BOOLEAN GRÖBNER BASIS REDUCTIONS ON FINITE FIELD DATAPATH CIRCUITS

Transcription

1 BOOLEAN GRÖBNER BASIS REDUCTIONS ON FINITE FIELD DATAPATH CIRCUITS USING THE UNATE CUBE SET ALGEBRA Utkarsh Gupta, Priyank Kalla, Senior Member, IEEE, Vikas Rao Abstrat Reent evelopments in formal verifiation of arithmeti atapaths make effiient use of symboli omputer algebra algorithms. The iruit is moele as an ieal in polynomial rings, an Gröbner basis (GB) reutions are performe over these polynomials to erive a anonial representation. As they moel logi gates of the iruit, the ieals omprise largely of Boolean (or pseuo-boolean) polynomials. This paper onsiers a logi synthesis analogue of GB reutions over Boolean polynomials, by interpreting symboli algebra as the unate ube set algebra over harateristi sets. By representing Boolean polynomials as harateristi sets using Zero-suppresse BDDs (ZDDs), impliit algorithms are effiiently esigne for GB-reution for atapath iruits. We show that the imposition of iruittopology base monomial orers exposes a speial struture on the ZDD representation of the polynomials. The subexpressions employe in the GB-reution are reaily visible as subgraphs on the ZDDs, whih are iretly use to ompose the result. Our ivision algorithms effetively anel multiple monomials impliitly in one-step, simplify the searh for ivisors, an avoi intermeiate size explosion. Experiments performe over various finite fiel arithmeti arhitetures emonstrate the effiieny of our algorithms an implementations; our approah is orers of magnitue faster as ompare to onventional methos. I. INTRODUCTION Automate formal verifiation an equivalene heking of arithmeti atapath iruits is hallenging. Conventional verifiation tehniques, suh as those base on binary eision iagrams (BDDs) [1], An-Invert-Graph (AIG) base reutions with SAT or SMT-solvers [2], et., are infeasible in verifying omplex atapath esigns. Suh esigns often implement algebrai omputations over bit-vetor operans, therefore finite integer rings [3] [4] or finite fiels [5] [6] are onsiere appropriate moels to evise eision proeures for verifiation. For this reason, the verifiation ommunity has explore the use of algebrai geometry an symboli algebra algorithms for verifiation. In suh a setting, the logi gates of the iruit are moele by way of a set of multivariate polynomials F = { f 1,..., f s } in rings R[x 1,...,x n ]. Usually, the oeffiients R = Z,Z 2 k, or F 2 k, epening on whether the integer, finite integer ring (mo 2 k ), or respetively the finite fiel (of 2 k elements) moel is employe for verifiation. This set of polynomials F generates an ieal, an for verifiation it is require to ompute a Gröbner basis (GB) [7] of this ieal. Reuing the primary output polynomials of the iruit moulo this GB results in a unique anonial polynomial expression, an it an be use for equivalene heking. This work has been supporte in part by grants from the US National Siene Founation CCF an CCF The authors are with the Eletrial & Computer Engineering Department at the University of Utah in Salt Lake City, USA. Contat author: Priyank Kalla (kalla@ee.utah.eu). The GB problem exhibits high omputational omplexity. Inee, omputing a GB for large iruits is pratially infeasible. Managing this omplexity ought to be a major goal of any approah. 1) State-of-the-art & Limitations: Reent approahes [3] [5] have isovere that partiularly for iruit verifiation problems, the expensive GB omputation an be avoie altogether. For arbitrary ombinational [3] [5] an sequential iruits [8], a speialize term orer > an be erive by analyzing the topology of the given iruit. This term orer is erive by performing a reverse topologial traversal of the iruit, an in this manusript we refer to it as the Reverse Topologial Term Orer (RTTO). Imposition of RTTO > on the polynomial ring reners the set of polynomials of the iruit itself a GB. Subsequently, the verifiation problems an be solve solely by way of GB-reution (using multi-variate polynomial ivision), without any nee to expliitly ompute a GB. It has now beome stanar pratie to make use of RTTO-style term orers to solve various formal verifiation problems on igital iruits (see for example [3], [5], [4], [9], [10], [11]), where the early tehniques of [3] [5] have been extene an improve to verify integer an floating point arithmeti iruits [9], [11], [12], [13]. A ommon theme among all these relevant works is that by virtue of RTTO, they move the omplexity of verifiation from one of omputing a GB to that of GB-reution by way of multivariate polynomial ivision. Moreover, sine the Gröbner basis is erive from the logi gates of the iruit, it omprises Boolean polynomials. Boolean polynomials (formally efine in Setion III) onsist of terms that have oeffiients from F 2 = {0,1}, an monomials that are a prout of variables where the egree of eah variable is also restrite to the set {0, 1}. The aforementione approahes will benefit greatly by a eiate, omain-speifi implementation of GB-reution w.r.t. Boolean polynomials, arrie out on the given iruit uner RTTO >. So far, the above tehniques [3], [6], [5], [11], [9], [14] use a general-purpose polynomial ivision approah, together with an expliit representation, for this GB-reution. Moreover, the overall onept of polynomial ivision is still utilize in its ruimentary form, involving iterative anellation of monomials 1-step at a time on expliit atastrutures. Despite reent efforts, suh GB-reutions an lea to a worst-ase size explosion problem, whih nees to be aresse. 2) Objetive & Rationale: This paper aresses the problem of eriving anonial representations for atapath iruits as Boolean polynomials. These anonial Boolean polynomials are use for equivalene heking of atapath esigns. The anonial representation requires a Gröbner basis reution moulo a set of Boolean polynomials. To make this GB-

2 2 reution on iruits more effiient, this paper esribes new tehniques, algorithms an implementations, speifially targete for iruit verifiation uner RTTO >. We make use of the impliit harateristi set representation for storing an manipulating Boolean polynomials using Zero-Suppresse BDDs (ZDDs) [15]. By analyzing the struture of ZDDs for polynomial representation uner RTTO >, we show how this GB-reution an be effiiently implemente using algorithms that speifially manipulate the ZDD graph, by interpreting Boolean polynomial manipulation as the algebra of unate ube sets. The algebrai objets use to moel the polynomial ieals erive from igital iruits are rings of Boolean polynomials. When Boolean funtions are represente in F 2 (AND/XOR expressions), an that too as a anonial Gröbner basis, the representation tens to exploe. Polynomial representations employe in omputer algebra tools, suh as the enseistributive ata-struture of the SINGULAR omputer algebra tool [16], are ineffiient for this purpose. Sine aition an multipliation (mo 2) are equivalent to XOR an AND operations, respetively, GB-reution an be viewe as a polynomial analog of a speialize AND/XOR Boolean eomposition problem. Moreover, the monomials of a Boolean polynomial are a prout of literals in positive polarity, whih an be viewe as unate ubes in logi synthesis. Clearly, impliit Boolean set representations suh as eision iagrams oul be employe for Gröbner basis reutions over Boolean polynomials. 3) Tehnial Contributions: We first esribe when an how the GB-reution enounters a term-explosion (exponential blow-up) uner RTTO >, whih annot be easily overome by expliit representations. We show that ZDDs an avoi this exponential blow-up thereby justifying their use. Subsequently, we show that RTTO > imposes a speial struture on ZDDs that allows to implement reution tehniques that impliitly anel multiple monomials in every step of polynomial ivision. Moreover, ue to RTTO >, the subexpressions that are require for polynomial ivision are also reaily available as subgraphs in the ZDDs. Our algorithm exploits this speial struture, thus improving GB-reution in both spae an time. Using an implementation integrate with the CUDD [17] pakage, we perform extensive experiments on atapath iruits for eriving the anonial representation of the funtions implemente by them. The benhmark esigns inlue various ryptography primitives, suh as finite fiel multipliers, ellipti urve point aition iruits, an also sequential finite fiel iruits. Experiments onute on these benhmarks show orers of magnitue improvement using our implementation of GB-reution, as ompare against ontemporary methos. In fat, for these benhmarks, our bit-level (Boolean) approah is muh faster than the wor-level approahes (e.g. [6]). 4) Paper Organization: The following setion reviews relevant previous work on Gröbner basis base verifiation of atapath iruits, an the literature on Boolean Gröbner basis an appliations. Setion III esribes the mathematial bakgroun on Gröbner basis reutions, the RTTO base term orer >, an how these onepts are applie to atapath verifiation. Setion IV motivates how an why the Boolean GBreution an be viewe as the unate ube set algebra. Setion V esribes the theory, algorithms an implementations for GB-reution for Boolean polynomials using ZDDs. Setion VI esribes the experiments onute for verifiation using our approah, an Se VII onlues the paper. II. RELATED PREVIOUS WORK In the past eae, omputer algebra an algebrai geometry base atapath verifiation has reeive a lot of attention. The work of [18] use a GB-reution approah to erive anonial representations of (wor-level) RTL atapath esriptions over finite rings Z 2 k. Using the same finite ring moel, [3] aresse ata orretness properties of arithmeti bit-level implementations using a Gröbner basis formulation. This paper showe how an effiient term orer > an be erive from the iruit to simplify the omputation. In [5], the authors aresse formal verifiation of finite fiel arithmeti iruits using the Strong Nullstellensatz formulation over F 2 k. Using a set (F) of polynomials to esribe the logi iruit, along with a set of vanishing polynomials (F 0 ) over the fiel F 2 k, the verifiation problem was formulate as a (raial) ieal membership test, requiring a Gröbner basis. Drawing inspirations from [3], the authors in [5] also exploite the same onept of eriving a speialize term orer > to simplify the ieal membership test. In partiular, it was shown that > oul be erive by performing a reverse topologial traversal on the iruit. Imposition of this term orer > renere the set of polynomials F F 0 itself a Gröbner basis, an verifiation was then performe simply by a GB-reution. This GB-reution was subsequently formulate as Gaussian elimination on a oeffiient matrix [5], [6] in the style of the F 4 algorithm; alle F 4 -style reution in the sequel. Formulations of a similar flavor (GB-reution uner the speialize term orer > erive from the iruit) were use an integrate with SMT-solvers [4] for verifiation using a pseuo-boolean moel (akin to Z 2 k[x] (mo X 2 X)). More reently, these onepts have been applie to verify integer arithmeti [9], [11], [13], an also floating point iruits [12]. The authors in [14] show that the reution proess an be parallelize by performing reution for eah output bit inepenently. While polynomial ivision algorithms form the ore omputation in the above tehniques, the overall onept of polynomial ivision is still utilize in its ruimentary form, involving iterative anellation of monomials 1-step at a time on expliit ata-strutures. A. Boolean Gröbner Basis The symboli algebra ommunity has stuie properties of Boolean Gröbner bases [19] [20]. Boolean GB formulations have also been use for SAT solving [21], e.g. to erive proof refutation, an for moel heking [22] [23]. From among these, the work of PolyBori [20] omes losest to ours, an is a soure of inspiration for this work. PolyBori propose the use of ZDDs to ompute Gröbner bases for Boolean polynomials. PolyBori is a generi Boolean GB omputational

3 3 engine that aters to many permissible term orers. Its ivision algorithm is also generally base on the onventional onept of aneling one monomial in every step of reution. In ontrast, our algorithms are tailore for GB-reution uner the RTTO >. The effiieny of our approah stems from the observation that the RTTO > imposes a speial struture on the ZDDs, whih allows for multiple monomials to be anele in one ivision-step, along with simplifying the searh for ivisors. Experiments show that our approah is an orer of magnitue faster than PolyBori. III. BACKGROUND: GRÖBNER BASIS REDUCTION AND CANONICAL REPRESENTATIONS Let B = {0,1} enote the Boolean omain, F 2 the finite fiel of 2 elements (B F 2 ), an R = F 2 [x 1,...,x n ] the polynomial ring over variables x 1,...,x n with oeffiients in F 2. Operations in F 2 are performe (mo 2), so 1 = +1 in F 2. We will use +, to enote aition an multipliation in R, an,, an to enote Boolean negation, OR, AND an XOR operations, respetively. A polynomial f R is written as a finite sum of terms f = 1 X X t X t. Here 1,..., t are oeffiients an X 1,...,X t are monomials, i.e. power prouts of the type x e 1 1 xe 2 2 xe n n, e i Z 0. To systematially manipulate the polynomials, a monomial orer > (also alle a term orer) is impose on the ring. This orer > is a total orer an a well orer on all the monomials of R suh that multipliation by a monomial preserves the orer 1. All polynomials in R are represente using >. Subjet to >, when a polynomial is written as f = 1 X X t X t suh that X 1 > X 2 > > X t, we all lt( f ) = 1 X 1, lm( f ) = X 1, l( f ) = 1, the leaing term, leaing monomial an leaing oeffiient of f, respetively, with lt( f ) = l( f ) lm( f ). We also enote tail( f ) = f lt( f ) = 2 X t X t. In this work, we are mostly onerne with terms orere lexiographially (lex). Definition III.1 (Boolean Polynomial). Let f = 1 X t X t be a polynomial in F 2 [x 1,...,x n ] suh that the oeffiients i {0,1}, an monomials X = x e 1 1 xe 2 2 xe n n,e i {0,1}. Then f is alle a Boolean polynomial. For Boolean polynomials lt( f ) = lm( f ). A gate-level iruit an be moele with Boolean polynomials, where every Boolean logi gate operator is mappe from B to a polynomial funtion over F 2 : z = a z + a + 1 (mo 2) z = a b z + a b (mo 2) z = a b z + a + b + a b (mo 2) z = a b z + a + b (mo 2) Polynomial reution via ivision: Let f, g be polynomials. If lm( f ) is ivisible by lm(g), then we say that f is reuible to r moulo g, enote f r, where r = f lt( f ) lt(g) g. g This operation forms the ore operation of polynomial ivision algorithms an it has the effet of aneling the leaing term 1 Lexiographi (lex) an egree-lexiographi (eglex) are examples of suh permissible monomial orers. (1) of f. Similarly, f an be reue w.r.t. a set of polynomials F = { f 1,..., f s } to obtain a remainer r. This reution is F enote as f + r, an the remainer r has the property that no term in r is ivisible (i.e. annot be anele) by the leaing term of any polynomial f i in F. Algorithm 1 (Alg from [7]) epits the proeure to perform this lassial reution that anels one monomial in every iteration of the while-loop. Algorithm 1 Multivariate Reution of f by F = { f 1,..., f s } 1: proeure multi variate reue( f,{ f 1,..., f s }, f i 0) 2: u i 0; r 0; h f 3: while h 0 o 4: if i s.t. lm( f i ) lm(h) then 5: hoose i least s.t. lm( f i ) lm(h) 6: u i = u i + lt(h) lt( f i ) 7: h = h lt(h) lt( f i ) f i 8: else 9: r = r + lt(h) 10: h = h lt(h) 11: return ({u 1,...,u s },r) Polynomial ieals: Given a set of polynomials F = { f 1,..., f s } from the ring R = F 2 [x 1,...,x n ], the ieal generate by F is J = F R: J = f 1,..., f s = {h 1 f h s f s : h 1,...,h s R}, (2) where the polynomials f 1,..., f s are alle the generators (or basis) of the ieal. For a binary variable x i, we have x 2 i = x i. Therefore, the polynomial x 2 i x i vanishes over F 2, an we all it a vanishing polynomial. While manipulating Boolean polynomials it is essential to ensure this inempoteny by reuing the polynomials moulo (the ieal of) all vanishing polynomials x 2 1 x 1,...,x 2 n x n. Therefore, we essentially operate on the quotient ring of F 2 [x 1,...,x n ] moulo the ieal of vanishing polynomials, i.e. over F 2 [x 1,...,x n ]/ x 2 1 x 1,...,x 2 n x n. Then Boolean polynomials are exatly the anonial representatives of resiue lasses in the aforementione quotient ring. A signifiant benefit of using a Boolean ata-struture suh as ZDDs is that the reution x 2 i = x i is performe impliitly by the ata-struture. For this reason, in the sequel we omit expliit mention of reution moulo the vanishing polynomials an it shoul be assume that the reution x 2 i = x i is always performe. Gröbner basis of ieals: An ieal J may have many ifferent sets of generators, i.e. it is possible to have J = f 1,..., f s = h 1,...,h r = = g 1,...,g t. A Gröbner basis G of ieal J is one suh set of polynomials G = GB(J) = {g 1,...,g t } with many important properties that allow to solve many polynomial eision questions. Definition III.2 (Gröbner basis [7]). For a monomial orering >, a set of non-zero polynomials G = {g 1,g 2,...,g t } ontaine in an ieal J, is alle a Gröbner basis of J iff f J, f 0, there exists g i {g 1,...,g t } suh that lm(g i ) ivies lm( f ); i.e., G = GB(J) f J : f 0, g i G : lm(g i ) lm( f ).

4 4 Gröbner basis G of an ieal J = f 1,..., f s is ompute using the Buhberger s algorithm [24], reproue in Alg. 2. Algorithm 2 Buhberger s Algorithm Inputs: F = { f 1,..., f s } Outputs: G = {g 1,...,g t } 1: G := F; 2: repeat 3: G := G 4: for eah pair { f i, f j },i j in G o 5: Spoly( f i, f j ) G + h 6: if h 0 then 7: G := G {h} 8: until G = G In the algorithm, Spoly( f i, f j ) = L lt( f i ) f i L lt( f j ) f j (3) where L = LCM(lt( f i ),lt( f j )). An important property of a Gröbner basis G is that reution of a polynomial f moulo G is essentially unique. Theorem III.1 (Gröbner Basis Reution, Thm in [7]). Let G = {g 1,...,g t } be a Gröbner basis of ieal J, an let f be another polynomial. The reution of f moulo G, enote G f + r, is alle the Gröbner basis reution (GBR) of f. The remainer r so obtaine by GBR of f is a anonial expression moulo G. In other wors, for any polynomial f, if f G + r 1 an f G + r 2, then r 1 = r 2 = r. The remainer r is sometimes also alle the normal form of f w.r.t. G. The anoniity of r (moulo G) an be exploite for equivalene heking of igital iruits. Proposition III.1. Given a iruit C, we an represent all the gates using (Boolean) polynomials F = { f 1,..., f s } in F 2 [x 1,...,x n ] by means of Eqn. (1), an generate ieal J = F. Let z i, i = 0,...,k 1,(z i {x 1,...,x n }) enote one-bit of the k-bit primary output variables of the iruit. Compute a Gröbner basis G = GB(J) = {g 1,...,g t } for the polynomials of the iruit, an perform the GBR z i G + r i for all 0 i < k. Then all r i s are a anonial representation an an be use for formal verifiation/equivalene heking. To erive the anonial representation r i, it is require to ompute a Gröbner basis G of the ieal generate by the polynomials of the iruit. Buhberger s algorithm for omputation of a Gröbner basis exhibits high omplexity. Over finite fiels F q of q elements (q = 2 in our ase), the omplexity is boune by q (O(n)), where n is the number of variables [25]. This omplexity still nees to be overome. The work of [5] showe that for formal verifiation of ombinational iruits, the expensive GB omputation an be avoie altogether, ue to the following results. Lemma III.1 (Prout Criterion [26]). For two polynomials f i, f j in any polynomial ring R, if the equality lm( f i ) lm( f j ) = LCM(lm( f i ),lm( f j )) hols, i.e. if lm( f i ) an lm( f j ) are relatively prime, then Spoly( f i, f j ) G + 0. Using this riterion we an say that when the leaing terms of all polynomials in the basis F = { f 1,..., f s } are relatively prime, then all Spoly( f i, f j ) G + 0. As no new polynomials are generate in Buhberger s algorithm, F is alreay a Gröbner basis (F = GB(J)). For a ombinational iruit C, a speialize term orer > an always be erive by analyzing the iruit topology whih ensures suh a property [3] [5]: Proposition III.2. (From [5]) Let C be an arbitrary ombinational iruit. Let {x 1,...,x n } enote the set of all variables (signals) in C. Starting from the primary outputs, perform a reverse topologial traversal of the iruit an orer the variables suh that x i > x j if x i appears earlier in the reverse topologial orer. Impose a lex term orer > to represent eah gate as a polynomial f i, s.t. f i = x i + tail( f i ). Then the set of all polynomials { f 1,..., f s } forms a Gröbner basis G, as lt( f i ) = x i an lt( f j ) = x j for i j are relatively prime. This term orer > is alle the Reverse Topologial Term Orer (RTTO). Imposition of RTTO on the polynomials of the iruit has the effet of making every gate output variable x i a leaing term of f i. Sine every gate output is unique, lm( f i ) = x i,lm( f j ) = x j beome relatively prime. As a result, the set F is alreay a GB (G = F), the explosive GB omputation is avoie, an verifiation is performe solely by the anonial G GB-reution: z i + r i. Note that as f i = x i + tail( f i ), RTTO ensures that every variable x j that appears in tail( f i ) satisfies x i > x j. Moreover, the remainer r i omprises only primary inputs of the iruit. These properties will be exploite in our algorithms. a 0 a 1 b 0 b r 0 Fig. 1: A 2-bit moulo Multiplier iruit. f 1 : 0 + a 0 b 0, lm = 0 ; f 2 : 1 + a 0 b 1, lm = 1 f 3 : 2 + a 1 b 0, lm = 2 ; f 4 : 3 + a 1 b 1, lm = 3 f 5 : r , lm = r 0 ; f 6 : z , lm = z 0 f 7 : z 1 + r 0 + 3, lm = z 1 Fig. 2: Polynomials of the iruit uner RTTO onstitute a GB. Example III.1. Demonstration of the approah: Consier the iruit given in Fig. 1. Impose RTTO on the iruit. The primary outputs z 0,z 1 are both at level-0, variables r 0, 0, 3 are at level-1, 1, 2 are at level-2, an the primary inputs z 0 z 1

5 5 a 0,a 1,b 0,b 1 are at level-3. Orer the variables {z 0 > z 1 } > {r 0 > 0 > 3 } > { 1 > 2 } > {a 0 > a 1 > b 0 > b 1 }. Using this variable orer, we impose a lex term orer on the monomials. Then all the polynomials extrate from the iruit have relatively prime leaing terms, as shown in Fig. 2, an G = F = { f 1,..., f 7 } forms a GB. Then the GBRs z 1 G + a 0 b 0 +a 1 b 1 an z 0 G + a 0 b 1 +a 1 b 0 + a 1 b 1 are anonial expressions (Boolean polynomials) of the output bits an an be use for equivalene heking. IV. UNATE CUBE SETS & BOOLEAN POLYNOMIALS A Boolean variable represents a imension of the Boolean spae B n, an a literal is an instane of a variable x i or its omplement x i. A ube is a prout of literals whih enotes a point or a set of points in the Boolean spae. A ube set onsists of a olletion of ubes, eah of whih is a ombination of literals. Unate ube sets allow for the use of only positive literals, not negative/omplemente literals. When ube sets are use to represent Boolean funtions, they are usually binate ube sets ontaining negative literals. In binate ube sets, literals x i an x i represent x i = 1 an x i = 0, respetively; while the absene of a literal implies a on t are. In unate ube sets, literal x i implies x i = 1 whereas its absene implies x i = 0. For example, the ube set {a,b} orrespons to points (ab) : {111,110,101,100,011} in the binate ube set representation, whereas it represents (ab) : {100, 011} in the unate ube set representation. Eah monomial of a Boolean polynomial an be viewe as a unate ube a prout of positive literals an a Boolean G polynomial as a unate ube set. Then the GBR z i + r i an be interprete as operations over unate ube sets, as shown below. Let us (re)onsier the one-step ivision for Boolean g polynomials: f r. This ivision an be interprete as: f g r = f lt( f ) lt(g) g (4) = f lm( f ) g; ( lt( f ) = lm( f )) (5) lm(g) = f + lm( f ) g; ( 1 = +1 (mo 2)) (6) lm(g) = f lm( f ) g; (as + (mo 2) = ) (7) lm(g) lm( f ) Notie that lm(g) is a unate prout of literals. i.e. a unate ube. The operation anels ommon ubes from f an lm( f ) lm(g) g. The operation moels the moulo 2 prout, where the partial prouts are ae using the operation. g Therefore, we will implement the reue operation f r for Boolean polynomials as r = f lm( f ) lm(g) g using an impliit representation partiularly suite for suh unate ube operations, i.e. ZDDs. A. Zero Suppresse Binary Deision Diagrams (ZDDs) for Boolean Polynomials Binary eision iagrams (BDDs) [1] an their variants have been use as impliit representations for solving many Boolean an pseuo-boolean optimization problems. Zerosuppresse BDDs [15] are another variant of BDDs that were esigne to effiiently manipulate sets of ombinations. A ZDD is obtaine from an orere BDD by: i) eliminating those verties whose 1-ege (then-ege) is inient on the 0-terminal; an ii) merging isomorphi subgraphs. Subjet to the given variable orer, a ZDD represents a Boolean funtion anonially. Just as with BDDs, every noe in a ZDD is assigne an inex, whih orrespons to the variable orer impose on the iagram. For a etaile esription of ZDDs an their apabilities for solving logi optimization an sparse ombinatorial problems, the reaer is referre to [15] an [27]. r 1 y Fig. 3: ZDD for the polynomial r 1 = y + y +. In [27], Minato emonstrate that ZDDs are an effiient ata-struture for impliit manipulation (algebra) of unate ube sets. Fig. 3 epits a ZDD for the unate ube set {y,y,} with the variable orer y >. The paths beginning from the root noe y an terminating in the 1-terminal noe orrespon to the ubes of the set. A variable is present in a ube if its 1-ege lies on the path; otherwise it is absent from the ube if its 0-ege lies on the path. Consequently, the ZDD of Fig. 3 an be onstrue to represent the Boolean polynomial r 1 = y +y+. Minato has shown ([15][27]) how the set union, intersetion an ifferene operations an be implemente reursively on the ZDDs, an they have been implemente using the ite-operator in eision iagrams suh as the CUDD [17] pakage. We exten these operations to aommoate the sum an prout operations (mo 2), i.e. polynomial algebra in F 2 [x 1,...,x n ], by manipulating sets of ombinations using ZDDs. V. THEORY AND ALGORITHMS Let us first onsier a senario where the GBR z G + r on iruits uner RTTO an result in a size explosion (expression swell) problem using an expliit representation. We also show on the other han that an impliit set representation (ZDD) overomes this size explosion. a b x Fig. 4: A hain of OR gates. Consier the iruit shown in Fig. 4 onsisting of a hain of OR gates. Impose RTTO: i.e. lex term orer with variable orering as, z > y > x > > > b > a. The Boolean polynomials y z

6 6 1 z 0 r 2 x r 1 y f 1 f 2 f 3 b b a a Fig. 5: Reution of output of the iruit in Fig. 4 by f 1, f 2, f 3. r 3 for the iruit are: f 1 = z + y + y + ; (8) f 2 = y + x + x + ; (9) f 3 = x + ba + b + a; (10) Uner RTTO, the set G = { f 1, f 2, f 3 } forms a GB. To erive a anonial representation of the funtion, we have to reue the output z G + r. A lassial symboli algebra reution using an expliit representation is arrie out as follows: 1) z f 1 y + y + 2) y + y + f 2 y + x + x + + f 2 x + x + x + x ) x + x + x + x f 3 x + x + x + ba + b + a f 3 x + x + ba + b + a + +ba+b+a+ + f 3 x+ba+b+a++ ba + b + a + + ba + b + a + f 3 ba + b + a + + ba + b + a + + ba + b + a + + ba + b + a = r Observations: i) Notie that the size of the final remainer orrespons to that of the worst ase of a Boolean polynomial: i.e. r ontains 2 n 1 (= 15) monomial terms for n (= 4) variables. ii) Classial ivision algorithms reue the polynomials 1-step at a time, where only one monomial is anele in eah step. iii) The number of 1-step reutions an inrease exponentially as GBR progresses aross the iruit. It is lear that any ata-struture that expliitly represents eah monomial will enounter spae an time explosion: this inlues the ense-istributive representation of SINGULAR omputer algebra tool [16], or the ones use by [9], [11]. The F 4 -style polynomial reution of [5], [6] simulates ivision on a matrix M representing the problem. However, eah olumn of M orrespons to a monomial generate in the ivision proess, therefore [5], [6] also enounter this size explosion. The use of ZDDs an help overome this explosion. Fig. 5 shows the same reution of z by f 1, f 2, f 3 using ZDDs (exat proeure isusse later). The size of the ZDDs after omplete reution by f 1, f 2, f 3 inreases linearly in the number of noes. Subsequently, the final remainer has 2 n 1 (= 7) noes (exluing the terminal 1 an 0 noes) for n (= 4) variables. Notie that while this ontrols spae explosion, the number of paths (monomials) in the ZDD is still exponential in the number of variables. A lassial ivision algorithm that anels only one monomial at a time may still require an exponential number of iterations. We show how to improve upon suh a situation. Problem Setup: Given a iruit C, enote all its nets with variables x 1,...,x n. Let the total number of gates in the iruit be s; represent eah gate of the iruit with a polynomial f i in its immeiate inputs. Then F = { f 1,..., f s } esribes the iruit netlist as a set of Boolean polynomials in F 2 [x 1,...,x n ]. Objetive: Impose RTTO on the polynomial ring, so that the set F = { f 1,..., f s } onstitutes a Gröbner basis G. For all primary outputs z i {x 1,...,x n }, ompute z i G + r i where r i is the anonial representation of z i moulo G, an use it for equivalene heking. The representation of the polynomials F of C, an the omputation z i G + r i is to be performe using ZDDs. A. ZDD representation for the polynomials of the iruit First, a reverse topologial traversal of the iruit is performe to erive the variable orer x 1 > x 2 > > x n as given in Prop. III.2. The same variable orer is impose on the ZDDs, i.e. x 1 is the variable at the top level in the ZDDs. A ZDD is reate for eah variable x i. Using Eqn. (1) the gates of the iruit are moele as the set of Boolean polynomials F = { f 1,..., f s }. ZDDs for these polynomials are onstrute using the + an binary operations for moulo 2 sum an prout of two ZDDs. Coneptually, the moulo 2 sum ( ) operation for two ZDDs f,g an be implemente as f +g = f s g s f s g s, where f s an g s represent the ube sets for the polynomials f an g respetively. For example, let f = ab + an g = + with the orresponing ube sets f s = {ab,} an g s = {,}, then f s g s = {ab,,} an f s g s = {}. The set ifferene f s g s f s g s is the set {ab,} an the orresponing Boolean polynomial is ab +. Experiene has shown that suh an implementation with the union operation results in large size of intermeiate ZDDs. In orer to avoi this intermeiate size explosion, we have implemente the f + g (mo 2) operation along similar lines as presente in [20]. The algorithm for this operation is shown in Algorithm 3. Example V.1. To emonstrate f + g, f = ab +,g = +, let the variable orering be a > b > >, i.e. inex values for these variables are 0, 1, 2, 3, respetively. The onition inex(v 1 = a) < inex(v 2 = ) is true. The ite operation plaes then( f ) = b on the soli ege of the root of the new ZDD an performs else( f )+g (mo 2), as shown in Fig. 6. During this

7 7 Algorithm 3 Algorithm for performing f + g (mo 2) 1: proeure mo 2 sum( f,g) 2: if f = 0 then 3: return g 4: else if g = 0 then 5: return f 6: else if f = g then 7: return 0 8: else 9: v 1 = top var( f );v 2 = top var(g); 10: if inex(v 1 ) < inex(v 2 ) then 11: return ite(v 1,then( f ),else( f ) + g) 12: else if inex(v 1 ) > inex(v 2 ) then 13: return ite(v 2,then(g),else(g) + f ) 14: else 15: return ite(v 1,then( f ) +then(g),else( f ) + else(g)) reursive all, the last onition is true (as inex(v 1 = ) = inex(v 2 = ) = 2). This time the ite operation performs two reursive alls then( f ) +then(g) an else( f ) +else(g), an so on, to finally onstrut the ZDD for the Boolean polynomial ab +. A similar reursive algorithm is also implemente for f g (mo 2) operation where the intermeiate partial prout terms are ae (mo 2) using the Algorithm 3. E.g., f = ab,g = a + b, f g = ab + ab = 0. B. GBR z i G + r i uner RTTO on ZDDs One the ZDDs for the iruit have been built an store in G, we nee to perform the anonial Gröbner basis reution G z i + r i for eah output bit z i. The polynomial r i will be a anonial representation of z i in terms of primary inputs. g Reution f r requires one to obtain the leaing monomials lm( f ),lm(g) of f,g (Eqn. 7). 1) Fining the leaing monomials uner RTTO on ZDDs: Reall that RTTO imposes a lex term orer on the polynomials using the variable orer x 1 > > x n. Moreover, the same variable orer x 1 > > x n is impose on the ZDDs. Traversing the then-eges from the root noe of a ZDD to terminal 1 elivers the leaing monomial of that polynomial uner RTTO. 2) Classial reution with ZDDs: Canel one monomial in every step: The algorithm for onventional reution proeure using ZDDs is shown in Algorithm 4. The input parameters are the ZDD of the output bit z i of the iruit an poly list a list ontaining the ZDDs for the set of polynomials F = { f 1,..., f s } orresponing to the gates of the iruit. The algorithm is base on the same priniples as the lassial ivision proeure (Algorithm 1). The proeure leaing term(g) returns the leaing term of the ZDD representation of polynomial g. If g ivies f, then the proeure ZDD Divie( f, g) (performs ube ivision) returns the quotient of the ivision, else it returns zero. Line 8 omputes z i = z i + lt(z i) lt(g) g. The polynomial z i is ompletely reue w.r.t. the polynomial g in the while loop. 3) Improve Reution: Canel multiple monomials in 1 step: Next, we will show how z i an be reue by a Algorithm 4 Reution: Canel 1 monomial every iteration 1: proeure single mon re(z i, poly list) 2: for eah g poly list o 3: lea g = leaing term(g) 4: lea z i = leaing term(z i ) 5: quotient = ZDD Divie(lea z i,lea g) 6: while quotient zero o 7: pro = quotient g 8: z i = z i + pro 9: lea z i = leaing term(z i ) 10: quotient = ZDD Divie(lea z i,lea g) 11: return z i polynomial g in one step. In the example of Figs. 4 an 5, the primary output z is reue by f 1 to get r 1. The next step is to reue r 1 by f 2 to get r 2. To emonstrate our approah we will show how the reution of r 1 by f 2 an be ahieve in one step. There are two monomials in r 1 that ontain y, namely y,y. Both an be anele by lt( f 2 ) = y in one step, eliminating the nee of the while loop in Algorithm 4. The polynomial r 1 = y + y + an be written as y ( + 1) +. If we perform 1-step reution of r 1 by f 2 we get the quotient + 1. This quotient is visible as the polynomial represente by the then-noe of r 1 (Fig. 7). So the reution an be performe by multiplying +1 with f 2 an subtrating (aing) this prout to r 1 (mo 2). r 1 f 2 + r 2 (11) = (y + y + ) + ( + 1) (y + x + x + ) (mo 2) (12) = 2 (y + y) + + ( + 1) (x + x + ) (mo 2) (13) = }{{} else(r 1 ) +( + 1) }{{} then(r 1 ) (x + x + ) }{{} else( f 2 ) (mo 2) (14) As shown in Fig. 7, else(r 1 ) =,then(r 1 ) = + 1 an else( f 2 ) = x + x +. Moreover, 2 (y + y) = 0 (mo 2). Therefore, in orer to reue number of operations inurre in the ivision proess, we iretly use the last step as a formula for reution: r 1 f 2 + r 2 = else(r 1 ) +then(r 1 ) else( f 2 ) (15) f j More generally, to perform the ivision r i + r j, we nee to ensure that if f j ivies r i, then the variable (inex) assoiate with the top-most noes of their respetive ZDDs are the same. This an be ensure by populating poly list = { f 1,..., f s } in a ertain orer. Due to RTTO, eah polynomial f j F is of the form f j = x j + tail( f j ), where eah variable in tail( f j ) is orere as being less than x j (Prop. III.2). Due to this orer, the ZDD representation of the polynomials is of the type f 1 = x 1 + else( f 1 ),..., f s = x s + else( f s ), where the variables x 1,...,x s are the top-most noes in their respetive ZDDs with variable orer x 1 > > x s > > x n. Note that the variables {x s+1,...,x n } are the primary inputs, an they are not the output of any logi gate. We ensure that primary inputs appear last in RTTO. Then we store elements in poly list aoring to the orer f 1 > f 2 > > f s ; i.e. poly list[1] = f 1,..., poly list[s] = f s.

8 8 f b a + g b a + f + g b a Fig. 6: f + g (mo 2) using ZDDs then(r 1) r 1 y else(r 1) Fig. 7: ZDDs for polynomial r 1 an f 2. f 2 y x 1 else(f 2 ) Consiering Algorithm 4, suppose that we first reue z i by poly list[1] = f 1, whih results in variable x 1 being replae by tail( f 1 ) in z i. The variable x 1 annot appear again in z i at any further reution step as x 1 is not in the support of polynomials poly list[2],..., poly list[s]. Further in the reution proess, let us assume that we have reue z i by f 1, f 2,..., f j 1. At this stage the intermeiate remainer z i will not ontain any of the variables x 1,x 2,...,x j 1 as they have been anele by the leaing terms of f 1, f 2,..., f j 1. The next variable in RTTO is x j. To anel terms in z i ontaining variable x j, we nee to searh for the ivisor polynomial f j = x j +tail( f j ). There an be two possibilities for z i : 1) If terms in z i ontain x j, then the top variable of the ZDD of z i will be x j. In that ase, as the top variable of the ZDD of f j is also x j, f j an ivie z i. 2) If z i oes not ontain terms in x j, then the top variable of the ZDD of z i will not be x j. In that ase, f j (with top variable x j ) annot ivie z i. Therefore, the ivisibility of z i by the urrent entry in poly list[ j] = f j an be heke just by omparing the inies of the top noes of the ZDDs of z i an f j. If the inies are equal, then f j ivies z i. Otherwise, f j oes not ivie z i. This allows to replae the ube ivision (Line 5, Algorithm 4) by an equality hek of top inies of ZDDs. Therefore, unlike in Algorithm 4, where we nee to obtain the leaing monomials an ompute the quotient lea z i /lea g, now we only nee to etermine if lea g an ivie z i at all (in whih ase the quotient is then(z i )). This an be aomplishe by just omparing the inies of top-most noes of z i an g. It an now be shown that Eqn. (15) hols throughout the f j GB-reution uner RTTO. To perform the operation r i + r j, we onsier their ZDDs onstrute using RTTO. Base on the above isussion, the top variables of the ZDDs of r i 0 an f j are the same an equal to x j. Also, let q enote the f j quotient of ivision of r i by f j. The operation r i + r j, is arrie out as follows, r j = r i + q f j As x j is the top variable of r i an f j, they an be written as r i = x j then(r i ) + else(r i ) an f j = x j + else( f j ), respetively. Also notie that q = then(r i ), beause f j (with leaing term x j ) an only ivie the x j then(r i ) omponent of r i. r j = x j then(r i ) + else(r i ) + q (x j + else( f j )) = x j then(r i ) + else(r i ) +then(r i ) (x j + else( f j )) = 2 x j then(r i ) + else(r i ) +then(r i ) else( f j ) = else(r i ) +then(r i ) else( f j ) The last expression is the same as in Eqn. (15). So the reution proess effetively involves just two operations, a moulo 2 sum an a prout. This has the effet of aneling all the terms in r i that an be anele by lt( f j ), impliitly aneling multiple monomials in one step. This is mae possible only ue to the properties that RTTO imposes on the struture of ZDDs. The algorithm for impliit anellation of multiple monomials in GB-reution is shown in Algorithm 5, where the notations, z i an poly list, are the same as in Algorithm 4. This algorithm signifiantly reues the number of iterations, whih now exatly equals the size of poly list. For the example of Fig. 4, the number of iterations is 3 using Algorithm 5, whereas 7 iterations are require using Algorithm 4. Algorithm 5 Reution uner RTTO: Canel multiple monomials 1: proeure multi mon re(z i, poly list) 2: for eah g poly list o 3: if inex(g) == inex(z i ) then 4: z i = else(z i ) +then(z i ) else(g) 5: return z i We have implemente the above GBR proeures using the CUDD pakage [17]. The iruit uner verifiation is analyze, RTTO base variable orer is impose on the ZDDs, an the Boolean polynomials of the iruit are represente as unate ube sets on ZDDs. The polynomials orresponing to the gates of iruit, G = { f 1,..., f s }, are inserte in poly list aoring to the variable orer x 1 > > x i > > x n, where f i = x i + else( f i ). To perform GBR z i G + r i, Algorithm 5 is invoke an r i use for equivalene heking.

9 9 VI. EXPERIMENTAL RESULTS This setion presents the results of using our implementation (Algorithm 5) for formal verifiation an equivalene heking of iruits use in ryptography. We ompare our results against: i) F4-style reution [6] whih moels the reution as Gaussian elimination on a oeffiient matrix; ii) Parallelize approah for performing reutions on Galois fiel multipliers [14]; an iii) PolyBori s [20] reution proeure with ZDDs as the unerlying ata struture. For all tools an experiments, RTTO > is use for onstraint representation. The experiments are performe on a 3.5GHz Intel Core TM i7-4770k Qua-Core CPU with 32 GB of RAM. The atapath sizes k are selete aoring to ryptography stanars reommene by U.S. National Institute of Stanars an Tehnology (NIST). A. Mastrovito Multipliers Moular multipliation is an important omputation use in ryptography. A Mastrovito multiplier arhiteture an be employe for performing this omputation over the finite fiel of 2 k elements, i.e. F 2 k. Mastrovito multipliers ompute Z = A B (mo P(x)) where P(x) is a given primitive polynomial for the atapath size k. Here A = {a 0,a 1,...,a k 1 }, B = {b 0,b 1,...,b k 1 } are the two ata operans, an Z = {z 0,z 1,...,z k 1 } is the output. The prout A B is first ompute using an array multiplier arhiteture, an then the result is reue moulo P(x). Table I provies the results for the reutions z i G + r i for Mastrovito multipliers for eah output bit z i,0 i k 1. The benhmarks are taken from [5] an optimize using ABC [28] with the ommans resyn2 an h as mentione in [14]. Algorithm 5 reues eah output bit inepenently of other bits. Therefore, we have presente the results obtaine by running our reution algorithm both sequentially an in parallel for eah output bit. Similarly, the results for implementation in PolyBori are also presente for both ases. The implementation presente in [14] is alreay parallelize. We parallelize PolyBori an our implementation by reating iniviual proesses for eah output bit z i that has its own set of variables an gate polynomials, poly list (Algorithm 5). The maximum number of parallel proesses is eie upon the memory usage of eah proess (i.e. reuing one bit) for our implementation an the total available memory. The larger benhmarks are run with fewer parallel proesses as they onsume more memory. In the table, the olumn #T represents the number of parallel proesses. (S) an (P) refer to the ases when the experiments run sequentially an in parallel for the output bits z i, respetively. The 571-bit multiplier oul not be synthesize an mappe with the given memory ue to its large size. Therefore, we have provie results for a struture (but unoptimize) 571- bit multiplier benhmark. Our implementation outperforms the expliit approahes of [6] an [14] for Mastrovito multipliers an also PolyBori. For the 571-bit multiplier, the implementation of [6] oes not finish for the given time perio of 30 hours an the PolyBori implementation rashes (CR). The maximum TABLE I: Mastrovito Multipliers (Time in seons); k = Datapath Size, #Gates = No. of gates, #T = No. of threas, Time-Out = 30 hrs, (P): Parallel Exeution, (S): Sequential Exeution, K = 10 3, M = 10 6, PB: PolyBori, ZR: Algorithm 5 k #Gates F4 [6] #T [14](P) PB ZR (P) (S) (P) (S) K K K K K K 2, * 1.6M TO 3 5,331 CR CR 2, memory onsumption by ZDDs for Mastrovito multipliers when GBR is performe sequentially varies from MB for 64-bit operans to 8.1 GB for 571-bit operans. An interesting point to note in Table I is that our implementation takes less time when run sequentially. There is a ertain overhea involve when we elare variables an buil ZDDs for eah gate of the iruit. In the ase of Mastrovito multiplier benhmarks, this overhea is substantially greater than the reution time for eah output bit. Therefore, when the output bits are reue in parallel for these benhmarks, this overhea inreases the overall run time. B. Montgomery Multipliers Exponentiation operations are often require in ryptosystems. For suh appliations, Montgomery arhitetures [29] [30] [31] are onsiere more effiient than Mastrovito multipliers as they o not require expliit reution moulo P after eah step. Fig. 8 shows the struture of a Montgomery multiplier. Eah MR blok omputes A B R 1, where R is selete as a power of a base (α k ) an R 1 is the multipliative inverse of R in F 2 k. As this operation annot ompute A B iretly, we nee to pre-ompute A R an B R as shown in the Fig. 8. We enote the leftmost two bloks as Blok A (upper) an B (lower), the mile blok as Blok C an the output blok as Blok D. A B R 2 R 2 MR MR A R B R MR A B R MR "1" Fig. 8: Montgomery multipliation. G=A Z B (mo P) Table II provies the results for GBR on flattene (bitblaste) an optimize Montgomery multipliers for the sequential an parallel exeutions of Algorithm 5. The maximum memory onsumption for sequential exeution varies from 66.7 MB for 64-bit operans to 11.3 GB for 571-bit operans. Our approah outperforms onventional expliit approahes exept for the ase of 283 bit multiplier. Table III presents the statistis for Montgomery multipliers where the hierarhy of Fig. 8 for the bloks A, B, C, an D is mae available. The experiment first reues the outputs of eah iniviual blok moulo the gates of that blok, an

10 10 TABLE II: Montgomery Multipliers (Time in seons); k = Datapath Size, #Gates = No. of gates, #T = No. of threas, Time-Out = 30 hrs, (P): Parallel Exeution, (S): Sequential Exeution, K = 10 3, M = 10 6, PB: PolyBori, ZR: Algorithm 5 k #Gates F4 [6] #T [14](P) PB ZR (P) (S) (P) (S) K K K 2, K K 5, , ,078 1, , K 7, * 1.97M TO 3 TO CR CR 43,813 99,042 then reues the primary outputs moulo these four sets of remainers (ZDDs), thus exploiting the hierarhy of these iruits. Table III shows the time for reution of eah blok an the time for reuing the primary outputs aross the four bloks. The time for reuing the primary outputs aross the hierarhial bloks in ase of the F4 implementation is <1 seon, an is not expliitly mentione in the table. The row labele Total presents the sum of the omputation time of reution aross these levels, an the maximum of the time to reue eah MR blok (as the reutions for the four bloks are inepenent of eah other an are parallelize). These results again emonstrate the effiieny of our approah against expliit approahes. TABLE III: Montgomery Bloks (Time in seons); k = Datapath Size, #Gates = No. of gates, Time-Out = 30 hrs, Re. = time for reution, Coll. = time to reue aross the 4 levels. K = 10 3, M = 10 6, PB: PolyBori, ZR: Algorithm 5 PB ZR k #Gates Blok F4 [6] Re. Coll. Re. Coll. 33K Blok A K Blok B K Blok C K Blok D Total K Blok A K Blok B K Blok C K Blok D Total K Blok A K Blok B K Blok C K Blok D Total K Blok A 1, K Blok B 1, K Blok C 4, K Blok D 1, Total 4, K Blok A 5, K Blok B 5, ,341 1, K Blok C 37,804 3, K Blok D 5, Total 37,804 4,946 4,438 Equivalene Cheking: As a result of the GBR z i G + r i, the funtion implemente by eah output bit z i of the iruit is represente as a reue, anonial, Boolean polynomial in terms of the primary inputs, an by using a ZDD. Thus the equivalene of suh vastly ifferent arithmeti iruit implementations (Mastrovito vs Montgomery) an be verifie by testing for the equality (isomorphism) of the orresponing ZDD graphs. C. Point Aition over Ellipti Curves Point aition is an important operation require for the task of enryption, eryption an authentiation in Ellipti Curve Cryptography (ECC). Moern approahes represent the points in projetive oorinate systems, e.g., the López-Dahab (LD) projetive oorinate [32], ue to whih the point aition operation an be implemente as polynomials in the fiel. Example VI.1. Consier point aition in López-Dahab (LD) projetive oorinate. Given an ellipti urve: Y 2 + XY Z = X 3 Z + ax 2 Z 2 + bz 4 over F 2 k, where X,Y,Z are k-bit vetors that are elements in F 2 k an similarly, a,b are onstants from the fiel. We represent point aition over the ellipti urve as (X 3, Y 3, Z 3 ) = (X 1, Y 1, Z 1 ) + (X 2, Y 2, 1). Then X 3, Y 3, Z 3 an be ompute as follows: A = Y 2 Z 2 1 +Y 1 B = X 2 Z 1 + X 1 C = Z 1 B D = B 2 (C + az 2 1) Z 3 = C 2 E = A C X 3 = A 2 + D + E F = X 3 + X 2 Z 3 G = X 3 +Y 2 Z 3 Y 3 = E F + Z 3 G Eah of the polynomials in the above esign are implemente as a (gate-level) logi blok an are interonnete to obtain final outputs X 3,Y 3 an Z 3. TABLE IV: Point Aition Ciruits (Time in seons); k = Datapath Size, #Gates = No. of gates, Time-Out = 30 hrs, K = 10 3, M = 10 6, PB: PolyBori, ZR: Algorithm 5 k #Gates F4 [6] PB ZR K K K K K 1, K 5, M 48, CR The wor-level abstration approah in [6] presents the results for extrating the above representation for eah of A,B,...,X 3,Y 3,Z 3 bloks. It first performs a bit-level reution G for every output of eah blok (GBR z i + r i ), an then a bit-to-wor substitution to erive an input-output wor-level representation for the iruit. Table IV shows the omparison of the time require for bit-level reution of outputs i of the blok D = B 2 (C + az1 2 ) as one in [6] against our implementation. (Bit-level reutions for other bloks take muh less time than that for blok D.) This result emonstrates that our bit-level GBR implementation is in many ases orers of magnitue faster than the F4-style reution of [6]. Therefore our approah an replae the F4-style bit-level GBR of [6] an improve the overall proess of wor-level abstration of atapath esigns.