Formal Verification of Clock Domain Crossing Using Gate-level Models of Metastable Flip-Flops Ghaith Tarawneh, Andrey Mokhov and Alex Yakovlev Newcastle.

Slides:

Advertisements

Similar presentations

Advertisements

Self-Timed Logic Timing complexity growing in digital design -Wiring delays can dominate timing analysis (increasing interdependence between logical and.

Clock Domain Crossing (CDC)

1 Lecture 16 Timing  Terminology  Timing issues  Asynchronous inputs.

Systematic method for capturing “design intent” of Clock Domain Crossing (CDC) logic in constraints Ramesh Rajagopalan Cisco Systems.

Automated Method Eliminates X Bugs in RTL and Gates Kai-hui Chang, Yen-ting Liu and Chris Browy.

Timing Override Verification (TOV) Erik Seligman CS 510, Lecture 18, March 2009.

Leonardo da Vinci ALLEGRO © J. M. Martins Ferreira - University of Porto (FEUP / DEEC)1 Scan design techniques J. M. Martins Ferreira FEUP / DEEC - Rua.

Presenter : Shih-Tung Huang 2015/4/30 EICE team Automated Data Analysis Solutions to Silicon Debug Yu-Shen Yang Dept. of ECE University of Toronto Toronto,

Prof. John Nestor ECE Department Lafayette College Easton, Pennsylvania ECE VLSI System Design Lecture 10 - Communicating.

ELEC 256 / Saif Zahir UBC / 2000 Timing Methodology Overview Set of rules for interconnecting components and clocks When followed, guarantee proper operation.

Computer Architecture CS 215

1 KU College of Engineering Elec 204: Digital Systems Design Lecture 12 Basic (NAND) S – R Latch “Cross-Coupling” two NAND gates gives the S -R Latch:

Delay/Phase Regeneration Circuits Crescenzo D’Alessandro, Andrey Mokhov, Alex Bystrov, Alex Yakovlev Microelectronics Systems Design Group School of EECE.

Module 12.  In Module 9, 10, 11, you have been introduced to examples of combinational logic circuits whereby the outputs are entirely dependent on the.

1 CS 151: Digital Design Chapter 5: Sequential Circuits 5-3: Flip-Flops I.

Charles Kime & Thomas Kaminski © 2008 Pearson Education, Inc. (Hyperlinks are active in View Show mode) Chapter 5 – Sequential Circuits Part 1 – Storage.

Presenter : Ching-Hua Huang 2012/4/16 A Low-latency GALS Interface Implementation Yuan-Teng Chang; Wei-Che Chen; Hung-Yue Tsai; Wei-Min Cheng; Chang-Jiu.

1. 2 Logic Circuits Sequential Circuits Combinational Circuits Consists of logic gates whose outputs are determined from the current combination of inputs.

Sequential circuit Digital electronics is classified into combinational logic and sequential logic. In combinational circuit outpus depends only on present.

LEONARDO INSIGHT II / TAP-MM ASTEP - Basic Test Concepts © J. M. Martins Ferreira - University of Porto (FEUP / DEEC)1 Basic test concepts J. M. Martins.

1 Lecture 28 Timing Analysis. 2 Overview °Circuits do not respond instantaneously to input changes °Predictable delay in transferring inputs to outputs.

Synchronous Digital Design Methodology and Guidelines

RTL Hardware Design by P. Chu Chapter 161 Clock and Synchronization.

Prof. John Nestor ECE Department Lafayette College Easton, Pennsylvania ECE VLSI System Design Lecture 7 - Synchronizers.

Charles Kime & Thomas Kaminski © 2008 Pearson Education, Inc. (Hyperlinks are active in View Show mode) Chapter 6 –Selected Design Topics Part 3 – Asynchronous.

Automatic Verification of Timing Constraints Asli Samir – JTag course 2006.

Asynchronous Sequential Logic

ELEN 468 Lecture 241 ELEN 468 Advanced Logic Design Lecture 24 Design for Testability.

Embedded Systems Hardware:

Asynchronous Machines

Asynchronous Input Example Program counter normally increments, jumps to address of interrupt subroutine on asynchronous interrupt How many states can.

Sequential Circuits. 2 Sequential vs. Combinational Combinational Logic:  Output depends only on current input −TV channel selector (0-9) Sequential.

COMPUTER ARCHITECTURE & OPERATIONS I Instructor: Hao Ji.

مرتضي صاحب الزماني  The registers are master-slave flip-flops (a.k.a. edge-triggered) –At the beginning of each cycle, propagate values from primary inputs.

111/9/2005EE 108A Lecture 13 (c) 2005 W. J. Dally EE108A Lecture 13: Metastability and Synchronization Failure (or When Good Flip-Flops go Bad)

Local Asynchronous Communications. Bit-wise data transmission Data transmission requires: Encoding bits as energy Transmitting energy through medium Decoding.

Digital Logic Design CHAPTER 5 Sequential Logic. 2 Sequential Circuits Combinational circuits – The outputs are entirely dependent on the current inputs.

Chapter 7 Counters and Registers

Sequential Circuits Chapter 4 S. Dandamudi To be used with S. Dandamudi, “Fundamentals of Computer Organization and Design,” Springer,  S.

Digital System Bus A bus in a digital system is a collection of (usually unbroken) signal lines that carry module-to-module communications. The signals.

Chapter 5 - Part Sequential Circuit Design Design Procedure  Specification  Formulation - Obtain a state diagram or state table  State Assignment.

ASIC/FPGA design flow. FPGA Design Flow Detailed (RTL) Design Detailed (RTL) Design Ideas (Specifications) Design Ideas (Specifications) Device Programming.

Using Formal Verification to Exhaustively Verify SoC Assemblies by Mark Handover Kenny Ranerup Applications Engineer ASIC Consultant Mentor Graphics Corp.

1 Sequential Digital Circuits Alexander Titov 11 October 2014.

ECE Advanced Digital Systems Design Lecture 12 – Timing Analysis Capt Michael Tanner Room 2F46A HQ U.S. Air Force Academy I n t e g r i.

VHDL IE- CSE. What do you understand by VHDL??  VHDL stands for VHSIC (Very High Speed Integrated Circuits) Hardware Description Language.

© BYU 18 ASYNCH Page 1 ECEn 224 Handling Asynchronous Inputs.

CS 151: Digital Design Chapter 5: Sequential Circuits 5-3: Flip-Flops II.

An Unobtrusive Debugging Methodology for Actel AX and RTAX-S FPGAs Jonathan Alexander Applications Consulting Manager Actel Corporation MAPLD 2004.

Synthesis Of Fault Tolerant Circuits For FSMs & RAMs Rajiv Garg Pradish Mathews Darren Zacher.

Lecture #26 Page 1 ECE 4110– Sequential Logic Design Lecture #26 Agenda 1.State Encoding 2.Pipelined Outputs 3.Asynchronous Inputs Announcements 1.n/a.

Detecting Errors Using Multi-Cycle Invariance Information Nuno Alves, Jennifer Dworak, and R. Iris Bahar Division of Engineering Brown University Providence,

1 CDC Clock Domain Crossing. 2 Outline Introduction Introduction Basic terminology Basic terminology Types of synchronizers Types of synchronizers CDC.

CS/EE 3700 : Fundamentals of Digital System Design

COUNTERS Why do we need counters?

A Simplified Approach to Fault Tolerant State Machine Design for Single Event Upsets Melanie Berg.

CS151 Introduction to Digital Design Chapter 5: Sequential Circuits 5-1 : Sequential Circuit Definition 5-2: Latches 1Created by: Ms.Amany AlSaleh.

ASIC/FPGA design flow. Design Flow Detailed Design Detailed Design Ideas Design Ideas Device Programming Device Programming Timing Simulation Timing Simulation.

TOPIC : Introduction to Sequential Circuits UNIT 1: Modeling and Simulation Module 4 : Modeling Sequential Circuits.

1. 2 Logic Circuits Sequential Circuits Combinational Circuits Consists of logic gates whose outputs are determined from the current combination of inputs.

Presenter: Yi-Ting Chung Fast and Scalable Hybrid Functional Verification and Debug with Dynamically Reconfigurable Co- simulation.

WAITX: An Arbiter for Non-Persistent Signals

Class Exercise 1B.

An Unobtrusive Debugging Methodology for Actel AX and RTAX-S FPGAs

Limitations of STA, Slew of a waveform, Skew between Signals

Timing Analysis 11/21/2018.

CSE 370 – Winter Sequential Logic - 1

Lecture 19 Logistics Last lecture Today

Presentation transcript:

Formal Verification of Clock Domain Crossing Using Gate-level Models of Metastable Flip-Flops Ghaith Tarawneh, Andrey Mokhov and Alex Yakovlev Newcastle University, UK 17 th March 2016

Talk Outline  Clock Domain Crossing (CDC) Refresher  Sate-of-the-Art CDC Verification and its Limitations  Proposed CDC Verification Methodology  Testbench Verification Results

What is CDC?  Clock Domain Crossing (CDC) takes place when a signal is generated in one clock domain and latched in another.

Why is it problematic? 1. Incoming asynchronous transitions may violate the setup/hold time conditions of destination (receiver) flip-flops leading to metastability.

Why is it problematic?

2. Non-deterministic crossing latencies: transitions that are simultaneous at the sender’s end may arrive in different receiver clock cycles

Why is it problematic? 3. Transitions propagating through crossover combinational logic may cause temporary glitches to appear at the inputs of their destination flip-flops

Why is it problematic?  These problematic analogue phenomena may cause: 1. Irrecoverable state transitions 2. Data corruption  But are invisible in digital simulation … and so can escape conventional (digital) testbench and formal verification but manifest in silicon!

Talk Outline  Clock Domain Crossing (CDC) Refresher  Sate-of-the-Art CDC Verification and its Limitations  Proposed CDC Verification Methodology  Testbench Verification Results

Commercial CDC Verification Tools  Most commercial tools are linters for safe CDC design rules of thumb, e.g.: RULE1: use synchronizers to latch control signals RULE2: avoid implementing combinational logic in crossover paths (with exceptions) RULE3: don’t synchronize data signals (with exceptions)  These rules are heuristics based on theoretical understanding of CDC issues – they guarantee that CDC failures don’t happen.

Commercial CDC Verification Tools

Limitations State of the art commercial tools are reliable at spotting CDC errors but … 1. generate a considerable number of false positive warnings (reported figures from commercial SoCs: 100k CDC warnings out of which 90% were false positives*) 2. require the designer to specify how interface logic is supposed to behave and where exceptions to CDC rules must be made 3. are restricted to verifying stereotypical synchronization schemes and design patterns 4. cannot demonstrate the mechanics or consequences of failures * Lee Y, Kim N, Kim JB, Min B. Millions to thousands issues through knowledge based SoC CDC Verification. InSoC Design Conference (ISOCC), 2012 International 2012 Nov 4 (pp ). IEEE.

Talk Outline  Clock Domain Crossing (CDC) Refresher  Sate-of-the-Art CDC Verification and its Limitations  Proposed CDC Verification Methodology  Testbench Verification Results

Proposed CDC Verification Methodology Structural and functional rule-checking is really just a walk-around solution. We propose to address the fundamental challenge at the heart of CDC verification …

“ ” making metastability and other problematic CDC phenomena observable in digital simulation The (Real) Main Challenge of CDC Verification No structural or functional heuristics to find out when unobservable problems may occur: just make problems visible in simulation.

Proposed Verification Methodology  We developed a tool to apply this verification methodology. The basic idea:

How does the tool work? 1. Flip-flops are replaced with model cells that can simulate (1) setup/hold time violations, (2) non-deterministic inputs/outputs and (3) prolonged clk-to-q delays. Ports: D and Q are the data input/output pins (same as regular flip-flops) V (input) indicates when the setup/hold time conditions are violated M (output) indicates when the flip-flop is metastable T (output) indicates when the output transitions V, M and T use “active-x encoding” (x is active, 0 or 1 is inactive)

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

How does the tool work? 2. Combinational path duplicates are added to simulate logical masking and the transfer of timing violations between model flip-flops.

Talk Outline  Clock Domain Crossing (CDC) Refresher  Sate-of-the-Art CDC Verification and its Limitations  Proposed CDC Verification Methodology  Testbench Verification Results

Formal Verification Flow

Test Circuit  We used the following sender-receiver circuit as a test run.

Test Circuit - Verification Results Synchroniser(s)AssertionSource Netlist None as_correct_transfer ✓ as_sender_handshake ✓ as_no_blocked_transfer ✓ Sender Only as_correct_transfer ✓ as_sender_handshake ✓ as_no_blocked_transfer ✓ Receiver Only as_correct_transfer ✓ as_sender_handshake ✓ as_no_blocked_transfer ✓ Both as_correct_transfer ✓ as_sender_handshake ✓ as_no_blocked_transfer ✓ ✓ = assertion received pass status (no counter-examples found)

Test Circuit - Verification Results Synchroniser(s)AssertionSource NetlistAugmented Netlist None as_correct_transfer ✓ - as_sender_handshake ✓ - as_no_blocked_transfer ✓ - Sender Only as_correct_transfer ✓ - as_sender_handshake ✓✓ as_no_blocked_transfer ✓ - Receiver Only as_correct_transfer ✓ - as_sender_handshake ✓ - as_no_blocked_transfer ✓ - Both as_correct_transfer ✓✓ as_sender_handshake ✓✓ as_no_blocked_transfer ✓✓ ✓ = assertion received pass status (no counter-examples found)

More Verification Tests …  We also used the tool to verify a number of multi-clock designs whose functional correctness we knew apriori (from theory).

More Verification Tests … TestbenchDescriptionCDC IssueStructural ChecksProposed Tool 1Data transfer (4-phase handshaking and synchronizers)(none) ✓✓ 2Data transfer (4-phase handshaking, no synchronizers)Data Corruption-- 3Data transfer (no handshaking, data synchronization, Gray coding)(none)- ✓ 4Data transfer (no handshaking, data synchronization, non-Gray coding)Data Corruption-- 5Data transfer (no handshaking, no synchronization, quasi-stable data)(none)- ✓ 6Multiplexer in crossover path(none) ✓✓ 7Combinational logic in crossover path (glitch-prone)Glitches-- 8Combinational logic in crossover path (glitch-free)(none)- ✓ 9Two synchronization pointsPath Reconvergence-- 10Two synchronization points (not activated simultaneously)(none)- ✓ False Positives 40 False Negatives 00

What are the benefits? Structural/Functional Rule-checking (Conventional) Simulating CDC Phenomena (Proposed) False PositivesManyLow/none Designer Input must specify adopted patterns and rule exceptions Zero configuration ApplicabilityLimited to known design patternsGeneral Failure mechanisms and consequences Unknown Demonstrated in signal waveforms

What are the benefits?

Conclusion  Presented a new method to verify multi-clock designs  The method relies on reproducing CDC faults in digital simulation  In testing the method revealed an inherent ability to report many known CDC design issues (e.g. synchronization, non-deterministic latencies, glitches, path convergence, data corruption)  Offers several advantages on top of state-of-the-art commercial CDC verification (e.g. fewer false positives, zero configuration, applicability to non-stereotypical designs)

Thank you There is a live demo of the tool starting NOW (10:00 – 12:00) at the University Booth UB09.4 – come and see the tool at work!