Classics Of FPV

Erik Seligman

CS 510, Lecture 10, January 2009

Goals

View examples of successful FPV cases• Abstracted a bit from real life

• But concepts reusable for actual design

See common patterns of FPV usage• Begin building ‘cookbook’ for designers

• Use past successes as guide

• Recognize cases well-suited for FPV

Encore Gigamax Cache

What is this example?

From Ken McMillan’s thesis• Key example using BDDs for FPV

• Major early-90’s PoC that FPV is viable

Basics of Gigamax Cache• Distributed multiprocessor system

• Detailed prototcol for maintaining coherence– Multiple proc need consistent view of memory

– Bus free between req & response, for other activity

– Memory block may be invalid, shared, or owned state at each processor

– One ‘master’ chosen on a bus at each cycle

Gigamax Abstract View

More on Gigamax Protocol

Important Properties for Cache Coherence Free from deadlock Sequential Consistency Various safety properties

Q: state ‘free from deadlock’ in SVA• Given variables readable and writable

Important Properties for Cache Coherence Free from deadlock Sequential Consistency Various safety properties

Q: state ‘free from deadlock’ in SVA• Given variables readable and writable

A1: assert property

(##[0:$] readable && ##[0:$] writable)

FPV Found Deadlock

Based on abstract model of protocol Found long sequence of events that

would lead to deadlock• Owner of mem block sends write cmd

• Remote block sends read to owner– Requests pass in transit

• Another remote request for same block– Locks global bus, nobody unlocks

New find, unknown to makers of Gigamax!

PCIE Packet Assembly

Packet Assembly Example

Abstracted from PCI-Express verification• FPV done by Erik

Fixed-size packets (DWORDS) from link layer• Assembled into transactions

– Start, end, type markers visible– Data errors detected & abort transaction

• Transaction may have variable # of packets– Type info at transaction start

• Transaction may commit or abort

“Garbage traffic” must be ignored• System guarantees no fake transaction-start

Link/Transaction Interface (abstract view)

FPV Challenge

Model complete correctness?• Possible, but would require lots of code

• Estimated to rival size of RTL– Insufficient ROI

Instead, create set of safety properties• Observe start, end, commit/abort, and types

• Can you guess some properties?

FPV Safety Properties

Examples of implemented properties• If START seen, END seen at legal time

• After END, see a COMMIT or ABORT in specified amount of time

• Without END, see no COMMIT or ABORT Required “shadow model” code

• Limited modeling but not full packet checking

• Kept track of various parts of state:– Inside or outside transaction– Transaction type

FPV Results

Basic method used for several chipsets Found serious errors missed by sim

• Simulation env omitted certain transactions

• Garbage traffic created fake transaction

• Could get into bad state & not commit or abort one packet

• Unlucky data confusing the state machine

Transaction Queue FPV

Transaction Queue

Another abstracted PCIE case• Also FPVed by Erik

• FIFO stores incoming transactions

Transaction Queue FPV

Designer was worried about overflow• Minimized size due to area/timing worries

• But what if transactions arrive too fast?– Misc logic must create backpressure in time– Some transactions need to hold >1 cycle

FPV requirements• Assumption: backpressure worksassume property (backpressure |=> !trans_valid);

• Assertion: queue won’t overflowassert property (!(fifo_cur == FIFO_MAX));

FPV Results

First got bogus pass, needed coverage

cover property (fifo_cur == FIFO_MAX-1);

• Revealed some minor assumption errors

Found real bug!• Queue needed to be 1 deeper

– Or generate backpressure one cycle earlier

• Due to backpressure latency in misc logic

• Miscalculation by designer

OpenSparc DDR2 Memory Controller

DDR2 Memory Controller (MC) Described in 2008 Datta/Singhal paper Various safety requirements

• Priority: refresh, CAS, scrub, read, write

• Max # commands in interval

Issue: Complex Startup

Control registers• Set by system during boot

• Take thousands of cycles– FPV would never get a good result!

Similar issues with software startup• Many command words needed to initialize

Get simulation values for registers, use assumptions to set & hold constant

Opportunity: Design Symmetry All bits of datapath basically identical So reduce width to 1 for FPV

• Code must be well-parameterized to enable

8 Banks in design, all with identical logic• Just need to FPV 1 for good confidence

Issue: Large Counters

13-bit refresh interval, 12-bit scrub interval• So potentially 2^13 cycles to see error

• Worse if independent & need both at once!

Solution: abstract counters• Create cut points at counter outputs

• Counters get arbitrary values for FPV– Potential problems?

Issue: Hazard Conditions

Important to check hazards like RAW• Read-after-write (RAW): Read from address

with write pending

• Requires 32-bit address compare– Complexity for FPV

Solution: free the RAW bit• At arbitrary time, FPV can assume hazard hit

– Potential problems?

MC Property Example

• No more than 4 ACTIVATE commands may be issued to the DDR2 SDRAM within a window of T_FAW clock cycles

• Added verilog code for tfaw_counter• Property violated: bug found!

Basic FPV Patterns

Reference Models

• assert property (rtl.o1 == abstract.o1)

• assert property (rtl.o2 == abstract.o2)

Shadow Models

• assert property (rtl.o1 == abstract.o1)

• o2 not represented in model, no property

Arbiters

Classic, common case for useful FPV Multiple requests come for a bus

• Arbiter decides who owns bus each cycle

What are some important properties?

Arbiters

Classic, common case for useful FPV Multiple requests come for a bus

• Arbiter decides who owns bus each cycle

What are some important properties?• Fair

req[i] |-> ##[1:`BOUND] owner[i]

owner[i] |-> ##[1:`BOUND] !owner[i]

• Conflict-free$onehot0(owner)

• Efficiency– (|req) |=> (|owner)

State Machines

Another common case for FPV Common state machine assertions?

State Machines

Another common case for FPV Common state machine assertions?

• Each SM state reachable

cover property (state == STATE_VALS[i]);

• System consistent with SM state

assert property ((state == `WAITING) |-> (req==1));

• State machine will always return to idle

assert property ((state == STATE_VAL[i]) |-> ##[1:`BOUND] (state == `IDLE));

General FIFO Assertions

Fifos are another common FPV case. Fifo assertion ideas?

General FIFO Assertions

Fifos are another common FPV case. Fifo assertion ideas?

Overflow/underflowassert property (fifo_cur==DEPTH |=> !write);

assert property (fifo_cur==0 |=> !read);

Successful flushassert property (flush |=> (fifo_cur==0));

Cover conditions of filling/emptying queuecover property (fifo_cur==DEPTH-1 ##1 fifo_cur==DEPTH);

cover property (fifo_cur==1 ##1 fifo_cur=0);

FIFO: Tracking A Value

Common for FIFO: we saw value go in, make sure it comes out

“Local variable” feature of SVA

property data_check;

bit [`SIZE:0] lvar;

(write, lvar = data_in) |-> ##[0:`BOUND]

(read && (data_out == lvar)) ); Watch for danger of sim performance hit

• Many threads may be needed

Sets of Related Properties

Suppose we see many failures in module Think about common causes

• Some overall constraint on inputs missing?

• Some conceptual issue missed?

Examples• Clocks/Reset: Are they correct? Are clock

ratios legal?

• Address/Command const for <n> cycles?

• Legal commands supplied?

References / Further Reading

http://www.kenmcmil.com/pubs/thesis.pdf http://oskitech.com/papers/datta-mc-vlsi08.pdf http://oskitech.com/wiki/index.php?title=Main_Page http://www.eetimes.com/news/design/showArticle.jhtml

;jsessionid=FQOK0R2XZXMHOQSNDLRSKHSCJUNN2JVN?articleID=190301228&pgno=1

http://ebook.dicder.com/verification/SystemVerilog%20Assertion%20Handbook.pdf

http://www.amazon.com/Assertion-Based-Design-Information-Technology-Transmission/dp/1402080271/ref=sr_1_1?ie=UTF8&s=books&qid=1233705569&sr=8-1 (especially ch.7)