System Design

Using Timing Analysis for ASIC Sign-Off

Static timing analysis can improve timing verification in ASIC design and produces results much more quickly

by Paul Granese

Static timing analysis is becoming increasingly important as the primary timing verification tool in the design of application-specific integrated circuits (ASICs). The main challenges facing designers of ASICs with submicron features are circuit size and the resulting circuit complexity. Static timing analysis takes less time than the traditional use of timing simulators and does not require detailed knowledge of the location of hundreds of thousands of gates and all possible paths through them.

Electronic design automation (EDA) started with the bottom-up design techniques of schematic capture and simulation. ASIC design complexity and the need to shorten the time to market soon led to top-down design, which is based on hardware design languages (HDLs) and synthesis.

In the traditional ASIC design process, the engineer designs the circuit and uses a timing simulator to verify that the gate-level logic design is functionally correct and the timing is accurate. With extremely complex ASICs, however, this process takes so long that it is impractical. Static timing analysis is becoming increasingly important for primary timing verification.

Static timing analysis is a closed-form analysis of the design. "Closed-form" refers to the use of an algorithm to examine the timing properties independently of the particular design. For example, a chip may contain a counter, consisting of one or more registers and combinatorial logic that computes the next value of the counter and feeds that value back to the registers. The delay through the devices can be added path by path in a mathematical computation rather than a simulation. This process requires a realized design with a netlist, knowledge of all connections between gates, and known target technology and types of cells. With post-route applications there is an exact model of how the design will be built.

Timing-based simulation is an emulation of reality. It creates a set of events and simulates those events as if the physical system really existed. The simulator recreates or emulates the physical behavior of the system. The simulated system runs through its paces so that the designer can observe its behavior. Simulation allows the designer to easily examine signals that would be very difficult to probe and measure physically because they are found on very small traces within the chip. And simulation is very intuitive, because it is an imitation of reality. The behavior of the design in the simulation exactly mirrors the real behavior. It works the way designers think about a design because the simulated chip is functionally doing exactly what it was designed to do (or if not, it reveals a mistake in design). The timing diagrams produced are exactly the same as those displayed by an oscilloscope in a physical system. Simulation exercises the chip in such a way that the timing problems found are real -- there should be no false timing problems that would have to be explained away.

Limitations of traditional methods To verify a circuit of moderate size (30 to 50 kgates), the designer may be able to generate test patterns that effectively stimulate the circuitry. Doing so requires first-hand familiarity with the design. For example, to check a critical path through a flip-flop embedded somewhere within many hundreds of logic gates, the designer must know how to make all the gates switch correctly to toggle the flip-flop.

Figure 1. These three procedures are in general use for ASIC sign-off. The traditional way (left) uses gate-level functional and timing simulation. Static timing analysis in parallel with this traditional design flow (center) permits the design of much larger, more synchronous chips. Finally, very large synchronous circuit designs can be implemented with a procedure (right) that does not use gate-level simulation, but only static timing analysis and automatic test program generation (ATPG).

With the smaller, more manageable designs of the past, designers could easily check such critical paths because they were familiar with the circuitry. With gate counts today reaching 500 kgates and more, however, designers cannot isolate various elements and effectively check every critical timing path. Also, because today's large designs are typically generated from an HDL and synthesis tool, by the time the designer traces from the HDL down to the gate level, he or she encounters so much foreign, unmapped territory that checking the timing paths is extremely difficult, if not impossible.

Furthermore, even if all the test patterns were available, simulation would take too long to be practical. Consequently, timing simulation is an inefficient way to check such large circuits for all potential timing hazards.

With a timing simulator, the designer must simulate every condition and apply input stimulus through the circuit to the desired location. Static timing analysis, however, does this automatically without any user input stimulus, and therefore does not require any user knowledge of how to get to a particular flip-flop.

Static timing analysis is able to efficiently and quickly handle designs with many hundreds of thousands of gates. Several EDA companies now offer static timing analysis tools. At Viewlogic , we use a static analysis tool called Motive, from Quad Design (Camarillo, CA). Motive exhaustively checks the entire circuit for every timing path with a thoroughness that is not possible with timing simulation.

How static timing analysis is used Most ASIC vendors at present offer a traditional design flow from synthesis to logic gates, verified with timing simulation. In addition, many ASIC vendors now also require the customer to perform static timing analysis to exhaustively check all the timing in the circuit. To accomplish this, designers must integrate static timing analysis tools into the design flow. These tools require new design procedures for timing verification. These procedures, in turn, require stringent design rules that engineers must follow to separate timing and functionality as two separate analyses. In the short term, at least, these rules require that the design be fully synchronous. They may also require a single clock and no feedback loops.

Three procedures are available to verify timing, as shown in Figure 1. The first, familiar to most designers, is standard timing simulation, which works well for small designs. The second procedure is timing simulation combined with timing analysis, which is appropriate for larger designs with a considerable amount of asynchronous circuitry. The final procedure is static timing analysis (to check the circuit timing) plus automatic test program generation (ATPG, for fast functional simulation). ATPG is sometimes required in a foundry, as described below. Static timing analysis and ATPG are much faster than ordinary timing simulation. This approach is best used for very large, mostly synchronous designs.

Sign-off Sign-off timing is the last step in the design process when the chip is ready to be released to fabrication. At that point everything about the chip is known. This is a major decision point because it commits the chip to physical production. It is the point at which the designer stops making choices, optimizing the design, and correcting problems. He or she should be fully confident that everything possible has been done to prove that there are no timing problems.

When it is known where every piece of metal goes, its length, its capacitance, what layer it's on, and everything else about the design of a chip, an exact computation is possible of the chip's successful operation. With pre-route applications much is known about the design, such as how all the gates interconnect. But how the design is physically implemented, where gates are on the die, or how long the traces are, remains unknown, so an estimate of these must be made, based on statistics.

Synchronous design Static timing analysis is not well suited to asynchronous designs. When the functional specification requires asynchronous design (for example, by protocol definition in a communication chip), the designer must use simulation-based methods. On the other hand, in synchronous designs, the system changes state on each clock pulse. These designs are inherently more verifiable since the timing is predictable and can be represented in closed form. Timing verification is trivial in even the most complicated functional design, if implemented with strict synchronous design rules. Since designers are wrestling with very complicated problems, this procedure eliminates a whole class of risk from their designs.

Because a simulator emulates reality, it requires a set of test vectors that can stimulate the system and demonstrate its functions. If these vectors do not fully exercise every possible path in the design, especially those with critical timing, the simulation may miss some timing problems. In some cases some of these faults will be missed even if stimulus vectors exercise every path in the design. Because of this possibility, simulation is an informal, less disciplined approach to timing verification.

Static timing analysis may eventually be preferred for ASIC sign-off, but for the time being, timing simulation continues to be used. Historically, ASIC foundries have depended on the designer's vector to verify its own processes. If a foundry fabricates a chip that doesn't work in the application for which it was designed, the foundry must be able to demonstrate that the physical chip behaves the same way on the designer's test vectors as it did in simulation. This protects the foundry from the liability of a bad design, and it protects the designer from process problems that could cause the physical device to differ from the design. With static sign-off timing, however, situations, such as full-scan implementations, could arise for which the designer cannot supply simulation data to the foundry. In that case, the foundry would need ATPG tools to show that the physical realization of the chip matches the simulation, as mentioned previously (Figure 2). In these remarks, the "designer" and the "foundry" may be independent organizations or merely different departments in one company.

Tradeoffs Although static timing verification is better at identifying whether or not the chip timing is correct, and in many ways is much more explicit than simulation, there are reasons for the continued use of simulation. The major reason is that it clearly identifies the causes of deviation between silicon behavior and simulation behavior. The cause of a fault is easier to identify in simulation than in static timing. In static timing, if a chip does not work, the designer must first identify whether it is a problem in logic design or a timing problem, and then, if it is a timing problem, determine its cause.

One advantage of static timing analysis over timing simulation is that the circuit doesn't have to be complete, because the process is closed-form and it evaluates path delays. It can identify critical paths independent of circuit functionality. In simulation, however, the chip must be functionally correct before the designer can consider timing.

Another advantage of static timing is that it is exhaustive. With no need to write any vectors, the designer can find all critical paths without having to stimulate them. Static timing tools are more explicit than simulation tools because they identify exactly what path made the failure occur. Timing analysis tools can automatically trace back through the circuit to identify failures.

Figure 2. Static timing analysis can quickly check a full scan implementation for critical paths. When these are found, they can be removed from the scan circuitry (Figure 3), to speed up the circuit. However, it can also find "faults" that are actually nonexistent, so the design flow should include fault grading.

In many cases simulation test vectors are extraordinarily difficult or impossible to generate because of the size and complexity of the circuit. Simulators typically cannot automatically provide a detailed history or specify details of path delays that create a timing problem. Simulators can provide this capability only through a tedious debugging process.

If a design organization is willing to adopt a rigorous, synchronous design procedure, designers can prove that their chip will not have timing problems and sign off on timing. For most designs, however, the perfectly synchronous design model cannot be followed. The purest, strictest, synchronous procedure is not practical, usually because it uses too many gates or too much power.

The main impetus toward static timing for sign-off is performance. The newest chips are so large that emulating reality has become impractical, requiring many days or even a week or more to run a simulation. Static timing can evaluate that same chip in a half-hour or an hour and prove that no timing problems exist, or find their cause if they do exist. Simulation runs consume time, and do not always prove that a design will operate.

In the short run, the industry will not eliminate simulation, but will begin to add static timing analysis to their design processes. Although this approach does not solve the performance problem, it greatly increases the probability that that chip will be manufactured without timing problems.

Current limitations Static timing analysis at present is not foolproof. It can report a path that looks as if it might contain a timing problem, but is actually error-free. Because it is not emulating reality, it checks every path through a chip design, including those in which a signal might interfere with a signal in another path, even though the logic design precludes the use of such a path. Static timing tools are notorious for such "false paths," even in tools such as Quad Design's Motive which attempt to eliminate them.

These false paths, whether actual or merely hypothetical, create an additional burden for the designer, who must make assertions to eliminate them. Such assertions, or knowledge-based inputs, are statements about the intended timing behavior of a circuit that the timing verifier assumes are true. A rigorous procedure must validate those assertions to ensure that they are really true. This is not a simple problem, although with a more conservative procedure; that is, more synchronous design, validation becomes easier.

In the purest synchronous design, data from combinatorial logic feeds every register, which changes state on every cycle. The designer identifies critical paths simply by finding the longest paths through the combinatorial logic. If the delay through the path is longer than the duration of one clock cycle, or even if, although shorter, it is very nearly the same--rather like the traveler who has only minutes to change planes at an airport, by running from gate to gate and getting through the second gate just as it closes--the logic must be refined or the clock rate reduced. But if the registers do not necessarily change every cycle, the designer has to tell the static timing tool which registers do not change with every cycle, and the circumstances under which they remain unchanged. This introduces a new class of risk, because the designer could make a mistake in such an assertion.

This is only one of many issues that still need to be worked out before applying static timing analysis exclusively, and before abandoning simulation-based procedures. Part of the work remaining must balance what is verifiable against what is practical, and must generate the algorithms and tool support necessary to make it a sign-off procedure.

Figure 3. Removing a critical path from a scan chain can speed up the circuit.

Is it for you? Static timing analysis is not for every ASIC designer. It is best suited for very large synchronous designs, such as chips for graphics, workstations, and small computers. Designers who are unlikely to need these procedures are those who use mostly asynchronous circuitry, or who produce smaller designs. Typical telecommunication designs, for example, might contain 70 to 80 kgates and contain much asynchronous circuitry. For them the traditional method of timing simulation is adequate.

But some designers on the leading edge of silicon technology may plan devices with up to half a million gates that they cannot simulate. They will be obliged to accept new rules to ensure that they can separate logic design and timing analysis. They will discover a marked improvement in turn-around time in analyzing the design, and a more complete verification of timing.

All ASIC vendors today still require full timing simulation for sign-off, although some are beginning to add the requirement for timing analysis. However, a handful of leading ASIC vendors are working with EDA companies now to define new procedures that combine static timing analysis with functional simulation, the latter not involving any timing checks. Names for these procedures include fast functional simulation, unit delay simulation, or cycle-based simulation. They expect to achieve orders-of-magnitude improvement in verifying ASIC designs, allowing ASIC designers to get there plans right with fewer design iterations, and to get them to market sooner.

Paul Granese is ASIC business manager at Viewlogic Systems Inc. , (Marlboro, MA).

To voice an opinion on this or any Integrated System Design article, please e-mail your message to michael@asic.com