Streamline Verification Process with Formal Property Verification to Meet Highly Compressed Design Cycle Prosenjit Chatterjee, nVIDIA Corporation

GoalsGoals Reach conventional verification goals faster Reach conventional verification goals faster Reach more verification goals Reach more verification goals Fewer verification resources Fewer verification resources Prove specific properties of most complex blocks Prove specific properties of most complex blocks Reach conventional verification goals faster Reach conventional verification goals faster Reach more verification goals Reach more verification goals Fewer verification resources Fewer verification resources Prove specific properties of most complex blocks Prove specific properties of most complex blocks

SFVSFV Minimal verification environment expertise Minimal verification environment expertise Ability to use conventional verification techniques Ability to use conventional verification techniques Non FV-able properties still usable Non FV-able properties still usable Use conventional verification techniques at Full Chip and Super Unit level Use conventional verification techniques at Full Chip and Super Unit level However, now fewer bugs to uncover as sub-units are already SFV-ed However, now fewer bugs to uncover as sub-units are already SFV-ed Full time Dedicated Verification Engineer not required Full time Dedicated Verification Engineer not required Designer’s kit Designer’s kit Minimal verification environment expertise Minimal verification environment expertise Ability to use conventional verification techniques Ability to use conventional verification techniques Non FV-able properties still usable Non FV-able properties still usable Use conventional verification techniques at Full Chip and Super Unit level Use conventional verification techniques at Full Chip and Super Unit level However, now fewer bugs to uncover as sub-units are already SFV-ed However, now fewer bugs to uncover as sub-units are already SFV-ed Full time Dedicated Verification Engineer not required Full time Dedicated Verification Engineer not required Designer’s kit Designer’s kit

Conventional Verification Process Sets of vector sequences that Sets of vector sequences that User generates to accomplish coverage goals User generates to accomplish coverage goals Directed or Random Vector sequences Directed or Random Vector sequences Outputs are “smart-diffed” Outputs are “smart-diffed” Sets of vector sequences that Sets of vector sequences that User generates to accomplish coverage goals User generates to accomplish coverage goals Directed or Random Vector sequences Directed or Random Vector sequences Outputs are “smart-diffed” Outputs are “smart-diffed” DUT RTL DUT Data Transform Model TestBench X Pass Fail Internal Properties Internal Properties Unknown Fail User writes TestBench Internal Coverage Goal Reachable Unknown Reachable Unknown DUT TestPlan Coverage Goals Input Biasing

SFV Environment DUT RTL Input Assumptions DUT Data Transform Model SFV TestBench X Pass Fail Internal Properties Input Biasing DUT TestPlan Coverage Goals Internal Coverage Goal Proof Unknown Fail generates Reachable Unknown Unreachable Reachable Unknown Unreachable

SFV Environment- Test Bench Input Assumptions provide legal stimulus Input Assumptions provide legal stimulus Input Biasing provide higher proportion of important events Input Biasing provide higher proportion of important events Different Random Seeds are applied automatically Different Random Seeds are applied automatically Random Simulation obeys Input Assumptions and Biasing Random Simulation obeys Input Assumptions and Biasing FV obeys Input Assumptions. Biasing is irrelevant FV obeys Input Assumptions. Biasing is irrelevant Auto self adjusts user’s biasing to reach coverage goals Auto self adjusts user’s biasing to reach coverage goals Coverage goals missed by SFV are reached by directed testing Coverage goals missed by SFV are reached by directed testing Input Assumptions provide legal stimulus Input Assumptions provide legal stimulus Input Biasing provide higher proportion of important events Input Biasing provide higher proportion of important events Different Random Seeds are applied automatically Different Random Seeds are applied automatically Random Simulation obeys Input Assumptions and Biasing Random Simulation obeys Input Assumptions and Biasing FV obeys Input Assumptions. Biasing is irrelevant FV obeys Input Assumptions. Biasing is irrelevant Auto self adjusts user’s biasing to reach coverage goals Auto self adjusts user’s biasing to reach coverage goals Coverage goals missed by SFV are reached by directed testing Coverage goals missed by SFV are reached by directed testing

Coverage Goals Automated: Line Coverage Line Coverage Condition Coverage Condition Coverage User Specified: Implementation Specific Implementation Specific Executable Test Plan Executable Test PlanAutomated: Line Coverage Line Coverage Condition Coverage Condition Coverage User Specified: Implementation Specific Implementation Specific Executable Test Plan Executable Test Plan

Coverage Goals Rand_B1 Rand_Default Rand_Bm Coverage Report Save SFV generated vectors Partition uncovered goals SFV_G1 SFV_Gn C-RTL output compare Rand_Default Coverage met ? yes Done no Directed Testing or SFV run with - biased random ON - formal engines OFF SFV run with - biased random ON - formal engines ON

Unit Verification Goals Reached Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved

SFV Engines Property Proving or Coverage Goal Unreachability SFV Process 2 Process 1 Property Falsification or Coverage Goal Reachability

Using BMC from interesting start states Default start state is reset state Default start state is reset state SFV tool uses heuristics to find interesting start states SFV tool uses heuristics to find interesting start states User identifies subset of coverage goals as interesting start states User identifies subset of coverage goals as interesting start states Requires efficient management of the start states population Requires efficient management of the start states population Default start state is reset state Default start state is reset state SFV tool uses heuristics to find interesting start states SFV tool uses heuristics to find interesting start states User identifies subset of coverage goals as interesting start states User identifies subset of coverage goals as interesting start states Requires efficient management of the start states population Requires efficient management of the start states population

Helping SFV tool reach interesting states faster Limiting conditions in DUT may be very “deep” Limiting conditions in DUT may be very “deep” Tolerable Random Logic Addition to fan-in of internal signals in DUT Tolerable Random Logic Addition to fan-in of internal signals in DUT Limiting conditions in DUT may be very “deep” Limiting conditions in DUT may be very “deep” Tolerable Random Logic Addition to fan-in of internal signals in DUT Tolerable Random Logic Addition to fan-in of internal signals in DUT fifo_full = original_RTL_design_logic || random_hi_or_low; random_hi_or_low; Tout_cntr <= random_decision ? timeout_value : timeout_value : original_RTL_design_logic; original_RTL_design_logic; fifo_full = original_RTL_design_logic || random_hi_or_low; random_hi_or_low; Tout_cntr <= random_decision ? timeout_value : timeout_value : original_RTL_design_logic; original_RTL_design_logic; Primarily for finding bugs using SAT Primarily for finding bugs using SAT Coverage Goals reached via such techniques are ignored Coverage Goals reached via such techniques are ignored Primarily for finding bugs using SAT Primarily for finding bugs using SAT Coverage Goals reached via such techniques are ignored Coverage Goals reached via such techniques are ignored

Enhanced Unit Verification Goals Reached Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved

Proving Data Transport Functionality - Intuition If I want to check FEDEX and UPS always delivers safely THEN If I want to check FEDEX and UPS always delivers safely THEN I do not care if Dan changes the gift before sending I do not care if Dan changes the gift before sending Of course Dan cannot expect to deliver nuclear weapons via UPS Of course Dan cannot expect to deliver nuclear weapons via UPS If I want to check FEDEX and UPS always delivers safely THEN If I want to check FEDEX and UPS always delivers safely THEN I do not care if Dan changes the gift before sending I do not care if Dan changes the gift before sending Of course Dan cannot expect to deliver nuclear weapons via UPS Of course Dan cannot expect to deliver nuclear weapons via UPS FEDEX gift to John Dan UPS gift to Bob f(x)=x^ garbage 2 +ve Original Too much ! Perfect ! 2 2 Imperfect !

Data Transport Properties A packet entering the system may not be visible exiting the system if DUT is viewed as a black box DUT P1P2...Pn Q1Q2...Qm n >= 1, m >= 0 This happens due to - One or more data transform functions inside DUT or - One or more data transform functions inside DUT or - Legal dropping of a Packet - Legal dropping of a Packet - Single Packet may split to multiple destinations - Single Packet may split to multiple destinations - Multiple Packets may merge to single destination - Multiple Packets may merge to single destination

H(x) G(x) F(x) M(x) null N(x) P enters via I1 Non-Math data transform Math data transform Deep FIFO Split Data filter Breakup for FV complexity P’ exits via O2 P’’ exits via O2 Proving Data Transport Properties

Deep FIFO Split Proving Data Transport Properties Non-Math data transform Math data transform Data filter Breakup for FV complexity H(x) G(x) F(x) M(x) null N(x)

Tool Assisted User Interactive Proof Process ABC = Cone of Influence of Property ABC = Cone of Influence of Property A’BC’ = Minimal cut-point to prove the Property A’BC’ = Minimal cut-point to prove the Property A’’BC’’ = Cut-point that the tool can handle to Prove Property A’’BC’’ = Cut-point that the tool can handle to Prove Property are internal assumptions added to Prove Property within A’’BC’’ are internal assumptions added to Prove Property within A’’BC’’ Internal Assumptions are subject to similar Proof Process Internal Assumptions are subject to similar Proof Process ABC = Cone of Influence of Property ABC = Cone of Influence of Property A’BC’ = Minimal cut-point to prove the Property A’BC’ = Minimal cut-point to prove the Property A’’BC’’ = Cut-point that the tool can handle to Prove Property A’’BC’’ = Cut-point that the tool can handle to Prove Property are internal assumptions added to Prove Property within A’’BC’’ are internal assumptions added to Prove Property within A’’BC’’ Internal Assumptions are subject to similar Proof Process Internal Assumptions are subject to similar Proof Process A B C A’ A’’ C’ C’’

Enhanced SFV Environment DUT RTL Input Assumptions DUT Data Transform Model DUT Data Transport Property SFV TestBench X Pass Fail Internal Properties Input Biasing DUT TestPlan Coverage Goals generates Proof Unknown Fail Reachable Unknown Unreachable Internal Coverage Goal

Enhanced Unit Verification Goals Reached Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved Important Properties of Complex Control Logic Blocks proved Important Properties of Complex Control Logic Blocks proved Coverage goals reached or proved expectedly unreachable Coverage goals reached or proved expectedly unreachable Line, Line, Condition, Condition, User Specified Implementation Specific, User Specified Implementation Specific, User Specified Test Plan User Specified Test Plan SFV traces that reached above goals = Data Transform Model Output SFV traces that reached above goals = Data Transform Model Output White Box Properties proved or bounded proved White Box Properties proved or bounded proved End to End Data Transport Property proved End to End Data Transport Property proved Important Properties of Complex Control Logic Blocks proved Important Properties of Complex Control Logic Blocks proved

Future Improvements Formal engines parallelized to reach goals faster Formal engines parallelized to reach goals faster Efficient Management of interesting start states population Efficient Management of interesting start states population Automating “logic addition” to DUT to reach bugs faster Automating “logic addition” to DUT to reach bugs faster Automate Assume Guarantee Verification for proofs Automate Assume Guarantee Verification for proofs Formal engines parallelized to reach goals faster Formal engines parallelized to reach goals faster Efficient Management of interesting start states population Efficient Management of interesting start states population Automating “logic addition” to DUT to reach bugs faster Automating “logic addition” to DUT to reach bugs faster Automate Assume Guarantee Verification for proofs Automate Assume Guarantee Verification for proofs