By Shaker Sarwary
Atrenta Inc.

Among the verification challenges confronting system-on-chip designers, clock domain crossings (CDCs) rank near the top in difficulty. CDCs have become a leading cause of design errors. Errors may even find their way into silicon, necessitating respins.

Two particularly troublesome CDC-related issues involve FIFO- and handshake-based synchronization mechanisms. Both can be difficult or impossible to accurately verify using simulation. And conventional static CDC analysis tools do too little and too much at the same time, simultaneously overlooking real design errors and overreporting large numbers of false violations. Thus the user is forced into an endless bug hunt.

The success of static CDC verification tools is determined by two critical measures-the time-to-signoff and the completeness of the CDC verification. Conventional CDC analysis generate noise (false violations), extending the verification cycle, and provide poor coverage of complex CDC synchronization schemes.

A new class of CDC tool, using static analysis techniques, offers the first effective automated solution for these problems. Such tools combine functional and structural analysis to identify and verify FIFO and handshake synchronizers, while weeding out false violations.

To isolate real CDC issues, it's necessary to detect various synchronization schemes-not just basic two-flop or multiflop synchronizers but more-complex mechanisms such as handshakes and FIFO-based schemes. Once detected, these synchronizers need to be verified as working correctly.

When detection and verification are done properly, one can confidently claim the clock domain crossings are correct. This knowledge, in turn, can be used to filter out false violations, which typically occur when a tool fails to recognize properly synchronized crossings.

Many tools lack the ability to detect, much less functionally verify, handshake structures. Since it's common to find up to 80 percent of CDCs controlled by handshakes in large design modules, false violations can number in the hundreds. Similar problems arise with FIFO synchronizers.

Automatic identification and verification of handshake schemes can eliminate a large number of false violations. This requires:

Handshake recognition. To correctly recognize a handshake scheme, the data transfer and all components of the handshake must be identified. ID includes crossing detection, mux or flip-flop enable detection, source and destination controller identification and, finally, request and acknowledge recognition. Detection of all the components requires thorough and flexible structural and functional analysis.

Handshake verification. The crossing cannot be considered safe until its functionality is proven correct. Two aspects of handshake functionality can be verified:

• Request and acknowledge behavior. Each request should result in an acknowledgement within some time frame. The time frame can be detected during the handshake recognition, and the designer may be prompted to verify the correctness before actual verification. Request and acknowledge signals may be active low or high, which can also be analyzed during handshake detection.
• Data capture window check. Data should be stable at the time a request is sent and should not change until the acknowledgment is asserted and the request is taken off. Although this requirement verifies that the source is correct and not directly related to a crossing problem, a violation indicates a serious functional problem in a design.

Static verification techniques are the ideal way to perform the above verification exhaustively; alternatively, verification can be carried out using simulation and a user-defined test bench. The difference is that the simulation approach is manually intensive and will not exhaustively verify these schemes.

FIFOs are commonly used to transfer data generated by a source to a destination where the source and destination are running at different or variable rates. Often, the source and destination reside in different clock domains, in which case an asynchronous FIFO is needed. In some cases, synchronous FIFOs are also used when the source and the destination are in the same clock domain.

Asynchronous FIFOs involve multiple CDCs for empty and full flag calculation as well as data reads to the destination domain. In a FIFO, these crossings are not always synchronized using traditional synchronization methods and may be falsely reported as unsynchronized.

CDC verification of FIFO synchronizers can be addressed by:

FIFO detection. FIFOs can be detected automatically by looking into logic around register banks and/or buses crossing clock domains. Thorough structural and functional analysis is needed to examine all components of a FIFO.

FIFO verification. Once recognized, FIFOs may be efficiently verified for overflow and underflow conditions. Static functional verification can be used to cover the functionality exhaustively. An intelligent verification approach can perform such verification using only the read and write pointers, sparing the designer the effort of specifying FIFO attributes such as FIFO depth.

Although FIFO- and handshake-based synchronization of clock domain crossings poses particular problems for design verification, a new class of tools is emerging that, using combined structural and functional analysis, offers the first effective automated solution to these problems.

By automatically detecting and verifying FIFO- and handshake-based CDC problems, such tools close a major gap in system-on-chip verification.

About the author
Shaker Sarwary is director of engineering at Atrenta Inc. Comments may be sent to shaker@atrenta.com.