Equivalent verification method of replacement circuit, electronic equipment and storage medium

Abstract

The invention relates to the technical field of EDA, in particular to an equivalence verification method of a replacement circuit, electronic equipment and a storage medium, and the method comprises the steps: respectively obtaining finite automaton of an original circuit and the replacement circuit, constructing a miter circuit according to the original circuit and the replacement circuit, and obtaining the finite automaton of the miter circuit; establishing a target property of equivalent verification according to a finite automaton of the miter circuit; obtaining inductive invariants of all replacement circuits in the to-be-verified circuit, wherein the step of obtaining the inductive invariants comprises: obtaining matching point pairs with the same state in the original circuit and the replacement circuits under the constraint condition; obtaining a matching formula of matching point pairs in the finite automaton of the miter circuit; judging whether the matching formula is an inductive invariant or not by using a specified solver; and verifying whether the original circuit and the replacement circuit meet the target property or not according to the inductive invariance. The inductive invariance can improve the verification efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of EDA, and in particular to an equivalent verification method for a replacement circuit, an electronic device and a storage medium. Background Art

[0002] After the chip design is completed, it will enter the tape-out stage. The cost of tape-out is very high. In order to reduce the risk in the tape-out process, the chip design will be fully verified before tape-out, and some problems in the chip design process will be discovered in time, and the design will be adjusted in time to ensure the smooth tape-out. Among them, during the chip verification process, the IC code needs to be transplanted to the FPGA for prototype verification. Due to the different physical structures of the chip and the FPGA itself, the chip design is based on the standard cell library, and the FPGA is based on the macro cell module provided by the manufacturer. Therefore, if the IC design is to be verified on the FPGA, the IC design must be converted to a certain extent before it can be transplanted to the FPGA. In general, in order to transplant the chip design to the FPGA, the registers in the chip design need to be replaced with the clock module in the FPGA. The replaced clock module is equivalent to the function of the register before the replacement, so as to ensure that the function of the circuit before and after the replacement has not been changed.

[0003] In order to verify the functional equivalence of the replaced clock module and the register before replacement, it is necessary to verify the function through the equivalence verification method. Equivalence verification is a kind of formal verification, which refers to the mathematically complete proof or verification of whether the replaced circuit realizes the function described by the circuit design. There are two generally used methods at present. One is to observe the output result of the clock model by simulating the behavior of the circuit, and judge whether the output result of the clock model is the same as the output result of the register. If the same, it can be confirmed that the two are equivalent; the disadvantage of this method is that when a circuit includes more clock models, it is impossible to traverse all states. Therefore, this method of verifying equivalence is incomplete. The second is model checking, which needs to consider all situations, but model checking cannot cover large circuits and the verification efficiency is low. In summary, there is an urgent need for an efficient method to verify model equivalence on the basis of ensuring completeness. Summary of the invention

[0004] In view of the above technical problem, the technical solution adopted by the present invention is: a method for verifying the equivalence of a replacement circuit, the method comprising the following steps:

[0005] S100, obtaining finite automata of the original circuit and the replacement circuit respectively.

[0006] S200, constructing a miter circuit according to the original circuit and the replacement circuit, and obtaining a finite automaton of the miter circuit.

[0007] S300, establishing the target property of equivalence verification according to the finite automaton of the miter circuit.

[0008] S400, obtaining the inductive invariant of all replacement circuits in the circuit to be verified, including:

[0009] S410, obtaining matching point pairs with the same state in the original circuit and the replacement circuit under the constraint condition.

[0010] S420, obtaining a matching formula for a matching point pair in a finite automaton of the miter circuit.

[0011] S430, using a specified solver to determine whether the matching formula is an inductive invariant, wherein the specified solver is a solver for solving constraint satisfaction problems, including:

[0012] S431, if yes, then obtain the inductive invariant and execute S500.

[0013] S432: Otherwise, obtain new matching point pairs again according to the output result of the solver, and execute S420 and S430 in a loop.

[0014] S500, verifying whether the original circuit and the replacement circuit satisfy the target property according to the inductive invariant.

[0015] In addition, the present invention also provides a non-transitory computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the above method.

[0016] In addition, the present invention also provides an electronic device, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0017] The present invention has at least the following beneficial effects:

[0018] The present invention assists in verifying the target property by obtaining the inductive invariant, which can eliminate the states that do not meet the target property, improve the correctness of the state variable values, reduce the state quantity on the basis of ensuring the completeness of the state, and improve the verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1A flow chart of an equivalence verification method for a replacement model provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of the relationship between corresponding sets in an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of a circuit graphical representation of a finite automaton of an original circuit provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the circuit structure of a clock model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0025] See also Figure 1 , which shows an equivalence verification method for a replacement model, the method comprising the following steps:

[0026] S100, obtaining finite automata of the original circuit and the replacement circuit respectively.

[0027] Optionally, the original circuit is a register or flip-flop in the IC design, the original circuit is a naming method relative to the replacement circuit, the replacement circuit is used to replace the original circuit, and then the original circuit is replaced with the replacement circuit and transplanted into the FPGA.

[0028] Optionally, when the original circuit is a register or a flip-flop, the replacement circuit is a clock model.

[0029] In the prior art, other combinations of original circuits and replacement circuits in which the original circuits are replaced by replacement circuits also fall within the protection scope of the present invention.

[0030] Optionally, the finite automaton is a Mealy-type finite automaton. The Mealy-type finite automaton is used to describe the functions and limitations of the original circuit. Specifically, the finite automaton is described by a six-tuple, including an input alphabet Y, an output alphabet F, a state transition function δ, an output function γ, an initial state q0, and a state set Q. The initial state is the state from which the finite automaton starts. Among them, at any given moment, the finite automaton can only be in a certain state q i , and can only receive a certain input aj, where q i ∈Q, aj∈Y. For example, in state qi Under the given input aj, the finite automaton enters a new state determined by the state transition function δ, and the new state outputs the final transition state b under the action of the output function k , where b k ∈F. That is, the input is restricted by restricting the input alphabet, the function of the circuit is described by the transition function and the output function, and all possible states of the circuit are represented by the state set. It should be noted that the more state variables there are, the more states there are, and the power set of the state variables constitutes all states. The power set of the input variables constitutes all input alphabets. Other methods in the prior art that describe circuit functions by finite automata all fall within the protection scope of the present invention.

[0031] It should be noted that the circuit function of the replacement circuit is described by a finite automaton, and the description method is the same as that of the original circuit, which will not be repeated here.

[0032] S200, constructing a miter circuit according to the original circuit and the replacement circuit, and obtaining a finite automaton of the miter circuit.

[0033] The miter circuit connects each pair of original inputs of the finite automaton of the original circuit and the finite automaton of the replacement circuit together, so that the original circuit and the replacement circuit share the input signal. At the same time, each corresponding pair of original outputs is connected to an XOR gate, and the output of the XOR gate is the output of the miter circuit.

[0034] It should be noted that the description method of the finite automaton of the miter circuit is the same as that of the original circuit and will not be repeated here.

[0035] S300, establishing the target property of equivalence verification according to the finite automaton of the miter circuit.

[0036] The target property is that the outputs of the original circuit and the replacement circuit are equal under the constraint conditions. It should be noted that the constraint conditions are determined by the circuit itself.

[0037] Optionally, the constraint condition is a rising edge or a falling edge of a clock signal.

[0038] Among them, for the circuit, the conversion of the circuit is the conversion of the registers or triggers in the circuit. If the conversion of each register or trigger is correct, that is, it meets the target property, then the conversion of the circuit is correct.

[0039] Among them, when the input variables of the miter circuit are (y1,y2,…,y n ), the state variables of the miter circuit are (x1, x2,…, x K ,z1,z2……,z M ), where (x1,x2,…,xK ) is derived from the state variables of the original circuit, (z1, z2…, z M ) is derived from the state variables of the replacement circuit. The state variables of the finite automaton of the original circuit are (x1, x2, …, x K ), the output is f(x1,x2,…,x K ,y1,y2,…,y n ). The state variables of the finite automaton that replaces the circuit are (z1, z2…, z M ), the output is g(z1,z2……,z M ,y1,y2,…,y n The output of the Miter circuit is h(x1,x2,…,x K ,z1,z2……,z M ,y1,y2,…,yn) When f=g, h=1. That is, the target property to be verified is ((x a =t1)∧(z b =u1)∧…∧(x c =t2)∧(z d =u2))->h=1, when the value of some state variables in the circuit is a certain value, the output is equal; otherwise, there is no requirement for the output to be equal. It should be noted that the state variables in the formula of the target property are part of all state variables in the miter circuit, not all state variables in the miter circuit. Where t1, t2, u1, u2∈{1, 0}. The formula expression of the target property varies according to the circuit to be verified and can be established by the user.

[0040] Among them, for a state of the finite automaton of the miter circuit (x1, x2, ..., x K ,z1,z2……,z M ), if for any input (y1,y2,…,y n ), the target properties are all established, then the state (x1, x2, …, x K ,z1,z2……,z M ) is the current state that satisfies the target properties.

[0041] Among them, during verification, under a certain input condition, the current state in the state set can make the target property hold true, but because the state variable migrates under the action of the input signal, if the next state after the migration cannot make the formula hold true, it is considered that the current state in the state set cannot make the formula always hold true. In order to find the current state that makes the target property always hold true, further processing is required.

[0042] S400, obtaining inductive invariants of all replacement circuits in the circuit to be verified.

[0043] Among them, the inductive invariant is the logical AND of all matching formulas, and the matching formula is the matching point where the states of the original circuit and the replacement circuit are always the same under the constraint conditions. Among them, the matching point is the logical formula of the state variable in the original circuit or clock model. When the initial state satisfies the inductive invariant, assuming that the current state satisfies the inductive invariant, if the state after one migration still satisfies the inductive invariant, it means that all states migrated from the initial state satisfy the inductive invariant. The inductive invariant can further eliminate all states that do not satisfy the matching formula, reduce the amount of states processed during equal addition verification, and save hardware computing resources.

[0044] Furthermore, S400 includes:

[0045] S410, obtaining matching point pairs with the same state in the original circuit and the replacement circuit under the constraint condition.

[0046] S420, obtaining a matching formula for a matching point pair in a finite automaton of the miter circuit.

[0047] S430, using a specified solver to determine whether the matching formula is an inductive invariant, wherein the specified solver is a solver for solving constraint satisfaction problems.

[0048] S430 further includes:

[0049] S431, if yes, then obtain the inductive invariant and execute S500.

[0050] S432: Otherwise, obtain new matching point pairs again according to the output result of the solver, and execute S420 and S430 in a loop.

[0051] As a preferred embodiment, in S430, the step of determining whether the matching formula is an inductive invariant includes: when the matching formula satisfies the following conditions, the logical AND of all matching formulas is an inductive invariant: the intersection between the complement of the current state set A and the reachable state set B is an empty set. The current state set A is the set of all current states that meet the target property, and the reachable state set B is the set of all reachable states after the current state is migrated once.

[0052] It should be noted that the reachable state is the state after the current state is migrated once, that is, the next state of the current state. If the next state of the current state also belongs to the current state set, the target property always holds. When the intersection is not empty, that is, the reachable state in the intersection does not belong to the current state set, the target property does not hold, and further processing is required to filter out the reachable states in the intersection. When the intersection is empty, it means that the complete inductive invariant has been found; if the intersection is an empty set when entering this step for the first time, it means that the target property does not need the constraint of the inductive invariant.

[0053] As a preferred embodiment, when the intersection between the complement of the current state set A and the reachable state set B is not empty, S432 is executed. After S432 is executed, when S420 is executed again, it also includes: eliminating the current state that does not match the match in the current state set A, and updating the current state set A. S430 determines whether the matching formula is an inductive invariant based on the updated current state set. It should be noted that the matching formula, as a constraint condition, further constrains the value range of the corresponding state variable, so that the value of the state variable is more consistent with the actual circuit, and improves the accuracy of the value of the state variable. Under the constraint of the inductive invariant, it can be obtained that all reachable state sets are within the current state set.

[0054] As a preferred embodiment, the step of acquiring the reachable state set B further includes:

[0055] S4301, obtaining the state transition relationship of the finite automaton of the miter circuit.

[0056] Optionally, the state transition relationship is a transition state table, a transition state diagram, or a formula representing the state and transition relationship.

[0057] Among them, the transition state table or transition state diagram is used to describe the behavior of the finite automaton. It is a table or state diagram used to show the reachable state to be migrated to based on the current state and the stimulus. The transition state table or transition state diagram includes input, current state and output, where the input is the stimulus, the current state is the state in the current state set, and the output is the output result of the finite automaton. The current state will produce the output result under the action of the input and migrate to the next state.

[0058] Preferably, the state transition relationship is a formula representing the state and transition relationship. The formula combined with the solver can represent the state of a large amount of data and the transition relationship between the states, such as 2 to the power of tens of thousands of states, which cannot be represented by a transition state table or a transition state diagram, and need to be represented by a formula.

[0059] S4302: Obtain a reachable state after a migration based on the logical AND of the current state set and the state transition relationship, and obtain a reachable state set B.

[0060] The reachable state is obtained by obtaining the reachable state according to the transition relationship between the current state in the current state set and the current input query state.

[0061] Other methods in the prior art for obtaining a reachable state after a migration of the current state all fall within the protection scope of the present invention.

[0062] To illustrate the relationship between sets more vividly, see Figure 2 , which shows the relationship between states. Figure 2 In the figure, the elliptical region P is the current state set A, the rectangular region not P is the complement of the current state set A, the elliptical region inductive invariant is the state set B constrained by the inductive invariant, and init is the initial state. The inductive invariant constraint allows the current state to return to P after migration within P. When there is a reachable state in P after the current state migration that is located in the not P region, it means that the current state does not meet the target property and needs to be eliminated through the inductive invariant. The inductive invariant can constrain the current state to a smaller set than P, improving the accuracy of the state variable value.

[0063] S500, verifying whether the original circuit and the replacement circuit satisfy the target property according to the inductive invariant.

[0064] Among them, S500 also includes: verifying whether the following two logical relationships are always established: the first logical relationship, whether the initial state is in the inductive invariant; the second logical relationship, whether all current states in the inductive invariant are still in the current state set after a migration. If these two logical relationships are always established, it is proved that the target property is met.

[0065] Among them, S500 also includes:

[0066] S510, verify whether the initial states of the original circuit and the clock model meet the constraints of the inductive invariant.

[0067] S520, verify whether the states of all states in the inductive invariant after one migration belong to the current state set.

[0068] As an example, to further help understand the present invention, please refer to Figure 3 , Figure 3 After the original circuit is described as a finite automaton, a circuit graphical representation of the finite automaton will be described for easier understanding. Figure 4 is the circuit of the clock model. Among them, Figure 3The description of the finite automaton in includes: the original circuit includes a data signal din connected to the data input terminal, a clock signal glk1 connected to the user clock terminal, and an output signal dout_reg_0_Q output from the data output terminal. Three state variables H1, H2, and H3 are used to save the corresponding states respectively: H2 saves the data state, H3 saves the clock state, and H1 saves the output state. The current state of the state variable H2 is the data signal saved in H2, and the next state of migration is the input data signal din; the current state of the state variable H3 is the saved clock signal, and the next state of migration is the input clock signal glk1; the current state of the state variable H1 is the saved output signal dout_reg_0_Q, and the next state of migration is the output signal dout_reg_0_Q at the output terminal. The function of the original circuit is that when the falling edge of the user clock connected to the user clock terminal comes, the original circuit outputs the current state of the data signal din saved in H2; when the rising edge comes, the original circuit outputs the current state of the output signal dout_reg_0_Q saved in the state variable H1. Among them, Figure 4 The clock model circuit includes a data signal din connected to the data input terminal, a clock signal glk1 connected to the user clock terminal, and an output signal dout_reg_1_Q output from the data output terminal. Three state variables are used to save the corresponding states respectively: MCK_DF_din saves the data state of the clock model, MCK_istate saves the clock state of the clock model, and dout_reg_1 saves the output state of the clock model. The next state of the data state variable MCK_DF_din is: din when the master clock is valid, otherwise, it is the output signal of MCK_DF_din. The next state of the output state variable dout_reg_1 is: when the enable terminal is valid and the master clock is valid, it is the output signal of MCK_DF_din; otherwise, it is the current state of the output state variable dout_reg_1. The next state of the clock state variable MCK_istate output signal is: when the master clock is at a low level, it is the current state of the master clock; otherwise, it is the current state of the MCK_istate output signal. The enable terminal is valid for the negation of the current state of the MCK_istate output signal and the AND operation of the current state of the master clock. When the Figure 3 The original circuit and the converted Figure 4When performing equivalence verification on the clock model in , it is necessary to construct a mealy-type automaton of the miter circuit. The target property is a Boolean expression that the master clock is valid and the output signals of the original circuit and the clock model are equal. It is necessary to verify that the target property is always true. The inductive invariant obtained according to the above steps is: H1 = dout_reg_1_Q, H2 = dout_reg_1_D, etc., where dout_reg_1_D is the data input signal of dout_reg_1. Among them, H1, H2, dout_reg_1_Q and dout_reg_1_D are the corresponding matching points respectively, and {H1, dout_reg_1_Q} and {H2, dout_reg_1_D} are the corresponding matching point pairs respectively. Among them, "H1 = dout_reg_1_Q" and "H2 = dout_reg_1_D" are the determined state matching relationships of the corresponding matching point pairs respectively. Matching point pairs can assist the target properties and constrain the invariant physical relationship between the corresponding matching point pairs, thereby filtering out states that do not conform to the physical matching relationship of the circuit, reducing the amount of states while ensuring the completeness of the states, and improving verification efficiency.

[0069] Among them, when the original circuit is Figure 3 The original circuit in , and the replacement circuit is Figure 4 When the clock model in is used, its function is to update the value of the register or trigger when the valid edge comes. The valid edge is the rising edge or the falling edge. Then the target property is the logical OR operation of the first logical expression and the second logical expression, where the first logical expression is used to determine whether it is a valid edge, and the second logical expression is used to determine whether the output of the original circuit and the clock model are equal.

[0070] The present invention assists in verifying the target property by obtaining the inductive invariant, which can eliminate the states that do not meet the target property, improve the correctness of the state variable values, reduce the state quantity on the basis of ensuring the completeness of the state, and improve the verification efficiency.

[0071] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0072] An embodiment of the present invention further provides an electronic device, comprising a processor and the aforementioned non-transitory computer-readable storage medium.

[0073] An embodiment of the present invention further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0074] Although some specific embodiments of the present invention have been described in detail by way of example, it will be appreciated by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It will also be appreciated by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A circuit replacement equivalent verification method, characterized in that: The method comprises the following steps: S100, obtaining finite automata of the original circuit and the replacement circuit respectively; S200, constructing a miter circuit according to the original circuit and the replacement circuit, and obtaining a finite automaton of the miter circuit; S300, establish the target property of equivalence verification based on the finite automaton of the miter circuit; S400, obtaining the inductive invariant of all replacement circuits in the circuit to be verified, including: S410, obtaining matching point pairs with the same state in the original circuit and the replacement circuit under the constraint condition; S420, obtaining a matching formula for a pair of matching points in a finite automaton of a miter circuit; S430, using a specified solver to determine whether the matching formula is an inductive invariant, wherein the specified solver is a solver for solving constraint satisfaction problems, including: S431, if yes, then get the inductive invariant and execute S500; S432, otherwise, obtain a new pair of matching points again according to the output result of the solver, and execute S420 and S430 in a loop; S500, verifying whether the original circuit and the replacement circuit satisfy the target property according to the inductive invariant.

2. The method according to claim 1, characterized in that In S430, the step of determining whether the matching formula is an inductive invariant includes: The logical AND of all matching formulas is an inductive invariant when the matching formulas satisfy the following conditions: the intersection between the complement of the current state set A and the reachable state set B is an empty set; Among them, the current state set A is the set of all current states that meet the target properties, and the reachable state set B is the set of all reachable states after the current state is migrated once.

3. The method according to claim 2, characterized in that After S432 is executed, when S420 is executed again, it also includes: eliminating the current state in the current state set A that does not match the matching formula, and updating the current state set A.

4. The method according to claim 2, characterized in that: The step of obtaining the reachable state set B also includes: S4301, obtaining the state transition relationship of the finite automaton of the miter circuit; S4302: Obtain a reachable state after a migration based on the logical AND of the current state set and the state transition relationship, and obtain a reachable state set B.

5. The method according to claim 4, characterized in that The state transition relationship is a transition state table, a transition state diagram, or a formula representing the state and transition relationship.

6. The method according to claim 1, characterized in that The S500 also includes: S510, verifying whether the initial state of the finite automaton of the miter circuit complies with the constraint of the inductive invariant; S520, verify whether the states of all states in the inductive invariant after one migration belong to the current state set.

7. The method according to claim 1, characterized in that The matching point pair in S410 is a point pair consisting of two matching points, where the two matching points are two matching points with equal states under constraint conditions in the original circuit and the clock model, wherein the matching point is a logical formula of a state variable in the original circuit or the clock model.

8. The method according to claim 1, characterized in that When the original circuit is a register or a flip-flop in IC design, the replacement circuit is a clock model.

9. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images