FORMAL VERIFICATION OF ADVANCED SYNTHESIS OPTIMIZATIONS Anant Kumar Jain Pradish Mathews Mike Mahar

1. FORMAL VERIFICATION OF ADVANCED SYNTHESISOPTIMIZATIONSAnant Kumar JainPradish MathewsMike Mahar

2. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Agenda Introduction Formal Verification Flow Logic Equivalence Checking Verification solutions for advanced Synthesis Optimizations Fault Tolerant Finite State Machine Encoding TMR Techniques Mapping of high level components like SRLs and DSPs Register Retiming Conclusion

3. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Formal Verification Flow Formal Verification Interface (FVI) file generated by synthesis tool helps during formal verification Each constraint in the FVI file is separately verified by the verification tool. FPGA products support a near �push-button� flow by writing out the register match file along with other optimizations like state encoding, duplicated flops, inverted states. Formalpro has this interface with Precision and Synplify-Pro. FPGA products support a near �push-button� flow by writing out the register match file along with other optimizations like state encoding, duplicated flops, inverted states. Formalpro has this interface with Precision and Synplify-Pro.

4. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Logic Equivalence Checking Matching will pair up Ins, OUTS, and Regs. If names differ, rules will be used.Matching will pair up Ins, OUTS, and Regs. If names differ, rules will be used.

5. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Logic Equivalence Checking FPGAs create duplicates for fanout and encodings which requires special matching. Naming of FPGA objects is not controlled by rules. Thus Matching is a challenge and requires FVI file. Registers from RTL can be mapped to large FPGA macrocells, mults, RAMs, DSP Compile flattens designs Match makes a �target� from a matched pair. Solve: proves equivalence of targetsFPGAs create duplicates for fanout and encodings which requires special matching. Naming of FPGA objects is not controlled by rules. Thus Matching is a challenge and requires FVI file. Registers from RTL can be mapped to large FPGA macrocells, mults, RAMs, DSP Compile flattens designs Match makes a �target� from a matched pair. Solve: proves equivalence of targets

6. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations FPGA Verification Challenges Advanced Synthesis Optimizations like: Fault Tolerant Finite State Machine Encoding TMR techniques Mapping of high level components like shift registers (SRL) and DSPs Register Retiming

7. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Finite State Machine (FSM)

8. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations FSM Encoding Common FSM encoding schemes utilized by the synthesis tool for a QofR improvement 1-hot (1-cold) encoding Grey Encoding Binary Encoding Fault Tolerant FSM encoding schemes utilized for safety and mission critical applications Recovering or Correcting fault with Single Event Upset (SEU) Re-encoding using extra parity flops

9. MAPLD 2009 - Synthesis of Fault Tolerant Circuits for FSMs & RAMs Fault Tolerant FSM

10. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Verification Challenges Register mapping between RTL and synthesis netlist might get distort after FSM encoding

11. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Verification using Encoding FVI Synthesis tool generates an encoding FVI constraint The constraint provides the information of the encoding that includes the parity registers as well. Verification tool creates an encoder-decoder circuit using this constraint to achieve a one-to-one register matching. Equivalence checking will be done on these matched register pairs

12. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Encoder - Decoder Circuit

13. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations TMR Techniques

14. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations TMR Formal Verification RTL to TMR netlist verification FVI constraints are generated by synthesis tool for the extra registers. These constraints provide the match for the extra TMR registers with its equivalent register in the RTL. Equivalence checking is then used to verify the extra TMR registers and the voter circuit.

15. Verification with Fault Injector Circuit

16. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations TMR Formal Verification TMR Netlist vs Non-TMR Netlist Both the netlists are synthesis output with no FVI constraints. A standard match rule file can be used in matching the extra registers in the TMR netlist with its equivalent register in the Non TMR netlist.

17. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Mapping of High Level FPGA Components Who: FPGA designer uses EC to confirm correct synthesis and interpretation of his coding style. An EC check also confirms revision control of source code set to synthesis output ( is RTL and gates in sync?). Verification engineer and System engineer use EC to accelerate gate-verification. Regression testing process should be set up to always verify, and set off alarms if it fails � after each synthesis, and after each place-and-route. What: EC effectively is same as running all RTL tests on the Gates plus verifies all the logic missed by stimulus/vectors. All 100x faster than any simulation solution. EC along with static timing checks (STA is in Precision RTL) eliminate need for gate-level simulation. Competition: Precision supports all vendors who provide EC libraries. Synplify limited to Xilinx and Altera. Unique: Precision generates a rich EC interface �text� file (currently) only supported by FormalPro. This file Eliminates false differences and configuration time spent by users. Does not compromise verification integrity. Other LEC vendors have not yet supported Precision. Who: FPGA designer uses EC to confirm correct synthesis and interpretation of his coding style. An EC check also confirms revision control of source code set to synthesis output ( is RTL and gates in sync?). Verification engineer and System engineer use EC to accelerate gate-verification. Regression testing process should be set up to always verify, and set off alarms if it fails � after each synthesis, and after each place-and-route. What: EC effectively is same as running all RTL tests on the Gates plus verifies all the logic missed by stimulus/vectors. All 100x faster than any simulation solution. EC along with static timing checks (STA is in Precision RTL) eliminate need for gate-level simulation. Competition: Precision supports all vendors who provide EC libraries. Synplify limited to Xilinx and Altera. Unique: Precision generates a rich EC interface �text� file (currently) only supported by FormalPro. This file Eliminates false differences and configuration time spent by users. Does not compromise verification integrity. Other LEC vendors have not yet supported Precision.

18. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Verification of High Level Components The register name is a static information in the FPGA library definition. It is used to generate the FVI constraints for matching the registers absorbed in these components with their equivalent RTL registers This FVI information gives a huge runtime improvement in the register matching step during formal verification. This register matching is further complicated if synthesis tool has employed retiming for the inference of these components.

19. Register Retiming

20. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Retiming and Formal Verification Retiming poses fundamental hurdles for equivalence checking NO Register mapping exists between RTL and retimed netlist, required for verification Formally verifying the RTL with the final synthesis output netlist is of enormous complexity It consists of combinational synthesis, retiming and post retiming synthesis.

21. Retiming Verification Flow MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations

22. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Retiming Verification Flow First the Verification Flow. [CLICK] Equivalence Check belongs after Synthesis when you have a netlist, and after Routing when you have a 2nd netlist EC checks that the Synth. And Route tools worked correctly. It also verifies that the User built the correct code. (revision control) CLICK First the Verification Flow. [CLICK] Equivalence Check belongs after Synthesis when you have a netlist, and after Routing when you have a 2nd netlist EC checks that the Synth. And Route tools worked correctly. It also verifies that the User built the correct code. (revision control) CLICK

23. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Retiming Verification Steps FVI constraint gives a hint to the verification tool about the movement of registers in that retiming step. Each retiming FVI constraint will be verified by applying standard retiming rules. These register movements will be applied on the pre-retimed netlist. After applying all the retiming constraints, one-to-one register matching can be done between the modified pre-retimed netlist and the final netlist. Complete equivalence checking will be done on these two netlists.

24. Some Retiming Verification Criteria � Verification of Register Initial States Retiming of flops with multiple fanout Retiming across sequential loop Retiming of registers with different enables State elements count check across all paths MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations

25. Verification of Register Initial States Retiming might change the initial state of the flop (i.e. an async reset flop might result in an async set flop after retiming).

26. Retiming of flops with multiple fanout MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations

27. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations Retiming across sequential loop

28. Registers with different enables MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations

29. State Elements Count Check A State elements count check will be done on the original pre-retimed netlist and the final netlist. The number of the registers in all the paths from any input to any output must remain same for both the netlists. The number of registers in all the loops in the design must remain same for both the netlists. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations

30. Conclusion A good FVI integration between a synthesis tool and a verification tool provides an automated flow for the verification of advanced synthesis optimizations. FVI information from synthesis tool gives a significant improvement in the runtime during formal verification. MAPLD 2009 - Formal Verification of Advanced Synthesis Optimizations