This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2008-249098, filed on Sep. 26, 2008, the entire contents of which are incorporated herein by reference.
The embodiment discussed herein is related to circuit verification support.
Conventionally, when hardware (sequential circuit) that implements a desired function is designed, logic verification to check for omissions in the design is a fundamental process before moving to manufacture of actual hardware. Specifically, a verification scenario that suits the contents of the hardware design is created, and logic verification is performed using an output result obtained when the verification scenario is input.
Furthermore, verification coverage is obtained to objectively evaluate the verification that has been performed using the verification scenario created as described above. Verification coverage is information concerning an index that indicates the sufficiency of simulation patterns for a subject of verification. Specifically, if the population is all simulation patterns requiring verification, coverage obtained from a rate of the executed simulation patterns is provided as the verification coverage. In this case, verification accuracy is determined to be high if the verification coverage is high.
A problem with this technique concerns the method of extracting “all simulation patterns requiring verification”, i.e., the population. Simulation patterns corresponding to the population are referred to as coverage standards. If patterns are extracted that are not effective practically for verification as coverage standards, the patterns do not necessarily contribute to improvement of actual verification efficiency even if the coverage of the simulation is high.
Therefore, methods called path coverage and code coverage in which patterns are comprehensively extracted according to specific standards are used nowadays. In path coverage, patterns to verify all paths causing state transitions in the register of a circuit under verification are extracted. Therefore, with the path coverage method, these patterns are the coverage standards. Code coverage is also called line coverage, and patterns are extracted to verify paths related to input and output of the register in which source codes corresponding to a circuit under verification are described. Further, in the code coverage, these patterns are the coverage standards. Such techniques are disclosed in, for example, Japanese Laid-Open Patent Publication Nos. 2006-190209 and 2006-201980, and “Assertion-Based Design” (2nd Edition) by Foster, Harry D., et al., “Programming Code metrics”, pp. 129-130, 2004.
However, even if a verification scenario comprehensive of the coverage standards as described above is created and verification is performed using the verification scenario, a bug due to an omission of verification may occur when the sequential circuit is actually operated, even if the coverage standards described above are 100 in the verification scenario; a consequence originating in a verification oversight of timing constraints that are given as a hardware specification corresponding to register transistor logic (RTL) description.
With the conventional verification coverage, in the path coverage standards, a verification scenario is created for each path corresponding to conditional branching for hardware that is designed based on the specifications as described above, thereby improving the verification accuracy.
When a verification scenario 2510 of items b, c, and d is executed, all paths are covered as expressed by broken lines in
If there is no error in the hardware description, it is possible to find a bug without omission by performing verification that satisfies the coverage standards as described above. However, when there is an error in the hardware description, oversight in verification can be caused when the specification is not satisfied, or the like.
A case where verification oversight is caused concerning a conditional branch is explained.
Moreover, when the line coverage described above is used as the coverage standards, verification of paths corresponding to the description of source code corresponding to a sequential circuit to be verified is a problem either in correct description or in incorrect description. Therefore, if the verification scenario 2810 of the items b, c, and d are created, the coverage becomes 100 coverage.
As described, in the conventional coverage standards, coverage concerning the conditional branch in a circuit to be verified may not be completely covered even if a verification scenario that achieves 100 coverage is created.
However, a technique to confirm coverage of conditional branches by a created verification scenario has not been provided. Therefore, incorrect description cannot be extracted as a problem when hardware description has been changed to incorrect description as explained with reference to
According to an aspect of an embodiment, computer-readable recording medium stores therein a verification support program that causes a computer to execute receiving a hardware description of a sequential circuit to be verified and a timing specification that indicates a timing constraint in the hardware description; converting the hardware description into a control flow graph that expresses a flow of control in the sequential circuit; indentifying, from the control flow graph and as a combination of conditional branch descriptions having a hierarchical relation, conditional branch descriptions that are connected in parallel; extracting, from among combinations of conditional branch descriptions identified at the identifying, a combination having a potential to satisfy specified conditions; creating a simulation program that, at a timing satisfying the timing specification received at the receiving, causes the conditional branch descriptions included in the combination extracted at the extracting to satisfy the specified conditions; and outputting, as assertion information of the sequential circuit, the simulation program created at the creating.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.
Preferred embodiments of the present invention will be explained with reference to the accompanying drawings. In a present embodiment, a simulation program (assertion information) is created to execute processing that satisfies conditions specified by an inspector for conditional branches included in a sequential circuit to be verified and that satisfies a timing specification. Execution of the simulation program enables determination of whether processing that satisfies the condition specified by a verification scenario is performed and further enables prevention of a bug caused by an omission at verification.
Specifically, the sequence or the hierarchy of processes indicated by the description may be altered to minimize the number of clocks or to adjust delays. For example, in the correct description 210, if the condition A is a determination of addition for which the processing load is light and the condition B is a determination of multiplication for which the processing load is heavy, the designer may attempt to shorten the critical path in the entire description by executing first the condition B for which the processing load is heavy. The processing load herein indicates the number of clocks required to complete processing. For example, if the condition A is “1”, it takes two clocks, and if the condition A is “0”, it takes one clock. If the condition B is “1”, it takes four clocks, and if the condition B is “0”, it takes three clocks. As described, in the processing of a heavy load, the greater the number of clocks required, more time is required to complete the determination processing.
Therefore, in the example depicted in
As in the incorrect description 220, when the description sequence of the condition A and the condition B is switched to perform first the condition B whose processing load is heavy, it can be misunderstood that such a branch of “condition A=condition B=1” (both the conditions A and B are satisfied) cannot occur. This is because no such branch of “condition A=condition B=1” occurs in the correct description 210.
However, when the description is changed to the incorrect description 220, if the pattern in which the condition A and the condition B are both satisfied at the same time is not verified, verification for an error in condition determination is omitted. Therefore, in the present embodiment, the inspector arranges to extract a combination of conditional branches in which the condition A and the condition B are both satisfied at the same time at step S110 explained in
Assertion information in which the condition A and the condition B extracted at step S110 are both satisfied at the same time, that is, a simulation program in which the condition A and the condition B are satisfied at the same time is created. Creation of the simulation program herein is achieved by creating a cover statement being condition A=Yes and condition B=Yes, for example. Furthermore, in the present embodiment, because the subject of verification is a sequential circuit, it is essential to satisfy the timing specification 102. Therefore, when the assertion information is created, such a cover statement is created in which both the condition A and the condition B are satisfied and the timing specification 102 is also satisfied.
Other than the cover statement described above, provided the description achieves a simulation in which the condition A and the condition B are satisfied at the same time, a program language to be used is not particularly limited. Therefore, the program language can be selected appropriately with respect to the hardware description or the design environment. By executing the cover statement thus created, the conditional branch specified by the inspector is achieved in the hardware to be verified.
Therefore, based on whether the specified conditional branch is satisfied as a result of executing this assertion information, it is possible to determine whether verification for the conditional branch (conditional branch in which the condition A and the condition B are satisfied at the same time in this example) specified by the inspector has been performed. If the verification for the conditional branch specified by the inspector has not been performed, by performing the verification for the conditional branch for which the verification has been omitted, the verification coverage of truly 100 coverage can be achieved.
The verification support apparatus 100 by which the verification support processing according to the present embodiment with reference to
In the present embodiment, in any kind of hardware description, a case including more than one conditional branch is to be targeted for the creation of the assertion information. If the designer specifies the priority for conditional branches independently, the priority is applied. In addition to the specification of the priority, a part for which instruction is written indicating that plural conditional branches in the hardware description definitely cannot be satisfied at the same time is also excluded from the target.
The CPU 401 governs overall control of the verification support apparatus 100. The ROM 402 stores therein various programs such as a boot program and a verification support program. The RAM 403 is used as a work area of the CPU 401. The magnetic disk drive 404, under the control of the CPU 401, controls the reading and writing of data with respect to the magnetic disk 405. The magnetic disk 405 stores therein the data written under control of the magnetic disk drive 404. The ROM 402 may further store therein the assertion information created by the verification support program and a verification program that executes verification simulation using the assertion information and verification scenario. In such a case, verification does not end with the assertion information created by the verification support apparatus 100, the inspector can be provided the actual results of the verification.
The optical disk drive 406, under the control of the CPU 401, controls the reading and writing of data with respect to the optical disk 407. The optical disk 407 stores therein the data written under control of the optical disk drive 406, the data being read by a computer.
The communication I/F 408 is connected to a network 411 such as a local area network (LAN), a wide area network (WAN), and the Internet through a communication line and is connected to other apparatuses through this network 411. The communication I/F 408 administers an internal interface with the network 411 and controls the input/output of data from/to external apparatuses. For example, a modem or a LAN adaptor may be employed as the communication I/F 408.
The input device 409 receives input from an external source to the verification supporting apparatus 420. The input device 409 can specifically be a keyboard, a mouse, etc.
In the case of the keyboard, the keyboard includes, for example, keys for inputting letters, numerals, and various instructions and performs the input of data. The input device 409 may be a touch-panel-type input pad or numeric keypad, etc. In the case of a mouse, the input device 409, for example, performs the movement of the cursor, selection of a region, or movement and size change of windows. The input device 409 may be a track ball or a joy stick provided each respectively has a function similar to a pointing device.
The output device 410 outputs verification scenarios created by the verification supporting apparatus 400 and verification results obtained using the verification scenarios. Specific examples of the output device 410 include a display, a printer, etc.
In the case of a display, the output device 410 displays, for example, data such as texts, images, functional information, etc., in addition to a cursor, icons, or tool boxes. A cathode ray tube (CRT), a thin-film-transistor (TFT) liquid crystal display, a plasma display, etc., may be employed as the display. In the case of a printer, the output device 410, for example, prints image data and text data. A laser printer or an ink jet printer may be employed as the printer.
The receiving unit 501 receives hardware description of a sequential circuit to be verified and the timing specification 102 that indicates the timing constraints of the hardware description. Accordingly, in this example, the RTL description 101 described in
The converting unit 502 converts the hardware description 101 received by the receiving unit 101 into a CFG that expresses the flow of control of the sequential circuit to be verified. The CFG obtained by the conversion performed by the converting unit 502 is stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407. Through the CFG obtained by the converting unit 502, combinations of conditional branch descriptions in hierarchy can be identified easily.
When the hardware description is converted into a CFG by the converting unit 502, the identifying unit 503 identifies, from the CFG, conditional branch descriptions that are connected in parallel as a combination of conditional branch descriptions in hierarchy. Conditional branch descriptions in hierarchy are, for example, the combination of the condition A and the condition B described at a lower level in the correct description 210 depicted in
Moreover, when the receiving unit 501 receives priority information that indicates execution priority relative to other conditional branches for conditional branches included in the hardware description 101, the identifying unit 503 may identify a combination of conditional branch descriptions in hierarchy based on the priority information. The priority information is information indicating a hierarchical relation of conditional branches, and for example, when the condition A is described at a higher level than the condition B, it is set as “condition A>condition B”. When the priority information indicating “condition A>condition B” is received, the identifying unit 503 may output the combination, identifying the hierarchical relation of the condition A and the condition B. Any combination identified by any method is stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407.
The combination extracting unit 504, from among the combinations of conditional branch descriptions identified by the identifying unit 503, extracts a combination having a potential to satisfy a condition specified. In this example, the condition specified by the inspector requires all conditional branches to be effective, and therefore, the combination having a possibility that all conditions are “1” (Yes) is extracted from among the combinations of conditional branch descriptions that are identified by the identifying unit 503. The extracted combination is stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407.
The creating unit 505 creates a simulation program in which the conditional branch description extracted by the combination extracting unit 504 satisfies the specified condition at the timing satisfying the timing specification received by the receiving unit 501. Because the condition that all conditional branches are effective is specified as described above, a simulation program is created by which results of determination of the conditions included in the extracted combination are all “1 (Yes)” within a clock condition specified in the timing specification. The simulation program created herein may be of any computer program provided the condition above is satisfied. The created simulation program is stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407.
The output unit 506 outputs the simulation program created for each combination by the creating unit 505, as the assertion information 104 of the sequential circuit to be verified. In other words, with each extracted combination, a simulation program in which conditions in the combination are satisfied at the same time is associated. The form of output includes display on a display device, print out by a printer, and transmission to an external device through the communication I/F 408. Further, output may be to a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407.
The functional units 501 to 506 explained above are the minimum components required to achieve the verification support processing according to the present embodiment. In the verification support apparatus 100, the deleting unit 507 is provided as a function to speed up the assertion creation processing described above.
The deleting unit 507 deletes a combination of conditional branch descriptions from among the combinations of conditional branch descriptions identified by the identifying unit 503, the combination being designated in advance. Therefore, the combinations of conditional branch descriptions after deletion are output from the deleting unit 507 and are stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407. When the deleting unit 507 is used, the combinations remaining after the deletion of by the deleting unit 507 are input to the combination extracting unit 504 and the combination extracting unit 504 extracts a combination having the potential of satisfying the specified condition. As described, by providing the deleting unit 507, the number of combinations subject to extraction by the combination extracting unit 504 can be reduced. Accordingly, the processing load on the combination extracting unit 504 can be reduced.
The verification support apparatus 100 creates the assertion information 104 by the functional units 501 to 507 explained above, to check whether verification of a conditional branch that has a possibility of being omitted from verification in the conventional verification technique has been performed. Verification of a sequential circuit can be performed by the conventional verification apparatus using this assertion information 104, or verification using the assertion information 104 can be performed by further providing to the verification support apparatus 100, a function to perform the verification. Therefore, in the following description, a series of the processing when both the functional unit achieving up to the creation of the assertion information explained in
First, processing performed by the assertion creation processing unit 610 is explained. The assertion creation processing unit 610 performs roughly two types of processing including processing to extract conditional branches (step S611) and processing to create the assertion information (step S612).
First, the processing to extract conditional branches performed by the assertion creation processing unit 610 explained in
The conversion into a CFG is explained herein.
Reference of the explanation returns to
Next, the processing to create the assertion information by the assertion creation processing unit 610 explained in
Waiting occurs until the conditional branch information 601 is input (step S901: NO), and when the conditional branch information 601 is input (step S901: YES), a combination having a possibility that conditional branches are effective at the same time is extracted from among the combinations included in the input conditional branch information 601 (step S902). Accordingly, because in the combination of A and D, A=No and the conditions in this combination are not satisfied at the same time, the combination of A and D is deleted.
A cover statement that satisfies the clock condition (complete output within five clocks) and the respective conditions at the same time (condition A=condition B=1) is then created from the combination extracted at step S902 and the timing specification 102 (step S903), and finally, information concerning the combination and the cover statement is output as the assertion information 104 (step S904), and a series of the assertion information creation processing ends. For example, if the sequential circuit to be verified is the description of the CFG 800, the assertion information 104 is created for the combinations of A and B, A and C, A and B and E, and B and E.
Next, the extraction of the conditional branches using the CFG at step S703 in
Specifically, in the list structure 1010, the jump address when a result of determination of the conditional expression is true or false is referenced and the branch names B, C, and D are extracted as conditional branch descriptions positioned at a level below the conditional branch of the branch name A. Similarly, in the list structure 1011, the branch name E is extracted as a conditional branch description positioned at a level below the branch name B. Although extraction of a conditional branch description positioned at a level below the branch names C, D, and E is attempted in the list structures 1012, 1013, and 1014, because the jump addresses thereof in the case of true or false are set to END, it is determined that a conditional branch description positioned at a level below the branch names C, D, and E is not present.
Moreover, with respect to the combinations extracted as a combination having the hierarchical relation as described above, determination whether the combinations have a hierarchical relation is further made. In this example, as depicted in
Furthermore, by adding extended processing to the verification support apparatus 100 described above, the processing load can be reduced. Extended processing of the verification support apparatus 100 may be processing to delete, from among combinations of conditional branches, a combination of conditional branches that definitely cannot be effective at the same time.
If a deletion condition is not received at step S1401 (step S1401: NO), it is determined that the extended processing is not to be applied, and the process proceeds to step S612. The combinations of conditional branches remaining after the deletion processing at step S1402 are output as the conditional branch information 601 (step S1403), and the process proceeds to step S612.
As described, by adding the extended processing prior to the processing of creation of the assertion information 104, combinations for which conditions cannot be effective at the same time are deleted. Therefore, a combination having a possibility that the conditions can be effective at the same time can be identified more efficiently.
Next, the verification processing unit 620 that performs verification of a circuit to be verified using the assertion information 104 created by the assertion creation processing unit 610 is explained. As depicted in
It is determined whether the cover statement description 602 is applicable from a result of the verification at step S621 (step S622). When the cover statement description 602 is determined to be applicable (step S622: YES), it is determined that operation as indicated by the expected value 604 has been performed inclusive of a part at which multiple conditional branches are effective at the same time (step S623). Such determination means the state in which all required verification scenarios 603 are included.
On the other hand, when the cover statement description 602 is determined to be inapplicable (step S622: NO), it is determined that although operation as indicated by the expected value 604 is performed, a part at which multiple conditional branches are effective at the same time has not been verified (step S624). This means that the verification scenario 603 is not sufficient. Therefore, step S624 indicates that there is an omission in the verification. Thus, the inspector can perform appropriate processing such as an addition of the verification scenario 603 where multiple conditional branches are effective at the same time.
As described, with the verification support apparatus 100 according to the present embodiment, verification omission that has not been resolved even with a verification scenario of 100 coverage in the conventional line coverage or path coverage, can be detected by focusing on a specific condition of conditional branches.
Next, an actual example with specific values is explained. First, a specification is set specifying that data be output within five cycles regardless of the value of the condition A and the condition B.
Input: Condition A=1, Condition B=0 Expected value: Data output within five cycles
Input: Condition A=0, Condition B=1 Expected value: Data output within five cycles
Input: Condition A=0, Condition B=0 Expected value: Data output within five cycles
On the other hand,
However, although the application example is the incorrect application example, the path coverage is 100 in the verification scenario described above, as depicted in a chart 1700. Even with the 100 path coverage, verification of an incorrect application part is not performed, and the bug is overlooked. Therefore, for a circuit for which the designer has changed a conditional branch as the circuit 1701, it is required to create the assertion information 104 and to check whether there is a verification omission.
After a combination of conditional branches in hierarchy is identified from the CFG as explained in
“rose(req)condition B” described in the cover statement 1902 is a service priority list (SPL) description that causes the condition B=1 upon a rise indicating input of a request (req) at the first cycle. Furthermore, “req” described next is a SPL description to maintain the state where the request (req) is input. “reqcondition A” is an SPL description that causes the condition A=1 at the third cycle. As described, by using assertion grammar, the assertion information 104, by which the specified condition and the timing specification 102 are satisfied for each combination of conditional branches, may be created.
Although the simulation verification at step S621 is the same processing as the simulation verification explained in
As described, according to the present embodiment, assertion information to check whether a conditional branch specified by an inspector is created. Specifically, a combination of conditional branches in hierarchy is extracted from an input RTL description, and a simulation program to satisfy conditions that are specified by the extracted combination is created. Whether verification has been performed can be determined based on whether the conditions are satisfied in this simulation program. As a result, verification of a conditional branch that has been omitted in the conventional verification coverage can also be covered, and the verification accuracy for hardware design can be improved.
While the verification support apparatus 100 has such a configuration that the function of creating the assertion information and the function of performing the simulation verification using the created assertion information are both provided, the verification support apparatus 100 may be a device only having the function of creating the assertion information. The assertion information created by the verification support apparatus 100 may be applied for any use by other verification apparatuses.
The verification support method explained in the present embodiment can be implemented by a computer, such as a personal computer and a workstation, executing a program that is prepared in advance. The program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, and a DVD, and is executed by being read out from the recording medium by a computer. The program can be distributed through a network such as the Internet.
The verification support apparatus 100 described in the present embodiment can be realized by an application specific integrated circuit (ASIC) such as a standard cell or a structured ASIC, or a programmable logic device (PLD) such as a field-programmable gate array (FPGA). Specifically, for example, functional units (the receiving unit 501 to the deleting unit 507) of the verification support apparatus 100 are defined in hardware description language (HDL), which is logically synthesized and applied to the ASIC, the PLD, etc., thereby enabling manufacture of the verification support apparatus 100.
According to the embodiment, with respect to a combination of conditional branches included in hardware description of a sequential circuit to be verified, assertion information (simulation program) that realizes specified conditions and that satisfies a timing specification is output. Therefore, if the a condition having a possibility that verification has been omitted is specified and assertion information is output, by executing simulation verification using this assertion information, whether verification of the condition is covered can be checked based on a result of the simulation verification.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiment of the present invention has been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
Number | Date | Country | Kind |
---|---|---|---|
2008-249098 | Sep 2008 | JP | national |
Number | Name | Date | Kind |
---|---|---|---|
5691911 | Gregory et al. | Nov 1997 | A |
6324678 | Dangelo et al. | Nov 2001 | B1 |
6415420 | Cheng et al. | Jul 2002 | B1 |
6421808 | McGeer et al. | Jul 2002 | B1 |
6907599 | Kashai et al. | Jun 2005 | B1 |
7260798 | Gupta et al. | Aug 2007 | B2 |
7509599 | Koelbl et al. | Mar 2009 | B1 |
7769569 | Stern | Aug 2010 | B2 |
20060155521 | Iwashita | Jul 2006 | A1 |
20060190861 | Matsuura | Aug 2006 | A1 |
20070168988 | Eisner et al. | Jul 2007 | A1 |
20070226666 | Ganai et al. | Sep 2007 | A1 |
20090327997 | Gulwani et al. | Dec 2009 | A1 |
20100064266 | Matsuda et al. | Mar 2010 | A1 |
20100251196 | Stern | Sep 2010 | A1 |
20100299656 | Shah et al. | Nov 2010 | A1 |
20100325608 | Radigan | Dec 2010 | A1 |
Number | Date | Country |
---|---|---|
2006-190209 | Jul 2006 | JP |
2006-201980 | Aug 2006 | JP |
Number | Date | Country | |
---|---|---|---|
20100083204 A1 | Apr 2010 | US |