Stefan Bauer Clock Domain Crossing Verification Application Engineer FPO – Distribution EMEA
Stefan Bauer
Clock Domain Crossing Verification
Application Engineer
FPO – Distribution EMEA
Restricted © 2017 Mentor Graphics Corporation
0%
10%
20%
30%
40%
50%
60%
LOGIC ORFUNCTIONAL
CLOCKING TUNING ANALOGCIRCUIT
CROSSTALK POWERCONSUMPTION
MIXED-SIGNALINTERFACE
TIMING – PATH TOO SLOW
FIRMWARE TIMING – PATH TOO FAST
OTHER
De
sig
n P
roje
cts
Trends in Types of Flaws Resulting in Respins
2012
2014
2016
Flaws contributing to FPGA rework
Source: Wilson Research Group and Mentor Graphics, 2016 Functional Verification Study
SB, CDC Verification, 20172
Restricted © 2017 Mentor Graphics Corporation
Formal VerificationSolution to isolate and resolve a bug earlier in the design cycle
0%
5%
10%
15%
20%
25%
Formal property checking Automatic formal verification
De
sig
n P
roje
cts
FPGA Static Verification Technique
2012
2014
2016
SB, CDC Verification, 2017
Source: Wilson Research Group and Mentor Graphics, 2016 Functional Verification Study
3
Restricted © 2017 Mentor Graphics Corporation
Today’s Design Characteristics
SB, CDC Verification, 2017
Main Clock Domain
Master IF
Memory
DMA
Master IF
CPU
AMBA AHB/AXI
Master IF
DSP
Arbiter
Slave IF
USBController
USB PHY
Master IF
Ethernet
Ethernet PHY
Master IF
Protocol
PHYs
Bridge
PCI-Express
PCI-E PHY
Slave IF
UART
Bridge
AMBA AHB
Slave IF
GPIO
Slave IF
CustomCore
Front-end
PHY
Master IF
CustomCore
Back-end
Power-Management,Clock, Reset, Test, Analog
Processor cores
DSP cores
Many IP blocks
Sophisticated interconnects
Multiple bus bridges
Advanced power management
Many Asynchronous Clock Domains
4
Restricted © 2017 Mentor Graphics Corporation
Clock Domain Crossing
0%
5%
10%
15%
20%
25%
30%
35%
40%
45%
1 2 3--4 5--10 11--20 21--30 31--50 >50
De
sig
n P
roje
cts
FPGA Number of Independent Clock Domains
2012
2014
2016
SB, CDC Verification, 2017
Source: Wilson Research Group and Mentor Graphics, 2016 Functional Verification Study
5
Restricted © 2017 Mentor Graphics Corporation
So, What’s The Problem With CDC Signals?
SB, CDC Verification, 2017
Logic
A
LogicTx Rx
Clock domain A Clock domain BB
Clock-Domain Crossing signal
To transfer signals from one clock domain to another,you need clock-domain crossing (CDC) logic
You CANNOT avoid violating setup and hold timing conditions in this logic
6
Restricted © 2017 Mentor Graphics Corporation
Metastability Effects
SB, CDC Verification, 2017
Even when synchronizers are used
CDC signals are subject to metastabilitywhen timing violations occur
Possible single-cycle delay effect in silicon vs. simulation
Simulation captures a ‘1’ while silicon produces either a ‘1’ or ‘0’
Possible bleed-through effect in silicon vs. simulation
Simulation captures a ‘0’ while silicon produces either a ‘1’ or ‘0’
7
Restricted © 2017 Mentor Graphics Corporation
Q
Clock A Clock B
i i +1 i +2i -1i i +1 i +2i -1
Tx
Metastability window
Rx
i i +1 i +2i -1 i +3
Synchronizers Confine Metastable Signals
Setup Violation : Transition at input of synchronizer will propagate to output after 2 or 3 active edges of Rx clock in silicon
The tradeoff is that metastability causes the delays
through synchronizers to be unpredictable!
SB, CDC Verification, 20178
Restricted © 2017 Mentor Graphics Corporation
Protocol Violation
CDC protocols defined— Rules that ensure data is accurately transferred between two clock
domains— Associated with specific synchronizer structures
SB, CDC Verification, 2017
Protocol Example:When a transmitter's data select signal crosses a clock domain and drives the mux select input (a) of a data multiplexer in the receiver, it must be held stable long enough for the signal (b, TX Data) to be sampled reliably by the receiver (c, RX Data) and the data must remain stable while the data select signal asserts.
(a) Mux select
(b) TX Data
(c) RX Data
9
Restricted © 2017 Mentor Graphics Corporation
Reconvergence Problems
SB, CDC Verification, 2017
Timing relationships between signals look OK in simulation…
but may be skewed in silicon
If the logic in domain B depends on such timing relationships, it will lead to a functional bug
Tx1 Rx1
Tx2 Rx2
Logic
in clock
domain A
Logic
in clock
domain B
Logic in clock domain C
Setup violation
Tx1
clk_B
Tx2
Rx1
Rx1
Rx2
Rx2
10
Restricted © 2017 Mentor Graphics Corporation
1. The design has missing or incorrect synchronizers
2. The design does not adhere to the required CDC protocols to ensure correct data transfer
3. The design does not account for non-deterministic delays through synchronizers
1 32
Summary of possible CDC problems
SB, CDC Verification, 2017
Restricted © 2017 Mentor Graphics Corporation
1 32
1. Complete structural analysis to find all synchronizers
2. Automated assertion-based verification to ensure correct implementation of CDC protocols
3. Accurate simulation of metastability effects in synchronizers to predict true silicon behavior
The Questa CDC Verification Solution
SB, CDC Verification, 2017
Restricted © 2017 Mentor Graphics Corporation
Questa Formal Solutions & AppsAutomated, Exhaustive Verification For Complex Challenges
SB, CDC Verification, 201713
Restricted © 2017 Mentor Graphics Corporation
Questa Clock Domain Crossing (CDC)Exhaustive, automated, scalable, and safe CDC analysis & guidance
SB, CDC Verification, 2017
Questa CDC exhaustively identifies bugs created by multiple clocks, and suggests circuit corrections w/out formal knowledge
UCDB
Waivers,Constraints
QuestaCDC
Textual & GUI Reporting
“CDC-FX”Metastability
modelsfor functional
simulation
RTL
SDC
UPF
RecommendedSynchronizers
14
Restricted © 2017 Mentor Graphics Corporation
Works on RTL source code — Uses vendor-specific
synthesizable libraries
Automatically identifies all clocks and clock-domain crossings
Provides an easy-to-use debug/analysis environment
Static CDC Analysis
SB, CDC Verification, 2017
RTL
Questa CDCStatic Analysis
CDC Coverage
Restricted © 2017 Mentor Graphics Corporation
Synchronizer Recognition Enables Dynamic CDC
2-DFF
DMUX
Handshake
FIFO
Asynchronous reset
…
SB, CDC Verification, 201716
Restricted © 2017 Mentor Graphics Corporation
CDC Protocol Assertions
Questa CDC verification solution automatically generated assertions to capture these protocols
SB, CDC Verification, 2017
Protocol Example:When a transmitter's data select signal crosses a clock domain and drives the mux select input (a) of a data multiplexer in the receiver, it must be held stable long enough for the signal (b, TX Data) to be sampled reliably by the receiver (c, RX Data) and the data must remain stable while the data select signal asserts.
(a) Mux select
(b) TX Data
(c) RX Data
Assertion
17
Restricted © 2017 Mentor Graphics Corporation
Questa CDC Protocol Assertion Flow
CDC Protocol
Assertions
RTL
Proven Assertions
RTL
Formally proveCDC protocols are implemented correctly – fully automatic
Simulate CDC protocol assertions jointly with the design and testbench
CDC Protocol
Assertions
SimulationNon-proven
Covered Assertions
Coverage Reporting
RTL &Testbench
Review Assertion Violations
Questa CDCStatic Analysis
QuestaFormal
Analysis
SB, CDC Verification, 201718
Restricted © 2017 Mentor Graphics Corporation
Accurate Simulation of Metastability Effects
RTL
MetastabilityModels
Simulation
Coverage Database
RTL &Testbench
Review Violations
Questa CDCStatic Analysis
SB, CDC Verification, 2017
Generate metastabilitymodel— Fully automatic!
Simulate your design and testbench with the metastability models for silicon-accurate simulation results
Tx Rx
clk
_A
D Q D Q D Q
2DFF Synchronizer
Metastability
Checker Driver
Behavioral Metastability Model (BMM)
i i +1 i +2i -1 i +3
Setup
violation
Tx
clk_B
Rx
clk_B
Rx
19
Restricted © 2017 Mentor Graphics Corporation
Summary: Questa CDC Advantages
Industry leading platform for CDC (and Power Aware CDC, CDC-FX for CDC+simulation, and Reset Check)
Comprehensive hierarchical approach that finds bugs competitors miss
Industry leading scalability and memory efficiency
The most built-in CDC schemes in the industry (50+) to address any CDC issue
UCDB from Questa CDC can be sent to Questa Verification Management to track progress over multiple runs
SB, CDC Verification, 201720
Restricted © 2017 Mentor Graphics Corporation
Enhancing the Questa CDC + FPGA Workflow
Simplifying the end-users’ job
Creating a GUI-centric flow that FPGA users prefer
Importing the project file of FPGA Vendor to expedite setup
Automatically streamline analysis for FPGA-specific architecture & primitives
UCDB
Waivers,Constraints
QuestaCDC
GUI-based work flow & reports
“CDC-FX”Metastability
modelsfor functional
simulation
RTL
SDC
UPF
RecommendedSynchronizers
SB, CDC Verification, 201721
Restricted © 2017 Mentor Graphics Corporation
New: Questa CDC is the ONLY ISO26262-compliant CDC Solution Today!
SGS-TÜV Saar certified ISO 26262 compliance of Mentor’s “Software Tool Qualification Report”
Covers QuestaSim, Verification Management and Questa CDC
Part of Mentor-wide “SAFE” initiative – more tools to follow
SB, CDC Verification, 201722
Restricted © 2017 Mentor Graphics Corporation
Questa CDC Success: Rapid Bring-Up & QoR
SB, CDC Verification, 2017
In only 90 minutes out of the box, Questa CDC found: 2 RTL Design bugs Multiple, severe SDC constraints issues
“We have found 2 bugs already using Questa CDC (related to missing synchronizers, asynchronous reset w/out proper synchronization, etc). Questa CDC has set the bar very, very high for any other CDC tool to meet.” -- Customer D&V Engineer
”The Questa CDC tool has gotten us farther along in 2 hours than we were even after a whole week of trying to set up Spyglass CDC.” -- Customer Engineering Manager
23
Restricted © 2017 Mentor Graphics Corporation
Where Can You Go To Learn More?
Verification Academy — https://verificationacademy.com/— Most comprehensive resource for verification training
in industry— Focuses on methodologies rather than tools
Functional Verification at www.mentor.com— https://www.mentor.com/products/fv/— Learn more about tools to enable methodologies— Simulation, SV/UVM, Formal, Verification IP
SB, CDC Verification, 201724
Restricted © 2017 Mentor Graphics Corporation
LABS
SB, CDC Verification, 2017
Restricted © 2017 Mentor Graphics Corporation
Lab Design
SB, CDC Verification, 201726
Restricted © 2017 Mentor Graphics Corporation
Set Design Environment & Basic Conditions
Generate Clock and Setup Reports
Perform CDC Checks
Check Clock Groups?
DONE
Resolve Warnings & Modify Setup
Debug & Resolve Violations
Check Setup?
Violations?
Modify Design Constraints
Static CDC Analysis
SB, CDC Verification, 201727
Restricted © 2017 Mentor Graphics Corporation
Static CDC Analysis
SB, CDC Verification, 201728
Restricted © 2017 Mentor Graphics Corporation
CDC Protocol Assertion Analysis
CDC Protocol
Assertions
RTL
Proven Assertions
RTL
CDC Protocol
Assertions
SimulationNon-proven
Covered Assertions
Coverage Reporting
RTL &Testbench
Review Assertion Violations
Questa CDCStatic Analysis
QuestaFormal
Analysis
SB, CDC Verification, 201729
Restricted © 2017 Mentor Graphics Corporation
Accurate Simulation of Metastability Effects
RTL
MetastabilityModels
Simulation
Coverage Database
RTL &Testbench
Review Violations
Questa CDCStatic Analysis
SB, CDC Verification, 201730
Restricted © 2017 Mentor Graphics Corporation
THANK YOU
SB, CDC Verification, 2017
Restricted © 2017 Mentor Graphics Corporationwww.mentor.com