Classics Of FPV

Erik SeligmanCS 510, Lecture 10, January 2009

Goals View examples of successful FPV cases

• Abstracted a bit from real life• But concepts reusable for actual design

See common patterns of FPV usage• Begin building ‘cookbook’ for designers• Use past successes as guide• Recognize cases well-suited for FPV

Encore Gigamax Cache

What is this example? From Ken McMillan’s thesis

• Key example using BDDs for FPV• Major early-90’s PoC that FPV is viable

Basics of Gigamax Cache• Distributed multiprocessor system• Detailed prototcol for maintaining coherence

– Multiple proc need consistent view of memory– Bus free between req & response, for other activity– Memory block may be invalid, shared, or owned state at

each processor– One ‘master’ chosen on a bus at each cycle

Gigamax Abstract View

More on Gigamax Protocol

Important Properties for Cache Coherence Free from deadlock Sequential Consistency Various safety properties

Q: state ‘free from deadlock’ in SVA• Given variables readable and writable

Important Properties for Cache Coherence Free from deadlock Sequential Consistency Various safety properties

Q: state ‘free from deadlock’ in SVA• Given variables readable and writable A1: assert property

(##[0:$] readable && ##[0:$] writable)

FPV Found Deadlock Based on abstract model of protocol Found long sequence of events that

would lead to deadlock• Owner of mem block sends write cmd• Remote block sends read to owner

– Requests pass in transit• Another remote request for same block

– Locks global bus, nobody unlocks New find, unknown to makers of

Gigamax!

PCIE Packet Assembly

Packet Assembly Example Abstracted from PCI-Express verification

• FPV done by Erik Fixed-size packets (DWORDS) from link layer

• Assembled into transactions– Start, end, type markers visible– Data errors detected & abort transaction

• Transaction may have variable # of packets– Type info at transaction start

• Transaction may commit or abort “Garbage traffic” must be ignored

• System guarantees no fake transaction-start

Link/Transaction Interface (abstract view)

FPV Challenge Model complete correctness?

• Possible, but would require lots of code• Estimated to rival size of RTL

– Insufficient ROI

Instead, create set of safety properties• Observe start, end, commit/abort, and types• Can you guess some properties?

FPV Safety Properties Examples of implemented properties

• If START seen, END seen at legal time• After END, see a COMMIT or ABORT in

specified amount of time• Without END, see no COMMIT or ABORT

Required “shadow model” code• Limited modeling but not full packet checking• Kept track of various parts of state:

– Inside or outside transaction– Transaction type

FPV Results Basic method used for several chipsets Found serious errors missed by sim

• Simulation env omitted certain transactions• Garbage traffic created fake transaction• Could get into bad state & not commit or

abort one packet• Unlucky data confusing the state machine

Transaction Queue FPV

Transaction Queue Another abstracted PCIE case

• Also FPVed by Erik• FIFO stores incoming transactions

Transaction Queue FPV Designer was worried about overflow

• Minimized size due to area/timing worries• But what if transactions arrive too fast?

– Misc logic must create backpressure in time– Some transactions need to hold >1 cycle

FPV requirements• Assumption: backpressure worksassume property (backpressure |=> !trans_valid);• Assertion: queue won’t overflowassert property (!(fifo_cur == FIFO_MAX));

FPV Results First got bogus pass, needed coverage

cover property (fifo_cur == FIFO_MAX-1);• Revealed some minor assumption errors

Found real bug!• Queue needed to be 1 deeper

– Or generate backpressure one cycle earlier • Due to backpressure latency in misc logic• Miscalculation by designer

OpenSparc DDR2 Memory Controller

DDR2 Memory Controller (MC) Described in 2008 Datta/Singhal paper Various safety requirements

• Priority: refresh, CAS, scrub, read, write• Max # commands in interval

Issue: Complex Startup Control registers

• Set by system during boot• Take thousands of cycles

– FPV would never get a good result!

Similar issues with software startup• Many command words needed to initialize

Get simulation values for registers, use assumptions to set & hold constant

Opportunity: Design Symmetry All bits of datapath basically identical So reduce width to 1 for FPV

• Code must be well-parameterized to enable 8 Banks in design, all with identical logic

• Just need to FPV 1 for good confidence

Issue: Large Counters 13-bit refresh interval, 12-bit scrub

interval• So potentially 2^13 cycles to see error• Worse if independent & need both at once!

Solution: abstract counters• Create cut points at counter outputs• Counters get arbitrary values for FPV

– Potential problems?

Issue: Hazard Conditions Important to check hazards like RAW

• Read-after-write (RAW): Read from address with write pending

• Requires 32-bit address compare– Complexity for FPV

Solution: free the RAW bit• At arbitrary time, FPV can assume hazard hit

– Potential problems?

MC Property Example

• No more than 4 ACTIVATE commands may be issued to the DDR2 SDRAM within a window of T_FAW clock cycles

• Added verilog code for tfaw_counter• Property violated: bug found!

Basic FPV Patterns

Reference Models

• assert property (rtl.o1 == abstract.o1)

• assert property (rtl.o2 == abstract.o2)

Shadow Models

• assert property (rtl.o1 == abstract.o1)

• o2 not represented in model, no property

Arbiters Classic, common case for useful FPV Multiple requests come for a bus

• Arbiter decides who owns bus each cycle What are some important properties?

Arbiters Classic, common case for useful FPV Multiple requests come for a bus

• Arbiter decides who owns bus each cycle What are some important properties?

• Fairreq[i] |-> ##[1:`BOUND] owner[i]owner[i] |-> ##[1:`BOUND] !owner[i]

• Conflict-free$onehot0(owner)

• Efficiency– (|req) |=> (|owner)

State Machines Another common case for FPV Common state machine assertions?

State Machines Another common case for FPV Common state machine assertions?

• Each SM state reachablecover property (state == STATE_VALS[i]);

• System consistent with SM stateassert property ((state == `WAITING) |-> (req==1));

• State machine will always return to idleassert property ((state == STATE_VAL[i]) |-> ##[1:`BOUND] (state == `IDLE));

General FIFO Assertions Fifos are another common FPV case. Fifo assertion ideas?

General FIFO Assertions Fifos are another common FPV case. Fifo assertion ideas?

Overflow/underflowassert property (fifo_cur==DEPTH |=> !write);assert property (fifo_cur==0 |=> !read);

Successful flushassert property (flush |=> (fifo_cur==0));

Cover conditions of filling/emptying queuecover property (fifo_cur==DEPTH-1 ##1 fifo_cur==DEPTH);cover property (fifo_cur==1 ##1 fifo_cur=0);

FIFO: Tracking A Value Common for FIFO: we saw value go in,

make sure it comes out “Local variable” feature of SVA

property data_check; bit [`SIZE:0] lvar; (write, lvar = data_in) |-> ##[0:`BOUND] (read && (data_out == lvar)) );

Watch for danger of sim performance hit• Many threads may be needed

Sets of Related Properties Suppose we see many failures in module Think about common causes

• Some overall constraint on inputs missing?• Some conceptual issue missed?

Examples• Clocks/Reset: Are they correct? Are clock

ratios legal?• Address/Command const for <n> cycles?• Legal commands supplied?

References / Further Reading http://www.kenmcmil.com/pubs/thesis.pdf http://oskitech.com/papers/datta-mc-vlsi08.pdf http://oskitech.com/wiki/index.php?title=Main_Page http://www.eetimes.com/news/design/showArticle.jhtml

;jsessionid=FQOK0R2XZXMHOQSNDLRSKHSCJUNN2JVN?articleID=190301228&pgno=1

http://ebook.dicder.com/verification/SystemVerilog%20Assertion%20Handbook.pdf

http://www.amazon.com/Assertion-Based-Design-Information-Technology-Transmission/dp/1402080271/ref=sr_1_1?ie=UTF8&s=books&qid=1233705569&sr=8-1 (especially ch.7)