Verifying the correctness of the PA 7300LC processor

Hewlett-Packard Journal, June, 1997 by Duncan Weir, Paul G. Tobin

Functional verification was divided into presilicon and postsilicon phases. Software models were used in the presilicon phase, and fabricated chips and real systems were used in the postsilicon phase. In both phases the goals were the same--to find design bugs and ensure that customers get the highest quality part possible.

Ensuring the correctness of the complex PA 7300LC design required an extensive verification effort. We wanted to ensure that no customer would ever encounter a design bug. To reach this goal, we set out to exercise the design more extensively than is done with user software. Previous HP processors have maintained a well-earned reputation for quality, and we wanted the PA 7300LC to meet or exceed the quality of its predecessors.

This paper discusses the methodology used to verify the correctness of the PA 7300LC and the diagnostic hardware incorporated into the design to support debugging.

Functional Verification

The functional verification effort was divided into presilicon and postsilicon phases. The presilicon phase involved creating a software model of the chip and an environment in which the model could be thoroughly tested and debugged. The modeling environment provided many features to aid verification including the ability to initialize the machine state, inject stimuli, and see into all portions of the design for debugging. One major drawback of the modeling environment was the slow simulation speed.

Complementing the presilicon effort, an extensive postsilicon verification program was completed that took advantage of the test throughput available when running on an actual computer.

Extensive testing of the physical circuit design of the PA 7300LC was done in presilicon and postsilicon environments to ensure that the circuits would meet frequency, voltage, and temperature targets. This topic is covered in the article on page 61.

Presilicon Verification

For better efficiency, we chose to divide the design of the PA 7300LC into two components: the CPU core and the memory and I/O controller (MIOC). These two portions of the design were logically separated by a well-documented interface that enabled us to verify each component independently. Verifying the two components independently provided several benefits:

* Smaller and faster models

* Precise control over the stimuli at the CPU-MIOC interface

* Simpler model management (because less coordination was needed)

* Reduced debugging time (since it was known which portion of the design contained the bug).

As the design neared completion and both the CPU and MIOC had been extensively verified, we created a single merged model that included both components. This provided a thorough check of the interface between the components and was a double check of the independent verification work. In addition, the MIOC was incorporated into a model with external I/O devices to ensure that the PA 7300LC design would work with the components needed for a complete computer system.

The presilicon verification environment consists of three parts: modeling environment (model), test case environment (stimuli), and checking environment (checks).

Modeling Environment

We modeled the PA 7300LC design using the Verilog hardware description language. The design was primarily modeled at the logic gate level with connectivity extracted from the physical design. Some key portions of the design like the caches, TLBs, and floating-point execution units were modeled at a higher level to improve the size and speed of the model.

Fig. 1 shows the CPU and MIOC modeling environments. Software emulators were connected to the model interfaces to provide input and respond to output from the model. The programmable nature of the emulators allowed test cases to exercise the interfaces fully.

[Figure 1 ILLUSTRATION OMITTED]

New Modeling Process. Managing the modeling environment of a large design is a time-consuming task requiring coordination among all team members. Problems with a model build could lead to downtime that would stall the verification effort. To minimize these problems, a new model building process was implemented for the PA 7300LC design. All blocks of the modeling environment were placed under revision control. Any changes had to be included in a process change order that documented the purpose of the change, the blocks affected, the dependencies existing between this and other process change orders, and the testing needed to verify the change. In addition, an automated model build procedure was put in place to allow designers to integrate their changes into a private copy of the model and verify them in isolation before submitting a process change order. Finally, before a model was released to the verification team, it would undergo regression testing to eliminate blatant errors. Using the new system resulted in a consistently stable model that accelerated the verification effort.

Test Case Environment

Test cases control the stimuli applied to a model, thereby providing the event interactions that stress the design. Having an efficient way for test cases to stress the entire design is an important factor for improving quality. The strategy used for the PA 7300LC was largely leveraged from the successful PA 7100LC effort.[1] It provided a simple way to initialize machine-state resources like registers, caches, TLBs, and memory. It also allowed high-level coordination of instructions executed by the CPU along with transactions occurring at the model interfaces.