ALGEBRAIC APPROACH TO ARITHMETIC DESIGN VERIFICATION

1. ALGEBRAIC APPROACH TO ARITHMETIC DESIGN VERIFICATION M.A. Basith, T. Ahmad, A. Rossi *, M. Ciesielski ECE Dept. Univ. Massachusetts, Amherst * Univ. Bretagne Sud, Lorient France

2. Introduction • Design Verification • A dominating factor in design flow • Formal Verification • Equivalence checking, model checking, property checking, etc. • Verification of combinational designs – a solved problem • Remains challenging for sequential circuits, but big progress • Verification of Arithmetic Designs and Data-paths • Difficult, bit blasting makes it not scalable • This Work • Verifying functionality of arithmetic designs • Not exactly EC, but comparing design to a “golden model” (reference signature) • Using algebraic rather than Boolean or symbolic approach

3. 4 2 1 4 0 1 x0 x1 x2 y0 y1 y2 2 1 Related Work • Canonical representations • BDD, too fine-grained [Bryant’85] • BMD [Bryant’95] and TED [Ciesielski’06], too-low grained • cannot express output bits as a function of word-level inputs • ILP based Data-path Verification [Brinkmann’02] • Transforms bit-vector expressions into ILP constraints • Cannot handle large designs, variable width limitation • Term rewriting for RTL equivalence checking [Vasudevan’07] • Database of rewrite rules for typical multiplier implementation schemes • Cannot be automated for non-standard implementations • Symbolic Algebra Methods [Shekhar’05] • Solving vanishing polynomial (modulo 2m) using finite ring algebra • Uses Grobner basis, scripting with Maple tools • Cannot handle complex arithmetic designs

4. Related Work, cont’d. • Arithmetic Bit-Level (ABL) [Wienand CAV’08, Pavlenko DATE’11] • Represents design as network of HA (ABL) • Creates algebraic expression of Boolean-level information • Requires structural similarity • Complex math, Grobner basis • Can it handle very large designs ? • ABL provided main motivation for our approach • No need for Grobner basis • No need for deriving and manipulating large polynomials • Use only linear expressions

5. Our Approach • Represent arithmetic design on ABL • Network of gates, HAs and FAs • Write linear equations to represent data flow • Compute algebraic signature of the network • Prove functionality by matching signature with reference signature (specification)

6. Arithmetic Network Model • Half-Adder • Binary inputs ( a, b) • Binary outputs ( S, C) • Full-Adder • Binary inputs ( a, b , cin) • Binary outputs ( S, C)

7. Gate Level Models x + y = 1

8. Mathematical Representation xI - Inputs xO - Outputs xS - Internal signals Network Equations:

9. Mathematical Representation xI - Inputs xO - Outputs xS - Internal signals Network Equations: x b A In matrix form: A x = b A – m x n constraint matrix (network) x– n-vector representing signals b – constant vector

10. Reference Signature Ref(N) = SigO(N) – SigI(N) = 4x8 + 2x9 + x10 - x1 - x2 - x3 - x4 - x5 - x6 - x7 SigO(N) = 4x8 + 2x9 + x10 (output signature) Reference Signature Functionality provided by user SigI (N) = x1 + x2 + x3 + x4 + x5 + x6 + x7 (input signature)

11. Reference Signature - definition • Reference Signature, Ref(N) • Provides relationship between input and output variables • Difference between the output signature and input signature Ref(N) = SigO − SigI Mathematically rO – output signature vector xO – primary output vector rI – input signature vector xI – primary input vector

12. Reference Signature - example Reference Signature for a 7-3 counter: or, equivalently Output Signature = 3-bit encoding of the output word Input Signature = sum of the input bits T

13. Algebraic Signature The network is similarly represented by its Algebraic Signature • Algebraic signature, Sig(N) • Defines relationship between input, output and internal signal variables (xI xO xS) • It is a linear combination of x= [xI xO xS]T where rT = [rI rO rS] • It can be computed directly from matrix A ATα = r by choosing a linear combination α of rows of matrix A • Goal: • compute α that will eliminate internal variables xS (rS = 0) • the resulting signature should match the reference signature

14. Verification Goal • Prove that the network (implementation) matches the specification given by the reference signature. That is: • Given the reference signature Ref(N) (specification) • Compute algebraic signature Sig(N) (implementation) • Check if Sig(N) = Ref(N) ? • For the network to be correct the two signatures should match

15. Computing Algebraic Signature n – total number of signals in the network m – number of linear equations in the system A x = b AI xI + AO xO + AS xS = b AI – columns associated with xI xI - primary input variables AO – columns associated with xO xO - primary output variables AS - columns associated with xS xS - internal signal variables

16. 0 (ideally) Computing Algebraic Signature • Algebraic signature Sig(N) relates I/O and internal signals • Sig(N) can be obtained as a linear combination of rows of A that matches Ref(N) α – vector of integer coefficients that reduces matrix A to signature vector r • Ideally, want rs = 0 (eliminate all internal signals)

17. Completing the Signature • If the system is infeasible, relax rS and solve for α If there is no solution: design is incorrect • Otherwise compute rS If rS = 0, design is correct • What oif rS ≠ 0, is the design incorrect?

18. Computing Algebraic Signature – example (rs=0) xI= {x1, x2, x3 ,x4, x5 ,x6, x7} xO = {x8, x9, x10} xS = {x11, x12, x13, x14, x15} r r r A A α α α = * -x1 –x2 –x3 –x4 –x5 –x6 –x7 +4x8 +2x9 +x10 -x1 –x2 –x3 +2x11 +x12 -x4 –x5 –x6 +2x13 +x14 -x7 +x10 –x12 –x14 +2x15 4x8 +2x9 -2x11 -2x13 -2x15

19. Computing Algebraic Signature – example (rs0) Ref(N) Network equations: Sig(N) Residual Expression • rS set to 0, system is infeasible • rS relaxed, gives residual expression

20. Residual Expression • Residual Expression, RE(N) = Sig(N) − Ref(N) = rST xS • An expression associated with the internal signalsxS • RE(N) should evaluate to zero for the design to be correct • Need additional Boolean constraints • To prove RE = 0, we need additional constraints to impose on N • Structural Constraints • Caused by fanout of internal signals, equality constraints • Boolean Constraints • Internal signals of FA, can be propagated in the network

21. Proving RE = 0 with Boolean constraints Computation of Signature: Algebraic Signature: Residual Expression: BooleanConstraints: Reference Signature:  RE(N) = 0 Now Ref(N) = Sig(N): design is correct

22. Functional Verification Flow

23. Comparison with SMT Solvers • Problem can be modeled as SAT • Need to show that is unSAT • With Boolean constraints, RE = Φ. • Without Boolean constraints, RE ≠ Φ. • (MO = out of memory 4GB, TO = timeout after 1800 sec)

24. Results – Large Multipliers CPU runtime for computing algebraic signature for n-bit integer multipliers with additional constraints propagated in the network.

25. Results – Booth-encoded Multipliers Complexity: O(N2) in number of gates CPU runtime for computing algebraic signature for n-bit integer Booth-encoded multipliers with additional constraints propagated in the network.

26. Conclusions • Developed a new technique for functional verification of arithmetic circuits based on computing algebraic signature • Application • RTL and gate-level Verification • Given reference signature, system tries to match the signatures • Equivalence Checking • Comparing two networks on the basis of their signatures • Property Checking • Represent property P by its algebraic signature, SigP(N) = rT xP • Check for consistency with reference signature APTα = rP • Extracting circuit behavior • Use SigO(N) to compute SigI(N) • Limitations: limited to linear networks (Wallace trees, etc.)

27. Thank You

28. Outline • Introduction and Motivation • Related Work • Algebraic Modeling of Arithmetic Networks • Mathematical Formulation • Computing the signature • Residual expression and Boolean constraints • Relation to SMT Techniques • Results • Conclusion and Future Work

29. Verification Methods • Boolean methods • Good for gate-level designs • Inefficient for arithmetic designs • Decision diagrams and SAT solvers • Requires “bit-blasting” (too low-level for arithmetic) • Symbolic Algebra • Too high level: limited to polynomial expressions or infinite precision • SMT • Generalization of Boolean SAT • Lack of adequate models to handle arithmetic designs • This Work • Functional verification of arithmetic circuits by computing algebraic signature

30. Related Work - Summary • Decision diagrams and Boolean SAT • Not able to handle arithmetic functions efficiently • ILP Methods • Computationally prohibitive for large designs • Symbolic Algebra • Limited to small designs that can be represented as polynomials • ABL Methods • Assumes structural similarity, which is often absent • Uses Grobner basis (overkill ?) • Our Method • No assumption about structural similarity • Handles arithmetic on bit-level using algebra • Fast and scalable (but limited to linear networks)

31. Complexity Graph Complexity:O(N2) Computational complexity of our approach

32. Future Work Need to learn additional Boolean Constraints Is this problem as difficult as the original one? Data-Path Verification Obtain a reference signature for the entire data-path Partition design into smaller blocks Debugging Identify bugs in the circuit Analyze Simplex phase I (pre-solver) of the LP solver If LP is infeasible, non-zero values of variables provide information which equations prevent the LP from being feasible If LP is feasible, but RE cannot be reduced to zero, content of RE will be used to reason about bugs