Synthesis of verifiably hazard-free asynchronous control circuits

Transcription

1 Synthesis of verifiably hazardfree asynhronous ontrol iruits L. Lavagno Dept. of EECS University of California, Berkeley K. Keutzer AT&T Bell Laboratories Murray Hill, NJ November 9, 990 A. SangiovanniVinentelli Dept. of EECS University of California, Berkeley Abstrat A synthesis tehnique for asynhronous sequential ontrol iruits from a high level speifiation, the Signal Transition Graph (STG) is desribed. The synthesis tehnique is guaranteed to generate hazardfree iruits with the unbounded gatedelay model and the bounded wiredelay model, if the STG is live, safe and has the unique state oding property. A proof that STG persisteny is not neessary for hazardfree implementation is given. Introdution Asynhronous sequential iruit design has always been a ontroversial topi. In the early years of eletroni iruit design, when the size of the iruits was suh that a human designer ould keep trak of the omplex timing issues involved, it was a popular design style (see [Ung69] for a thorough review). Then synhronous logi dominated the VLSI era, when the ease of design of loked iruits overwhelmed the advantages of the asynhronous style. Asynhronous design, still, has always been around, at least in the restrited domain of interfaes to the external world, asynhronous by definition. However it was usually limited to finding a good and reliable way to synhronize signals with the internal lok. Reently there has been a revival of interest in asynhronous selftimed iruits ([Sei8]) due to their desirable properties:. the lokskew problem, getting worse and worse in synhronous submiron designs, disappears ompletely. 2. systemlevel lateny is no longer ditated by the worstase delay, but by the average delay. For example, a selftimed adder an signal when the result on its outputs is valid and stable, rather than always wait for the worst delay of the arry hain. These properties are ounterbalaned by a more onstrained design proedure and, often, by an inrease in area, power onsumption and worstase delay. The lok period of synhronous iruits must be long enough for the ombinational logi outputs to settle. Asynhronous iruits, on the other hand, are by definition sensitive to all signal hanges, whether they are intentional (i.e. part of the speifiation) or not. An example of suh unintentional hanges, also alled hazards, are the multiple osillations of a signal that is supposed to have a single transition. In this paper we will give a proedure transforming a formal, tehnologyindependent speifiation, alled Signal Transition Graph (introdued by [Chu87]), into a iruit implementation made out of basi gates suh as nands, nors and SR flipflops. We want to prove that the output of our proedure does not have hazards. In order to do so, we must define what delay model we are going to use for our iruit implementation. The unbounded gatedelay model ([Ung69]) assumes that wires interonneting gates have zero delay, and that all paths inside eah gate (inluding flipflops) have exatly the same delay. It also assumes that no bounds are known on the delay of eah gate. The unbounded wiredelay model assumes that eah onnetion between a gate output and another gate input an have an unbounded delay (see figure ). This work was partially supported by the National Siene Foundation under Grant UCBBS642 and by AT&T Bell Laboratories

2 a b S R Q e d a b S R Q e d Gate delay model Wire delay model Figure : Delay models. The bounded wiredelay model assumes that eah onnetion between a gate output and another gate input an have a delay. In this model the amount of delay from eah input to eah output of a omplex gate is a funtion of the load on the gate output. The funtion depends both on the input that we onsider and on the atual iruit used to implement the gate. This delay is alled nominal delay. Beause of statistial flutuations in the manufaturing proess and of modeling errors, for example the delay on the wires themselves, a lower and an upper bound on the nominal delay are onsidered when verifying the iruit with timing analysis. This delay model was introdued by [Huf54] (together with the assumption, that we shall not make, that input hanges are applied only when the iruit is known to be stable). In this paper we introdue a new synthesis proedure, that an be proved to generate hazardfree iruits from an STG speifiation, both with the unbounded gatedelay and the bounded wiredelay models. The synthesis proedure resembles the one presented in [Chu87] and [Men88]. However our proedure is more general, sine it deals with a more realisti delay model, and it an potentially give better results, sine it an guarantee that the iruit is hazardfree without requiring the STG to be persistent in the ase of both unbounded gatedelay and bounded wiredelay. In order to do this we will: give a synthesis proedure deriving from an STG a iruit implementation C with twolevel ombinational funtions and flipflops, together with suffiient onditions on the STG guaranteeing that suh an implementation exists, haraterize all hazards in iruit C, show that onstrained multilevel logi synthesis an be used without altering hazard properties of C, prove that C does not have hazards if we use the unbounded gatedelay model, give a proedure to remove all hazards from C if we use the bounded gate delay model, show that persisteny is not a neessary ondition for hazardfree implementation. The paper is organized as follows. Setion 2 realls some definitions from the literature. Setion 3 desribes briefly the synthesis proedure introdued by [Chu87] and improved by [Men88] and [Van90]. Setion 4 gives a proedure to synthesize a hazardfree iruit under the bounded wiredelay model. Setion 5 desribes the algorithm implementation and gives experimental results. Setion 6 draws some onlusions and outlines some opportunities for future development. Appendix A desribes a very simple example, applying the ideas presented in the paper. 2 Definitions This setion gives some basi definitions and previous results useful throughout the paper. Most of the definitions and results, unless otherwise stated, are from [Chu87]. 2. Logi funtions A ompletely speified singleoutput logi funtion g of n input variables is a mapping g : f0; g n! f0; g. Eah input variable x i orresponds to a oordinate of the domain of g. Eah element of f0; g n is alled a vertex. An inompletely speified singleoutput logi funtion f of n input variables (alled logi funtion in the following) is a mapping f : f0; g n! f0; ; g. The set of verties where f evaluates to is alled the onset of f, the set of verties where f evaluates to 0 is alled its offset, the set of verties where f evaluates to is alled its dset. Eah vertex of the onset of f is alled a minterm. 2

3 A literal is either a variable or its omplement. A ube is a set of literals, suh that if a 2 then a 62 and vieversa. It is interpreted as the Boolean produt of its elements. The ubes with n literals are in onetoone orrespondene with the verties of f0; g n. A ube overs another ube 2, denoted 2 v if 2, for example fa; bg fa; b; g, so ab v ab. The overing is strit, denoted 2 <, if 2 6=. The intersetion of two ubes and 2 is the empty ube if there exists x i suh that x i 2 and x i 2 2, otherwise it is 3 = [ 2. It is alled intersetion beause it overs exatly the intersetion of the sets of verties overed by and 2. For example the intersetion of fa; bg and fa; g is fa; b; g. A ube is alled an impliant of a logi funtion f if it overs some minterm of f and it does not over any offset vertex of f. An impliant of f is alled a prime if it is not overed by any other (single) impliant of f. An onset over F of a logi funtion f is a set of ubes suh that:. eah ube of F is an impliant of f, 2. eah minterm of f is overed by at least one ube of F. By analogy we an define an offset over R of a logi funtion f as a set of ubes suh that:. eah ube of R overs only offset verties of f. 2. eah offset vertex of f is overed by at least one ube of R. It should be obvious that, if F is an onset over of f and R is an offset over of f, then for eah 2 F; 2 2 R the intersetion of and 2 is empty. A ube in an onset over F of a logi funtion f an be expanded against an offset over R of f by removing literals from it while its intersetion with eah 2 2 R remains empty. The result of the expansion is not unique (it depends on the removal order), but it is always a prime impliant of f. In the following we shall use over to denote onset overs. Eah over F orresponds to a unique ompletely speified logi funtion, denoted by B(F). On the other hand a logi funtion an have in general many overs. A over is interpreted as the Boolean sum of its elements, so it an also be seen as a twolevel sumofproduts implementation of the ompletely speified funtion B(F). A over F is alled a prime over of a funtion f if all its ubes are prime impliants of f. A over F is alled an irredundant over of a funtion f if deleting any ube from F auses it to be no longer a over of f (i.e. if some minterm is no longer overed by any ube of F ). The ofator of a ube with respet to a literal x i, denoted by xi, is: the empty ube (a ube that does not over any element of f0; g n ) if x i 2.? fx i g otherwise. The ofator of a over F with respet to a literal x i, denoted by F xi, is the set of ubes of F ofatored against x i. The empty ube an always be deleted from a over, sine it does not over any vertex. The ofator has the following property (Shannon deomposition),for eah i n: B(F) = x i^b(f xi )_x i^b(f xi ). A funtion f is monotone inreasing in a variable x i if f(x i ; ) = ) f(x i ; ) = for all 2 f0; g n?, that is if inreasing the value of x i from 0 to never dereases the value of f from to 0. A funtion f is monotone dereasing in a variable x i if f(x i ; ) = 0 ) f(x i ; ) = 0 for all 2 f0; g n?, that is if dereasing the value of x i from to 0 never inreases the value of f from 0 to. A funtion f is unate in a variable x i if it is either monotone inreasing or monotone dereasing in x i. Otherwise f is binate in x i. A over F is unate in a variable x i if variable x i appears in only one phase (i.e. either x i or x i ) in its ubes. A funtion that is unate an have nonunate overs, but prime overs of unate funtions must be unate. Moreover if F is a over of f and F is unate then f must be unate. 3

4 2.2 Hazards Synhronous iruits do not have hazard problems: the lok yle is hosen long enough to insure that every lath input is stable when the lok is pulsed. In the asynhronous ase, we must make sure that no signal transition ever happens exept when it is speified by the designer, beause every transition an be reorded by some other part of the system, and ause it to behave inorretly. A stati hazard is a 0!! 0 transition (stati 0hazard) or! 0! transition (stati hazard) in any ondition where no transition for that signal should be enabled aording to the speifiation. A dynami hazard is a 0!! 0! (or! 0!! 0) transition in any ondition where a single positive (or negative) transition for that signal is enabled aording to the speifiation. Hazards must be absolutely avoided, beause they an ause the iruit to malfuntion in an unpreditable way (for example in response to a hange in operating temperature). The following Theorem was proved in [Ung69]: Theorem 2. Let T be a twolevel representation of a logi funtion f. Let M be a multilevel representation of f suh that it an be obtained from T using only the assoiative, distributive and De Morgan laws. Then the iruits orresponding to M and T have preisely the same stati hazards. That is for eah pair of input vetors suh that the output of M had a hazard for some assignment of wire delays, there exists some wire delay assignment in T suh that the same hazard happens at its output, and vieversa. On the other hand if some hazard ould not happen in M under any wire delay assignment, then it ould not happen also in S, and vieversa. The relevane of this Theorem is that, if we have a twolevel implementation T of a logi funtion f that does not exhibit hazards for some lass of input hanges, then we an use multilevel synthesis tehniques, onstrained to use only the transformations listed above, to obtain a multilevel implementation of f that has the same hazard properties. 2.3 Signal Transition Graph The Signal Transition Graph was introdued by [Chu86] as a speifiation formalism for asynhronous sequential iruits. It is a natural way to speify asynhronous interfae iruits, beause the ausal relations among the signal transitions an be easily desribed, and it the onurreny is aptured expliitly. A Petri Net is a triple N =< P; T; F >, where P is a set of plaes, T is a set of transitions and F (P T) [ (T P), suh that dom(f)[range(f) = P [ T, is the flow relation. A plae p 2 P is a predeessor of a transition t 2 T, and t is a suessor of p, if (p; t) 2 F. Conversely, a transition t 2 T is a predeessor of a plae p 2 P, and p is a suessor of t, if (t; p) 2 F. A freehoie net (FC net) is a Petri net where if a plae p has more than one transition t : : : t n as its suessors, then p must be the only predeessor of t : : : t n. Suh a p is alled a freehoie plae. A marked graph (MG) is a Petri net where eah plae p has exatly one predeessor and one suessor transition. An STG is an interpreted freehoie Petri net: transitions of the FC net are interpreted as value hanges on input/output signals of the speified iruit. Positive transitions (labeled with a + ) represent 0! hanges, negative transitions (labeled with a ) represent! 0 hanges. From now on t will denote a transition of signal t (i.e. either t + or t? ) and t will denote its omplementary transition (i.e. either t? or t + ). Input transitions are those that our on input signals of the iruit, output transitions are those that our on its output signals. The onventional graphial representation of an STG (slightly different from the Petri net onvention) is a direted graph, where nodes orrespond to transitions (denoted by single irles) and plaes (denoted by double irles), while direted edges represent elements of the flow relation. Direted edges fanning out to a transition represent sequening onstraints either on the iruit to be synthesized (if their fanout is an output transition) or on the environment (if their fanout is an input transition). They speify what set of transitions auses eah transition. Figure 2.a ontains an example of an STG without FC plaes (from [Men88]), where x and y are inputs, z is an output. The edge x +! y + means that the environment guarantees that the rising edge of y always follows the rising edge of x. The edges x?! z? and y +! z? mean that the iruit to be synthesized must guarantee that the falling edge of z always follows the falling edge of x and the rising edge of y. Figure 2.b ontains an example of an STG with two FC plaes, where l, a, and e are inputs, d and f are outputs. Informally, it desribes a iruit where a is allowed to hange its value only when l is at, and depending on the value of a, one of two full handshake yles takes plae. So the funtion performed by this iruit depends on an external ondition a. A set T of transitions is alled a omplementary set if it does not ontain all the transitions of the STG and t 2 T ) t 2 T. A omplementary pair of transitions is a pair of positive and negative transitions for the same signal (i.e. a omplementary set with two elements).. 4

5 x+ f+ d+ l+ l+ y z+ x y+ e+ f a a+ l l l l d z e + (a) (b) Figure 2: Examples of STG s. External signals are those whose behavior is speified by the STG. Internal signals are those who are generated by the synthesis proedure to interonnet the logi gates Marking and firing A token marking of a Petri net is a nonnegative integer labeling of its plaes. A transition is enabled (i.e. the orresponding event an happen in the iruit) whenever all its fanin plaes are marked with at least one token. Transitions z + and y + are enabled in Figure 2.a (blak dots represent the marking). An enabled transition must eventually fire. This means that the orresponding signal hanges value in the iruit. When it fires, a token is removed from every fanin plae, and a token is added to every fanout plae. If a plae has more than one fanout edge, then exatly one of its fanout transitions is nondeterministially enabled. This means, in pratie, that the behavior of the iruit depends on an external ondition. So we onstrain all fanout transitions of an FC plae to be input transitions. A set of transitions is said to be feasible if it an fire without firing any other transition not belonging to it. For example in Figure 2.a the set fx + ; z + ; y + g is feasible, while the set fy + ; y? g is not, sine they annot both fire without, at least, either x + or z? firing also Live and safe net In the following we will restrit ourselves to FC nets whose underlying direted graph is strongly onneted. An FC net is live if every transition an be enabled through some sequene of firings from the initial marking. This means that, sine the net is strongly onneted, every transition an be enabled infinitely often through some sequene of firings from the initial marking. An FC net is safe if no plae an ever be assigned more than one token after any sequene of firings from the initial marking. In [Ha72] was proved that a live and safe FC net an be deomposed into. FSM omponents that over the net (eah omponent is sequential and exhibits nondeterministi hoie), 2. MG omponents that over the net (eah omponent has onurreny and does not exhibit nondeterministi hoie). Covering means that eah transition and plae of the net has a orrespondent in at least one FSM omponent and a orrespondent in at least one MG omponent. FSM omponents an be thought as running onurrently, synhronizing on the transitions belonging to the intersetion of two (or more) omponents. MG omponents an be thought as running one at a time, and whenever a plae orresponding to an FC plae in the original FC net beomes marked, then the next running omponent is nondeterministially hosen. If there are no FC plaes, i.e. if the net is an MG, then the FSM omponents are just the simple yles of the net. For example in Figure 2.a there are two FSM omponents, namely x +! z +! x?! z?! y?! x + and x +! y +! z?! y?! x +. On the other hand, Figure 3 ontains a possible deomposition of the STG in Figure 2.b in MG s. The marking simply appears on the edges themselves whenever a single fanin/single fanout plae is omitted from the graphial representation. 5

6 f+ d+ f+ d+ l+ l+ l+ l+ e+ e+ a a+ f l l d f l l d e + e + Figure 3: An MG deomposition of the STG in Figure 2.b This deomposition mehanism is very useful to analyze the properties of the FC net in terms of its omponents, sine those have an easy haraterization of behavior properties (liveness, safeness, : : :) in terms of syntati properties. Two transitions in a live and safe FC net are said to be ordered if there exists a simple yle to whih both belong. They are said to be onurrent if they are not ordered and there exists some MG omponent to whih both belong. Otherwise they are said to be in onflit. The following Theorems about marked graph omponents of an FC net are proved in [CHEP7]: Theorem 2.2 An MG marking is live if and only if the token ount in every simple yle is positive. Theorem 2.3 An MG marking is safe if and only if every edge belongs to at least one simple yle with exatly one token. Theorem 2.4 An MG has at least one live and safe marking if and only if it is strongly onneted. Theorem 2.5 A live marking M of a strongly onneted MG an produe a marking M 2 (whih is also live) if and only if they have the same number of tokens for eah simple yle. So all live and safe markings of an MG are partitioned into equivalene lasses, where all mutually reahable markings belong to the same lass. The following Theorem is proved in [Chu87]: Theorem 2.6 Let N be an FC net suh that eah FSM omponent has exatly one token in the initial marking. Then every live and safe marking of N is a live and safe marking of some MG omponent. This Theorem states formally that MG omponents are running one at a time. Liveness is obviously a desirable property of a iruit (a signal that an never hange its value is redundant), and safety is required by the synthesis proedure outlined below, so from now on we will restrit ourselves to strongly onneted STG s with a live and safe initial marking Live STG An STG is live 2 if:. it is strongly onneted. This ensures that the underlying net is live and safe. 2. for eah signal t there is at least one FSM omponent, initially marked with one token, suh that: (a) it ontains all transitions t s of t, (b) eah path from a transition t to another transition t (i.e. both rising or falling) ontains also the omplementary transition t. This ensures that eah signal in the iruit has always a welldefined value in all markings reahable from the initial one, beause a rising and falling transition for the same signal an never be onurrently enabled and eah signal must have alternate rising and falling transitions. 2 Note the distintion between live net and live STG. 6

7 x+ x+ 000 x x y+ z z+ y+ x y+ z+ y 00 x y+ z 0 0 z+ y+ x 00 y+ z+ 0 y 00 0 x y+ z z+ y+ x 00 0 y+ z+ 0 y (a) (b) Figure 4: A state graph with state odes () This definition is broader than the one given in [Chu87], sine he required that only two transitions per signal appear in the STG, and that those transitions are ordered (i.e. belong to a simple yle) in every FSM omponent of the net. we do not restrit the number of transitions per signal, and we require that at least one FSM ensures the alternating order for eah signal. 2.4 State Graph The State Graph (SG) is another possible speifiation level for an asynhronous iruit, where the onurreny has been been expliitly resolved into a stritly sequential behavior. It an be derived from a live STG using a deterministi proedure ([Chu87]). The SG is a direted graph, where eah node (heneforth alled state) is in onetoone orrespondene with a live and safe marking of the signal transition graph. An edge joins state s with state s 2 if the orresponding marking M 2 an be reahed from M (orresponding to s ) through the firing of a single transition. This transition labels the edge. Figure 4.a ontains the SG derived from the STG in Figure 2.a (the initial marking orresponds to the dotted state). 2.5 Unique state oding The synthesis proedure desribed in [Chu87] uses the output signals of the iruit diretly as state variables, so the iruit must be able to tell its global state given only the values of the input and output signals. This means that: we must assign to eah state s i of the SG a unique vetor v i of signal values and this vetor of values must be onsistent with the SG edge labeling, in other words for eah edge s! s 2 :. if it is labeled t + then signal t must be 0 in v and in v if it is labeled t? then signal t must be in v and 0 in v otherwise signal t must have the same value in both v and v 2. An example of suh a labeling appears in Figure 4.b. If this an be done, then we say that the STG from whih the SG was derived has the Unique State Coding property (USC, [Van90]). The following Theorem was proved in [Chu87]: 7

8 Theorem 2.7 An STG S has the USC property if no omplementary set of transitions is feasible in S. Informally, if a set of transitions is feasible, then they an all fire without any other signal hanging in the iruit. If they are also a omplementary set, then the initial and final values are the same for all signals, and not all signals of the STG are involved, so we have two distint states with the same ode. The first formal proedure to enfore the USC property was given by [Van90]. It adds to the STG edges (this redues the amount of onurreny allowed in the initial speifiation, so it is not always desirable) and/or new internal signals (i.e. signals used only as state variables and not interesting for the outside world). 3 Logi funtion derivation from Signal Transition Graph In the next Setions we will derive an implementation of a live STG with the USC property in two different ways. The first one, taken from the literature, uses the SG as an intermediate step, and it is useful to show that the implementation is valid if the iruit does not have delay. The latter one, whih is new, is useful to haraterize the hazard properties of the implementation in presene of delays. Both implementation tehniques are shown to generate the same result, so either of them an be used to obtain the implementation, but both are useful in order to prove properties of this implementation. 3. State Graph derivation from Signal Transition Graph The SG an be derived from the STG by exhaustive simulation as follows (see also [Chu87] for an equivalent proedure based on graph deomposition): Proedure 3.. for eah live and safe marking M : (a) if M has not been reorded yet, then: i. reate a new state s assoiated with M. ii. for eah transition t enabled in M : A. fire t, obtaining a marking M 2. B. all reursively step a using M 2 as urrent marking (this all will either reate or retrieve the orresponding state s 2 ). C. reate an edge from s to s 2 labeled with t. 3.2 Nextstate funtion derivation from State Graph Let S be a live STG with the USC property and let n be the number of signals in S. Let f be the nextstate/output funtion to be implemented for signal t 3, and let v i be an element of the domain of f, v i 2 f0; g n. Every state has a unique, onsistent enoding in terms of the STG signals, so eah SG state s i an be assoiated with a vertex v i of the domain of f. The following proedure ([Chu87]) derives f: Proedure 3.2. for eah SG state s : (a) let v be the orresponding vertex. (b) if there is no fanout edge s! s 2 labeled t then let f(v ) be the value of t in v. () else let f(v ) be the omplement of the value of t in v. 3 Eah output signal is used as state variable, so the output funtion is identially equal to the nextstate funtion. 8

9 a b f >0 t ~0 Figure 5: An ideal iruit implementing signal t Notie that in step b there an be only one fanout edge with label t, beause no two transitions for t an be onurrently enabled. Moreover f(v) is don t are for all verties v of the domain of f that do not have a orresponding SG state. Figure 4. ontains the SG orresponding to the STG of Figure 2.a. Eah state s i is labeled with the orresponding input vertex m i (state ode, upper label) and the nextstate/output value for x; y; z (lower label). It should be obvious that a hypothetial implementation of f (see Figure 5) with:. zerodelay ombinational logi, 2. a feedbak loop with almost zero delay and 3. an unbounded delay (greater than the feedbak delay) on the output, would satisfy the STG speifiation, sine a transition on t an happen exatly when it is enabled in the STG (and orrespondingly in the SG). 4 Hazardfree logi implementation 4. Stati hazard analysis of a twolevel logi iruit We want to analyze when stati hazards an our in a twolevel iruit implementation C i of a logi funtion f i, with the unbounded wiredelay model, given an STG speifiation restriting the way in whih input and output signals of C i (orresponding to the input variables and the value of f i ) are allowed to hange value. As shown in Setion 3.2, we an synthesize an asynhronous sequential iruit speified by an STG as a set of ombinational subiruits C i, one for eah output signal of the STG t i, eah having as inputs the set of signals speified by the STG. Eah C i, in general, has its output signal t i appearing also as one of its inputs. In this analysis, though, we will treat them as separate entities, and we will make sure that the output signal does not have hazards if none of the inputs has hazards. An input vetor is an assignment of binary values to all input signals of C i. A sequene of input vetors (also alled a transition sequene) is onsistent with the STG if it is a valid firing sequene of the STG. This is equivalent to say that there exists a path on the SG suh that eah vetor appears in it as a state label (in the same order as in the sequene). A stati hazard ours in the iruit if applying a onsistent sequene of input vetors, with any delay among them, to C i, its output hanges value when the STG does not allow a transition on it. Exhaustive simulation of all input vetor sequenes for all possible delay assignments is learly not feasible. So we will use threevalued logi analysis, where eah variable an assume a value of 0, or (for undetermined), as desribed in [Ung69], by ollapsing a whole family of input vetor sequenes and delay assignments into a single threevalued simulation. A ontrolling value for an input of a subiruit is defined as a value of that input whih uniquely determines the value of the output of the subiruit, independently of the value of the other inputs of the subiruit. This value of the output is the ontrolled value of the subiruit. A nonontrolling value is any value that is not a ontrolling value. For example is a ontrolling value, and is the orresponding ontrolled value, for any input of an or gate, beause if it is then the output is, while there is no ontrolling value for any input of an exor gate. An input ube is a set of assignments of threevalued values to all the input signals of C i. The value is defined as nonontrolling for all logi gates. The threevalued output of a ombinational iruit C i for an input ube is:. the twovalued result if no inputs in have the value. 9

10 2. if all inputs to C i have nonontrolling values in and some inputs in have the value. 3. the ontrolled value otherwise. For example the threevalued output of a twoinput or gate with inputs and (input ube ) is, while with inputs 0 and (input ube 0) it is. An input with a value of or 0 orresponds to a signal whose value is known to be onstant from the STG speifiation during the transition sequene that we are simulating. An input with a value of orresponds to a signal allowed by the STG to have or more transitions during the transition sequene that we are simulating. With this proedure we an simulate the transition sequene where all the signals with a value of hange value in any order at any point in time, under all possible wire delay assignments. We define an input vetor pair (v ; v 2 ) to be valid with respet to the logi funtion f i of signal t i if. f i (v ) = f i (v 2 ) (sine we are analyzing stati hazards) and 2. state s 2 (orresponding to v 2 ) is reahable from state s (orresponding to v ) on the SG without traversing any edge labeled with a transition of t i. We forbid valid pairs to inlude a transition t beause any subiruit that implements a transition i t that is enabled by j t i must wait for t i to fire. So in order to be sure that t j will be pereived by C i as distint from the transitions desribed by the urrent vetor pair, we must assume that C i plus its feedbak loop is ready to aept the next input transition whenever a transition on t i ours. We shall see later that this assumption an be reasonably satisfied, implementing the feedbak loop with an SR flipflop. Eah valid vetor pair has assoiated a transition ube, where all signals that hange value from v to v 2 are undetermined, while the other signals have the value they have in v (and also in v 2, of ourse). It was proved in [Ung69] that a hazard ondition exists for a gatelevel implementation, with the unbounded wiredelay model, if and only if the threevalued simulation of the extended transition ube orresponding to a valid vetor pair gives an undetermined output value. The following proedure performs the threevalued simulation of a twolevel iruit, diretly implementing an onset over F of a logi funtion f 4, for all valid input vetor pairs. Let v i be the value of input signal t i in the input vetor v, for example if v = 00 then v = ; v 2 = 0; v 3 = 0. Proedure 4.. for eah valid pair of input vetors (v ; v 2 ): (a) for eah input signal t i : i. if any SG path from v to v 2 inludes an edge labeled with a transition for t i, then let i =? ii. else let i = v i (b) i. if does not interset any ube i 2 F, then the output of eah ube i, and of the iruit, is 0. ii. if overs some ube i 2 F, then the output of that partiular i, and of the iruit, is. iii. otherwise ( intersets some i without overing any), the output of those i s, and of the iruit, is?. Then a hazard ondition exists for vetor pair (v ; v 2 ). For example, any subiruit synthesized from the STG in Figure 2.a (the orresponding SG appears in Figure 4.b) to implement output signal z must onsider the vetor pair (00; 00) as valid, with orresponding transition ube =?0?, while the vetor pair (0; 00) is not valid, beause it requires to traverse the edge labeled z?. 4.2 Nextstate funtion derivation from Signal Transition Graph One of the main problems in asynhronous iruit synthesis is to make sure that the iruit behavior is orret for eah possible ordering of onurrent transitions. In the example of Figure 2.a, sine nothing is said about the ordering of z + and y +, then every output signal must not have stati hazards regardless of their firing order. So we must make sure, remembering the analysis in Setion 4., that the onset and offset overs F and R that we synthesize for the nextstate funtion of output t have the following property: 4 That is a iruit with two levels of gates, a level of and gates, one for eah ube, possibly with inverters at their inputs, fanning out to an or gate. 0

11 Property 4. Let S be a live STG, let F be an onset over and let R be an offset over of the nextstate/output funtion of signal t, synthesized from S. Then for eah live and safe marking m of S and for eah set T of onurrent transitions in S suh that t must remain onstant during any sequene of firings in T :. if t must be, then there exists at least one ube j 2 F suh that: j evaluates to in the vertex orresponding to marking m and no signal whose transition is in T appears in j. 2. otherwise, if t must be 0, then there exists at least one ube i 2 R suh that: i evaluates to in the vertex orresponding to m and no signal whose transition is in T appears in i. We require S to be live in order to be able to assoiate eah marking m of S with a vertex in the domain of the nextstate/output funtion of eah signal t in S. We will see later that F and R an have Property 4. if and only if S has the USC property. Case guarantees that the output of F, if so required, remains at independent of the firing order in T. Case 2 guarantees that the output of F, if so required, remains at 0 independent of the firing order in T, even though it is stated in terms of the offset over R. This is beause the intersetion of i 2 R with any ube j 2 F is empty. So we an be sure that eah j 2 F will evaluate to 0 in the vertex orresponding to m, and no signal whose transition is in T appears in it. For example, the set of onurrently enabled transitions in the marking shown in Figure 2.a, orresponding to vertex 00 in Figure 4.b, is S = fz + ; y + g. If one of the ubes in the onset over of the nextstate/output funtion for z, whih must be a onstant independent of the firing order in S, is exatly x, then signal z will remain onsistently at regardless of the firing order. The following proedure derives an onset over F and an offset over R for the nextstate funtion f of signal t i, reeiving as input a live STG, S, having the USC property, with initial marking m. Let v be a vetor of values for the n signals that appear in S, v 2 f0; g n, and let v j denote the value of signal t j in v. Proedure 4.2. Initialization: (a) for eah signal t j in the STG, do (determine its initial value): i. let M j be an FSM omponent of S that ontains all transitions for t j, and let m j be its initial marking (a subset of m). ii. find on M j the first transition t j that an be reahed from m j. iii. if t j is t+ j, then let v j = 0, otherwise let v j =. (b) let F =, R =. 2. Reursive step: (a) if t + i is enabled in m then let v i =. (b) else if t? i is enabled in m then let v i = 0. () for eah maximal subset T of transitions enabled in marking m suh that t i obtained from m firing all transitions in T do: i. let = fv j s:t: t j 62 T g. ii. if v i = then let F = F [ fg, otherwise let R = R [ fg. (d) for eah transition t j do: is not enabled in the marking m0 enabled in m suh that marking m0, obtained from m firing t, has not been reahed yet, j i. let v 0 = v. ii. if t j is t+ j, then let v0 j =, otherwise let v 0 j = 0. iii. reursively all step 2 with v 0 and m 0. The initial values determined by step a are well defined if the STG is live (Setion 2.3.3), beause:

12 at least one M j ontaining all transitions of signal t j must exist. the first transition of t j that an fire on the FSM omponent M j starting from a marking m j must be independent of the path on M j, or else there would be a firing sequene where two transitions t (both rising or falling) are not separated j by a t. j if there are two (or more) FSM omponents ontaining all transitions of t j, say M 0 00 and M, then the first transition of j j t j reahable from a marking m restrited to M 0 00 or M must be the same, sine the intersetion of the two mahines j j obviously ontains all suh t s, and the FSM s are synhronized in their mutual intersetions. F and R are onstruted by the above proedure exatly to have Property 4.. This guarantees that the nextstate funtion remains onstant whenever the STG speifies so, independent of the firing order of a set of onurrently enabled transitions. Moreover the vetor of values v generated at eah step is onsistent with the firing, so it oinides with the unique ode of the state s orresponding to marking m, as desribed in Setion 2.5. We still want to prove that F and R are onset and offset overs of the nextstate funtion f, as obtained in Setion 3. Theorem 4. Let f be the inompletely speified nextstate/output funtion of signal t i, obtained from a live STG S with the USC property using Proedures 3. and 3.2. Let F and R be the overs obtained from S using Proedure 4.2. Then every onset vertex and no offset vertex of f is overed by a ube of F, and every offset vertex and no onset vertex of f is overed by a ube of R (that is F and R are valid onset and offset overs of f). Proof: we have the following ases:. Some transitions an fire from the urrent marking m reahing a marking m 0 where no transition of t i is enabled. Then we generate a set of ubes suh that the vertex v orresponding to m is overed. Moreover all the ubes belong to either the onset or to the offset aording to whether v i is or 0, and the deision about v i is made exatly as in Setion 3.2. All overed verties orrespond to markings where no transitionof t i an be enabled, so if the STG has the USC property (i.e. different markings orrespond to different verties) then no vertex where f must have a different value an be overed. 2. Every transition firing from m will reah a marking m 0 where a transition of t i is enabled. We will show that in this ase no transition of t i an be enabled in m. Suppose that t is enabled in m and let i m0 be the marking reahed from m firing t. Then i (a) t ould not be enabled again in i m0, sine the STG is live (otherwise two rising or falling transitions of t i ould fire in sequene). (b) t i ould not be enabled in m0, sine the STG has the USC property (otherwise the omplementary set ft + i ; t? i g would be feasible). So there would exist some transition (namely t i ) that an reah a marking m0 where no transition of t i is enabled, and we have a ontradition. We know also, sine the STG is live, that there exists some marking m 00 from whih m an be obtained by firing some transition t j. Then whenever the proedure reahes m00, it generates a ube overing also the vertex orresponding to m, beause m is obtained from m 00 by firing a transition that does not enable t i. 2 Figure 6 ontains an STG fragment (a) and the orresponding SG fragment (b) to illustrate ase. Let o be the signal for whih we are generating over ubes in marking m (blak dots in the STG fragment). Blak dots in the SG represent onset verties of f, white dots represent offset verties.. The sets of transitions that an fire without enabling o? are: S = fa + ; b + g, S 2 = fa + ;? g and S 3 = fb + ;? g. 2. The vetor orresponding to marking m is: a = 0; b = 0; = ; d = ; e = ; o =. 3. The generated ubes are: = deo, 2 = bdeo and 3 = adeo. 4. Eah ube overs vertex abdeo, orresponding to m, and belongs to the onset over. So minterm abdeo of f is overed without problems. 2

13 m + a a + d o + b b + + a + a b + + a b + b + o e (a) (b) Figure 6: Illustration of Theorem 4. ase 5. Every ube overs only verties where o? is not enabled, so no offset vertex (suh as abdeo) is improperly overed. Figure 7 ontains an STG fragment (a) and the orresponding SG fragment (b) to illustrate ase 2. Let o be the signal for whih we are generating over ubes in marking m (blak dots in the STG fragment). The double irles represent an FC plae. Blak dots in the SG represent onset verties of f, white dots represent offset verties.. The only two transitions that an fire in m are either a + or? (not both, sine this is an FC plae, so it enables only one fanout transition). Both enable o?. 2. One example of a marking m 00 predeessor of m is represented as white dots on the STG (replaing the token on b +! o? ). 3. One of the ubes generated in m 00 is = ao, so minterm abo orresponding to m is overed without problems. 4. If one of the enabled transitions in m had been either o + or o?, instead of a + or?, then it is lear that either the STG would not have had the USC property (o + followed by o?, Figure 7.), or it would not have been live (o? followed by o? Figure 7.d). 4.3 Ciruit implementation of the nextstate funtion One we have the onset and offset overs of the nextstate/output funtion f for eah output signal, we an hoose how to implement the feedbak loop (sequential part), and apply known logi synthesis tehniques in order to obtain a minimal implementation of the ombinational part Feedbak loop implementation with SM flipflop The feedbak loop an always be implemented using a simple flipflop, due to the following theorem, first proved in [Moo90] in the restrited ase when the STG is persistent. Theorem 4.2 Let S be a live STG with the USC property. Let F and R be a pair of onset and offset overs of the nextstate/output funtion f of signal t derived from S aording to Proedure 4.2. Let F 0 be a over derived from F expanding eah ube 2 F against R to a prime impliant of f and removing dupliate ubes. Then F 0 is positive unate in t. An intuitive reason for this is that if f is binate in t, then there is a set of input values for whih t osillates. And, if f is unate, every prime over of f must be unate. Proof: let us assume, for the sake of ontradition, that F 0 is binate or negative unate in t. Then there exists at least one vertex v = t, where 2 f0; g n?, belonging to the onset of f, whose orresponding vertex v 2 = t belongs to the offset of f (otherwise we ould always over both v and v 2 with a prime impliant not depending on t). 3

14 m" + b + a b + m a + o o o o (a) (b) + b b + o + a + o o o o o () (d) Figure 7: Illustration of Theorem 4. ase 2 The value of f in vertex v is the omplement of the value of t in v, so t + is enabled in the marking m orresponding to v. The marking obtained firing t + orresponds exatly to v 2, sine v 2 differs from v only in the value of t. Similarly the value of f in vertex v 2 is the omplement of the value of t in v 2, so t? is enabled in the marking m 2 orresponding to v 2. m 2 is obtained by m through the firing of t +, so a firing of t + would immediately enable t?. But this would mean that the omplementary set ft + ; t? g is feasible, ontraditing the assumption that the STG has the USC property. 2 Corollary 4. Let S be a live STG with the USC property. Let f be the nextstate/output funtion of signal t derived from S as desribed in Setion 3.2. Then f is positive unate in t. Proof: Theorem 4. proved that F and R, as derived in Setion 4.2, are valid onset and offset overs of f, as derived in Setion 3.2. Moreover if we expand eah ube in an onset over to a prime it still remains an onset over. And a funtion with a prime unate over is unate. 2 If f is positive unate in t, then there exist two logi funtions s and m that do not depend on t, suh that f = s + tm. So we an partition the subiruit into two purely ombinational parts, s and m, and an SM flipflop, that is a flipflop with logi equation Q = S + QM ([BC88]). The more usual SR flipflop has logi equation Q = S + QR. We shall see in Setion that the assumption to use SM flipflops an be removed without hanging the hazard properties of the subiruit. Dynami hazards are pratially unavoidable in any iruit implementation of a ombinational funtion (see [Ung69]). Thus we assume that the SM flipflop implementation, or any flipflop type that we will use, is relatively immune to dynami hazards, i.e. that a dynami hazard on S or M an ause only one of the following events:. Q makes the orret transition in response to the first edge of the hazard. 2. Q goes into a metastable state after the first edge, then it makes the orret transition after the seond edge Q makes the orret transition after the seond edge. 5 This ase is not a problem even if two distint subiruits interpret the metastable value of Q differently, sine we are assuming bounded wire delays. 4

15 In all ases the orret behavior is guaranteed, only the timing hanges. Moreover we assume that the flipflop is ready to aept a new transition on its inputs (i.e. that the internal feedbak loop is in a stable state) whenever the output Q makes a transition. This means that the internal feedbak loop delay must be smaller than the delay on any path from the flipflop output to one of its inputs. This requirement an always be trivially satisfied by adding buffers after the flipflop output, with a delay greater than the internal feedbak loop delay. These two delays an be guaranteed to be similar (despite proess variations, et.) using appropriate layout tehniques, suh as keeping the flipflop and the buffers near to eah other Logi synthesis for minimal implementation of the ombinational logi In general we have the hoie between implementing the onset or the offset over of eah signal (inverting the output if neessary). In the following we will disuss only about the onset over, but most results apply also to the offset over implementation. We want to obtain an implementation that is minimal with respet to some ost funtion, usually a ombination of delay, area and testability. Prime and irredundant overs are very important from an implementation point of view, beause:. heuristi twolevel logi minimizers an obtain prime and irredundant overs whose implementation has a nearly minimum area among all twolevel implementations of the funtion ([BHMSV84]). 2. a twolevel implementation of a logi funtion obtained from a prime and irredundant over is fully testable for single stukat faults. 3. a prime and irredundant over is a good starting point of multilevel logi synthesis systems ([BRSVW87]). On the other hand we want to preserve Property 4., beause it is strongly onneted with the hazard properties of the implemented iruit. This means that we an expand eah ube in the over F against R to a prime impliant of f, beause this does not introdue additional dependenies of the ube on signals that may hange when f must remain onstant. Unfortunately we annot remove redundant ubes, unless eah ube in the original onset over is already overed by some other prime. So we an set up a minimum overing problem similar to the lassial QuineMCluskey minimization proedure[mc56], where eah ube of the original over (rather than eah minterm of f, as in the original proedure) must be ompletely overed by at least one prime in the output over. Figure 8.a ontains an example of a live STG with the USC property whose twolevel implementation of the flipflop exitation funtion m aording to Proedure 4.2 is redundant 6. Figure 8.b ontains the SG (input variables are ordered a; b; ; t), while Figure 8. ontains the Karnaugh map of the funtion m(a; b; ). The over of m obtained by the proedure is: m = ab + a + b + a where the impliant a is redundant (it is shown by the dashed oval on the Karnaugh map, while nonredundant impliants are shown by dotted ovals). If the redundant impliant is removed from the over, then a hazard an our when the irled b? transition fires, beause the impliant b ould go to 0 before the impliant ab goes to. This auses a stati hazard, and possibly a malfuntion in the iruit, sine the SM flipflop an be set inorretly due to this hazard. The deomposition into an SM flipflop and two ombinational networks maintains Property 4., sine every ube in F has exatly one orresponding ube in the over of either s or m. Moreover eah one of the two overs of s and m is still prime after the deomposition, beause we first split F into a over F where no ube depends on t and a over F 2 where every ube depends on the positive phase of t, so ofatoring eah ube of F 2 against t leaves it a prime of the over of m. Theorem 2. allows us to use, for example, SR flipflops, instead of the less usual SM type, applying De Morgan s law to the over of m. If we want to further improve the area and/or delay performane of the iruit, we an use some multilevel synthesis tehniques, suh as those desribed in [BRSVW87]. In order to retain the hazard properties of the twolevel iruit, though, we must restrit ourselves to the transformations listed by Theorem 2.. Algebrai fatorization is a diret appliation of assoiative and distributive laws, so it an safely be used. 6 Reall that the over of m is the set of those ubes in the onset over F for signal t that depend on t itself, ofatored against t, while the over of s is the set of ubes of F that do not depend on t. 5

16 b+ t+ b t+ a+ b 00 t+ 0 b a b + (a) t a+ + b+ t (b) t a b b+ t b () ab b+ b 00 0 a 00 0 a a a 000 t b+ Figure 8: An STG that requires a redundant twolevel implementation 4.4 Stati hazard analysis of a iruit implemented from an STG Now let us see what happens when we apply eah valid vetor pair (v ; v 2 ) as desribed in Setion 4., to the iruit implementation of signal t obtained from the onset over F of the nextstate/output funtion f for t as desribed in Setions 4.2 and 4.3. We have the following ases for eah transition ube orresponding to the valid vetor pair (v ; v 2 ):. is overed by a ube of F or it does not interset any ube of F : the output is either or 0, and we do not have stati hazards. 2. f(v ) = f(v 2 ) = and two ubes of F, say and 2, are required to over (the extension to more than two is straightforward): a hazard ondition an our, under an appropriate wire delay assignment. Every path on the SG from v to v 2 ontains two transitions j and i (ordered j! i on the path) suh that: i turns off (i.e. overs the fanin vertex of i and it does not over its fanout vertex on the SG). j turns 2 on (i.e. 2 does not over the fanin vertex of j and it overs its fanout vertex on the SG). We have a hazard if the transition on the output of propagates to an input of the flipflop before the transition on the output of 2, sine the STG does not speify any transition for signal t (otherwise (v ; v 2 ) would not have been a valid pair). Notie that j transitively enables i on the STG, beause if they were onurrent, then they would be overed by a single ube. 3. f(v ) = f(v 2 ) = 0 and intersets some ube of F. A hazard ondition an our. under an appropriate wire delay assignment. In this ase some direted path P in f0; g n from v to v 2 ontains two transitions j and i (ordered j! i on the path) suh that: i turns on, 6