributes includes: determining whether the signal of the current attribute belongs to a signal set of any analyzed attribute; if so, the current attribute and the analyzed attribute are mutually related attributes, otherwise the two are not related.

[0025] Further, judging the degree of sharing between the current attribute and its associated attributes includes:

[0026] Determine in sequence the degree of sharing between each signal of the current attribute and the associated attribute of the current attribute;

[0027] Find the current signal in the influence cone of the associated attribute of the current attribute;

[0028] Count the number m of primitives that the current signal spans to the top of the influence cone, and the number n of primitives that the current signal spans to the bottom of the influence cone;

[0029] If m and n satisfy n<m*k, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are lower than the preset sharing degree; otherwise, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are higher than the preset sharing degree, 0<k<1.

[0030] Furthermore, the attribute includes at least one of an assertion attribute, a constraint attribute, and a coverage attribute.

[0031] Furthermore, the signal of the attribute includes at least one of an input signal, an output signal, an internal signal, a home signal and a reset signal.

[0032] The present invention studies the sub-problem sharing relationship between the attributes of the integrated circuit, thereby reducing the number of influence cones of the attribute, avoiding multiple repeated verifications, and improving the overall verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The present invention is described in detail below with reference to the embodiments and accompanying drawings, wherein:

[0034] Figure 1 It is the main flow chart of the present invention.

[0035] Figure 2(a) to Figure 2(c) It is a schematic diagram of the degree of sharing of attribute sub-problems.

[0036] Figure 3 It is a comparison chart of verification time between the present invention and the prior art. DETAILED DESCRIPTION

[0037] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0038] Thus, a feature indicated in this specification will be used to illustrate one of the features of an embodiment of the present invention, rather than implying that each embodiment of the present invention must have the described feature. In addition, it should be noted that this specification describes many features. Although some features can be combined together to illustrate possible system designs, these features can also be used in other combinations that are not explicitly described. Thus, unless otherwise stated, the described combinations are not intended to be limiting.

[0039] The formal verification method of an integrated circuit proposed by the present invention comprises the following steps.

[0040] Obtaining properties of the integrated circuit to be verified, and analyzing each property in turn;

[0041] During the analysis process, for each current attribute, that is, the attribute that is currently being analyzed and is to be processed, a corresponding judgment is made. If there is no attribute that has been analyzed, that is, the current attribute is the first attribute, and no attribute has been analyzed to generate an influence cone, then the corresponding influence cone is directly generated for the current attribute, and the signal set corresponding to the influence cone is recorded.

[0042] Alternatively, if the current attribute has no correlation with any of the analyzed attributes, that is, the current attribute is not the first attribute, but is relatively independent of the analyzed attributes that have been analyzed and have generated influence cones, then the corresponding influence cone is directly generated for the current attribute, and the signal set corresponding to the influence cone is recorded.

[0043] If the current attribute is related to any of the analyzed attributes, it is necessary to determine the degree of sharing of the influence cones of the two.

[0044] If the sharing degree of the influence cones of the two is lower than the preset sharing degree, the corresponding influence cone is directly generated for the current attribute, and the signal set corresponding to the influence cone is recorded; otherwise, based on the influence cone of the corresponding analyzed attribute, an extended influence cone is generated as the influence cone of the current attribute and the analyzed attribute, and the signal set corresponding to the influence cone is recorded. The extended cone is an influence cone generated by adding the signal of the current attribute on the basis of the corresponding influence cone, which reduces the number of influence cones.

[0045] When all properties are analyzed, formal verification is performed based on the influence cone of these properties.

[0046] The method of the present invention makes optimal use of the sharing of sub-problems between attributes, thereby avoiding repeated verifications and improving the overall verification efficiency of the integrated circuit.

[0047] In the present invention, analyzing attributes refers to analyzing attribute-related signals and states.

[0048] In one embodiment, analyzing the attributes may include the following steps.

[0049] First, clarify the content of the attribute, and understand and analyze the attribute to be verified in detail, including its logical expression and specific meaning.

[0050] Identify the various signals associated with the attribute, including but not limited to input, output, and internal signals, and ensure that their changes over time can be tracked.

[0051] Create state transition diagrams, such as the states of a finite state machine, to understand the scope of the effects of properties.

[0052] Analyze the timing conditions involved in the attributes and clarify the time relationship of signal changes to determine the time range of impact.

[0053] Identify any constraints associated with the property and ensure that the cone of influence reflects the limits of those constraints.

[0054] Build or adjust the model used for formal verification to ensure it contains all necessary information to correctly generate the cone of influence.

[0055] In one embodiment, determining whether the current attribute and any analyzed attribute are mutually related attributes includes: determining whether the signal of the current attribute belongs to a signal set of any analyzed attribute; if so, the current attribute and the analyzed attribute are mutually related attributes, otherwise the two are not related.

[0056] For example, the current attribute is the third attribute, and its signals are A and C. The attributes that have been analyzed are the first attribute and the second attribute. The elements in the signal set of the first attribute are A, B, and C, and the elements in the signal set of the second attribute are A, D, and E. Obviously, the signal of the third attribute belongs to the signal set of the first attribute, and does not belong to the signal set of the second attribute. The third attribute and the first attribute are mutually related attributes, and there is no correlation between the third attribute and the second attribute. The non-correlation defined in the present invention is only for the implementation of the steps of the present invention, and does not mean that the two attributes have no relationship. By analyzing whether the two attributes are mutually related, it is helpful to further find the degree of sharing of their influence cones.

[0057] In one embodiment, the present invention determines the degree of sharing of the influence cone of the current attribute and its associated attributes, including the following steps.

[0058] Determine in sequence the degree of sharing between each signal of the current attribute and the associated attribute of the current attribute;

[0059] Find the current signal in the influence cone of the associated attribute of the current attribute;

[0060] Count the number of primitives m that the current signal spans to the top of the influence cone, and the number of primitives n that the current signal spans to the bottom of the influence cone.

[0061] If m and n satisfy n<m*k, it is considered that the influence cone corresponding to the current signal and the influence cone of the associated attribute are lower than the preset sharing degree; otherwise, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are higher than the preset sharing degree, 0<k<1.

[0062] An attribute usually has multiple signals. If the influence cones corresponding to all signals of an attribute are highly shared with the influence cone of the associated attribute of the attribute, then the influence cone of this attribute is highly shared with the influence cone of its associated attribute. If the influence cones corresponding to some signals of an attribute are highly shared with the influence cone of the associated attribute, and some are lowly shared. At this time, the influence cone should be generated per signal. For example, an attribute has two signals, A and B, and the influence cone corresponding to the A signal is highly shared with the influence cone of the associated attribute. Then, the A signal is added to the influence cone of the associated attribute to generate an extended influence cone. If the influence cone corresponding to the B signal is lowly shared with the influence cone of the associated attribute, then the corresponding influence cone is generated for the B signal alone.

[0063] When two attributes are related to each other, but the degree of sharing of their influence cones is lower than the preset sharing degree, the present invention believes that there is no high sharing relationship between the two attributes. Therefore, the two attributes generate their influence cones separately, which will not lead to too much repeated verification. However, when the degree of sharing of the influence cone between the two attributes is higher than the preset sharing degree, it indicates that the two attributes are in a high sharing relationship. At this time, it is necessary to pay attention to the generation of their influence cones to avoid too much repeated verification. It should be noted that the sharing degree of the influence cone of the present invention is higher than the preset sharing degree, which means that it is greater than or equal to the preset sharing degree.

[0064] The attributes referred to in the present invention include at least one of assertion attributes, constraint attributes and coverage attributes.

[0065] The signal of the attribute referred to in the present invention includes at least one of an input signal, an output signal, an internal signal, a clock signal and a reset signal.

[0066] like Figure 1 As shown, a specific example is used below to illustrate the concept of the present invention. In this specific example, assuming that there are N attributes waiting for formal verification, each attribute Pi, i=1, ..., N is analyzed in turn.

[0067] Analyze the first attribute P1, traverse the signals in the first attribute P1, form the influence cone C1 of the first attribute P1, and record the signal set S1 of the influence cone C1;

[0068] Analyze the second attribute P2 and first determine whether the signal of the second attribute P2 belongs to the signal set S1 of the first attribute;

[0069] If the signal of the second attribute P2 belongs to the signal set S1, the position of the signal in the influence cone C1 is further analyzed to determine the degree of sharing of the influence cone between the second attribute P2 and the first attribute P1.

[0070] The method for determining the position includes but is not limited to judging the relative position of the signal and the top and bottom of the influence cone C1. If the signal is close to the bottom of the cone, it is assumed that the first attribute P1 and the second attribute P2 are low-shared, and the influence cone C2 is regenerated for the second attribute P2; if the signal is close to the top of the cone, it is assumed that the first attribute P1 and the second attribute P2 are highly shared, and the influence cone C1 is expanded to form the influence cone C1'.

[0071] As shown in Figure 2(a) and Figure 2(b), the first attribute P1 and the second attribute P2 are low-shared, then the influence cones C1 and C2 are generated respectively, and the corresponding signal sets are S1 and S2;

[0072] If the signal of the second attribute P2 does not belong to S1, directly generate a new influence cone C2 and record the signal set S2 of influence cone C2;

[0073] Analyze the third attribute P3, and determine whether the signal of the third attribute P3 belongs to signal set S1 and signal set S2 in turn. If so, further determine the degree of sharing of the influence cones of the two attributes according to the above method; if not, directly generate the influence cone C3 of the third attribute, and record the signal set S3 of the influence cone C3.

[0074] As shown in Figure 2(a), the third attribute P3 and the first attribute P1 are not shared, while as shown in Figure 2(c), the third attribute P3 and the second attribute P2 are highly shared. Then, the influence cone C2' is formed by expanding on the basis of the second attribute P2;

[0075] Continue to process the fourth attribute in the same way as above, until the Nth attribute. When all attributes have been analyzed, proceed to the next step of formal verification.

[0076] The present invention uses the sharing of sub-problems between attributes to avoid repeated verification and improve the overall verification efficiency. The present invention selects some modules in RISC-V (open source instruction architecture set) as examples for performance analysis, such as Figure 3 As shown, the upper curve is the formal verification time of the prior art, and the lower curve is the formal verification time of the present invention. It can be seen that the formal verification time is greatly reduced after adopting the present invention.

[0077] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A formal verification method for an integrated circuit, characterized in that: include: Obtaining properties of the integrated circuit to be verified, and analyzing each property in turn; If there is no analyzed attribute, or there is no correlation between the current attribute and any analyzed attribute, then directly generate the corresponding influence cone for the current attribute and record the signal set corresponding to the influence cone; If the current attribute is related to any of the analyzed attributes, the degree of sharing of the influence cones of the two is determined; If the sharing degree of the influence cones of the two is lower than the preset sharing degree, the corresponding influence cone is directly generated for the current attribute, and the signal set corresponding to the influence cone is recorded; otherwise, based on the influence cone of the corresponding analyzed attribute, an extended influence cone is generated as the influence cone of the current attribute and the analyzed attribute, and the signal set corresponding to the influence cone is recorded; The extended cone is an influence cone generated by adding the signal of the current attribute to the corresponding influence cone; When all properties are analyzed, formal verification is performed based on the influence cone of the properties.

2. The formal verification method of an integrated circuit as claimed in claim 1, characterized in that: Analyzing the attribute includes analyzing a signal and a state related to the attribute.

3. The formal verification method of an integrated circuit as claimed in claim 1, characterized in that: Determining whether the current attribute and any analyzed attribute are mutually related attributes includes: determining whether the signal of the current attribute belongs to the signal set of any analyzed attribute; if so, the current attribute and the analyzed attribute are mutually related attributes, otherwise the two have no related relationship.

4. The formal verification method of an integrated circuit as claimed in claim 3, characterized in that: Determining the degree of sharing between the current attribute and its associated attributes includes: Determine in sequence the degree of sharing between each signal of the current attribute and the associated attribute of the current attribute; Find the current signal in the influence cone of the associated attribute of the current attribute; Count the number m of primitives that the current signal spans to the top of the influence cone, and the number n of primitives that the current signal spans to the bottom of the influence cone; If m and n satisfy n<m*k, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are lower than the preset sharing degree; otherwise, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are higher than the preset sharing degree, 0<k<1.

5. The formal verification method for an integrated circuit according to any one of claims 1 to 4, characterized in that: The attribute includes at least one of an assertion attribute, a constraint attribute, and a coverage attribute.

6. The formal verification method of an integrated circuit as claimed in claim 2, characterized in that: The signal of the attribute includes at least one of an input signal, an output signal, an internal signal, a clock signal and a reset signal.

Images