Making Formal Normal
Integrating FV into your verification flow
Steve Holloway
FEBRUARY 2019
© 2019 Dialog Semiconductor
1
Dialog Corporate Overview
HQ: London, UK | Founded: 1981 | Listing: Frankfurt (DLG)
Dialog Semiconductor is a leading provider of custom and highly-integrated Configurable Mixed-signal ICs, including
power management, power conversion, and connectivity technologies, backed by world-class manufacturing partners.
Increased focus on fast-growing segments of mobile, Global design centers, broad direct sales
IoT, automotive and computing & storage applications and distribution channels, including
excellence in customer support
A fabless manufacturing model, with production, Leading innovator in Bluetooth® low energy
assembly and packaging fully outsourced technology
#1 supplier of PMICs, sub-PMICs and Track record of revenue growth and a strong cash
Configurable Mixed-signal ICs (CMICs) generative business model
© 2019 Dialog Semiconductor
2
Dialog’s Formal Journey
Novice
▪ Basic training (wider) Post Si debug
▪ Fundamental concepts
▪ Tool training Security
assurance
▪ Knowledge acquisition
▪ Expert hiring Automatic
▪ External consultants analysis,
Superlint
▪ Knowledge sharing (focussed)
In-house
▪ Best practise guidelines scripts & apps
▪ Knowledge base
Formal
▪ Assertion library
Property
▪ Internal training Verification
▪ Project deployment (focussed)
Bug Hunting
▪ Dialog FV expert network
▪ >= 1 expert per team Expert
▪ Project deployment model
© 2019 Dialog Semiconductor
3
Formal in the Verification Flow
Unreachability,
Formal Replay
Target FV Formal
features, Property
design Checking,
assurance Scripts, Apps
Coverage Gate Level
Specification vPlanning RTL Design Verification Post Silicon
Closure Sims
Designer
properties, ECO Bug Hunting
AFA
© 2019 Dialog Semiconductor
4
Formal vs Simulation workflow
Deep
Debug
Build Effort
Refine
Build Sanity Refine Uncover Coverage
Simulation testbench checking
models and
stimulus corner cases closure
checks
Deep
Debug
Refinement Effort
Refine
Develop Uncover Refine Reach proof Decide when
Formal sanity covers corner cases
models and
constraints bounds to stop
checks
© 2019 Dialog Semiconductor
5
Tips and Tricks – Creating Covers
▪Start with covers – do not leave until the end!
▪Confirms specified behaviour is possible in the FV environment
▪Basic coverage recipe:
▪All normal use cases possible
▪Every waveform diagram in the design specification
▪All transaction types possible
▪All FSM states/arcs reachable
▪Normally part of AFA
▪Corner cases reachable:
▪FIFO full/empty
▪Error or “bad machine” cases
© 2019 Dialog Semiconductor
6
Raising abstraction
Transactions as sequences
AHB write sequence
sequence ahb_write(addr, data);
(haddrs == addr) && hwrites && . . .
##1 (hreadys && !hwrites && . . . && hwdatas == data);
endsequence: ahb_write
Special function register check
chk_lock: assert property (
ahb_write(‘LOCK_REG, ‘h01)
|=>
lock_rwt);
© 2019 Dialog Semiconductor
7
Covering access sequence
cov_wr_deadabba: cover sequence (
ahb_write('h00, ‘hDE) ##1
ahb_write('h04, ‘hAD) ##1
ahb_write('h08, ‘hAB) ##1
ahb_write('h0C, ‘hBA) ##1
1);
© 2019 Dialog Semiconductor
8
Raising Abstraction
Abstract FSM
▪Possible to construct FSM model DUT
▪Higher level concept of DUT assertions
state
▪Allows simpler properties
▪Enables easier debug
▪Sometimes a good proxy for FSM
design restructure!
© 2019 Dialog Semiconductor
9
Helper code – avoiding complex properties
Pipelined handshaking protocol
Every req must have a gnt sometime later
gnt_follows_req: assert property (
@(posedge clk)
(req && (handshakes == 0)
|-> ##[1:$](handshakes == 0)));
There must be no gnt issued without a req
always @(posedge clk or negedge rst_n) begin no_gnt_without_req: assert property (
if (!rst_n) handshakes <= 0; @(posedge clk)
else begin (not(handshakes < 0)));
if (req & !gnt) handshakes++;
if (!req & gnt) handshakes--;
end
end
© 2019 Dialog Semiconductor
10
Mixing Formal with Simulation
No need to simulate - Formal is complete, right?
▪Some pitfalls with Formal:
▪Incomplete (bounded) proofs
▪Not knowing when to stop
▪Faulty constraints which give a false result
▪Some design structures don’t work well
▪How simulation can help:
▪Provides formal constraint checking
▪Cross-check FV design understanding
▪Can collect coverage metrics from formal env
▪Can tackle formal-unfriendly implementations
© 2019 Dialog Semiconductor
11
Formal Replay
Automated stimulus generation
▪Creating stimulus to exercise corner ‘coverage holes’ can be time
consuming
▪Closure activities take place close to tape-out, adding to project stress!
▪Formal Replay connects the two different worlds of Formal and dynamic
simulation
▪Stores cover traces (waveforms) from IP or device-level cover sequences
▪Converts these into simulation stimulus
▪Internal Dialog flow:
▪ Automatic hole covers – automatically generated from coverage metrics data
▪ Manual covers – cover sequences manually written for specific interesting cases
© 2019 Dialog Semiconductor
12
Metrics hole cover automation
Translating coverage analysis report into SVA covers
cov_hole_expr_11_1_2 : cover sequence (
!(clear_cabinet_i)&&
!(fifo_empty_o)&&
(user_reg_access_i)&&
!((rd_ptr_next == {SRAM_OFFSET_WIDTH{1'b0}}))&&
((rd_ptr_q + 1'b1))&&
(user_is_reading_d)
);
© 2019 Dialog Semiconductor
13
Formal Replay Flow
Testbench
DUT
Checkers
Coverage assumes
Metrics translate asserts Simulator
manual covers
hole covers
batch
JasperGold vcd wgl script
automation
© 2019 Dialog Semiconductor
14
Conclusions
▪Integrate FV into your verification flow – it’s a no-brainer!
▪Be careful not to neglect formal covers
▪Try to raise abstraction in your approach
▪Run FV assertions in simulation as early as possible
▪Judge ROI for FV vs simulation approaches
▪Take advantage of “push button” apps
▪ UNR
▪ AFA / Superlinting
▪ Connectivity/Security/CSR
▪ Formal Replay
▪Drive cultural change:
▪Make Formal Normal in your company
© 2019 Dialog Semiconductor
15
Powering the Smart Connected Future
www.dialog-semiconductor.com
Personal • Portable • Connected
© 2019 Dialog Semiconductor
16
