Equivalence checking of scheduling with speculative code transformations in high-level synthesis

The growing complexity of modern digital design makes designers shift toward starting design exploration using high-level languages, and generating register transfer level (RTL) design from system level modeling (SLM) using high-level synthesis or manual transformation. Unfortunately, this translation process is very complex and may introduce bugs into the generated design. In this paper, we propose a novel SLM and RTL sequential equivalence checking method. The proposed method bases on Finite state machines with datapath (FSMD) equivalence checking method. The proposed method recognizes the corresponding path-pairs of FSMDs using machine learning (ML) technique from all the paths. And then it compares the corresponding path-pairs by symbolic simulation. The advantage of our method is that it separates the corresponding path-pairs from all the paths and avoids blind comparisons of path-pairs. Our method can deal with greatly different SLM and RTL designs and dramatically reduce the complexity of the path-based FSMD equivalence checking problem. The promising experimental results show the efficiency and effectiveness of the proposed method.

In this article, we present a novel methodology based on SMT-solvers to verify equality of a high-level described specification and a pipelined RTL implementation produced by a high-level synthesis tool. The complex transformations existing in the high-level synthesis process, such as nested loop pipelining, cause the conventional methods of equivalence checking to be inefficient. The proposed equivalence checking method simultaneously attacks the two problems in this context: (1) state space explosion and (2) complex high-level synthesis transformations. To show the scalability and efficiency of the proposed method, the verification results of large designs are compared with those of the SAT-based method, including three different state-of-the-art SAT-solvers: the SMT-based procedure, the modular Horner expansion diagram (M-HED)-based method, and the M-HED partitioning approach. The results show 2470×, 2540×, and 142× average memory usage reduction and 252×, 28×, and 914× speedup in comparison with M-HED, M-HED partitioning, and SMT-solver without using the proposed method, respectively.

Equivalence checking is a classical verification method for ensuring the compatibility of a finite-state concurrent system (protocol) with its desired external behaviour (service) by comparing their underlying labeled transition systems ( Lts s) modulo an appropriate equivalence relation. The local (or on-the-fly) approach for equivalence checking combats state explosion by exploring the synchronous product of the Lts s incrementally, thus allowing an efficient detection of errors in complex systems. However, when the two Lts s being compared are equivalent, the on-the-fly approach is outperformed by the global one, which completely builds the Lts s and computes the equivalence classes between states using partition refinement. In this paper, we consider the approach based on translating the on-the-fly equivalence checking problem in terms of the local resolution of a boolean equation system ( Bes ). We propose two enhancements of the approach in the case of equivalent Lts s: a new, faster encoding of equivalence relations in terms of Bes s, and a new local Bes resolution algorithm with a better average complexity. These enhancements were incorporated into the Bisimulator 2.0 equivalence checker of the Cadp toolbox, and they led to significant performance improvements w.r.t. existing on-the-fly equivalence checking algorithms.

Deep State Sequence-based (DSS) equivalence checking and path-based equivalence checking have been successfully applied for verification of digital designs between System Level Model (SLM) and Register Transfer Level (RTL). The DSS-based equivalence checking method can validate designs without mapping information, but the query size for each DSS is large compared with path-based verification. The query size for path-based methods is small, but the number of comparisons is large. In this work, we combine the advantages of DSS-based methods and path-based methods. We use DSS-based methods to find the corresponding paths and use cut-points like in path-based methods to split the DSS to reduce the query size. Finite State Machine with Datapath (FSMD) is used to represent the SLM and RTL models. Experimental results demonstrate that our method can effectively validate the designs and reduce the query size for DSS-based equivalence checking method.

The rapidly increasing complexities of hardware designs are forcing design methodologies and tools to move to the Electronic System Level (ESL), a higher abstraction level with better productivity than the state-of-the-art Register Transfer Level (RTL). Behavioral synthesis, which automatically synthesizes ESL behavioral specifications to RTL implementations, plays a central role in this transition. However, since behavioral synthesis is a complex and error-prone translation process, the lack of designers' confidence in its correctness becomes a major barrier to its wide adoption. Therefore, techniques for establishing equivalence between an ESL specification and its synthesized RTL implementation are critical to bring behavioral synthesis into practice. The major research challenge to equivalence checking for behavioral synthesis is the significant semantic gap between ESL and RTL. The semantics of ESL involve untimed, sequential execution; however, the semantics of RTL involve timed, concurrent execution. We propose a sequential equivalence checking (SEC) framework for certifying a behavioral synthesis flow, which exploits information on successive intermediate design representations produced by the synthesis flow to bridge the semantic gap. In particular, the intermediate design representation after scheduling and pipelining transformations permits effective correspondence of internal operations between this design representation and the synthesized RTL implementation, enabling scalable, compositional equivalence checking. Certifications of loop and function pipelining transformations are possible by a combination of theorem proving and SEC through exploiting pipeline generation information from the synthesis flow (e.g., the iteration interval of a generated pipeline). The complexity brought by bubbles in function pipelines is creatively reduced by symbolically encoding all possible bubble insertions in one pipelined design representation. The result of this dissertation is a robust, practical, and scalable framework for certifying RTL designs synthesized from ESL specifications. We have validated the robustness, practicality, and scalability of our approach on industrial-scale ESL designs that result in tens of thousands of lines of RTL implementations.

Function pipelining is a key transformation in behavioral synthesis. However, synthesizing the complex pipeline logic is an error-prone process. Sequential equivalence checking (SEC) support is highly desired to provide confidence in the correctness of synthesized pipelines. However, SEC for function pipelining is challenging due to the significant difference between the behavioral specification and synthesized RTL. Furthermore, function pipelines include hardware logic for dynamically inserting “bubbles” (pipeline stalls), which bring additional difficulties in equivalence checking. We develop an SEC framework for behaviorally synthesized function pipelines by (1) building a reference pipeline model with a certified function pipelining transformation, which faithfully captures bubble insertion; and (2) checking the equivalence between the reference model and synthesized RTL. We demonstrate the scalability of our approach on industry-strength designs synthesized by a commercial tool.

Equtivalence checking is one of the most important issues in VLSI designs to guarantee that bugs do not enter the design during optimization steps or synthesis steps. In this paper, we propose a new word-level equivalence checking method between two models before and after high-level synthesis or behavioral optimization. Our method converts two given designs into RTL models which have the same datapath so that the two designs have the same bit-level accuracy. Then the word-level equivalence checking techniques can be applied satisfying the bit-level accuracy. Also, as our method propagates equivalences from inputs to outputs with the equivalence rules of control structures, name correspondences among registers or variables are not requtired. By those rules, designs which have loops can be verified without unrolling. Experimental results with realistic examples show that our method can verify those designs in practical periods.

A formal verification method for checking correctness of code motion techniques is presented in this article. Finite State Machine with Datapath (FSMD) models have been used to represent the input and the output behaviors of each synthesis step. The method introduces cutpoints in one FSMD, visualizes its computations as concatenation of paths from cutpoints to cutpoints, and then identifies equivalent finite path segments in the other FSMD; the process is then repeated with the FSMDs interchanged. Unlike many other reported techniques, the method is capable of verifying both uniform and nonuniform code motion techniques. It has been underlined in this work that for nonuniform code motions, identifying equivalent path segments involves model checking of some data-flow properties. Our method automatically identifies the situations where such properties are needed to be checked during equivalence checking, generates the appropriate properties, and invokes the model checking tool NuSMV to verify them. The correctness and the complexity of the method have been dealt with. Experimental results demonstrate the effectiveness of the method.

As the pressure to produce smaller and faster designs increases, the need for formal verification of sequential transformations increases proportionally. In this paper we describe a framework that attempts to extend the set of designs that can be equivalence checked. Our focus lies in integrating sequential equivalence checking into a standard design flow that relies on combinational equivalence checking today. In order to do so, we can not make use of reset state or reset sequence information (as this is not given in combinational equivalence checking), and we need to mitigate the complexity inherent in the traditional sequential equivalence checking algorithms. Our solution integrates combinational and sequential equivalence checking in such a way that the individual analyses benefit from each other. The experimental results show that our framework can verify designs which are out of range for pure sequential equivalence checking methods aimed designs with unknown reset states.

Finite state machines (FSMs) control the functionality of System-on-Chip (SoC) designs. The security and trustworthiness of SoCs can be compromised by exploring the vulnerabilities of their FSMs. Any deviation from the specification of FSMs can endanger the security and trustworthiness of SoCs. This is a critical concern when an FSM is responsible for controlling the usage or propagation of protected information (e.g., secret keys) in a secure component. FSM vulnerabilities may be introduced by a rogue designer or an attacker who inserts hardware Trojans in the FSM implementation. Traditional FSM design flows as well as CAD tools may create unintentional security vulnerabilities in FSM designs (e.g., when a synthesis tool is trying to optimize a gate-level netlist). These vulnerabilities can also be introduced unintentionally by a CAD tool. In this chapter, we present an efficient formal analysis framework based on symbolic algebra to find FSM vulnerabilities. The proposed method tries to find inconsistencies between the specification and FSM implementation through manipulation of respective polynomials. Security properties (such as a safe transition to a protected state) are derived using specification polynomials and verified against implementation polynomials. In case of a failure, the vulnerability is reported. While existing methods can verify legal transitions, the proposed approach tries to solve the important and non-trivial problem of detecting illegal accesses to the design states (e.g., protected states).

We introduce Fine Grain Scheduling (FGS) as a post-processing step to circuits classically designed as a data-path controlled by a finite state machine (FSM). Such circuits may have timing errors, particularly if they are generated by High Level Synthesis (HLS) tools that make use of crude temporal estimates during scheduling. FGS reschedules the FSM to ensure correct execution at a requested frequency on the data-path.The proposed algorithm takes into account all the electrical constraints of the data-path, namely propagation times, set-up and hold times of memorization elements, and even delays due to the interconnects if the data-path is placed and routed. Like HLS algorithms, FGS supports multi-operators cells, multi-cycle operators and chaining. However, it also makes use of mutli-cycles chaining to allow the chaining of several operators over several cycles without intermediate memorizations.Experimentation of FGS on an MPEG2 Variable Length Decoder and a full MJPEG decoder has demonstrated that the approach is particularly well suited for the design of asynchronous coprocessors. Synchronous processors cannot be scheduled by FGS because the inputs and outputs dates are modified.

Chapter 6 - Equivalence Checking on Higher-Level Design Descriptions

The author discusses the effects of false paths and their consequences in scheduling and allocation during high-level synthesis. False paths through the control-flow graph may occur due to sequences of conditional operations. The detection of false paths during scheduling may result in a smaller number of states, improved operator sharing, and smaller control logic. A heuristic algorithm is presented for the detection and elimination of false paths during path-based scheduling. Results for benchmark examples are presented. For the designs which contained false paths, the percentage of false paths varied from 5% to 83%. A reduction of 15% in the final cell count for one benchmark was obtained by eliminating false paths. Even though the proposed algorithm is heuristic and cannot guarantee the detection of all false paths, it did find all false paths in the small to medium size examples tried. In most cases the condition trees are small, with few data dependencies, which increases the probability of a false path being found by the algorithm. >

The method how to design a safety device of railway station efficiently and scalable is proposed. The safety device for any configuration of railway station can be built from five basic blocks. These basic blocks are connected together with universal interface. Each block is based on a finite state machine. The finite state machines are Moore type. Each state machine is divided into three basic parts, where each part is designed as a self- checking circuit ensuring fault detection. Our methodology is intended for final implementation in FPGA and hence SEU faults occurring in the system is assumed.

This paper presents a finite-state machine (FSM) reengineering method that enhances the FSM synthesis by reconstructing a functionally equivalent but topologically different FSM based on the optimization objective. This method enables the FSM synthesis algorithms to explore a set of functionally equivalent FSMs and obtain better solutions than those in the original FSM. To demonstrate the effectiveness of the proposed method, we apply it to popular power- and area-driven FSM synthesis algorithms, respectively. Our method achieves an average of 5.5% power reduction and 2.7% area reduction, respectively, on 25 Microelectronics Center of North Carolina (MCNC) FSM benchmarks, where the proposed method is applicable. This is a significant performance improvement for the power- and area-driven FSM synthesis algorithms being used. Our method has a negligible run-time overhead, and it maintains the quality of the synthesis solutions.