In a recent Mentor Graphics whitepaper titled “Boosting RTL Verification with High-Level Synthesis”, Shawn McCloud talks about how the use of high-level synthesis both directly and indirectly affects the functional verification process. He says: Verifying at the C level is simpler and faster because it is more abstract than the RTL. There are fewer things to verify, fewer lines of code to debug, higher simulation performance, and quicker fixes. The second thing he states must be true is that the synthesis process must be correct by construction and he says: There are two common pitfalls that prevent most HLS tools and methodologies from achieving correct-by-construction RTL: schedule dependent source code and synthesis short cuts that misrepresent the specification. He goes on to explain why he believes these are issues, but I will not go into those here. Let’s get back to the verification issue.

[F]ull coverage of the design not only deliver high-quality designs for synthesis but also produce C-level golden reference models and high-level tests and testbenches that can be reused at the RTL. Rather than extending on these concepts, the paper chooses instead to talk about why SystemC has problems, and why it cannot separate function from architecture. Unfortunately the statements do not really hold true because it is equally possible to do this in a SystemC description. Remember that SystemC is noting more than a C++ class library that enables hardware concepts to be defined, but it does not mean that they have to be defined. I agree that if a SystemC description contains timing and explicit concurrency, that it is a lower level description than a pure untimed one. So back to the real issue:

Improving simulation performance even more, C++ models execute directly on the host workstation; they do not require an event-based simulator or a simulation kernel. Faster simulation enables more test vectors to be applied for greater coverage of the design. All very true. Yet, verification engineers still need to know when their design has been fully and properly covered. Any truly worthwhile HLS solution must be tightly integrated with the best C/C++ analysis tools that collect and measure code coverage metrics. And that is where I have a problem. This is not a verification methodology anymore than code coverage is on an RTL description. Yes - it can tell you when you are not done, but it can never tell you that verification is complete. Neither can this help you get to a good set of tests in a decent amount of time. In addition, a verification methodology that spans both high-level and RTL must be extensible to be able to handle incremental capabilities added n the refinement process, such as error correction and detection, redundancy logic or logic that is enabled in IP and activated by software.

So while you will find no argument from me that verification at a higher level of abstraction is better, this alone is not a methodology. We need suitable methodologies that can ensure that an abstract model is fully verified and I hope that the high-level synthesis vendors are working on this, otherwise they will never be able to fully deliver on the promise of increased productivity that synthesis provides.

This is a well written paper that sets out the problem nicely, although it chooses to attack SystemC rather than deliver on the promise of the title. I hope to see more about how Mentor is going to solve this verification problem in the near future.

--------------------------------------------
Brian Bailey – keeping you covered