New tools solve CDC-analysis troubles

Among the verification challenges confronting SoC designers, clock domain crossings (CDCs) is one of the most difficult. CDCs have become a leading cause of design errors. Errors may even find their way into silicon, necessitating respins.

Two particularly troublesome CDC-related issues involve FIFO- and handshake-based synchronization mechanisms. Both can be difficult or impossible to accurately verify using simulation. And conventional static CDC analysis tools do too little and too much at the same time, simultaneously overlooking real design errors and overreporting large numbers of false violations. Thus, the user is forced into an endless bug hunt.

The success of static CDC verification tools is determined by two critical measures?the time-to-signoff and the completeness of the CDC verification. Conventional CDC analysis generates noise (false violations)?extending the verification cycle?and provides poor coverage of complex CDC synchronization schemes.

A new class of CDC tools using static analysis techniques offers the first effective automated solution to these problems. Such tools combine functional and structural analysis to identify and verify FIFO and handshake synchronizers, while weeding out false violations.

To isolate real CDC issues, it is necessary to detect various synchronization schemes, not just basic two-flop or multiflop synchronizers, but more complex mechanisms such as handshakes and FIFO-based schemes. Once detected, these synchronizers need to be verified as working correctly.

When detection and verification are done properly, one can confidently claim that the CDCs are correct. This knowledge, in turn, can be used to filter out false violations, which typically occur when a tool fails to recognize properly synchronized crossings.

Many tools can't detect, much less functionally verify, handshake structures. Since it's common to find up to 80 percent of CDCs controlled by handshakes in large design modules, false violations can number in the hundreds. Similar problems arise with FIFO synchronizers.

Automatic identification and verification of handshake schemes can eliminate many false violations. The requirements are the following:

• Recognition?To correctly recognize a handshake scheme, the data transfer and all components of the handshake must be identified. ID includes crossing detection, mux or flip-flop enable detection, source and destination controller identification, and finally, request and acknowledge recognition. Detection of all the components requires thorough, flexible structural and functional analysis.

• Verification?The crossing cannot be considered safe until its functionality is proven correct. Two aspects of handshake functionality can be verified:

  1. Request and acknowledge behavior?Each request should result in an acknowledgement within some time frame. The time frame can be detected during the handshake recognition, and the designer may be prompted to verify the correctness before actual verification. Request and acknowledge signals may be active low or high, which can also be analyzed during handshake detection.

  2. Data capture window check?Data should be stable at the time a request is sent and should not change until the acknowledgment is asserted and the request is taken off. Although this requirement verifies that the source is correct and not directly related to a crossing problem, a violation indicates a serious functional problem in a design.

Automatic identification and verification of handshake schemes can eliminate many false violations.

Static verification techniques are a good way to perform this verification exhaustively; alternatively, verification can be carried out using simulation and a user-defined test bench. The difference is that the simulation approach is manually intensive and will not exhaustively verify these schemes.

FIFOs are commonly used to transfer data generated by a source to a destination where the source and destination are running at different or variable rates. Often, the source and destination reside in different clock domains, in which case an asynchronous FIFO is needed. In some cases, synchronous FIFOs are also used when the source and the destination are in the same clock domain.

Asynchronous FIFOs involve multiple CDCs for empty and full flag calculation, and data reads to the destination domain. In a FIFO, these crossings are not always synchronized using traditional synchronization methods and may be falsely reported as unsynchronized.

CDC verification of FIFO synchronizers can be addressed by FIFO detection and FIFO verification. FIFOs can be detected automatically by looking into logic around register banks or buses crossing clock domains or both. Thorough structural and functional analysis is needed to examine all components of a FIFO. Once recognized, FIFOs may be efficiently verified for overflow and underflow conditions. Static functional verification can be used to cover the functionality exhaustively. An intelligent verification approach can perform such verification using only the read and write pointers, sparing the designer the effort of specifying FIFO attributes (such as FIFO depth).

- Shaker Sarwary
Director of Engineering, Atrenta Inc.