A verification method and a verification system for a chip protection function

Abstract

The application relates to a verification method and a verification system for a chip protection function, comprising the following steps: constructing a traffic shaper Shaper model, mapping the protection function attribute to be verified into the configuration parameter of the Shaper model; connecting the Shaper model to the input end of the protection module of a chip DUT to be tested, so that the Shaper model realizes the dual functions of background traffic sending and congestion state detection; detecting the credit value of the Shaper model, and automatically generating a verification excitation signal for the protection function when the credit value is lower than a low threshold Th_low; stopping the generation of the verification excitation signal when the credit value rises to be higher than a high threshold Th_high; collecting the protection switching behavior data of the chip DUT to be tested under the action of the verification excitation signal, and comparing the data with preset expected responses to complete the verification. The application solves the problems that the excitation generation is disconnected with the congestion state in the existing verification technology, and the critical state is prone to jitter.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit verification technology, and in particular to a verification method and system for chip protection functions. Background Technology

[0002] In switching chips, routing chips, and bearer network chips, protection functions (such as linear protection, ring network protection, fast rerouting, and TSN chip FRER redundancy merging) are the core mechanisms for ensuring service reliability. These functions must complete primary / backup path switching or redundant member flow switching within a specified time when link congestion, packet loss, or physical layer failure occurs.

[0003] Existing chip verification methods typically generate protection trigger conditions in the following way: (1) Static script injection: A fixed number of error packets or link cut-off signals are sent by an external script, which cannot simulate the dynamic network congestion state.

[0004] (2) Independent excitation module: Congestion is created using a separate noise generator, but there is no feedback loop between this module and the protection module under test, making it difficult to accurately control the duration of congestion.

[0005] (3) Decision based on queue depth: Congestion is determined by monitoring queue depth within the RTL, but this is internal logic of the design under test (DUT) and cannot be directly reused in the transaction level verification environment.

[0006] While existing technologies utilize token buckets or traffic shapers to construct verification incentives, their purpose is merely to limit the transmission rate or simulate a single traffic model. They do not treat the shaper as an abstract model for protection mechanisms, nor do they leverage the shaper's internal state as a congestion criterion to achieve closed-loop control over the generation and cessation of verification incentives. Furthermore, simple single-threshold triggering easily leads to jitter around the threshold, causing frequent incentive flips and affecting verification stability.

[0007] In the field of TSN chips, IEEE 802.1CB FRER (Frame Replication and Elimination for Reliability) ensures reliability through multi-member stream redundant transmission, while IEEE 802.1AS provides time synchronization protection. Existing TSN verification methods typically verify the independent functions of each protocol separately, lacking a method to abstract the redundancy protection requirements into a quantifiable model and perform closed-loop excitation control.

[0008] In summary, this invention aims to solve the following technical problems existing in the verification of existing chip protection functions: (1) The generation of incentives is disconnected from the congestion status: Existing methods cannot dynamically start and stop verification incentives based on the real-time network congestion level.

[0009] (2) Lack of closed-loop control: The start and stop of the verification stimulus depends on manual scripts or fixed timing, and cannot be adaptively adjusted according to the real-time response of the DUT protection module.

[0010] (3) Critical jitter: Single threshold decision leads to frequent excitation flips at the congestion boundary.

[0011] (4) Lack of unified abstraction of protection mechanism: The protection attributes of different chip types (APS switching chip, FRER TSN chip, etc.) are different, and there is a lack of a general modeling method to map them into computable verification parameters.

[0012] Therefore, the present invention urgently needs to propose a verification method and verification system for chip protection functions to solve the above-mentioned technical problems. Summary of the Invention

[0013] The purpose of this invention is to provide a verification method, verification system, and structure for chip protection functions, in order to solve the problems of excitation generation being disconnected from congestion state and easy jittering in critical state in existing verification technologies, and to significantly improve the authenticity and stability of protection function verification for switching chips such as APS and TSN chips such as FRER.

[0014] To address the aforementioned technical problems, this invention provides a verification method for chip protection functions, comprising: By constructing a flow shaper model in the verification platform, the protection function attributes to be verified are mapped to the configuration parameters of the shaper model; wherein the protection function attributes serve as quantifiable features describing the chip protection switching requirements. By connecting the Shaper model to the protection module input of the chip under test (DUT), the Shaper model can achieve the dual functions of background traffic transmission and congestion state detection. The credit score of the Shaper model is detected, and a high threshold Th_high and a low threshold Th_low are set. When the credit value is lower than the low threshold Th_low, network congestion is determined to occur, and a verification incentive signal for the protection function is automatically generated. When the credit value rises above the high threshold Th_high, the network congestion is determined to be resolved, and the generation of the verification incentive signal is stopped. The verification is completed by collecting the protection switching behavior data of the chip under test (DUT) under the action of the verification excitation signal and comparing it with the preset expected response.

[0015] Preferably, a hysteresis window is formed between the high threshold Th_high and the low threshold Th_low; when the credit value is within the range of the hysteresis window, the current start / stop state of the verification stimulus signal is maintained to prevent the verification stimulus signal from frequently flipping due to traffic fluctuations near the threshold.

[0016] Preferably, the verification stimulus signal includes at least one of the following: injecting an error frame, pulling down the link valid signal, increasing the transmission delay, disabling the parallel sub-Shaper bucketing corresponding to the member stream, and injecting a sequence number transition.

[0017] Preferably, when the protection function is the Automatic Protection Switching (APS) function of the Ethernet switching chip: The protection function attributes include protection level, maximum tolerable switching delay T_max, maximum allowed packet loss rate P_loss, link bandwidth LINK_BW, and burst tolerance Burst. The configuration parameters include shaping rate (CIR), committed burst size (CBS), credit lower limit threshold (Credit_min), and peak rate (PIR). The mapping rules are as follows: The shaping rate (CIR) is mapped according to the protection level; wherein a higher protection level corresponds to a large CIR / PIR ratio and a wide hysteresis. The committed burst size CBS is mapped according to the maximum tolerable switching delay T_max; The credit threshold Credit_min is mapped according to the maximum allowable packet loss rate P_loss. The peak rate PIR is mapped according to the link bandwidth LINK_BW; The verification stimulus signal is injected into an error frame or pulled low by the general verification methodology driving module UVM_Driver to simulate a link anomaly and trigger the chip under test (DUT) to switch between primary and backup paths.

[0018] Preferably, when the protection function is the Frame Copy and Cancel (FRER) function of the Time-Sensitive Network (TSN) chip: The protection function attributes include the FRER sequence loss tolerance window W_seq, the number of member flows N, the path deviation limit Δt, the synchronization tolerance, and the flow priority; The Shaper model includes multiple parallel sub-Shaper, each of which corresponds to a member flow. The number of parallel sub-Shaper is equal to the number of member flows N. The configuration parameters include the initial credit value of the sub-Shaper (Credit_init), the number of parallel sub-Shapers, the rate difference between sub-Shapers (ΔRate), the time-aware gating offset (Offset), and the sub-Shaper scheduling weight. The mapping rules are as follows: The FRER sequence loss tolerance window W_seq is mapped to the sub-Shaper initial credit value Credit_init; The path deviation upper limit Δt is mapped to the rate difference ΔRate between sub-Shapers; The synchronization tolerance is mapped to the time-aware gating offset Offset. The flow priority is mapped to the sub-Shaper scheduling weight; where high-priority flows correspond to large weights and high integer rate (CIR). The detection of the credit value of the Shaper model includes: detecting the initial credit value Credit_init of each sub-Shaper and calculating the credit difference ΔCredit between each sub-Shaper; when the initial credit value Credit_init of any sub-Shaper is lower than the low threshold Th_low, or the credit difference ΔCredit exceeds a preset difference threshold, the member flow is determined to be abnormal, so as to generate the verification incentive signal for the member flow; the verification incentive signal includes turning off bucket filling or injecting sequence number jumps in the sub-Shaper corresponding to the member flow.

[0019] Preferably, the verification platform is a transaction-level verification environment based on the Universal Verification Methodology (UVM). The Shaper model is implemented in a transaction-level manner and is connected to the chip under test (DUT) through the Universal Verification Methodology Driver module UVM_Driver. The credit value includes the available token balance or available sending quota in the token pool of the Shaper model.

[0020] The present invention also provides a verification system for chip protection functions, which performs the above-described verification method for chip protection functions, including: Modeling units are used to map the protection function attributes to be verified to the configuration parameters of the flow shaper model; The Shaper model is connected to the modeling unit. Based on the Shaper model, background traffic is generated and sent to the chip under test (DUT), and it also has the function of congestion state detection. The detection and decision module is connected to the Shaper model and is used to detect the credit value of the Shaper model and compare the credit value with a preset high threshold Th_high and a low threshold Th_low to output a decision signal. The decision signal is used to control the generation and start / stop status of the excitation control unit to verify the excitation signal. An incentive control unit, connected to the detection and decision module, is configured to start a verification incentive signal when the credit value is lower than a low threshold Th_low, stop the verification incentive signal when the credit value is higher than a high threshold Th_high, and maintain the current start / stop state when the credit value is in the hysteresis window interval between the low threshold Th_low and the high threshold Th_high. The verification module is connected to the chip under test (DUT) and is used to collect the protection switching behavior data of the DUT under the action of the verification excitation signal, and compare it with the preset expected response.

[0021] Preferably, when the protection function is the Automatic Protection Switching (APS) function of the Ethernet switching chip: The modeling unit is configured as follows: The shaping rate (CIR) is mapped according to the protection level; The burst size CBS is committed to mapping based on the maximum tolerable switching delay T_max. The credit threshold (Credit_min) is mapped based on the maximum allowable packet loss rate (P_loss). The peak rate PIR is mapped based on the link bandwidth LINK_BW; The excitation control unit is configured to generate a verification excitation signal that injects an error frame or pulls the link valid signal low.

[0022] Preferably, when the protection function is the Frame Copy and Cancel (FRER) function of the Time-Sensitive Network (TSN) chip: The modeling unit is configured as follows: Construct multiple parallel sub-Shaper based on the number of member streams N; The initial credit value Credit_init is determined based on the FRER sequence loss tolerance window W_seq mapper. Based on the upper limit of path deviation Δt, map the rate difference ΔRate between shapers; Based on the synchronization tolerance mapping, it is converted into a time-aware gating offset Offset; Based on the flow priority mapping, sub-Shaper scheduling weights are assigned. The detection and decision module is also used to calculate the credit difference ΔCredit between each of the sub-Shapers, and to determine that the member flow is abnormal when the credit difference ΔCredit exceeds a preset difference threshold. The incentive control unit is configured to generate a verification incentive signal that fills the bucket of the sub-Shaper corresponding to the closed member stream or injects a sequence number jump.

[0023] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a verification method for chip protection functions as described above.

[0024] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention adopts a universal unified model: for the first time, the protection mechanism is abstracted into a Shaper model, which enables the verification environment to quantitatively simulate different levels of protection requirements (such as gold / silver level services, TSN high priority flow / low priority flow), thereby improving the realism of the verification scenario.

[0025] 2. This invention adopts closed-loop control: using the Shaper's own credit value as a feedback signal to control the start and stop of the excitation, it realizes a strong correlation between the verification excitation and the network congestion state, and solves the problem that traditional open-loop verification cannot simulate dynamic congestion.

[0026] 3. The present invention has strong anti-jitter performance: By introducing a high and low dual threshold mechanism, a hysteresis window is formed, which effectively avoids the phenomenon of frequent opening / closing of excitation near a single threshold due to traffic fluctuations.

[0027] 4. This invention is applicable to multiple domains: By protecting the mapping between functional attributes and shaper parameters, the same verification framework can simultaneously cover the switching chip APS scenario and the TSN chip FRER / AS scenario, and can be reused simply by changing the mapping parameters.

[0028] 5. High reusability of the invention: The Shaper-based method can be implemented at the transaction level (UVM / TLM) without relying on specific RTL implementation details, making it easy to port to different projects. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a verification method for chip protection functions provided by the present invention.

[0030] Figure 2 This is a schematic diagram of a verification system for chip protection function provided by the present invention.

[0031] Figure 3 This is a schematic diagram of the timing waveform for verifying the start and stop of the dual-threshold control excitation provided by the present invention.

[0032] Figure 4This is a logical diagram illustrating the mapping of the protection function attributes provided by this invention to the parameters of the Shaper model. Detailed Implementation

[0033] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of the present invention will become clearer from the following description. It should be noted that the drawings are all in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the present invention.

[0034] like Figure 1 As shown in the figure, this embodiment of the invention specifically provides a verification method for chip protection functions, which includes the following steps: Protection mechanism modeling steps: Map protection function attributes to flow shaper (Shaper) model parameters, including rate, bucket depth, filling rate, and credit reclamation strategy, etc. Excitation coupling step: Connect the flow shaper model to the input terminal of the protection module of the chip under test (DUT), so that the flow shaper model can simultaneously assume the dual roles of background flow transmission and congestion detection; Dual threshold setting steps: By setting a high threshold Th_high and a low threshold Th_low, the dual thresholds apply to the credit or token balance of the flow shaper model. Congestion decision steps: When the credit value is lower than Th_low, a verification incentive is generated; when the credit value is in the hysteresis window between Th_low and Th_high, the previous state is maintained; when the credit value is higher than Th_high, the hysteresis is canceled and the incentive is stopped. The result verification step involves collecting protection switching behavior data of the chip under test (DUT) and comparing it with the expected response to complete the verification. Feedback from the result verification step to the protection mechanism modeling step indicates that the modeling parameters can be iteratively adjusted based on the verification results.

[0035] like Figure 2 As shown, this embodiment of the invention specifically provides a verification system for chip protection functions, including: The modeling unit is used to map protection function attributes to flow shaper model parameters and output configuration parameters. The detection and decision module, as a dual threshold comparator, is used to compare the credit value with the high threshold Th_high and the low threshold Th_low, and outputs the credit value decision signal as the control start and stop signal for controlling the start and stop of the excitation control unit. The verification module is used to collect the protection response of the chip under test (DUT) and compare it with the expected result.

[0036] The flow shaper model is a combination of flow shaping and congestion observation. It includes sub-modules such as rate control, token or credit pool, and burst management. Its credit value detection output is connected to the detection and decision module, and its output sends background flow and congestion incentives to the chip under test (DUT).

[0037] The excitation control unit is used to generate or stop the verification excitation signal. It can perform operations such as error injection, link failure or delay mutation. In the case of switching chip, it performs bit error injection, and in the case of time-sensitive network, it performs member flow disconnection. The excitation control unit receives the control start and stop signals from the detection and decision module and has a feedback connection with the flow shaper model.

[0038] The chip under test (DUT) has the Automatic Protection Switching (APS) function in the switching chip scenario and the Frame Copying and Frame Elimination (FRER) function in the Time Sensitive Network (TSN) chip scenario. The protection switching output of the DUT is connected to the verification module.

[0039] It should be noted that the "protection function attributes" involved in this invention refer to quantifiable characteristics describing protection switching requirements, including but not limited to: protection level (such as G.8031 linear protection LSP / segment layer), maximum tolerable switching delay, allowable service packet loss rate, number of redundant member flows, sequence number loss tolerance window, and path deviation upper limit. These attributes are typically reflected as APS switching metrics in switching chip scenarios and as FRER redundancy merging tolerance or AS clock protection tolerance in TSN chip scenarios.

[0040] Table 1: Mapping Relationship between Protection Function Attributes and Shaper Model Parameters (Switching Chip Scenario) Protection level Gold / Silver / Copper CIR / PIR ratio and hysteresis width High-level → CIR / PIR ratio + wide hysteresis Maximum tolerable switching delay T_max ms Commitment to sudden size CBS CBS = T_max * CIR Maximum allowable packet loss rate P_loss % Token redemption compensation coefficient k k = f(P_loss), k ∈ [0,1] Link bandwidth LINK_BW Gbps Peak Rate PIR PIR = LINK_BW * Utilization Coefficient Burst tolerance byte Excessive burst size EBS EBS = Burst * Safety Factor Table 2: Mapping Relationship between Protection Function Attributes and Shaper Model Parameters (TSN Chip Scenario) FRER sequence loss tolerance window W_seq Number of serial numbers Sub-Shaper initial credit_init Credit_init=W_seq*Member Stream Rate Number of member flows N ≥2 Number of parallel sub-Shaper Each member stream corresponds to an independent sub-Shaper Path deviation upper limit Δt μs Rate difference between sub-Shaper ΔRate=Δt / W_seq 802.1AS Synchronization Tolerance ns Time-aware gating offset Offset = Synchronization Tolerance * Safety Factor Stream priority 0~7 Shaper scheduling weight High priority → high weight + high CIR like Figure 3 As shown, the timing waveform diagram is divided into two sub-graphs, both sharing the same horizontal time axis. The vertical axis of the upper sub-graph represents the flow shaper credit value. Figure 3 The graph shows three curves: the solid line represents the credit value of the flow shaper model over time, gradually decreasing from an initial high level, then falling to a trough after crossing a low threshold, before rebounding and crossing a high threshold to reach a peak, followed by another decrease to form a second cycle; the low threshold (Th_low) is represented by a dashed line at a credit value of 20; the high threshold (Th_high) is represented by a dashed line at a credit value of 80. The vertical axis of the lower subplot represents the verification excitation state, divided into two levels: excitation generation and excitation termination. Figure 3The diagram shows a square wave representing the excitation signal: initially, excitation is stopped. When the credit value drops below the low threshold, the excitation signal jumps to excitation generation and remains active; when the credit value rises above the high threshold, the excitation signal jumps back to excitation stop. The lower sub-diagram marks the two transition points of the excitation signal with vertical dashed lines, aligning with the moments in the upper sub-diagram where the credit value crosses the low and high thresholds, respectively, visually demonstrating the hysteresis window mechanism.

[0041] like Figure 4 The diagram shows the logical parameters of the traffic shaper model. The left column represents the protection function attributes, from top to bottom: protection level (example values ​​are gold, silver, and bronze); maximum tolerable switching delay (example values ​​are 10ms, 50ms, and 100ms); maximum allowable packet loss rate (example values ​​are 0.001%, 0.01%, and 0.1%); link or member flow bandwidth (example values ​​are 1Gbps, 10Gbps, and 100Gbps); and burst or sequence tolerance (Burst or Ws_eq, respectively). The middle column contains the mapping rules, from top to bottom: CIR = f(priority), indicating that the shaping rate CIR is a function of the protection level priority f; CBS = T_max * CIR, indicating that the committed burst size CBS is the product of the maximum tolerable switching delay T_max and the shaping rate CIR; Credit_min = 1 - P_loss, indicating that the credit threshold Credit_min is 1 minus the maximum allowable packet loss rate P_loss; PIR = LINK_BW, indicating that the peak rate PIR equals the link bandwidth LINK_BW; burst or sequence tolerance is mapped to the burst size or sequence tolerance window. The right column contains the traffic shaper configuration parameters, from top to bottom: shaping rate CIR; committed burst size CBS; credit threshold Credit_min; peak rate PIR; excess burst size or sequence tolerance window. The attributes in the left column point to the corresponding mapping rules in the middle column via arrows, and the mapping rules in the middle column point to the corresponding configuration parameters in the right column via arrows, forming a complete attribute-to-parameter mapping link.

[0042] As a preferred embodiment of the present invention, this embodiment verifies the G.8031 Ethernet automatic protection switching function of an Ethernet switching chip in a general verification methodology verification environment.

[0043] The verification method in this embodiment specifically includes the following: Step 1: Define protection function attributes; The test cases require simulating a gold-level business operation, with the following protection requirements: maximum switchover latency of 50ms and allowable packet loss rate of 0% (i.e., no perceptible packet loss is allowed during the switchover period).

[0044] Step 2: Modeling and parameter mapping of the flow shaper model; Protection function attributes are converted into configuration parameters of the flow shaper model using mapping rules. In SystemVerilog, a flow shaper class is instantiated and configured according to the mapping rules between protection function attributes and flow shaper model parameters (i.e., Table 1): The shaping rate CIR = the service commitment rate, which in this embodiment is 1Gbps; Committed Burst Size (CBS) = Maximum Tolerable Switching Delay (T_max) * Shaping Rate (CIR) = 50ms * 1Gbps = 62.5Mbit ≈ 7.8MB; Peak rate PIR = Link bandwidth LINK_BW * Utilization coefficient = 10Gbps * 0.8 = 8Gbps; Low threshold Th_low = 20% of total credit score; The high threshold Th_high = 80% of the total credit score.

[0045] Step 3: Excitation Coupling and Operation; The flow shaper (Shaper) model instance is connected to the front-end port (input) of the automatic protection switching module of the chip under test (DUT) via the general verification methodology driver module UVM_Driver. The flow shaper model sends background traffic normally while monitoring its own credit value. The general verification methodology detection module UVM_Monitor collects the protection switching response data of the DUT.

[0046] Step 4: Congestion decision and incentive control; like Figure 3 As shown, during the test run, due to the manually configured main path blockage, the token consumption rate inside the traffic shaper model exceeded the filling rate, causing the credit value to continuously decrease. When the credit value dropped below 20%, the verification platform determined that congestion had occurred, and the incentive control unit automatically lowered the error injection signal, injecting error frames into the chip under test (DUT) and triggering automatic protection switching.

[0047] Step 5: Delayed Cancellation; After the chip under test (DUT) switches to the backup path, the pressure on the main path decreases, the flow shaper (Shaper model) resumes smooth transmission, and the credit value recovers. When the credit value recovers to above 80%, the excitation control unit determines that the congestion has been resolved and stops injecting errors. Figure 3 As shown, the hysteresis window (20% to 80%) ensures that the incentives do not frequently flip as the credit value fluctuates around the threshold.

[0048] Step 6: Result Verification; The verification module compares the actual switching time of the chip under test (DUT) with the 50ms specification stipulated in the G.8031 standard, checks whether the number of packet losses during the switching period is 0, and completes the automated verification.

[0049] As another preferred embodiment of the present invention, this embodiment verifies the IEEE 802.1CB frame duplication and elimination function of a time-sensitive network switching chip, focusing on verifying the protection behavior of redundant merging points when member flow is disconnected.

[0050] The verification method specifically includes the following: Step 1: Define protection attributes; The requirements for time-sensitive network flow protection are: frame duplication and sequence loss elimination tolerance window W_seq=3 sequence numbers, number of member flows N=2 (primary + backup), path deviation upper limit Δt=10μs, and flow priority=6 (high priority time-sensitive flows).

[0051] Step 2: Joint modeling of multiple flow shaper Shaper models; This embodiment employs two parallel sub-flow shaper models (Sub_Shaper_A and Sub_Shaper_B), representing the primary and backup member flows, respectively. The mapping relationship between protection attributes and flow shaper model parameters in time-sensitive network scenarios is configured (i.e., Table 2): The shaping rate CIR of Sub_Shaper_A is equal to the member stream rate, which is 100Mbps in this embodiment; The committed burst size CBS of Sub_Shaper_A = sequence loss tolerance window W_seq * inter-frame interval credit value corresponding to the member stream rate = 3 * inter-frame interval credit value. The shaping rate CIR of Sub_Shaper_B is equal to the member stream rate, which is 100Mbps in this embodiment. Sub_Shaper_B's committed burst size CBS = sequence loss tolerance window W_seq * member stream rate corresponding to the frame interval credit value = 3 * frame interval credit value; The credit difference ΔCredit = |Credit_A - Credit_B| in the two-sub-flow shaper Shaper model. The low threshold Th_low = 20% of the total credit of the single-subflow shaper (Shaper model); The high threshold Th_high = 80% of the total credit of the single-flow shaper model.

[0052] Step 3: Excitation Coupling and Operation; Sub_Shaper_A and Sub_Shaper_B send traffic to the two member stream inlets of the chip under test (DUT) through an independent general verification methodology driver module, UVM_Driver. The frame duplication and deduplication merge point of the DUT performs deduplication and merging on the two traffic streams.

[0053] Step 4: Congestion Decision and Member Flow Failure Simulation; The credit values ​​of the two sub-flow shapers (Shaper models) are monitored. When the credit value of Sub_Shaper_B drops below the low threshold (20%) due to congestion on the backup path, the verification platform determines that the backup member flow is abnormal, and the incentive control unit automatically performs one of the following operations: (a) Disable token padding for Sub_Shaper_B to simulate a complete disconnection of the alternate path; (b) Inject a sequence number jump into the output of Sub_Shaper_B to simulate path packet loss.

[0054] Step 5: Delayed Cancellation; When the backup path recovers and the Sub_Shaper_B credit value rises back above the high threshold (80%), the injection of anomalies stops, and normal transmission of the dual-member stream resumes. A hysteresis window prevents frequent triggering or revocation of protection when path quality fluctuates at boundaries.

[0055] Step 6: Result Verification; Detect the output of frame duplication and demerging points of the chip under test, and check the following indicators: (a) After a member flow fails, does the merge point complete the single member flow forwarding switch (without service interruption) within the sequence loss tolerance window? (b) Whether to re-enter dual-member flow redundancy mode after recovery; (c) Whether the end-to-end delay during the handover exceeds the maximum allowable value corresponding to the flow priority.

[0056] The difference between this embodiment and the embodiment used to verify the G.8031 Ethernet automatic protection switching function of an Ethernet switching chip is that: a multi-sub-flow shaper model is used to jointly model multiple member flows, rather than a single flow shaper model; the decision object is the credit difference between sub-flow shaper models or the credit value of a single sub-flow shaper model, reflecting the asymmetric congestion state of the member flows; the incentive type is member flow failure simulation (disabling token filling or sequence number transition), rather than general error injection. These differences allow this invention to simultaneously cover two types of protection verification scenarios: switching chips and time-sensitive network chips.

[0057] It should be noted that the credit value of the flow shaper model in this invention refers to the available transmission quota, which is similar in name to the credit value concept of the credit-based flow shaper (IEEE 802.1Qav) in the Time-Sensitive Networking standard, but the uses are different: the credit value in the Time-Sensitive Networking standard is used to control the transmission timing of the local output port, which belongs to the implementation of the function under test; this invention uses the credit value as a congestion observation window of the verification platform to determine whether to inject protection trigger stimulus into the chip under test, which belongs to the verification environment control logic.

[0058] The above description is merely a description of preferred embodiments of the present invention and is not intended to limit the scope of the present invention in any way. Any changes or modifications made by those skilled in the art based on the above disclosure shall fall within the protection scope of the claims.

Claims

1. A verification method for chip protection functions, characterized in that, include: By constructing a flow shaper model in the verification platform, the protection function attributes to be verified are mapped to the configuration parameters of the shaper model; wherein the protection function attributes serve as quantifiable features describing the chip protection switching requirements. By connecting the Shaper model to the input terminal of the protection module of the chip under test (DUT), the Shaper model can achieve the dual functions of background traffic transmission and congestion state detection. The credit score of the Shaper model is detected, and a high threshold Th_high and a low threshold Th_low are set. When the credit value is lower than the low threshold Th_low, network congestion is determined to occur, and a verification incentive signal for the protection function is automatically generated. When the credit value rises above the high threshold Th_high, the network congestion is determined to be resolved, and the generation of the verification incentive signal is stopped. The verification is completed by collecting the protection switching behavior data of the chip under test (DUT) under the action of the verification excitation signal and comparing it with the preset expected response.

2. The verification method for chip protection function as described in claim 1, characterized in that, A hysteresis window is formed between the high threshold Th_high and the low threshold Th_low; when the credit value is within the range of the hysteresis window, the current start / stop state of the verification stimulus signal is maintained to prevent the verification stimulus signal from frequently flipping due to traffic fluctuations near the threshold.

3. The verification method for chip protection function as described in claim 1, characterized in that, The verification stimulus signal includes at least one of the following: injecting an error frame, pulling down the link valid signal, increasing transmission delay, disabling the parallel sub-Shaper bucketing corresponding to the member stream, and injecting a sequence number transition.

4. The verification method for chip protection function as described in claim 1, characterized in that, When the protection function is the Automatic Protection Switching (APS) function of the Ethernet switching chip: The protection function attributes include protection level, maximum tolerable switching delay T_max, maximum allowed packet loss rate P_loss, link bandwidth LINK_BW, and burst tolerance Burst. The configuration parameters include shaping rate (CIR), committed burst size (CBS), credit lower limit threshold (Credit_min), and peak rate (PIR). The mapping rules are as follows: The shaping rate (CIR) is mapped according to the protection level; wherein a higher protection level corresponds to a large CIR / PIR ratio and a wide hysteresis. The committed burst size CBS is mapped according to the maximum tolerable switching delay T_max; The credit threshold Credit_min is mapped according to the maximum allowable packet loss rate P_loss. The peak rate PIR is mapped according to the link bandwidth LINK_BW; The verification stimulus signal is injected into an error frame or pulled low by the general verification methodology driving module UVM_Driver to simulate a link anomaly and trigger the chip under test (DUT) to switch between primary and backup paths.

5. The verification method for chip protection function as described in claim 1, characterized in that, When the protection function is the Frame Copy and Cancel (FRER) function of the Time-Sensitive Network (TSN) chip: The protection function attributes include the FRER sequence tolerance window W_seq, the number of member flows N, the path deviation limit Δt, the synchronization tolerance, and the flow priority; The Shaper model includes multiple parallel sub-Shaper, each of which corresponds to a member flow. The number of parallel sub-Shaper is equal to the number of member flows N. The configuration parameters include the initial credit value of the sub-Shaper (Credit_init), the number of parallel sub-Shapers, the rate difference between sub-Shapers (ΔRate), the time-aware gating offset (Offset), and the sub-Shaper scheduling weight. The mapping rules are as follows: The FRER sequence loss tolerance window W_seq is mapped to the sub-Shaper initial credit value Credit_init; The path deviation upper limit Δt is mapped to the rate difference ΔRate between the sub-Shapers; The synchronization tolerance is mapped to the time-aware gating offset Offset. The flow priority is mapped to the sub-Shaper scheduling weight; where high-priority flows correspond to large weights and high integer rate (CIR). The detection of the credit value of the Shaper model includes: detecting the initial credit value Credit_init of each sub-Shaper and calculating the credit difference ΔCredit between each sub-Shaper; when the initial credit value Credit_init of any sub-Shaper is lower than the low threshold Th_low, or the credit difference ΔCredit exceeds a preset difference threshold, the member flow is determined to be abnormal, so as to generate the verification incentive signal for the member flow; the verification incentive signal includes turning off bucket filling or injecting sequence number jumps in the sub-Shaper corresponding to the member flow.

6. The verification method for chip protection function as described in claim 1, characterized in that, The verification platform is a transaction-level verification environment based on the Universal Verification Methodology (UVM). The Shaper model is implemented in a transaction-level manner and is connected to the chip under test (DUT) through the Universal Verification Methodology Driver module UVM_Driver. The credit value includes the available token balance or available sending quota in the token pool of the Shaper model.

7. A verification system for chip protection functions, comprising executing a verification method for chip protection functions as described in any one of claims 1 to 6, characterized in that, include: Modeling units are used to map the protection function attributes to be verified to the configuration parameters of the flow shaper model; The Shaper model is connected to the modeling unit. Based on the Shaper model, background traffic is generated and sent to the chip under test (DUT), and it also has the function of congestion state detection. The detection and decision module is connected to the Shaper model and is used to detect the credit value of the Shaper model and compare the credit value with a preset high threshold Th_high and a low threshold Th_low to output a decision signal. The decision signal is used to control the generation of the excitation control unit to verify the start and stop status of the excitation signal. An incentive control unit, connected to the detection and decision module, is configured to start a verification incentive signal when the credit value is lower than a low threshold Th_low, stop the verification incentive signal when the credit value is higher than a high threshold Th_high, and maintain the current start / stop state when the credit value is in the hysteresis window interval between the low threshold Th_low and the high threshold Th_high. The verification module is connected to the chip under test (DUT) and is used to collect the protection switching behavior data of the DUT under the action of the verification excitation signal, and compare it with the preset expected response.

8. The verification system for chip protection function as described in claim 7, characterized in that, When the protection function is the Automatic Protection Switching (APS) function of the Ethernet switching chip: The modeling unit is configured as follows: The shaping rate (CIR) is mapped according to the protection level; The burst size CBS is committed to mapping based on the maximum tolerable switching delay T_max; The credit threshold (Credit_min) is mapped based on the maximum allowable packet loss rate (P_loss). The peak rate PIR is mapped based on the link bandwidth LINK_BW; The excitation control unit is configured to generate a verification excitation signal that injects an error frame or pulls the link valid signal low.

9. A verification system for chip protection function as described in claim 7, characterized in that, When the protection function is the Frame Copy and Cancel (FRER) function of the Time-Sensitive Network (TSN) chip: The modeling unit is configured as follows: Construct multiple parallel sub-Shaper based on the number of member streams N; The initial credit value Credit_init is determined based on the FRER sequence loss tolerance window W_seq mapper. Based on the upper limit of path deviation Δt, map the rate difference ΔRate between shapers; Based on the synchronization tolerance mapping, it is converted into a time-aware gating offset Offset; Based on the flow priority mapping, sub-Shaper scheduling weights are assigned. The detection and decision module is also used to calculate the credit difference ΔCredit between each of the sub-Shapers, and to determine that the member flow is abnormal when the credit difference ΔCredit exceeds a preset difference threshold. The incentive control unit is configured to generate a verification incentive signal that fills the bucket of the sub-Shaper corresponding to the closed member stream or injects a sequence number jump.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements a verification method for chip protection functions as described in any one of claims 1 to 6.

Images