2. Verification by Equivalence Checking

Transcription

1 2. Verifiction by Equivlence Checking Pge Combintionl Circuits Verifiction 2.2 Propositionl Logic (Clculus) 2.5 Propositionl Resolution 2. Stålmrck s Procedure 2.9 Reduced Ordered Binry Decision Digrms (ROBDDs) 2.23 Sequentil Circuits Verifiction 2.55 Reltionl Representtion of FSMs 2.56 Reltionl Product of FSMs 2.6 Rechbility Anlysis on FSMs 2.62 Equivlence Checking Tools 2.7 References E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2. (of 73)

2 Combintionl Circuits Verifiction Consist of n interconnection of logic gtes AND, OR, NOT, NAND, NOR, XOR, XNOR, nd blocks implementing more complex logic (Boolen) functions. No logicl loops, i.e., topologiclly there my be loops, but they re not sensitizble under ny (vlid) input combintion, even such loops my be prohibited / not produced by utomted nlysis / synthesis tools Gol Given two Boolen netlists, check if the corresponding outputs of the two circuits re equl for ll possible inputs Two circuits re equivlent iff the Boolen function representing the outputs of the networks re logiclly equivlent Identify equivlence points nd implictions between the two circuits to simplify equivlence checking Since typicl design proceeds by series of locl chnges, in most cses there re mny implictions / equivlent subcircuits in the two circuits to be compred Vrious tutology/stisfibility checking lgorithms bsed on heuristics (problem is NPcomplete, but mny work well on rel pplictions...) In this course we consider three min combintionl equivlence checking methods: - Propositionl resolution method (tutology/stisfibility checking) - Stålmrck s method (recent ptented lgorithm, very efficient nd populr) - ROBDD-bsed method (Boolen function converted into ROBDD s representtion) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.2 (of 73)

3 Combintionl Equivlence Checking Explicit Proof f = flg: T/F Tutology Check f2 (f = f2) = T Propositionl resolution Stålmrck s procedure ROBDDs 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.3 (of 73)

4 Implicit Proof Combintionl Equivlence Checking (con t) b d f (,b,c) b c c out x y q f2 (x,y,z) out 2 y x z check! z p ROBDDs 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.4 (of 73)

5 Propositionl Logic (Clculus) Syntx P, Q, R,... propositionl symbols (tomic propositions) t: true; f: flse constnts P: not P P Q: P nd Q P Q: P or Q; P Q: if P then Q (proposition equivlent to P Q) P Q: P if nd only if Q, i.e., P equivlent to Q (proposition equivlent to (P Q) ( P Q) ) Semntics Given through the Truth Tble: P Q P P Q P Q P Q P Q t t f t t t t t f f f t f f f t t f t t f f f t f f t t An interprettion is function from the propositionl symbols to {t, f} 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.5 (of 73)

6 Propositionl Logic (cont d) Formul F is stisfible (consistent) iff it is true under t lest one interprettion Formul F is unstisfible (inconsistent) iff it is flse under ll interprettions Formul F is vlid iff it is true (consistent) under ll interprettions Interprettion I stisfies formul F (I is model of F) iff F is true under I. Nottion: I F Theorem: A formul F is vlid ( tutology) iff F is unstisfible. Nottion: The reltionship between F to F cn be visulized by mirror principle : F Vlid formuls All formuls in propositionl logic Stisfible, but non-vlid formuls Unstisfible formuls F F G G To determine if F is stisfible or vlid, test finite number (2 n ) of interprettions of the n tomic propositions occurring in F... but it is n exponentil method... stisfibility is n NP-complete problem 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.6 (of 73)

7 Propositionl Logic (cont d) Proofs A proof of proposition is derived using xioms, theorems, nd inference rules (n inference rule permits deducing conclusions bsed on the truth of certin premises) A logic formul F is deducible from the set S of sttements if there is finite proof of F strting from elements of S. Nottion: S F Exmple: A simple proof system Axioms: K: A (B A) S: (A (B C)) ((A B) (A C)) DN: A A Inference rule (Modus Ponens): {A B, A} A proof of A A () (A ((D A) A)) ((A (D A)) (A A)) by S ([B\D A], [C\A]) (2) A ((D A) A) by K ([B\D A]) (3) (A (D A)) (A A) by MP, (), (2) (4) A (D A) by K (5) A A by MP, (3), (4). B 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.7 (of 73)

8 Reltion between syntx nd semntics Propositionl Logic (cont d) Truth tbles provide mens of deciding truth Propositionl logic is: - complete: everything tht is true my be proven, i.e., if S A then S A - consistent (sound): nothing tht is flse my be proven. i.e., if S A then S A - decidble: there is n lgorithm for deciding the truth of ny proposition, i.e., test finite (exponentil) number of truth ssignments 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.8 (of 73)

9 Flse Negtive & Flse Positive Let P be proposition ( property) nd A verifiction method (lgorithm). Flse Negtive: (similr to incompleteness) A(P) reports true interprettion ψ, ψ(p) = true A(P) reports flse ( interprettion ψ, ψ(p) = true)! ( ψ, ψ(p) = flse) Flse Positive: (similr to inconsistency, unsoundness) A(P) reports flse interprettion ψ, ψ(p) = flse A(P) reports true ( interprettion ψ, ψ(p) = flse)! ( ψ, ψ(p) = true) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.9 (of 73)

10 Combintionl Equivlence Checking Determine if two expressions E nd E2 denote the sme truth tble Appliction: Determine if two combintionl logic circuit designs C nd C2 implement the sme truth tble (logic (Boolen) function) - Extrct representtion of logic expressions E nd E2 - Verify if (E E2) is vlid formul, i.e., (E E2) is unstisfible using stisfibility lgorithms (Propositionl Resolution methods), or (E E2) nd (E2 E) hold (where E nd E2 re trnsformed to impliction form using Stålmrck s procedure), or E nd E2 hve the sme cnonicl form using, e.g., Reduced Binry Decision Digrms 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2. (of 73)

11 Propositionl Resolution A Literl L is n tomic proposition A or its negtion A A Cluse C is finite set of disjunctive literls (C = L L 2 L 3...) C is true iff one of its elements is true. The empty cluse is lwys flse. Let A, A 2,... be tomic propositions nd L i, j literls Conjunctive Norml Form (CNF): conjunction of disjunctions of literls n F=( ( L i, j )), where L i, j {A,A 2,...} { A, A 2,...} i= j= Disjunctive Norml Form (DNF): disjunction of conjunctions of literls n m i m i F=( ( L i, j )), where L i, j {A,A 2,...} { A, A 2,...} i= j= Ech L i, j {A,A2,...} { A, A2,...} ppers in ech disjunct (conjunct) t most once! Theorem: For every logic formul F, there is n equivlent CNF nd n equivlent DNF Cnonicl Conjunctive Form (CCF): CNF in which ech L ppers exctly once Cnonicl Disjunctive Form (DCF): DNF in which ech L ppers exctly once 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2. (of 73)

12 Propositionl Resolution (cont d) Resolution is proof method underlying some utomtic theorem provers bsed on simple syntctic trnsformtion nd refuttion. Refuttion is procedure to show tht given formul is unstisfible Resolution procedure: - To prove F, we trnslte F into set of cluses, ech disjunction of tomic formule or their negtions. - Ech resolution step tkes two cluses nd yields new one. - The method succeeds if it produces the empty cluse ( contrdiction), thus refuting F. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.2 (of 73)

13 Propositionl Resolution (cont d) Let F=(L,... L,n )... (L k,... L k,nk ) where literls L i, j {A,A 2,...} { A, A 2,...} F cn be viewed s set of cluses: F={{L,,..., L,n },..., {L k,,..., L k,nk }}, where - Comm seprting two literls within cluse corresponds to - Comm seprting two cluses corresponds to Let L be literl in cluse C (L C ) nd its complement L in cluse C 2 (L C 2 ), Cluse R is resolvent of C nd C 2 if: R = (C {L}) (C 2 {L}) Exmple: F = {{p, r}, {q, r}, { q}, { p, v}, { s}, {s, v}}. {p, r} {q, r} { p, v} {s, v} {p, q} { q} { p, s} { s} {p} { p} { } 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.3 (of 73)

14 Propositionl Resolution (cont d) A (resolution) deduction of C from F is finite sequence C, C 2,..., C n of cluses such tht ech C i is either in F or resolvent of C j, C k, (j, k < i) Res(F) = F R where R is resolvent of two cluses in F Lemm. F nd F R re equivlent Define Let Res * (F) = Res (F) = F, Res n+ (F) = Res( Res n (F) ), n n Res n (F) Theorem. F is unstisfible iff Res * (F) Algorithm: to decide stisfibility of formul F in CNF (cluse set): repet G:=F; F:=Res(F) until (( F) or (F = G); if F then F is unstisfible else F is stisfible. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.4 (of 73)

15 Summry of bsic ide: Propositionl Resolution (cont d) Gol: G in DNF is vlid? G is unstisfible F = G in CNF: F = (L,.. L,n )... (L k,... L k,nk ) F = {{L,,..., L,n },..., {L k,,..., L k,nk }} Resolution Refuttion procedure F = { } (contrdiction) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.5 (of 73)

16 Two circuits C nd C2 Propositinl Resolution - Exmple b b out out2 C C2 =? Propositionl Resolution C: out = b C2: out2 = ( b) ( ) (Mux: out2 = ( s b) (s ) ) G = (out out2) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.6 (of 73)

17 G = (out out 2) ( out out 2) (DNF) = true? F = G = ((out out 2) ( out out 2)) = Flse? (unstifible!) CNF F = ( out out 2) (out out 2) = ( ( b) [( b) ( )]) (( b) [( b) ( )]) =... = ( ) ( b) ( b) Literls: {{ }, { b}, {, b}} { b} {, b} {} { } { } derive empty cluse { } 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.7 (of 73)

18 Theorem Proving b out b out2 s out = ( s b) (s ) out2 = b = ( b) ( ) = ( b) = ( ) (b ) = (b ) = b = b out2 = out 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.8 (of 73)

19 Stålmrck s Procedure Trnsform propositionl formul G (in liner time) in nested impliction form, e.g.: G = (p (q r)) s G is now represented using set of triplets {b i, x, y}, mening b i (x y), e.g.: (p (q r)) s becomes {(b, q, r), (b 2, p, b ), (b 3, b 2, s)}; G = b 3 To prove formul vlid, ssume tht it is flse nd try to find contrdiction (use for flse nd for true, s in switching (Boolen) lgebr) Derivtion rules: (/b mens replce by b ) r (, y, z) y/, z/ mening flse (y z) implies y = true nd z = flse r2 (x, y, ) x/ mening x (y true) implies x = true r3 (x,, z) x/ mening x (flse z) implies x = true r4 (x,, z) x/z mening x (true z) implies x = z r5 (x, y, ) x/ y mening x (y ) implies x = y r6 (x, x, z) x/, z/ mening x (x z) implies x = true nd z = true r7 (x, y, y) x/ mening x (y y) implies x = true Exmple: G = (p (q p)) : {(b, q, p), (b 2, p, b )}, ssume G = b 2 =, i.e., (, p, b ) By r : p = nd b =, substitute for b nd get (, q, ) (which is terminl triplet) Agin by r this is contrdiction since / is derived for z in r, hence b 2 = G = (true) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.9 (of 73)

20 Stålmrck s Procedure (cont d) Not ll formuls cn be proved with these rules, need form of brnching: Dilemm rule T = set of triplets, D i, i =, 2, re derivtions, results U[S ] nd V[S 2 ], conclusion T[S] T T[x/] T[x/] D D 2 U[S ] V[S 2 ] T[S] Assume x = derive result, then ssume x = nd lso derive result. - If either derivtion gives contrdiction, the result is the other derivtion - If both re contrdictions, then T contins contrdiction - Otherwise return the intersection of the result of the two derivtions, since ny informtion gined from x = nd x = must be independent of tht vlue Exmple: T = { (, p, p), (, p, p) } cnnot be resolved using r - r7 T[p/] = {(,, ), (,, )} where (,, ) is contrdiction T[p/] = {(,, ), (,, )} where (,, ) is gin contrdiction Hence T[S] results in contrdiction. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.2 (of 73)

21 Stålmrck s Procedure (cont d) Trnsformtion from nd-or-not logic to impliction form: not: G =, G = x or: G = A B A B {( x, y, B), (y, A, ) }, G = x nd: G = A A {(x, A, ) } A B ( A B) {( x, y, ), (y, A, z), (z, B, ) }, G = x Exmple of equivlence checking: b x y.. b c r s t C = {(y, e, x), (e, b, ), (x, f, ), (f,, g), (g, b, )} Check y t nd t y C2 = {(t, h, s), (h, b, ), (s, u, ), (u, r, v), (v, c, ), (r, w, ), (w,, p), (p, b, )} y t: Form C C2 {(, y, t)} which by r yields [y/, t/] nd fter substitution {(, e, x), (e, b, ), (x, f, ), (f,, g), (g, b, ), (, h, s), (h, b, ), (s, u, ), (u, r, v), (v, c, ), (r, w, ), (w,, p), (p, b, )} giving by r gin [h/, s/] nd E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.2 (of 73)

22 Exmple of equivlence checking (cont d): Stålmrck s Procedure (cont d) {(, e, x), (e, b, ), (x, f, ), (f,, g), (g, b, ), (, b, ), (, u, ), (u, r, v), (v, c, ), (r, w, ), (w,, p), (p, b, )} pply r nd r5 nd get [u/, e/ b, x/ f, g/ b, v/ c, r/ w, p/ b] which yields {(, b, f), (f,, b), (, b, ), (, w, c), (w,, b)} Appliction of Dilemm rule to, sy, b yields: b = : {(,, f), (f,, ), (,, ), (, w, c), (w,, )} yields [f/, w/] by r2, thus {(,, ), (,, ), (,, c), (,, )} i.e., (,, ) is contrdiction b = : {(,, f), (f,, ), (,, ), (, w, c), (w,, )} contrdiction gin Conclusion: y t holds. Similrly for t y The two circuits re equivlent. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.22 (of 73)

23 Binry Decision Digrms (BDDs) Clssicl representtion of logic functions: Truth Tble, Krnugh Mps, Sum-of-Products, criticl complexes, etc. Criticl drwbcks: - My not be cnonicl form or is too lrge (exponentil) for useful functions, Equivlence nd tutology checking is hrd - Opertions like complementtion my yield representtion of exponentil size Reduced Ordered Binry Decision Digrms (ROBDDs) A cnonicl form for Boolen functions Often substntilly more compct thn trditionl norml forms Cn be efficiently mnipulted Introduced minly by R. E. Brynt (986). Vrious extensions exist tht cn be dpted to the sitution t hnd (e.g., the type of circuit to be verified) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.23 (of 73)

24 Binry Decision Trees A Binry decision Tree (BDT) is rooted, directed grph with terminl nd nonterminl vertices Ech nonterminl vertex v is lbeled by vrible vr(v) nd hs two successors: - low(v) corresponds to the cse where the vrible v is ssigned - high(v) corresponds to the cse where the vrible v is ssigned Ech terminl vertex v is lbeled by vlue(v) {, } Exmple: BDT for two-bit comprtor, f(, 2,b,b 2 ) = ( b ) ( 2 b 2 ) b 2 b Unordered vribles b 2 b b b b b 2 b E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.24 (of 73)

25 Binry Decision Trees (cont d) We cn decide if truth ssignment x = (x,..., x n ) stisfies formul in BDT in liner time in the number of vribles by trversing the tree from the root to terminl vertex: - If vr(v) x is, the next vertex on the pth is low(v) - If vr(v) x is, the next vertex on the pth is high(v) - If v is terminl vertex then f(x) = f v (x,..., x n ) = vlue(v) - If v is nonterminl vertex with vr(v)=x i, then the structure of the tree is obtined by Shnon s expnsion f v (x,..., x n ) = [ x i f low(v) (x,..., x n )] [x i f high(v) (x,..., x n )] For the comprtor, (, 2, b, b 2 ) leds to terminl vertex lbeled by, i.e., f(,,, ) = Binry decision trees re redundnt: - In the comprtor, there re 6 subtrees with roots lbeled by b 2, but not ll re distinct Merge isomorphic subtrees: - Results in directed cyclic grph (DAG), binry decision digrm (BDD) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.25 (of 73)

26 Cnonicl Form property Reduced Ordered BDD A cnonicl representtion for Boolen functions is desirble: two Boolen functions re logiclly equivlent iff they hve isomorphic representtions This simplifies checking equivlence of two formuls nd deciding if formul is stisfible Two BDDs re isomorphic if there exists bijection h between the grphs such tht - Terminls re mpped to terminls nd nonterminls re mpped to nonterminls - For every terminl vertex v, vlue(v) = vlue(h(v)), nd - For every nonterminl vertex v: vr(v) = vr(h(v)), h(low(v)) = low(h(v)), nd h(high(v)) = high(h(v)) Brynt (986) showed tht BDDs re cnonicl representtion for Boolen functions under two restrictions: () the vribles pper in the sme order long ech pth from the root to terminl (2) there re no isomorphic subtrees or redundnt vertices Reduced Ordered Binry Decision Digrms (ROBDDs) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.26 (of 73)

27 Cnonicl Form Property Requirement (): Impose totl order < on the vribles in the formul: if vertex u hs nonterminl successor v, then vr(u) < vr(v) Requirement (2): repetedly pply three trnsformtion rules (or implicitly in opertions such s disjunction or conjunction). Remove duplicte terminls: eliminte ll but one terminl vertex with given lbel nd redirect ll rcs to the eliminted vertices to the remining one b b b b 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.27 (of 73)

28 Cnonicl Form Property (cont d) 2. Remove duplicte nonterminls: if nonterminls u nd v hve vr(u) = vr(v), low(u) = low(v) nd high(u) = high(v), eliminte one of the two vertices nd redirect ll incoming rcs to the other vertex shre 3. Remove redundnt tests: if nonterminl vertex v hs low(v) = high(v), eliminte v nd redirect ll incoming rcs to low(v) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.28 (of 73)

29 Creting the ROBDD for ( x y z) () x y y z z z z (b) x x becomes x x x becomes x (c) x y y z z 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.29 (of 73)

30 Cnonicl Form Property (cont d) A cnonicl form is obtined by pplying the trnsformtion rules until no further ppliction is possible Brynt showed how this cn be done by procedure clled Reduce in liner time Applictions: - checking equivlence: verify isomorphism between ROBDDs - non-stisfibility: verify if ROBDD hs only one terminl node, lbeled by - tutology: verify if ROBDD hs only one terminl node, lbeled by Exmple: ROBDD of 2-bit Comprtor with vrible order < b < 2 < b 2 : b b 2 b 2 b E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.3 (of 73)

31 ROBDD Exmples OR b out = f (,b) = b b out b b b b BDD ROBDD 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.3 (of 73)

32 ROBDD Exmples (con t) AND b out = f (,b) = b b b b BDD ROBDD 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.32 (of 73)

33 ROBDD Exmples (con t) XOR b + out = f(,b) = b b b b b BDD ROBDD 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.33 (of 73)

34 ROBDD Exmples (con t) NAND b out = f(,b) = ( b) b b b b BDD ROBDD b out b red T.T. b out E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.34 (of 73)

35 Vrible Ordering Problem The size of n ROBDD depends criticlly on the vrible order For order < 2 < b < b 2, the comprtor ROBDD becomes: 2 2 b b b b b 2 b 2 For n n-bit comprtor: < b <... < n < b n gives 3n+2 vertices (liner complexity) <... < n < b... < b n, gives 3x2 n vertices (exponentil complexity!) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.35 (of 73)

36 Vrible Ordering Problem - Exmple ( x y) ( x2 y2) ( x3 y3) x x2 x2 x3 x3 x3 x3 y y y y y y y y y x2 y2 x y2 y y2 y2 y2 y2 x3 y3 y3 y3 y3 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.36 (of 73)

37 Vrible Ordering Problem (cont d) The problem of finding the optiml vrible order is NP-complete Some Boolen functions hve exponentil size ROBDDs for ny order (e.g., multiplier) Heuristics for Vrible Ordering Heuristics developed for finding good vrible order (if it exists) Intuition for these heuristics comes from the observtion tht ROBDDs tend to be smller when relted vribles re close together in the order (e.g., ripple-crry dder) Vribles ppering in subcircuit re relted: they determine the subcircuit s output should usully be close together in the order Dynmic Vrible Ordering Useful if no obvious sttic ordering heuristic pplies During verifiction opertions (e.g., rechbility nlysis) functions chnge, hence initil order is not good lter on Good ROBDD pckges periodiclly internlly reorder vribles to reduce ROBDD size Bsic pproch bsed on neighboring vrible exchnge... < < b <......< b < <... Among number of trils the best is tken, nd the exchnge is repeted 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.37 (of 73)

38 Residul function (cofctor): b {, } Logic Opertions on ROBDDs f x i b (x,...,x n ) = f(x,...,x i-, b, x i+,..., x n ) ROBDD of f x i b computed by depth-first trversl of the ROBDD of f: For ny vertex v which hs pointer to vertex w such tht vr(w) = x i, replce the pointer by low(w) if b is nd by high(w) if b is. If not in cnonicl form, pply Reduce to obtin ROBDD of f x i b. All 6 two-rgument logic opertions on Boolen function implemented efficiently on ROBDDs in liner time in the size of the rgument ROBDDs. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.38 (of 73)

39 Logic Opertions on ROBDDs (cont d) Bsed on Shnnon s expnsion f = [ x f x ] [x f x ] Brynt (986) gve uniform lgorithm, Apply, for computing ll 6 opertions: f * f : n rbitrry logic opertion on Boolen functions f nd f v nd v : the roots of the ROBDDs for f nd f, x = vr(v) nd x = vr(v ) Consider severl cses depending on v nd v () v nd v re both terminl vertices: f * f = vlue(v) * vlue(v ) (2) x = x : use Shnnon s expnsion f * f = [ x (f x * f x )] [x (f x * f x )] to brek the problem into two subproblems, ech is solved recursively The root is v with vr(v) = x Low(v) is (f x * f x ) High(v) is (f x * f x ) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.39 (of 73)

40 Logic Opertions on ROBDDs (cont d) (3) x < x : f x = f x = f since f does not depend on x In this cse the Shnnon s expnsion simplifies to f * f = [ x (f x * f )] [x (f x * f )], similr to (2) nd compute subproblems recursively, (4) x < x: similr to the cse bove Improvement using the if-then-else (ITE) opertor: ITE(F, G, H) = F. G + F. H where F, G nd H re functions Recursive lgorithm bsed on the following, v is the top vrible (lowest index): ITE(F, G, H) = v.(f.g + F.H) v + v.(f.g + F.H) v = v.(f v.g v + F v.h v ) + v.(f v.g v + F v.h v ) = (v, ITE(F v, G v, H v ), ITE(F v, G v, H v )) With terminl cses being: F = ITE(, F, G) = ITE(, G, F) = ITE(F,, ) = ITE(G, F, F) we define NOT(F) = ITE(F,, ) AND(F, G) = ITE(F, G, ) OR(F, G) = ITE(F,, G) XOR(F, G) = ITE(F, G, G) LEQ(F, G) = ITE(F, G, ) etc. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.4 (of 73)

41 Logic Opertions on ROBDDs (cont d) By using dynmic progrmming, it is possible to mke the ITE lgorithm polynomil: () The result must be reduced to ensure tht it is in cnonicl form; - record constructed nodes (unique tble); - before creting new node, check if it lredy exists in this unique hsh tble (2) Record ll previously computed functions in hsh tble (computed tble); - must be implemented efficiently s it my grow very quickly in size; - before computing ny function, check tble for solution lredy obtined Complement edges cn reduce the size of n ROBDD by fctor of 2 - Only one terminl node is lbeled - Edges hve n ttribute (dot) to indicte if they re inverting or not - To mintin cnonicity, dot cn pper only on low(v) edges - Complementtion chieved in O() time by plcing dot on the function edge - F nd F cn shre entry in computed tble - Adpttion of ITE esy Test for F G cn be computed by specilized ITE_CONSTANT lgorithm Comprtor: b b 2 b 2 F 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.4 (of 73)

42 BDD Opertors - Exmple b x y out = f (,b) Tsk: compute ROBDD for f (,b) ) f = x y = ( b) ( b) order,b. b out b out - - b 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.42 (of 73)

43 BDD Opertors - Exmples (con t) 2) f = x y BDD f = BDD x BDD y = Conj (BDD x, BDD y ) BDD x b BDD y b x = x = x = : b = b = : b = b = : = b = : = b 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.43 (of 73)

44 Other Decision Digrms Multiterminl BDD (MTBDD): Pseudo-Boolen functions B n N, terminl nodes re integers Binry Moment Digrms (BMD): for representing nd verifying rithmetic opertions, word-level representtion Ordered Kronecker Functionl BDDs (OKFBDD): Bsed on XOR opertions nd OBDD Free BDDs (FBDD): Different vrible order long different pths in the grph Zero suppressed BDDs (ZBDD) Combintion of vrious forms of DDs integrted in DD softwre pckges: Drechsler et l (U. Freiburg, Germny), Clrke et l (Crnegie Mellon U., USA) Extension to represent systems of liner nd Boolen constrints (DTU) Multiwy Decision Digrms (MDG): Representtion for subset of equtionl firstorder logic for modeling stte mchines with bstrct nd concrete dt (U. of Montrel) Well known ROBDD pckges: CMU (s used in SMV from Crnegie Mellon U.) CUDD, U. of Colordo t Boulder (s used in VIS from UC t Berkeley) Industril pckges: Intel, Lucent, Cdence, Synopsys, Bull Systems, etc. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.44 (of 73)

45 ROBDD: Applictions of ROBDDs Construction DD from circuit description: - Depth-first vs. bredth-first construction (keep only few levels in memory, rest on disk; problem with dynmic reordering) - Prtitioning of Boolen spce, ech prtition represented by seprte grph - Bottom-up vs. top-down, introducing decomposition points Internl correspondences in the two circuits equivlent functions, or complex reltions ATPG-bsed: Combine circuits with n XOR gte on the outputs, show inexistence of test for fult s- - on the output (i.e., the output would hve to be driven to mening tht there is difference in the two circuits) Use ATPG nd lerning to determine equivlent circuit nodes Fst rndom simultion: Detect quickly esy differences Rel tools: Use combintion of techniques, fst nd less powerful first, slow but exct lter 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.45 (of 73)

46 Combintionl Equivlence Chequing - Exmple Two circuits C nd C2 b out b out 2 C C2 =? C: b C2: if then else b MUX: if c then else b b isomorph b c b 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.46 (of 73)

47 Combintionl Equivlence Checking - Multiplexer Exmple Specifiction: if c = then out = else out = b Build ROBBD for Spec: c b out ROBDD: order: c,, b b c Implementtion: c b out = (c ) ( c b) out c b out 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.47 (of 73)

48 Combintionl Equivlence Checking - Mux Exmple (con t) Build ROBDD for Imp: c b x y out ROBDD2 order: c,, b x: c c disjunction (or) c b y: c b c b isomorph to ROBDD! 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.48 (of 73)

49 Alterntive wy to build ROBDD2: Mux Exmple (con t) c b out out = ( c ) ( c b) order: c,, b BBD c b b b b ROBBD b c isomorph to ROBDD! 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.49 (of 73)

50 â bˆ 2 Spec: 2 fâbˆ (, ) = if â= bˆ Comprtor Exmple fâbˆ (, ) 2 b b 2 b 2 b Refinement: f (, 2, b, b 2 ) = if ( = b ) ( 2 = b 2 ) bˆ â= 2 = b b 2 Implicit: b 2 b 2 = = f (...) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.5 (of 73)

51 Comprtor Exmple (cont d) x y = z : z= ( x y) ( x y) x y z b 2 b2 f ( ) f = T T2 [( b) ( b) ] [( 2 b2) ( 2 b2) ] T4 T3 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.5 (of 73)

52 Comprtor Exmple (cont d) T: b T2: b disj: T, T2, T2 b b x = x x = T3: 2 b2 T4: b2 2 disj: T3, T4, T34 2 b2 b2 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.52 (of 73)

53 Comprtor Exmple (cont d) conj. T 2, T 34,, 2 b, b 2 order:, b, 2, b 2 ) independent b 2 b 2 b 2 b Isomorph to the spec 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.53 (of 73)

54 Equivlence Checking in Prctice Usully, combintionl circuits implement rithmetic nd logic opertions, nd next-stte nd output functions of finite-stte mchines (sequentil circuits) Verifying the behvior of the gte-level implementtion ginst the RTL design of digitl systems cn often be reduced to verifying the combintionl circuits - Equivlence comprison between the next-stte nd output functions (combintionl circuits) - Requires tht both hve the sme stte spce (nd of course inputs nd outputs), knowing the mpping between sttes helps... - Cn lso be used to verify gte-level implementtion ginst gte-level model extrcted from lyout - This kind of verifiction is useful for confirming the correctness of mnul chnges or synthesis tools If the stte spce is not the sme, sequentil (behviorl equivlence) of FSM must be considered E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.54 (of 73)

55 Sequentil Circuits nd Finite Stte Mchines x y Comb. Logic f(x, y) Comb. Logic g(x, y) r r s y Clock z r = (r,..., r s ) vector of memory bits stte vribles, memorize encoded sttes y = (y,..., y s ) vector of present stte vlues y = (y,..., y s ) vector of next stte vlues x = (x,..., x m ) vector of input bits encode input symbols z = (z,..., z n ) vector of output bits encode output symbols f = output function, f(x, y) = Mely, f(y) = Moore g = next-stte function Here we consider FSM synchronized on clock trnsitions synchronous sequentil circuits To verify the behvior of such circuits we need efficient representtion for the mnipultion of next-stte nd output functions nd sets of sttes Using chrcteristic functions of reltions nd sets 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.55 (of 73)

56 Representtion of Reltions nd Sets Reltionl Representtion of FSM If R is n-ry reltion over {,} then R cn be represented by (the ROBDD of) its chrcteristic function: f R (v,...,v n ) = iff (v,...,v n ) R - Sme technique cn be used to represent sets of sttes Trnsition reltion N of sequentil circuit is represented by its Boolen chrcteristic function over inputs nd stte vribles: N(x, y,..., y s,y,..., y s ) Exmple: synchronous modulo 8 counter, N(y, y ) = N (y, y ) N (y, y ) N 2 (y, y 2 ) y 2 y y Register (3 bits) y 2 y y Next stte y : y = y y = y y y 2 = (y y ) y 2 Trnsition reltion N(y,y ): N (y,y ) = (y y ) N (y,y ) = (y y y ) N 2 (y,y ) = (y 2 (y y ) y 2 ) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.56 (of 73)

57 Reltionl Representtion of FSM (cont d) Quntified Boolen Formuls (QBF) Needed to construct complex reltions nd mnipulte FSMs V={v,v 2,..., v n } = set of Boolen (propositionl) vribles QBF(V) is the smllest set of formuls such tht - every vrible in V is formul - if f nd g re formuls, then f, f g, f g re formuls - if f is formul nd v V, then v.f nd v.f re formuls A truth ssignment for QBF(V) is function σ: V {,} If {,}, then σ[v ] represents σ[v ](w) = if v = w σ[v ](w) = σ(w) if v w f is formul in QBF(V) nd σ is truth ssignment: σ f if f is true under σ. 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.57 (of 73)

58 Reltionl Representtion of FSM (cont d) Quntified Boolen Formuls (cont d) QBF formuls hve the sme expressive power s ordinry propositionl formuls; however, they my be more concise QBF Semntics: reltion is defined recursively: σ v iff σ(v)=; σ f iff σ f; σ f g iff σ f or σ g; σ f g iff σ f nd σ g; σ v.f iff σ[v ] f or σ[v ] f; σ v.f iff σ[v ] f nd σ[v ] f. Every QBF formul cn represent n n-ry Boolen reltion consisting of those truth ssignments for the vribles in V tht mkes the formul true: Boolen chrcteristic function of the reltion x. f = f x f x, x. f = f x f x In prctice, specil lgorithms needed to hndle quntifiers efficiently (e.g., on ROBDD) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.58 (of 73)

59 Sequentil Equivlence Checking Bsic Ide: To prove the equivlence of two FSMs M nd M 2 (with the sme input nd output lphbet), product mchine is formed which tests the equlity of outputs of the two individul mchines in every stte x M M 2 z z Product Mchine Flg M nd M 2 re equivlent iff the product mchine produces Flg = true output in every stte rechble from the initil stte Coudert et l. were first to recognize the dvntge of representing set of sttes with ROBDD s: Symbolic Bredth-First Serch of the trnsition grph of the product mchine Their technique ws initilly pplied to checking mchine equivlence nd lter extended by McMilln, et l. to symbolic model checking of temporl logic formuls (in CTL) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.59 (of 73)

60 Reltionl Product of FSMs Reltionl Products implementtion using ROBDD A typicl tsk in verifiction: compute reltionl products with bstrction of vribles: v.[f(v) g(v)] Algorithm RelProd computes it in one pss over ROBDDs f(v) nd g(v), insted of constructing f(v) g(v) RelProd uses computed tble (result cche), nd is bsed on Shnnon s expnsion Entries in the cche hve the form (f, g, E, h), where E is set of vribles tht re existentilly qulified out nd f, g nd h re (pointers to) ROBDDs If n entry indexed by f, g nd E is in the cche, then previous cll to RelProd (f, g, E) hs returned h, it is not recomputed Algorithm works well in prctice, even if it hs theoreticl exponentil complexity 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.6 (of 73)

61 Reltionl Representtion of FSMs (cont d) Reltionl Product Algorithm RelProd (f, g: ROBDD, E: set of vribles) if f=flse g=flse then return flse else if f=true g=true then return true else if (f, g, E, h) is cched then return h else let x nd y be the top vribles of f nd g, respectively let z be the topmost of x nd y, h:=relprod(f z=, g z=, E) h:=relprod(f z=, g z=, E) endif insert (f, g, E, h) in cche return h endif if z E then h:=or(h, h) {ROBDD: h h} else h:=ifthenelse(z, h, h) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.6 (of 73)

62 Computing Set of Rechble Sttes Rechbility Anlysis on FSMs Rechble stte computtion (stte enumertion) is needed for FSM equivlence nd model checking S = set of sttes, represented by the ROBDD S (V) Find those sttes S rechble in t most one trnsition from S : ROBDD s S (y) nd N(y, y ), compute n ROBDD representing S : S =S { s s [s S (s, s ) N]} S (y )=S (y ) y i [S (y) N(y,y )] yi y S S S 2 S 2 = S {s s [s S (s, s ) N ]} S 2 (y )=S (y ) y i [S (y) N(y,y )] yi y 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.62 (of 73)

63 Rechbility Anlysis (cont d) Rechbility Anlysis on FSMs (cont d) In generl, the sttes rechble in t most k+ steps re represented by: S k+ (y ) = S (y ) y i [ S k (y) N(y.y )] yi y As ech set of sttes is superset of the previous one, nd the totl number of sttes is finite, t some point, we must hve S k+ = S k, k 2 s the number of sttes Rechbility computtion cn be viewed s finding lest fixpoint Wht bout inputs x? Existentilly quntify them out in the reltionl product (equivlent to closing the system with non-deterministic source of vlues for x ) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.63 (of 73)

64 BDD Encoding M M2 = Flg Product Mchine Bsic ide: ) connect both mchines to equlity check of outputs 2) compute set of rechble sttes 2) representing set of sttes using ROBDD 2b) computing imges of BDDs of ll next sttes (using trnsition reltions) 2c) rechbility itertion (using imges strting from one initil stte until sequence emerges)... R = initil BDD R i + = R i Imge( R i ) convergence; 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.64 (of 73)

65 Sequentil Equivlence Checking Exmple ) Connect both mchines to equlity check of outputs i i i mux mux x Q D clk y x Q D clk y out x2 Q D clk y2 out + flg 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.65 (of 73)

66 Sequentil Equivlence Checking Exmple (con t) 2) Representing set of sttes using ROBDD Initil Stte: x = x = x2 = {,,} set x x x2 formul ROBDD x2 x x 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.66 (of 73)

67 Sequentil Equivlence Checking Exmple (cont d) 2) Representing set of sttes using ROBDDs Set {} {,,,,,} {} Formul x x x2 x x x x x2 ROBDD x x x2 x x x x x2 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.67 (of 73)

68 Sequentil Equivlence Checking Exmple (cont d) 2b) Compute imge of set { } set = { } x x x2 x x x2 imge: ( x x x2) ( x x x2) i = i = ( BDD BDD ) trnsition reltion: ( y= ( x i) ) ( y= ( i x) ( i x2) ) ( y2= ( i x2) ( i x) ) 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.68 (of 73)

69 Sequentil Equivlence Checking Exmple (cont d) 2b) Compute imges of set { } y = x i Tnsition{ y = i x Reltion y2 = ( ) ( i x3) ( i x2) ( i x) i i i = (i = ) = (i = ) (i = ) (i = ) (i = ) (i = ) x: x: x2: i = i = {{,,}, {,,}} ( x x x2) BDD BDD2 ( x x x2) ROBDD disj. BDD BDD2 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.69 (of 73)

70 Exmple (cont d) 2c) Rechbility itertion R = x x x2 R = ( x x x2) ( x x x2) R R 2 = R In terms of sets: R = {} R = {, } R2 = {,} R2 = R converged ll sttes reched! 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.7 (of 73)

71 Commercil tools: Chryslis: Design Verifier Synopsys: Formlity Cdence: Affirm Verysys: Torndo AHL: ChekOff-E Appliction: Equivlence Checking Tools Used to prove equivlence of two sequentil circuits tht hve the sme stte vribles (or t lest the sme stte spce nd known mpping between sttes) by verifying tht they hve the sme next-stte nd output functions Used in plce of gte vs. RTL verifiction by simultion Recommendtions: Use modulr design, reltively smll modules, k - 2k gtes Mintin hierrchy during synthesis (not flttening) nd before lyout: equivlence cn be proven hierrchiclly much fster, especilly for rithmetic circuits 997 E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.7 (of 73)

72 Equivlence Checking Tools (cont d) CheckOff-E Commercil product by Abstrct Hrdwre Ltd. (UK) nd Siemens AG (Germny) Performs behviorl comprison of two Finite Stte Mchines Input EDIF netlist + librry or VHDL VHDL subset (superset of synthesizble synchronous VHDL) - no rel time cluses (fter, wit for), no conditionl loop sttements Interprets VHDL simultion semntics to build Micro FSM Converts to Mcro FSM by merging trnsition until stbiliztion t ech time t Mcro FSM is strting point for ny verifiction; representtion in ROBDD For more informtion: E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.72 (of 73)

73 References. V. Sperschneider, G. Antoniou. Logic: A Foundtion for Computer Science. Addison- Wesley, S. Reeves, M. Clrke. Logic for Computer Science. Addison-Wesley, Aln J. Hu, Forml Hrdwre Verifiction with BDDs: An Introduction, IEEE Pcific Rim Conference on Communictions, Computers, nd Signl Processing, pp , J. Jin, A. Nryn, M. Fujit, nd A. Sngiovnni-Vincentelli, Forml Verifiction of Combintionl Circuits, VLSI Design, R.E. Brynt. Grph-Bsed Algorithms for Boolen Function Mnipultion. IEEE Trnsctions on Computers, C-35(8), pp , August R.E. Brynt. Symbolic Boolen Mnipultion with Ordered Binry Decision Digrms. ACM Computing Surveys, 24(3), 992, pp R.E. Brynt. Binry Decision Digrms nd Beyond: Enbling Technologies for Forml Verifiction. Interntionl Conference on Computer-Aided Design, pp , S. Minto. Binry Decision Digrms nd Applictions for VLSI CAD. Kluwer Acdemic Publishers, M. Sheern, G. Stålmrck. A tutoril on Stålmrck s proof procedure for propositionl logic. Forml Methods in Systems Design, Kluwer, 999..O. Coudert nd J.C. Mdre, A Unified Frmework for the Forml Verifiction of Sequentil Circuits, Int. Conference on Computer-Aided Design, pp , 99..H. Touti, H. Svoj, B. Lin, R.K. Bryton, nd A. Sngiovnni-Vincentelli, Implicit Stte Enumertion of Finite Stte Mchines Using BDD s, Int. Conference on Computer-Aided Design, pp. 3-33, E. Cerny, X. Song, 999 E. Cerny, 22 S. Thr 4/28/ 2.73 (of 73)