Formal verification method for integrated circuits

Abstract

The application discloses a form verification method of an integrated circuit, which comprises the following steps: obtaining attributes to be verified, and analyzing each attribute in sequence; if there is no analyzed attribute or the current attribute is irrelevant to the analyzed attribute, generating an influence cone corresponding to the current attribute, and recording a signal set; if the current attribute and the analyzed attribute are associated attributes, judging the sharing degree of the influence cones of the two attributes; if the sharing degree of the influence cones of the two attributes is lower than a preset sharing degree, generating an influence cone corresponding to the current attribute, and recording a signal set corresponding to the influence cone; otherwise, generating an extended influence cone as the influence cone of the current attribute and the analyzed attribute, and recording a signal set corresponding to the influence cone; the extended cone is an influence cone generated by adding the signal of the current attribute to the corresponding influence cone; and when all the attributes are analyzed, performing form verification based on the influence cones. The application can reduce repeated verification and improve verification efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of formal verification of integrated circuits, and more particularly, to a method of formal verification of integrated circuits. BACKGROUND

[0002] With the increasing complexity of integrated circuits, formal verification needs to check a large number of properties on the same design. Properties include Assertion, Assumption, and Coverage.

[0003] Assertion properties are used to check whether the actual behavior of the design meets the expectations. Common assertion properties include the following cases.

[0004] Safety Assertions: Ensure that the system does not enter an undesirable state under certain conditions. For example, "If the input A of the circuit design is high, then the output B must remain high for 100 clock cycles."

[0005] Liveness Assertions: Ensure that certain events will eventually occur. For example, "If the request signal of the circuit design is activated, a response should be obtained within a limited time."

[0006] Temporal Assertions: Check the relationship of signals in time, for example, "Signal X must become high within 3 clock cycles after the rising edge of signal Y."

[0007] Assumption properties are used to define the preconditions of the design behavior. Common assumption properties include the following cases.

[0008] Environmental Assumptions: Assume the behavior of certain input signals under certain conditions. For example, "The valid state of input signal A is between clock cycles 0 and 10."

[0009] Interface Assumptions: Specify the way of interaction with external interfaces. For example, "External signal X should not be high and low at the same time within a clock cycle."

[0010] Coverage properties are used to monitor whether certain events occur. Common coverage properties include the following cases.

[0011] State Coverage: Check whether all possible states in the design are triggered.

[0012] Condition Coverage: Ensures that all conditions have experienced all possible combinations of truth values.

[0013] Cross Coverage: Monitors the occurrence of events that combine multiple signals, such as "A and B are high at the same time."

[0014] However, the current conventional formal verification tools usually solve all properties at the same time or once. That is, COI (cone of influence) is divided, each property is divided into a single COI, and then verification is performed continuously multiple times. This method requires multiple traversals of COI and calls to the verification engine. Or the entire design is verified with all properties at once. This method can avoid multiple traversals, but each verification is the entire design, the verification space is too large, and there is multiple repeated verification. If the verification space is too large, the process of formal verification can be understood as solving equations, the number of variables in the equation is the verification space, the more variables, the larger the verification space, and the greater the computational complexity. For the entire circuit design combined with all properties verified at once, this is because the COI obtained at this time involves all signals of the integrated circuit, the larger the number of signals, the larger the verification space, and the more complex the verification.

[0015] Therefore, how to efficiently verify a large number of properties within a limited verification period is a technical problem to be solved. SUMMARY

[0016] In order to solve the technical problems of too many traversal times or too much repeated verification in the prior art, the present application provides a formal verification method for integrated circuits.

[0017] The formal verification method for integrated circuits provided by the present application comprises:

[0018] Obtaining the properties to be verified of the integrated circuit, and sequentially analyzing each property;

[0019] If there is no analyzed property, or the current property has no correlation with any analyzed property, then directly generating the corresponding cone of influence for the current property, and recording the signal set corresponding to the cone of influence;

[0020] If the current property and any analyzed property are mutually correlated properties, then judging the sharing degree of the cones of influence of the two properties;

[0021] if the sharing degree of the influence cones of the two is lower than a preset sharing degree, generating an influence cone corresponding to the current attribute directly, and recording a signal set corresponding to the influence cone; otherwise, generating an extended influence cone as the influence cone of the current attribute and the analyzed attribute based on the influence cone of the analyzed attribute, and recording a signal set corresponding to the extended influence cone; the extended cone is an influence cone generated by appending the signal of the current attribute to the corresponding influence cone;

[0022] when all the attributes are analyzed, performing formal verification based on the influence cones of the attributes.

[0023] Further, analyzing the attribute includes analyzing the signal and state related to the attribute.

[0024] Further, judging whether the current attribute and any analyzed attribute are associated attributes includes: judging whether the signal of the current attribute belongs to the signal set of any analyzed attribute; if yes, the current attribute and the analyzed attribute are associated attributes, otherwise, the two have no associated relationship.

[0025] Further, judging the sharing degree of the current attribute and its associated attribute includes:

[0026] judging the sharing degree between each signal of the current attribute and the associated attribute of the current attribute in sequence;

[0027] finding the current signal in the influence cone of the associated attribute of the current attribute;

[0028] counting the number m of primitives crossed by the current signal to the top of the influence cone, and the number n of primitives crossed by the current signal to the bottom of the influence cone;

[0029] if m and n satisfy n < m*k, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are lower than the preset sharing degree, otherwise, it is considered that the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are higher than the preset sharing degree, 0 < k < 1.

[0030] Further, the attribute includes at least one of the assertion attribute, the constraint attribute and the coverage attribute.

[0031] Further, the signal of the attribute includes at least one of the input signal, the output signal, the internal signal, the always signal and the reset signal.

[0032] The present application reduces the number of influence cones of the attributes by studying the sub-problem sharing relationship between the attributes of the integrated circuit, avoids multiple repeated verification, and improves the overall verification efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0033] The present application will be described in detail below with reference to the embodiments and the accompanying drawings, in which:

[0034] Figure 1 is the main flow chart of the present application.

[0035] Figures 2(a) to 2(c) is a schematic diagram of the sharing degree of attribute sub-problems.

[0036] Figure 3 is a comparison diagram of verification time of the present application and prior art. DETAILED DESCRIPTION

[0037] In order to make the technical problems to be solved by the present application, technical solutions and beneficial effects clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0038] Therefore, one feature indicated in the specification will be used to explain one feature of one embodiment of the present application, and it is not implied that each embodiment of the present application must have the explained feature. In addition, it should be noted that the specification describes many features. Although certain features can be combined together to show possible system designs, these features can also be used in other combinations that are not explicitly described. Therefore, unless otherwise specified, the explained combinations are not intended to be limiting.

[0039] The form verification method of the integrated circuit provided by the present application comprises the following steps.

[0040] Obtaining the attributes to be verified of the integrated circuit, and analyzing each attribute in turn;

[0041] In the process of analysis, for each current attribute, i.e. the attribute currently analyzed and to be processed, corresponding judgment is performed, if there is no analyzed attribute, i.e. the current attribute is the first attribute, and no attribute has been analyzed to generate an influence cone, the influence cone corresponding to the current attribute is directly generated, and the signal set corresponding to the influence cone is recorded.

[0042] Alternatively, the current attribute has no correlation with any analyzed attribute, i.e. the current attribute is not the first attribute, but is relatively independent compared with the analyzed attribute which has been analyzed and generated an influence cone, the influence cone corresponding to the current attribute is directly generated, and the signal set corresponding to the influence cone is recorded.

[0043] If the current attribute and any analyzed attribute are mutually correlated attributes, the sharing degree of the influence cones of the two attributes needs to be judged.

[0044] If the sharing degree of the influence cones of the two is lower than the preset sharing degree, an influence cone corresponding to the current attribute is directly generated, and a signal set corresponding to the influence cone is recorded; otherwise, an extended influence cone is generated as the influence cone of the current attribute and the analyzed attribute based on the influence cone of the analyzed attribute, and a signal set corresponding to the influence cone is recorded. The extended cone is an influence cone generated by appending the signal of the current attribute to the corresponding influence cone, thereby reducing the number of influence cones.

[0045] When all the attributes are analyzed, formal verification is performed based on the influence cones of the attributes.

[0046] By the method of the application, the sub-problem sharing between attributes is optimally utilized, thereby avoiding repeated verification and improving the overall verification efficiency of the integrated circuit.

[0047] In the application, analyzing an attribute refers to analyzing the signals and states related to the attribute.

[0048] In one embodiment, analyzing an attribute can include the following steps.

[0049] First, the content of the attribute is determined, and the attribute to be verified is understood and analyzed in detail, including its logical expression and specific meaning.

[0050] Various signals related to the attribute are identified, including but not limited to input, output and internal signals, to ensure that their changes over time can be tracked.

[0051] A state transition diagram, such as the states of a finite state machine, is created to understand the scope of the attribute influence.

[0052] The timing conditions involved in the attribute are analyzed to determine the time relationship of signal changes and the time range of the influence.

[0053] Any constraint conditions related to the attribute are confirmed to ensure that the influence cone reflects the limitations of these constraints.

[0054] A model for formal verification is constructed or adjusted to ensure that it contains all necessary information for correct generation of the influence cone.

[0055] In one embodiment, determining whether the current attribute and any analyzed attribute are associated attributes includes: determining whether the signal of the current attribute belongs to the signal set of any analyzed attribute; if yes, the current attribute and the analyzed attribute are associated attributes, otherwise, the two have no association.

[0056] For example, the current attribute is the third attribute, its signal is A, C, the analyzed attributes are the first attribute and the second attribute, the signal set of the first attribute has A, B, C, and the signal set of the second attribute has A, D, E, obviously, the signal of the third attribute belongs to the signal set of the first attribute, does not belong to the signal set of the second attribute, the third attribute and the first attribute are associated attributes, and the third attribute and the second attribute have no associated relationship, the non-associated relationship defined in the application is only for the implementation of the steps of the application, and does not mean that the two attributes have no relationship. By analyzing whether the two attributes are associated with each other, the sharing degree of their influence cones can be further searched.

[0057] In one embodiment, the application determines the sharing degree of the influence cone of the current attribute and its associated attribute, including the following steps.

[0058] The sharing degree between each signal of the current attribute and the associated attribute of the current attribute is determined in sequence;

[0059] The current signal is found in the influence cone of the associated attribute of the current attribute;

[0060] The number m of the base elements crossed by the current signal to the top of the cone, and the number n of the base elements crossed by the current signal to the bottom of the cone are counted,

[0061] If m and n satisfy n < m*k, it is considered that the influence cone corresponding to the current signal is lower than the preset sharing degree with the influence cone of the associated attribute, otherwise, it is considered that the influence cone corresponding to the current signal is higher than the preset sharing degree with the influence cone corresponding to the associated attribute, 0 < k < 1.

[0062] An attribute usually has multiple signals, if all the signals of an attribute correspond to the influence cones which are high sharing with the influence cones of the associated attributes, the influence cone of the attribute is high sharing with the influence cones of the associated attributes. If some signals of an attribute correspond to the influence cones which are high sharing with the influence cones of the associated attributes, and some are low sharing, at this time, the influence cone should be generated in units of signals. For example, an attribute has A, B two signals, the influence cone corresponding to the A signal is high sharing with the influence cone of the associated attribute, so the A signal is appended to the influence cone of the associated attribute to generate an extended influence cone. The influence cone corresponding to the B signal is low sharing with the influence cone of the associated attribute, so the influence cone corresponding to the B signal is generated separately.

[0063] When two attributes are related but their influence cones share less than a preset sharing level, this invention considers them not to have a high sharing relationship. Therefore, generating influence cones for each attribute separately will not lead to excessive duplicate verification. However, when the influence cones of two attributes share more than the preset sharing level, it indicates a high sharing relationship. In this case, careful attention needs to be paid to the generation of their influence cones to avoid excessive duplicate verification. It should be noted that in this invention, "influence cone sharing greater than the preset sharing level" means greater than or equal to the preset sharing level.

[0064] The attributes referred to in this invention include at least one of assertion attributes, constraint attributes, and coverage attributes.

[0065] The signal of the attribute referred to in this invention includes at least one of the following: input signal, output signal, internal signal, start signal, and reset signal.

[0066] like Figure 1 As shown, the concept of this invention will be illustrated below with a specific example. In this specific example, assume there are N attributes awaiting formal verification, then each attribute Pi, i = 1, ..., N, will be analyzed sequentially.

[0067] Analyze the first attribute P1, traverse the signals in the first attribute P1, form the influence cone C1 of the first attribute P1, and record the signal set S1 of the influence cone C1.

[0068] To analyze the second attribute P2, first determine whether the signal of the second attribute P2 belongs to the signal set S1 of the first attribute.

[0069] If the signal of the second attribute P2 belongs to the signal set S1, further analysis is performed to determine the position of the signal in the influence cone C1, in order to determine the degree of influence cone sharing between the second attribute P2 and the first attribute P1.

[0070] The method for determining the position includes, but is not limited to, judging the relative position of the signal with the apex and apex of the influence cone C1. If the signal is close to the apex, it is assumed that the first attribute P1 and the second attribute P2 are low-shared, and the influence cone C2 is regenerated for the second attribute P2. If the signal is close to the apex, it is assumed that the first attribute P1 and the second attribute P2 are high-shared, and the influence cone C1 is expanded to form the influence cone C1'.

[0071] As shown in Figures 2(a) and 2(b), the first attribute P1 and the second attribute P2 are low-shared. Therefore, influence cones C1 and C2 are generated respectively, and the corresponding signal sets are S1 and S2.

[0072] If the signal of the second attribute P2 does not belong to S1, a new influence cone C2 is directly generated, and the signal set S2 of the influence cone C2 is recorded;

[0073] The third attribute P3 is analyzed, and whether the signal of the third attribute P3 belongs to the signal set S1 and the signal set S2 is judged in turn, if it belongs, the sharing degree of the influence cones of the two attributes is further judged according to the above method; if it does not belong, the influence cone C3 of the third attribute is directly generated, and the signal set S3 of the influence cone C3 is recorded.

[0074] As shown in Fig. 2(a), the third attribute P3 and the first attribute P1 are non-shared, and as shown in Fig. 2(c), the third attribute P3 and the second attribute P2 are highly shared, so the influence cone C2' is formed by extending on the basis of the second attribute P2;

[0075] The fourth attribute is continuously processed according to the above method until the Nth attribute. After all the attributes are analyzed, the next formal verification is performed.

[0076] The present application avoids multiple repeated verifications by using the sub-problem sharing between attributes, thereby improving the overall verification efficiency. The present application selects part of the modules in RISC-V (open source instruction architecture set) as a sample to perform performance analysis, as shown in Fig. 3, the upper curve is the formal verification time of the prior art, and the lower curve is the formal verification time of the present application, it can be seen that the formal verification time is greatly reduced after using the present application. Figure 3

[0077] The above only describes the preferred embodiments of the present application and does not limit the present application, any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.​

Claims

1. A formal verification method for integrated circuits, characterized in that, include: Obtain the properties of the integrated circuit to be verified, and analyze each property in turn; If there is no analyzed attribute, or if the current attribute has no correlation with any analyzed attribute, then directly generate the corresponding influence cone for the current attribute and record the signal set corresponding to the influence cone. If the current attribute is related to any previously analyzed attribute, then determine the degree of influence cone sharing between the two. If the degree of sharing between the two influence cones is lower than the preset degree of sharing, then the influence cone corresponding to the current attribute is directly generated, and the signal set corresponding to the influence cone is recorded; otherwise, based on the influence cone of the corresponding analyzed attribute, an extended influence cone is generated as the influence cone of the current attribute and the analyzed attribute, and the signal set corresponding to the influence cone is recorded; the extended influence cone is an influence cone generated by adding the signal of the current attribute to the corresponding influence cone. Once all attributes have been analyzed, formal verification is performed based on the influence cones of those attributes. Determining the degree of sharing between the current attribute and its associated attributes includes: Determine the degree of sharing between each signal of the current attribute and its associated attributes in turn; Find the current signal in the influence cone of the related attributes of the current attribute; Count the number of primitives m that the current signal crosses from the top of the cone to the bottom of the cone, and the number of primitives n that the current signal crosses from the bottom of the cone to the top of the cone. If m and n satisfy n < m * k, then the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are considered to be lower than the preset sharing degree; otherwise, the influence cone corresponding to the current signal and the influence cone corresponding to the associated attribute are considered to be higher than the preset sharing degree, 0 < k < 1.

2. The formal verification method for integrated circuits as described in claim 1, characterized in that, Analyzing the attribute includes analyzing the signals and states associated with the attribute.

3. The formal verification method for integrated circuits as described in claim 1, characterized in that, Determining whether the current attribute is related to any analyzed attribute includes: determining whether the signal of the current attribute belongs to the signal set of any analyzed attribute; if so, the current attribute and the analyzed attribute are related attributes, otherwise they are not related.

4. The formal verification method for integrated circuits as described in any one of claims 1 to 3, characterized in that, The attribute includes at least one of assertion attributes, constraint attributes, and coverage attributes.

5. The formal verification method for integrated circuits as described in claim 2, characterized in that, The signal for the attribute includes at least one of the following: input signal, output signal, internal signal, constant signal, and reset signal.

Images