FORMAL VERIFICATION OF ADVANCED SYNTHESIS OPTIMIZATIONS Anant Kumar Jain Pradish Mathews Mike Mahar

MAPLD Formal Verification of Advanced Synthesis Optimizations Agenda  Introduction  Formal Verification Flow  Logic Equivalence Checking  Verification solutions for advanced Synthesis Optimizations  Fault Tolerant Finite State Machine Encoding  TMR Techniques  Mapping of high level components like SRLs and DSPs  Register Retiming  Conclusion

MAPLD Formal Verification of Advanced Synthesis Optimizations Formal Verification Flow RTL Formal Verification Tool FPGA Vendor Place & Route FPGA Synthesis Tool FVI FPGA Library Net list  Formal Verification Interface (FVI) file generated by synthesis tool helps during formal verification  Each constraint in the FVI file is separately verified by the verification tool.

MAPLD Formal Verification of Advanced Synthesis Optimizations I1 I2 I3 I4 Out1 Out2 Out3 Out4 in1 in2 in3 in4 o1 o2 o3 o4 A_reg[3:0]C_reg[3:0]B_reg[3:0] A_reg(3:0)B_reg(3:0)C_reg(3:0) User RTL Synthesized Netlist Match Register State Points Logic Equivalence Checking

MAPLD Formal Verification of Advanced Synthesis Optimizations User RTL in1 in2 in3 in4 o1 o2 o3 o4 A3 A2 A1 A0 E E 4 H G F L K J I Synthesis o/p I1 I2 I3 Out1 Out2 Out3 Out4I4 A3 A2 A1 A0 E E 4 H G F L K J I A3_reg C DQ R S C DQ R S tf[0-9]d Logic Equivalence Checking Formally verify the logic cone of all the matched register pairs

MAPLD Formal Verification of Advanced Synthesis Optimizations FPGA Verification Challenges  Advanced Synthesis Optimizations like:  Fault Tolerant Finite State Machine Encoding  TMR techniques  Mapping of high level components like shift registers (SRL) and DSPs  Register Retiming Register points matching becomes complicated after

MAPLD Formal Verification of Advanced Synthesis Optimizations Finite State Machine (FSM) Next State Function State Vectors State Vectors Output Logic Outputs clkrst Present State Inputs FSM Circuit State Transition Graph

MAPLD Formal Verification of Advanced Synthesis Optimizations FSM Encoding  Common FSM encoding schemes utilized by the synthesis tool for a QofR improvement  1-hot (1-cold) encoding  Grey Encoding  Binary Encoding  Fault Tolerant FSM encoding schemes utilized for safety and mission critical applications  Recovering or Correcting fault with Single Event Upset (SEU)  Re-encoding using extra parity flops

MAPLD Synthesis of Fault Tolerant Circuits for FSMs & RAMs Next State Function State Registers Inputs Outputfunction clkrst PresentState Parity Bits Generator Parity Registers ErrorCorrectionCircuit output Single Event Upset Detection & Correction Fault Tolerant FSM

MAPLD Formal Verification of Advanced Synthesis Optimizations Verification Challenges Register mapping between RTL and synthesis netlist might get distort after FSM encoding in1 in2 A0 A1 4 I1 I2 A0 A1 A2 A3 4 RTL with NO Encoding Synthesis netlist with FSM Encoding Logic Cones Cannot be verified

MAPLD Formal Verification of Advanced Synthesis Optimizations Verification using Encoding FVI  Synthesis tool generates an encoding FVI constraint  The constraint provides the information of the encoding that includes the parity registers as well.  Verification tool creates an encoder-decoder circuit using this constraint to achieve a one-to-one register matching.  Equivalence checking will be done on these matched register pairs

MAPLD Formal Verification of Advanced Synthesis Optimizations Encoder - Decoder Circuit in1 in2 A0 A1 4 I1 I2 A0 A1 A2 A3 4 RTL with Encoder Circuit Synthesis netlist with FSM Encoding Registers matched for Equivalence checking in1 in2 4 ENCODER A0 A1 A2 A3 DECODER Verify that the illegal states found during synthesis are unreachable Encoding FVI

MAPLD Formal Verification of Advanced Synthesis Optimizations TMR Techniques CombLogic Voter Voter Voter  TMR Sequential elements  Triplicate Flops and vote the result out using majority voter circuit TMR

MAPLD Formal Verification of Advanced Synthesis Optimizations TMR Formal Verification  RTL to TMR netlist verification  FVI constraints are generated by synthesis tool for the extra registers.  These constraints provide the match for the extra TMR registers with its equivalent register in the RTL.  Equivalence checking is then used to verify the extra TMR registers and the voter circuit. How to match the extra registers in synthesized netlist ???

MAPLD Formal Verification of Advanced Synthesis Optimizations Verification with Fault Injector Circuit Decoder will ensure the toggling of only one register at a time (SEU) VOTERVOTER Additional Inputs replicating the radiation effect TMR Netlist No Toggling VOTERVOTER

MAPLD Formal Verification of Advanced Synthesis Optimizations TMR Formal Verification  TMR Netlist vs Non-TMR Netlist  Both the netlists are synthesis output with no FVI constraints.  A standard match rule file can be used in matching the extra registers in the TMR netlist with its equivalent register in the Non TMR netlist.  TMR for tech-cells like SRLs, DSPs  Extra tech-cells created during TMR contain registers which have no matching with the RTL registers.  FVI constraints are generated to match these extra registers absorbed in the new tech-cells created.

MAPLD Formal Verification of Advanced Synthesis Optimizations Mapping of High Level FPGA Components clk SRL SynthesisNetlistSynthesisNetlist Formal Verification Tool FVI FPGA Library RTLRTL The RTL definition of a high level component is provided by the FPGA library to the verification tool

MAPLD Formal Verification of Advanced Synthesis Optimizations Verification of High Level Components  The register name is a static information in the FPGA library definition. It is used to generate the FVI constraints for matching the registers absorbed in these components with their equivalent RTL registers  This FVI information gives a huge runtime improvement in the register matching step during formal verification.  This register matching is further complicated if synthesis tool has employed retiming for the inference of these components.

Register Retiming Forward retiming removes the registers at the input of a gate and creates new registers at the outputs. Thus reducing the number of flip flops. 1. Before Retiming 2. After Retiming 3. After Re-synthesis

MAPLD Formal Verification of Advanced Synthesis Optimizations Retiming and Formal Verification  Retiming poses fundamental hurdles for equivalence checking  NO Register mapping exists between RTL and retimed netlist, required for verification  Formally verifying the RTL with the final synthesis output netlist is of enormous complexity  It consists of combinational synthesis, retiming and post retiming synthesis.

Retiming Verification Flow MAPLD Formal Verification of Advanced Synthesis Optimizations  RTL vs Pre-retimed netlist  Only combinational synthesis before retiming.  Standard equivalence checking methods used.  Pre-retimed netlist vs Final synthesis netlist  Retiming and combinational synthesis after retiming.  Constraints for Retiming steps are logged by synthesis tool in the FVI file. Two-step Formal Verification

MAPLD Formal Verification of Advanced Synthesis Optimizations Retiming Verification Flow Input RTL Pre-RetimedNetlist Retiming FVI Constraints Read RTL CombinationalSynthesis Retiming Pre-Retimed Netlist generated CombinationalSynthesis Final Netlist generated Equivalence Check 1 (Only Combinational) Equivalence Check 2 (Retiming + Combinational) Final Netlist Synthesis FlowVerification Flow

MAPLD Formal Verification of Advanced Synthesis Optimizations Retiming Verification Steps 1. FVI constraint gives a hint to the verification tool about the movement of registers in that retiming step. 2. Each retiming FVI constraint will be verified by applying standard retiming rules. 3. These register movements will be applied on the pre- retimed netlist. 4. After applying all the retiming constraints, one-to-one register matching can be done between the modified pre-retimed netlist and the final netlist. 5. Complete equivalence checking will be done on these two netlists.

Some Retiming Verification Criteria …  Verification of Register Initial States  Retiming of flops with multiple fanout  Retiming across sequential loop  Retiming of registers with different enables  State elements count check across all paths MAPLD Formal Verification of Advanced Synthesis Optimizations

Verification of Register Initial States Retiming might change the initial state of the flop (i.e. an async reset flop might result in an async set flop after retiming). Verification tool will compute the initial state of all the new registers created after retiming and will verify the synthesis results

Retiming of flops with multiple fanout lut2 clk o1 MAPLD Formal Verification of Advanced Synthesis Optimizations lut2 o1 o2 clk lut2 o2 o1 Registers must be preserved in the fan-out other than the retiming path

Registers count in the sequential loop must remain same. MAPLD Formal Verification of Advanced Synthesis Optimizations Retiming across sequential loop Backward Retiming across feedback loop

Registers with different enables lut2 ce2 clk ce1 clk o1 MAPLD Formal Verification of Advanced Synthesis Optimizations lut2 ??? o1  Enable must be dissolved with multiplexer feedback loop before retiming  Rules for the sequential loop will be applied

State Elements Count Check  A State elements count check will be done on the original pre-retimed netlist and the final netlist.  The number of the registers in all the paths from any input to any output must remain same for both the netlists.  The number of registers in all the loops in the design must remain same for both the netlists. MAPLD Formal Verification of Advanced Synthesis Optimizations

Conclusion  A good FVI integration between a synthesis tool and a verification tool provides an automated flow for the verification of advanced synthesis optimizations.  FVI information from synthesis tool gives a significant improvement in the runtime during formal verification. MAPLD Formal Verification of Advanced Synthesis Optimizations