<<

KNOWLEDGE-GUIDEDMETHODOLOGYFOR

SOFTIPANALYSIS

BY

BHANUPRATAPSINGH

Submitted in partial fulfillment of the requirements

For the degree of Doctor of Philosophy

Dissertation Advisor: Dr. Christos Papachristou

Department of Electrical Engineering and Computer Science

CASEWESTERNRESERVEUNIVERSITY

January 2015 CASEWESTERNRESERVEUNIVERSITY

SCHOOLOFGRADUATESTUDIES

we hereby approve the thesis of BHANUPRATAPSINGH

candidate for the PH.D. degree.

chair of the committee DR.CHRISTOSPAPACHRISTOU

DR.FRANCISMERAT

DR.DANIELSAAB

DR.HONGPINGZHAO

DR.FRANCISWOLFF

date AUG 2 1 , 2 0 1 4

∗ We also certify that written approval has been obtained for any propri- etary material contained therein. Dedicated to my family and friends. CONTENTS

1 introduction1

1.1 Motivation and Statement of Problem ...... 1 1.1.1 Statement of Problem ...... 6 1.2 Major Contributions of the Research ...... 7 1.2.1 Expert System Based Approach ...... 7 1.2.2 Specification Analysis Methodology ...... 9 1.2.3 RTL Analysis Methodology ...... 9 1.2.4 Spec and RTL Correspondence ...... 10 1.3 Thesis Outline ...... 10

2 background and related work 11

Abstract ...... 11 2.1 Existing Soft-IP Verification Techniques ...... 11 2.1.1 Simulation Based Methods ...... 11 2.1.2 Formal Techniques ...... 13 2.2 Prior Work ...... 15 2.2.1 Specification Analysis ...... 15 2.2.2 Reverse Engineering ...... 17 2.2.3 IP Quality and RTL Analysis ...... 19 2.2.4 KB System ...... 20

3 overview of methodology 21

Abstract ...... 21 3.1 KB System Overview ...... 21 3.1.1 Knowledge Base Organization ...... 24 3.2 Specification KB Overview ...... 26 3.3 RTL KB Overview ...... 29

iv contents v

3.4 Confidence and Coverage Metrics ...... 30 3.5 Introduction to CLIPS and XML ...... 31 3.5.1 CLIPS Expert System Shell ...... 31 3.5.2 XML ...... 32

4 specification knowledge base 36

Abstract ...... 36 4.1 Spec-KB ...... 36 4.2 Specification Knowledge Representation Scheme ...... 37 4.2.1 Specification Ontology ...... 37 4.2.2 Automating Ontology Generation ...... 43 4.3 Specification Knowledge Extraction Scheme ...... 47 4.3.1 Spec-Extractor Tool ...... 47 4.3.2 Specification Rule-Base ...... 50 4.3.3 Metrics for Specification Analysis ...... 53

5 rtl knowledge base 57

Abstract ...... 57 5.1 RTL-KB ...... 57 5.2 RTL Knowledge Representation Scheme ...... 58 5.2.1 RTL-CLIPS ...... 58 5.2.2 Property Based Model ...... 59 5.3 RTL Knowledge Extraction ...... 62 5.3.1 RTL Rule Base ...... 62 5.3.2 RTL Evaluation in CLIPS ...... 67 5.3.3 RTL Analysis Example ...... 68

6 specification and rtl correspondence 70

Abstract ...... 70 6.1 Back Annotation ...... 70 6.1.1 Specification Tabular Objects ...... 71 6.1.2 Specification Drawing Objects ...... 78 contents vi

6.2 Results: Spec and RTL correspondence ...... 82

7 conclusion and future work 85 i appendix 87 a processing tabular objects 88

a.1 HTML Register Table and Register Test-bench Generation . . . . 88 b processing drawing objects 102

b.1 Extraction of FSM Specfication from SVG ...... 102

bibliography 110 LISTOFFIGURES

Figure 1 Design completion time compared to the project original schedule [1]...... 2 Figure 2 Functional Bugs Resulting in Increasing ASIC Respins . . 2 Figure 3 Verification effort in a project [1]...... 4 Figure 4 Cost of fixing bug vs Time [2]...... 5 Figure 5 Components of an Expert System [3]...... 8 Figure 6 Simulation Based Verification ...... 12 Figure 7 Formal verification process ...... 14 Figure 8 Knowledge Base Generation ...... 22 Figure 9 Knowledge Base Application for third-Party IP Analysis 23 Figure 10 OMAP4470 application processor from Texas Instruments [4]...... 24 Figure 11 Marvell ARMADA 510 (88AP510) Application Processor [5]...... 25 Figure 12 FreeScale i.MX25 Application Processor [6]...... 26 Figure 13 Knowledge Base organization overview ...... 27 Figure 15 Confidence factor merging using parallel combination formula ...... 30 Figure 14 Fragment of semantic network for peripheral interface domain ...... 35 Figure 16 Spec Analysis Flow ...... 38 Figure 17 Fragment of ontology model for FPU design domain . . 40 Figure 18 Tabular representation of IEEE-754 Floating point ontology 42 Figure 19 Overview of Ontology Automation system ...... 44

vii List of Figures viii

Figure 20 Frequency and Location based visualization of words in a FPU Spec ...... 45 Figure 21 Ontology Construction: Statistics of Generated Sugges- tions [7]...... 46 Figure 22 Iteration: Saturation Point [7]...... 46 Figure 23 Spec Word classification based on Lexical, Syntactic and Spatial Attributes ...... 49 Figure 24 Fragment of ARM2 design composition knowledge . . . 52 Figure 25 RTL Analysis Overview ...... 58 Figure 26 Property based model of a FIFO design ...... 61 Figure 27 Fragment of pdg for floating point add function . . . . . 66 Figure 28 Html annotation report ...... 69 Figure 29 Back Annotation overview ...... 71 Figure 30 Proposed IO Description Template ...... 73 Figure 31 Block diagram generated for ARM2 Core using GraphViz package ...... 74 Figure 32 Register Specification Template ...... 76 Figure 33 HTML view of register specification ...... 77 Figure 34 Register Verification Test bench ...... 78 Figure 35 FSM diagram drawn in Dia Tool [8]...... 79 Figure 36 FSM specification extraction from SVG diagram . . . . . 80 Figure 37 Example Timing Diagram ...... 81 Figure 38 Corresponding fragment of TDML XML ...... 81 Figure 39 Wishbone Interface timing diagram drawn using TDML tool and verification of generated assertions in simulation 82 LISTOFTABLES

Table 1 Fragment of Signal Description table from an Opencores FPU Spec ...... 33 Table 2 Spec word clusters ...... 56 Table 3 Specification analysis results using Spec rule base . . . . 56 Table 4 Examples of HDL represented in Knowledge Base . . . . 59 Table 5 Example - Template RTL code fragments and their an- notations ...... 60 Table 6 Test results for six ITC99 Benchmarks [9]. State names and CLIPS rules fired per machine cycle. . . 68 Table 7 RTL Analysis results using RTL rule-base ...... 69 Table 8 Spec Analysis Results ...... 84 Table 9 RTL Analysis and Back Annotation Results ...... 84

ix ACRONYMS

SoC System on Chip

NEFCIS Neuro-fuzzy Concept based Inference System for Specification Mining

UAG Undirected Acyclic Graph

DAG Directed Acyclic Graph

CRV Constrained Random Verification

FPU Floating Point Unit

CLIPS Language Integrated Production System

HDL Hardware Description Language

HVL Hardware Verification Language

RTL Register Transfer Level

XML Extensible Markup Language

DTD Document Type Definition

NLP Natural Language Processing

KB Knowledge Base

TDML Timing Diagram Markup Language

UVM Universal Verification Methodology

x ACKNOWLEDGEMENTS

First and foremost, I would like to thank my advisor Dr. Christos Papachris- tou for accepting me as his PhD student and guiding me in my research. He has always inspired me with his optimism and his creative ideas. The pro- posed methodology in this work has been conceptualized by him. His ability to quickly understand an issue and ask relevant questions around it has several times helped me to think afresh. He always encouraged me and appreciated my efforts, which kept me motivated during project implementation. Secondly, I would like to thank Prof. Frank Merat, Prof. Daniel Saab and Prof. Hong Ping Zhao, and Dr. Francis Wolff for serving on my dissertation commit- tee, for their time and valuable comments. Especially, I would like to thank Dr. Francis Wolff, who has been closely involved in my research throughout my graduate career. My research at Case would not have been possible without the help and support of my teammates, with whom I have collaborated in my research. I am thankful to Dr. Lawrence Leinweber, Dr. Yuriy Shivanosiki, and Arun- prasath Shankar for numerous interesting project discussions. I would also like to thank my friends at CWRU especially Mike Labarbera, Aswin Krishna, Maryam Hashemian and Moussa Souare, because of whom I had wonderful time at Case. I would like to thank Rockwell Automation (Mayfield Heights) for giving me an internship opportunity and to my manager Dan Weyer, who was very sup- portive. I am also thankful to Steve Clay, with whom I interacted at Rockwell and who has increased my knowledge in IC design. I would like to thank my family for all their love and support. My parents have instilled in me the value of hardwork and patience. Their unconditional

xi acknowledgements xii

love for me, and pride in me keeps me motivated in life. My brothers Vishav and Rishabh, who have always been my support system. I would like to ex- press my deepest gratitude to my wife and my friend, Smriti, for her support and understanding during the past few years. Her support and encouragement made this dissertation possible. Finally, I acknowledge my daughter, Advika, and my son, Aaditya, who had to adjust with their father’s busy schedule and are my bundles of joy. knowledge-guided methodology for soft ip analysis by bhanu pratap singh

ABSTRACT

Demand for increasing functionality in handheld devices is driving integration of more functions (IPs) into System-on-Chip (SoC) designs. The development of such complex designs poses new challenges to the semiconductor industry in terms of productivity gaps and risks meeting quality and time-to-market goals. In SoC design, these goals are critical as rapid advances in process and product technology have shortened product life cycles with a limited feasible marketing window. SoC design teams have been employing IP reuse method- ology to increase their productivity and often integrate third party IPs into their systems. Verification has developed into a major bottleneck in SoC design and has now reached crisis proportions. Verification involves building a complex test environment and the productivity gap affecting verification means that thor- ough verification of third party IPs is generally not done. In practice, there are risks involved in using a third party IP as bugs may creep in due to versioning issues, poor documentation, and mismatches between specification and RTL. As a result of this, third party IP specification and RTL must be carefully eval- uated. The current state-of-the-art lacks a methodology that captures the exper- tise of a design expert by providing knowledge representation, extraction and reuse schemes. New techniques are required that can leverage heuristic knowl- edge of design experts and uncover IP quality issues early in the design cycle. Simulation based verification techniques can also be augmented by engineer’s

xiii abstract xiv

understanding and knowledge of design. This work addresses the issue of third party IP analysis by providing a methodology to find a correspondence between IP specification and RTL. In this research, a knowledge-based system is used to mitigate the risk of using a third party IP. The methodology provides a technique to analyze IP specs and RTL, which are then cross-correlated to discover any discrepancies. The key innovative ideas in our approach are to use prior and trusted experience about designs, which include their specs and RTL code. Also, we have captured this trusted experience into two knowledge bases (KB), Spec-KB and RTL-KB. Fi- nally, knowledge base rules are used to cross-correlate the RTL blocks to the specs. We apply our knowledge-based system to analyze a third party soft IP, pro- vided by its RTL code description and a trusted specification document. The third party IP analysis involves a rule-based search process, which checks the existence of trusted design properties in an untrusted design. Our validation approach complements existing IP validation techniques and acts as a spec vs. RTL lint tool with a behavioral analysis capability. 1

INTRODUCTION

1.1 motivation and statement of problem

Validation for correctness is the most important task in digital system de- sign especially for IP cores and large integrated systems. Validation is a quality assurance process of establishing evidence that provides a high degree of as- surance that a product or system complies with its intended specification [10] [11]. The International Technology Road map for Semiconductors (ITRS) has listed design validation as a major bottleneck resulting in productivity gaps and risking return on investment for semiconductor companies. Hardware as- pects of design continue to witness soaring verification team sizes and test costs [12]. In recent years, the task of validating an IP against its specification is be- coming daunting due to increasing design complexity. The verification com- plexity increases exponentially with design complexity and as such verifica- tion schedules can not be accurately predicted resulting in project schedule slippage. This risks products missing a feasible market window. Fig.1 provides the results of a survey, which shows that on an average 67 % of projects are running behind schedule [1][13]. A major reason for slippage of schedule is late discovery of logical/functional design flaws as shown in Fig. 2, which decreases chances of first silicon success [14][15].

1 1.1 motivation and statement of problem 2

Figure 1: Design completion time compared to the project original schedule [1]

(a) IC/ASIC Having One or More Re-spins by Type of Flaw [14]

(b) ASIC Respin statistics [15]

Figure 2: Functional Bugs Resulting in Increasing ASIC Respins 1.1 motivation and statement of problem 3

Hardware design teams practice IP reuse to increase their productivity [16]. This allows semiconductor companies to focus their R&D effort on de- veloping their differentiating technology and use third party IPs for standard- based IPs, which provide minimal differentiation. A soft intellectual property (Soft IP) core is a reusable unit of logic, which can be synthesized to logic gates. A general assumption is that by reusing silicon proven IP blocks, design risk can be averted, productivity can be improved and time to market goals can be met. SoC design teams typically integrate a number of third-party IPs into their design. It is assumed by the SoC integrators that the third-party IP has been functionally validated by developers. In practice, bugs might still creep in due to the following reasons

• IP design validation ultimately comes down to good engineering judg- ment of engineers. A validation engineer might write his tests influenced by the design implementation rather than basing them on requirement specifications. In such a scenario, if a feature is not implemented or in- correctly implemented in RTL, then the bug is not discovered by the simulation test bench.

• In today’s global economy, IPs are being designed and verified at differ- ent geographic locations. The multi-site development of IPs also increases the risk to design quality.

• It is a common case that the IPs to be integrated might be required to be customized as per the requirements of the system. The vendors thus release a customer specific version and as such modifications are made to a stable RTL version of the IP.

• In case of new design standards, the IP might not have matured and been robustly proven in silicon. 1.1 motivation and statement of problem 4

The third-party IPs can as such be classified as untrusted designs since the user has no insight into IP validation or the quality control process. In a typical project, more than half of the development time is devoted to the verification process [17]. Fig.3 shows the trends in total project time spent in verification [1][13]. The productivity gap affecting design validation means that thorough third-party IP analysis at the user end is not performed. How- ever, the importance of thorough design analysis is not overstated. IP design issues, if discovered later than the RTL sign-off stage, increase the design turn around time and in the worst case result in chip re-spins.

Figure 3: Verification effort in a project [1]

Traditionally, validation has been pursued by simulation and testing tech- niques, using tools at several levels of representation i.e. system architecture, RTL and gate levels [18]. Large sets of functional vectors are applied at the sys- tem and RTL levels, testing just functionality without any fault modeling. At the gate level, ATPG tools use fault models to cover specific defects at the gate level [19]. The problem with functional testing is that it is very expensive as it requires long run times to operate on the large test vector sets. Thus functional 1.1 motivation and statement of problem 5 testing may not provide a high confidence level at a reasonable cost. Formal techniques for hardware system verification based on “Theorem proving” have been proposed in many research works [20][21]. The basis of formal verification is to derive a formal proof of a mathematical model of the system. The most widely used approach to formal verification is “Model check- ing”, which pursues exhaustive exploration of the state space and state tran- sitions of the system model [22][23]. However, model checking needs formal specs, i.e. a formal specification language. Although verification techniques have improved significantly, still the state explosion issue is a challenge in for- mally verifying large systems. A hardware bug is not simple to fix as in software, where a simple software patch can be downloaded via the Internet. A faulty chip means product recalls and extra re-spin costs. Fig. 4 shows the exponential increase in verification cost if the bug is discovered at the customer end [2]. The requirements to pro- duce fault-free chips motivate research to develop techniques to uncover IP quality issues early in the design cycle.

Figure 4: Cost of fixing bug vs Time [2] 1.1 motivation and statement of problem 6

The current state-of-the art lacks a methodology that models the exper- tise of a design expert to uncover IP quality issues by providing knowledge representation, extraction and reuse schemes. This work addresses the issue of third party IP analysis by providing a methodology to find a correspondence between IP specification and RTL using a knowledge base system. Knowledge based techniques use powerful pattern matching algorithms [24][25] to solve a variety of problems including circuit design. Knowledge bases are built on facts and rules and a search engine that can resolve new rules against existing rules in the rule base. Knowledge bases can be used to represent prior and trusted design experience, which can be used to infer by pattern matching the validity of new, possibly untrusted, designs. This is achieved by creating rules to represent properties of a new design and attempt to match these rules against the property rules of prior designs in the rule base. The development of design knowledge bases is a key element in our proposed work.

1.1.1 Statement of Problem

We consider a common scenario, where a SoC design team develops an IP specification (trusted spec) document but outsources the IP design and ver- ification to a third party design house. The SoC team finally receives the IP block as a soft IP core, which has a synthesizable RTL code description and a detailed functional spec document. An important issue is that the RTL design corresponds without discrepancies to its original trusted spec. Our method ad- dresses this issue. The application of our work is also to identify functionality of independently designed IP blocks. Given a third Party IP block specification and its RTL representation, our problem entails:

• Developing a methodology for specification analysis. 1.2 major contributions of the research 7

• Developing a methodology for RTL code analysis.

• Developing techniques to validate correspondence of specification to RTL.

1.2 major contributions of the research

The key innovative ideas in our approach are: first, to use prior and trusted design experience about designs, including their specs, RTL code, synthesis scripts and test benches; second, to capture this trusted experience in two knowledge bases, for specs and RTL information, respectively; third, use pat- tern matching rules against the rules in both knowledge bases to confirm the RTL and infer its relation block by block to the specs. Exploitation of prior and trusted design experience through both knowledge bases and pattern match- ing rules is a key benefit of our approach in contrast to formal methods and functional simulations. The following is a brief description of the main innova- tive items of our research.

1.2.1 Expert System Based Approach

An expert system is a program which is specifically intended to model human expertise or knowledge and is an intelligent software system capable of supporting explicit representation of knowledge. Expert systems are also known as knowledge based system and are generally designed very differ- ently from conventional programs because the problems have no satisfactory algorithmic solution and rely on inferences to achieve a reasonable solution. Engineers often use their past experience or heuristics, to solve a new prob- lem. This is also termed as case based reasoning, which is used by experts to solve a problem using previous similar cases, called precedents [3]. We have used CLIPS, an expert system shell originally developed by NASA, to build 1.2 major contributions of the research 8 our knowledge based system [3].

EXPERT SYSTEM

INFERENCE ENGINE WORKING MEMORY RULE BASE AGENDA FACTS

EXPERT

Figure 5: Components of an Expert System [3]

An expert system consists of a rule-base, inference engine and a working memory of facts as shown in Fig.5. A rule is in IF-THEN format. The part of the rule between IF and THEN is called antecedent or pattern part or condi- tional part. Following the THEN part of a rule is a list of actions to be executed when the rule fires. The term facts means information that is used by the ex- pert system for drawing inferences. A rule uses a set of facts as its conditional part in its antecedent. The inference engine determines which rule antecedents are satisfied by the facts. Two general methods of inferencing used in expert systems are forward chaining and backward chaining. Forward chaining is reasoning from facts to the conclusions resulting from those facts. Backward chaining involves reasoning in reverse from a hypothesis, a potential conclu- sion to be proved, to the facts that support the hypothesis [3]. We have a developed an expert system based methodology for specification and RTL analysis [26][27][28]. Our approach provides techniques to perform CLIPS fact based representation of spec and RTL information. A Spec and RTL rule-base written by experts captures their heuristic knowledge in the system. A forward chaining inference engine then uses the rule-base to draw conclu- sions from spec and RTL facts. 1.2 major contributions of the research 9

1.2.2 Specification Analysis Methodology

IP specification (spec) documents are becoming complex with increasing number of features listed across hundreds of pages. Designers prefer to write specs in natural language (NL) format such as English. However, this is a lim- itation for automating specification analysis. Existing systems for IP spec analysis mainly use keyword based approaches. Keyword-based systems fail to capture and take into account semantic relation- ships between keywords in a design domain. We have developed a spec anal- ysis technique that utilizes the underlying conceptual information embedded in specs to perform concept mining for semantic analysis of specs [27][7].

1.2.3 RTL Analysis Methodology

We have developed a methodology to perform rule-based static and dy- namic analysis of RTL code [26][27]. Our vhdl2clips tool automatically con- verts VHDL constructs into CLIPS facts [9]. The tools serves as the basis for forming the RTL knowledge base of trusted HDL code. We have developed pattern matching rules to perform static analysis of RTL code using the inbuilt inference engine of CLIPS. Our emphasis is recognition of code by matching patterns of operators and program constructs. The local evaluation of code fragments with test vectors is then used to confirm and supplement inferences made by pattern matching rules. Our approach augments the in-built pattern-matching capability of CLIPS with an event-based RTL simulator [9]. This enables the rule-base to use the en- hanced CLIPS expert system shell to identify IP design behavior and perform IP quality checks. 1.3 thesis outline 10

1.2.4 Spec and RTL Correspondence

Our work provides a methodology to validate the cross-correlations be- tween spec and RTL of a third party IP [29]. We have developed techniques to validate register specification and specification of drawing objects such as finite state machines (FSM). The Spec analysis output lists inferred design domain functions, associated features and their attributes such as bus-interface logic (protocol) and input- ouput (IO) features (bit-width, direction). The RTL analysis output provides behavioral annotations corresponding to design functions and IO features. Our back-annotation technique then maps inferred RTL modules block by block to the corresponding sections in spec. This provides feedback to the user about mismatches between specification and RTL.

1.3 thesis outline

The thesis is organized as follows: Chapter 2 discusses existing Soft-IP Val- idation techniques and prior work in specification and RTL analysis. Some examples of KB systems in the hardware domain are also discussed. Chapter 3 provides a brief overview of our methodology and provides an introduction to the CLIPS expert system and XML document format. The chapter also dis- cusses the confidence factor as a key metric in our approach. In Chapter 4, we discuss our specification knowledge representation and extraction schemes. Chapter 5 discusses in detail our RTL knowledge representation and extraction schemes. In Chapter 6, we discuss our back-annotation technique to perform cross-correlation between IP specs and RTL. Finally, Chapter 7 summarizes the conclusions and describes future research. 2

BACKGROUNDANDRELATEDWORK

abstract

In this chapter, current state-of-the-art verification techniques are discussed. Existing techniques are classified under simulation and formal verification based methods. Simulation requires generation of input test vectors while for- mal methods are based on verifying precise mathematical description of de- sign properties. This chapter also discusses related prior work and previous knowledge based systems developed for the hardware domain.

2.1 existing soft-ip verification techniques

2.1.1 Simulation Based Methods

Simulation remains the mainstay for most real-life verification issues, even though it is inherently incomplete due to an input state space that is too large to be enumerated [30]. Simulation involves either directed test case generation or constrained random verification (CRV). Fig.6 provides an overview of the simulation based design verification flow. The simulation of a hardware design involves the following tasks (a) un- derstanding a specification and building a test-plan to list tests for all the spec- ified features, (b) development of a test bench that should ideally exercise the design to provide full functional coverage, (c) building a reference behavioral model from a specification against which the design is compared, (d) build-

11 2.1 existing soft-ip verification techniques 12

Design

Functional RTL Design Spec output IP Design Requirement Spec Simulation Test stimulus Checker Test Spec TestBench pass/fail Coverage Test stimulus

Behavioral Model output

Figure 6: Simulation Based Verification

ing a checker block to do pass/fail analysis, and (e) analyzing the functional coverage results. In all these tasks, it is very important that the verification engineer does not mimic the thought process of the design engineer, as both of them will then commit the same errors and a bug may not be discovered in simulation. Directed test case generation involves much manual effort and test cases have to be explicitly thought of. Each directed test case covers a particular de- sign feature. A hardware design has many corner cases, so this approach can only target easy-to-find bugs. CRV can generate many test scenarios through constrained random genera- tion of stimulus and is better suited for tackling the state space explosion prob- lem. The hardware description languages (HDL) were incapable of effectively modeling test environments to verify the complex designs being developed. This led to the development of hardware verification languages (HVL) such as “systemVerilog” and “e-language” [31]. HVL have accelerated the adoption of CRV based test environments [32]. HVLs are successful, in part, due to the recognition that SoC functional ver- 2.1 existing soft-ip verification techniques 13 ification is really a software problem, not a hardware problem. Where HDLs were adequate to describe the static hardware in a chip, the inclusion of ran- domization, objects and other HVL features allowed the languages to describe more dynamic behaviors required to describe the real world in which chips are expected to operate. Users quickly realized that these environments could be quite complicated and reinventing new environments from scratch for each project was not a viable strategy. Thus was born the concept of verification methodologies to facilitate reuse of verification IP [31]. A number of verification methodologies to architect HVL verification envi- ronments have been proposed such as, e-language Reuse Methodology (eRM) and Open Verification Methodology (OVM) [33]. The recently developed Uni- versal Verification Methodology (UVM) Class library provides the building blocks needed to quickly develop well-constructed and reusable verification components and test environments. CRV based techniques require a complex self-checking environment, which takes a large amount of development time. The major issue in CRV is that there is no direct mapping between a feature and a test case. In directed testing, a test covers a particular feature while in CRV we do not know which features are being covered by a particular test. The effective usage of CRV comes down to good engineering judgment of providing constraints and usage scenarios. A coverage driven metric is used as the key indicator of the verification process. The coverage is very much dependent on the engineer’s knowledge of the de- sign. We cannot rule out bugs creeping in due to faults in the self-checking environment [17].

2.1.2 Formal Techniques

Formal verification is a systematic process that uses mathematical reason- ing to verify that design intent (spec) is preserved in implementation (RTL). 2.1 existing soft-ip verification techniques 14

A formal specification or model of the design is prepared in terms of proper- ties that obey mathematical rules. Now, given a property, formal verification exhaustively searches all possible input and state conditions for failure [34]. Fig.7 provides an overview of formal verification process.

Standard Specification

Functional Property Specification Specification

Implementation Property Modeling

Verification Framework

Satisfiable ?

Figure 7: Formal verification process

The traditional formal techniques (broadly, model checking and theorem proving) can, in principle, analyze and find all bugs in a design model but their applicability in practice is limited. The well known state explosion problem limits model checking, and the cost of theorem proving is prohibitive because of the amount of skilled manual guidance it requires [30]. The simulation based techniques do black box testing of the design under test (DUT). The formal verification techniques use the white box strategy and 2.2 prior work 15

are at a lower level of abstraction as compared to simulation. Assertion based verification is another formal verification technique that provides exhaustive coverage of the design. The assertion based techniques involve building an assertion using design signals. A verification engineer has to be very careful to be independent of the thought process of the designer as he may also repeat the bugs in RTL in his assertion model.

2.2 prior work

There are four broad areas related to our work, (a) Specification Analysis, (b) Reverse engineering, (c) IP Quality and RTL Analysis, and (d) KB System. We summarize the prior work in each of these areas and relate it with our focus and approach.

2.2.1 Specification Analysis

Designers have a preference for writing specification documents in an in- formal natural language format using a variety of notations that include dia- grams, charts, and tables. A lot of research has been done in the past to extract formal specifications from the specification documents. In software, domain ontologies have been used as domain knowledge for requirement elicitation [35]. The proposed approach requires human effort to map requirements to concepts in ontology. Inference rules on the ontology sys- tem are then used to detect incompleteness and inconsistency of requirements description. Our approach is different as it analyzes specs in the hardware do- main and uses heuristic rules to model expertise of a design expert. We assume that ontologies are built by design experts and that description of techniques to automatically build ontologies is beyond the scope of this work. Research has been done in the past to extract ontological concepts by 2.2 prior work 16

applying text-mining techniques to natural language documents [36], which can assist design experts in ontology generation. Various approaches have been proposed for extracting a formal specifica- tion from an informal specification written in natural language such as En- glish [37][38][39]. Our approach is not concerned with generating a formal specification. We are extracting features from a specification document and do feature based specification analysis. In a natural language processing (NLP) approach, knowledge representa- tion schemes in the form of conceptual graphs have been proposed for block diagrams, flowcharts, timing diagrams, and text [37]. This approach provides conceptual graphs for each format with an algorithm for automatically extract- ing conceptual structures from the specification document. The technique as- sumes a restricted subset of English for describing specifications and requires feedback from an expert to verify the extracted conceptual structures. In our proposed method for specification analysis, we avoid natural language process- ing (NLP) techniques or putting any restrictions of having a restricted subset of English in specification documents. In addition, we also propose a format for certain notations in specification documents to capture their description e.g. Register specification template. We also propose a flow to convert finite state machine diagrams to their formal representation when drawn with Dia, an open source tool [8]. For generating formal specifications, limited semantic expressibility of com- putation tree logic (CTL) has been exploited to derive a hierarchy of subsets of English sentences that correspond to a CTL expression [38]. This approach for automatic conversion of English to CTL requires a restricted subset of English to minimize ambiguity with respect to the formal specification language. In reference [40], the authors propose natural language representation of temporal logic formulas by introducing patterns of structured English lan- guage that correspond to Clocked CTL (CCTL) specification. Sentences are 2.2 prior work 17

compiled by a user by selecting these patterns. The user compiles a specifi- cation by selecting patterns and combining them into meaningful sentences, which directly correspond to a CCTL formulae. The approach assumes a sub- set of English and a library of patterns and their mapping to a CCTL represen- tation. In semi-formal techniques, textual use-case based specification of the sys- tem has been proposed [39]. The use-cases define the behavior of a system as a sequence of interaction steps under certain conditions and are written in a structured English language to act as the formal description of design behav- ior. The use-cases are then processed to generate constraints and test-cases for a random verification environment. Our approach is different from the above techniques as it avoids in-depth NLP and does not assume a restricted subset of English in specs. The in-depth NLP based approach is very complex and computationally expensive. NLP is not required for our approach as we focus on a limited domain specific aspect of text. We are not processing documents for general linguistic context. We avoid the difficulties of NLP by using domain specific feature extraction. Our KB system facilitates feature extraction by using design ontology models and a spec rule-base.

2.2.2 Reverse Engineering

IP design process begins with a specification and, through a succession of refinements, produces an implementable design. Reverse engineering is a pro- cess of back-tracing an implementation to its functional specification [41][42]. The application of our work can also be the reverse engineering of RTL design behavior. Reverse engineering has been an active topic of research over the years. There are few approaches related to our knowledge guided IP analy- sis methodology. Most of the techniques proposed for reverse engineering are 2.2 prior work 18

based on analyzing a gate-level net-list or integrated circuit die [43][44]. Our approach addresses reverse engineering of RTL, which is at a higher level of abstraction than gate and die level. Techniques that reverse engineer gate-level net-lists in order to determine the higher-lever structure have been demonstrated on ISCAS-85 benchmark circuits [45]. One technique first identifies library modules, for example, an adder from the gate-level net-list. It then tries to identify repetition of the basic circuit blocks and then higher level functions. In [46], HDL reverse engineering tools are proposed based on structural analysis of the VHDL source code. In this work, reverse engineering is manually accomplished by using graphical representation of design data. An approach has been proposed to reverse engineer a net-list from a pack- aged IC [44]. The proposed solution primarily uses scan operations and IC specification. The circuit connectivity is discovered by generating a set of tests that detect specific input/output dependencies, existing in the specification, and on using the test to assert that the discovered dependencies are imple- mented in the manufactured circuit. The discovered dependencies are com- bined to form an interconnected circuit. The functions are determined by enu- merating the input combinations of the function dependent variables, applying each input combination to the circuit, and computing the behavior at the out- put. In reference [47], a technique has been proposed to extract behavioral pat- terns from the simulation trace of gate-level net-lists and to represent them as a pattern graph. The pattern graph for a untrusted circuit is compared against pattern graphs of a library of trusted circuits using sub-graph isomorphism. This results in input-output correspondences between two patterns graphs. The closest matching component is then chosen and its specification are used for model checking of the gate-level net-list of the untrusted circuit. 2.2 prior work 19

2.2.3 IP Quality and RTL Analysis

Various approaches have been proposed for IP quality evaluation [48][49]. Quality metrics have been proposed in the past such as Quality Intellectual Property (QIP) by virtual socket interface alliance (VSIA) [48]. The VSIA iden- tified four factors that determine overall quality of IP: authoring, verification, the maturity of the IP, and the capabilities of the provider. Our approach pro- vides additional spec coverage and functional identification coverage metrics to quantify IP design quality. In industry, the so called lint tools are primarily used to check RTL design quality. These tools such as Spyglass from Atrenta, HAL from Cadence and Leda from Synopsys catch RTL coding errors early in the design cycle [50]. The lint tools generally have powerful rule sets that check design issues with respect to DFT (Design for testability), synthesis, naming conventions and de- sign style. These tools also do clock domain crossing (CDC) checks. The basic principle used in these tools is static analysis of RTL code. These tools do not analyze specification to RTL correspondences. For IP Quality analysis, an approach proposed by industry is to document all aspects of an IP using an XML data book format as specified in IP-XACT standard (IEEE 1685-2009)[51]. IPXACT provides meta-data to describe com- ponents, design interfaces, ports, registers, component instances, connections between components and configurable attributes of an IP. The limitation of IP-XACT is that it captures part of spec relevant to integration but does not capture the behavioral specifications of the IP. Our approach complements IPX- ACT structural specification by providing design ontology, which can be used to analyze behavioral specification. 2.2 prior work 20

2.2.4 KB System

KB systems based on artificial intelligence (AI) technology have been pro- posed in the past for fast prototyping of hardware designs and for hardware- software partitioning [52][53]. IBM estimates that it has saved more than $100 million during the last decade in direct development costs and reduced time to market by using AI technology for the verification of its processors [54]. Our validation approach is also an AI based technique but the application of our work is analyzing specification to RTL correspondences without performing exhaustive simulations. 3

OVERVIEWOFMETHODOLOGY

abstract

In this chapter, we provide an overview of our knowledge-guided method- ology. We present the organizational structure of our KB system. We provide a brief introduction of our specification and RTL analysis techniques. The key concepts like back-annotation technique and confidence/identification cover- age metrics are also discussed. At the end, we provide a brief introduction to the CLIPS expert system shell and the usage of XML format for representing spec information that can be easily extracted.

3.1 kb system overview

The main elements of our technique are: (a) a KB of trusted Specs and RTL, (b) property based models for common third party IP blocks (c) specification analysis, (d) RTL analysis, and (e) back-annotation of inferred RTL functional- ity to specification. Fig.8 provides an overview of knowledge base generation and Fig.9 provides an overview of knowledge base application for third party IP analysis. We have used the expert system shell CLIPS, with its powerful infer- ence engine to help us generate the Spec and RTL KBs and perform rule based analysis [3]. The generation of the KB is an incremental process, as the KB is en- hanced with addition of new rules, designs and associated knowledge. Every IP in the KB is considered as trusted design, built previously by experienced

21 3.1 kb system overview 22

Knowledge Base

Design standards Spec KB Spec Specs Extraction Spec Ontologies

Spec Rule-base

IP … IP Expert RTL KB

RTL Property-based RTL Analysis Models

RTL Rule-base

Figure 8: Knowledge Base Generation

designers. The third party IP analysis involves a rule-based search process, which checks the existence of trusted design properties in an untrusted design. Thus correspondences between third party RTL and its original trusted spec are inferred through the KB search by matching CLIPS rules. Our methodology can be used to analyze soft IPs based on standards, such as IEEE-754 floating point standard. We also use the concept of design domain, which we define as a family of soft IP designs that have common application, such as a bus interface domain. There are property similarities of designs within a domain. From analysis of specifications of various vendor specs, we observed that new SoC designs are built mostly by reusing and integrating existing IPs that are properly configured according to the specification. Therefore our approach of building spec/RTL rule-base, ontology, and property based models for each 3.1 kb system overview 23

Knowledge Base

Spec 3rd Party Extraction IP Spec Spec KB Spec Spec Ontologies CLIPS facts

Spec Rule-base Spec Analysis

Spec annotations Output Spec 2 RTL mismatches. Specification coverage Back-annotation RTL identification coverage Annotation Reports RTL KB RTL annotation Property-based Models RTL Analysis

RTL Rule-base 3rd Party RTL to CLIPS IP RTL

Figure 9: Knowledge Base Application for third-Party IP Analysis

design domain is a one time exercise while building the KB. The manual effort is high initially and is minimal afterwards. The reuse of the KB across multiple projects justifies the initial effort. In addition, our approach is well suited for platform based SoCs, which is a family of similar chips that differ for one or more components but that are based on the same processor. The knowledge base development is initially done for a limited number of IP’s that are common across SoC’s. Fig.10, Fig.11, and Fig.12 show block dia- grams of SoCs from Texas Instruments, Marvell semiconductor and Freescale respectively [4][5][6]. These SoCs have some common IP blocks such as SPI, UART, USB, I2C, Timers, PWM and we therefore add these designs to the KB. 3.1 kb system overview 24

The bus-interface protocol standards such as AHB/APB [55] are also added to the KB. Electronic design automation (EDA) companies, such as Cadence and Syn- opsys have verification IPs (VIP) for a limited number of design domains that act as reference models in simulation based verification [56][57]. The KB de- velopment effort can be considered similar to the VIP library development done by EDA companies. The differences are that our methodology provides techniques for performing rule-based specification and RTL analysis.

Figure 10: OMAP4470 application processor from Texas Instruments [4]

In the following sections, we briefly describe each element of our technique.

3.1.1 Knowledge Base Organization

The KB has a repository of trusted soft IP’s organized under the IPLIB directory. Fig.13 provides an overview of the KB organization. The KB has a pre-defined directory structure for storing information, and each IP database 3.1 kb system overview 25

Figure 11: Marvell ARMADA 510 (88AP510) Application Processor [5]

acts as a leaf node in this organization. For each trusted IP in the KB, we have its spec representations, RTL code representations, specific CLIPS rules that are executed on specs/RTLs, testing vectors, and design implementation scripts. The KB is structured in a way to simplify search of relevant information in specs or RTL. It also allows a user to selectively apply a part of the KB to analyze an untrusted design. Fig.13 provides an overview of the KB organization. The IPLIB directory is further categorized as per the design domain, the corresponding IP name and its specific vendor. The rules are available at each level. The rules at a do- main level are more generic than rules at the IP level and vendor levels. The directory structure at the IP level provides a uniform representation of each IP in terms of its RTL, Specs, Spec/RTL rules, and test vectors. 3.2 specification kb overview 26

Figure 12: FreeScale i.MX25 Application Processor [6]

3.2 specification kb overview

The Spec-KB is built by extracting knowledge from specification docu- ments of previous trusted designs and through addition of heuristic rules written by design experts. We partition the specification document into spec objects of three major types: (a) Text object, refers to a block of textual descrip- tion of a specification module, which may include its function, object attributes and their values, properties, exception modes, and constraints. For example, a text object for a clock could have a gating clock property, clock frequency at- tribute, and special timing constraints. (b) Tabular objects comprise tables and listings such as instruction formats, register maps, I/O and parameter lists. (c) Drawing objects comprise diagrammatic specification descriptions such as block diagrams, timing diagrams, state charts. As with text objects, properties, attributes and constraints may be extracted from drawing objects. Note that the spec objects (text, tabular or drawing) may contain hierarchies of other ob- 3.2 specification kb overview 27

KNOWLEDGE BASE

LEX IPLIB MISC

DOMAIN Processor Interface Peripheral … Memory Rules Ontology Manifest/Index

STANDARD SSP I2C SPI … UART Rules Ontology

VENDOR Rockwell ST … ARM Rules Ontology

IP-PACKAGE RTL SPEC RTL-FACTS SPEC-FACTS SCRIPTS TEST Rules Ontology

Figure 13: Knowledge Base organization overview jects. An important aspect of our work is to format the spec objects into tabu- lar fields, in particular we use rule-based templates composed of production rules and multi-field facts containing the object characteristics. We have built domain ontologies to capture text-objects that express salient features of each design domain. We extract the specifications from block diagrams and state machine di- agrams by parsing the scalar vector graphics (SVG) format representation of these objects. The spec is finally represented in a CLIPS fact based representa- tion. Any new IP spec is then analyzed by first representing it in a CLIPS fact based format and then performing rule-based analysis to find correspondence with the Spec-KB. The main purpose of specification analysis is to be able to extract relevant functional information about the document and compare it with previously analyzed specification documents in Spec-KB. The ability to extract and com- pare relevant information from the specification document is independent of the design vendor or writing style of the document author. The key elements 3.2 specification kb overview 28 of specification analysis are: (a) specification information extraction, and (b) specification ontology.

Specification Information Extraction

This transforms an English specification document into a unique CLIPS fact based representation, containing most important information about the document, while, providing a framework for uniform comparison between the extracted information from multiple documents. We have developed a spec extractor tool to automatically convert English documents into a CLIPS fact based representation.

Specification Ontology

This captures salient features of the design and builds a concept graph of design keywords, their attributes and relationships. It acts as a semantic net- work for a design domain, which is then used to perform spec analysis. Fig.14 provides a fragment of a semantic network for the serial peripheral interface domain. The key concepts of interface based designs are shown as nodes along with their attributes and are connected through relationships in the network. Relationships help to capture semantic information for a design domain. For example, in Fig.14, the has-a relation signifies a must have lower-level func- tion or feature, while a relationship may-have signifies an optional feature for a node in the semantic network. A specification ontology is superset of keywords for a particular domain (FPU, Memory Controllers, ARM chips, SPI, etc). The ontology is able to de- scribe the functional details for all variations of a particular IP design domain. 3.3 rtl kb overview 29

3.3 rtl kb overview

Our RTL analysis methodology performs static analysis (SA) of RTL code. We also perform local evaluation of code fragments in CLIPS. In general, SA based techniques are used to identify possible bugs in code as well as indicate how closely certain segments of code match specifications. In theoretical com- puter science, through Rice’s theorem and the undecidability of the halting problem, it has been proved that finding any kind of violation of a specifi- cation on the final result of a program is undecidable [58]. The only way to determine how a program will behave is to perform exhaustive simulations. In any case, being forewarned about a bug is valuable as it gives immediate feedback about what may be wrong in the implementation [59]. In our approach, we address the limitations of SA techniques by perform- ing evaluation of code fragments to better approximate design behavior. We are not doing design verification, in the sense of finding bugs in the design. We are validating that the design meets the specifications by levels of confidence. The RTL-KB is built by representing RTL of trusted designs in RTL-CLIPS format. RTL-CLIPS is a semantically equivalent translation of RTL code into CLIPS facts. A property based model for each design domain is also added to the RTL-KB. A property is a partial specification that contains some element of the expected design behavior. A property based model for a design is generated through hierarchical func- tional decomposition of design behavior into behavioral functions and associ- ated attributes. The expert generates the property-based model for trusted de- signs. The RTL-CLIPS fact format is used for rule based pattern matching for concept to code association. The CLIPS rules are written by creating a pattern using a set of RTL-CLIPS facts that are sufficient to make a inference. When a match is achieved, the rule fires and an inference is made, thus asserting new facts. 3.4 confidence and coverage metrics 30

3.4 confidence and coverage metrics

The spec and RTL rules search for matching behavioral properties associ- ated with trusted designs in the third Party IP Specs and RTL. There may only be a partial match of properties between trusted designs and third-Party IP. The matching properties may be of more significance to unmatched properties or vice-versa. Our approach provides a technique where an expert’s knowl- edge about the significance of a behavioral property towards inferring a design functionality is quantified.

Rule A1 Combinational CF1 = 0.1 logic Merge Rule Infer barrel barrel-shift CF = CF1 + CF2 – (CF1* CF2) shifter Rule 2 = 0.64 Logical shift left CF2 = 0.6 operation

Figure 15: Confidence factor merging using parallel combination formula

The methodology has a confidence factor (CF) associated with each rule in the RTL rule-base to support partial matching and accommodate expert knowledge about the significance of a design property. The CF given to the rule by an expert is in the range of zero to one. CF is the likelihood of being ac- curate in inferring a design function when a particular design property exists in Specs or RTL code. The CF allows the rule base to identify high level design functions even for partial matching of the behavioral properties. The CF’s are merged for rules inferring a function at the same hierarchical level using par- allel combination formula. Fig.15 provides an example of CF’s merging for a set of rules, which together infer a barrel-shifter logic based on existence of a logical left shift operation and the operation being combinational logic. We produce the CF of inferring a higher level module, based on the ex- istence of lower modules, by the average (possibly weighted) of the CF’s of 3.5 introduction to clips and xml 31

lower level modules. The CF for inferring a property increases if it is inferred in third party IP Specs by the Spec rule-base, and is also inferred in RTL code by the RTL rule-base. However, the CF decreases if a property found in Specs does not exist in the RTL or vice-versa. Coverage is an important concept in RTL validation and is defined in terms of code coverage metrics. The coverage metrics in our case concern function- ality identification coverage, thus our metrics are expressed in terms of con- fidence factors. Our emphasis is on identifying the functionality of soft IP design modules based on the existence of their behavioral properties. This pro- cess does not necessarily guarantee valid design behavior. Our methodology does produce confidence factors by which a soft IP and all its functions have been correctly identified in the RTL hierarchy.

3.5 introduction to clips and xml

We have used the CLIPS fact based format for spec and RTL knowledge representation. In our method, XML format of specs is used as input for spec analysis. In what follows we provide a brief introduction to CLIPS and XML.

3.5.1 CLIPS Expert System Shell

We have used CLIPS (C Language Integrated Production System) expert system to analyze specification and RTL. CLIPS is an expert system shell origi- nally developed by the Artificial Intelligence section of NASA’s Johnson Space Center and is written in C [3]. It also includes an object-oriented language called COOL (CLIPS Object-Oriented Language), which is directly integrated with the inference engine. CLIPS uses a forward-chaining inference strategy based on the Rete pattern-matching algorithm [24]. The CLIPS shell provides the following basic elements of an expert system: 3.5 introduction to clips and xml 32

• fact-list and instance-list : Global memory for data

• knowledge-base : Contains all the rules, the rule-base

• inference engine : Controls overall execution of rules

A program written in CLIPS may consist of rules, facts, and objects. The inference engine decides which rules should be executed and when. A rule- based expert system written in CLIPS is a data-driven program where the facts, and objects if desired, are the data that stimulate execution via the inference engine [3]. A fact consists of a relation name (a symbol field) followed with zero or some slots (also symbol fields) and their relevant value. The deftemplate construct is used to create a template, which can then be used by non-ordered facts to access fields of the fact by name. The syntax of the deftemplate con- struct is:

1 (deftemplate [] *) ::= |

One of the primary methods of representing knowledge in CLIPS is an IF THEN rule [3]. A rule is composed of an antecedent and a consequent. The an- tecedent of a rule is a set of conditions (or conditional elements), which must be satisfied for the rule to be applicable. Rules are defined using the defrule construct. The syntax of the defrule construct is:

(defrule [][] ;

* ; Left-Hand Side (LHS) 3 => *) ; Right-Hand Side (RHS)

3.5.2 XML

XML stands for Extensible Markup Language. XML is designed to struc- ture, store and transport data, with focus on what data is [60]. The difficulties 3.5 introduction to clips and xml 33 with word processor documents, spreadsheets and other form of documenta- tion is that they mix structure with formatting [61][62]. This makes it difficult to manage content and design, because the two are intermingled. XML can be used for sharing data among applications that hold data in different structures. A predefined XML structure can be used as an intermediate format between different applications. Adobe Acrobat and Microsoft Word are the popular documentation software programs and both support XML output to be stored from the documents written in pdf or doc format. A document type definition (DTD) defines the legal building blocks of an XML document. It defines the document structure with a list of legal ele- ments and attributes. XML document structure consists of elements with a root element, which contains other elements and so on. The data stored in each ele- ment is delimited by a start tag and end tag associated with the element name. A tag acts as boundary for data that the element stores. We use XML format of specification documents as input to our spec-extractor tool. XML provides documents structure, which can be used to extract data along with its location in the document and further classify data that is textual, tabular, or diagram- matic. Table 1 is a fragment of a signal description table from an open cores FPU specification document [63].

Signal Name Width Description clk_i 1 clock signal

Table 1: Fragment of Signal Description table from an Opencores FPU Spec

A text version of same document does not contain any tags and therefore cannot be used to classify/extract tabular data. The corresponding XML frag- ment of the document is shown below and contains the tags

, , and \n") 47 file.write("\n") 50 for x in range(0,len(access)): 51 x1=0; 52 y1=0; 53 p=str(bit[x]) 54 a= ’:’ in p 55 if a==1: 56 b=p[:3] 57 d=p[3:7] 58 if b >=31: 59 c= ’:’ in b 60 if c==1: 61 x1=b[0:-1] 62 else: 63 x1=b 64 if d >=0: 65 e= ’:’ in d 66 if e==1: 67 y1=d[1:3] 68 else: 69 y1=d 70 if y1>0: 71 for z in range(int(y1),int(x1)+1): 72 file.write("") 75 else: 76 file.write("") 79 file.write("") 80 81 def regmap_rsts(file,temp1,val,bit): 82 value=0 83 file.write("\n") 84 file.write("\n") 87 for x in range(0,len(val)): 88 tval=val[x]; 89 pval=tval[2:] 90 if pval.upper()=="A": 91 pval="10" 92 if pval.upper()=="B": 93 pval="11" 94 if pval.upper()=="C": 95 pval="12" 96 if pval.upper()=="D": 97 pval="13" 98 if pval.upper()=="E": 99 pval="14" 100 if pval.upper()=="F": 101 pval="15" 102 value+=int(pval) 103 file.write("") 110 file.write("") 111 112 def regmap_feld(file,temp1,fld,bit,des): 113 file.write("\n") 114 file.write("\n") 117 file.write("") 138 file.write("") 139 140 def regmap_strt(file,reg,offset,des): 141 file.write("
that identify a table, table row and table column data respectively. Thus, the XML tags aid in extraction of tabular data from the specification. 3.5 introduction to clips and xml 34

1 4.1 Interface

2

3 Input signals:

4

5

6

7

8

9

10

11

12

13

14

15

3.5 introduction to clips and xml 35 is-control Timing Generator can-use clock,output DMA INTERFACE mode, transfer type> mode, DATA TRANSFER INTERRUPT has -function is-extClk CLOCK is-a CPU Interface CPU is-a STATUS is-clock is-a CHECK may-have PARITY, CRC is-a is-a has-a RX RX DATA RX,TX FIFO STATUS is-rx has-a is-wrData is-rdData CONTROL DESERIALIZE Fragment of semantic network for peripheral interface domain : TX DATA 14 Extrernal Interface Extrernal RX RX FIFO Figure is-rdData is-tx is-wrData has-a SERIALIZE has-attr rx threshold, TX FSM TX FIFO has-a tx threshold,…> PARAMETERS TX-RX-LOGIC is-control depth, width, < has-a may-have has-attr RX RX FSM RX RX FIFO is-control LOOP BACK 4

SPECIFICATIONKNOWLEDGEBASE

abstract

In this chapter, we provide a detailed description of our specification anal- ysis methodology. We describe our technique of using ontology as spec knowl- edge representation scheme. We also discuss our method to automate ontol- ogy generation using our ontology builder tool. We provide details of our spec knowledge extraction scheme, which uses the spec extractor tool and the spec rule-base. We provide experimental results of specification analysis performed for FPU specs downloaded from opencores.org.

4.1 spec-kb

IP specs that conform to a particular design standard exhibit commonality of keywords, which describe their design features. These keywords and their relationships can be used to capture the specification for a design. A specifica- tion document has a regular structure. Hardware design specs generally have common labels for document sections such as Introduction, Functional descrip- tion, Register description, I/O port description and Block diagram. A spec can be broken down into the following components: text, tables and diagrams. In a spec, tables are generally used to provide register and in- put/output port descriptions. Timing diagrams are used to specify temporal behavior. State diagrams are used to describe finite state machine control logic. Block diagrams specify design structure. This acts as meta-data, which aids in

36 4.2 specification knowledge representation scheme 37

extracting salient features from a spec document. A specification document can be categorized as functional spec, which is used for design implementation, and data-sheet, which is a concise spec sum- marizing design features. The Spec-KB is built using specs of trusted designs. We perform spec analysis to extract features from a spec document and gener- ate a CLIPS fact based representation, which is then stored in the knowledge base. This allows us to perform spec to spec comparison and to store relevant information about a spec in a machine readable format. The key elements of our Spec-analysis methodology are: (a) the specifi- cation ontology, (b) the specification information extraction, and (c) the spec rule-base. Fig.16 provides an overview of Spec-analysis flow. In what follows, we describe the concept of ontology applicable to Soft-IP designs and each element of our spec analysis technique.

4.2 specification knowledge representation scheme

4.2.1 Specification Ontology

An ontology is defined as a knowledge representation model to explicitly represent a domain by defining its concepts, their attributes and relationships [64][65]. For Soft-IP designs, hierarchical functional decomposition of design behavior results in ontological concepts corresponding to function objects and their relationships. Ontologies can be developed for Soft-IP designs using standard specs. In this context, standards are published documents that establish specifications and procedures that are universally understood to ensure compatible func- tionality and interoperability. An authorized standardization body, like IEEE standards association, publishes such standards. A standard acts like a high- level specification and defines key concepts (functions and properties) for a 4.2 specification knowledge representation scheme 38

(word-data(word “floating-point”) (spec-id fpuV1) (location-id 0 3 4 1 0) (signature Part Sect P Statement Word)) (word-data(word “number”) (spec-id fpuV1) (location-id 0 3 4 1 1) (signature Part Sect P Statement Word)) (word-data(word “representation”) (spec-id fpuV1) (location-id 0 3 4 1 2) (signature Part Sect P Statement Word)) (word-data(word “Single”) (spec-id fpuV1) (location-id 0 3 4 1 2) (signature Part Sect P Statement Word)) (word-data(word “precision”) (spec-id fpuV1) (location-id 0 3 4 1 2) (signature Part Sect P Statement Word)) (word-data(word “32-bit”) (spec-id fpuV1) (location-id 0 3 4 1 2) (signature Part Sect P Statement Word))

Spec words as facts in CLIPS

IP Spec Spec Words as CLIPS Facts with (XML) ▪ location Tags ▪ Spec or english dictionary word ▪ Abbreviation or rtl word Spec-Extractor ▪ number or acronym IP RTL ▪ unknown (RTL words)

Word Knowledge Spec Ontologies ⁃ English dictionary Spec Rule-base ⁃ Custom Stop word FPU Location UART

… Existence Expert AHB Specification Function Knowledge-Base

Trusted Specs IO based (CLIPS)

Output ▪ spec coverage ▪ spec correspondence

Figure 16: Spec Analysis Flow

design. Soft-IP designs that are compliant to a standard have concrete behavioral correspondences. For example, every IEEE-754 compliant floating point unit (FPU) design should support the following modes: “round to zero”, “round up”, “round down” and “round to nearest even” [66]. Compliant FPU specs from all vendors should conform to the behavior listed in the standard. In our approach, an IP library of standard-based designs is built. The be- havior of a standard-based design is represented using a collection of its par- 4.2 specification knowledge representation scheme 39

tial specifications, which is captured in the KB system through design ontology and heuristic rules. Ontologies have been developed and added to the KB for some of the commonly used IP design standards. Fig.17 is an example of a fragment of ontology for FPU design. The FPU ontology was described to the Protégé tool and visualized through OntoViz tab [67]. We build ontologies for each design domain, which we define as a fam- ily of Soft-IP designs that have the same application, such as a bus interface domain. In the bus interface domain, which includes bus protocol designs like “AHB” and “Wishbone”, the basic design behavior is “on-chip data trans- action”. Such behavior is carried out according to a protocol specified by the standard [55][68]. There is abstract conceptual correspondence between de- signs in a domain. The correspondences are characteristics shared by every bus interface, for-example, master/slave attribute, finite state machine to gen- erate read/write control signals on the bus. Design experts can write rules for spec analysis based on behavior specified in standard specs and based on cor- respondences in a design domain. We have developed a knowledge representation scheme to capture hard- ware design ontologies and we term it as specification ontology. A spec on- tology helps in extraction of salient features of a design from textual design documents. The ability to extract and compare relevant information from a document is independent of the design vendor or writing style of the docu- ment’s author. 4.2 specification knowledge representation scheme 40 Fragment of ontology model for FPU design domain : 17 Figure 4.2 specification knowledge representation scheme 41

The spec ontology is a knowledge representation scheme for “text-objects” that occur as part of the text in specs. We define “text-objects” as words or phrases that specify functions, operations and properties for a design. Through analysis of different vendor specs, it was observed that for a de- sign, specs have commonality of text objects. An ontology is prepared by ex- perts through analysis of IP standard and multiple specs and is a superset of “text-objects” for a design. Each spec is represented in the KB by a unique CLIPS fact template, which is populated by “text-objects” that map to spec ontology. This representation enables us to compare the specification of a new design with existing designs in the KB. The following is a description of Spec ontology structure.

4.2.1.1 Spec Ontology Structure

An ontology consists of text-objects, their features and attributes organized in a hierarchy using relationships. Fig.18 provides an overview of an ontology fragment for FPU design using four level deep functional decomposition. The first level is the soft IP design domain along with its listed features. The sec- ond level has function objects. The third level consists of sub-function objects, which are further decomposed in terms of leaf level operations. This ontology structure is suitable for capturing specification of math-function soft IPs. For other domains, adding new relationships can further enhance the ontology structure. Object, relationship, feature and attribute are defined below.

object Objects are key concepts in a design domain through which the design behavior can be described. The root object represents the soft-IP design domain. The hierarchical decomposition of design behavior results in function and sub-function objects. A function object represents a stand-alone function within the domain, such as “floating point add” in a “floating point unit”. The sub- 4.2 specification knowledge representation scheme 42

Figure 18: Tabular representation of IEEE-754 Floating point ontology

functions do not implement a stand-alone function, but are used to implement bit level operations such as “barrel-shift logic” or “leading-zero logic”.

relationship The relationships between objects creates a conceptual net- work for a design domain, which describes its specification model. Function objects occur as anchor points in an ontology and other text-objects can be associated with the function using relationships such as “is-a-operation” or “is- a-property”.

feature and attribute Features are low level properties of an object. For example, precision is a feature of a floating-point object. An attribute is a value of a feature in a specification. For example, “single or double” are values of a feature, “precision”. The value type of feature can be “boolean, set, number” etc. 4.2 specification knowledge representation scheme 43

4.2.2 Automating Ontology Generation

Ontology is the knowledge representation scheme for spec text-objects in our methodology. We provide tools to assist design experts for ontology gen- eration. Fully automated approaches for ontology generation are exhaustive since entity and relation mining involves NLP and any NLP problem is AI- hard [69]. There is a large body of work in ontology generation that uses fre- quency based term extraction along with shallow NLP techniques [70][71]. A number of tools have been devised to aid ontology generation in a semi- automatic or in a hand-operated way. For example, in [72], the authors have developed a semi-automatic ontology editor called “OntoEdit”. Researchers from Stanford have developed an ontology-editing environment called “Pro- tégé” [67]. We have developed a semi-supervised expert system based methodology for generating ontologies from design specs [7]. Our approach automates the knowledge-extraction process through a concept-mining inference-system. A standard DB stores data in tabular format at a logical level, which does not effectively capture semantic knowledge associated with the data. An ontology based approach allows formulation of specification queries in natural language and is adaptable to changes in knowledge domain and user’s views. This is a key advantage as it removes the need for DB-Specific construct-language. Our tool is based on a concept-driven model to automate ontology gen- eration and can be executed semi-automatically or in full automation mode. When executed semi-automatically, the tool gives access to an expert designer to fully adjust all the entries of the ontology by accepting or rejecting the gen- erated suggestions from the tool. In case of full automation, the generated suggestions can be autovalidated by fine-tuning the confidence factors (CF). A CF varies between zero to one. The CF values are generated by our neuro- fuzzy concept based inference system (NEFCIS) using proximity and priority 4.2 specification knowledge representation scheme 44

scores [73]. A CF provides a metric to score relevance of a suggestion. For example, “leading-zeros” keyword is extracted from a FPU spec and has a re- lation “is-a-subfunction” to FPU with a CF = 0.85. Fig. 19 provides an overview of our ontology generation tool [7]. The tool can be used by design experts to generate domain ontologies.

Word Bags

Attributes Port Names Concepts Lexical Spec Sections NeuroFuzzy Document Spec Spatial System Analyzer Syntactic . . . NNP + NN

Relation Extraction Seed Ontology Template

Derived Validate Review Relations

Rectified Relations Expert Designer

Figure 19: Overview of Ontology Automation system

4.2.2.1 Ontology Building Process

The ontology building process consists of the following two steps:

feature extraction For extracting candidate entities, we use our NE- FCIS tool designed as a concept mining system [73]. NEFCIS is capable of extracting keywords in spec documents as concept graphs. We first filter com- mon words such as pronouns, conjunctions etc. by using a custom stop word dictionary. We then perform spec word frequency analysis and location analy- sis on a corpus of specs. Fig.20(a) shows a word cloud of words in a FPU spec, where the size of each word indicates its frequency. Fig.20(b) shows lexical dispersion plot for some design keywords in a FPU spec. It is observed that certain keywords such as “exceptions”, “inexact”, “overflow”, which are used to describe exception for a FPU design have location proximity. 4.2 specification knowledge representation scheme 45

(a) Word Cloud for a FPU specification based on Frequency

(b) Lexical Dispersion Plot for some Design Keywords in a FPU Spec

Figure 20: Frequency and Location based visualization of words in a FPU Spec

NEFCIS then combines various techniques like “fuzzy clustering”, “neu- ral networks” and “proximity distance matrices” to extract the concepts in the form of directed acyclic graphs (DAGs). The priority index of a node while building DAGs represents the relative importance of the node (word) in a design spec with respect to all specs in the domain repository (corpus). The proximity score between any nodes depicts the closeness between the nodes based on word/statement distance matrices and other deciding factors [7]. The concepts are generated to reduce the search 4.2 specification knowledge representation scheme 46

200 187

150 123 109 108 86 100 79 71 69 66 65 57 54 50 49 44 41 39 37 32 30 Suggestions 50 25 17 16 16 16 0 1 2 3 4 0 ieee 754 clearspeed dillon weitek altera Total Correct Incorrect Rectified Deleted

Figure 21: Ontology Construction: Statistics of Generated Suggestions [7] space and time complexity in mining relations between keywords, which is a crucial step of our ontology building process. Fig. 21 provides results of an FPU feature extraction process through concept mining of the following spec documents: IEEE-754 floating point standard [66] and FPU spec from Dillon engineering[74], Weitek [75], and Altera [76] respectively.

200

150

100

50 IEEE 754 clearspeed dillon Suggestions (Cumulative) weitek altera 0 2 4 6 8 10 12 14 Iterations

Figure 22: Iteration: Saturation Point [7]

Fig. 22 shows saturation points of ontology generation iterations. The per- formance of our proposed model was evaluated using 52 FPU spec documents (IP specs and data-sheets) [7]. 4.3 specification knowledge extraction scheme 47

relation extraction Relation extraction is a complex problem to re- solve and has turned out to be the main impediment to automate ontology gen- eration. The expert predefines essential relations in a domain such as is-a-function, is-a-exception, is-a-clock, is-a-interface, is-a-property, is-a-attribute. A valid relation is depicted by a corresponding edge between concept nodes. We perform relation mining with the help of prior domain knowledge as a seed template and visualize it as an edge search process on the concept graphs extracted during the feature extraction process.

4.3 specification knowledge extraction scheme

4.3.1 Spec-Extractor Tool

The spec information extraction is done through an internally developed tool called spec-extractor, which takes an XML format of specs as input. The specs are converted from PDF into an XML format using Adobe tools. Spec- extractor parses the XML spec document and generates a hierarchical tree of the document structure. Each word is a leaf node in the tree and the key idea is tracing back the hierarchy to the top most level. A unique location vector is generated for every word consisting of level numbers and corresponding signatures. The location vector represents a numerical value based on the XML tag hierarchy of the particular word with respect to the document. The location signature is essentially a one-to-one mapping of the location vector bits to the corresponding XML tag. This captured data is then output as CLIPS facts. The following is an example of a location vector and signature in a word-fact (word- fact(word ?floating-point?) (spec-id fpuV1)(location-id 0 3 4 1 0)(signature Part Sect P Statement Word))

The spec extractor also preprocesses the data by tokenizing and lemma- 4.3 specification knowledge extraction scheme 48

tizing the words. Frequency analysis is performed to generate tf-idf scores for keywords by calculating the term frequency, tf and inverse document fre- quency, idf, by comparing them against corpus documents [73]. tf refers to the number of times the word occurs in the specific spec document. Inverse document frequency is the sparseness of occurrence of the word across all the documents in a particular domain or all domains. By using these two metrics, tf-idf score is obtained for each word as shown below [7].

Our document space is defined as,

D = d1, d2, ..., dn where n is the number of specs in corpus. tf is a measure of how often a term appears in the document. It is often nor- malized to prevent a bias towards larger documents, as shown below:

nt tf(t, d) = (1) Nd where, nt = the number of occurrences of the term t in the document d and

Nd = total number of terms in the document. idf is a measure of the discriminative power of a term over a collection of documents [73].

|D| idf = log (2) t |d : t ∈ d| where |d : t ∈ d| is the number of documents where the term appears.

Then tf-idf is calculated as

tf-idft = tf(t, d) × idf(t) (3) 4.3 specification knowledge extraction scheme 49

A threshold is set and redundant and repetitive words are filtered ac- cordingly. idf scores equal to unity are filtered out along with stop words by the spec extractor. After pre-processing and frequency analysis, word are clus- tered into word-bags based on their attributes. Words are broadly classified into three attributes as shown in Fig 23.

Word Bags

Abbreviation s Numbers

Port Names Lexical Qualifiers Attributes Quantifiers

….

Table Data

XML Spec Spatial Sections Spec Metadata Extractor Attributes Headings Links

Conjunctions Frequency Analyzer …. Syntatic Attributes Negations NNP + NN NNP + VBD NN+NN+CD

NN+NNS+CD

Figure 23: Spec Word classification based on Lexical, Syntactic and Spatial Attributes

• Lexical Attributes: common English words, abbreviations, acronyms, num- bers, symbols, quantifiers, qualifiers, misspelled words etc.

• Syntactic Attributes: Every word can be associated with its corresponding Part-of-Speech (POS) like nouns, verbs, adverbs etc., or combinational patterns of POS for N-grams (1< N < 5) etc.

• Spatial Attributes: By looking at both the tags and position of a word in the metadata structure, we can group them into bags. e.g. words that belong to heading or title tags carry more weight than words that be- long to other tags. The location attributes carry important hierarchical 4.3 specification knowledge extraction scheme 50

information about the word’s position with respect to the document and facilitate easy proximity searching.

This captured data is then output as CLIPS facts which then gets ana- lyzed by spec rule base. The objects and features (defined by the ontology) are located in the document and the attributes are extracted that are specific to the document. The techniques to identify important information vary depend- ing on the type of the object/feature definition found in the ontology. Fig.16 provides an overview of spec extraction as part of specification analysis flow.

4.3.2 Specification Rule-Base

The spec rule-base captures the heuristic knowledge of a design expert. The rule-base can analyse a soft-IP spec by finding correspondences with the relevant design ontology. The general syntax of a spec rule is shown below.

1 ( = (IF THEN (ELSE )) = (AND{}) =(OR{} | (predicate )) = ( | | = ( ) 6 = ( ) = ( ) = {} | {} = ( )

The following are some important categories of rules.

location rules These rules use a location vector associated with spec words for,

• associating features with their attributes as listed in ontology.

• finding negative phrases associated with features.

• inferring objects based on location proximity of their low-level features. 4.3 specification knowledge extraction scheme 51

We also do location analysis to find any potential feature words that are not mapped to the ontology. For example, the unknown word “SQRT” in a spec can be classified as a missing function object when (a) it is part of a subsection heading, and (b) has location proximity to known functions from the spec ontology. This is used to further classify some of the unknown words generated by spec-extractor. The following is an example of a rule that is used to associate a feature with its attribute value.

(defrule MAIN::find-attribute (declare (auto-focus TRUE)) f1 <-(onto-fact (object ?obj)(feature ?f)(domain fpu) (relation ?rel) (type"set")(attribute$?attr)) f2 <-(word-fact (word ?word1&:(eq ?word1 (string-to-field ?f))) (location-id$?location1 ?word1loc)) f3 <-(word-fact (word ?word2&:(member$ (str-cat ?word2) (create$$?attr))) (location-id$?location1 ?word2loc)) 5 => (assert (spec-fact(spec-id ?*spec*) (object ?obj) (feature ?f)(attribute ?word2)(relation ?rel)(domain fpu) ))

function hints These rules identify specific design functionality based on pattern matching of low level operations and sub-functions. For example, existence of a look-up table function is used as a hint to infer the occurrence of a floating point divider. The IO names for bus protocol designs are used as hints to infer the associated bus interface function. The rule-base has multiple levels of inference rules. The first level of rules are based on functions, properties and attributes listed in an ontology and in- ferring them from a new specification document. We may have a partial match of features in a spec and certain features are more important as they provide hints for the existence of high level functions. The methodology has a confi- dence factor (CF) associated with function rules to support partial matching and accommodate expert knowledge about the significance of a design fea- ture. The following is an example of a heuristic rule to infer an FP adder when sub-functions leading zeros and carry save adder are extracted from specs.

(rule (if sub-function"leading zeros" is yes and sub-function"carry save adder" is yes ) 4 (then function"floating point adder" is yes with CF 0.8)) 4.3 specification knowledge extraction scheme 52

Function hint rules use design composition knowledge provided by de- sign experts to infer design properties based on the existence of leaf level op- erations. For example, the identification of leaf level operations such as logical shift right (LSR), is used to infer the containing design entity as a barrel-shifter. Further identification of multiplier and barrel-shifter components in a design block are used to infer execute stage of an ARM2 processor. Fig. 24 shows a fragment of design composition knowledge for an ARM2 processor, which is provided to the Spec-KB.

Figure 24: Fragment of ARM2 design composition knowledge

io property based The IO rules check for connectivity inferred for de- sign from the IO tables. Signal names specified for any standard based protocol are compared with the spec to flag any inconsistency in width, direction or sig- nal. Structural information from RTL is represented in CLIPS to include mod- ule names and their associated IO ports as facts. IO information is also ex- tracted from the IO table in specs and represented in CLIPS as IO facts. IO rules are then used to analyse if IO port names and their attributes listed in the spec exist in RTL for consistency checks. The following is an example of an IO rule which flags a spec signal missing in RTL. 4.3 specification knowledge extraction scheme 53

1 (defrule spec2rtl-io-mismatch (declare (auto-focus TRUE)) (spec-io -fact (is-a spec-signal)(spec-id ?spec) (label ?name)(direction ?d)(width ?w)(module ?m)) (not(rtl-io-fact (is-a rtl-signal)(label ?name)(direction ?d) (width ?w)(module ?m))) => (assert (spec2rtlMismatch (signal ?name)(mod ?mod))))

existence The existence type of rule checks for missing facts that de- scribe a function or property essential to a design. For example, “overflow prop- erty” for a FPU design. The existence rule checks if some required feature of a floating point standard is missing in Floating point specification. The follow- ing is an example of an existence rule which flags a missing spec feature.

(defrule MAIN::missing-feature(declare (auto-focus TRUE)) f1 <- (onto-fact (object ?obj) (feature ?feature)(relation ?relation) (standard"required") (domain fpu)) f2 <- (not (word-fact (word ?word&:(eq ?word)(string-to-field ?feature))))) => 5 (assert (spec-fact(spec-id ?*spec*) (object ?obj) (feature ?feature)(attribute missing)(relation ?relation)))

4.3.3 Metrics for Specification Analysis

We have defined some quantitative metrics to measure the degree of cor- respondences between domain specification ontology and a particular IP spec. The following are metrics that we have used.

spec coverage Spec coverage (SC) uses spec document structure. The rule-base uses the location tag of spec words that map to the ontology to an- notate the corresponding sections/subsections as being covered. In case RTL is available then RTL symbols like module name and IO names are also used to mark the sections as covered. A section is considered uncovered if it does not contain functions listed in the ontology or component names listed in RTL. Since functions are first level objects, inference of a function by spec analysis and its location in section text 4.3 specification knowledge extraction scheme 54

covers all lower level sub-functions. If a high level function cannot be directly identified but its properties and sub-functions are found in a subsection then the corresponding section is annotated with the function with a confidence level (CF) given by function hint rules. If the CF is below a threshold, the sec- tion is considered uncovered. Specs downloaded from Xilinx and Actel are data-sheets and we ignore sections with labels like References, Revision history, Support and Ordering infor- mation. Spec coverage can provide feedback to user about sections which have no correspondence with KB and need to be carefully reviewed. The coverage also acts as feedback to experts to add more rules to the KB or to improve the ontology structure. Spec coverage is calculated as shown below.

NannotSec SC = (4) NsecTotal where,

NannotSec = No. of sections in spec annotated by spec rule base,

NsecTotal = Total no. of sections in Spec

requirement coverage We assume that the spec ontology is a com- plete high level specification for the design domain. In the FPU ontology, we categorize all the 11 high level functions, 2 sub-functions (rounding/exception) and 3 properties related to IEEE-754 compliance as required features which should be listed in every floating point spec. The completeness of a spec is quantified using requirement coverage (RC) which is calculated as shown be- low.

NextrReq RC = (5) NdicReq where,

NextrReq = No. of required features extracted from the spec, 4.3 specification knowledge extraction scheme 55

NdicReq = No. of required features in the ontology

4.3.3.1 Spec Analysis Example

The FPU specification ontology has 115 entries with 11 functions, 15 sub- functions and 89 properties. The spec rule base is then used to find correspon- dences between the spec and the FPU domain ontology. The spec rule-base has general feature extraction rules and heuristic rules for the FPU domain. Table 2 listed below shows spec words extracted from FPU specs down- loaded from following IP vendors Opencores, Xilinx, Altera and Actel [77][63] [78][79][80]. The XML representation of specs is parsed by spec-extractor and spec words are grouped under various classifications as listed in Table 2. Table 3 provides specification analysis results for FPU specs. It lists num- ber of functions, and features extracted for each spec. The table also provides values for requirement and specification coverage metrics. It is observed that the IP Specs being analysed do not provide all the functions listed in the IEEE- 754 FPU standard and that is why RC is low. An IP requirement might be to support only a subset of IEEE-754 functions and the feedback provided by Ta- ble 3 can help an IP customer to compare the above FPU IP’s based on their supported features. Spec analysis can help a design engineer who is writing a spec to find the functions and features most commonly supported by other IP competitors. It can also help a validation engineer who is preparing a test plan to get feedback if any key FPU function or requirement is missing. 4.3 specification knowledge extraction scheme 56 % % % % % Requirement coverage 56 50 56 62 75 (RC) Unmatched 46 89 391 241 137 % % % % % Spec- coverage 75 80 60 86 67 stop 337 1366 2782 2523 772 words annotSec English 226 1055 1871 1997 406 words Sections annotated N 3 4 6 6 2 10 24 16 174 157 symbol secTotal Total Sections N 4 5 10 7 3 16 65 78 207 783 Number extrReq Required features extracted N 9 8 9 10 12 Spec word clusters : 2 Table Acronym & 24 50 314 280 202 Abbreviation Specification analysis results using Spec rule base : 3 funcExtr Table High-level functions extracted N 6 5 5 6 8 FPU Dict Matches 51 187 312 288 71 Spec 710 2889 6627 5551 1682 Words Features extracted 31 46 33 38 43 ] ] 77 63 ] ] ] [ [ 79 80 1 2 78 No. of Pages 6 23 32 17 11 1 2 Spec name fpuXilinx [ fpuGaisler [ fpuAltium [ fpuOpencores fpuOpencores Spec name fpuOpencores fpuOpencores fpuXilinx fpuAltium fpuGaisler 5

RTLKNOWLEDGEBASE

abstract

In this chapter, we provide a detailed description of our RTL analysis method- ology. The chapter describes our technique of using RTL-CLIPS as an RTL knowledge representation scheme. We discuss semantic equivalence between RTL in VHDL format and its corresponding RTL-CLIPS syntax. We also de- scribe our technique of building property based models for each IP design domain and using it for RTL knowledge extraction and analysis. We provide experimental results of RTL analysis performed for FPU IPs downloaded from opencores.org.

5.1 rtl-kb

IP vendors deliver soft IP RTL as a set of files, each of which generally corresponds to a design module. In our approach, we do a semantically equiv- alent translation of RTL code into CLIPS facts, which we term as RTL-CLIPS. The RTL-KB contains a database of previously analyzed trusted designs in RTL-CLIPS format and a RTL rule-base. Fig.25 provides an overview of our RTL analysis flow. In what follows, we describe each element of our RTL anal- ysis technique.

57 5.2 rtl knowledge representation scheme 58

IP RTL RTL to CLIPS RTL-CLIPS (VHDL) Converter

RTL-KB RTL Analysis OUTPUT • Pattern Matching • Annotation Reports • Evaluation of code fragments • Identification Coverage with CF • Register Verification Property Based • Register implementation Error Models • FSM Analysis • Assertion Mapping

RTL Rule base IP Spec • Register Spec • IO Spec

Figure 25: RTL Analysis Overview

5.2 rtl knowledge representation scheme

5.2.1 RTL-CLIPS

This format is a semantically equivalent translation of RTL code into CLIPS facts. RTL-CLIPS preserves the RTL code structure and it helps the rule-base to semantically and syntactically infer RTL properties. For example, the rule base can use code semantics to infer a function or generate some high level fact such as to identify an FSM. We have developed tools to perform RTL to CLIPS translation and a simulation environment for RTL-CLIPS [9]. Table 4 gives some examples of VHDL language elements and their CLIPS templates. We define two types of fact templates and instances of these tem- plates as facts represent RTL in CLIPS. The var template captures attributes associated with a signal/variable declaration. The stmt template captures at- tributes of a control/data operation. For example, inputs, output and type of operator used. Each fact, an instance of these templates, has a unique “id” and each has a “parent-id”, to maintain the block structure of the VHDL code. 5.2 rtl knowledge representation scheme 59

VHDL Element CLIPS Template

signal clk : std_logic; (var (parentid gen3) (id gen6) (text clk)(class signal)) ...

process (clk) (stmt (parentid gen13) (id gen17)(cat BLOCK CONC-SEQ)(ins gen6) ... (stmts gen19 gen20))

elsif rising_edge(clk) (stmt (parentid gen23) (id gen26) (cat SEQ IF) (ins gen6) (stmts gen27 then gen29))

cnt <= cnt + 1; (stmt (parentid gen26) (id gen27) (cat MATH ADD) (ins gen8 "1") (outs ... gen8))

Table 4: Examples of HDL represented in Knowledge Base

Stmt templates include a multislot cat, for category. A CLIPS “slot” holds one value whereas a “multislot” holds an ordered list of values. We de- fine the category as a path through a tree of commands. For example, “MATH ADD” for addition. The statements in a code block make references to their parent; however for blocks of sequential statements, we also define a stmts multislot in the parent, to give the order of execution. Within a process, flow of control constructs include sequential, conditional, loop and function. Sequential control is defined by an ordered list of ids in the stmts multislot of the parent stmt. These ids appear in the id slot of each child. Conditional and loop control are defined as a parent stmt with command cat- egory “SEQ IF” or “SEQ WHILE” and a conditional variable reference in the ins multislot and one or two ids in the stmts multislot. Function calls are de- fined as a stmt with command category “SEQ FUNC name” for the function name and ins and outs multislots with references to arguments and results.

5.2.2 Property Based Model

A property is denoted by a fragment of the specification, which contains some element of expected design behavior. In our approach, the behavior of a design is represented by the collection of its properties. The properties of 5.2 rtl knowledge representation scheme 60

trusted designs are captured in the KB through a property based model (PBM). The expert generates this model using a combination of the following notations (a) hypothesis about design behavior, (b) library of template code fragments, and (c) test vectors for expected input/output behavior. For an IP, its hierarchical functional decomposition results in behavioral functions, which at the highest abstraction level, are captured through the design-domain ontology. The PBM for a design is further refined by experts by providing template code fragments that act as a pattern for concept to code mapping. The functions and operations in an ontology correspond to a set of RTL code fragments (sequence of control/data operations), captured through rules in RTL-KB. For example, Table 5 lists some template code fragments and their annotations (words listed in corresponding domain ontology).

Code fragment Annotation Annotation (first level) (second level)

pclk and presetn annotated process block gets annotated

process (pclk or presetn) as clock and active low reset. as “clocked process”. if presetn= ’0’ then rdAdr <= "0"; elsif rising_edge(pclk) then

“up-counter” annotation

rdAddr <= rdAdr+1; wrAdr <= wrAdr+1;

rdAdr annotated as “read ad- further annotated as read

dout <= mem(conv_integer(rdAdr)); dress” pointer. The corresponding code blocks are annotated as pop logic

wrAdr annotated as “write further annotated as write

mem(conv_integer(wrAdr)) <= dataIn; address” pointer. The corresponding code blocks are annotated as pop logic

Table 5: Example - Template RTL code fragments and their annotations 5.2 rtl knowledge representation scheme 61

The properties of the CLIPS code are semi-automatically made into CLIPS rules with the assistance of a code analysis tool. The tool allows an ex- pert to provide an annotation for a fragment of RTL code. The user identifies the annotation and associates it with sample CLIPS facts from the converted RTL code. The tool then assembles the code fragment as antecedent and anno- tation as consequent into a set of CLIPS rules. The resulting rules then auto- matically annotate sections of trusted RTL code and low-level annotations are used for performing higher-level annotations. The expert’s skill in recognizing code fragments becomes part of the system and similar code fragments in un- trusted RTL get annotated with an equivalent concept. The concepts inferred by pattern matching rules are further confirmed through application of test vectors. We explain the PBM using an example for synchronous FIFO, shown in Fig. 26.

Figure 26: Property based model of a FIFO design 5.3 rtl knowledge extraction 62

example The model has a hypothesis about FIFO design composition in terms of its behavioral functions: “push data", “pop data", and “exceptions". The expert knowledge about a FIFO design is also captured. For example, syn- chronous FIFO is categorized as a single clock-domain design. The template code fragments associated with the model as shown in Table 5 provide hints for the existence of these behavioral functions.

5.3 rtl knowledge extraction

5.3.1 RTL Rule Base

The RTL rule-base captures heuristic knowledge of design experts. The KB keeps on improving as more designs are analyzed and more rules get added to capture variations in RTL implementation. This increases the accuracy of the rule based inference process. The following are descriptions of various rule categories:

syntactic rules This rule-set infers common design concepts like coun- ters, memory components, FIFO, FSM etc. A “process” in VHDL get annotated as sequential, combinational, control-only, and for existence of arithmetic op- erations. These rules also perform custom RTL lint checks. The following is an example of syntactic lint rules.

Pseudo Rule : a) Generics should have default value assigned in entity declaration. b) Input signals to the design should be registered. c) Output signals from the design should be registered outputs.

behavioral analysis rules These rules identify properties of an un- trusted RTL by finding correspondences with RTL KB. The inferences done by rules at lower level are used to perform higher level inference. Each rule uses a 5.3 rtl knowledge extraction 63

combination of template code fragments as a pattern and on successful firing provides an annotation. For example, following is a RTL code fragment that implements count leading zeros (LZ) subfunction. The associated pseudo rule which gets implemented in CLIPS to infer a LZ function is also listed.

--"RTL code fragment 1 for identifying LZ function" elsif (fracAddOut_s3(31 downto 28)= "0001") then tmpOUT := "00010"; elsif (fracAddOut_s3(31 downto 27)= "00001") then tmpOUT := "00011"; --"Pseudo-rule: infer leading zeros function" --1) A block of code in a combinational process which has multiple condition -- statements or loop construct with common condition variable, (say x). --2) x is compared against a constant value. If the condition is true, a variable -- (say y) gets updated. --3) When control falls from one condition statement to another the value of y -- keep on incrementing by a constant value.

CLIPS format of the LZ pseudo rule.

1 ( defrule FPU_BEHAV_10 : : LEADING−ZERO−ANNOTATE (declare (auto−focus TRUE)) (stmt (cat BLOCK)(id ?f1pid) (stmts ?f 1 i d ? f 2 i d ? f 3 i d ) ) (stmt (parentid ?f1pid ) ( id ? f 1 id)(cat RANGE) (text ?f 1 txt&:(member$ ?f 1 t x t ( cr eate $ TO DOWNTO)))(ins ?sigID ?rangeID1 &:(stringp?rangeID1 ) ? rangeID2&??rangeID1 &:( stringp ? rangeID2 ) ) ( outs ? f1out ) ) (stmt(parentid ?f1pid ) ( id ? f 2 id) (cat MATH) (text ==) (ins ?f1out ? f 2 i n 2 &:(stringp ? f 2 i n 2 ) ) ( outs ? f2out ) ) 6 (stmt (parentid ?f1pid ) ( id ? f 3 id) (cat SEQ) (text IF) (ins ?f2out ) ( stmts ? f3stmt1 ? f3stmt2 )) (stmt (parentid ?f 3 i d ) ( id ? f3stmt1 ) (cat BLOCK)(stmts ?f4stmt1 )) (stmt (parentid ?f3stmt1 ) ( id ? f4stmt1 ) ( c a t MATH) ( t e x t ASSIGN) ( ins ? f3I n ) ( outs ? f 3 i t ) ) ( t e s t (= (+( −( string−to−field ?rangeID1 ) ( string−to−field ?rangeID2 )) 1) ( s t r−index" 1 " ? f 2 i n 2 ))) 11 => ( bind ?process (find−process ? f1pid ) ) ( a s s e r t (inference (module ?module)(process ?process) (annotation"LZ")(cf 0 . 9 )))

The KB system keeps on improving as more designs are analysed and rules get added to capture variations in RTL implementation. For example, if the KB contains FPU designs with different RTL implementations of an LZ 5.3 rtl knowledge extraction 64

function, then each of those different code fragments can be used as patterns for rules to infer an LZ function. The addition of new designs and associated knowledge to the KB increases the accuracy of the rule based inference pro- cess. The rule-base first identifies leaf level operations from RTL and uses those results to identify higher level functions. The following is an example of a rule that identifies logical left shit (LSL) operation from a VHDL code fragment.

1 ( defrule MAIN: : i n f e r−LSL (stmt(parentid gen0 )(cat DESIGN)(text ?module)) (stmt(cat CONST)(text ?x&?:(str−index 1 ?x)) (outs ?y)) (stmt(parentid ?p)(cat MATH CONCAT) (ins ?f 2 i n 1 ?y)(outs ?out1 )) (stmt(parentid ?p)(cat MATHWHEN)(ins ?cmpResult1 ? out1 ? f 3 i n 2 )) 6 (stmt(parentid ?p)(cat MATH ==)(ins ?sel ?const1 )(outs ?cmpResult1 )) (stmt(cat CONST)(text ?constVal1 &:(eq(string−to−field ?constVal1 ) ( s t r−length (proper−str ?x)))) (outs ?const1 )) => ( a s s e r t (inference(module ?module)(function LSL)(cf 0 . 9 ))))

register meta-data rules An IP has programmable registers that are generally specified in a tabular format. We define a register description tem- plate that uses meta data tags for register specification. Each register in the spec is specified using meta-data tags to capture its name, address, reset value and access type. The register meta-data rules identify mismatches between reg- ister specification in spec documents and register implementation in RTL. For example, inconsistency in register label/address etc.

i/o port rules For each design domain, an expert associates a label with signal names to map names from different vendors to an equivalent con- cept. For example, for FIFO designs “push" and “write" signals are labelled as “fifo write". This is captured in an I/O label dictionary. For a new design, automatic port name resolution is performed using stem- 5.3 rtl knowledge extraction 65

ming and lemmatization techniques [81]. This associates each port name with an equivalent concept from the I/O label dictionary. The generated I/O label file is reviewed by a user and is provided as an input to the rule-base.

datapath rules These rules use design composition knowledge pro- vided by experts in PBM. These rules annotate unidentified code blocks us- ing annotation information of neighboring code blocks. For example, for a “FPU Add" function in the PBM, its datapath has “fraction addition (FrAdd)" subfunction followed by “leading zeros (LZ)" subfunction and then “fraction left-shift (FrLS)" subfunction [63]. If two code-fragments in RTL are annotated as "FrAdd" and "FrLS", then the data dependency is analyzed to annotate an associated code fragment as an “LZ" subfunction. The CF provided by data- path rules is low, as functional annotations are not directly inferred for a code fragment, but use data-path knowledge to associate an annotation with a code fragment. In Figure 27, which shows a fragment of a process dependency graph (pdg) for FPU, process P0 and P2 are annotated with “fraction add” and “frac- tion left shift” subfunctions respectively. The process P1 remains unannotated as the antecedent code pattern for LZ rule does not match with the RTL. In that case, “FPU add datapath” rule annotates P1 with “LZ subfunction”.

evaluation rules In our approach, a CLIPS program is run to simulate the execution of the VHDL code. The KB has reference test-vectors associated with each behavioral function and these are developed as part of trusted de- signs in the KB. The behavioral analysis and data path rules first identify enti- ties in an untrusted RTL that have matchings with functions in PBM. The IO port rules further provide concept labels to RTL signals of third party IP. The rule-base then generates input test values for an entity in untrusted RTL using a test vector in KB and IO concept labels. The user reviews the input values 5.3 rtl knowledge extraction 66

Figure 27: Fragment of pdg for floating point add function

before they are applied as evaluation rules to simulate third party IP. The evaluation of VHDL involves implementation of bit level VHDL func- tions in CLIPS. A library of CLIPS functions for implementing VHDL bit level operations has been developed. For example, CLIPS equivalent of bit-select operation in VHDL is implemented through other leaf level functions such as bitvector: a CLIPS multifield variable consisting of zeroes and ones repre- senting binary with most-significant-bit first. Also, lower level functions are implemented for conversion between a bit-string and two’s complement bit vector, such as frombitvec and tobitvec. The following is CLIPS code of a bit- select function, which uses other leaf-level functions.

(deffunction BITSELECT (?val ?pos1 ? pos2 ?wIn ?wOut) ( bind ?num (frombitstring ?val)) ; ( bind ?num (tobitvec ?num ?wIn)) ( i f ( neq (+ (− ? pos1 ? pos2 ) 1 ) ?wOut) then 5 ( printout t"Mismatch in Operator width" c r l f ) ( e x i t ) ) ( bind ? pos1 (− 32 ? pos1 )) ( bind ? pos2 (− 32 ? pos2 )) ( bind ?val (subseq$ ?num ?pos1 ? pos2 )) 10 ( bind ?val (frombitvec ?val))) 5.3 rtl knowledge extraction 67

5.3.2 RTL Evaluation in CLIPS

Simulation is carried out by CLIPS rules that represent the semantics of VHDL. Clocking and test vectors are represented by the “waveform” template, which includes a “var” slot for the id of the variable represented, a “vals” mul- tislot, and a boolean “is-out” slot. An input “waveform” includes a value from the “vals” multislot to be clocked into the variable with each cycle. An output “waveform” has the variable value clocked out to the “vals” multislot with each cycle. At the beginning of simulation, input waveforms are full; at the end, output waveforms are full [9].

5.3.2.1 Simulation of ITC99 Benchmark Circuits

To demonstrate the simulator, we have carried out validation tests using the first six ITC99 benchmarks [82]. The tests were performed for particular test vectors. The outputs and other signals were verified for correctness. Table 6 reports for each machine cycle and benchmark, the abbreviated name of the state of the state machine and the number of CLIPS rules fired, which varied from 44 to 361. These VHDL benchmarks range from one to five pages of code. The longest of these was b05, which also needed a CLIPS template and rule to represent reading a ROM. This benchmark required about 20,000 rules fired to exhaust its 32 element ROM [9]. The RTL simulator within CLIPS can aid design engineers, perform- ing local evaluation of RTL code fragments without the requirement of build- ing a complex verification environment. This approach augments the pattern- matching capability of CLIPS with an event-based RTL simulator. The en- hanced CLIPS expert system shell is employed to better approximate design behavior to perform IP quality checks by doing rule-based RTL analysis. 5.3 rtl knowledge extraction 68

Cycle b01 b02 b03 b04 b05 b06 reset 82 66 121 90 361 88 1 a 70 A 59 I 74 A 69 st0 122 init 83 2 f 79 B 57 R 89 B 107 st1 58 wait 70 3 g 93 C 64 A 98 C 124 st1 198 enin 90 4 wf1 107 G 92 R 111 C 124 st2 172 enin_w 91 5 e 60 E 72 A 113 C 124 st3 135 wait 70 6 f 79 B 57 R 89 C 124 st4 139 intr_1 77 7 g 93 F 79 A 100 C 124 st3 135 intr 98 8 wf1 107 G 92 R 113 C 124 st4 139 intr_w 105 9 e 60 A 44 A 120 C 124 st3 135 wait 70 10 f 79 B 57 R 92 C 124 st4 146 intr_1 77 11 g 93 C 64 A 120 C 116 st3 144 wait 70 12 wf1 107 G 92 R 92 C 116 st4 139 intr_1 77

Table 6: Test results for six ITC99 Benchmarks [9]. State names and CLIPS rules fired per machine cycle.

5.3.3 RTL Analysis Example

identification coverage Coverage is an important concept in RTL de- sign verification and is defined in terms of code/functional coverage metrics. The coverage metrics in our case concern functionality identification coverage, thus our metrics are expressed in terms of confidence factors. We identify the functionality of soft IP design modules based on the existence of their be- havioral properties. This process does not necessarily guarantee valid design behavior. Therefore we cannot use traditional coverage metrics such as code coverage. For quantifying our results, we use functional identification (Id) cov- erage as a metric, which is the percentage of functions listed in the PBM model that can be inferred from an untrusted RTL. The RTL analysis is performed for FPU IPs downloaded from opencores.org. The FPU PBM has 11 functions, 15 subfunctions and 89 features. In Table 7, the Id coverage for each IP is proportional to number of high level design functions 5.3 rtl knowledge extraction 69

inferred. If a function gets inferred but all of its subfunctions and properties cannot be inferred then CF for a function is low and it decreases overall CF. The CF listed for each IP is the average confidence of the rule-base about the inferences performed for the IP.

Design Information Analysis results IP Name No. of No of Input Output No. of Properties Identification Overall Design lines of ports Ports rules identi- Coverage Confi- Modules code fired fied dence Factor fpuOpencores1 11 1176 5 9 69 34 70% 72 % [77] fpuOpencores2 14 2396 5 11 82 42 77% 80 % [63] fpuOpencores3 24 3259 4 1 31 15 55 % 56 % [83] fpuOpencores4 7 1912 7 7 46 22 68 % 63 % [84]

Table 7: RTL Analysis results using RTL rule-base

Fig. 28. provides an example of based annotation report that was generated for FPU. If the Id coverage for a third Party IP is low, then it is a hint to the user about possible design quality issues. The user can review the annotation reports to find the design properties listed in the PBM but missing in the third Party IP.

Figure 28: Html annotation report 6

SPECIFICATIONANDRTLCORRESPONDENCE

abstract

In this chapter, we describe our back-annotation technique to perform spec- ification to RTL correspondence. We also describe how we process tabular objects from specification documents to generate test cases for RTL analysis. Finally our approach to process drawing objects from specification documents is discussed.

6.1 back annotation

The objective of back annotation is to map RTL modules to the correspond- ing sections in the spec. We assume that the spec has an IO port list speci- fied for each RTL entity. The spec analysis method uses location vectors of text-objects to annotate the corresponding spec sections/subsections. The RTL modules get annotated by the RTL analysis method. A particular spec section to RTL entity/module correspondence is established through the existence of module name, matching annotations and IO port list in that section. For exam- ple, in Fig. 29 #1,#2,#3 refer to back-annotation of RTL entity/ports to sections in the spec. Finally, design properties annotated to the section are matched against RTL annotations for the entity. A CF is assigned for both complete matches and par- tial matches of the annotations. The back-annotation follows a bottom up pro- cedure, where CFs generated for matching lower level modules are summed

70 6.1 back annotation 71 and averaged progressively to find the CF for a higher level module. Fig. 29 provides an overview of the back annotation process

Figure 29: Back Annotation overview

Back-annotation is aided by register specification analysis and IO port analysis. Specification drawing objects are also analyzed to perform specifi- cation vs. RTL correspondence. In what follows, we describe each of these techniques.

6.1.1 Specification Tabular Objects

Specification tabular objects are generally register description tables and IO description tables. We have defined templates that act as a knowledge rep- resentation scheme for IO and register data.

6.1.1.1 IO template

The IO port description for every design block is normally provided as tab- ular data in the specification. We propose an IO template that has meta data 6.1 back annotation 72

tags to associate logical name with every physical IO name and also provides width, direction and source module for each IO port signal. Fig. 30 provides an overview of the IO specification template. The IO tables from the specification document are extracted to perform a comparison against IO implementation in RTL. The IO table for a register inter- face module is used along with register specifications to generate UVM based test cases for IPs with the AHB/APB bus protocol interface. The IO specifica- tion is also converted into IP-XACT XML format so that the IO specification can be imported into third-party tools such as Kactus [85]. IP-XACT XML description files are also available for soft -IP’s from IP vendors e.g. AMBA design kit from ARM [55]. The following is an IP-XACT XML description of “i_pwdata” input port.

1

2

3 i_pwdata

4

5 in

6

7 31

8 0

9

10

11 ’0’

12

13

14

15 6.1 back annotation 73

Signal'Name Field BIT Direction Source Active Type Logical'Name Constraint Comments i_pclk 1 in system clock pclk apb Clock i_presetn 1 in system L reset presetn apb reset i_pwrite 1 in apbBridge H level pwrite apb write enable i_paddr 12:2 in apbBridge bus paddr apb address i_pwdata 31:0 in apbBridge bus pwdata apb write data i_penable 1 in apbBridge H level penable apb enable i_psel_uart 1 in apbBridge H level psel apb peripheral select i_uart_clk 1 in system clock module clock uart clock i_uart_rst_n 1 in system L reset module reset uart reset synchronous to uart clock i_cts_n 1 in system L level uart cts host clear to send i_rx 1 in system H level uart rx uart receive input o_uart_pack 1 out H bus pready apb acknowledge o_prdata 31:0 out H level prdata apb read data o_rts_n 1 out L level uart rts uart request to send o_rxInt 1 out H pulse rx Int uart receive interrupt o_txInt 1 out H pulse tx Int uart transmit interrupt o_rxFullInt 1 out H level rx Full Int uart receive full interrupt o_tx 1 out H level uart tx uart transmit output

Figure 30: Proposed IO Description Template

The IO description template can also be processed to generate a block diagram view of the design using the Graphviz package [86]. A block diagram view as shown in Fig. 31 is generated for the AMBER ARM2 IP (downloaded from open core.org). The IO specification for the ARM2 IP is provided using our proposed IO description template. The block-diagram view can be used to review port con- nections between sub-blocks in a design to discover any discrepancy in the IO specification.

6.1.1.2 Register Description Tables

Registers are generally informally specified as tabular data in a specifica- tion and act as a programmable interface for an IP design. Register verification is a laborious process. Generally for verifying a single register several lines of validation code are written. The validation engineer has to change test cases as per new register specification to validate the RTL every time there is a specifi- cation change. This requires much manual effort and the process is error prone. The register specification of an IP is changed several times during design de- velopment. Due to human error, there can be versioning issues between Spec and RTL, where RTL register modification is not reflected in the specs or the specs are not consistent with current RTL register implementation. 6.1 back annotation 74

a23_core

o_data_access i_data_access

o_byte_enable i_byte_enable

o_exclusive i_exclusive

o_address_nxt i_address_nxt

o_address_valid i_address_valid

i_address o_address

o_fetch_stall i_fetch_stall

o_priviledged i_priviledged

o_write_enable i_write_enable

o_write_data i_write_data o_multiply_done i_multiply_done o_execute_status_bits i_execute_status_bits o_adex i_adex i_execute_address o_execute_address o_copro_write_data_wen i_copro_write_data_wen o_status_bits_firq_mask_wen i_status_bits_firq_mask_wen o_status_bits_irq_mask_wen i_status_bits_irq_mask_wen o_status_bits_mode_wen i_status_bits_mode_wen o_status_bits_flags_wen i_status_bits_flags_wen o_reg_bank_wen i_reg_bank_wen o_pc_wen i_pc_wen o_base_address_wen i_base_address_wen o_write_data_wen i_write_data_wen o_firq_not_user_mode i_firq_not_user_mode o_user_mode_regs_store_nxt i_user_mode_regs_store_nxt o_user_mode_regs_load i_user_mode_regs_load o_reg_write_sel i_reg_write_sel o_status_bits_sel i_status_bits_sel o_byte_enable_sel i_byte_enable_sel o_pc_sel i_pc_sel o_jtag_pc (a23_execute) o_address_sel i_address_sel o_wb_adr (a23_fetch) o_interrupt_vector_sel i_interrupt_vector_sel o_multiply_function o_wb_sel (a23_fetch) i_multiply_function o_alu_function o_wb_we (a23_fetch) i_alu_function o_barrel_shift_function i_barrel_shift_function o_wb_dat (a23_fetch) o_barrel_shift_data_sel i_barrel_shift_data_sel o_wb_cyc (a23_fetch) o_barrel_shift_amount_sel i_barrel_shift_amount_sel o_wb_stb (a23_fetch) o_rn_sel i_rn_sel o_rds_sel o_cpuwait (a23_fetch) i_rds_sel o_rm_sel i_rm_sel o_data_access_exec i_data_access_exec o_exclusive_exec i_exclusive_exec o_condition i_condition o_shift_imm_zero i_shift_imm_zero o_imm_shift_amount i_wb_err i_imm_shift_amount o_imm32 i_firq i_imm32 o_status_bits_firq_mask reset_b i_status_bits_firq_mask i_wb_ack o_status_bits_irq_mask i_status_bits_irq_mask a23_execute i_clk o_status_bits_mode i_status_bits_mode i_irq o_read_data_alignment i_irq i_wb_dat i_read_data_alignment a23_multiply i_firq a23_decode o_read_data i_read_data a23_register_bank i_system_rdy a23_fetch i_system_rdy i_wb_dat i_clk a23_barrel_shift

i_wb_ack i_clk a23_alu i_wb_err

reset_b i_clk reset_b

reset_b

o_fetch_stall i_fetch_stall

i_fault_address

i_fault_status

i_fault

i_copro_read_data i_copro_write_data o_copro_read_data

i_copro_operation

i_copro_num

i_copro_crm

i_copro_crn o_read_data i_read_data

i_copro_opcode2 i_copro_opcode1 a23_coprocessor

i_cacheable_area o_cacheable_area i_cache_flush o_cache_flush i_cache_enable o_cache_enable i_fetch_stall i_clk reset_b

Figure 31: Block diagram generated for ARM2 Core using GraphViz package

We have developed a register description scheme to provide specification for register logic using meta-data tags. It can help in automation of register test case generation and generate html documentation of registers. Any changes in register description which are not reflected in RTL can be easily flagged by these test cases. Fig.32 is the proposed register description template that can be used for soft IP register specification. There are meta data tags associated with each register 6.1 back annotation 75

to capture its address, reset value and the description of register fields. The following is an IP-XACT description of the TDATA register, which is automat- ically generated from the template [51].

1

2 TDATA

3 UART Transmit Data Register

4

5 0x8

6 32

7 true

8 read-write

9 0x0

10

11 RSVD

12 8

13 24

14 read-only

15

16 TX_DATA

17 Transmit Data value

18 0

19 8

20 read-write

21

22

IP-XACT representation helps in storing registers in a standard XML format which can also be processed by third party tools such as Kactus [85]. Fig.33 provides an html view of register specification generated from the register template. 6.1 back annotation 76

table_begins version date author comments 0.1 Junel)24)2014 Bhanu)Singh Draft)Version

table_begins base_address IP name module name 0x00000000 uart uartRegIF table_begins register address_offset field_name reset_value bit access_type definition register_begins RX_SLOTS 0x1C UART)Receive)FIFO)filled)up)slots RSDV8 0x0 )31:6 RO Reserved Error)Indicator)Bit)(frame,)break)or)parity)error)) 0=)All)bytes)in)the)receive)FIFO)have)been)received)without)error.) ERROR_IN_FIFO_DATA 0x0 5 RO 1)=)At)least)one)byte)in)the)receive)FIFO)has)been)received)in)error. number)of)valid)data)present)in)the)UART)receive)register.)The)reset) value)for)this)register)is)0x0)corresponding)to)no)readable)data)present. FULL_SLOTS 0x0 )4:0 RO

register_begins CONTROL2 0x20 UART)Control)2)Register RSVD9 0x0 )31:3 RO Reserved Transmit)FIFO)reached)threshold)interrupt)enable.) 0)=)Transmit)FIFO)reached)threshold)interrupt)is)disabled.) 1)=)Transmit)FIFO)reached)threshold)interrupt)is)enabled.)When)this) interrupt)is)enabled,)an)interrupt)is)raised)whenever)the)number)of) TX_RCHD_THRES_INTR_EN 0x0 2 RW entries) Status)read)enable.) 0)=)status)read)is)disabled.)On)reading)the)receive)data)register,)only) received)data)is)returned.) 1)=)status)read)is)enabled.)On)reading)the)receive)data)register,)data) STATUS_READ_EN 0x0 1 RW along)with)its)associated)break,)parity)error)and)frame)error)s 0)=)UART)is)disabled),)1)=)UART)is)enabled.)This)bit)should)be)set)after) UART_EN 0x0 0 RW programming)all)UART)registers

Figure 32: Register Specification Template

6.1.1.3 Register Access Tests

The Register and IO specification using proposed templates provide us meta- data for each register and associated bus-interface protocol for the design. We process the meta-data associated with each register to generate a UVM based test environment for register access testing. Fig.34 provides an overview of au- tomatically generated test bench structure. Register access tests are generated to test the reset value of each register and to test the register access specifica- tion. For example, a read only (RO) access field in a register spec is checked to confirm that RTL implementation of the register is also a RO field. In Fig.34, the following is description of various sub-blocks of the UVM test bench.

• The “Register-Sequence” is a basic read-write sequence block, which gen- erates and compares register commands.

• The “Register model” block models the registers specified for the design under test (DUT). The register coverage is also implemented in the same model and memory mapping is also described in the model. 6.1 back annotation 77

version date author comments 0.1 Junel 24 2014 Bhanu Singh Draft Version base_address IP name module name 0x00000000 uart uartRegIF

TX_THRESHOLD Threshold value for transmit FIFO 0x24 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R R R R R access type RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO W W W W W reset value 0x00000 [ 31:5] RSVD10:

Reserved

field [ 4:0] TX_FIFO_THRES:

Number of entries that should be in the transmit FIFO. When the number of entries are equal to or below this programmed value, a transmit interrupt is raised. The value to be programmed in this register should be maximum of (16)d.

RX_THRESHOLD Threshold value of Receive FIFO 0x28 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R R R R R access type RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO RO W W W W W reset value 0x000012 [ 31:5] RSVD11:

Reserved

field [ 4:0] RX_FIFO_THRES:

The number of elements that should be in the receive FIFO. When the number of entries in the receive FIFO are equal to or more than the value programmed in this register, a receive interrupt is raised. The reset value of this register is (14)d, which corr

Figure 33: HTML view of register specification

• The “Reg2Bus” block converts register transactions to bus transactions and is used in register model for comparison.

• The “Base Packet” block generates basic address and data, which is used in reading and writing.

• The “Monitor” block monitors and checks the protocol signals and looks for violations and passes the transaction to a scoreboard through analysis port.

• The “Sequencer” block converts the base packet sequence to bus transac- tions and passes this transaction to a driver by sequencer-driver connec- tion mechanism.

• The “Driver” block actually drives physical signals to the DUT. It un- packs the transaction and assigns transaction values to the actual DUT with the help of virtual interface.

• The “Interface” block is the basic DUT and testbench connection inter- face. 6.1 back annotation 78

Register/IO Table (Spec as XML) Spec-Extractor Register or Sequence Register/IO Description (XLS)

Coverage Scoreboard Block Register Model

UVC Agent Reg2Bus Monitor

Interface Driver Sequencer Base Packet

Figure 34: Register Verification Test bench

6.1.2 Specification Drawing Objects

We define drawing objects as finite state machine (FSM) diagrams and block diagrams. We assume that the diagrams are available as scalar vector graphics (SVG), which is an XML based vector-format for two-dimensional graphics. The SVG specification is an open standard developed by the World Wide Web Consortium (W3C) since 1999 [87][88]. Standard shapes are predefined in SVG as a convenience for common graphical operations. Specifically: “circle”, “ellipse”, “line”, “polygon”, “poly- line” and “rectangle”. Commercial drawing software such as “Microsoft Visio” [89], “Omnigraffle” [90] and open-source drawing software “Dia” [8] are some of the popular tools used in industry for drawing diagrams. The diagrams drawn in each of the these tools can be saved in SVG format. We assume that FSM and block dia- grams are exported from above tools in SVG format and are available as part of IP database. If the specification is written using a word-processor program, 6.1 back annotation 79

and the diagram is an embedded Visio object, then the diagram can be accessed within the document and stored in SVG format [89]. Fig 35 is an example of an FSM drawn using dia tool.

Figure 35: FSM diagram drawn in Dia Tool [8]

The following is a fragment of a SVG based XML representation of the above diagram.

1 2 3 ... 4 5 6 ... 7 IDLE 8 9 10 11 12 ... 13 SHIFTING 14 15 16 17 6.1 back annotation 80

18 ... 19 CNT_EXPIRE 20 21 22 23 24 ... 25 IDLE_FC 26 27 28 ...

In our technique, the SVG diagram in XML format is parsed and specifi- cations for FSM are extracted as shown in Fig.36.

Review

SPEC FSM Spec svg2nusmv fsmExtractor (FSM as SVG) (.txt file) Translator

Output FSM nuSMV tool any deadlock states etc (.smv file)

Figure 36: FSM specification extraction from SVG diagram

The extracted FSM can be reviewed and then automatically converted into nuSMV format [91]. The FSM in Fig 35 is automatically extracted (see Chapter Appendix B) into nuSMV syntax and is analyzed for any deadlock states.

6.1.2.1 Timing Diagrams

Timing diagrams consist of waveforms, which specify temporal relation- ships between signals. In specification documents, timing diagrams are used to specify temporal behavior of interface logic between blocks. We assume that Timing Diagram Markup Language (TDML) is used to represent timing dia- grams. TDML is an XML format for storing timing diagrams. TDML has been developed by an Electronic Component Information eXchange (ECIX) Working 6.1 back annotation 81

Group under the management of the Silicon Integration Initiative (Si2)[92]. Fig. 37 shows an example timing diagram and Fig. 38 shows corresponding fragment of its TDML XML.

Figure 37: Example Timing Diagram

Figure 38: Corresponding fragment of TDML XML

Timing diagrams as raster images are not tool consumable. We use Timing- Tool to draw timing diagrams, which stores it in TDML format [93]. TDML XML is then parsed to extract value of each signal for each clock cycle to get the waveform. The waveform is used to generate a SystemVerilog assertion sequence. The sequence is added as a cover group, which can be added to functional coverage bins. Properties are based on edge relationships between signals and annotations in TDML. The purpose is to have the test-bench cover the waveform sequence in the specs. Any future changes in RTL should con- form to waveform sequence in the specs or specs should be modified. Fig. 39 shows a timing diagram of the Wishbone interface drawn using TimingTool and the same behavior being checked in RTL using generated assertions. 6.2 results: spec and rtl correspondence 82

Timing Diagram using TimingTool

Simulation of generated Assertions

Figure 39: Wishbone Interface timing diagram drawn using TDML tool and verification of generated assertions in simulation

6.2 results: spec and rtl correspondence

We have developed a prototype KB system based on the CLIPS inference engine for the following design domains: FPU, ARM2 and Timer. With our industrial collaborators, we developed trusted designs (Specs & RTL), spec on- tologies and Spec & RTL rule-bases for these design domains. The FPU, ARM2 and Timer spec ontology contained 115, 134 and 39 features respectively. We obtained vendor FPU IPs, AMBER ARM2 IP and Timer IP from opencores.org. We considered each vendor IP as untrusted design. We performed analysis of the spec and RTL for each untrusted IP. Table 8 provides spec analysis results. The table lists (a) spec extractor output as number of words extracted from XML version of each spec, and (b) their classification as spec ontology, English dictionary word etc. Then the spec rule-base performs location and function analysis. The table also lists the number of functions and features inferred for each spec, and the spec coverage metrics. Spec coverage provides feedback to the user about spec sections of the 6.2 results: spec and rtl correspondence 83

untrusted IP that have no correspondences and need to be carefully reviewed. A low spec coverage also acts as feedback to the KB developer to add more rules and to improve the spec ontologies. Table 9 provides RTL analysis and back annotation results. The RTL to CLIPS translation was automatically performed for each IP. The table lists number of RTL CLIPS facts, rules fired and inferences done for each IP. The function inferences refer to the number of behavioral functions being success- fully inferred, e.g. FPADD in FPU domain. The bus-interface lists the number of protocol buses inferred in the IP. The IP level CF is the weighted average CFs of its lower level modules. The Id coverage corresponds to behavioral func- tions inferred for each IP in comparison to their number in PBM. A high CF means that functions along with low level properties get identified in RTL. The CF of the IP drops if there is a function inference mismatch between spec and RTL. The FPU_IP1 has two functions (Float to integer and Integer to Float) listed in its spec but not inferred from RTL. On manual review this discrepancy was confirmed. The register discrepancy for the timer is RTL coding quality is- sue, where register parameter defines, for address and name used in the spec are not found in RTL. The Timer has a port naming discrepancy between the specs and RTL. The ARM2 design has two extra ports in RTL as compared to the specs. 6.2 results: spec and rtl correspondence 84 % % % % % 5 . 75 80 41 33 Spec 87 coverage 2 0 0 0 0 mismatch 3 4 5 7 2 function inference Sections annotated 0 9 NA NA NA based 31 46 40 86 11 register inferred Features Back Annotation 0 0 0 2 1 IO (Spec & RTL mismatches) based 6 5 4 2 15 Spec Rule-base Analysis Output inferred Functions 7 9 48 93 . . 72 . . . 0 0 CF 0 0 0 average 9 46 89 43 779 unknown % % % % % Id 57 71 53 85 90 coverage 563 2421 2344 6501 1750 English Dictionary 0 0 0 1 1 bus interface 26 231 277 742 292 symbol 0 0 0 2 0 Number/ memory ram/rom Spec Analysis Results 24 50 63 : 280 163 8 0 1 0 2 0 fsm Acronym/ abbreviat. inferred Table RTL Analysis and Back Annotation Results : 9 51 19 187 226 695 4 5 4 2 15 Ontology matches inferred functions Table Spec Extractor Output 710 2889 3720 2919 Total words 92 73 24 10342 162 269 rules fired 2 RTL Rule-base Analysis Domain FPU FPU FPU ARM rtl 3335 3965 3919 1232 Peripheral 15195 clips facts for 4 5 8 6 13 No. of Sections 48 22 30 11 102 processes 6 23 12 48 25 Pages No. of 7 5 11 13 14 ] entities ] ] ] ] 94 77 63 84 [ [ [ 95 1 2 3 1 2 3 Information Spec Document RTL Design Information TIMER [ TIMER FPU_IP FPU_IP FPU_IP FPU_IP FPU_IP FPU_IP IP Name AMBER_IP [ IP Name AMBER_IP 7

CONCLUSIONANDFUTUREWORK

We have presented techniques for (a) specification analysis, (b) RTL anal- ysis, and (c) back-annotation of RTL functionality to Specs. In Spec analysis, we use ontology as a knowledge representation scheme for text objects embedded in spec documents. In addition, custom templates for specifying tabular objects such as register and IO specifications have been discussed. The knowledge represented as text, tables and diagrams in specifica- tion documents is extracted by our spec extractor tool. Each spec is converted into a CLIPS fact based representation. The spec rule-base then performs spec- ification analysis of soft-IP specs. We presented results for specification anal- ysis of FPU specs downloaded from opencores.org. The “spec-coverage” and “requirement-coverage” results can be used to find any key function or require- ment missing from an IP spec. The results can also help to find soft-IP features most commonly supported by various IP vendors and competitors. In RTL analysis, we have discussed RTL-CLIPS as a knowledge representa- tion scheme for RTL . We present RTL rule-base to perform RTL analysis. We also discuss rule-based simulation of RTL-CLIPS. The RTL simulation within CLIPS allows local evaluation of RTL code fragments without the requirement of building a complex verification environment. Our approach augments the pattern-matching capability of CLIPS with an event-based RTL simulator. The enhanced CLIPS expert system shell can be employed to better approximate design behavior and aids the RTL rule-base to perform IP RTL quality checks. We presented behavioral test results of the first six ITC99 benchmark circuits. We also presented RTL analysis results for FPU Soft IPs downloaded from opencores.org. The key challenge for the RTL rule-base is to use a successful

85 conclusion and future work 86 combination of behavioral analysis and evaluation rules to make an inference. Finally, our back-annotation technique can be used to perform cross-correlation between IP Specs and RTL. Our approach can assist engineers in discovering discrepancies between IP spec and RTL. The confidence level and identification coverage results can be used as metrics for IP analysis. We presented back- annotation results for ARM2, Programmable Interval Timer and FPU soft-IPs downloaded from opencores.org. Future work will include enhancing the KB by adding more design domains and rules to the KB. We are looking at research done in the software domain on semantic clone detection to see what techniques can be applied towards our work. These approaches capture semantic information from program depen- dency graphs(PDGs), program representation that encode data and control dependencies between statements and predicates. To find similar code frag- ments these techniques use some variant of sub-graph isomorphism for PDG, tree based detection techniques on abstract syntax tree (AST) and string/token comparison. We plan to do experiments using semantic clone detection tech- niques to see how successful they are for clone detection for a database of RTL programs. We also plan to use assertion synthesis to generate assertions from RTL and then perform a rule-based analysis of assertions in CLIPS.

acknowledgement

This research work has been supported by the DARPA IRIS Program under contract: HR001-11-C-0091. Rockwell Automation collaborated in the team ef- fort of this project. Part I

APPENDIX A

PROCESSINGTABULAROBJECTS

a.1 html register table and register test-bench generation

1 #Note - This script expects Register description as per the Register template in Chapter 6 2 # The complete script for generating UVM test bench is not provided. 3 # The register description should be provided in a worksheet and IO description in another worksheet 4 # in same XLS file. 5 # Usage:./tbdev.py " 6 # : name of the IP to be generated" 7 # : name of the protocol to be generated" 8 # apb : ARM AMBA APB" 9 # ahb : ARM AMBA AHB" 10 # whb : OPEN WishBone" 11 # : xls file name" 12 13 DEBUG=0 14 15 def html_init(file): 16 file.write(" Document\n") 17 file.write("\n") 18 19 def html_close(file): 20 file.write("") 21 file.write("") 22 file.close() 23 24 def table_gen(file,list,row): 25 llen=len(list) 26 flag=0 27 file.write("

Signal Name Width Description
clk_i 1 clock signal
") 28 for x in range(0, row): 29 file.write("\n") 30 if x==0: 31 a=0 32 b=llen/2 33 elif x==1: 34 a=llen/2 35 b=llen 36 for y in range(a,b): 37 file.write("\n") 41 file.write("
\n") 38 test=str(list[y]) 39 file.write(test) 40 file.write("
\n") 42 file.write("
") 43 file.write("
") 44

88 A.1 html register table and register test-bench generation 89

45 def regmap_accs(file,temp1,bit,access): 46 file.write("

\n") 48 file.write("access type") 49 file.write("") 73 file.write(access[x]) 74 file.write("") 77 file.write(access[x]) 78 file.write("
\n") 85 file.write("reset value") 86 file.write("\n") 104 if value=="0": A.1 html register table and register test-bench generation 90

105 value="0x00000000" 106 else : 107 value="0x0000%s"% pval 108 file.write(value) 109 file.write("

\n") 115 file.write("field") 116 file.write("\n") 118 for x in range(0,len(fld)): 119 file.write("") 120 file.write("[") 121 val= str(bit[x]) 122 file.write(val) 123 file.write("]") 124 file.write("") 125 file.write(fld[x]) 126 file.write(":\n") 127 file.write("") 128 file.write("
") 129 file.write("
") 130 file.write(" ") 131 file.write(" ") 132 file.write(" ") 133 file.write(" ") 134 file.write(str(des[x])) 135 file.write("
") 136 file.write("
") 137 file.write("
\n") 142 file.write("\n") 143 file.write("\n") 148 file.write("\n") 151 file.write("\n") 152 p=31 153 while p>-1: 154 pval=p 155 file.write("\n") 158 p=p-1 159 file.write("\n") 160 class Reg_Gen : 161 162 163 def data_col(self,xlsfile): 164 import xlrd A.1 html register table and register test-bench generation 91

165 workbook= xlrd.open_workbook(xlsfile) 166 worksheet= workbook.sheet_names() 167 worksheet1=worksheet[0] 168 worksheet= workbook.sheet_by_name(worksheet1) 169 head=0 170 intf0= worksheet.col_values(0, start_rowx=0) 171 intf1= worksheet.col_values(1, start_rowx=0) 172 intf2= worksheet.col_values(2, start_rowx=0) 173 intf3= worksheet.col_values(3, start_rowx=0) 174 intf4= worksheet.col_values(4, start_rowx=0) 175 intf5= worksheet.col_values(5, start_rowx=0) 176 intf6= worksheet.col_values(6, start_rowx=0) 177 intf7= worksheet.col_values(7, start_rowx=0) 178 m_header=[] 179 b_header=[] 180 r_header=[] 181 r_name=[] 182 f_name=[] 183 r_val=[] 184 o_val=[] 185 d_val=[] 186 b_val=[] 187 a_val=[] 188 de_val=[] 189 f_name=[] 190 temp="TEST" 191 temp1=0 192 file=open("index.html",’w’) 193 html_init(file) 194 reg_no=0 195 196 for i, j in enumerate(intf0): 197 head= head+1 198 flag=0 199 flag1=0 200 if j == ’table_begins’: 201 if head ==1: 202 m_header.append(intf1[i]) 203 m_header.append(intf2[i]) 204 m_header.append(intf3[i]) 205 m_header.append(intf4[i]) 206 if head ==3: 207 b_header.append(intf1[i]) 208 b_header.append(intf2[i]) 209 b_header.append(intf3[i]) 210 if head ==5: 211 r_header.append(intf1[i]) 212 r_header.append(intf2[i]) 213 r_header.append(intf3[i]) 214 r_header.append(intf4[i]) 215 r_header.append(intf5[i]) 216 r_header.append(intf6[i]) 217 r_header.append(intf7[i]) 218 if head ==4: 219 b_header.append(intf1[i]) 220 b_header.append(intf2[i]) 221 b_header.append(intf3[i]) 222 table_gen(file,b_header,2) 223 if head ==2: 224 m_header.append(intf1[i]) A.1 html register table and register test-bench generation 92

225 m_header.append(intf2[i]) 226 m_header.append(intf3[i]) 227 m_header.append(intf4[i]) 228 table_gen(file,m_header,2) 229 230 if j== ’register_begins’: 231 reg_no+=1; 232 r_name.append(intf1[i]) 233 o_val.append(intf2[i]) 234 d_val.append(intf7[i]) 235 f_name.append([]) 236 r_val.append([]) 237 b_val.append([]) 238 a_val.append([]) 239 de_val.append([]) 240 temp=1 241 elif j==’’ and temp==1: 242 if intf3[i]!=’’: 243 f_name[reg_no-1].append(intf3[i]) 244 r_val[reg_no-1].append(intf4[i]) 245 b_val[reg_no-1].append(intf5[i]) 246 a_val[reg_no-1].append(intf6[i]) 247 de_val[reg_no-1].append(intf7[i]) 248 for k in range(0,reg_no): 249 regmap_strt(file,r_name[k],o_val[k],d_val[k]) 250 regmap_accs(file,temp1,b_val[k],a_val[k]) 251 regmap_rsts(file,temp1,r_val[k],b_val[k]) 252 regmap_feld(file,temp1,f_name[k],b_val[k],de_val[k]) 253 file.write("
") 254 file.write("

\n") 144 file.write(reg) 145 file.write("
") 146 file.write(offset) 147 file.write("
\n") 149 file.write(des) 150 file.write("
\n") 156 file.write(str(pval)) 157 file.write("
") 255 256 257 def intf_write(filep,bits,sigs,intf): 258 for i, j in enumerate(sigs): 259 if j == ’pclk’: 260 if bits[i]==1.0: 261 filep.write("logic "+intf[i]+"; \n") 262 else: 263 filep.write("logic ["+bits[i]+"] "+intf[i]+";\n") 264 for i, j in enumerate(sigs): 265 if j == ’presetn’: 266 if bits[i]==1.0: 267 filep.write("logic "+intf[i]+"; \n") 268 else: 269 filep.write("logic ["+bits[i]+"] "+intf[i]+";\n") 270 for i, j in enumerate(sigs): 271 if j == ’paddr’: 272 if bits[i]==1.0: 273 filep.write( "logic "+intf[i]+"; \n") 274 else: 275 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 276 for i, j in enumerate(sigs): 277 if j == ’pwdata’: 278 if bits[i]==1.0: 279 filep.write( "logic "+intf[i]+"; \n") 280 else: 281 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 282 for i, j in enumerate(sigs): 283 if j == ’prdata’: 284 if bits[i]==1.0: A.1 html register table and register test-bench generation 93

285 filep.write( "logic "+intf[i]+"; \n") 286 else: 287 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 288 for i, j in enumerate(sigs): 289 if j == ’pwrite’: 290 if bits[i]==1.0: 291 filep.write( "logic "+intf[i]+"; \n") 292 else: 293 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 294 for i, j in enumerate(sigs): 295 if j == ’psel’: 296 if bits[i]==1.0: 297 filep.write( "logic "+intf[i]+"; \n") 298 else: 299 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 300 for i, j in enumerate(sigs): 301 if j == ’penable’: 302 if bits[i]==1.0: 303 filep.write( "logic "+intf[i]+"; \n") 304 else: 305 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 306 for i, j in enumerate(sigs): 307 if j == ’pready’: 308 if bits[i]==1.0: 309 filep.write( "logic "+intf[i]+"; \n") 310 else: 311 filep.write( "logic ["+bits[i]+"] "+intf[i]+";\n") 312 313 def cb_mas(file,bits,sigs,intf): 314 file.write("\n") 315 file.write("clocking mas @(posedge pclk);\n") 316 file.write(" output ") 317 for i,j in enumerate(sigs): 318 if j == "penable": 319 file.write(intf[i]+",") 320 elif j == "psel": 321 file.write(intf[i]+";\n") 322 elif j == "pwrite": 323 file.write(intf[i]+",") 324 elif j == "pwdata": 325 file.write(intf[i]+",") 326 elif j == "paddr": 327 file.write(intf[i]+",") 328 file.write(" input ") 329 for i,j in enumerate(sigs): 330 if j == "prdata": 331 file.write(intf[i]+";\n") 332 file.write("endclocking\n") 333 file.write("\n") 334 335 def cb_slv(file,bits,sigs,intf): 336 file.write("\n") 337 file.write("clocking slv @(posedge pclk);\n") 338 file.write(" input ") 339 for i,j in enumerate(sigs): 340 if j == "penable": 341 file.write(intf[i]+",") 342 elif j == "psel": 343 file.write(intf[i]+";\n") 344 elif j == "pwrite": A.1 html register table and register test-bench generation 94

345 file.write(intf[i]+",") 346 elif j == "pwdata": 347 file.write(intf[i]+",") 348 elif j == "paddr": 349 file.write(intf[i]+",") 350 file.write(" output ") 351 for i,j in enumerate(sigs): 352 if j == "prdata": 353 file.write(intf[i]+";\n") 354 file.write("endclocking\n") 355 file.write("\n") 356 357 def cb_pas(file,bits,sigs,intf): 358 file.write("\n") 359 file.write("clocking pas @(posedge pclk);\n") 360 file.write(" input ") 361 for i,j in enumerate(sigs): 362 if j == "penable": 363 file.write(intf[i]+",") 364 elif j == "psel": 365 file.write(intf[i]+",") 366 elif j == "pwrite": 367 file.write(intf[i]+",") 368 elif j == "prdata": 369 file.write(intf[i]+";\n") 370 elif j == "pwdata": 371 file.write(intf[i]+",") 372 elif j == "paddr": 373 file.write(intf[i]+",") 374 file.write("endclocking\n") 375 376 def blq_line(file): 377 file.write("\n") 378 379 def strt_run(file): 380 file.write("\n") 381 file.write(" virtual protected task run_phase(uvm_phase phase);\n") 382 file.write(" super.run_phase(phase);\n") 383 file.write("\n") 384 return; 385 386 def cons_wrt(file,port): 387 file.write("\n") 388 file.write(" function new(string name, uvm_component parent = null);\n") 389 file.write(" super.new(name, parent);\n") 390 if port!="nope": 391 file.write(’’+port+’= new("’+port+’",this);\n’) 392 file.write(" endfunction\n") 393 file.write("\n") 394 return; 395 396 def cons_pkt(file,prot): 397 file.write("\n") 398 file.write(’ function new(string name = "’+prot+’");\n’) 399 file.write(" super.new(name);\n") 400 file.write(" endfunction\n") 401 file.write("\n") 402 return; 403 404 def strt_bld(a,b,vif,file): A.1 html register table and register test-bench generation 95

405 file.write(" virtual function void build_phase(uvm_phase phase);\n") 406 file.write(""+a+"_agent agent;\n") 407 file.write(" if($cast(agent,get_parent()) && agent !=null) begin\n") 408 file.write(" vif=agent.vif;\n") 409 file.write(" end else begin\n") 410 if vif!="vif": 411 file.write(" virtual "+a+"_if "+vif+"; \n") 412 file.write(’ if (!uvm_config_db#(’+a+’_vif)::get(this, "", "vif",’+vif+’)) begin\n’) 413 file.write(’ ‘uvm_fatal("’+a+’_agent", "No virtual interface specified for this ’+b+’ instance")\n’) 414 file.write(" end\n") 415 if vif!="vif": 416 file.write(" vif = "+vif+";\n") 417 file.write(" end\n") 418 file.write(" endfunction\n") 419 file.write("\n") 420 return; 421 422 def strt_conn(file,sub_comps): 423 file.write("\n") 424 file.write(" virtual function void connect_phase(uvm_phase phase);\n") 425 file.write(""+sub_comps[0]+".seq_item_port.connect("+sub_comps[1]+".seq_item_export);\n") 426 file.write(" endfunction\n") 427 file.write("\n") 428 429 def run_rd(pro,intf,file): 430 if pro=="apb": 431 file.write(" virtual protected task read(input bit [31:0] addr,\n") 432 file.write(" output logic [31:0] data);\n") 433 file.write("\n") 434 file.write(" this.vif.mcb."+intf[2]+"<=addr;\n") 435 file.write(" this.vif.mcb."+intf[5]+"<=1’b0;\n") 436 file.write(" this.vif.mcb."+intf[6]+"<=1’b1;\n") 437 file.write(" @(this.vif.mcb);\n"); 438 file.write(" this.vif.mcb."+intf[7]+"<=1’b1;\n") 439 file.write(" @(this.vif.mcb);\n") 440 file.write(" data=this.vif.mcb."+intf[4]+";\n") 441 file.write(" this.vif.mcb."+intf[6]+"<=0’b1;\n") 442 file.write(" this.vif.mcb."+intf[7]+"<=0’b1;\n") 443 file.write(" endtask \n") 444 file.write("\n") 445 elif pro=="ahb": 446 file.write(" virtual protected task read(input bit [31:0] addr,\n") 447 file.write(" output logic [31:0] data);\n") 448 file.write("\n") 449 file.write(" this.vif.mcb."+intf[2]+"<=addr;\n") 450 file.write(" this.vif.mcb."+intf[5]+"<=1’b0;\n") 451 file.write(" this.vif.mcb."+intf[6]+"<=1’b1;\n") 452 file.write(" @(this.vif.mcb);\n"); 453 file.write(" this.vif.mcb."+intf[7]+"<=1’b1;\n") 454 file.write(" @(this.vif.mcb);\n") 455 file.write(" data=this.vif.mcb."+intf[4]+";\n") 456 file.write(" this.vif.mcb."+intf[6]+"<=0’b1;\n") 457 file.write(" this.vif.mcb."+intf[7]+"<=0’b1;\n") 458 file.write(" endtask \n") 459 file.write("\n") 460 elif pro=="wsb": 461 file.write(" virtual protected task read(input bit [31:0] addr,\n") 462 file.write(" output logic [31:0] data);\n") 463 file.write("\n") 464 file.write(" this.vif.mcb."+intf[2]+"<=addr;\n") A.1 html register table and register test-bench generation 96

465 file.write(" this.vif.mcb."+intf[5]+"<=1’b0;\n") 466 file.write(" this.vif.mcb."+intf[6]+"<=1’b1;\n") 467 file.write(" @(this.vif.mcb);\n"); 468 file.write(" this.vif.mcb."+intf[7]+"<=1’b1;\n") 469 file.write(" @(this.vif.mcb);\n") 470 file.write(" data=this.vif.mcb."+intf[4]+";\n") 471 file.write(" this.vif.mcb."+intf[6]+"<=0’b1;\n") 472 file.write(" this.vif.mcb."+intf[7]+"<=0’b1;\n") 473 file.write(" endtask \n") 474 file.write("\n") 475 476 def run_wr(pro,intf,file): 477 if pro=="apb": 478 file.write(" virtual protected task write(input bit [31:0] addr,\n") 479 file.write(" input bit [31:0] data);\n") 480 file.write("\n") 481 file.write(" this.vif.mcb."+intf[2]+"<=addr;\n") 482 file.write(" this.vif.mcb."+intf[3]+"<=data;\n") 483 file.write(" this.vif.mcb."+intf[5]+"<=1’b1;\n") 484 file.write(" this.vif.mcb."+intf[6]+"<=1’b1;\n") 485 file.write(" @(this.vif.mcb);\n"); 486 file.write(" this.vif.mcb."+intf[7]+"<=1’b1;\n") 487 file.write(" @(this.vif.mcb);\n"); 488 file.write(" this.vif.mcb."+intf[6]+"<=0’b1;\n") 489 file.write(" this.vif.mcb."+intf[7]+"<=0’b1;\n") 490 file.write(" endtask \n") 491 file.write("\n") 492 493 def drv_run(protocol,intf,a,file): 494 if protocol=="apb": 495 file.write(" this.vif.mcb."+ intf[6]+" <=1’b0; \n") 496 file.write(" this.vif.mcb."+ intf[7]+" <=1’b0; \n") 497 file.write("\n") 498 file.write(" forever begin\n") 499 file.write(""+a+"_rw trans;"); 500 file.write(" @(this.vif.mcb) ;"); 501 file.write("\n") 502 file.write(" seq_item_port.get_next_item(trans);\n") 503 file.write(" @(this.vif.mcb) ;"); 504 file.write("\n") 505 file.write(" case(trans.kind)\n") 506 file.write(""+a+"_rw::READ : this.read(trans.addr,trans.data);\n") 507 file.write(""+a+"_rw::WRITE: this.write(trans.addr,trans.data);\n") 508 file.write(" endcase\n") 509 file.write(" \n") 510 file.write(" seq_item_port.item_done();\n") 511 file.write(" -> trig;\n") 512 file.write(" end\n") 513 file.write(" endtask\n") 514 file.write(" \n") 515 run_rd(protocol,intf,file) 516 run_wr(protocol,intf,file) 517 518 def mon_run(protocol,intf,a,file): 519 if protocol=="apb": 520 file.write(" forever begin\n") 521 file.write(""+a+"_rw trans;"); 522 file.write("\n") 523 file.write(" do begin\n") 524 file.write(" @(this.vif.pas) ;\n"); A.1 html register table and register test-bench generation 97

525 file.write(" end\n") 526 file.write("\n") 527 file.write(" while (this.vif.pas."+intf[6]+" !== 1’b1 ||\n") 528 file.write(" this.vif.pas."+intf[7]+" !== 1’b0);\n") 529 file.write("\n") 530 file.write(’ trans=’+a+’_rw::type_id::create("trans", this);\n’) 531 file.write("\n") 532 file.write(" trans.kind = (this.vif.pas."+intf[5]+"?"+a+"_rw:: WRITE :"+a+"rw:: READ ;\n") 533 file.write(" trans.addr = this.vif.pas."+intf[2]+";\n") 534 file.write(" \n") 535 file.write(" @(this.vif.pas) ;\n"); 536 file.write(" if(this.vif.pas."+intf[7]+"!== 1’b1) begin \n"); 537 file.write(’ ‘uvm_error("APB", "APB protocol violation: SETUP cycle not followed by ENABLE cycle");\n’); 538 file.write(" end\n") 539 file.write(" trans.data=(trans.kind =="+a+"_rw::READ) ? this.vif.pas."+intf[4]+": \n") 540 file.write(" this.vif.pas."+intf[3]+"; \n") 541 file.write(" \n") 542 file.write(" ana_port.write(trans);\n") 543 file.write(" \n") 544 file.write(" end\n") 545 file.write(" endtask\n") 546 file.write(" \n") 547 548 def gen_adapt(file,prot): 549 file.write("class reg2"+prot+"_adapter extends uvm_reg_adapter;\n") 550 file.write("\n") 551 file.write(" uvm_object_utils(reg2"+prot+"_adapter)\n") 552 file.write("\n") 553 value="reg2%s_adapter"% prot 554 cons_pkt(file,value) 555 file.write(" virtual function uvm_sequence_item reg2bus(const ref uvm_reg_bus_op rw);\n") 556 if prot=="apb": 557 file.write(’ apb_rw apb = apb_rw::type_id::create("apb_rw");\n’) 558 file.write(" apb.kind = (rw.kind == UVM_READ) ? apb_rw::READ : apb_rw::WRITE;\n") 559 file.write(" apb.addr = rw.addr;\n") 560 file.write(" apb.data = rw.data;\n") 561 file.write(" return apb;\n") 562 file.write(" endfunction\n") 563 file.write("\n") 564 file.write(" virtual function void bus2reg(uvm_sequence_item bus_item,\n") 565 file.write(" ref uvm_reg_bus_op rw);\n") 566 file.write(""+prot+"_rw "+prot+";\n") 567 file.write(" if(!$cast("+prot+",but_item))begin\n") 568 file.write(’ ‘uvm_fatal("Type Missmatch :’+prot+’","Provided bus_item is not of the correct type")\n’) 569 file.write(" return\n") 570 file.write(" end\n") 571 if prot=="apb": 572 file.write(" rw.kind = apb.kind == apb_rw::READ ? UVM_READ : UVM_WRITE;\n") 573 file.write(" rw.addr = apb.addr;\n") 574 file.write(" rw.data = apb.data;\n") 575 file.write(" rw.status = UVM_IS_OK;\n") 576 file.write(" endfunction\n") 577 file.write("endclass\n") 578 579 class Sv_Interface: 580 def gen_intf(self,xlsfile): 581 import xlrd 582 workbook= xlrd.open_workbook(xlsfile) 583 worksheet= workbook.sheet_names() 584 worksheet1=worksheet[1] A.1 html register table and register test-bench generation 98

585 worksheet= workbook.sheet_by_name(worksheet1) 586 intf= worksheet.col_values(0, start_rowx=1) 587 bits= worksheet.col_values(2,start_rowx=1) 588 sigs= worksheet.col_values(7, start_rowx=1) 589 fo=open("apb_interface.sv","wb") 590 fo.write("interface apb_interface(input bit pclk);") 591 fo.write("\n") 592 fo.write("\n") 593 intf_write(fo,bits,sigs,intf) 594 fo.write("\n") 595 cb_mas(fo,bits,sigs,intf) 596 cb_slv(fo,bits,sigs,intf) 597 cb_pas(fo,bits,sigs,intf) 598 fo.write("\n") 599 fo.write("modport master(clocking mas);\n") 600 fo.write("modport slave(clocking slv);\n") 601 fo.write("modport passive(clocking pas);\n") 602 fo.write("\n") 603 fo.write("endinterface\n") 604 fo.close() 605 return intf; 606 607 #class Uvm_Env: 608 609 #class Uvm_Test: 610 # def gen_intf(self): 611 # print "This message is coming from Uvm_Test Class" 612 # 613 #class Uvm_Sequence: 614 # def gen_intf(self): 615 # print "This message is coming from Uvm_Sequence Class" 616 # 617 class Uvm_Pkg: 618 619 def gen_pkg(self,pkgname,pktname,f1,f2,f3,f4,prot): 620 file=open(pkgname,’w’) 621 file.write(’‘include "’+prot+’_interface.sv"’) 622 file.write("\n") 623 file.write("\n") 624 file.write(’packge ’+prot+’_pkg;\n’) 625 file.write("\n") 626 file.write(’ import uvm_pkg::*;\n ‘include "uvm_macros.svh"\n’) 627 file.write("\n") 628 file.write(’ typedef virtual ’+prot+’_interface ’+prot+’_vif;\n’) 629 file.write(’ typedef class ’+prot+’_agent;\n’) 630 file.write("\n") 631 file.write(’ ‘include "’+pktname+’\n’) 632 file.write(’ ‘include "’+f1+’\n’) 633 file.write(’ ‘include "’+f2+’\n’) 634 file.write(’ ‘include "’+f3+’\n’) 635 file.write(’ ‘include "’+f4+’\n’) 636 file.write("\n") 637 file.write(’endpackge’) 638 639 class Uvm_Pkt: 640 641 642 def gen_pkt(self,pktname,prot): 643 file=open(pktname,’w’) 644 file.write("class "+prot+"_rw extends uvm_sequence_item;\n") A.1 html register table and register test-bench generation 99

645 if prot=="apb": 646 file.write("\n") 647 file.write("typedef enum {READ, WRITE} kind_e;\n") 648 file.write("rand bit [31:0] addr;\n") 649 file.write("rand logic [31:0] data;\n") 650 file.write("rand kind_e kind;\n") 651 file.write("\n") 652 file.write("‘uvm_object_utils_begin(apb_rw)\n") 653 file.write("‘uvm_field_int(addr, UVM_ALL_ON);\n") 654 file.write("‘uvm_field_int(data, UVM_ALL_ON);\n") 655 file.write("‘uvm_field_enum(kind_e,kind, UVM_ALL_ON);\n") 656 file.write("‘uvm_object_utils_end\n") 657 prot1="%s_rw"% prot 658 cons_pkt(file,prot1) 659 file.write("function string convert2string();\n") 660 file.write(’ return $sformatf("kind=%s addr=%0h data=%0h",kind,addr,data);\n’) 661 file.write("endfunction\n") 662 file.write("\n") 663 file.write("endclass\n") 664 file.write("\n") 665 gen_adapt(file,prot) 666 667 class Uvm_Component: 668 669 def gen_comp(self,work,prot,intf): 670 671 if DEBUG==1: 672 print "This is message coming from inside Uvm_Component class." 673 674 comp_name="%s"% work[:-3] 675 work.split("_") 676 f= open(work, ’w’) 677 678 if DEBUG==1: 679 print "%s"% comp_name 680 a,b=comp_name.split("_") 681 if DEBUG==1: 682 print "%s"%a 683 if b=="agent": 684 f.write("class"+""+ comp_name+""+ "extends"+""+ "uvm_"+b+ ";"+" \n") 685 f.write("\n") 686 sub_comps=[’driver’,’sequencer’,’monitor’] 687 for sub_comp in sub_comps: 688 f.write(""+a+"_"+ sub_comp+""+ sub_comp+"; \n") 689 f.write("\n") 690 f.write(""+a+"_vif"+""+ "vif; \n") 691 f.write("\n") 692 693 f.write(" ‘uvm_component_utils_begin("+comp_name+")\n") 694 for sub_comp in sub_comps: 695 f.write(" ‘uvm_component_utils_begin("+ sub_comp+", UVM_ALL_ON) \n") 696 f.write(" ‘uvm_component_utils_end\n") 697 #Call Constructor 698 cons_wrt(f,"nope"); 699 700 f.write(" virtual function void build_phase(uvm_phase phase);\n") 701 for sub_comp in sub_comps: 702 f.write(’’+sub_comp+’=’+a+’_’+sub_comp+’::type_id::create("’+sub_comp+’", this); \n’) 703 f.write("\n") 704 A.1 html register table and register test-bench generation 100

705 f.write(’ if (!uvm_config_db#(’+a+’_vif)::get(this, "", "vif", vif)) begin\n’) 706 f.write(’ ‘uvm_fatal("’+a+’_agent", "No virtual interface specified for this agent instance")\n’) 707 708 f.write(" end\n") 709 f.write(" endfunction\n") 710 strt_conn(f,sub_comps) 711 if b=="sequencer": 712 f.write("class"+""+ comp_name+""+ "extends"+""+ "uvm_"+b+ " #("+a+"_rw);"+" \n") 713 f.write("\n") 714 f.write(" ‘uvm_component_utils("+comp_name+")\n") 715 cons_wrt(f,"nope"); 716 if b=="driver": 717 f.write("class"+""+ comp_name+""+ "extends"+""+ "uvm_"+b+ " #("+a+"_rw);"+" \n") 718 f.write("\n") 719 f.write(" ‘uvm_component_utils("+comp_name+")\n") 720 f.write("\n") 721 f.write(" event trig;\n") 722 f.write(""+a+"_vif vif ;\n") 723 cons_wrt(f,"nope"); 724 strt_bld(a,b,"vif",f); 725 strt_run(f); 726 drv_run(prot,intf,a,f) 727 if b=="monitor": 728 f.write("class"+""+ comp_name+""+ "extends"+""+ "uvm_"+b+ ";"+" \n") 729 f.write("\n") 730 f.write(" virtual"+a+"_if.passive vif; \n") 731 f.write(" uvm_analysis_port#("+a+"_rw) ana_port;\n") 732 f.write("\n") 733 cons_wrt(f,"ana_port"); 734 f.write("\n") 735 strt_bld(a,b,"tmp",f); 736 strt_run(f) 737 mon_run(prot,intf,a,f) 738 f.write("endclass\n") 739 f.close() 740 741 742 743 744 def env_gen(agname,protocol,regfile): 745 746 # Instance of Component Class 747 comp1=Uvm_Component() 748 comp2=Uvm_Component() 749 comp3=Uvm_Component() 750 comp4=Uvm_Component() 751 # Instance of Package Class 752 pkggen=Uvm_Pkg() 753 # Instance of Packet Class 754 pktgen=Uvm_Pkt() 755 # Instance of Interface Class 756 intgen=Sv_Interface() 757 758 # Instance of Enviroment Class 759 # env=Uvm_Env() 760 # Instance of Sequence Class 761 # Instance of Test Class 762 # Instance of Top Class 763 # Instance of Dummy Dut Class 764 A.1 html register table and register test-bench generation 101

765 # Instance of Reg Gen Class 766 reggen=Reg_Gen() 767 768 # Usage of Interface Class 769 interface=intgen.gen_intf(regfile) 770 771 cfile1="%s_agent.sv"% agname 772 cfile2="%s_driver.sv"% agname 773 cfile3="%s_sequencer.sv"% agname 774 cfile4="%s_monitor.sv"% agname 775 pkgfile="%s_pkg.sv"% agname 776 pktfile="%s_rw.sv"% agname 777 778 reggen.data_col(regfile) 779 pkggen.gen_pkg(pkgfile,pktfile,cfile1,cfile2,cfile3,cfile4,protocol) 780 pktgen.gen_pkt(pktfile,protocol) 781 comp1.gen_comp(cfile1,protocol,interface) 782 comp2.gen_comp(cfile2,protocol,interface) 783 comp3.gen_comp(cfile3,protocol,interface) 784 comp4.gen_comp(cfile4,protocol,interface) 785 786 def help(): 787 print "Help Usage:./tbdev.phy " 788 print "...... : name of the IP to be generated" 789 print "...... : name of the protocol to be generated" 790 print "...... : apb : ARM AMBA APB" 791 print "...... : ahb : ARM AMBA AHB" 792 print "...... : whb : OPEN WishBone" 793 print "...... : xls file name" 794 795 def main(): 796 print "...... " 797 print "| |" 798 print "| Automatic VIP Generator |" 799 print "| Supported VIP : apb,ahb_lite,wishbone |" 800 print "| 2014 |" 801 print "...... " 802 803 import sys 804 total= len(sys.argv) 805 if total==1: 806 help() 807 elif str(sys.argv[1])=="-help": 808 help() 809 elif str(sys.argv[1])=="-v": 810 print "Date: 1st August 2014 Version : 0.1" 811 elif total==4: 812 agname=str(sys.argv[1]) 813 ip=str(sys.argv[2]) 814 #validate the ip name here , if not found then insert error 815 reg=str(sys.argv[3]) 816 env_gen(agname,ip,reg) 817 print "%s VIP Generated..."% ip.upper() 818 819 else: 820 print "** ERROR ** : please provide correct argument to tool" 821 help() 822 823 main() B

PROCESSINGDRAWINGOBJECTS

b.1 extraction of fsm specfication from svg

1 #File name - fsmConverter.py 2 #usage - python fsmConverter.py fsm.svg 3 # output - fsm.svg.txt 4 #Note : This script is for processing SVG file generated from Dia open source drawing tool. 5 #The FSM is drawn using Dia software and saved in SVG format, which is then processed 6 #by the script. 7 #-*- coding: utf-8 -*- 8 import os.path 9 import xml.dom.minidom 10 import math 11 import sys 12 13 #define error code 14 SUCCESS=0 15 FILE_NOT_EXIST=1 16 WRONG_FORMAT=2 17 18 CLOSE_DISTANCE= 10 19 20 #check if a point inside an ellipse 21 def inElippse (cx, cy, rx, ry, x1, y1): #x1, y1 is point 22 return (x1- cx) * (x1- cx)/ (rx * rx)+ (y1- cy) * (y1- cy)/ (ry * ry) 23 24 #distance between two point 25 def dist (x1, y1, x2, y2): 26 return (x1- x2) * (x1- x2)+ (y1- y2) * (y1- y2) 27 28 def getText(nodelist): 29 rc=[] 30 for node in nodelist: 31 if node.nodeType == node.TEXT_NODE: 32 rc.append(node.data) 33 return ’’.join(rc) 34 35 def parseSVG (file_name): 36 dom= xml.dom.minidom.parse (file_name) 37 38 elem_list= dom.getElementsByTagName ("g") 39 if not elem_list: 40 return WRONG_FORMAT 41 42 state_list= list() 43 state_pos= list() 44

102 B.1 extraction of fsm specfication from svg 103

45 trans_list= list() 46 trans_pos= list() 47 48 text_list= list() 49 50 #begin and end states of a transition 51 begin_list= list() 52 end_list= list() 53 54 # initial state 55 # initial state was pre - defined by ’Reset’ transition 56 initial_states= dom.getElementsByTagName (’ellipse’) 57 if (initial_states): 58 state_name= ’Initial_State’ 59 60 state_pos.append ((0,0, 1e3000, 1e3000,1)) 61 62 state_list.append (state_name) 63 64 65 for elem in elem_list: 66 # handle states 67 if (elem.getElementsByTagName (’ellipse’)): 68 if (len (elem.getElementsByTagName (’ellipse’))<2): 69 return WRONG_FORMAT 70 71 state_name= getText (elem.getElementsByTagName (’text’)[0].getElementsByTagName (’tspan’)[0].childNodes) 72 pos= list() 73 pos.append (float (elem.getElementsByTagName (’ellipse’)[1].getAttribute (’cx’))) 74 pos.append (float (elem.getElementsByTagName (’ellipse’)[1].getAttribute (’cy’))) 75 pos.append (float (elem.getElementsByTagName (’ellipse’)[1].getAttribute (’rx’))) 76 pos.append (float (elem.getElementsByTagName (’ellipse’)[1].getAttribute (’ry’))) 77 pos.append (elem.getElementsByTagName (’ellipse’)[1].getAttribute (’stroke-width’)) 78 79 state_list.append (state_name) 80 state_pos.append (pos) 81 #handle transitions 82 if (elem.getElementsByTagName (’path’)): 83 if (len (elem.getElementsByTagName (’path’)) !=1): 84 return WRONG_FORMAT 85 86 pos= list() 87 #get 3 points from polygon 88 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[1].split(’,’)[0])) 89 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[1].split(’,’)[1])) 90 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[3].split(’,’)[0])) 91 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[3].split(’,’)[1])) 92 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[7].split(’,’)[0])) 93 pos.append (float (elem.getElementsByTagName (’path’)[0].getAttribute (’d’).split (’’)[7].split(’,’)[1])) 94 pos.append (float (elem.getElementsByTagName (’polygon’)[0].getAttribute (’points’).split (’’)[1].split(’,’)[0])) 95 pos.append (float (elem.getElementsByTagName (’polygon’)[0].getAttribute (’points’).split (’’)[1].split(’,’)[1])) 96 #default transition condition 97 pos.append ("1") 98 99 trans_pos.append (pos) 100 101 elem_list= dom.getElementsByTagName ("text") 102 for elem in elem_list: 103 #handle text 104 if (elem.parentNode.nodeName == ’svg’): B.1 extraction of fsm specfication from svg 104

105 text_elem= list() 106 text_elem.append (float (elem.getAttribute (’x’))) 107 text_elem.append (float (elem.getAttribute (’y’))) 108 #handle multi line text 109 text_name=’’ 110 for i in range(len (elem.getElementsByTagName (’tspan’))): 111 text_name += getText (elem.getElementsByTagName (’tspan’)[i].childNodes) 112 text_elem.append (text_name) 113 text_list.append (text_elem) 114 115 #handle transitions: 116 #mapping transition to states and condition 117 begin_list=[None] * len (trans_pos) 118 end_list=[None] * len (trans_pos) 119 trans_list_name=[’1’] * len (trans_pos) 120 #trans_list_index = [-1] * len (trans_pos) 121 for i in range(len (trans_pos)): 122 #transition 123 begin_x= trans_pos [i] [0] 124 begin_y= trans_pos [i] [1] 125 end_x= trans_pos [i] [4] 126 end_y= trans_pos [i] [5] 127 arrow_x= trans_pos [i] [6] 128 arrow_y= trans_pos [i] [7] 129 130 #determine begin and end point 131 d1= dist (begin_x, begin_y, arrow_x, arrow_y) 132 d2= dist (end_x, end_y, arrow_x, arrow_y) 133 134 if (d2> d1): #swap begin and end points 135 temp= end_x 136 end_x= begin_x 137 begin_x= temp 138 temp= end_y 139 end_y= begin_y 140 begin_y= temp 141 142 #to states 143 min_begin_distance= 1e4000 144 min_begin_index=0 145 min_end_distance= 1e4000 146 min_end_index=0 147 for j in range(1, len (state_pos)): 148 #state 149 s_pos= state_pos [j] 150 cx= s_pos [0] 151 cy= s_pos [1] 152 rx= s_pos [2] 153 ry= s_pos [3] 154 s= s_pos [4] 155 156 #check begin state 157 d= inElippse (cx, cy, rx, ry, begin_x, begin_y) 158 if (d< min_begin_distance): 159 min_begin_distance=d 160 min_begin_index=j 161 162 #check end state 163 d= inElippse (cx, cy, rx, ry, end_x, end_y) 164 if (d< min_end_distance): B.1 extraction of fsm specfication from svg 105

165 min_end_distance=d 166 min_end_index=j 167 begin_list [i]= min_begin_index 168 end_list [i]= min_end_index 169 170 distance_name_trans_order= list() 171 confidence_list=[None] * len (trans_pos) 172 #to names 173 for i in range(len (text_list)): 174 text_x= text_list [i][0] 175 text_y= text_list [i][1] 176 177 dist_name_trans= list() 178 for j in range(len (trans_pos)): 179 begin_x= trans_pos [j] [0] 180 begin_y= trans_pos [j] [1] 181 end_x= trans_pos [j] [4] 182 end_y= trans_pos [j] [5] 183 184 distance= dist (text_x, text_y, (begin_x+ end_x)/2, (begin_y+ end_y)/2) 185 dist_name_trans.append ([j, distance]) 186 dist_name_trans= sorted (dist_name_trans, key= lambda dist_name_trans: dist_name_trans[1]) 187 #print trans_list [min_index] 188 189 distance_name_trans_order.append (dist_name_trans) 190 191 if (trans_list_name [dist_name_trans[0][0]] == ’1’): 192 trans_list_name [dist_name_trans[0][0]]= list() 193 194 trans_list_name [dist_name_trans[0][0]].append (text_list[i][2]) 195 196 if (confidence_list[dist_name_trans[0][0]] == None): 197 confidence_list[dist_name_trans[0][0]]= list() 198 199 if (len (dist_name_trans) >=2): 200 confidence_list[dist_name_trans[0][0]].append (1- dist_name_trans[0][1]/ dist_name_trans[1][1]) 201 else: 202 confidence_list[dist_name_trans[0][0]].append (1.0) 203 204 if (text_list[i][2] == ’Reset’): 205 begin_list [dist_name_trans[0][0]]=0 #Initial State 206 207 #sort by confidence level 208 for i in range(len (confidence_list)): 209 if (confidence_list[i] == None): 210 continue 211 for j in range(len (confidence_list [i])): 212 for k in range (j+1, len (confidence_list [i])): 213 if (confidence_list[i][j]< confidence_list[i][k]): 214 tmp= confidence_list[i][j] 215 confidence_list[i][j]= confidence_list[i][k] 216 confidence_list[i][k]= tmp 217 tmp= trans_list_name[i][j] 218 trans_list_name[i][j]= trans_list_name[i][k] 219 trans_list_name[i][k]= tmp 220 221 dom.unlink () 222 return (state_list, trans_list_name, begin_list, end_list, confidence_list) 223 224 #main B.1 extraction of fsm specfication from svg 106

225 def process (input_file): 226 if (not os.path.isfile (input_file)): 227 print ’File not exists’ 228 return FILE_NOT_EXIST 229 (states, trans, begin, end, confidence_level)= parseSVG (input_file) 230 file= open (input_file+ ".txt", ’w’) 231 232 file.write ("--- State list ---\n") 233 for i in range(len (states)): 234 file.write (states [i]) 235 if (i< len (states)-1): 236 file.write (’\n’) 237 file.write ("\n---Transition list---\n") 238 for i in range(len(trans)): 239 start= ’None’ 240 finish= ’None’ 241 if (begin [i] != None): 242 start= states [begin [i]] 243 if (end [i] != None): 244 finish= states[end[i]] 245 file.write (start+ ’->’+ finish+ ’:’) 246 for j in range(len (trans[i])): 247 file.write (trans[i][j]) 248 file.write (’(’) 249 if (trans[i][j] != ’1’): 250 file.write (’CF = %5.3f’%(confidence_level[i][j])) 251 else: 252 file.write (’CF = NA’) 253 file.write(’)’) 254 if (j< len (trans [i])-1): 255 file.write (’,’) 256 file.write (’\n’) 257 file.close 258 259 if (len(sys.argv)<2): 260 print ’Missing input file’ 261 else: 262 process (sys.argv[1])

Conversion to NuSMV syntax

1 # receive the output file of fsmConverter (after manual check) as input 2 # convert this file into nuSMV/nuXMV format 3 #File name - nuSMVConverter.py 4 #usage - python nuSMVConverter.py fsm.svg.txt 5 # output - fsm.svg.txt.smv 6 7 8 import os.path 9 import sys 10 11 #define error code 12 #do not modify 13 SUCCESS=0 14 FILE_NOT_EXIST=1 15 WRONG_FORMAT=2 B.1 extraction of fsm specfication from svg 107

16 17 CLOSE_DISTANCE= 10 18 19 #define reading mode 20 READ_STATE=1 21 READ_TRANSITION=2 22 23 def loadStateMachine (input_file): 24 if (not os.path.isfile (input_file)): 25 print ’File not exists’ 26 return FILE_NOT_EXIST 27 28 #input file 29 i_file= open (input_file, "r") 30 31 #read input file to input data 32 i_data= i_file.readlines () 33 34 #parse input file 35 states= list() 36 trans= list() 37 begins= list() 38 ends= list() 39 40 #reading_mode indicates we are reading state list or transition list 41 reading_mode=0 42 43 for line in i_data: 44 if "State list" in line: 45 reading_mode= READ_STATE 46 continue 47 if "Transition list" in line: 48 reading_mode= READ_TRANSITION 49 continue 50 if (reading_mode == READ_STATE): 51 states.append (line[:-1]) 52 continue 53 if (reading_mode == READ_TRANSITION): 54 arrow_pos= line.index (’->’) 55 if (arrow_pos ==-1): 56 return WRONG_FORMAT 57 begins.append (line[:arrow_pos]) 58 59 colon_pos= line.index (’:’) 60 if (colon_pos ==-1): 61 return WRONG_FORMAT 62 ends.append (line[arrow_pos+2:colon_pos]) 63 64 open_bracket= line.index (’(CF =’) 65 if (open_bracket ==-1): #not recommend 66 trans.append (line [colon_pos+1:]) 67 else: 68 trans.append (line [colon_pos+1:open_bracket]) 69 return (states, trans, begins, ends) 70 71 def writeToNuSMVFormat (output_file, states, trans, begins, ends): 72 file= open (output_file, ’w’) 73 74 if (file == None): 75 return FILE_NOT_EXIST B.1 extraction of fsm specfication from svg 108

76 77 non_duplicate_trans= list(set (trans)) 78 79 file.write (’MODULE main\n’) 80 file.write (’VAR\n’) 81 file.write (’\t’) 82 file.write (’request:’) 83 file.write (’{’) 84 for i in range(len (non_duplicate_trans)): 85 file.write (non_duplicate_trans[i]) 86 if (i< len (non_duplicate_trans)-1): 87 file.write (’,’) 88 file.write (’};\n’) 89 90 file.write (’\tstate:’) 91 file.write (’{’) 92 for i in range(len (states)): 93 file.write (states[i]) 94 if (i< len (states)-1): 95 file.write (’,’) 96 file.write (’};\n’) 97 98 file.write (’ASSIGN\n’) 99 file.write (’init(state):=’) 100 file.write (states [0]) 101 file.write (’;\n’) 102 file.write (’next(state):=case\n’) 103 for i in range(len (begins)): 104 file.write (’\t\tstate = ’+ begins [i]+ ’ & request = ’+ trans [i]+’:’+ ends [i]+’; \n’) 105 file.write(’\t\tTRUE : state; \n’) 106 file.write (’\tesac;’) 107 file.close () 108 109 if (len(sys.argv)<2): 110 print ’Missing input file’ 111 else: 112 (states, trans, begins, ends)= loadStateMachine (sys.argv[1]) 113 writeToNuSMVFormat (sys.argv[1]+ ’.smv’, states, trans, begins, ends)

Generated SMV code from Script

1 MODULE main 2 VAR 3 request:{"! dataInStore",Reset,"dataInStore & (! cts_n)", 4 "countExp & cts_n & dataInStore","! dataInStore & countExp", 5 "countExp & (! dataInStore)","! cts_n & dataInStore", 6 "dataInStore & cts_n",doneShiftOut, 7 "dataInStore & (! cts_n) & countExp"}; 8 9 state: {Initial_State,IDLE,SHIFTING,CNT_EXPIRE,IDLE_FC}; 10 ASSIGN 11 init(state):=Initial_State; 12 next(state):=case 13 state= IDLE& request= "dataInStore & (! cts_n)": SHIFTING; 14 state= SHIFTING& request= doneShiftOut: CNT_EXPIRE; 15 state= IDLE_FC& request= "! dataInStore": IDLE; B.1 extraction of fsm specfication from svg 109

16 state= IDLE& request= "dataInStore & cts_n": IDLE_FC; 17 state= CNT_EXPIRE& request= "countExp & cts_n & dataInStore": IDLE_FC; 18 state= CNT_EXPIRE& request= "dataInStore & (! cts_n) & countExp": SHIFTING; 19 state= CNT_EXPIRE& request= "! dataInStore & countExp": IDLE; 20 state= IDLE_FC& request= "! cts_n & dataInStore": SHIFTING; 21 state= Initial_State& request= Reset: IDLE; 22 TRUE: {Initial_State,IDLE,SHIFTING,CNT_EXPIRE,IDLE_FC}; 23 esac; BIBLIOGRAPHY

[1] H. D. Foster, “Why the design productivity gap never happened,” in Computer-Aided Design (ICCAD), 2013 IEEE/ACM International Conference

on, pp. 581–584, IEEE, 2013.

[2] B. Wile, J. C. Goss, and W. Roesner, Comprehensive Functional Verification: The Complete Industry Cycle. Morgan Kaufmann, 2005.

[3] J. C. Giarratano and G. Riley, “Expert systems, principles and program- ming, thomson course of technology,” Boston, Australia, 2005.

[4] T. Instruments, “Omap 4470 technical specification,” 2011.

[5] Marvell, “Marvell armada 510 application processor,” 2009.

[6] F. Semiconductor, “Freescale semiconductor data sheet: Technical data imx25cec,” July 2013.

[7] A. Shankar, B. Singh, F. Wolff, and C. Papachristou, “Ontology-guided conceptual analysis of design specifications,” in Proceedings of the The 51st Annual Design Automation Conference on Design Automation Conference, pp. 1–6, ACM, 2014.

[8] https://live.gnome.org/Dia, “Dia-version-0.97.2.”

[9] L. Leinweber, B. Singh, and C. Papachristou, “Expert system simulation of hardware,” in Tools with Artificial Intelligence (ICTAI), 2013 IEEE 25th International Conference on, pp. 207–212, IEEE, 2013.

[10] P. G. Maropoulos and D. Ceglarek, “Design verification and validation in product lifecycle,” CIRP Annals-Manufacturing Technology, vol. 59, no. 2, pp. 740–759, 2010.

110 bibliography 111

[11] I. Babuska and J. T. Oden, “Verification and validation in computational engineering and science: basic concepts,” Computer Methods in Applied Me- chanics and Engineering, vol. 193, no. 36, pp. 4057–4066, 2004.

[12] ITRS, “International technology roadmap for semiconductor - design,” tech. rep., ITRS, 2011.

[13] H. Foster, “Prologue: The 2012 wilson research group functional verifica- tion study,” Retrieved August, vol. 1, 2013.

[14] R. Collett, “Ic/asic functional verification study,",” Industry Report from Collett International Research, p. 34, 2004.

[15] M. Fujita, “Post-silicon patchable hardware silicon patchable hardware.” http://cmacs.cs.cmu.edu/seminars/slides/fujita.pdf, July 22nd, 2011.

[16] M. Keating and P. Bricaud, Reuse Methodology Manual for System-on-a-Chip Designs: For System-on-a-chip Designs. Springer, 2002.

[17] W. K. Lam, Hardware Design Verification: Simulation and Formal Method- Based Approaches (Prentice Hall Modern Semiconductor Design Series). Pren- tice Hall PTR, 2005.

[18] M. Abramovici, M. A. Breuer, and A. D. Friedman, Digital systems testing and testable design. Wiley-IEEE Press, ist ed., September 27, 1994.

[19] M. Bushnell and V. D. Agrawal, Essentials of electronic testing for digital, memory and mixed-signal VLSI circuits, vol. 17. Springer, 2000.

[20] C. Kern and M. R. Greenstreet, “Formal verification in hardware design: a survey,” ACM Transactions on Design Automation of Electronic Systems (TO- DAES), vol. 4, no. 2, pp. 123–193, 1999.

[21] M. C. McFarland, “Formal verification of sequential hardware: A tutorial,” Computer-Aided Design of Integrated Circuits and Systems, IEEE Transactions

on, vol. 12, no. 5, pp. 633–654, 1993. bibliography 112

[22] E. M. Clarke, O. Grumberg, and D. Peled, Model checking. MIT press, 1999.

[23] S. Merz, “Model checking: A tutorial overview,” in Modeling and verifica- tion of parallel processes, pp. 3–38, Springer, 2001.

[24] C. L. Forgy, “Rete: A fast algorithm for the many pattern/many object pattern match problem,” Artificial intelligence, vol. 19, no. 1, pp. 17–37, 1982.

[25] D. P. Miranker, Treat: A better match algorithm for ai production systems; long version. University of Texas at Austin, 1987.

[26] B. S. C. Papachristou and F. Wolff, “An expert system based methodology for soft an expert system based methodology for soft ip core validation,” in GoMACTech Conference, 2013.

[27] B. Singh, A. Shankar, F. Wolff, D. Weyer, C. Papachristou, and B. Negi, “Knowledge-guided methodology for third-party soft ip analysis,” in VLSI Design and 2014 13th International Conference on Embedded Systems,

2014 27th International Conference on, pp. 246–251, IEEE, 2014.

[28] B. Singh, A. Shankar, Y. Shiyanovskii, F. Wolff, C. Papachristou, D. Weyer, S. Clay, and J. Morrison, “Knowledge-guided methodology for specifica- tion analysis,” in Tools with Artificial Intelligence (ICTAI), 2013 IEEE 25th International Conference on, pp. 749–754, IEEE, 2013.

[29] B. Singh, A. Shankar, F. Wolff, C. Papachristou, D. Weyer, and S. Clay, “Cross-correlation of specification and rtl for soft ip analysis,” in Design, Automation and Test in Europe Conference and Exhibition (DATE), 2014, pp. 1– 6, IEEE, 2014.

[30] J. Bhadra, M. S. Abadir, L.-C. Wang, S. Ray, et al., “A survey of hybrid techniques for functional verification,” IEEE Design and Test of Computers, vol. 24, no. 2, pp. 112–123, 2007. bibliography 113

[31] D. R. Tom Fitzpatrick, “Of camels and committees: Standards should en- able innovation, not strangle it,” in DVCON Proceedings, 2014.

[32] S. A. Edwards, “Design and verification languages,” 2004.

[33] S. Rosenberg and K. Meade, A practical guide to adopting the universal veri- fication methodology (UVM). Cadence Design Systems, 2013.

[34] T. Kropf, Introduction to formal hardware verification. Springer, 1999.

[35] H. Kaiya and M. Saeki, “Using domain ontology as domain knowledge for requirements elicitation,” in , 14th IEEE Inter- national Conference, pp. 189–198, IEEE, 2006.

[36] L. Goldin and D. M. Berry, “Abstfinder, a prototype natural language text abstraction finder for use in requirements elicitation,” Automated Software Engineering, vol. 4, no. 4, pp. 375–412, 1997.

[37] W. R. Cyre, “Capture, integration, and analysis of digital system require- ments with conceptual graphs,” Knowledge and Data Engineering, IEEE Transactions on, vol. 9, no. 1, pp. 8–23, 1997.

[38] A. Holt and E. Klein, “A semantically-derived subset of english for hard- ware verification,” in Proceedings of the 37th annual meeting of the Association for Computational Linguistics on Computational Linguistics, pp. 451–456, As- sociation for Computational Linguistics, 1999.

[39] C. Kirchsteiger, C. Trummer, C. Steger, R. Weiss, and M. Pistauer, “Au- tomatic verification plan generation to speed up soc verification,” in NORCHIP, 2008., pp. 33–36, IEEE, 2008.

[40] S. Flake, W. Müller, and J. Ruf, “Structured english for model checking specification.,” in MBMV, pp. 99–108, 2000. bibliography 114

[41] G. H. Chisholm, S. T. Eckmann, C. M. Lain, and R. L. Veroff, “Understand- ing integrated circuits,” IEEE design & test of computers, vol. 16, no. 2, pp. 26–37, 1999.

[42] D. James, “Reverse engineering delivers product knowledge; aids technol- ogy spread,” Electronic Design, 2006.

[43] P. Subramanyan, N. Tsiskaridze, K. Pasricha, D. Reisman, A. Susnea, and S. Malik, “Reverse engineering digital circuits using functional analysis,” in Proceedings of the Conference on Design, Automation and Test in Europe, pp. 1277–1280, EDA Consortium, 2013.

[44] D. G. Saab, V. Nagubadi, F. Kocan, and J. Abraham, “Extraction based ver- ification method for off the shelf integrated circuits,” in Quality Electronic Design, 2009. ASQED 2009. 1st Asia Symposium on, pp. 396–400, IEEE, 2009.

[45] M. C. Hansen, H. Yalcin, and J. P. Hayes, “Unveiling the iscas-85 bench- marks: A case study in reverse engineering,” IEEE Design & Test of Computers, vol. 16, no. 3, pp. 72–80, 1999.

[46] G. Lehmann, B. Wunder, and K. D. Müller-Glaser, “Basic concepts for an hdl reverse engineering tool-set,” in Proceedings of the 1996 IEEE/ACM international conference on Computer-aided design, pp. 134–141, IEEE Com- puter Society, 1997.

[47] W. Li, Z. Wasson, and S. A. Seshia, “Reverse engineering circuits using be- havioral pattern mining,” in Hardware-Oriented Security and Trust (HOST), 2012 IEEE International Symposium on, pp. 83–88, IEEE, 2012.

[48] K. Werner, “Can ip quality be objectively measured?,” in Proceedings of the conference on Design, automation and test in Europe-Volume 3, p. 30330, IEEE Computer Society, 2004. bibliography 115

[49] Z. Meng, G. Minglun, and P. C. Chan, “A practical ip quality measure- ment framework,” in ASIC, 2007. ASICON’07. 7th International Conference on, pp. 1313–1316, IEEE, 2007.

[50] F. Wickberg, “Hdl code analysis for asics in mobile sys- tems,” Master’s thesis, LINKOPING UNIVERSITY, liu.diva- portal.org/smash/get/diva2:24142/FULLTEXT01, February 2007.

[51] I.-X. Standard, “Ieee 1685–2009,” IEEE standard for IPXACT, standard struc- ture for packaging, integrating and reusing IP within tool flows, 2009.

[52] G. Koch, U. Kebschull, and W. Rosenstiel, “A prototyping environment for hardware/software codesign in the cobra project,” in Proceedings of the 3rd international workshop on Hardware/software co-design, pp. 10–16, IEEE Computer Society Press, 1994.

[53] M. López, C. A. Iglesias, and J. C. López, “A knowledge-based system for hardware-software partitioning,” in Proceedings of the conference on Design, automation and test in Europe, pp. 914–915, IEEE Computer Society, 1998.

[54] Y. Naveh, M. Rimon, I. Jaeger, Y. Katz, M. Vinov, E. s Marcu, and G. Shurek, “Constraint-based random stimuli generation for hardware verification,” AI magazine, vol. 28, no. 3, p. 13, 2007.

[55] A. Ltd., “Amba 3 specifications.” http://www.arm.com/products/system- ip/amba/amba-open-specifications.php, 2003.

[56] Cadence, “Cadence vip catalog.” http://ip.cadence.com/ipportfolio/verification- ip/simulation-vip, 2014.

[57] Synopsys, “Synopsys verification ip.” http://www.synopsys.com/VIP, 2014.

[58] W. Wögerer, “A survey of static program analysis techniques,” Vienna University of Technology, 2005. bibliography 116

[59] D. Esposito, “Static code analysis and code contracts,” August 2011.

[60] H. Williamson, XML: The complete reference. McGraw-Hill Professional, 2001.

[61] “Xml basics.” http://www.webucator.com/tutorial/learn-xml/xml- basics.cfm.

[62] “Introduction to xml.” http://www.w3schools.com/xml/xml_whatis.asp.

[63] J. Al-Eryani. http://opencores.org/project,fpu100.

[64] Z. Li and K. Ramani, “Ontology-based design information extraction and retrieval,” AI EDAM: Artificial Intelligence for Engineering Design, Analysis, and Manufacturing, vol. 21, no. 02, pp. 137–154, 2007.

[65] S. Nirenburg and V. Raskin, Ontological semantics. MIT Press, 2004.

[66] I. S. Committee et al.,“754-2008 ieee standard for floating-point arith- metic,” IEEE Computer Society Std, vol. 2008, 2008.

[67] “Protégé.” http://protege.stanford.edu. Accessed: 2013-10-03.

[68] S. Opencores, “Wishbone system-on-chip (soc) interconnection architec- ture for portable ip cores,” tech. rep., Technical report, Opencores, 2002.

[69] S. C. Shapiro, “Artificial intelligence,” 1982.

[70] D. Maynard, Y. Li, and W. Peters, “Nlp techniques for term extraction and ontology population,” in Proceeding of the 2008 conference on Ontol- ogy Learning and Population: Bridging the Gap between Text and Knowledge, pp. 107–127, 2008.

[71] M. Poesio and A. Almuhareb, “Extracting concept descriptions from the web: the importance of attributes and values,” in Proceedings of the Confer- ence on Ontology Learning and Population: Bridging the Gap between Text and

Knowledge, pp. 29–44, Citeseer, 2008. bibliography 117

[72] Y. Sure, J. Angele, and S. Staab, “Ontoedit: Multifaceted inferencing for on- tology engineering,” in Journal on Data Semantics I, pp. 128–152, Springer, 2003.

[73] A. Shankar, B. P. Singh, F. Wolff, and C. Papachristou, “Nefcis: Neuro- fuzzy concept based inference system for specification mining,” in Tools with Artificial Intelligence (ICTAI), 2013 IEEE 25th International Conference

on, pp. 337–343, IEEE, 2013.

[74] http://www.dilloneng.com/uploads/2/1/2/2/21220816/fp_spec.pdf.

[75] http://bitsavers.informatik.uni-stuttgart.de/pdf/weitek/WTL_3167_Floating- Point_Coprocessor_Sep88.pdf.

[76] http://www.altera.com/literature/ug/ug_altfp_mfug.pdf.

[77] R. Usselmann. http://opencores.org/project,fpu.

[78] Xilinx. http://www.xilinx.com/support/documentation/ ip_documentation/floating_point_ds335.pdf.

[79] Altium. http://www.altium.com/files/AltiumDesigner/s08/ learning- guides/CR0171.

[80] Actel, “Grfpu lite companion core data sheet.” http://www.actel.com/ipdocs/GRFPU_Lite_DS.pdf.

[81] C. D. Manning, P. Raghavan, and H. Schütze, Introduction to information retrieval, vol. 1. Cambridge university press Cambridge, 2008.

[82] F. Corno, M. S. Reorda, and G. Squillero, “Rt-level itc’99 benchmarks and first atpg results,” IEEE Design & Test of Computers, vol. 17, no. 3, pp. 44–53, 2000.

[83] M. Guillermo. http://opencores.org/project,fpuvhdl.

[84] D. Lundgren. http://opencores.org/project,fpu double. bibliography 118

[85] A. Kamppi, L. Matilainen, J. Maatta, E. Salminen, T. D. Hamalainen, and M. Hannikainen, “Kactus2: Environment for embedded product develop- ment using ip-xact and mcapi,” in Digital System Design (DSD), 2011 14th Euromicro Conference on, pp. 262–265, IEEE, 2011.

[86] J. Ellson, E. Gansner, L. Koutsofios, S. C. North, and G. Woodhull, “Graphviz—open source graph drawing tools,” in Graph Drawing, pp. 483– 484, Springer, 2002.

[87] J. Ferraiolo, F. Jun, and D. Jackson, Scalable vector graphics (SVG) 1.0 speci- fication. iuniverse, 2000.

[88] e. a. Erik Dahlström, Patrick Dengler, “Scalable vector graphics (svg) 1.1 (second edition).” http://www.w3.org/TR/SVG11/Overview.html, Au- gust 2011.

[89] M. H. Walker, N. J. Eaton, and N. Eaton, Microsoft Office Visio 2003 Inside Out. Microsoft Press, 2004.

[90] R. Olsen, OmniGraffle 5 Diagramming Essentials: Create Better Diagrams with Less Effort Using OmniGraffle. Packt Publishing Ltd, 2010.

[91] A. Cimatti, E. Clarke, E. Giunchiglia, F. Giunchiglia, M. Pistore, M. Roveri, R. Sebastiani, and A. Tacchella, “Nusmv 2: An opensource tool for symbolic model checking,” in Computer Aided Verification, pp. 359–364, Springer, 2002.

[92] S. I. I. (si2.org). https://www.si2.org/?page=435/tdml/dtutorial.zip.

[93] T. version 2.0. http://www.timingtool.com.

[94] S. Cornor. http://opencores.org/project,amber.

[95] R. Hayes. http://opencores.org/project,pit.