Improved Generation of AMS Circuits for Formal Verification Dhanashree Kulkarni, Satish Batchu, Chris Myers University of Utah Abstract Recently, formal verification has had success in rigorously checking the correctness of digital designs. We have developed the LEMA tool to provide a methodology for the formal verification of analog/mixed-signal (AMS) circuits. In particular, LEMA utilizes a labeled Petri net (LPN) model to represent AMS circuit behavior. LPN models can be translated to SystemVerilog for simulation as well as analyzed directly using formal methods. This paper focuses on improvements in the generation of these abstract models from simulation data. In particular, this paper focuses on modeling transient behavior. This methodology is illustrated using a voltage controlled oscillator (VCO) example. I. INTRODUCTION Since system validation is taking up an increasing portion of the design time, it is very important to have efficient and reliable methods. Systems can be validated using either simulation or formal verification methods. Analog/mixed-signal (AMS) circuits are typically validated using only simulation methods. In simulation methods, an input sequence is applied and the output sequence is analyzed to see if it satisfies the desired behavior. As described in [6], it is possible to check these output sequences using SystemVerilog assertions (SVA). While this approach is straightforward, design errors may be missed, since not every input sequence or set of circuit parameters can be considered. Formal verification methods, on the other hand, represent the system as a state-space and verify it under all possible scenarios. While formal methods, such as equivalence checking and model checking, are beginning to be applied to AMS circuits [9], there are still numerous challenges before they can have the success that they have had for digital designs. Verification becomes even more challenging when dealing with radio-frequency (RF) circuits. Even for these circuits, though, there are some recent results [1]. The biggest challenge to AMS verification is constructing an abstract model of the circuit at the right level of abstraction. In simulation aided verification (SAV), the circuit simulation traces generated during conventional simulation-based validation are utilized to construct the abstract model. Simulation methods generate individual traces for a particular set of parameters and input sequences, hence generating abstract models from these sets of traces is comparatively easy for designers. Recently several tools have been developed that utilized this SAV methodology [2] [4], [7]. Fig. 1 shows the tool LEMA that we have developed which utilizes this SAV methodology. As explained before, the input to this tool is the simulation traces of the ciruit to be modeled. The model generator in the tool, generates two types of models for the circuit, a SystemVerilog model and a more formal model in the form of a labeled Petri net (LPN). These models can be used to check the correctness of the circuit. The tool also allows the user to provide properties in the form of LPNs. These properties can be converted into SVA and can be checked during system-level simulations. The generated LPN models are also analyzed against these properties in a model checker. In this case, the properties are checked to ensure that they hold under all variations allowed by the model. If the property fails, an error trace is generated which is then analyzed to find the possible errors in the circuit. The proposed technique can be applied for modeling and verifying AMS circuits. We have verified numerous practical circuits such as digital-to-analog converters and phase interpolators [5], [8]. Verification Property Labeled Petri Net (LPN) Checker Pass or Fail + Error Trace Generator Transistor Level Design SPICE Simulation Traces SystemVerilog Simulation Engine Assertion Pass/Fail Fig. 1: LEMA tool flow. Traditional Analog Circuit Verification RTL for Digital Components The work described here is an enhancement of the method introduced in [4]. The enhancements are inspired by the design of a voltage-controlled oscillator (VCO), a critical component
of a phase-locked loop (PLL) as shown in Fig. 2. A PLL includes a phase detector which compares the frequency of a reference clock with the frequency of the output clock, and it generates an error signal which is proportional to their phase difference. This signal is then filtered with a low pass filter to remove noise and high frequency changes. The output of the filter drives the VCO to set the frequency of the output clock. Namely, the VCO produces a clock signal which has a frequency that is proportional to the control voltage. This output clock is then fed back to the input producing a negative feedback loop. This VCO example inspired several improvements to our LEMA tool with the most significant being a new algorithm to isolate transient behavior of the circuit from the steady state behavior. In the VCO example, when the control voltage changes, the circuit takes some time to stabilize to the new output frequency value. During this time, the output frequency of the circuit is not fixed. This paper describes the method to find this period of instability, model it as unstable states, and generate the corresponding LPN and SystemVerilog models. The resulting model more accurately represents the behavior of the circuit. d) For each data point in the simulation trace, if there is a change in a care variable then add a transition to the place for this new region. 3) Add pseudo transitions. 4) Build an LPN to generate the stable variable. 5) Generate SystemVerilog model. This model generation process is illustrated using the VCO example. In order to generate a model, several simulation traces must first be generated for various values of the ctl signal. Fig. 3 shows one such simulation waveform for a ctl signal value of 2V which results in a specific output frequency after an initial transient. In order to generate LPN models, these waveforms are split into regions which in turn are represented as places in the generated LPN model. For example, in Fig. 3, the output has two values, 0V and 5V, so it is represented using two regions. The ctl signal is assigned one region for each ctl value considered. In this example, three simulation traces are used, produced using three different ctl values: 2V, 3V, and 4V. Reference Clock Phase Detector Error Signal Loop Filter Control Voltage VCO Output Clock Fig. 2: Block diagram for a phase-locked loop. II. MODEL GENERATION The models generated in LEMA are in the form of LPNs, a mathematical modeling language. Petri nets describe a system using a graph that consists of places, transitions, and directed arcs which connect the places to the transitions. The places represent the states of the system, and the transitions indicate how the system can change stater. The places in an LPN contain tokens. A place that has a token is said to be marked. The transitions in our LPN models are labeled with an enabling condition, a delay assignment, and a set of variable assignments. A transition is enabled when its input places are marked and its enabling condition evaluates to true. An enabled transition fires after the delay specified in its delay assignment. The firing of a transition results in the variable assignments, and it removes the tokens from its input places and places tokens in its output places. More details about these semantics are given in [5], [8], for example. LEMA includes a model generation procedure that translates simulation data into an LPN model. The steps of this procedure are given below: 1) Add initially marked place, p0, to the LPN model. 2) For each simmulation trace: a) Make region assignments for all the variables. b) Add stable variable to the simulation trace. c) Add transition between p0 and a place for the initial region in the trace. Fig. 3: A simulation trace for a VCO. The model generation process begins by adding an initially marked place, p0, to the LPN shown in Fig. 4. At this point, each trace is dealt with individually. For each data point within an individual trace, each variable is assigned to a region depending upon the value of the variable at that particular data point. Next, the stable variable is added to the simulation trace as described in detail in the next section. Then, a transition, t0, to the initial region, p1, is added. In the initial region, the stable variable is low due to the initial transient, and the output is also low. Therefore, t0 has an enabling condition that checks that stable is low (i.e., not greater than 0.5), and it sets out to a low value (i.e., a random value between 0 and 0.2V). At this point, the model generation process continues by examining each data point in the simulation trace one at a time. Whenever the region assignment changes for an important variable, known as a care variable, a transition is added from the current place to a new place that represents the region that is entered at this point in the trace. In this example, the care variables are stable and out. The first change in a care variable in the trace shown in Fig. 3 is that out goes to a high value. To represent this change, the place, p2, is added which
p0 t0 p1 t1 [( (ctl 2.5)) 1.9 + ((ctl 2.5) & (ctl 3.5)) 1.9 + (ctl 3.5) 1.9] p2 t2 [( (ctl 2.5)) uniform(1.3, 10.9)+ ((ctl 2.5) & (ctl 3.5)) uniform(1.1, 10.7)+ (ctl 3.5) uniform(1.1, 10.7)] t3 [( (ctl 2.5)) uniform(1.7, 2)+ ((ctl 2.5) & (ctl 3.5)) uniform(1.5, 1.7)+ (ctl 3.5) uniform(1.3, 1.5)] pt6 pt4 p0 p3 t4 p4 t5 [( (ctl 2.5)) 1.5+ ((ctl 2.5) & (ctl 3.5)) 1.3+ t6 [( (ctl 2.5)) 2+ ((ctl 2.5) & (ctl 3.5)) 1.5+ pt7 pt5 (ctl 3.5) 1.2] (ctl 3.5) 1.3] p0 p5 Fig. 4: Generated LPN model for a VCO with a stable variable added to account for transient behavior.
represents that stable is low and out is high. A transition, t1, is added between p1 and p2, and it sets out to a high value (i.e., a random value between 4.9 and 5V). Also, the delay is calculated from the beginning of the trace to a time at which out goes high which is found to be 1.9ns. This delay, however, is a function of the control signal value, so the delay is expressed using a function of the form: (ctl 2.5) 1.9. This process continues for each change in a care variable. The next change is that out goes low again, and transition, t2, is added to a new place, p3, which represents the region where stable and out are both low. As can be seen in the waveform, the delay of this transition is quite long, 10.9ns. When out goes high again, transition, t3 is added to the existing place, p2. As can be seen in the waveform, the next low going transition of out has a substantially shorter delay, so the delay on t2 is adjusted to be the range 1.3 to 10.9ns. This represents the significant uncertainty during the transient period. At some point, the stable variable goes high simultaneously with a change in a care variable. In this case, stable goes high as out goes high which results in transition, t4, being created from place p3 to a new place p4 which represents the region where both stable and out are high. At this point, the circuit has stabilized, so as the process continues to add transitions t5 and t6 which have very tight delay bounds. This process is repeated for each of the simulation traces. In this example, the analysis of the traces for ctl of 3V and 4V results in the exact same structure of the LPN. The only difference is the delays on transitions t2, t3, t5, and t6 are changed to indicate the change in frequency that results. An LPN model generated in this way only represents the circuit behavior for the input sequences which are present in the simulation traces used for generating the model. This model can potentially show unusual behavior when it is subjected to a different input sequence. To address this problem, our method inserts pseudo-transitions between the regions to allow for movement between regions not found in the simulation traces. Pseudo-transitions are labeled pt# in Fig. 4. For example, pt4 and pt6 are added to represent the possibility of the circuit stabilizing or destabilizing while out is high. The next step of the process is to create an LPN to represent the generation of the stable variable which is not an actual circuit variable, but only an artificial variable added to model transients. This LPN is generated using the same LPN generation process as above (skipping, of course, the step to add the stable variable). For this LPN, the ctl signal is selected as a care variable, and stable is an output variable. The resulting LPN for the VCO is shown in Fig. 5. III. ADDING THE STABLE VARIABLE In the VCO example, the control voltage sets the output frequency. When the control voltage changes, though, the frequency does not change immediately. In order to address this transient behavior, our method uses the notion of control inputs. Control inputs are those which when triggered cause the circuit to show a transient behavior that is different from the steady-state behavior for a finite time duration. The set of control inputs to a circuit are assumed to be specified by t25 pt3 pt1 p13 t28 [87.4] p10 t30 p11 pt4 pt5 t26 [97] pt0 p12 t27 [95.7] pt2 Fig. 5: LPN to generate the stable variable. t29 the designer. Transient behavior is isolated from the steadystate behavior of the model by adding a unique Boolean state variable, stable. The value of this stable variable at each time point in the simulation data is determined depending on whether the circuit is displaying transient behavior or steadystate behavior at that point. The tolerance with which this behavior has to be captured is specified by a user controlled parameter. This parameter defines the amount of variation allowed in the steady state of the circuit output. The value of stable is 0 when the system is in the transient state and 1 when the system is in the steady state. Thus, the state variable, stable, serves the purpose of isolating the transient behavior from the steady-state behavior observed in the simulations. The transient behavior in an LPN is displayed in the form of wider ranges of delay assignments, value assignments, or rate assignments on the transitions as compared to those in the steady-state (see transitions t2 and t5 in Fig. 4, for example). The stable variable is added to a simulation trace using the steps shown below: 1) Start at the beginnning of the simulation trace (i = 0). 2) Starting with i+1, search for the next change in a control input or the end of the trace, set this position to j. 3) Starting at j 1, search backwards for changes in the output value, and at each change, record the duration it took for switching from one output value to another. 4) Check that these durations are the same as the previous duration within some tolerance. 5) If it is not within the tolerance, then mark this point k. 6) Mark all data points between i and k 1 as unstable and from k to j 1 as stable. 7) Set i to j 1. 8) If i is not the end of the trace, go back to step 2.
The algorithm above can be explained with the help of Fig. 3. In this example, the only control input is ctl. Since this trace does not include any changes in ctl, j is set to the end of the trace. This process then searches backwards starting at the end of the trace. During this search, the delay between each output change is recorded. In this example, there are two output values, 0 and 5V, and hence two regions. The durations of change in outputs are compared and checked until they are no longer within the predefined tolerance value. For this waveform, this condition is not fulfilled until the long transient at the beginning of the waveform is encountered. At this point, stable is set to 0 for all data points up to the end of this transient. At that position, all subsequent data points are marked with stable being 1. As described in the previous section, this stable variable results in an LPN model that has been separated into a portion that models transient behavior and another that models the steady-state behavior. These are represented as the two loops in Fig. 4. Another outcome is the duration of the transient is recorded in the LPN to produce the stable variable shown in transitions t26, t27, and t28 in Fig. 5. This LPN waits for a change in the control input, ctl, and it sets stable to low and changes to the appropriate place that models the response to this change. This LPN then sets stable to high after waiting for an appropriate transient delay, and stable stays high until there is another change in ctl. One more thing which should be noted is that although this LPN is generated by simulation traces that never change ctl, the addition of pseudo-transitions allows for it to also represent transients as ctl changes dynamically. IV. SYSTEMVERLIOG GENERATION In addition to formal verification, our method can also produce a SystemVerilog model that can be used in systemlevel simulations. SystemVerilog is chosen instead of an AMS modeling language as it results in a more efficient model for simulation, and it is often sufficiently accurate for such simulations. A generic approach is used to translate the generated LPNs to SystemVerilog models. As an example, the code generated for the transition t0 from the LPN shown in Fig. 4 is given below: assign #(delay( t 0,0,0)) t 0 = p 0 &&(!(stable>=0.5)); always @(posedge t 0 ) begin p 0 <= 0; p 1 <= 1; out <= uniform(0,0.2); end these generated models on a variety of examples. We are especially interested in models of circuits which include a mixture of digital and analog components and more complex circuits like a complete phase locked loop. ACKNOWLEDGEMENTS The authors would like to thank Chandra Kashyap, Chirayu Amin, and others at Intel s Strategic CAD Labs for help with the example and numerous insightful discussions. This work is supported by the National Science Foundation under Grant CCF-1117515, SRC Contract 2008-TJ-1851, and by Intel Corporation. REFERENCES [1] H. Chang and K. Kundert. Verification of complex analog integrated circuits. In The Proceedings of the IEEE, 2007. [2] T.R. Dastidar and P. P. Chakrabarti. A verification system for transient response of analog circuits. ACM Trans. Des. Autom. Electron. Syst., 12(3):1 39, 2007. [3] G. E. Fainekos, A. Girard, and G. J. Pappas. Temporal logic verification using simulation. In Eugene Asarin and Patricia Bouyer, editors, Formal ling and Analysis of Timed Systems (FORMATS), volume 4202 of Lecture Notes in Computer Science, pages 171 186. Springer-Verlag, 2006. [4] S. Little, D. Walter, K. Jones, C. Myers, and A. Sen. Analog/mixed-signal circuit verification using models generated from simulation traces. The Int. Jour. of Foundations of Computer Science, 21(2):191 210, 2010. [5] S. Little, D. Walter, C. Myers, R. Thacker, S. Batchu, and T. Yoneda. Verification of analog/mixed-signal circuits using labeled hybrid petri nets. IEEE Transactions on Computer-Aided Design, 30(4):617 630, 2011. [6] Rajdeep Mukhopadhyay, S K Panda, Pallab Dasgupta, and John Gough. Instrumenting AMS assertion verification on commercial platforms. In ACM Transactions on Design Automation of Electronic Systems, 2009. [7] D. Nickovic and O. Maler. AMT: A property-based monitoring tool for analog systems. In Formal ling and Analysis of Timed Systems (FORMATS), 2007. [8] D. Walter, S. Little, C. Myers, N. Seegmiller, and T. Yoneda. Verification of analog/mixed-signal circuits using symbolic methods. IEEE Transactions on Computer-Aided Design, 27(12):2223 2235, 2008. [9] M. H. Zaki, S. Tahar, and G. Bois. Formal verification of analog and mixed signal designs: A survey. Microelectronics Journal, 39(12):1395 1404, 2008. V. CONCLUSION The method described in this paper has been incorporated in our AMS verification tool, LEMA, and it has been applied to several examples. Our preliminary results indicate that the separation of transient and steady state behavior results in a more accurate circuit model. The SystemVerilog model of the VCO generated using this method has been simulated producing reasonable results for high-level simulation. In the future, we plan to further explore the formal verification of