When The Chips Are Down, How Do You Know They Work? - Featured Article By Sunil Kakkar and Yaron Wolfsthal From IBM Microelectronics

Today's VLSI design companies are all trying to grab a big slice of the pie when it comes to the complex chip designs of tomorrow. Getting a piece of the action is great—but these companies have to understand that a complex design, no matter how cool, won't make it to silicon unless the company can verify its design—beyond the faintest doubt. And, judging by results, it is not certain that this is, in fact, the case, with headline examples of re-spin and over-run clear in the mind.

Clearly, this is not a new problem. However, as geometries now descend below 90 nanometers and, increasingly, whole systems are assembled on chips consisting of anything up to 50 million transistors and sometimes more, a customer company’s future may be on the line.

As product life-cycles also shrink, the pressures increase. Today, even traditional telecommunications products, that have been used for 10 or 15 years, must now earn their keep in five or so years, whilst the “sell-by” date for sophisticated consumer electronics designs may be counted in months rather than years.

Design verification, as it stands today, has forced numerous potential killer designs to undergo several silicon mask re-spins. Re-spins can, quite literally, bring a a company to its knees in terms of lost time to market and a haemorrhaging of money wasted in delay and redesign.

Almost inevitably, a company may decide to take a chance and release the product to the market for fear of losing their customers totally— even though they may not be sure that the chip is really ready to be shipped out. In these cases, the customers quickly confirm their worst fears and the chips have to be recalled. Then “right the second or third time” does not make good business sense!

If chip design is considered a prestigious task, the wisdom of design verification is worthy of worship! Accordingly, many ASIC design houses should make sure its gurus, fellows, or architects are selected from the verification arena just as much as they are handpicked from the design area.

VLSI design engineers who are new to the field need to understand that verifying a complex design is not a lesser task to be assigned to junior engineers. Rather, those engineers who really understand the complexities of robust design verification have potential for becoming superior design engineers. This is because they'll know which designs will work and which, no matter how chic, will bomb out on silicon.

Is flawless verification expensive? It certainly is! A multi million-gate complex design demands twice as many verification engineers as design engineers. Verification tools can also be costly to license. But, when you consider that a silicon re-spin can easily cost upwards of a million dollars, not to mention the time lost getting the product out the door, that cost becomes insignificant. Ultimately, it's not a question of the monetary cost of verification, but whether or not you want your chip to hit the shelves, “Right First Time”.

IBM is among the companies making serious investments in the development of leading-edge verification tools to meet aggressive quality and time-to-market goals. Unique to IBM are the company’s formal verification tools, developed by the IBM Research Division. One such tool is RuleBase, an industrial-strength tool that applies a technique called model checking, especially applicable for verifying the control logic of large and complex hardware designs. Using formal methods, the system's implementation is represented as a finite state machine and the desired behaviour is given as a set of assertions written in the standard assertion language called PSL/Sugar.

Take, for example, a complex design for a high-performance hub/router chip which has to interact with multiple, concurrent data streams arriving from different sources that use different communication protocols. The device has to validate the arriving data, make routing decisions based on dynamically changing priorities and actually transmit the data to its destination, according to the protocol that the destination follows. Such a device, which can be thought of as one of the nerve centers of the system, is very difficult to verify due to its extremely large number of execution scenarios and corner cases it has.

The model-checking algorithm scans all possible states and execution paths in an attempt to find a counter-example to the formulas. Unlike traditional verification methods, which typically build on simulation, model-checking explores potentially large sets of states at each computation step. And, unlike simulation-based verification, no test cases are required. Proving a property is equivalent to verifying that it holds true for all possible execution paths, with all combinations of inputs.

Typically, in the design projects that use RuleBase, designers and verification engineers find evasive design bugs throughout the design cycle. This is valuable both in early design stages when other verification means have not yet been ramped up and in late design stages when simulation techniques have already provided their maximum input.

IBM’s own engineers have long used RuleBase for development of the company’s own complex processor designs, such as for the PowerPC and POWER4 and POWER5 processors. It is also used for both internal and external customer ASIC design projects, and has undoubtedly played its part in helping move IBM to the head of the ASIC market for the past several years. RuleBase may also be used by IBM customers for their own design developments.

So, as suppliers prepare to cash in on the next chip design boom, the need to ensure that the right verification mindset is ingrained into the future chip design fraternity is essential. A first step would be that verification engineers share the same pedestal as the design gurus. Otherwise, we run the risk of shutting down before we ever get started.

Sunil Kakkar works in the IBM’s Engineering and Technology Services Division in Bangalore and heads the microprocessor and ASIC performance & verification group. He can be reached at sukakkar@in.ibm.com

Yaron Wolfsthal is the manager of the Formal Methods department in the IBM Haifa Research Lab where the company’s formal verification tools are developed. He can be reached at wolfstal@il.ibm.com_