Scaling VLSI Design Debugging with Interpolation

1. Scaling VLSI Design Debugging with Interpolation Brian Keng, Andreas Veneris FMCAD 2009 Presenter: Meng-YenLi

2. Introduction • Theaimoffunctionalverificationisdeterminewhethertheimplementationofadesignconformstoitsspecification. • Anerrortraceisreturnedifthedesigniffoundtobebuggy. • Designdebuggingisthetaskofidentifyingpotentialerrorsuspectsinthedesign.

3. Introduction • Inmoderndesigns,errortracecanbethousandsofclockcycleslong. • Designdebuggingcanconsumeasmuchas30%ofthetotaltimetodesignaVLSIchip. • Automateddebuggingmethodologiesremainofgreatinteresttoboththeresearchandindustrialcommunities.

4. Introduction • ThisworkproposedanovelscalableSAT-baseddesigndebuggingalgorithm. • Thealgorithmleveragesinterpolantstoover-approximatesetsofconstraintsthatmodeltheerroneousbehavior. • Thisapproachsignificantlyreducethememory-intensivecircuitreplicationatanygiventime.

5. Introduction • The algorithm divides the error trace into several parts(windows). • Analyze each window of time-frames separately. • Interpolants are use to over-approximate set of constraints to properly constrain the erroneous behavior.

6. Introduction • The described method finds all error locations. • Error location is the place of module where error occurs. • The function of the error location can be modified to correct the erroneous behavior for a give error trace and number of errors. • A techniques to generate multiple interpolants is introduced to reduce the number of error locations returned.

7. Introduction • Experiments show the benefits of this work compared to tradition SAT-based debugging: • for a conservatitve partitoning of the error trace • 34% memory reduction • 24% run-time reduction • Only increased the number of returned error locations 1% of the total number of suspects.

8. Introduction • for a more aggressive partitioning scheme, average in: • 57% memory reduction • 23% run-time reduction • Above reduction achieved at the cost of increasing the number of returned error locations 2% of the total number of suspects.

9. Introduction • This favorable trade-off between resolution and performance allows for scaling of existing SAT-based debugging methodologies to handle modern VLSI designs.

10. Preliminaries • Notation of variables • x denotes the primary inputs • y denotes the primary outputs • s denote the state elements x y Comb s Register

11. Preliminaries • Notation of variables • In the ith clock-cycle(time-frame) • xi, yi, si denotes the vectors of PI/PO/state • xij, yij, sij denotes the jth bit variable in the vector i xi1 yi1 Comb yi2 xi2 xi3 si1 si+11 si2 si+12

12. Preliminaries • An example of multiple time-frame notation

13. Preliminaries • Xi, Yi, Si denote a predicate for the ith clock cycle. • Transition relation denoted as T(si, si+1, xi, yi). • Suspects are all the error locations found in design debugging. • A design debugging method is complete if and only if it return all suspects for a given error trace and number of errors.

14. Preliminaries • The resolution of a debugging method refers to the total number of suspects returned. • Fewer suspects correspond to better resolution.

15. Preliminaries • An error trace for clock-cycles 0 to k is defined as V0k of length k+1. • V0k can be written as follows: • V0k = <S0, <X0, …, Xk>, <Y0, … Yk>> (1) • initial state predicate S0 • PI predicates from 0 to k <X0, …, Xk> • correct(expected) PO predicates from 0 to k <Y0, … Yk>

16. Preliminaries • A window for clock-cycles p to q is defined as Vpq of length q-p+1. • Vpq = <Sp, <Xp, …, Xq>, <Yp, … Yq>> • Sp is calculated by S0 and first p PI predicate to the transition relation.(simulating p cycles) • Prefix window of length p is V0p-1 • Suffix window of length k-p+1 is Vpk • The error is assumed that first observed in the last clock cycle of the error trace.

17. Preliminaries • Error trace • Window • Prefix 0 k 0 p q k 0 p-1 p q k

18. Preliminaries • Suffix 0 p-1 p q k

19. Preliminaries • SAT-based Design Debugging • A complete method that encodes the problem into a SAT instance for a give error trace and number of errors. • The satisfying assignments of the instance correspond to suspects which can be replaced with non-deterministic functions to correct the erroneous behavior in the error trace.

20. Preliminaries • The instance is created in several steps • First, the transition relation is enhanced by introducing a set of suspect variables, E = {e0, … en}, denoted Ten(si, si+1, xi, yi, E). • Each ei correspond to ith potential error location(gate, module) • This i is not related the ith clock cycle’s i. • If ei = 1 then the location is disconnected from its fan-in and become free variable. • Can be achieved by using multiplexor.

21. Preliminaries • Ten is unrolled as time-frame expaned model. • Suspect variables are not replicated in the model since they represent the same location regardless of the time frame.

22. Preliminaries • The number of simultaneous active suspect variables denoted as the error cardinality. • Constrained to a given constant number N using N(E).

23. Preliminaries • Given error trace V0k or window Vpq, the problem can be encoded into SAT instance as: • Debug0k = S0(s0)N(E)  ( Xi(xi)Yi(yi)Ten(si, si+1, xi, yi, E)) • Debugpq = Sp(sp) N(E)  ( Xi(xi)Yi(yi)Ten(si, si+1, xi, yi, E)) (2)

24. Preliminaries • Note that for N = 0, Debug0k is UNSAT. • To find all suspects, for each satisfying assignment, a blocking clause is added to the debugging instance to block the active suspect variables from appearing again as a satisfying assignment. • When the solver eventually returns UNSAT, all possible suspects have been found.

25. Preliminaries • Example 1. • time frame 0 to 1 • Suspect vars {e1, e2} • Incorrect gate is g2 • For N=1, • a sat assignment e1e2 • V01 = <s00,<x10x20,x11x21>,<y11y21>> • Adding blocking clause (e2) makes the instance UNSAT. • This implies that g2 is the only gate that can modified to correct the erroneous behavior.

26. Debugging with Interpolants • Lemma 1 • Any suspect found in a debugging instance Debugpk, for a suffix of an error trace, Vpk, will be found as a suspect to the debugging instance, Debug0k, for the entire error trace, V0k.

27. Debugging with Interpolants • Lemma1 • Proof: • Let M(E) be an assignment to the suspect variables in E such that DebugpkM is SAT. • The lemma can be written as • From eq 2, Debug0p-1Debugpk have same clauses with Debug0kSp(sp) • Debug0p-1 is SATbecause error hasn’t been observed yet

28. Debugging with Interpolants • Debug0p-1  Sp(sp) is SAT when no suspect variables are activebecause Debug0p-1 simulating p cycles and generating Sp(sp). • Debug0p-1  Sp(sp)  M(E) is SAT because each active suspect variable allows the corresponding component to become an arbitrary non-deterministic function, which will not change the satisfiacbility of an instance if it was already satisfiable.

29. Debugging with Interpolants • Therefore, if Debugpk  M(E) is SAT then Debug0p-1  Debugpk  M(E) is SAT, since the only common variables are sp and E which are fully assigned. • As a result, Debug0kSp(sp) M(E) is SAT, implying that Debug0kM(E) is SAT. • Proved.

30. Debugging with Interpolants • Lemma 1 guarantees that suspects found in the suffix will also be found in the entire trace. • However, if the error is excited before the current suffix, then there is no guarantee that the error will be found in Debugpk.

31. Debugging with Interpolants • Theorem 1 • Let U be an UNSAT core generated after blocking all satisfying assignments to suspects for Debugpk. If U  Sp(sp) =  then the suspects found in Debugpk will be exactly the suspects found in the entire debugging instance, Debug0k.

32. Debugging with Interpolants • Theorem 1 • Prove: • By Lemma 1, any suspect found in Debugpk is a suspect found in Debug0k. • Proving theorem 1 by contradiction. • Assume M(E) is an assignment that • Debug0kM(E) is SAT • DebugpkM(E) is UNSAT

33. Debugging with Interpolants • U is the UNSAT core derived after blocking all satisfying assignments to suspects for Debugpk, which contain no clauses in Sp(sp). • Since DebugpkM(E) is UNSAT, M(E) is not blocked by the blocking_clausepk. • This means Debug0k blocking_clausepk is SAT. • But in terms of clauses, U  (Debugpk blocking_clausepk - Sp(sp))  Debug0k blocking_clausepk because U not contains clauses in Sp(sp).

34. Debugging with Interpolants • So U M(E) is SAT because Debug0k blocking_clausepk M(E) is SAT. • But U is an UNSAT core, which is a contradiction. • So it must be the case that DebugpkM(E) is SAT.

35. Debugging with Interpolants • Theorem 1 give a condition to omit prefix debugging analysis with very little computation for some cases. • The proof does not depend on the error cardinality since the same UNSAT core will exist in suffix instance and entire debugging instance.

36. Debugging with Interpolants • Example 2. • An example that theorem 1 cannot be applied and need prefix debugging. • Suffix derive from ex.1 is show in Fig. 2 • Suffix V11, used for an instance Debug11,N=1 • Debug11 is UNSAT • The U contains the clause s01S1(s1) • Need prefix debugging

37. Debugging with Interpolants • Prefix Debugging can be formulated in two parts. • First part use eq2. for conventional SAT-based formulation. • Second part use interpoant approximating time-frames for the corresponding suffix of the error trace.

38. Debugging with Interpolants • Recall that erroneous behavior is only observed in last time-frame • If only prefix is modelled then the instance will not be properly constrained. • To avoid this situation, the interpolant is used as an over-approximation for the constraints that model the corresponding suffix. • This ensures that the prefix is properly constrained.

39. Debugging with Interpolants • The interpolant can be generated by UNSAT core of the solved suffix. • Debugpkblocking_clauses is partitioned into A and B. • A = Xi(xi)Yi(yi)Ten(si, si+1, xi, yi, E) • B = Sp(sp) N(E) blocking_clauses • The common variables of A and b are the state variables sp and suspect variables E. • Interpolant Ppk for the suffix is generated.

40. Debugging with Interpolants • Ppk can be interpreted as an over-approximation of the suffix. • The benefit of Ppk is it retains only the useful information that causes the erroneous behavior instead of modelling all the time-frames for the suffix of the error trace. • Experimental results show that in most cases, the interpolant is much smaller than the instance it was generated from.

41. Debugging with Interpolants • Using Ppk , Debug0p-1 can be constrained with the cause for erroneous behavior. • The debugging instance for a prefix of an error trace with an interpolant is denoted as DebugItp0p-1 = Debug0p-1 Ppk • DebugItp0p-1 will be UNSAT when no suspect variables are active because Debug0p-1 means simulating for clock cycle 0 to p-1, generate predicate Sp. • Sp  Ppk is UNSAT.

42. Debugging with Interpolants • Example 3. • Many of the root nodes of the resolution graph generate constants values in the interpolation. • This is a common occurrence and generally leads to a smalle interpolant relative to the UNSATcore.

43. Debugging with Interpolants • Example 4. • Shows how interpolant generated in ex.3 can be used to debug a prefix of an error trace. • Notice that the interpolant is significantly smaller once the constants have been propagated through the gates. • In Fig 4, activating suspect variable, e2, leads to the only satisfying assignment. This is consistent with the solution found in Ex. 1

44. Debugging with Interpolants • Example 4.

45. Debugging with Interpolants • Theorem 2 • Any suspect found in Debug0k will be found in DebugItp0p-1. • Proof: • By definition, Debug0k = Debug0p-1A • Any satisfying assignment to Debug0k will satisfy Debug0p-1 and A • But A→Ppk, so it also satisfies Ppk satisfying DebugItp0p-1

46. Debugging with Interpolants • Theorem 2 guarantees that solving the prefix will result in a complete method where no suspects will be missed. • However Th 2 does not guarantee that spurious suspects will no be found. • Ppk is used as an over-approximation for the suffix, this results in DebugItp0p-1 possibly returning suspects that will not be found when debugging the entire error trace. • Multiple Interpolants is aimed to improve this.

47. Algorithm k = 10, step = 3

48. Algorithm