Scalable conditional equivalence checking: An automated invariant-generation based approach

As the pressure to produce smaller and faster designs increases, the need for formal verification of sequential transformations increases proportionally. In this paper we describe a framework that attempts to extend the set of designs that can be equivalence checked. Our focus lies in integrating sequential equivalence checking into a standard design flow that relies on combinational equivalence checking today. In order to do so, we can not make use of reset state or reset sequence information (as this is not given in combinational equivalence checking), and we need to mitigate the complexity inherent in the traditional sequential equivalence checking algorithms. Our solution integrates combinational and sequential equivalence checking in such a way that the individual analyses benefit from each other. The experimental results show that our framework can verify designs which are out of range for pure sequential equivalence checking methods aimed designs with unknown reset states.

Function pipelining is a key transformation in behavioral synthesis. However, synthesizing the complex pipeline logic is an error-prone process. Sequential equivalence checking (SEC) support is highly desired to provide confidence in the correctness of synthesized pipelines. However, SEC for function pipelining is challenging due to the significant difference between the behavioral specification and synthesized RTL. Furthermore, function pipelines include hardware logic for dynamically inserting “bubbles” (pipeline stalls), which bring additional difficulties in equivalence checking. We develop an SEC framework for behaviorally synthesized function pipelines by (1) building a reference pipeline model with a certified function pipelining transformation, which faithfully captures bubble insertion; and (2) checking the equivalence between the reference model and synthesized RTL. We demonstrate the scalability of our approach on industry-strength designs synthesized by a commercial tool.

The rapidly increasing complexities of hardware designs are forcing design methodologies and tools to move to the Electronic System Level (ESL), a higher abstraction level with better productivity than the state-of-the-art Register Transfer Level (RTL). Behavioral synthesis, which automatically synthesizes ESL behavioral specifications to RTL implementations, plays a central role in this transition. However, since behavioral synthesis is a complex and error-prone translation process, the lack of designers' confidence in its correctness becomes a major barrier to its wide adoption. Therefore, techniques for establishing equivalence between an ESL specification and its synthesized RTL implementation are critical to bring behavioral synthesis into practice. The major research challenge to equivalence checking for behavioral synthesis is the significant semantic gap between ESL and RTL. The semantics of ESL involve untimed, sequential execution; however, the semantics of RTL involve timed, concurrent execution. We propose a sequential equivalence checking (SEC) framework for certifying a behavioral synthesis flow, which exploits information on successive intermediate design representations produced by the synthesis flow to bridge the semantic gap. In particular, the intermediate design representation after scheduling and pipelining transformations permits effective correspondence of internal operations between this design representation and the synthesized RTL implementation, enabling scalable, compositional equivalence checking. Certifications of loop and function pipelining transformations are possible by a combination of theorem proving and SEC through exploiting pipeline generation information from the synthesis flow (e.g., the iteration interval of a generated pipeline). The complexity brought by bubbles in function pipelines is creatively reduced by symbolically encoding all possible bubble insertions in one pipelined design representation. The result of this dissertation is a robust, practical, and scalable framework for certifying RTL designs synthesized from ESL specifications. We have validated the robustness, practicality, and scalability of our approach on industrial-scale ESL designs that result in tens of thousands of lines of RTL implementations.

Inductive Invariants play critical roles in restricting the search space during Sequential Equivalence Checking (SEC), especially for those instances with few internal equivalent points. For large circuits, there can be too many potential invariants relating signals between the two circuits, thereby requiring much time to prove. However, we observe that a large portion of the potential invariants may not even contribute to equivalence checking. Moreover, equivalence checking can be significantly helped if there exists a method to check if a subset of potential invariants would be sufficient (e.g., whether two-nodes are enough or multi-nodes are also needed) prior to the verification step. In this paper, we address these problems and propose a sufficiency-based approach to identify useful invariants out of the initial potential invariants for SEC. Experimental results show that our approach can either demonstrate insufficiency of the invariants or select a small portion of them to successfully prove the equivalence property.

Sequential equivalence checking between system level descriptions of designs and their register transfer level (RTL) implementations is a very challenging and important problem in the context of systems on a chip (SoCs). We propose a technique to alleviate the complexity of the equivalence checking problem, by efficiently decomposing it using compare points. Traditionally, equivalence checking techniques use nominal or functional mapping of latches as compare points. Since we operate at a level where design descriptions are in system level languages or hardware description languages, we leverage the information available to us at this level in deducing sequential compare points. Sequential compare points encapsulate the sequential behavior of designs and are obtained by statically analyzing the design descriptions. We decompose the design using sequential compare points and represent the design behavior at these compare points by symbolic expressions. We use a SAT solver to check the equivalence of the symbolic expressions. In order to demonstrate our technique, we present results on a non-trivial case study. We show an equivalence check between a SystemC description and two different Verilog RTL implementations of a Viterbi decoder, that is a component of the DRM SoC.

Sequential clock-gating can lead to easier equivalence checking problems, compared to the general sequential equivalence checking (SEC) problem. Modern sequential clock-gating techniques introduce control structures to disable unnecessary clocking. This violates combinational equivalence but maintains sequential equivalence between the original and revised circuits. We propose the use of characteristic graphs (CGs) to extract essential LTL clock-gating properties, which when proved imply certain sequential redundancies. The extraction, proof and subsequent removal of the implied redundancies lead to an efficient SEC procedure for clock-gated circuits. Experiments show that the proposed SEC procedure substantially outperforms existing methods in terms of speed and scalability when applied to several difficult cases.

High performance designs must conform to stringent timing requirements. Designers frequently utilize low-level optimization techniques and develop many iterations of the same block in order to close a timing gap. Simulation with random stimulus is the traditional method for verifying that these changes do not introduce a change in the functional behavior of the block. For the development of a new high-performance core at Freescale Semiconductor the authors decided to instead research the possibility of using formal techniques, in the form of sequential equivalence checking, for this form of verification. Various equivalence checking tools were evaluated for this task. Initial results looked promising and the authors decided to integrate this capability into our design flow. This paper describes the experience and also addresses some of the problems that were exposed and how we plan to deal with them

Due to the rapidly increasing complexity in hardware designs and competitive time to market trends in the industry, there is an inherent need to move designs to a higher level of abstraction. Behavioral Synthesis is the process of automatically compiling such Electronic System Level (ESL) designs written in high-level languages such as C, C++ or SystemC into Register-Transfer Level (RTL) implementation in hardware description languages such as Verilog or VHDL. However, the adoption of this flow is dependent on designers' faith in the correctness of behavioral synthesis tools. Loop pipelining is a critical transformation employed in behavioral synthesis process, and ubiquitous in commercial and academic behavioral synthesis tools. It improves the throughput and reduces the latency of the synthesized hardware. It is complex and error-prone, and a small bug can result in faulty hardware with expensive ramifications. Therefore, it is critical to certify the loop pipelining transformation so that designers can trust the behaviorally synthesized pipelined designs. Certifying a loop pipelining transformation is however, a major research challenge because there is a huge semantic gap between the input sequential design and the output pipelined implementation, making it infeasible to verify their equivalence with automated sequential equivalence checking (SEC) techniques. Complex loop pipelining transformations can be certified by a combination of theorem proving and SEC: (1) creating a certified pipelining algorithm which generates a reference pipeline model by exploiting pipeline generation information from the synthesis flow (e.g. the iteration interval of a generated pipeline) and (2) conduct SEC between the synthesized pipeline and this reference model. However, a key and arguably, the most complex component of this approach is the development of a formal, mechanically verifiable loop pipelining algorithm. We show how to systematically construct such an algorithm, and carry out its verification using the ACL2 theorem prover. We propose a framework of certified pipelining primitives which are essential for designing pipelining algorithms. Using our framework, we build a certified loop pipelining algorithm. We also propose a key invariant in certifying this algorithm, which links sequential loops with their pipelined counterparts. This is unlike other invariants that have been used in proofs of microprocessor pipelines so far. This dissertation provides a framework for creating certified pipelining algorithms utilizing a mechanical theorem prover. Using this framework, we have developed a certified loop pipelining algorithm. This certified algorithm is essential in the overall approach to certify behaviorally synthesized pipelined designs. We demonstrate the

It has long been the practice to create models in C or C++ for architectural studies, software prototyping and RTL verification in the design of systems-on-chip (SoC). These models are written in C++ primarily because it is possible to achieve very high simulation speeds, but also because it is productive to code at high levels of abstraction. In this paper we present a modeling methodology that continues to exploit the inherent advantages of writing models in C++ while ensuring that they are usable for formal verification of RTL through the use of sequential equivalence checking technology. An industrial case study is presented to show the validity of the approach.

The growing complexity of modern digital design makes designers shift toward starting design exploration using high-level languages, and generating register transfer level (RTL) design from system level modeling (SLM) using high-level synthesis or manual transformation. Unfortunately, this translation process is very complex and may introduce bugs into the generated design. In this paper, we propose a novel SLM and RTL sequential equivalence checking method. The proposed method bases on Finite state machines with datapath (FSMD) equivalence checking method. The proposed method recognizes the corresponding path-pairs of FSMDs using machine learning (ML) technique from all the paths. And then it compares the corresponding path-pairs by symbolic simulation. The advantage of our method is that it separates the corresponding path-pairs from all the paths and avoids blind comparisons of path-pairs. Our method can deal with greatly different SLM and RTL designs and dramatically reduce the complexity of the path-based FSMD equivalence checking problem. The promising experimental results show the efficiency and effectiveness of the proposed method.

Performing synthesis and verification in isolation has two undesirable consequences: (1) verification runs the risk of becoming intractable, and (2) strong sequential optimizations are not applied because they are hard to verify. This paper proposes a format for recording synthesis information and a methodology for sequential equivalence checking using this feedback from synthesis. An implementation is described and experimentally compared against an efficient general-purpose sequential equivalence checker that does not use synthesis information. Experimental results confirm expected substantial savings in runtime and reliability of equivalence checking for large designs.

Boolean Satisfiability (SAT) is a widely used modeling tool in Electronic Design Automation (EDA). It finds application in test pattern generation, delay-fault testing, equivalence checking and circuit delay computation, among many other problems. This paper starts by describing how Boolean Satisfiability algorithms can take circuit structure into account when solving instances derived from combinational circuits. Afterwards, it shows how recursive learning techniques can be incorporated into Boolean Satisfiability algorithms. The proposed algorithmic framework has several natural applications in EDA. Moreover, potential advantages include smaller run times, the utilization of circuit-specific search pruning techniques, avoiding the overspecification problem that characterizes Boolean Satisfiability testers, and reducing the time for iteratively generating instances of SAT from circuits. The experimental results obtained, on a large number of benchmark examples in different problem domains, illustrate the effectiveness of the proposed techniques.

This paper presents a new type of sequential technology independent synthesis. Building on the previous notions of combinational observability and sequential equivalence, sequential observability is introduced and discussed. By considering both the sequential nature of the design and observability simultaneously, better results can be obtained than with either algorithm alone. The experimental results show that this method can reduce the technology-independent gate count up to 10% more than the previously best known synthesis techniques.

Based on previous findings concerning the numerical solution of one-dimensional elastodynamical problems [Provatidis in Arch Appl Mech 78(4):241–250, 2008] this paper extends the methodology to the static analysis of two-dimensional problems in quadrilateral domains. This target is achieved by replacing the Galerkin/Ritz procedure involved in Lagrangian (or Gordon–Coons) type finite elements by a global collocation scheme. In brief, the boundary conditions are fulfilled at all boundary nodes, while the governing equation is fulfilled at internal points. The theory is supported by four test cases concerning rectangular and curvilinear structures under plane-stress or plane-strain conditions, where the convergence rate is successfully compared with that of conventional bilinear finite elements with the same mesh density.

Summary form only given. Modern circuits contain up to several hundred million transistors and this number grows exponentially over time. Thus, the state-of-the-art design flows have to be improved continuously. In the meantime ensuring correctness becomes a major bottleneck. Up to 80% of the overall design costs are due to verification and even more problems are foreseeable - shrinking feature sizes lead to large process variations, increased susceptibility to radiation, etc. As a result even a correct design may contain faulty components. Thus, robustness is required, i.e. correct operation in presence of faults. Formal verification techniques have gained large attention, since they allow proving the correctness of a circuit and thereby ensure 100% functional correctness. Moreover, the underlying techniques can also be used to prove robustness of a design. Besides being more reliable, formal verification approaches have also shown to be more cost effective in many cases, since test bench creation - usually a very time consuming and error prone task - becomes superfluous. Therefore these techniques allow unveiling faulty behaviour automatically. Proving robustness in the sense of fault tolerance is important. As in any implementation step, faults may tamper the behaviour. In particular, fault tolerance may hide flaws during the standard verification step. Therefore instead of relying on the design's architectural precautions against faults, the implementation has to be proven to be fault tolerant. In this tutorial, after a brief motivation of the overall topic and definition of the problem domain, the alternative verification approaches are explained. Next, the application of the underlying formal techniques for robustness checking is considered. The standard approaches for verification are simulation, emulation and formal methods. Details are discussed related to formal verification, symbolic simulation and assertion based verification. The verification scenarios for equivalence checking (EC) and property checking (PC) are presented and the underlying proof techniques are explained. Robustness checking then also builds on the underlying formal methods. This allows analyzing the robustness of a design fully automatically. Practical scenarios covered by this model for robustness of a circuit are discussed. The model not only yields a measure for the robustness of a circuit but also shows critical parts of the implementation that should be reengineered. In comparison alternative approaches, e.g. using statistical measures, are outlined. Further references are given for all topics are given (see below). Directions for future work and research challenges are discussed.