A hierarchical method is typically used to describe a design process, but for very large designs, hierarchical verification is the best and perhaps the only way to meet schedule and quality requirements. The approach allowed us to start our verification process at the highest level, with algorithmic system description, and to successively refine the verification model down to detailed register-transfer level (RTL) models for implementation.

We began with a high-level model that would eventually be implemented in billions of gates, or scores of very large-scale integration chips. We involved the verification function very early in the design process and at a higher level of abstraction than usual. This enabled us to ensure that each successive level of refinement met the functional intent of the level above.

We chose to do as much of the verification in C++ as possible. C++ was a good choice, because its generality is useful when doing architectural exploration. You can try out different organizations and algorithms more easily with an object-oriented programming language like C++ than with a more constrained implementation language like Verilog or VHDL. We started writing in Cynlib with a C++ architectural model. The architecture, or system model, was for the entire product. It functioned as an integrated whole and as a model, and it was able to process transactions fast enough to analyze the functionality of the entire system. We chose Cynlib, the open-source hardware design class library created from CynApps (now Forte Design Systems Inc.) because Cynlib contained all of the constructs needed for the system model, and because it was compatible with the eventual RTL implementation.

That way we were able to model things like hardware parallelism, timing and bit widths at the very beginning of the design. This was crucial because we had everything we needed to maintain a system model at different levels of abstraction, all the way from architectural to chip and block levels.

With a successive-refinement approach, we were able to separate parts of the individual system model one at a time and add detail to each. These detailed models were individual chip models. Because Cynlib has a built-in simulation kernel, we were always able to ensure that the elaboration we were adding functioned properly by simulating and comparing results. We did this with each chip model until the entire system model had been defined to a greater level of detail.

Next, we isolated parts within each chip model for further elaboration. More detail was again added to those parts to turn each into a block model. Each block model was simulated using Cynlib so that we could be sure that each functioned as intended.

• A high-level abstract model that runs in the system model. This model is architecturally complete and models enough detailed behavior to verify system functionality and performance.
  
• The Verilog RTL design, which was based on the same specification used to develop the block model.
  
• The layout and floor plan, which were based on the same specification as the RTL and block models.
  

Also, all three modeling activities exchanged information, such as "the chip is too big," or "we have to add more buffers," or "we need a different handshake."

We converged on an architectural and microarchitectural specification that would meet the architecture requirements and the power/area/timing constraints.

The block model was created by successive refinement from the chip model, either in C++ or directly in Verilog. Thus, in a block-by-block fashion, verified RTL Verilog models were implemented for subsequent logic synthesis with Design Compiler.

Testbenches are key
For our design, one of the most important aspects of the hierarchical verification process was the reuse of testbenches. We created low-level testbenches to drive the simulations of the chip models. Written in Cynlib, each simulation was able to drive its particular chip model in a data-flow fashion.

When the chip models were further refined into block models, we refined the testbenches as well. This was a simple process in Cynlib, and was a fully functional testbench for the block-level models at the RTL level. In some cases, we used symbolic simulation from Innologic to verify the block-level modules.

After we implemented each block model in Verilog, we used CoCym from Forte to drive the Verilog simulator with the Cynlib testbench. We used C++/Cynlib as a powerful and flexible medium for writing testbenches that could put the Verilog RTL blocks through CoCym. In that way we were able to ensure that the Verilog block performed just the same as the Cynlib block model. Since we reused much of the C++/Cynlib testbench from the system model or the chip model, this co-simulation step went quickly.

The reuse and refinement of testbenches at different levels of abstraction and the reuse of testbenches to prove Verilog modules that had already verified their Cynlib counterparts, was a key factor in boosting verification productivity. Through the reuse of testbenches, we were able to move more quickly.

Hardware test
The final benefit of this hierarchical verification process was proof that the hardware itself would function in the system and the blocklevel models. We took the actual Verilog hardware modules and with a Cynlib wrapper around each, inserted them one at a time into the more abstract verification models. The correct re-simulation of those more abstract models showed that the inserted hardware modules had the same functionality as their verification counterparts.

As is usual when using new tools, a number of limitations and difficulties had to be overcome. As we got down to doing mixed-level simulation, the Cynlib-Verilog co-simulation interface was substantially reworked to improve its performance.

In the end, we created a very large system design with many large chips and ensured that the overall product would function as specified. The total gate count of the end product is in the billions. Since we worked with Forte in pioneering this entirely new approach to verification, it has chosen to formalize the hierarchical verification process with the term GigaScale Verification, and Forte is working on tools to further automate the process.

Peter Barnes is Hardware Verification Manager at Procket Networks (Milpitas, Calif.) and John Sanguinetti is Chief Technical Officer at Forte Design Systems Inc. (Santa Clara, Calif.).