JP6303509B2 - Circuit verification method and circuit verification program - Google Patents

Description

  The present invention relates to digital circuit development support using a hardware description language, and more particularly to a circuit verification method and a circuit verification program for dealing with problems caused by asynchronous signal changes.

  In recent years, in the development of digital circuits such as LSI (Large Scale Integration), SOC (System-On-a-Chip), FPGA (Field Programmable Gate Array), etc., register transfer level (hereinafter referred to as “RTL”). The hardware description language (hereinafter referred to as “HDL”) is generally used. Typical examples of HDL include VHDL (Very high speed integrated circuit HDL) and Verilog-HDL. Hereinafter, a circuit in which RTL HDL is described is simply referred to as “RTL description”. In this specification, an example of RTL description using VHDL is mainly shown, but the scope of application of the present invention is not limited to a specific type of HDL used for RTL description.

  By the way, in the digital circuit as described above, deadlock of a finite state machine (hereinafter referred to as “FSM”) circuit occurs due to the racing between signals at the release timing of the asynchronous reset. There is.

  Hereinafter, the possibility of deadlock occurring is referred to as “deadlock-inducing”. And the deadlock that occurs due to the signal change timing is called “timing-induced deadlock”, and the possibility of timing-induced deadlock is called “timing-induced deadlock” .

  “FSM” refers to a circuit having a finite internal state depending on the state and order of past outputs and inputs, and the output at that time is determined by the internal state. Accordingly, flip-flops (hereinafter referred to as “F / F”) are also included in the FSM as the smallest scale.

  Some front-end EDA tools provided by vendors of EDA (Electronic Design Automation) tools can perform “FSM circuit detection”. In particular, recently, Formal Verification (formal verification, hereinafter referred to as “Formal verification”) is a trend as a method of logical verification. Formal verification enables functional verification without the need for test patterns, and the verification accuracy does not depend on the skill of the designer.

  Some Formal verification tools are capable of static “detection of FSM circuit deadlock”. In such a tool, the static deadlock detection function can avoid the problem that the device does not operate normally due to a state transition unintended by the designer. In addition, there is a formal verification tool that automatically detects "asynchronous reset" and checks the polarity of the reset signal.

  FIG. 12 is a flowchart showing an analysis procedure of the FSM circuit by a general Formal verification tool. As described above, the analysis function of the FSM circuit provided in a general Formal verification tool is roughly divided into two types. One is a “reachability check” that checks whether the FSM circuit can transition to all states in the RTL description. The other is “deadlock” that checks whether it is possible to “logically” exit from that state when the FSM circuit transitions to a certain state, that is, whether it can transition to another state. “Deadlock Check”. Many current formal verification tools have both of the above functions.

  However, as described above, the “deadlock check” only checks whether it is possible to get out of the state “logically”, that is, whether a “logic-induced deadlock” has occurred. Therefore, it is impossible to detect a deadlock due to timing such as the asynchronous reset release timing and the racing of the valid edge of the clock (hereinafter simply referred to as “clock edge”).

  The “logic-induced deadlock state” and “timing-induced deadlock state” will be described in detail.

  FIG. 13A and FIG. 13B show an RTL description example (hereinafter referred to as “design 1”) by VHDL of an FSM circuit in which a “logic-induced deadlock state” occurs.

  Line 68-75 describes the state of STATE3. In the case of the description of the design 1, if the NEXT_STATE signal transits to STATE3, the NEXT_STATE signal cannot get out of the STATE3 state. This is because Line 68-75 does not have a “logical description” that exits from STATE3.

  An RTL description example (hereinafter referred to as “design 2”) that improves this problem is shown in FIGS. 14A and 14B. In this description example, the description of Line 70 is changed. As a result, the NEXT_STATE signal can transition from STATE3 to STATE1, and it seems logically that no deadlock can occur. In fact, a general Formal verification tool can detect deadlock inductivity for design 1, but not for design 2.

  However, design 2 has a deadlock-inducing property due to timing. The reason will be described later. As described above, a general Formal verification tool cannot detect deadlock inductivity due to timing.

  The deadlock caused by timing includes, for example, a deadlock that occurs due to “racing of a reset signal and a clock signal when an asynchronous reset is released”. That is, deadlock may occur due to the timing at which the deadlock asynchronous reset signal due to timing is deasserted and the timing of the active edge of the clock signal is very close.

  The cause of design 2 falling into a deadlock due to timing is the relationship between the asynchronous reset release timing and the state value encoding type in the RTL description. The “state value” is a value that specifies each state of the FSM, and is also called a “state variable”.

  FIG. 15 is a timing chart showing the state transition “expected by RTL description designer” when reset is released asynchronously in the circuit of design 2 (hereinafter referred to as “when asynchronous reset is released”). .

  As is apparent from the description of FIG. 14A, in the design 2, the CURRENT_STATE signal maintains the STATE0 state during the reset period as shown in Line 34 of FIG. 14A. Then, at the timing of the next clock edge (rising edge) after reset is released, the CURRENT_STATE signal transitions to the STATE 1 state as shown in Line 36 in FIG. 14A and Line 44 in FIG. 14B. The above is the circuit behavior expected by the RTL description designer.

  However, in the case of asynchronous reset, the reset assertion / deassertion timing is arbitrary, and the reset is not necessarily released at the timing of FIG.

  FIG. 16 is a timing chart showing the state transition in the circuit of design 2 when the release timing and the clock edge timing are very close when asynchronous reset is released. In the asynchronous reset release timing of FIG. 16, there is a possibility that racing occurs between the reset and the clock.

  As shown in Line 21-25 of FIG. 14A, the CURRENT_STATE signal is composed of a 5-bit one-hot encoding type. That is, the FSM state value defined in the description example of design 2 is 5 bits. For this reason, in the case of the reset release timing as shown in FIG. 16, not all of the F / Fs for 5 bits are simultaneously released from the reset due to the influence of racing. Accordingly, there is a possibility that F / Fs that are reset and F / Fs that are not reset are mixed.

  Specifically, the CURRENT_STATE signal is expected to change from STATE0 (“00001”) to STATE1 (“00010”) at the reset release timing. At this time, the value of CURRENT_STATE [4: 2] among the 5-bit signals constituting the CURRENT_STATE signal is not affected by the racing because the value does not change (it remains “0”). This is because these signals remain '0' regardless of reset release.

  For CURRENT_STATE [1: 0], the value is expected to change after reset release (CURRENT_STATE [1] changes from '0' to '1', CURRENT_STATE [0] changes from '1' to '0') . However, for CURRENT_STATE [1: 0], the value after reset is not determined due to racing. In other words, it may not be the expected value.

  However, it is possible to infer candidates for values that can be taken by each bit of the CURRENT_STATE signal after reset release.

  FIG. 17 is a timing chart in which values that can be taken by the CURRENT_STATE signal when racing occurs, that is, state values and states after transition corresponding to the state values are added to the contents of FIG.

  As described above, the CURRENT_STATE signal is affected by racing in two bits, bit1 and bit0. Accordingly, it can be estimated that there are four possible state values of the CURRENT_STATE signal at the reset release timing: a) “00001”, b) “00010”, c) “00000”, and d) “00011”.

  With reference to FIG. 17, the state transition timing and the state after the transition are verified in the case where the CURRENT_STATE signal takes each of these four state values.

  As a result, the behavior of the circuit of design 2 when the reset is released is as follows depending on the value of the CURRENT_STATE signal.

  a): Reset is released at the next clock edge of the timing.

  b): Reset is released at this timing.

  c), d): Transition to another state (state not defined by the designer).

  Thus, if the CURRENT_STATE signal takes the values of a) and b), deadlock does not occur.

  The case where the CURRENT_STATE signal takes the value of c) or d) will be examined in more detail.

  Both the values c) and d) do not exist in the encoding list defined by Line 21-25 on the RTL description in FIG. 14A. That is, when the CURRENT_STATE signal takes the values of c) and d), the designer does not define the state.

  However, even if the designer of this RTL description takes the value of c) or d), the designer of the RTL description expects to jump to the others statement of Line 84 in the process statement starting from Line 41. That is, when the CURRENT_STATE signal becomes an undefined value, the designer creates the RTL description so that the CURRENT_STATE transitions to STATE0. In fact, when design 2 is verified with a general logic simulator, it jumps to the others statement as expected, so it does not fall into a deadlock.

  However, when a logic synthesis tool is used to implement an RTL description circuit of design 2 on an actual device, prevention of deadlock by the others statement may not work effectively. The reason will be described below.

  The logic synthesis tool converts the RTL description into a gate level netlist. At that time, in the default setting of a general logic synthesis tool, the other sentence of the RTL description recognized as the FSM circuit is not logically synthesized but is deleted. This is because the circuit scale becomes very large if the other sentence function of the FSM circuit is implemented. As described above, in the default setting, the function of others statement is not implemented in the device.

  Therefore, in order to care for the function described in the others statement, it is necessary to insert an attribute description in the RTL description on the designer side, or to enable the option to care for the others statement on the logic synthesis tool. is there.

  If the designer neglects this measure, as described with reference to FIG. 17, when the CURRENT_STATE signal takes the values of c) and d), the CURRENT_STATE signal becomes undefined on the actual device. Therefore, the FSM circuit may fall into a deadlock.

  Various techniques for verifying problems caused by asynchronous signals and detecting deadlocks in state machines have been released.

  For example, in order to avoid a failure caused by an asynchronous circuit, there is a technique for generating an operation characteristic of the asynchronous circuit in a simulation (for example, Patent Document 1). In the asynchronous circuit verification method of Patent Document 1, a delay is caused in a circuit that performs an asynchronous operation at a simulation stage, and a fault caused by the asynchronous circuit is generated. Thereby, the operation verification of the asynchronous circuit can be performed with high accuracy.

  There is also a logic circuit design apparatus that improves the efficiency of formal verification related to a state machine (for example, Patent Document 2). The apparatus of Patent Document 2 reduces the number of states of the state machine, and improves the efficiency of deadlock verification by formal verification.

  Alternatively, there is a circuit design verification method that detects a deadlock of a state machine and improves circuit quality (for example, Patent Document 3). In the verification method of Patent Document 3, it is determined whether or not there is a possibility of transition to a non-transition state, and deadlock is detected.

Japanese Patent Laying-Open No. 2005-284426 (page 8-9, FIG. 1) JP 2008-304960 A (page 5-6, FIG. 2-3) JP 2011-134242 A (page 4-5, FIG. 2)

  The technique of Patent Documents 1-3 has a problem that it is impossible to detect a description having a deadlock-inducing property due to timing from the RTL description to be verified.

  In the asynchronous circuit verification method of Patent Document 1, a failure caused by the asynchronous circuit is generated in the simulation of the target circuit. That is, the asynchronous circuit cannot be verified without simulation. In general, in order to improve the development efficiency, it is desirable to reduce the number of backward steps as much as possible, and it is desirable to verify the circuit at the upstream stage of development as much as possible. However, the method of Patent Document 1 has a problem that it cannot cope with verification at the RTL description stage.

  In the logic circuit design apparatus of Patent Document 2 and the verification method of Patent Document 3, verification without the concept of time is performed. However, as described above, the RTL description may include a description that is logically correct and causes a deadlock with respect to an asynchronous signal even if a problem does not occur in the synchronous circuit. Therefore, the techniques of Patent Documents 2 and 3 cannot verify the occurrence of timing-induced deadlock.

  As described above, in the technique of Patent Documents 1-3, it is impossible to detect a description having a deadlock-inducing property due to timing from the RTL description to be verified.

  If it is not possible to automatically detect from the RTL description the description of the FSM that would cause deadlock due to timing, the designer himself may find this problem from the behavior of the mounted device. . However, this method requires a very long development TAT (Turn Around Time), and the development cost is also increased.

  For this reason, there is a case where the RTL coding style is made a manual, and the designer uses a design technique to design a circuit according to the manual. However, even with this method, there is a problem that the countermeasures for avoiding the deadlock inducement depend on the skill of the designer and the coding quality varies.

Therefore, originally, it is desirable that a description having a deadlock-inducing property due to timing can be found from the RTL description using a verification tool, but the technique of Patent Documents 1-3 cannot cope with such a request.
(Object of invention)
The present invention has been made in view of the above technical problems, and provides a circuit verification method and a circuit verification program capable of detecting an FSM description having a deadlock-inducing property caused by timing from an RTL description. The purpose is to do.

According to the circuit verification method of the present invention, a computer that verifies a verification target description in which a circuit is described using a register-transfer level hardware description language detects a state machine from the verification target description, and detects a plurality of state machines. Detects an asynchronous transition state with a transition condition defined using an asynchronous signal that changes asynchronously with the clock that synchronizes the operation of the circuit from the state, and is asynchronous with the valid edge of the first clock after the asynchronous signal changes Depending on the timing of the signal change, it is determined whether there is a possibility of transition from an asynchronous transition state to an undefined undefined state transition. It is judged that there is a possibility of generating.

  A circuit verification program according to the present invention includes a computer for verifying a verification target description in which a circuit is described using a register-transfer level hardware description language, means for detecting a state machine from the verification target description, A means for detecting an asynchronous transition state in which a transition condition is defined using an asynchronous signal that changes asynchronously with respect to a clock that synchronizes the operation of the circuit from a plurality of states, and a first clock after the change of the asynchronous signal Depending on the valid edge and the timing of the asynchronous signal change, a means to determine the possibility of transition from an asynchronous transition state to an undefined undefined state transition, and verification when it is determined The object description is characterized by functioning as means for determining that there is a possibility of causing a deadlock.

  The circuit verification method and the circuit verification program according to the present invention have an effect that it is possible to detect an FSM description that induces deadlock caused by timing from the RTL description.

It is a flowchart which shows the process sequence of the circuit verification method of this invention. It is a flowchart which shows the analysis procedure of the FSM circuit by the Formal verification tool to which the circuit verification function of this invention was added. It is the first half of the flowchart which shows the example of the detailed algorithm of the process sequence of the circuit verification method of this embodiment. It is the latter half part of the flowchart which shows the example of the detailed algorithm of the process sequence of the circuit verification method of this embodiment. It is a block diagram which shows the structural example of an FSM circuit with an asynchronous reset input. It is a block diagram which shows the structural example of a FSM circuit with the synchronized reset input. It is an RTL description example of FSM in which an encoding type attribute declaration is described. It is an encoding design example for showing the logic expansion | deployment which judges the presence or absence of deadlock inductivity in the circuit verification method of this invention. It is a flowchart which shows the procedure which judges the presence or absence of deadlock inductivity in the case of the 1st encoding design in the circuit verification method of this invention. It is a flowchart which shows the procedure which judges the presence or absence of deadlock inductivity in the case of the 2nd encoding design in the circuit verification method of this invention. It is an RSM description example of FSM in which attribute definitions are described in addition to encoding type attribute declarations. 6 is a first half of a flowchart showing a procedure for determining whether or not there is a state transition at the first clock edge after reset release in the circuit verification method of the present invention. 6 is a second half of a flowchart showing a procedure for determining whether or not there is a state transition at the first clock edge after reset release in the circuit verification method of the present invention. 14A is the first half of a first RTL description example (design 3) in which a conditional expression for transitioning to a reset release state is added to the RTL description of the FSM circuit of FIGS. 14A and 14B (design 2). This is the middle part of design 3. This is the second half of Design 3. This is the first half of a second RTL description example (design 4) in which a conditional expression for transitioning to the reset release state is added to the RTL description of the FSM circuit of design 2. This is the middle part of design 4. This is the second half of Design 4. It is a flowchart which shows the analysis procedure of the FSM circuit by a general Formal verification tool. This is the first half of an RTL description example (design 1) of an FSM circuit in which a logic-induced deadlock state occurs. This is the second half of Design 1. This is the first half of an RTL description example (design 2) of an FSM circuit in which a deadlock state due to timing may occur. This is the second half of Design 2. It is a timing chart which shows the state transition expected at the time of asynchronous reset cancellation. It is a timing chart which shows the state transition at the time of the racing by asynchronous reset cancellation. It is a timing chart which shows the state value which can be taken after transition, and the state after transition corresponding to the state value at the time of racing by asynchronous reset cancellation.

  Embodiments of the present invention will be described in detail. FIG. 1 is a flowchart showing a processing procedure of the circuit verification method of the present invention.

  In the processing procedure of the circuit verification method of the present invention, first, a state machine is detected from a verification target description in which a circuit is described using a register-transfer level hardware description language (step S1).

  Next, an asynchronous transition state in which a transition condition is defined is detected from a plurality of states of the state machine using an asynchronous signal that changes asynchronously with respect to a clock that synchronizes the operation of the circuit (step S2).

  And whether there is a possibility of transition from the asynchronous transition state to an undefined undefined state transition depending on the first valid edge of the clock after the asynchronous signal change and the timing of the asynchronous signal change. Is determined (step S3).

  Finally, when it is determined that there is the possibility, it is determined that there is a possibility of causing a deadlock in the verification target description (step S4).

  FIG. 2 is a flowchart showing an analysis procedure when the circuit verification procedure of the present invention is added to the Formal verification tool of FIG.

  In the circuit verification method of this embodiment, “racing dead” using the circuit verification method of the present invention is used for “reachability check” and “deadlock check” which are functions of the general formal verification tool of FIG. "Racing Deadlock Check" has been added. In the racing deadlock check, the source file of the RTL description is used as input information, and the possibility of deadlock due to racing at the time of asynchronous reset cancellation, that is, an FSM circuit that induces deadlock is detected.

The outline of the processing procedure of the racing deadlock check is as follows.
1) The description of the FSM circuit with asynchronous reset is detected from the RTL description.

This process can be realized by the function of a general Formal verification tool.
2) Grasp the state transition before and after reset release in 1).
3) Estimate how the state transition of 2) changes in racing when reset is released.
4) It is checked whether all the state transitions estimated in 3) are described in the conditional branch of the RTL description.
5) When a state transition not described in the conditional branch is found, it is determined that the target RTL description is inducible in deadlock.

  In the present invention, an algorithm of a formal verification tool necessary for designing these programs is provided.

3A and 3B are flowcharts showing examples of detailed algorithms of the processing procedure of the circuit verification method of the present embodiment. Specifically, FIGS. 3A and 3B show an algorithm for verifying whether there is an FSM circuit in which deadlock occurs due to racing when the asynchronous reset is released in the RTL description to be verified. Hereinafter, a processing procedure of the circuit verification method of the present embodiment will be described.
(Step S01)
First, an FSM circuit is detected from the RTL description.
(Step S02)
Check whether the detected FSM circuit is using asynchronous reset. The specific check method of this process differs depending on the language used for the RTL description to be processed.

The case of VHDL and Verilog-HDL, which are typical RTL description languages, is as follows.
a) In the case of VHDL It is checked that the following (1) to (3) are all satisfied.

(I) Multiple signals are defined in the argument of the process statement (ii) The event statement does not come to the if statement immediately after the process declaration (iii) The event statement is declared in the elsif statement after (ii) B) Verilog-HDL Check that the following holds.

(I) A plurality of signals are defined in the argument of the always statement. However, in both cases a) and b), in the process of step S2, the clock, reset back, It is necessary to perform a trace and confirm that the reset is not synchronized with the clock.

  For example, when the FSM circuit 101 configured as shown in FIG. 4 is defined by the RTL description of design 2 in FIGS. 14A and 14B, the clock and reset input to the FSM circuit 101 are external inputs as they are. . For this reason, it may be considered that the reset release timing is not synchronized with the clock. Therefore, the FSM circuit 101 is once a candidate for verification.

  However, as shown in FIG. 5, when the synchronizer 102 is provided outside the FSM circuit 101 of FIG. 4, the reset input to the FSM circuit 101 is a signal output from the synchronizer 102 in the higher hierarchy. The synchronizer 102 has a function of synchronizing the asynchronous reset release timing with the clock (S02: No). Therefore, when such a circuit is added, racing does not occur at the asynchronous reset release timing, and the FSM circuit 101 does not fall into a deadlock. Therefore, in this case, the FSM circuit 101 is excluded from subsequent verification targets.

Naturally, when the circuit for synchronizing the reset is not added (S02: Yes), the FSM circuit 101 is a target of the subsequent verification processing.
(Step S03)
Check if the state transition occurs at the first clock edge after reset release. Specifically, the check is performed according to the procedure shown in FIGS. 9A and 9B. Detailed description will be given later.
(Step S04)
It is checked whether each state of the FSM circuit is described using an enumerated type state variable or a constant type state variable. Hereinafter, an FSM in which each state is described using an enumerated state value is referred to as “enumerated type FSM”, and an FSM in which each state is described using a constant type state value is referred to as “constant type FSM”.

The following processing differs depending on whether the FSM included in the RTL description is an enumerated type FSM or a constant type FSM. Hereinafter, a verification method will be described for each type of FSM. If the target FSM is an enumeration type FSM, the process proceeds to step S11 in FIG. 3A. If the target FSM circuit is a constant type FSM, the process proceeds to step S21 of the “constant type FSM processing” shown in FIG. 3B. The constant type FSM processing will be described later.
(1) In the case of enumeration type FSM (step S11)
When the FSM is an enumerated type FSM, it is checked whether or not the encoding type is declared as an attribute of the state value on the RTL. Specifically, the presence or absence of attribute description on RTL is confirmed.

  If there is no such description (S11: No), the encoding type attribute with which the state value is used depends on the logic synthesis tool, so that “the FSM circuit is deadlock-inducing”. It is judged.

In the case of the RTL description example of FIG. 6, “one-hot” is declared as an encoding type in Line 27. As described above, when the encode type is declared as the attribute of the state value on the RTL (S11: Yes), it is not determined that the FSM circuit is deadlock-inducing at this point.
(Step S12)
The contents of the attribute description in step S11 are checked.
a) When “gray” (gray code) is declared as the encoding type In this case, it is determined that “the FSM circuit is not deadlock-inducing”.

The reason why such a determination can be made is shown in FIGS. 7A, 7B, and 7C. Since the detailed description is shown in the figure, the description is omitted here. In conclusion, if the state value is a Gray code, only one bit of the state value is affected by racing. Therefore, in this case, no deadlock occurs.
b) When “safe” (Safe State Machine) is declared In this case, the description of the other / default statement of the FSM circuit is implemented in the circuit at the time of logic synthesis. It is judged that there is no.
c) When an encoding type other than “gray” or “safe” is declared If an encoding type other than “gray” or “safe” is declared with attribute, deadlock may occur. . For example, in the case of the RTL description in FIG. 6, the encoding type is declared as “one-hot” and is the same encoding type as in FIGS. 14A and 14B (design 2). It is judged that there is a lock-inducing property.
(2) In the case of a constant type FSM circuit (step S21)
If it is determined in S04 of FIG. 3A that the FSM is a constant type FSM, it is first checked whether the encoding type is declared on the RTL as an attribute.

  Originally, attribute is not necessary when encoding (bit assignment) is declared in a constant type. Nevertheless, as shown in FIG. 8, when an attribute definition is intentionally written (S21: Yes), depending on the logic synthesis tool, the constant type encoding description may be ignored and the attribute given priority.

Therefore, in this case, it is determined that there is a possibility of deadlock regardless of the encoding type, and it is determined that “the FSM circuit has a deadlock inducing property”.
(Step S22)
The exclusive OR of each bit of the state value during the reset period and the state value after the reset is released is calculated. In the case of the RTL description of FIGS. 14A and 14B (design 2),
During reset: STATE0 (“00001”)
After reset release: STATE1 (“00010”)
Therefore, the exclusive OR (EXOR_VALUE) for each bit of STATE0 and STATE1 is
EXOR_VALUE = “00011”
It becomes.
(Step S23)
For each bit of EXOR_VALUE, count the total number of bits with '1' standing. For design 2, the total number of bits with '1' (HIGH_BIT_COUNT) is
HIGH_BIT_COUNT = 2
(Because '1' stands for bit0 and bit1 of EXOR_VALUE).
(Step S24)
Check if HIGH_BIT_COUNT is 2 or more.

  If HIGH_BIT_COUNT is 1 or less (S24: No), it is determined that “the FSM circuit is not deadlock-inducing”.

  The reason is shown in FIG. 7C. Similar to the description of FIG. 7B in the process of S12, as a conclusion, when one bit is affected by racing, no deadlock occurs.

If HIGH_BIT_COUNT is 2 or more (S24: Yes), it is not determined at this point that the FSM circuit is not deadlock-inducing.
(Step S25)
Estimate the value of EXOR_VALUE when it can take both values of “0” and “1” for the bit with “1” set in EXOR_VALUE, and store it in the memory. In the case of the RTL description in FIGS. 14A and 14B (design 2), EXOR_VALUE can take the following four values, and these are stored in the memory area (ARRAY_EXOR_VALUE).

EXOR_VALUE = “00001”
“00010”
“00000”
“00011”
(Step S26)
Extract EXOR_VALUE from memory area ARRAY_EXOR_VALUE in order. The extracted value is tmp_EXOR_VALUE.
(Step S27)
It is checked whether the tmp_EXOR_VALUE value is described in the conditional branch of the case statement in the FSM circuit on the RTL description.

As described above, when the tmp_EXOR_VALUE value is not described in the conditional branch of the case statement in the FSM circuit on the RTL description (S27: Yes), it is determined that “the FSM circuit has deadlock inducing property”. The When the tmp_EXOR_VALUE value is described in the conditional branch of the case statement in the FSM circuit on the RTL description (S27: No), the process proceeds to the next process.
(Step S28)
It is checked whether or not the tmp_EXOR_VALUE value to be inspected in S27 is the last data extracted from ARRAY_EXOR_VALUE.

  That the tmp_EXOR_VALUE value to be inspected is the last data extracted from ARRAY_EXOR_VALUE (S28: Yes) means that all tmp_EXOR_VALUE values stored in S25 are described in the conditional branch in the RTL description. . In this case, since there is no possibility that the state changes to the others statement or the default statement, it is determined that “the FSM circuit is not deadlock-inducing”.

  When the tmp_EXOR_VALUE value to be inspected is not the last data extracted from ARRAY_EXOR_VALUE (S28: No), the process returns to S27.

  As described above, in S27 and S28, all tmp_EXOR_VALUE values are described in the conditional branch of the case statement in the FSM circuit, or there are tmp_EXOR_VALUE values not described in the conditional branch of the case statement in the FSM circuit. This is a process of checking whether or not.

If at least one tmp_EXOR_VALUE value stored in S25 is not described in the conditional branch in the RTL description (S27: Yes), it is determined that “the FSM circuit has deadlock inductiveness”. In the case of FIG. 14B (design 2), the processing of S27 and S28 when the above four values of EXOR_VALUE are extracted from the memory area ARRAY_EXOR_VALUE in order from the top are as follows. The line number is a line number in the RTL description of FIGS. 14A and 14B.
1) Read tmp_EXOR_VALUE = “00001” and confirm the description of STATE0 = “00001” in Line 43 (S27: No). 2) Read tmp_EXOR_VALUE = “00010” and confirm the description of STATE1 = “00010” in Line 46 (S27: No).
3) Read tmp_EXOR_VALUE = “00000” At this time, there is no description of STATE1 = “00000” in the RTL description of FIG. 14A and FIG. 14B (S27: Yes). Transition to the definition location.

  Since it has been found that there is a possibility that the state transitions to the definition part of the “others” statement, the fact that “the FSM circuit is deadlock-inducing” is reported, and the process ends.

  FIG. 7C shows the processing contents of S22 to S28 in more detail. Since the detailed description is shown in the figure, the description is omitted here.

  Next, a procedure of “determination of state transition at first clock edge after reset release”, which is the process of S03 of FIG. 3A described above, will be described.

9A and 9B are flowcharts showing an example of the determination procedure. In the following, conditional expressions are added to the RTL description (design 2) in FIGS. 14A and 14B as the RTL description to be processed, and the RTL description in FIG. 10A, FIG. 10B, and FIG. 10C (design 3). ), The processing procedure will be described in order using the RTL description (design 4) in FIGS. 11A, 11B, and 11C.
(1) In case of design 2 (step S31)
It is determined whether or not the RTL description has a conditional expression (hereinafter simply referred to as “conditional expression”) for transitioning to the reset release state after reset release (after generation of a clock edge).

  In design 2, there is no conditional expression in Line 43-44 (S31: No). Therefore, it is determined that the state transitions to STATE1 unconditionally at the first clock edge after the reset is released, and the process ends.

In this case, for the reason described with reference to FIG. 17, it is determined that there is a possibility that “the FSM circuit is deadlock-inducing”, and the process proceeds to S04 in FIG. 3A.
(2) In case of design 3 (step S31)
In the case of design 3, since there is a conditional statement in Line 44 (S31: Yes), the process proceeds to the next process.
(Step S32)
It is determined whether or not the conditional expression includes an F / F output signal.
In the case of design 3, the element of the conditional expression of Line 44 includes the INDATA signal that is the input signal, but does not include the F / F output signal (S32: No).
(Step S36)
Since the INDATA signal is input from the outside, the timing when INDATA = '1' is unknown. Therefore, there is a possibility that INDATA = '1' at the asynchronous reset release timing in terms of algorithm. Therefore, it is determined that there is a possibility that “the FSM circuit has a deadlock-inducing property”. Therefore, the process proceeds to S04 in FIG. 3A.
(3) In case of design 4 (step S31)
In the case of design 4, since there is a conditional statement in Line 44 (S31: Yes), the process proceeds to the next process.
(Step S32)
In the case of design 4, the INDATA signal which is an element of the conditional expression of Line 44 is an input terminal, the cnt signal is an F / F output signal, and the F / F output signal is included in the conditional expression (step S32: Yes).
(Step S33)
It is determined whether or not the conditional expression element is only an F / F output signal.

  In the case of design 4, the conditional expression includes an INDATA signal in addition to the F / F output signal (step S33: No).

When the conditional expression element is only an F / F output signal (step S33: Yes), the process proceeds to step S38 described later.
(Step S34)
When it is assumed that the F / F output signal is false, it is determined whether or not the conditional expression is always false regardless of whether the elements other than the F / F output signal are true or false.

In the case of the design 4, assuming that “cnt =“ 100 ”” in the Line 44 is false, the conditional expression of the Line 44 is always false regardless of the value of the INDATA signal (step S34: Yes).
(Step S37)
Whether the conditional expression is true or false at the asynchronous reset release timing is determined by the logic of the F / F output signal.

  This determination means that in the case of the design 4, the cnt signal depends only on the value taken at the asynchronous reset release timing, does not depend on the INDATA signal, and the true / false of the conditional expression of the Line 44 is determined.

In this case, thereafter, it is verified what value other than the F / F output signal (cnt signal in the case of design 4) can take at the asynchronous reset release timing.
(Step S38)
It is determined whether or not a value at the time of asynchronous reset exists in the generation logic of the F / F output signal.

  In the case of design 4, it is checked whether the F / F of the cnt signal is an F / F with asynchronous reset. This is because it is necessary to confirm whether or not the value at the time of asynchronous reset is fixed.

  If the value is not fixed (step S38: No), the value of the cnt signal at the time of reset release becomes indefinite ('X'). Judge that it may be true. Therefore, it is determined that there is a possibility that “the FSM circuit is deadlock-induced”, and the process proceeds to S04 in FIG. 3A.

However, in the case of design 4, as shown in Line 96, the F / F of the cnt signal is an F / F with asynchronous reset (step S38: Yes), and the process proceeds to the next process.
(Step S39)
It is determined whether or not the value at the time of asynchronous reset of the F / F output signal matches the value of the F / F output signal for the conditional expression to be true.

  In the case of design 4, the reset initial value of the cnt signal is confirmed. As shown in Line 97, the reset value of the cnt signal is “000”. This value does not match “cnt =“ 100 ””, which is a value for the conditional expression of Line 44 to be true (step S39: Yes). That is, since the cnt signal is “000” at the reset release timing, the conditional expression of Line 44 in FIG. 11B is always false at this timing. Therefore, since it can be seen that the state does not change from STATE 0 to STATE 1 at this timing, it is determined that “the FSM circuit is not deadlock-inducing”.

  If the conditional expression of Line 44 of design 4 is described as “INDATA = '1' and cnt =“ 000 ””, the determination result in S39 is false (step S39: No). That is, at the reset release timing, it is determined that the state always changes from STATE0 to STATE1. Therefore, it is determined that there is a possibility that “the FSM circuit is deadlock-induced”, and the process proceeds to S04 in FIG. 3A.

In the above embodiment, the behavior at the time of releasing the asynchronous reset has been described as an example. However, the FSM in which the state transition for the asynchronous signal other than the reset is defined can be similarly processed. That is, the above asynchronous reset cancellation may be replaced with a change in an asynchronous signal.
(Effect of embodiment)
According to the circuit verification method of the present embodiment, a description of an FSM that transitions to an undefined state due to an asynchronous signal change included in an RTL description to be verified is detected.

  Accordingly, when the signal changes asynchronously, for example, a deadlock defect of the FSM circuit due to racing of the asynchronous reset release timing can be detected before the front-end design face and before the RTL simulation.

  Until now, the above problems could only be found at the actual machine evaluation stage or the gate simulation stage, so that the time required for debugging in the subsequent process can be greatly reduced (TAT improvement). There is.

  Further, from the viewpoint of front loading, there is an effect that the quality in the previous process is improved (quality improvement).

  The subject that executes the processes shown in the flowcharts of the present embodiment is not limited. Each processing control may be executed by hardware. Alternatively, a device including a CPU (Central Processing Unit) (not shown) is used as a circuit verification device, and the CPU reads the verification program from a predetermined storage unit (not shown) and executes it to execute processing. Also good.

  The program may be stored in a semiconductor storage device such as a ROM (Read Only Memory), a RAM (Random Access Memory), or a flash memory, or a non-transitory medium such as an optical disk, a magnetic disk, or a magneto-optical disk. .

  The circuit verification method of the present invention can be applied in general development of semiconductor devices for RTL design.

  The verification means using the circuit verification method of the present invention may be implemented in a program of an EDA tool for semiconductor device development, such as a formal verification tool. That is, as shown in FIG. 2, it may be implemented in a form added to a general formal verification tool as shown in FIG. Alternatively, it may be realized as a single EDA tool.

101 Finite state machine (FSM)
102 Synchronizer

Claims (10)

A computer for verifying a verification target description in which a circuit is described using a register-transfer level hardware description language,
Detect the state machine from the verification target description,
Detecting an asynchronous transition state in which a transition condition is defined using an asynchronous signal that changes asynchronously with respect to a clock that synchronizes the operation of the circuit from a plurality of states of the state machine;
Whether there is a possibility of transition from the asynchronous transition state to an undefined undefined state transition is determined depending on the first valid edge of the clock after the asynchronous signal change and the timing of the asynchronous signal change. And
When it is determined that there is the possibility, it is determined that the verification target description may cause a deadlock. The state machine including the asynchronous transition state among the plurality of states, an enumerated state machine in which the state is defined by an enumerated state value, or a constant type state in which the state is defined by a constant state value Classified into machines
Encoding encoded such that other than one bit of the plurality of bits constituting the state value is false as an attribute of the state value of each of the enumerated state machine and the constant state machine The circuit verification method according to claim 1, wherein the possibility is determined based on whether or not a type is specified. When the encoding type is not specified as an attribute of a state value of the enumerated state machine in the verification target description, it is determined that the enumerated state machine has the possibility. Item 3. The circuit verification method according to Item 2. In the verification target description, when the encoding type is specified as an attribute of the state value of the enumerated state machine,
When either safe or gray is specified as an attribute, the enumerated state machine determines that there is no such possibility,
If neither safe or gray is not specified as an attribute, circuit verification method of claim 3 wherein the enumeration state machine is characterized in that it is determined that there is the possibility. In the verification target description, when the encoding type is specified as an attribute of the state value of the constant type state machine, it is determined that the constant type state machine has the possibility. The circuit verification method according to claim 2. When the encoding type is not specified as an attribute of the state value of the constant type state machine,
6. The possibility of the enumeration state machine is determined based on the number of change bits of the state value of the enumeration state machine that change before and after the change of the asynchronous signal. Circuit verification method. When the encoding type is specified as an attribute of the state value of the constant type state machine and the number of change bits is 2 or more,
Based on whether or not all of the virtual state values constructed assuming that each of the plurality of bits of the change bits is true or false are included in the state value of the state machine, The circuit verification method according to claim 6, wherein the possibility is determined. Whether the state of the state machine includes a conditional expression for transition from a state before the change of the asynchronous signal to a state after the change of the asynchronous reset in the verification target description; and
Based on the output state of the flip-flop included in the conditional expression,
The circuit verification method according to claim 1, wherein it is determined whether or not the asynchronous transition state is included in the plurality of states. A computer for verifying a verification target description in which a circuit is described using a register-transfer level hardware description language,
Means for detecting a state machine from the verification object description;
Means for detecting an asynchronous transition state in which a transition condition is defined using an asynchronous signal that changes asynchronously with respect to a clock that synchronizes the operation of the circuit from a plurality of states of the state machine;
Whether there is a possibility of transition from the asynchronous transition state to an undefined undefined state transition is determined depending on the first valid edge of the clock after the asynchronous signal change and the timing of the asynchronous signal change. Means to
A circuit verification program for functioning as means for determining that there is a possibility of causing a deadlock in the verification target description when it is determined that there is the possibility. The circuit verification program according to claim 9 is installed,
A circuit verification apparatus for determining the possibility of the verification target description.

Images