1. Using Mathematica for modeling, simulation and property checking of hardware systems Ghiath AL SAMMANE VDS group : Verification & Modeling of Digital systems TIMA Laboratory Techniques of Informatics and Microelectronics for computer Architecture

2. © Ghiath AL SAMMANE 2 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

3. © Ghiath AL SAMMANE 3 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

4. © Ghiath AL SAMMANE 4 What is TIMA ? (1)  Public research lab of the university of Grenoble and CNRS, located in the European equivalent to Silicon Valley  Carrying out research in the field of –Hardware design, architecture, test. –Verification & CAD tools. –Quality of integrated circuits and by means of data processing and microelectronics technology.  Transferring research results to industry  Contributing to knowledge dissemination by organizing conferences and editing journals

5. © Ghiath AL SAMMANE 5 What is TIMA ? (2)  120 members including interns and staff  67 PhD candidates  17 patents since 1993 and 3 start ups since 1999  7 conferences organized in 2004 and 6 conferences to be organized in 2005  100 publications/year since 1993 and 57 PhD theses since 1999

6. © Ghiath AL SAMMANE 6 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

7. © Ghiath AL SAMMANE 7 Digital Hardware Design Process Design Specifications Functional Design RTL Design In English Given by managers, customers… In Matlab, C, Java …. Property checking Done by R&D department In standard description Language, VHDL, Verilog. Done by HW designers

8. © Ghiath AL SAMMANE 8 Digital Hardware Design Process Functional Design RTL Design In Matlab, C, Java …. Property checking Done by R&D department In standard description Language, VHDL, Verilog. Done by HW designers RTL Verification By simulation, logical modeling & automatic reasoning Property checking Done by HW designers & verification experts

9. © Ghiath AL SAMMANE 9 By simulation, logical modeling & automatic reasoning Property checking Equivalence checking Done by HW designers & verification experts up to 75 % of design time ! Digital Hardware Design Process RTL Verification Synthesis & Optimization Post-Synthesis Verification Tech. mapping Place & route Fabrication Test & Packaging Post design process

10. © Ghiath AL SAMMANE 10 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

11. © Ghiath AL SAMMANE 11 Designing Hardware in Mathematica Functional Design RTL Design In Mathematica, Matlab, C, Java …. Property checking Done by R&D department In standard description Language, VHDL, Verilog. Done by HW designers RTL Verification By simulation, logical modeling & automatic reasoning in Mathematica Property checking Done by HW designers & verification experts

12. © Ghiath AL SAMMANE 12 Designing HW in Mathematica  Functional Design –Writing the early algorithms, formulas & equations directly in Mathematica –Checking property by numerical & symbolic computation  RTL (register transfer level) design –Writing in standard VHDL –Simulating VHDL in Mathematica numerically & symbolically –Checking properties

13. © Ghiath AL SAMMANE 13 Designing HW in Mathematica  Functional Design –Writing the early algorithms, formulas & equations directly in Mathematica –Checking property by numerical & symbolic computation  RTL (register transfer level) design –Writing in standard VHDL –Simulating VHDL in Mathematica numerically & symbolically –Checking properties

14. © Ghiath AL SAMMANE 14 Designing HW in Mathematica  Functional Design –Writing the early algorithms, formulas & equations directly in Mathematica –Checking property by numerical & symbolic computation  RTL (register transfer level) design –Writing in standard VHDL –Simulating VHDL in Mathematica numerically & symbolically –Checking properties

15. © Ghiath AL SAMMANE 15 Designing HW in Mathematica  Functional Design –Writing the early algorithms, formulas & equations directly in Mathematica –Checking property by numerical & symbolic computation  RTL (register transfer level) design –Writing in standard VHDL –Simulating VHDL in Mathematica numerically & symbolically –Checking properties Finding bugs earlier  Less verification effort

16. © Ghiath AL SAMMANE 16 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

17. © Ghiath AL SAMMANE 17 First step :VHDL in Mathematica  Modeling the semantic of a VHDL subset –The model must meet the VHDL synthesizable standard –Accept numeric & symbolic inputs –A hierarchical functional model  Simulating the VHDL descriptions –The same results in numeric cases as within standard simulators –Optimized for symbolic simulation  Checking properties about the symbolic results –Pattern matching, sat solving, BDD, theorem proving…

18. © Ghiath AL SAMMANE 18 Mathematica symbolic simulatior Results M-Code Simulation Constraints + Assertions Event-based Symbolic Simulator Constraints Resolution + symbolic Verification of assertions Simulation Rules VHDL File n simulation cycles Symbolic test cases Translator In Mathematica

19. © Ghiath AL SAMMANE 19 Mathematica symbolic simulatior Results M-Code Simulation Constraints + Assertions Event-based Symbolic Simulator Constraints Resolution + symbolic Verification of assertions Simulation Rules VHDL File n simulation cycles Symbolic test cases Translator In Mathematica

20. © Ghiath AL SAMMANE 20 A VHDL example A VHDL example : entity two_arbiter is port ( Clock : in bit; Reset : in bit; Req1 : in bit; Req2 : in bit; Ack1 : out bit; Ack2 : out bit); end two_arbiter ; Two requests arbiter Clock Reset Req1 Req2 Ack1 Ack2 Priority is given to the request Req2

21. © Ghiath AL SAMMANE 21 A VHDL example A VHDL example : architecture behavior of two_arbiter is begin -- behavior synchronous: process (clock, reset) begin -- process synchronous if reset = '0' then ack1<='0'; ack2<='0'; elsif clock'event and clock = '1' then -- rising clock edge if req1='1' and req2='0' then ack1<='1'; ack2<='0'; elsif req2='1' then ack2<='1'; ack1<='0'; else ack1<='0'; ack2<='0'; end if; end process synchronous; end behavior;

22. © Ghiath AL SAMMANE 22 The M-code  The Mathematica function that models the execution of the VHDL entity-architecture for one clock cycle  M-code (Mathematica COnditional DEscription)  Extracted automatically from the VHDL description  Hierarchy is supported

23. © Ghiath AL SAMMANE 23 The M-code of the example The Mathematica equivalent : Clear[two$arbiter$behavior]; SetAttributes[two$arbiter$behavior, HoldAll]; two$arbiter$behavior[ack1_, ack1$1_, ack2_, ack2$1_, clock_, clock$0_, req1_, req2_, reset_, reset$0_]:= A VHDL example : entity two_arbiter is port ( Clock : in bit; Reset : in bit; Req1 : in bit; Req2 : in bit; Ack1 : out bit; Ack2 : out bit); end two_arbiter ;

24. © Ghiath AL SAMMANE 24 The M-code of the example The Mathematica equivalent : Clear[two$arbiter$behavior]; SetAttributes[two$arbiter$behavior, HoldAll]; two$arbiter$behavior[ack1_, ack1$1_, ack2_, ack2$1_, clock_, clock$0_, req1_, req2_, reset_, reset$0_]:= A VHDL example : entity two_arbiter is port ( Clock : in bit; Reset : in bit; Req1 : in bit; Req2 : in bit; Ack1 : out bit; Ack2 : out bit); end two_arbiter ;

25. © Ghiath AL SAMMANE 25 The M-code of the example The Mathematica equivalent : Clear[two$arbiter$behavior]; SetAttributes[two$arbiter$behavior, HoldAll]; two$arbiter$behavior[ack1_, ack1$1_, ack2_, ack2$1_, clock_, clock$0_, req1_, req2_, reset_, reset$0_]:= A VHDL example : entity two_arbiter is port ( Clock : in bit; Reset : in bit; Req1 : in bit; Req2 : in bit; Ack1 : out bit; Ack2 : out bit); end two_arbiter ;

26. © Ghiath AL SAMMANE 26 The M-code of the example The Mathematica equivalent : Clear[two$arbiter$behavior]; SetAttributes[two$arbiter$behavior, HoldAll]; two$arbiter$behavior[ack1_, ack1$1_, ack2_, ack2$1_, clock_, clock$0_, req1_, req2_, reset_, reset$0_]:= A VHDL example : entity two_arbiter is port ( Clock : in bit; Reset : in bit; Req1 : in bit; Req2 : in bit; Ack1 : out bit; Ack2 : out bit); end two_arbiter ;

27. © Ghiath AL SAMMANE 27 Signal modeling  Three values are needed  The current value at time t, (S)  The old value at time (t-1), (S$0)  The next value at time (t+1), (S$1)  Old values are used only for detecting events (Sig(t)  Sig (t-1))

28. © Ghiath AL SAMMANE 28 The M-code body  Each concurrent statement in the architecture is rewritten as a sequential process  From these processes we extract automatically a list of assignments  One assignment for each object in the design :the transfer function of the object (signal or variable)  Simulates the behavior of the circuit for an abstract time unit called cycle

29. © Ghiath AL SAMMANE 29 Modeling assignments  The signal assignment function : NextSig[ S, F(S1,S2,…,Sn)]]  It gives the next value of S knowing the current and the old values of design objects (S1,S2,…,Sn)  F is an if-then-else expression (Ife)

30. © Ghiath AL SAMMANE 30 A VHDL example A VHDL example : architecture behavior of two_arbiter is begin -- behavior synchronous: process (clock, reset) begin -- process synchronous if reset = '0' then ack1<='0'; ack2<='0'; elsif clock'event and clock = '1' then -- rising clock edge if req1='1' and req2='0' then ack1<='1'; ack2<='0'; elsif req2='1' then ack2<='1'; ack1<='0'; else ack1<='0'; ack2<='0'; end if; end process synchronous; end behavior;

31. © Ghiath AL SAMMANE 31 The M-code of the architecture  The process is a set of signal assignments : {NextSig[ack1$1, Ife[equal[reset, 0], 0, Ife[and[event[clock], equal[clock, 1]], Ife[and[equal[req1, 1], equal[req2, 0]], 1, 0], ack1] ], NextSig[ack2$1, Ife[equal[reset, 0], 0, Ife[and[event[clock], equal[clock, 1]], Ife[and[equal[req1, 1], equal[req2, 0]], 0, Ife[equal[req2, 1], 1, 0] ], ack2]] ] }

32. © Ghiath AL SAMMANE 32 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

33. © Ghiath AL SAMMANE 33 Second step : simulation VHDL Results M-Code Simulation Constraints + Assertions Event-based Symbolic Simulator Constraints Resolution + symbolic Verification of assertions Simulation Rules VHDL File n simulation cycles Symbolic test cases Translator In Mathematica Executing the M-code function for n cycle (clock cycle for synchronous circuits)

34. © Ghiath AL SAMMANE 34 Results M-Code Simulation Constraints + Assertions Event-based Symbolic Simulator Constraints Resolution + symbolic Verification of assertions Simulation Rules VHDL File n simulation cycles Symbolic test cases Translator In Mathematica Mathematica symbolic simulator During simulation : applying test cases and simulation rules

35. © Ghiath AL SAMMANE 35 Simulation algorithm Initialize(DesignObject) For cycle := 1 to n do Apply-test-vectors(inputs)Mcode(DesignObject) Verify(Assertion) Update(DesignObject) Print(SelectedResults) End for

36. © Ghiath AL SAMMANE 36 Simulation Rules  Used during the execution of M-code  Simplification rules –Ife[True,x_,_]  x; –Ife[False,_,y_]  y; –Ife[_,y_,y_]  y;  Normalization rules –Ife[Ife[a_,b_,c_],x_,y_]  Ife[a,Ife[b,x,y],Ife[c,x,y]];  Evaluation rules –Ife[cond_,x_,y_]  IFE[cond,Assuming[cond,simplify[x]],Assuming[Not[cond], simplify[y]]];

37. © Ghiath AL SAMMANE 37 The M-code of the architecture  The process is a set of signal assignments : {NextSig[ack1$1, Ife[equal[reset, 0], 0, Ife[and[event[clock], equal[clock, 1]], Ife[and[equal[req1, 1], equal[req2, 0]], 1, 0], ack1] ], NextSig[ack2$1, Ife[equal[reset, 0], 0, Ife[and[event[clock], equal[clock, 1]], Ife[and[equal[req1, 1], equal[req2, 0]], 0, Ife[equal[req2, 1], 1, 0] ], ack2]] ] }

38. © Ghiath AL SAMMANE 38 Simulation of the example  Most inputs are symbols, one simulation test case is equivalent to a lot of numeric ones  The symbolic expression of Ack1 –IFE[RESET == 0, 0, IFE[REQ1 == 1 && REQ2 == 0, 1, 0]]  The symbolic expression of Ack2 –IFE[RESET == 0, 0, IFE[REQ1 == 1 && REQ2 == 0, 0, IFE[REQ2 == 1, 1, 0]]]

39. © Ghiath AL SAMMANE 39 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

40. © Ghiath AL SAMMANE 40 Checking properties  What can we do with huge If-then-else expressions? –The designer writes a property that the circuit should satisfy –After the simulation, the symbolic expression of the assertion should be evaluated to true or false  Property are checked by –Using comparison to direct specifications written in Mathematica –Using a Boolean prover in Mathematica –Using an external theorem prover

41. © Ghiath AL SAMMANE 41 Boolean prover in Mathematica  A prototype is under test  Take a normalized if-then-else and gives a counter example if the theorem is wrong and prove it otherwise  Built by the association of : –an implementation of the shared-BDD rewriting in Mathematica –Make use of the FindInstance function in Mathematica

42. © Ghiath AL SAMMANE 42 Checking properties of the example  mutex : assert not (Ack1 and Ack2)  serve : assert Req1 or Req2  Ack1 or Ack2  waste : assert Ack1  req1  waste : assert Ack2  req2  All these properties are proved by by our Boolean prover in Mathematica and by ACL2

43. © Ghiath AL SAMMANE 43 SatBit : checking the arbiter SatBit : Gives an example that the expression is satisfaisable, False other wise. In[24]:= SatBit[ack2] Sat, example: Out[24]= {{REQ1 -> 1, REQ2 -> 1, RESET -> 1}} In[25]:= SatBit[ack1&&ack2] Out[25]= False

44. © Ghiath AL SAMMANE 44 Proving properties by ACL2  An inductive theorem prover  An automatic link with Mathematica  The main function is ImpliesAcl2[p,q] –Prove by Acl2 that p  q Example: –ImpliesAcl2[ And[ bitp[REQ1, REQ2, RESET], RESET == 1,ack1 == 1 ], REQ1 == 1] True

45. © Ghiath AL SAMMANE 45 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

46. © Ghiath AL SAMMANE 46 Successful applications  Validation on research and academic cases  Symbolic simulation and a verification of a network on chip (a university circuit)  Symbolic simulation of an industrial cryptographic component implementation  Symbolic simulation and property verification of a DRAM specification that comes from STMicroelectronics

47. © Ghiath AL SAMMANE 47 Outline  What is TIMA?  Digital hardware design process  Modeling Hardware in Mathematica  VHDL simulation in Mathematica  Verification & symbolic simulation  Property checking  Successful applications  Conclusion

48. © Ghiath AL SAMMANE 48 Conclusion : achievements  A VHDL to Mathematica compiler is built  A hardware simulator in Mathematica is implemented  We prove properties about results –A Boolean prover is implemented in Mathematica (automatic) –A link to an external theorem prover is achieved (expert in proof may be needed when proof fails)  Application on various industrial circuits

49. © Ghiath AL SAMMANE 49 Conclusion : What is next ?  Writing a user manual  Building an interface  Supporting Property Specification Language (PSL)  A Demo at DATE 2005 (Design Automation & Test in Europe)

50. © Ghiath AL SAMMANE 50 Thank you

51. © Ghiath AL SAMMANE 51 If-then-else expression (Ife) Ife_expr ::= Symbol | Number | True | False | Boolean_Expression | Arithmetic_Expression | Ife[Ife_expr, Ife_expr, Ife_expr]