A Hybrid Method for Equivalence Checking Between System Level and RTL

The growing complexity of modern digital design makes designers shift toward starting design exploration using high-level languages, and generating register transfer level (RTL) design from system level modeling (SLM) using high-level synthesis or manual transformation. Unfortunately, this translation process is very complex and may introduce bugs into the generated design. In this paper, we propose a novel SLM and RTL sequential equivalence checking method. The proposed method bases on Finite state machines with datapath (FSMD) equivalence checking method. The proposed method recognizes the corresponding path-pairs of FSMDs using machine learning (ML) technique from all the paths. And then it compares the corresponding path-pairs by symbolic simulation. The advantage of our method is that it separates the corresponding path-pairs from all the paths and avoids blind comparisons of path-pairs. Our method can deal with greatly different SLM and RTL designs and dramatically reduce the complexity of the path-based FSMD equivalence checking problem. The promising experimental results show the efficiency and effectiveness of the proposed method.

A formal verification method for checking correctness of code motion techniques is presented in this article. Finite State Machine with Datapath (FSMD) models have been used to represent the input and the output behaviors of each synthesis step. The method introduces cutpoints in one FSMD, visualizes its computations as concatenation of paths from cutpoints to cutpoints, and then identifies equivalent finite path segments in the other FSMD; the process is then repeated with the FSMDs interchanged. Unlike many other reported techniques, the method is capable of verifying both uniform and nonuniform code motion techniques. It has been underlined in this work that for nonuniform code motions, identifying equivalent path segments involves model checking of some data-flow properties. Our method automatically identifies the situations where such properties are needed to be checked during equivalence checking, generates the appropriate properties, and invokes the model checking tool NuSMV to verify them. The correctness and the complexity of the method have been dealt with. Experimental results demonstrate the effectiveness of the method.

Sequential equivalence checking between system level descriptions of designs and their register transfer level (RTL) implementations is a very challenging and important problem in the context of systems on a chip (SoCs). We propose a technique to alleviate the complexity of the equivalence checking problem, by efficiently decomposing it using compare points. Traditionally, equivalence checking techniques use nominal or functional mapping of latches as compare points. Since we operate at a level where design descriptions are in system level languages or hardware description languages, we leverage the information available to us at this level in deducing sequential compare points. Sequential compare points encapsulate the sequential behavior of designs and are obtained by statically analyzing the design descriptions. We decompose the design using sequential compare points and represent the design behavior at these compare points by symbolic expressions. We use a SAT solver to check the equivalence of the symbolic expressions. In order to demonstrate our technique, we present results on a non-trivial case study. We show an equivalence check between a SystemC description and two different Verilog RTL implementations of a Viterbi decoder, that is a component of the DRM SoC.

This paper describes a formal method for checking the equivalence between the finite state machine with datapath (FSMD) model of the high-level behavioural specification and the FSMD model of the behaviour transformed by the scheduler. The method consists in introducing cutpoints in one FSMD, visualizing its computations as concatenation of paths from cutpoints to cutpoints and finally, identifying equivalent finite path segments in the other FSMD; the process is then repeated with the FSMDs interchanged. The method is strong enough to accommodate merging of the segments in the original behaviour by the typical scheduler such as DLS, a feature very common in scheduling but not captured by many works reported in the literature. It also handles arithmetic transformations

Using RTL (Register Transfer Level) models for the verification of complex hardware designs involves reducing the state space of designs using various abstraction techniques. In this paper, we propose faster and earlier verification of hardware designs at a level of abstraction above RTL. We consider a high-level (above RTL) hardware model that uses atomic rules to describe the behavior of a design, which can then be synthesized to RTL code. Bluespec System Verilog (BSV) is an example of such a high-level specification language. We propose a methodology for verification of BSV models using Spin, which is a Model Checking tool. Verification of high-level BSV models may avoid the need for using abstraction techniques since such models already ignore various low-level details that are irrelevant for verifying a design's behavioral properties. Moreover, using our proposed methodology different behaviors of BSV models can be efficiently verified at high-level aiding in faster verification.

The rapidly increasing complexities of hardware designs are forcing design methodologies and tools to move to the Electronic System Level (ESL), a higher abstraction level with better productivity than the state-of-the-art Register Transfer Level (RTL). Behavioral synthesis, which automatically synthesizes ESL behavioral specifications to RTL implementations, plays a central role in this transition. However, since behavioral synthesis is a complex and error-prone translation process, the lack of designers' confidence in its correctness becomes a major barrier to its wide adoption. Therefore, techniques for establishing equivalence between an ESL specification and its synthesized RTL implementation are critical to bring behavioral synthesis into practice. The major research challenge to equivalence checking for behavioral synthesis is the significant semantic gap between ESL and RTL. The semantics of ESL involve untimed, sequential execution; however, the semantics of RTL involve timed, concurrent execution. We propose a sequential equivalence checking (SEC) framework for certifying a behavioral synthesis flow, which exploits information on successive intermediate design representations produced by the synthesis flow to bridge the semantic gap. In particular, the intermediate design representation after scheduling and pipelining transformations permits effective correspondence of internal operations between this design representation and the synthesized RTL implementation, enabling scalable, compositional equivalence checking. Certifications of loop and function pipelining transformations are possible by a combination of theorem proving and SEC through exploiting pipeline generation information from the synthesis flow (e.g., the iteration interval of a generated pipeline). The complexity brought by bubbles in function pipelines is creatively reduced by symbolically encoding all possible bubble insertions in one pipelined design representation. The result of this dissertation is a robust, practical, and scalable framework for certifying RTL designs synthesized from ESL specifications. We have validated the robustness, practicality, and scalability of our approach on industrial-scale ESL designs that result in tens of thousands of lines of RTL implementations.

In this paper we describe a hardware design method for memory and register arrays that allows the application of formal equivalence checking for comparing a high-level register transfer level (RTL) specification with a low-level transistor implementation. Equivalence checking is increasingly applied in practical design flows to verify regular logic components. However, because of their specific organization and circuit techniques, high-performance implementations of large storage arrays require particular modifications to the general flow that make them suitable for formal equivalence checking. Two techniques are outlined in this paper. First, a special hierarchical verification scheme is described that allows the application of a partitioned comparison approach of the bit-wise organized transistor-level model with the word-wise organized RTL model. Second, a modified switch-level extraction technique is presented that extends the applicability of equivalence checking from regular dynamic CMOS circuits to self-resetting CMOS (SRCMOS) circuits.

Equivalence checking is an integral part of the formal verification of ASIC to ensure that the constructed design flow meets the specifications. State-of-the-art techniques and heuristics are available for combinational equivalence checking restricted to binary netlists and do not work for netlists containing and propagating the “X” value. To accommodate the X-value, a 3-valued formal analysis has to be done which is computationally exponentially harder than its binary counterpart and can be a capacity challenge for the verification tool. X-value propagation becomes crucial for applications including low power equivalence checking under power shutoff and comparing a Register Transfer Level (RTL) design to a synthesized netlist. This paper introduces an algorithm for X-value equivalence checking using Binary Decision Diagrams (BDD) for combinational circuits. It extends the functionality of pre-existing formal verification tools available for binary netlists, to X-value netlists by introducing new variables to the BDD. The Colorado University Decision Diagram (CUDD) package has been used for BDD manipulation.

Until now, simulation has been the primary approach for the functional verification of register transfer level (RTL) circuit descriptions written in a hardware description language (HDL). A finite state machine (FSM) coverage test can find all the bugs in a FSM design. However, this is impractical for large designs because of the state explosion problem. In this paper, we modify the higher-level FSM models used in other applications to replace the FSM model in the FSM coverage test. The state transition graphs (STGs) can be significantly reduced in this model, so that the complexity of the test becomes acceptable even for large designs. This model can be easily extracted from the original HDL code automatically, with little computation overhead. Experimental results show that it is indeed a promising functional test for FSMs.

Transaction-level modeling (TLM) is the leading design style to deal with the increasing complexity of modern embedded systems. TLM provides designers with high-level interfaces and communication protocols for abstract modeling and efficient simulation of system platforms. The Open SystemC Initiative (OSCI) has recently released the TLM-2.0 standard for facilitating the interchange of models between suppliers and users, and thus encouraging the use of virtual platforms for fast simulation prior to the availability of register-transfer level (RTL) code. On the other hand, verification of TLM IPs still relies on simulation-based techniques since formal verification methodologies (such as model checking) and tools are not mature enough to be applied at TLM level. In this paper, we propose a methodology to apply existing RTL model checkers for verifying TLM IPs. The methodology relies on the automatic synthesis of the TLM IP models into equivalent RTL descriptions, in order to verify the TLM properties through the equivalent RTL model of the IPs.

Application-specific systems are increasingly being deployed on reconfigurable computing platforms such as the field-programmable gate array (FPGA). These systems can integrate many disparate computing elements, and often contain soft processors hosting application components. Soft processors are sequential, synchronous devices with low computational density, and are not capable of exploiting the concurrency available on the FPGA. We present a method for increasing the computational density of application-specific systems by eliminating soft processors within these systems. This method eliminates soft processors by replacing programs that would be hosted on soft processors with custom, self-contained, circuitizable finite-state machine with datapath (FSMD) components that are automatically generated. We show that FS-MDs produced using this method eliminate the computational overhead associated with fetching and decoding instructions. We further show that this method, when applied to interrupt-driven programs, can produce concurrent FSMDs that arbitrate for shared datapath resources. We discuss how these FSMDs are capable of leveraging the spatial computational capabilities of the FPGA and are therefore more aptly suited for deployment within application-specific systems. We show that these FSMDs eliminate overhead associated with interrupt context switching, decrease interrupt servicing latencies, and eliminate interrupt livelock. We discuss implications and limitations of this method, and describe a prototype that implements the method for programs targeted for the Intel 8051.

Although stochastic search techniques have shown promise in test generation and design validation, they often fail when there is a specific, random-resistant sequence of vectors required to exercise a target. In order to combat this, deterministic techniques are added, resulting in a hybrid solution to maintain high speed of execution while improving metric performance. This paper presents a formal hybridization that combines a Register Transfer Level (RTL) stochastic swarm intelligence based test vector generation with the Verilator Verilog-to-C++ source-to-source compiler. Verilator generates a fast cycle accurate C++ simulation unit for Verilog descriptions and provides instrumentation for branch and toggle coverage metrics. This RTL model can also be used to generate a bounded model checking (BMC) instance. During the stochastic search, the bounded model checker is launched to expand the unexplored search frontier and aid in the navigation of narrow paths. Additionally, an inductive reach ability test is applied in order to eliminate unreachable branches from our search space. These additions have significantly improved branch coverage, reaching 100% in several ITC99 benchmarks. Additionally, compared to previous functional test generation methods, we achieve substantial speedup achieved with purely stochastic methods.

Transaction level (TL) models are key to early design exploration, performance estimation and virtual prototyping. Their speed and accuracy enable early and rapid System-on-Chip (SoC) design evaluation and software development. Most devices have only register transfer level (RTL) models that are too complex for SoC simulation. Abstracting these models to TL ones, however, is a challenging task, especially when the RTL description is too obscure or not accessible. This work presents a methodology for automatically creating a TL model of an RTL memory controller component. The device is treated as a black box and a multitude of simulations is used to obtain results, showing its timing behavior. The results are classified into conditional probability distributions, which are reused within a TL model to approximate the RTL timing behavior. The presented method is very fast and highly accurate. The resulting TL model executes approximately 1200 times faster, with a maximum measured average timing offset error of 7.66%.

Early RTL delay prediction using neural networks

Due to the globalization of Integrated Circuit supply chain, hardware Trojans and the attacks that can trigger them have become an important security issue. One type of hardware Trojans leverages the “don’t care transitions” in Finite-state Machines (FSMs) of hardware designs. In this article, we present a symbolic approach to detecting don’t care transitions and the hidden Trojans. Our detection approach works at both register-transfer level (RTL) and gate level, does not require a golden design, and works in three stages. In the first stage, it explores the reachable states. In the second stage, it performs an approximate analysis to find the don’t care transitions and any discrepancies in the register values or output lines due to don’t care transitions. The second stage can be used for both predicting don’t care triggered Trojans and for guiding don’t care aware reachability analysis. In the third stage, it performs a state-space exploration from reachable states that have incoming don’t care transitions to explore the Trojan payload and to find behavioral discrepancies with respect to what has been observed in the first stage. We also present a pruning technique based on the reachability of FSM states. We present a methodology that leverages both RTL and gate-level for soundness and efficiency. Specifically, we show that don’t care transitions and Trojans that leverage them must be detected at the gate-level, i.e., after synthesis has been performed, for soundness. However, under specific conditions, Trojan payload exploration can be performed more efficiently at RTL. Additionally, the modular design of our approach also provides a fast Trojan prediction method even at the gate level when the reachable states of the FSM is known a priori . Evaluation of our approach on a set of benchmarks from OpenCores and TrustHub and using gate-level representation generated by two synthesis tools, YOSYS and Synopsis Design Compiler (SDC), shows that our approach is both efficient (up to 10× speedup w.r.t. no pruning) and precise (0% false positives both at RTL and gate-level netlist) in detecting don’t care transitions and the Trojans that leverage them. Additionally, the total analysis time can achieve up to 1.62× (using YOSYS) and 1.92× (using SDC) speedup when synthesis preserves the FSM structure, the foundry is trusted, and the Trojan detection is performed at RTL.