Chapter 6 - Equivalence Checking on Higher-Level Design Descriptions

In this paper, an efficient equivalence checking method for two C descriptions is described. The equivalence of two C descriptions is proved by symbolic simulation. Symbolic simulation used in this paper can prove the equivalence of all of the variables in the descriptions. However, it takes long time to verify the equivalence of all of the variables if large descriptions are given. Therefore, in order to improve the verification, our method identifies textual differences between descriptions. The identified textual differences are used to reduce the number of equivalence checkings among variables. The proposed method has been implemented in C language and evaluated with several C descriptions.

The growing complexity of modern digital design makes designers shift toward starting design exploration using high-level languages, and generating register transfer level (RTL) design from system level modeling (SLM) using high-level synthesis or manual transformation. Unfortunately, this translation process is very complex and may introduce bugs into the generated design. In this paper, we propose a novel SLM and RTL sequential equivalence checking method. The proposed method bases on Finite state machines with datapath (FSMD) equivalence checking method. The proposed method recognizes the corresponding path-pairs of FSMDs using machine learning (ML) technique from all the paths. And then it compares the corresponding path-pairs by symbolic simulation. The advantage of our method is that it separates the corresponding path-pairs from all the paths and avoids blind comparisons of path-pairs. Our method can deal with greatly different SLM and RTL designs and dramatically reduce the complexity of the path-based FSMD equivalence checking problem. The promising experimental results show the efficiency and effectiveness of the proposed method.

A formal verifier is an automated decision procedure that can prove or disprove a set of statements in some logical system of reasoning. Problems informal verification have been posed and studied in a variety of disciplines for many years. However the last ten years have produced significant advances in both the theory and practical art of building formal verifiers. Various formal proof techniques available today include language containment, model checking, equivalence checking, symbolic simulation and theorem proving. In this tutorial, we will be restricting ourselves to the formal finite state machine based techniques: language containment, model checking and equivalence checking. A brief introduction to the technologies that underly these techniques will be presented as well. The tutorial will conclude with some examples of how formal methods can be employed in the verification of hardware systems.

Total Care Products are innovative packages consisting of hardware and services integrated to provide a complete functional provision. These types of products are becoming increasingly popular as companies strive to find new ways to ensure their business remains profitable and their products are attractive to customers. The Total Care Product creation process requires close collaboration between the customer and supplier as the two parties engage in an iterative, often time-consuming procedure involving needs, expectations and solutions exploration that ultimately leads to the creation of the functional product. This paper describes a novel design process for Total Care Product creation that seamlessly integrates hardware and service support by providing a robust design methodology and process support tool that firstly breaks down Total Care Product creation into distinct stages, and then the support structure is provided to facilitate the design and decision-making process at each stage in a rapid and simplified way. In order to be able to integrate hardware and service support design in such a manner, it is first necessary to assess how the hardware and service design processes are currently performed in their own right. The hardware design process is well documented and understood, in contrast to service design. This paper describes the service design process in detail, highlighting the similarities with hardware design and detailing how services are designed. Having described the service design process, and using knowledge of hardware design, the paper then proceeds to describe the development of a fast design process for the Total Care Product creation process that integrates both hardware and services. The numerous potential benefits of employing the fast design process are highlighted.

Automating hardware design at higher levels of abstraction requires first and foremost a formal model of the high-level specification. This formal model is the basis of many EDA applications such a...

Summary form only given. Modern circuits contain up to several hundred million transistors and this number grows exponentially over time. Thus, the state-of-the-art design flows have to be improved continuously. In the meantime ensuring correctness becomes a major bottleneck. Up to 80% of the overall design costs are due to verification and even more problems are foreseeable - shrinking feature sizes lead to large process variations, increased susceptibility to radiation, etc. As a result even a correct design may contain faulty components. Thus, robustness is required, i.e. correct operation in presence of faults. Formal verification techniques have gained large attention, since they allow proving the correctness of a circuit and thereby ensure 100% functional correctness. Moreover, the underlying techniques can also be used to prove robustness of a design. Besides being more reliable, formal verification approaches have also shown to be more cost effective in many cases, since test bench creation - usually a very time consuming and error prone task - becomes superfluous. Therefore these techniques allow unveiling faulty behaviour automatically. Proving robustness in the sense of fault tolerance is important. As in any implementation step, faults may tamper the behaviour. In particular, fault tolerance may hide flaws during the standard verification step. Therefore instead of relying on the design's architectural precautions against faults, the implementation has to be proven to be fault tolerant. In this tutorial, after a brief motivation of the overall topic and definition of the problem domain, the alternative verification approaches are explained. Next, the application of the underlying formal techniques for robustness checking is considered. The standard approaches for verification are simulation, emulation and formal methods. Details are discussed related to formal verification, symbolic simulation and assertion based verification. The verification scenarios for equivalence checking (EC) and property checking (PC) are presented and the underlying proof techniques are explained. Robustness checking then also builds on the underlying formal methods. This allows analyzing the robustness of a design fully automatically. Practical scenarios covered by this model for robustness of a circuit are discussed. The model not only yields a measure for the robustness of a circuit but also shows critical parts of the implementation that should be reengineered. In comparison alternative approaches, e.g. using statistical measures, are outlined. Further references are given for all topics are given (see below). Directions for future work and research challenges are discussed.

Bounded Model Checking is a widely used technique both in hardware and software verification. However, it cannot be applied if the bounds (number of time frames to be analyzed) becomes large. Therefore it cannot detect bugs that can be observed only through very long sequence counter-examples. In this paper, we present a method connecting multiple BMCs by sophisticated uses of inductive approach and symbolic simulation. The proposed method can check unbounded properties by analyzing loop behaviors in the design with decision procedures. In our verification flow, a property is automatically decomposed and refined instead of designs. First, a property is decomposed not to consider the reachability from the initial states of the design. Next, if a counter-example is found, the condition to enter it is generated by symbolic simulation. Finally, the reachability from the initial states to the states where the condition becomes true is checked inductively by another Bounded Model Checking. If they are not reachable from the initial states, then the property is refined not to enter the unreal counter-example. Key observation here is that each BMC does not need to process so many time frames as compared with pure BMC from initial states. Therefore, the proposed method can process much larger bounds. Experimental results with two examples have confirmed this advantage.

This paper presents a new, compact, canonical graph-based representation, called Taylor expansion diagrams (TEDs). It is based on a general non-binary decomposition principle using Taylor series expansion. It can be exploited to facilitate the verification of high-level (RTL) design descriptions. We present the theory behind TEDs, comment upon its canonicity property and demonstrate that the representation has linear space complexity. Its application to equivalence checking of high-level design descriptions is discussed.

This paper presents a formal method for equivalence checking between the descriptions before and after scheduling in high-level synthesis (HLS). Both descriptions are represented by finite state machine with datapaths (FSMDs) and are then characterized through finite sets of paths. The main target of our proposed method is to verify scheduling employing code transformations-such as speculation and common subexpression extraction (CSE), across basic block (BB) boundaries-which have not been properly addressed in the past. Nevertheless, our method can verify typical BB-based and path-based scheduling as well. The experimental results demonstrate that the proposed method can indeed outperform an existing state-of-the-art equivalence checking algorithm.

The growth in size and heterogeneity of System-on-Chip (SOC) design makes their design process from initial specification to IC implementation complex. System-level design methods seek to combat this complexity by shifting increasing design burden to high-level languages such as SystemC and SystemVerilog. Such languages not only make a design easier to describe using high-level abstractions, but also provide a path for systematic implementation through refinement and elaboration of such descriptions. In principle, this can enable a greater exploration of design alternatives and thus better design optimization than possible using lower level design methods. To achieve these goals, however, verification capabilities that seek to validate designs at higher levels as well their equivalences with lower level implementations are crucially needed. To the extent possible given the large space of design alternatives, such validation must be formal to ensure the design and important properties are provably correct against various implementation choices. In this paper, we present a survey of high-level verification techniques that are used for both verification and validation of high-level designs, that is, designs modeled using high-level programming languages. These techniques include those based on model checking, theorem proving and approaches that integrate a combination of the above methods. The high-level verification approaches address verification of properties as well as equivalence checking with refined implementations. We also focus on techniques that use information from the synthesis process for improved validation. Finally, we conclude with a discussion and future research directions in this area.

This work presents the design validation techniques for microprocessors. The verification effectiveness validates the design implementation using a combination of simulation techniques and formal methods. This article presents a top-down validation methodology that complements existing bottom-up verification techniques. The validation team applies model checking to a high-level description of the design abstracted from the RTL implementation. Formal verification uses a formal language to describe the system. The specification for the formal verification comes from the architecture description; the implementation can come from either the architecture specification or the abstracted design. A top-down methodology for validating microprocessors using a combination of symbolic simulation and equivalence checking is presented. Specification-driven hardware generation and validation of design implementation using equivalence checking has one limitation: the structure of the generated hardware reference model is similar to that of implementation.

In this paper, we propose a novel algorithm for synthesizing the pipeline structures with variable data initiation intervals (DIIs). Compared to previous researches where the pipeline synthesis is confined to those with fixed DIIs, the proposed algorithm tries to optimize the pipeline latency by fully utilizing hardware resources to which abstract operations in high-level design descriptions are assigned. Determining time-overlapping of pipeline stages, the proposed algorithm performs scheduling and module allocation using the time-overlapping information for the proper control of pipelines with variable DIIs. Experimental results on benchmarks show that significant improvement can be achieved both in speed and in area.

Software architecture has become an important area of research and practice since the late 1980s (Shaw and Clements 2006). The term “software architecture” started gaining acceptance by the software engineering community in early 1990s but the foundations of this field were laid by the seminal work of Edsger Dijkstra, David Parnas, and others between 1960s and 1980s (Clements 2000). The increasing size and complexity of software systems and demand for high quality are some of the most important factors that have driven the increased interest in this sub-discipline of software engineering. It has generally been realized that a high-level design description can play an important role in successfully understanding and managing large and complex software systems (Clements et al. 2002; Lung and Kalaichelvan 2000). The high-level design decisions regarding the software architecture of a system are not only the hardest and most expensive to change but also play a fundamental role in setting the boundaries for the required quality attributes such as maintainability, reliability, usability, performance, and flexibility of a system (Bass et al. 2003; Clement and Northorp 1996). As a result of increasing realization of the important role of software architecture in large-scale software development and evolution projects, the software architecture community has developed several methods, techniques, and tools to support the software Empir Software Eng (2011) 16:539–543 DOI 10.1007/s10664-011-9168-6

Equivalence checking is a classical verification method for ensuring the compatibility of a finite-state concurrent system (protocol) with its desired external behaviour (service) by comparing their underlying labeled transition systems ( Lts s) modulo an appropriate equivalence relation. The local (or on-the-fly) approach for equivalence checking combats state explosion by exploring the synchronous product of the Lts s incrementally, thus allowing an efficient detection of errors in complex systems. However, when the two Lts s being compared are equivalent, the on-the-fly approach is outperformed by the global one, which completely builds the Lts s and computes the equivalence classes between states using partition refinement. In this paper, we consider the approach based on translating the on-the-fly equivalence checking problem in terms of the local resolution of a boolean equation system ( Bes ). We propose two enhancements of the approach in the case of equivalent Lts s: a new, faster encoding of equivalence relations in terms of Bes s, and a new local Bes resolution algorithm with a better average complexity. These enhancements were incorporated into the Bisimulator 2.0 equivalence checker of the Cadp toolbox, and they led to significant performance improvements w.r.t. existing on-the-fly equivalence checking algorithms.

The ever-growing complexity of software and its target hardware makes it increasingly challenging to develop reliable compilers that preserve the semantics of source code during compilation. Traditional testing methods often lack sufficient test coverage and fail to identify subtle errors and undefined behaviors that can lead to compiler malfunctions. Furthermore, while formal compiler certification ensures semantic preservation through theorem proving, the inherent complexity of this process makes re-certification after each compiler revision substantially labor-intensive. This often significantly hinders the improvement of compilers. This research aims to bridge the gap between increasing compiler complexity and the limited scalability of formal verification techniques. We present a comprehensive approach for automatic verification of compiler transformations that are the core components of any compiler design. Our approach particularly targets the foundations of state-of-the-art compilers: their intermediate representations (IRs). It provides automated verification algorithms that formally compare the IRs before and after a compiler transformation and systematically enumerate the execution paths of such transformation. First, we have developed an automated equivalence checking framework for hardware designs represented in HalideIR, the foundation of several well-known hardware design compilers. This framework conducts scalable equivalence checking by analyzing structural similarities in HalideIR across various design iterations. It identifies minimal design constructs essential for verification and performs efficient localized checks. Its application in deep learning accelerator designs has proven its capability to detect inconsistencies that manual testing fails to identify, thereby bolstering hardware design reliability. Second, we have developed an automated verification framework for HalideIR-based compiler transformations using symbolic execution. This method systematically enumerates and verifies execution paths of compiler transformations to ensure that the output program for each path is equivalent to its source. The application of this framework in common HalideIR-based compilers has uncovered previously undetected transformation bugs, highlighting its effectiveness. Third, we have pioneered a novel translation validation framework for MLIR-based compilers. This framework overcomes the complexity arising from the numerous MLIR dialects and employs the Z3 SMT solver to validate the refinement of target programs with respect to source programs in MLIR. Its evaluations on diverse MLIR-based compilers have not only showcased its versatility but also its crucial role in identifying bugs and undefined behaviors. Finally, we have also explored integrating Large Language Models (LLMs) into translation validation to target compiler transformations where formal verification tools fall short. Our framework utilizes existing formal verification tools for translation validation (in this work, we use Alive2, a