Model checking in the cloud VIGYAN SINGHAL OSKI TECHNOLOGY
Views are biased by Oski experience Service provider, only doing model checking Using off-the-shelf tools (Cadence, Jasper, Mentor, OneSpin Synopsys) Have built in the past (UC Berkeley, Cadence, Jasper) 15+ full-time model checking users Customers like NVIDIA, AMD, Cisco, Huawei, Synopsys, Xilinx Most projects are set up as milestone-based Milestones have to show value in a simulation-based plan Have to fit in with the chip schedule Predicting the user and tool run-times is a requirement Hope (a.k.a bug hunting ) is not a strategy 2 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED
Types of post-silicon flaws 60% Verification is the still the largest problem Responses 50% 40% 30% 20% 2004 2007 2010 10% 0% 3 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED Wilson Research Group and Mentor Graphics 2010 Functional Verification Study. Used with permission.
Verification market size (2009)* Millions 450 400 350 300 250 200 150 100 50 0 Gate-level Simulation Formal Formal ($38.3M) $0.4M Simulation ($401.8M) Gate-level formal (equivalence checking) Then (1993): Chrysalis; Now: Cadence, Synopsys RTL formal (model checking) RTL * excluding analog Source: Gary Smith EDA, October 2010 Then (1994): Averant, IBM; Now: Cadence, Jasper, Mentor, OneSpin, Synopsys 4 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED
Motivation: exponential rise in bug-fix cost $10M $1M $100k $10k $1k $100 Tapeout Block-level design Block-level verification Chip-level verification 5 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED ECO phase Silicon is back
A model checking testbench Constraints Checkers (Scoreboard) Design Under Test (DUT) Coverage (code and functional) Abstraction Models 6 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED 10/28/2012
Cloud applicability depends on what you check Internal assertions, automatic checks Relate RTL internals, embedded in RTL E.g. sm[7:0] is one-hot Internal assertions X-propagation, clock gating checks Many, usually easier RTL Interface assertions Relate I/Os on one interface E.g. valid-ack, AMBA AXI4 AXI4 AVIP Interface assertions DDR2 AVIP Fewer, harder End-to-end checkers Models end-to-end functionality End-to-End Checker Replaces simulation Often requires manual abstractions 7 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED 10/28/2012
Where is the bar (for end-to-end formal)? Formal has to be more cost-effective than the alternative Usually bounded proofs are good enough (if bound is good enough!) Need to commit to what can be verified (and not), up front Backed by Coverage (measurable and/or argumentative) 8 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED 10/28/2012
Am I done with model checking? (three C s) Is my list of Checkers complete? Are my Constraints not over-constrained? Is my Complexity strategy complete? (are my proof bounds good enough) Coverage is the missing link 9 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED
Verification manager s dashboard Coverage tracking Bug tracking Runtime status 10 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED 10/28/2012
Model checking with coverage Implement Checkers and Constraints Add Abstractions and/or fix Constraints Run formal verification and collect Coverage Are Coverage goals met? 11 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED Design is formally verified
Cloud can help in later stages Early stages (user intensive, not parallelizable) Building constraints Build abstractions Debugging first checker failures Building multiple checkers Later stages (machine intensive, parallelizable) Running daily/weekly regressions Formal code coverage Thousands to hundreds of thousands of targets Hybrid formal: search from tons of user-specified far states Validate proof depths are good enough 12 Block-level verification Chip-level verification 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED ECO phase Tapeout Silicon is back
Non-technical challenges with cloud Perceived IP risk VP Engineering more conservative than CFO or VP Sales People use SalesForce, CRMs, in same companies Legal responsibility (vendor, cloud host, customer?) Licensing model Time-based-licensing or Pay-per-use First solve the most capital-intensive problems Emulators, costing $1M++ Vendor solutions exist Synopsys VCS in Amazon cloud Private vs public cloud 13 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED
Opportunities with the cloud Access to design and verification environment from anywhere in the world Vendors and customers monitor usage, and build business efficient pay-per-use models Manage peak usage Possible to have flexible architecture plug-in any engines Exploit latest engine advances Lower barrier for proof engine performance feedback back to EDA developers Cloud will happen, don t know when (after emulation?) 14 2011-12 OSKI TECHNOLOGY, INC. ALL RIGHTS RESERVED