Verify the hardware design of components that implement permutation-related functions

Abstract

A method and system for verifying the hardware design of a component that implements a permutation-dependent function is described. The method includes: formally verifying that an instantiation of the hardware design produces correct results for the function for a subset of valid input vectors; and formally verifying that an instantiation of the hardware design produces permutation-dependent outputs for each of one or more input vector permutations on a set of input vectors (i.e., an instantiation of the hardware design produces permutation-dependent outputs for an input vector and a permutation of the input vector. The subsets and input vector permutations are selected such that any input vector not in the subset can be generated from an input vector in the subset via a combination of the one or more input vector permutations.

Description

Technical Field

[0001] The present disclosure relates to hardware designs for verifying components that implement permutation-related functions. Background Art

[0002] There are multiple input elements (x0, x1...x n-1 ) and produces permutation-respecting outputs for at least two different orderings (or permutations) of a set of input elements. A function is said to produce a permutation-respecting output if it produces a first output in response to a first input vector and a second output in response to a second input vector that is a permutation of the first input vector, and the second output can be derived solely from the first output and the permutation. Such functions are referred to herein as permutation-respecting functions. The set of permutations of the input vectors of a function relative to its permutations (i.e., the set or groups of input vector permutations that the function produces permutation-respecting outputs for the input vectors and the permutations of the input vectors) is referred to herein as a set or group of relevant input vector permutations. Permutation-respecting functions include, but are not limited to: a function F that is invariant with respect to one or more input vector permutations σ (i.e., F(σx)=F(x)); a function F that is equivariant with respect to one or more input vector permutations σ (i.e., σF(x)=F(σx)); and a function F that satisfies t σ A function F(x) = F(σx), where the input vector permutation σ is mapped to the output transformation t by a homomorphism from the associated input vector permutation group to the output automorphism group σ .

[0003] An example permutation-related function is the ranking function F sort (a, b, c), sorting function F sort (a, b, c) receives an input vector consisting of three input elements a, b, c and outputs a vector consisting of the input elements in ascending order. This function is a permutation-dependent function because it is invariant with respect to all permutations of the input vector, i.e., it will produce the same output for any permutation of a set of input elements. For example, when the function F sort When receiving input elements 4, 5, and 6 in any order, the function F sort The output will be 4, 5, and 6. Specifically, when the function F sortThe following inputs will be output: 4, 5, 6: (i) a = 4, b = 5, and c = 6, (ii) a = 4, b = 6, and c = 5; (iii) a = 5, b = 4, c = 6; (iv) a = 5, b = 6, and c = 4; (v) a = 6, b = 4, and c = 5, or (vi) a = 6, b = 5, and c = 4. Other examples of permutation-related functions include, but are not limited to, an average function that outputs the average of a plurality of input elements; a median function that outputs the median of a plurality of input elements; a maximum function that outputs the maximum of a plurality of input elements; a minimum function that outputs the minimum of a plurality of input elements; and a function that receives a set of input elements representing entries of a square matrix and outputs the determinant of the matrix.

[0004] Many electronic devices (e.g., systems on a chip (SOCs)) include components that implement permutation-related functions. Generating a component that implements a permutation-related function typically includes: developing a hardware design that describes the structure and functionality of an integrated circuit that implements the permutation-related function; verifying or testing the hardware design to ensure that an integrated circuit manufactured according to the design will operate as expected; and once verified, manufacturing the integrated circuit according to the hardware design in an integrated circuit fabrication system. Verifying the operation or behavior of the hardware design of a component that implements a permutation-related function includes verifying that an instantiation of the hardware design produces correct (or expected) outputs according to the function for all valid input vectors.

[0005] For example, a hardware design can be verified through formal verification or simulation-based verification. Formal verification is a systematic process of verifying a hardware design using mathematical models of the hardware design and mathematical reasoning. In contrast, simulation-based verification is a process of testing a hardware design by applying stimuli to instantiations of the hardware design and monitoring the output of the instantiations in response to the stimuli.

[0006] Compared to simulation-based verification, formal verification improves controllability. Low controllability occurs when the number of analog test signals, or vectors, required to fully simulate a hardware design becomes unmanageable. For example, a 32-bit comparator requires 264 test vectors. This could take millions of years to fully verify using simulation-based verification. By performing formal verification, a 32-bit comparator can be verified in less than a minute.

[0007] While formal verification can be an effective method for exhaustively verifying the properties of a hardware design, formal verification can only be used when the properties to be verified are presented in a way that the formal verification tool can solve the mathematical problem presented thereby. Specifically, in the formal verification device of a hardware design, the hardware design is represented as a mathematical model, the properties to be proved are also represented mathematically, and mathematical reasoning is used to determine whether the properties of the hardware design are true based on the mathematical model. In other words, in formal verification, verification is represented as a mathematical problem to be solved. Some mathematical problems will be solved by the formal verification tool in a reasonable amount of time, while others will not. When the formal verification tool is able to solve the mathematical problem presented by the hardware design and the properties to be verified, then the formal verification is considered to be converged. However, when the formal verification tool cannot solve the mathematical problem presented by the hardware design and the properties to be verified, then the formal verification will not converge, will not output any results, and the verification is indeterminate.

[0008] The embodiments described below are provided by way of example only and not limitation of implementations that address any or all of the shortcomings of known methods and systems for verifying hardware designs of components implementing permutation-related functions. Summary of the Invention

[0009] This summary is intended to introduce some concepts that are further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0010] A method and system for verifying a hardware design of a component that implements a permutation-dependent function is described herein. The method includes: formally verifying that an instantiation of the hardware design outputs a correct result of the function for a subset of valid input vectors; and formally verifying that the instantiation of the hardware design is a permutation of each of one or more input vector permutations (i.e., the instantiation of the hardware design produces a permutation-dependent output for an input vector and a permutation of the input vector. The subsets and input vector permutations are selected such that any input vector not in the subset can be generated from an input vector in the subset via a combination of the one or more input vector permutations.

[0011] A first aspect provides a method for verifying a hardware design of a component that implements a permutation-related function, the component being configured to receive an input vector comprising a plurality of input elements and to generate an output based on the input vector and the function, the method comprising: verifying at one or more processors that an instantiation of the hardware design generates an expected output for each input vector of a subset of valid input vectors; and verifying at one or more processors, for each of one or more input vector permutations, that an instantiation of the hardware design generates a permutation-related output for any input vector in a set of valid input vectors and a permutation of the input vector; wherein each valid input vector not in the subset of valid input vectors can be obtained by applying one or more of the one or more input vector permutations to an input vector in the subset.

[0012] A second aspect provides a system for verifying a hardware design of a component that implements a permutation-related function, the system comprising: a memory comprising: a hardware design of a component that implements a permutation-related function, the component being configured to receive an input vector comprising a plurality of input elements and to generate an output based on the input vector and the function; and one or more verification tools; and one or more processors configured to: verify, using one of the one or more verification tools, that an instantiation of the hardware design generates an expected output for each input vector of a subset of valid input vectors; and verify, using one of the one or more verification tools, for each of one or more input vector permutations, that an instantiation of the hardware design generates a permutation-related output for any input vector in a set of valid input vectors and a permutation of the input vector; wherein each valid input vector not in the subset of valid input vectors can be obtained by applying one or more of the one or more input vector permutations to the input vectors in the subset.

[0013] When processed in an integrated circuit manufacturing system, a hardware design for a component that implements a permutation-related function can configure the system to manufacture an integrated circuit including the component. A non-transitory computer-readable storage medium having stored thereon a hardware design for a component that implements a permutation-related function can be provided, which, when processed in the integrated circuit manufacturing system, causes the integrated circuit manufacturing system to manufacture an integrated circuit including the component.

[0014] An integrated circuit manufacturing system may be provided, comprising: a non-transitory computer-readable storage medium having stored thereon a hardware design of a component that implements a permutation-related function; a layout processing system configured to process the hardware design to generate a circuit layout description of an integrated circuit including the component; and an integrated circuit generation system configured to manufacture the integrated circuit including the component based on the circuit layout description.

[0015] A computer program code for executing the method described herein may be provided.A non-transitory computer readable storage medium may be provided having computer readable instructions stored thereon, which, when executed on a computer system, cause the computer system to execute the method described herein.

[0016] As will be apparent to the skilled person, the features described above may be combined as appropriate and may be combined with any aspects of the examples described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Examples will now be described in detail with reference to the accompanying drawings, in which:

[0018] Figure 1 is a block diagram of example components implementing a permutation-related function;

[0019] Figure 2 is a flow chart of an example method for verifying a hardware design of a component implementing a permutation-related function;

[0020] Figure 3 is a diagram of the input space of the example permutation correlation function;

[0021] Figure 4 is a schematic diagram illustrating example input vector permutations and example generated sets based thereon;

[0022] Figure 5 is a block diagram of an example system for verifying the hardware design of components implementing a permutation-related function;

[0023] Figure 6 is a block diagram of an example computing-based device;

[0024] Figure 7 is a block diagram of an example computer system in which components implementing permutation-related functions may be implemented; and

[0025] Figure 8 is a block diagram of an exemplary integrated circuit fabrication system for producing an integrated circuit including components that implement a permutation-related function.

[0026] The accompanying drawings show various examples. It will be appreciated by those skilled in the art that the element boundaries (e.g., boxes, box groups or other shapes) shown in the accompanying drawings represent an example of boundaries. In some examples, an element can be designed as multiple elements, or multiple elements can be designed as one element. Where appropriate, common reference numerals are used throughout the figures to indicate similar features. DETAILED DESCRIPTION

[0027] The following description is presented by way of example only to enable those skilled in the art to make and use the present invention. The present invention is not limited to the embodiments described herein, and various modifications to the disclosed embodiments will be apparent to those skilled in the art. The embodiments are described by way of example only.

[0028] Although formal verification can provide advantages over simulation-based verification, methods known to the applicant for formally verifying the hardware design of components that implement permutation-related functions have been shown to be inefficient (e.g., they take a long time to complete) and / or ineffective (e.g., they fail to converge, so they fail to provide a definitive answer). For example, a method known to the applicant for formally verifying the hardware design of a component that implements a permutation-related function includes formally verifying that an instantiation of the hardware design produces the correct output in response to each valid input vector according to the function. In this article, this may be referred to as a naive formal verification of the hardware design of a component that implements a permutation-related function. This approach has been shown to be inefficient (e.g., has been shown to take a long time) when the number of input elements is large, and / or is ineffective (e.g., fails to converge or fails to produce a result) when the function is complex. It should be noted that the fact that something is known to the applicant does not mean that it is well-known.

[0029] Therefore, this article describes a method and system for verifying the hardware design of a component that implements a permutation-related function, wherein the verification is broken down into a collection of smaller verifications. Specifically, the method includes formally verifying that an instantiation of the hardware design outputs the correct result of the function for a subset of valid input vectors; and formally verifying that an instantiation of the hardware design is a permutation of each of one or more input vector permutations (i.e., the instantiation of the hardware design produces a permutation-related output of an input vector and a permutation of the input vector). The subset and the input vector permutation are selected so that any input vector not in the subset can be generated from the input vector in the subset via a combination of one or more input vector permutations. The method described herein has been shown to be able to verify the hardware design of a component that implements a permutation-related function faster than using a naive method. The method described herein is also capable of verifying hardware designs for which the naive method cannot converge (i.e., cannot provide a definite answer).

[0030] As mentioned above, the permutation correlation function receives a plurality of input elements (x0, x1...x n-1 ) and produces permutation-dependent outputs for at least two permutations of the same set of input elements. A function produces permutation-dependent outputs if the function produces a first output in response to a first input vector x and a second output in response to a second input vector that is a permutation of the first input vector, and the second output is derivable solely from the first output and the permutation.

[0031] Each input element x iIt may contain a single variable, or it may contain multiple variables (e.g., each input element may itself be a vector or matrix containing multiple variables). For example, in some cases, each input element may be a b-bit binary number, while in other cases, each input element may be a vector or matrix of b-bit binary numbers, where b is an integer greater than or equal to 1.

[0032] The permutation σ of the input vector x is the permutation of the input element x of the input vector x. i The input vector x has n input elements x i In the case of n, there will be n permutations of the input vector x. For example, for a set of input elements {x0, x1, x2}, an input vector x consisting of three input elements (x0, x1, x2) will have 3! = 6 permutations (or orderings) σ, as shown below. The set of all possible permutations of a set of n input elements is referred to herein as Sym(n). Thus, Sym(n) for n = 3 is {σ0, σ1, σ2, σ3, σ4, σ5}.

[0033] σ0(x0,x1,x2)=(x0,x1,x2)

[0034] σ1(x0,x1,x2)=(x0,x2,x1)

[0035] σ2(x0,x1,x2)=(x1,x0,x2)

[0036] σ3(x0,x1,x2)=(x1,x2,x0)

[0037] σ4(x0,x1,x2)=(x2,x0,x1)

[0038] σ5(x0,x1,x2)=(x2,x1,x0)

[0039] The symbol F(σx) is used to refer to the output of the function F for the permutation σ of the input vector x. For example, if the input vector includes three input elements, F(σ2x) is the output of the function F for the input vector where the order of x1 and x2 has been swapped. In other words, F(σ2x) = F(σ2(x0, x1, x2)) = F((x0, x2, x1)).

[0040] As described above, the permutation-related functions include but are not limited to: a function F that is invariant with respect to one or more input vector permutations σ (i.e., F(σx)=F(x)); a function F that is equivariant with respect to one or more input vector permutations σ (i.e., σF(x)=F(σx)); and a function F that satisfies t σA function F(x) = F(σx), where the input vector permutation σ is mapped to the output transformation t via a homomorphism from the associated set of input vectors to the output automorphism group σ As known to those skilled in the art, an automorphism is a reversible function that maps some set onto itself. In the case where relevant input vector permutations are related to the output automorphisms via group homomorphisms, it follows that if any relevant input vector permutation σ a and σ b Satisfying σ=σ a σ b , then σ is also relevant and because

[0041] As described above, an example permutation-related function is a sorting function F that receives an input vector x comprising three input elements x0, x1, x2 and outputs a vector comprising the input elements in ascending order. sort (x0, x1, x2). This function is a permutation-dependent function because it is invariant to all permutations of the input vector, i.e., it will produce the same result or output for any permutation of a set of input elements. For example, the function F sort When an input vector comprising 4, 5, and 6 is received in any order, (4, 5, 6) will be output. Another example of a permutation-related function is an index sorting function H that sorts the input elements and outputs a vector comprising an ordered list of indices. This function is a permutation-related function because it is equivariant for all input vector permutations. For example, if the function receives an input vector with three input elements, where x0 < x1 < x2, the function will output (0, 1, 2), indicating that the 0th input element is the smallest input element, the 1st input element is the middle input element, and the second input element is the largest input element. If the order of the input elements changes, the output will change accordingly. For example, if the order of x0 and x1 is swapped, the positions of 0 and 1 in the output will change accordingly (i.e., H(x1, x0, x2) = (1, 0, 2)).

[0042] Satisfy t σ An example of a permutation-related function of F(x)=F(σx) is an index function that outputs the index of a specific element in the input vector (e.g., the index of the largest element or the smallest element). When the largest element is the first element, the function may output 0; when the largest element is the second element, the function may output 1, and so on. σ Another example of a permutation correlation function of F(x)=F(σx) is h(A, C)=h((a, b), (c, d))=ab-cd, since h(A, C)=-h(σ a (A, C)) = -h (C, A), where σ aSwap the positions of two input elements A and C

[0043] Other example permutation-related functions include, but are not limited to: an average function that outputs the average of a set of input elements; a median function that outputs the median value of a set of input elements; a maximum function that outputs the maximum value of a set of input elements; a minimum function that outputs the minimum value of a set of input elements; an intersection function that determines the intersection of a set of input elements, such as a function that determines the intersection of rays or other shapes; a search function that outputs an indication of whether an element appears in a set of input elements; a counting function that counts the number of times an element appears in a set of input elements; functions related to adding or multiplying a set of input elements, such as a function that finds the dot product of multiple vectors; a function that finds the mean or standard deviation of a set of input elements; and functions that output a function associated with a permutation in a predetermined manner.

[0044] The permutation-related function may be a permutation that is true for all input vector permutations (i.e., for all σ∈Sym(n)), or it may be a permutation that is true for only a subset of the input vector permutations (i.e., for some subset of σ∈Sym(n)). For example, a ranking function is a permutation that is true for all input vector permutations because it will produce the same output regardless of the order of the input elements in the input vector. In other words, the ranking function will produce the same output for any permutation of the input vector x. An example of a function that is a permutation that is true for only a subset of the input vector permutations is the dot product: f(a, b, c, d) = ab + cd, which is a permutation that is true for the input vector permutations with a and b swapped, the input vector permutations with c and d swapped, and the input vector permutations with a and c and b and d swapped, but not for other input vector permutations (e.g., the input vector permutations with a and c swapped). Another example of a function that is a permutation that is true for only a subset of the input vector permutations is g(a, b, c, d) = ad - bc, which computes the determinant of a 2x2 matrix The input vector permutation of swapping a and d or swapping b and c does not change the output, but the input vector permutation of swapping a and b and swapping c and d will negate the output g(a, b, c, d) = bc-Ad = -(ad-bc) = -g(a, b, c, d)), so that t (ad) =t (bc) = identity mapping, and t (ab)(cd) = negation. The permutation of the input vector of a function with respect to its permutation (ie, the function produces a permutation-dependent output for the input vector and the permutation of the input vector) is referred to herein as the correlated input vector permutation E, where

[0045] like Figure 1As shown, component A100 that implements the permutation correlation function F includes hardware logic that is configured to receive an input vector x, calculate a result F(x) of the permutation correlation function F for the received input vector, and output the calculated result A(x). The symbol A(x) is used herein to indicate the output of component A in response to the input vector x. Component A operates as expected with A(x)=F(x). Similar to the symbol F(σx), the symbol A(σx) is used herein to refer to the output of component A in response to the permutation σ of the input vector x. For example, where the input vector includes three input elements, A(σ2x) is the output of component A in response to the input vector, where the order of x1 and x2 is swapped. In other words, A(σ2x)=A(σ2(x0, x1, x2))=A((x0, x2, x1)).

[0046] Now refer to Figure 2 , Figure 2 An exemplary method 200 for verifying a hardware design of a component implementing a permutation correlation function is shown. The method 200 may be performed by a computing-based device (such as, but not limited to, the following description of Figure 6 For example, there may be a computer-readable storage medium having computer-readable instructions stored thereon that, when executed on the computing-based device, cause the computing-based device to perform Figure 2 Method 200.

[0047] The method includes formally verifying that an instantiation of the hardware design produces correct results for a subset of valid input vectors; and formally verifying that the hardware design is permutation-dependent with respect to one or more input vector permutations (i.e., produces permutation-dependent outputs in response to a permutation of any input vector and the input vector in the input vector set). As described above, a set of input vector permutations with respect to which a function implemented by a component is permuted is called a permutation-dependent input vector E, where Each relevant input vector permutation is covered by a subset, or can be generated by one or more input vector permutations that have been verified. A relevant input vector permutation that is not covered by a subset is referred to herein as a relevant input vector permutation R, where R is equal to E or is a subset of E. Thus,

[0048] Method 200 begins at block 202 where a hardware design for a component implementing a permutation-related function is received.

[0049] A "hardware design" is a description of the structure and functionality of an integrated circuit that, when processed in an integrated circuit manufacturing system, enables the integrated circuit manufacturing system to produce the integrated circuit described by the hardware design. For example, as described below Figure 8As described in more detail, when a hardware design is processed in an integrated circuit manufacturing system, the integrated circuit manufacturing system can generate the integrated circuit by synthesizing the hardware design into silicon, or by loading configuration data into a field programmable gate array (FPGA).

[0050] The hardware design may be implemented using a high-level hardware description language (HDL), such as, but not limited to, a register transfer level (RTL) language. Examples of register transfer level languages ​​include, but are not limited to, VHDL (VHSIC Hardware Description Language) and It will be apparent to those skilled in the art that other high-level hardware description languages, such as proprietary high-level hardware description languages, may be used.

[0051] An "instantiation of a hardware design" is a representation of the hardware and / or hardware functionality defined by the hardware design. Instantiations of a hardware design include, but are not limited to, simulation models of the hardware design that simulate the behavior of the hardware defined by the hardware design, synthesized versions of the hardware design (e.g., netlists), hardware implementations of the hardware design (e.g., integrated circuits or field-programmable gate arrays (FPGAs)), and mathematical models of the hardware design generated by formal verification tools. An instantiation of a hardware design embodies the hardware design in a form that can be tested to verify the hardware design.

[0052] Thus, the hardware design of components implementing the permutation correlation function is a description of the structure and functionality of an integrated circuit implementing the permutation correlation function, which, when processed at an integrated circuit manufacturing system, causes the integrated circuit manufacturing system to produce an integrated circuit implementing the permutation correlation function.

[0053] Once the hardware design for the component implementing the permutation-related function is received, method 200 proceeds to block 204 .

[0054] At block 204, it is formally verified that an instantiation of the hardware design (i.e., an instantiation of the components described by the hardware design) produces correct output for a subset of valid input vectors. Specifically, if the input space representing valid input vectors x is X such that all input vectors x are elements of X (x∈X), then it is formally verified that an instantiation of the hardware design is All produces the correct result, where is a subset of X The term subset is used herein to mean a set that is smaller than the set that it consists of. The input vectors included are less than the input space X. Form a subset The input vector of can be called the base case, and the formal verification hardware design is instantiated as a subset The input vector in which the correct output is produced can be called the formal verification base case.

[0055] Select Subset So that the input space X is not in the subset All input vectors x in In other words, select the subset So that each input vector x in the input space X is in the subset Neutralize and / or subset The relevant permutation of the input vector in . Accordingly, the subset At least one input vector is included for each set of possible input elements (representing a permutation or an ordering of the set of input elements).

[0056] In some cases, subsets For each possible set of input elements x i Include only one input vector (this may be referred to herein as a minimum-sized subset ). Choose for each possible set of input elements x i Include only a subset of the input vectors Reduces the number of states that must be verified, which may allow for subsets In these cases, the subset to include all input vectors x in the input set X, where the input element x i In predetermined order.

[0057] Preferably, the subset Includes input vectors where its output is easy to deduce. A subset can be selected based on a permutation correlation function implemented by the component Tests have shown that a good subset of sorting functions is a subset of the input vector where the output is equal to the input Accordingly, for the subset of sorting functions that sort the input elements in ascending order Can contain input element x i Arrange in ascending order (i.e. x0≤x1≤…≤x n-1 ). Similarly, for a subset of sorting functions that sort the input elements in descending order, This can include sorting the input elements in descending order (i.e. x0 ≥ x1 ≥ ... ≥ x n-1 ) is the input vector.

[0058] Now refer to Figure 3 , Figure 3A diagram 300 is shown of an input space X of a sorting component A that receives an input vector x comprising two input elements x0 and x1 and outputs a vector comprising the input elements x0 and x1 in ascending order. In this example, a subset of the valid input vectors The input vector may include input elements arranged in ascending order (i.e., x0≤x1). Region 302 represents a portion of the input space X where the input elements x0 and x1 are arranged in ascending order (i.e., subset ). In the case of only two input elements, there will be two permutations, σ1(x0, x1) = (x0, x1) and σ2(x0, x1) = (x1, x0). Region 304 represents a portion of the input space X, which is represented as a subset The permutation σ2 of the input vector x in ) is the input vector x. Therefore, we can Figure 3 It can be seen that these two areas 302 and 304 Together, they cover the entire input space X, indicating that this is a proper subset It should be noted that x1=x2 falls within the region 302 and 304 The input vectors of both indicate that if the hardware design is formally verified in block 206 as a permutation with respect to permutation σ2, there will be some redundancy in the verification.

[0059] Include a subset of the input vector whose elements are in ascending or descending order It is also suitable for minimum and maximum functions that output the minimum or maximum value of the input elements, and for median functions that return the median input element in the input vector, because the correct output for this base case can be determined directly from the input vector. For example, the output of the minimum or maximum function will be the first or last input element of the input vector in ascending order. A suitable subset of search functions that indicates whether a particular element is in the input vector It can be an input vector where the particular element is the first element in the input vector, or the particular element is not in the input vector at all. A suitable subset of counting functions that counts the number of times an element appears in the input vector It can be an input vector where the element appears a predetermined number of times at the beginning of the input vector and not elsewhere. It will be apparent to those skilled in the art that these are only exemplary subsets. And other subsets can be used

[0060] In other cases, the subset It is possible to have more than the minimum number of input vectors. For example, instead of including only one subset of input vectors per set of input elements Subset Two or more input vectors can contain the same set of input elements but in a different order.

[0061] In some cases, the subset can be expanded The size of the subset with the minimum size Compared) because there is a larger subset in block 206 And it may be more efficient to verify fewer permutations of the input vector. For example, if the component implements a sort function by sorting the first half of the input elements and the second half of the input elements separately, and then merging the two halves, it may take a long time to formally verify in block 206 that the two middle input elements are transposed. This is because the differences between the two halves will propagate to the merge stage, while for other permutations (e.g., permutations involving transpositions of input elements in the same half), the differences can be eliminated after the initial sorting stage. In this example, the substitution includes a subset of the input vector whose input elements are in ascending order. Use a subset of the input vector It may be more efficient to sort the first half and the second half. For example, if the number of input elements n is even, then the subset can contain the set of input vectors x, where and

[0062] If the input element x i is unique, there will be n! permutations of a set of input elements. Because there will be only one permutation of a set of input elements that has the input elements in ascending order, the subset of the input vector that has the input elements in ascending order There will be only one input vector for each set of input elements. However, there is a set of input elements A permutation where the first half of the input elements are in ascending order and the second half of the input elements are in ascending order, so a subset where the first half of the input elements are in ascending order and the second half of the input elements are in ascending order will include each set of input elements Input vector. Because there exists a set of n! permutations of the input elements, the subset will be smaller than the input space x ((n / 2)!) 2 times, but it will be larger than a subset containing only one input vector for each set of input elements Table 1 shows the size difference of this subset relative to the input space X and the size difference of this subset relative to the subset with the smallest size.

[0063] Table 1

[0064]

[0065] Additionally or alternatively, to expand the subset The subset may also be expanded to cover the permutations verified invalid in block 206 when the permutation-related function implemented by the component is not a permutation of all possible input permutations of a set of input elements (i.e., the function is not a permutation of all σ∈Sym(n)). Specifically, in these cases, the subset may contain at least two permutations of one or more groups of input elements, wherein the at least two permutations include a permutation for which the function is not a related permutation.

[0066] In general, any permutation that is not verified in block 206 (either because the verification in block 206 is invalid or because the permutation-related function implemented by the component is not a permutation for that permutation) is represented by the subset For example, if the permutation-related function implemented by the component is not a permutation in which the first two input elements (e.g., x0 and x1) are swapped, then the subset will include the input vector (x0, x1, ..., x1) of all groups of input elements. n-1 ) and (x1,x0…x n-1 ).

[0067] As mentioned above, formal verification is a systematic process of verifying the properties of a hardware design using mathematical reasoning. In contrast, simulation-based verification is the process of testing a hardware design by applying stimuli to instantiations of the hardware design and monitoring the output of the instantiations of the hardware design in response to the stimuli.

[0068] The formally verified hardware design instantiation will respond to the subset Producing a correct output for any input vector in may include: formally verifying that one or more formal assertions are true or hold for the hardware design, and if true, determining that an instantiation of the hardware design will respond to the subset In some programming languages ​​and tools, assertions may also be called "lemmas", such as Synopsys' HECTOR.

[0069] As known to those skilled in the art, a formal assertion is a statement or expression that indicates a formal property that must be true for an instantiation of a hardware design to function as expected. An example format for a formal assertion is assertion property [FORMAL PROPERTYSTATEMENT], which indicates that FORAL PROPERTY STATEMENT must be true. Formal property statements are statements or expressions that capture the behavior of a design. For example, a formal property statement for the property that signal a of a hardware design is equal to signal b of the hardware design may be a=b. In HDL design, formal property statements are executable statements that check for specific behavior in an HDL design. Formal property statements are used to capture the required or expected temporal behavior of a hardware design instantiation in a formal and unambiguous manner.

[0070] Formal assertions are usually written in assertion languages. Assertion languages ​​(also known as property languages) capture design behavior over multiple design cycles in a concise and unambiguous way. While traditional hardware description languages ​​(HDLs) such as VHDL or Verilog RTL have the ability to capture single cycle behavior, they are too detailed to describe properties at a higher level. Specifically, assertion languages ​​provide a means to express temporal relationships and complex design behavior in a concise way. Assertion languages ​​include but are not limited to SystemVerilog Assertion (SVA), Property Specification Language (PSL), Assertion Library (IAL), OpenVera TM Assertions (OVA), Symbolic Trace Evaluation (STE), Hardware Property Language (HPL), and the Open Verification Library (OVL).

[0071] In some cases, the one or more formal assertions used to verify that an instantiation of a hardware design produces correct output for a base case may include one or more formal assertions that assert properties of the output correctness established solely from the input. For example, such assertions may be appropriate when the output of the base case is equal to all or part of the input vector. For example, if the hardware design is a component that implements a sorting function that outputs a vector containing the input elements in ascending order, and the base case includes an input vector with the input elements in ascending order, the one or more formal assertions may include an assertion that the output vector of the instantiation of the hardware design is equal to the input vector of the instantiation of the hardware design.

[0072] In other cases, the one or more formal assertions used to verify that an instantiation of a hardware design produces correct output for a base case may include one or more formal assertions that assert properties that establish the correctness of the output by comparing the output to a model of the component. Such assertions may be appropriate, for example, where the output of the base case is more complex to compute and / or where all base cases are uncommon. For example, where the hardware design is for a component that implements a multiplication function that outputs the product of its input elements, and the base case includes an input vector whose input elements are arranged in ascending order, the one or more formal assertions may include assertions that compare the output of the instantiation of the hardware design to the output of the model of the component.

[0073] Once formal assertions are established, formal verification tools can be used to formally verify that one or more formal assertions are true or valid for the hardware design. A formal verification tool is a software tool that can perform formal verification of a hardware design. Formal verification tools include, but are not limited to, formal model checkers (also known as formal property checkers), which are configured to formally verify the properties of an integrated circuit hardware design; and formal equivalence checkers, which are configured to formally verify the equivalence of two designs (e.g., two integrated circuit hardware designs, or an integrated circuit hardware design and a netlist, etc.). Examples of formal model checkers include, but are not limited to, OneSpin DV, Mentor Graphics Formal verification, VC formal verification, Enterprise Authenticator and Examples of formal equivalence checkers include, but are not limited to, HECTOR, Sequential Equivalence Checker (SEC) application along with other Logic Equivalence Checkers (LEC) and Sequential Logic Equivalence Checkers (SLEC).

[0074] In formal verification, a hardware design (e.g., a hardware design of a component that implements a permutation-related function) is converted into a mathematical model (e.g., a state transition system or a flow chart) to provide an instantiation of the hardware design that can be tested to verify the hardware design, and the formal properties to be verified (e.g., properties of assertions) are expressed using mathematical logic in a precise syntax or a language with precise mathematical syntax and semantics.

[0075] Formal verification tools verify assertions by searching the entire reachable state space of an instantiation of the hardware design (e.g., a state transition system or flow graph) without explicitly traversing all states to determine whether there are valid states of the instantiation of the hardware design (defined by formal constraints) where the asserted property is not true. For example, the search is accomplished by encoding the states using a valid Boolean encoding (using binary decision diagrams (BDDs)) or using advanced SAT (bounded model checking) based techniques. In some cases, tools can be used to implement techniques such as, but not limited to, abstraction, symmetry, symbolic indexing, and invariants to improve performance and achieve scalability. Because formal verification of assertions algorithmically and exhaustively explores all valid input values ​​over time, verifying properties in this manner allows the property to be thoroughly proved or disproven for all valid states.

[0076] Once formally verified, the instantiation of the hardware design responds to the subset If each input vector x in produces a correct output, method 200 proceeds to block 206.

[0077] At block 206, for a set K of input vectors in the input space X, an instantiation of the hardware design is formally verified with respect to each of one or more relevant input vector permutations. Specifically, for each of the one or more relevant input vector permutations σ, the instantiation of the hardware design is verified to produce permutation-dependent outputs for any input vector x and a permutation σx of that input vector in the input vector set K. The relevant input vector permutations verified in block 206 and the set K of input vectors to be verified against are selected such that for each input vector x in the input space X, the corresponding output is either explicitly verified to be correct (block 204) or is verified to be a permutation associated with the explicitly verified output (block 206).

[0078] Formal verification of an instantiation of a hardware design with respect to each of one or more relevant input vector permutations on an input vector set K may include: for each of the one or more relevant input vector permutations, formally verifying that a set of assertions are true or hold for the hardware design, and if the verification is true, determining that the instantiation of the hardware design is a permutation with respect to the input vector permutation. The formal verification that the instantiation of the hardware design is with respect to a specific relevant input vector permutation may be performed separately or in conjunction with the formal verification that the instantiation of the hardware design is with respect to another relevant input vector permutation. Specifically, the formal verification of one or more assertions corresponding to a specific input vector permutation may be performed separately, or may also be performed in conjunction with the formal verification of one or more assertions corresponding to another input vector permutation. For example, in some cases, the formal verification that the instantiation of the hardware design is with respect to different input vector permutations may be performed serially or in parallel.

[0079] In some cases, the relevant input vector permutations verified in block 206 include all relevant input vector permutations (ie, all input vector permutations σ∈R), as well as the set of input vectors verified to be a subset (Right now ). In the case where the function is such that all input vector permutations are relevant, then the relevant input vector permutations verified may include all input vector permutations. Note that in these cases, there are n! relevant permutations, and if the subset is the minimum size, then the subset This roughly involves |X| / n! input vectors, so n!|X| / n! = |X| will be verified the same number of times as during naive verification. However, these verifications may be easier for formal verification tools to complete.

[0080] In a typical application, a set R of related input permutations forms a group. In this case, for each related input vector permutation, the output of the instantiation of the verification hardware design is the same as the subset (For any ), verifies that the instantiation of the hardware design will produce permutation-dependent outputs for any input vector x and any permutation-dependent input vector σx in the subset . In other words, this verifies that Each input vector x in the output is a permutation associated with an explicitly verified output. The mathematical proof establishing this is described below.

[0081] However, verifying the instantiation of a hardware design is about subset The permutation of each relevant input vector permutation on all input vectors x in includes generating a set of one or more assertions for each relevant input vector permutation that, if true, verify that the hardware design is true with respect to that input vector permutation. Because there may be up to n! relevant input vector permutations (where n is the number of input elements), the number of assertions to be generated can quickly become unmanageable as n increases. For example, when n is 3, n! equals 6, whereas when n is 8, n! quickly jumps to 40,320.

[0082] Therefore, in other cases, the instantiation of the alternative verification hardware design is to use the subset For each relevant input vector permutation on the input vector x in the input set X, it is to be verified that the instantiation of the hardware design is a permutation of each input vector permutation in the generation set G with respect to the relevant input vector permutations on all input vectors x in the input set X. Because the generation set G typically includes only a subset of the relevant input vector permutations, verifying that the instantiation of the hardware design is a permutation with respect to the input vector permutations in the generation set G includes: verifying that the hardware design is a permutation with respect to fewer permutations, but on more input vectors (i.e., on the entire input space X rather than a subset) above).

[0083] The generating set G of input vector permutations is a set of input vector permutations φ i (For example, G = {φ i |i=1,...,m}), from which all relevant input vector permutations R can be generated. Therefore, And R is a group if it is generated as follows: the relevant input vector permutation σ can be generated by the generating set G of input vector permutations if the input vector permutation σ can be written as the input vector permutation φ in the generating set G i Specifically, the relevant input vector permutation σ can be generated by the generator set G of input vector permutations if the input vector permutation σ can be written in the following form:

[0084] For some i0...i k ∈{1,...m},s0...S k ∈{1,-1},

[0085] in, Equal to φ i ,and is φ i The inverse permutation or anti-permutation of or Keep all elements in the same order.

[0086] For each input vector permutation in the generating set G of input vector permutations, verify that the output of an instantiation of the hardware design in response to (i) any input vector x in the input space X; and (ii) the permutation of the input vector x is permutation-dependent, verify that the instantiation of the hardware design will produce permutation-dependent outputs for any input vector x and any related permutation σx of the input vector. The mathematical proof establishing this condition is described below.

[0087] In some cases, the spanning set G may consist only of adjacent transpositions. A transposition is a permutation in which two elements x in an n-element input vector are swapped. iThe position of the element i is swapped with the element i+4, and all other elements remain in the same position. An adjacent transposition is a transposition in which the positions of two adjacent elements are swapped (e.g., element i is swapped with element i+1). An adjacent transposition that swaps the i-th element and the (i+1)-th element is denoted as σ at-i (See, for example, Figure 4 ):

[0088] σ at-i x=σ at-i (x0, ..., x i-1 , x i , x i+1 , x i+2 ,...,x n-1 )=(x0,...,x i-1 , x i+1 , x i , x i+2 ,...,x n-1 )

[0089] For example, the permutation σ at-0 Swap the 0th element and the 1st element:

[0090] σ at-0 x=(x1,x0,x2,...,x n-1 )

[0091] Since adjacent permutations are minimal changes to the input vector, formal verification tools can often (though not always) efficiently prove that for any input vector x and for any vector according to the adjacent permutation σ at-i The output of the permutation of the input vector is permutation dependent.

[0092] It can be easily seen that any input vector permutation σ in Sym(n) i The set of adjacent transpositions {σ at-0 , σ at-1 ,...,σ at-n-2 For example, as mentioned above, if the input vector x includes three input elements (i.e., n=3), there are n!=6 permutations, i.e., Sym(n)={σ0,σ1,σ2,σ3,σ4,σ5}. The input vector permutation σ i Each of the can be written as a set {σ at-0 , σ at-1}, as shown below:

[0093] σ0(x0,x1,x2)=(x0,x1,x2)=σa t-i σ at-i x=x

[0094] σ1(x0,x1,x2)=(x0,x2,x1)=σ at-1 x

[0095] σ2(x0,x1,x2)=(x1,x0,x2)=σ at-0 x

[0096] σ3(x0,x1,x2)=(x1,x2,x0)=σ at-1 σ at-0 x

[0097] σ4(x0,x1,x2)=(x2,x0,x1)=σ at-0 σ at-1 x

[0098] σ5(x0,x1,x2)=(x2,x1,x0)=σ at-1 σ at-0 σ at-1 x

[0099] Specifically, the first permutation σ0 can be generated by performing any adjacent transposition twice (i.e., by swapping any two elements and then swapping them again); the second permutation σ1 can be generated by swapping the first and second elements (i.e., by performing the permutation σ at-1 ) to generate; the third permutation σ2 can be generated by swapping the 0th and 1st elements (i.e., by performing the permutation σ at-0 ) to generate; the fourth permutation σ3 can be generated by swapping the 0th and 1st elements (i.e., by performing the permutation σ at-0 ) and then swap the first and second elements (i.e., by performing a permutation σ at-1 ) to generate; the fifth permutation σ4 can be generated by swapping the first and second elements (i.e., by performing the permutation σ at-1 ) and then swap the 0th and 1st elements (i.e., by performing a permutation σ at-0 ) to generate; and the sixth permutation σ5 can be generated by swapping the first and second elements (i.e., by performing the permutation σ at-1 ), swapping the 0th and 1st elements (i.e., by performing a permutation σ at-0 ), and then swap the first and second elements (i.e., by performing a permutation σ at-1 ) to generate.

[0100] Therefore, in some cases, the generating set G may include {σ at-0 , σ at-1 ,...,σ at-n-2} (See, for example, Figure 4Verifying an instantiation of a hardware design with respect to each permutation in such a generation set involves generating and verifying a set of assertions for each of the n-1 permutations. Especially for large n, this greatly reduces the number of assertions that must be generated relative to verifying each relevant input vector permutation, since there may be as many as n! relevant input vector permutations.

[0101] Using such a spanning set also allows reducing the input vectors on which the permutation is verified to a subset of the input vectors x in the input space X, rather than all input vectors x in the input space X. Because adjacent transpositions are self-invertible (i.e. ), verify that the instantiation of the hardware design is for each adjacent transposition σ on a subset of the input vector at-i (where x i and x i+1 In ascending order (i.e. x i ≤x i+1 )) permutation, it is verified that the instantiation of the hardware design is a permutation of adjacent positions of all x in the input space X. This is because if it is proved that for all x (where x i ≤x i+1 ) in terms of A(x)=A(σ at- i x), then for any input vector x in the input set, either x i <x i+1 means it will appear on the left side of the equation, x i >x i+1 means it will appear on the right side of the equation, either x i =x i+1 =A(x)=A(σ) at-i x) can be reduced to a subset of the input vector, where x i and x i+1 It is descending order.

[0102] In other cases, the generator set G may include one or more adjacent transpositions and cyclic permutations. c) is a permutation where each element is moved to the next position and the element in the last position is moved to the 1st (or 0th) position. In other words, the 0th element is moved to the 1st position, the 1st element is moved to the 2nd position, and so on, so that the i-th element is moved to the (i+1)th position, until the (n-2)th element is moved to the (n-1)th position. The (n-1)th element is then moved to the 0th position (for example, see Figure 4 ):

[0103] σ c x=(x n-1 ,x0,x1,...,x n-2 )

[0104] It can be easily shown that any input vector permutation σ in Sym(n) i From the permutation set {σ at-0 , σ c For example, as mentioned above, if the input vector x includes three input elements (i.e., n=3), there are n!=6 permutations, i.e., Sym(n)={σ0,σ1,σ2,σ3,σ4,σ5}. Each input vector permutation σ i can be written as a combination of one or more permutations in the set {σ at-0 , σ c}, as shown below:

[0105] σ0(x0,x1,x2)=(x0,x1,x2)=σ at-0 σ at-0 x=x

[0106] σ1(x0,x1,x2)=(x0,x2,x1)=σ at-0 σ c x

[0107] σ2(x0,x1,x2)=(x1,x0,x2)=σ at-0 x

[0108] σ3(x0,x1,x2)=(x1,x2,x0)=σ c σ c x

[0109] σ4(x0,x1,x2)=(x2,x0,x1)=σ c x

[0110] σ5(x0,x1,x2)=(x2,x1,x0)=σ x σ at-0 x

[0111] Specifically, if the first permutation is the identity map, and can be obtained by performing σ at-0twice; the second permutation σ1 can be generated by looping the elements (i.e. by performing the permutation σ c ) and then swap the 0th and 1st elements (i.e., by performing a permutation σ at-0 ) to generate; the third permutation σ2 can be generated by swapping the 0th and 1st elements (i.e., by performing the permutation σ at-0 ) to generate; the fourth permutation σ3 can be generated by looping elements (ie by performing permutation σ c ) and then by looping over the elements again (i.e. by performing a permutation σ c ) to generate; the fifth permutation σ4 can be generated by looping elements (ie by performing permutation σ c ) is generated, and the sixth permutation σ5 can be generated by swapping the 0th and 1st elements (i.e., by performing the permutation σ at-0 ), and then loop over the elements (i.e., by performing a permutation σ c ) to generate.

[0112] Therefore, in some cases, the generating set G may include {σ at-0 , σ c} (See, for example, Figure 4 Verifying an instantiation of the hardware design with respect to each permutation of the input vector in such a generation set G consists of generating and verifying a set of assertions for only two permutations. This greatly reduces, especially for large n, the number of assertions that must be generated with respect to verifying each relevant input vector permutation, since there may be as many as n! relevant input vector permutations, and with respect to verifying each input vector permutation in the generation set that includes n-1 adjacent permutations. However, since formal verification tools tend to be better at verifying similar things than dissimilar things - and x will be different from σ c x is significantly different because all elements will be in different positions - some formal verification tools may not be able to effectively verify that the instantiation of the hardware design is a permutation of the loop permutation. However, this may depend on the formal verification tool and / or the configuration of the component (e.g. internal structure).

[0113] It will be apparent to those skilled in the art that these are merely exemplary generating sets and that other suitable generating sets may be used. For example, other generating sets include any adjacent transpositions (e.g., at-1 ) and cyclic permutations.

[0114] Once formal verification of an instantiation of the hardware design has been completed with respect to each of the one or more relevant input vector permutations on a set of input vectors K, method 200 may end, or method 200 may continue to block 208 .

[0115] At block 208, the formal verification tool used to perform the verification may output one or more signals indicating whether the verification was successful. For example, when using a formal verification tool to verify an assertion, the formal verification tool may output a signal indicating whether the assertion is true (i.e., the assertion property is true for all valid states or state sequences of the hardware design), which may also be referred to herein as a successfully verified assertion. The output may be: yes, the assertion is valid or successfully verified; no, the assertion is invalid (i.e., not true or fails for at least one valid state or state sequence) or not successfully verified; or the formal verification is non-summative. Formal verification may be non-summative, for example, because the computing device running the formal verification tool is out of memory, or because the formal verification tool has determined that a certain amount of progress has not been made after a predetermined time period.

[0116] If the assertion is invalid or unsuccessfully verified, the formal verification tool may also output information indicating the hardware design state or state sequence that caused the assertion to fail. For example, the formal verification tool may output a verification trace indicating at what point, state, or state sequence the failure occurred. Once a signal has been output indicating whether verification was successful, method 200 may end, or method 200 may continue to block 210.

[0117] At block 210, it may be determined whether the output signal(s) indicate successful verification. If the output signal(s) indicate successful verification, thereby indicating that the instantiation of the hardware design will work correctly for all input vectors in the input space, then method 200 may proceed to block 214, where the components defined by the hardware design are implemented in hardware. However, if the output signal(s) indicate that at least one verification was unsuccessful, thereby indicating that the instantiation of the hardware design will not work correctly for all input vectors in the input space, then method 200 may proceed to block 212, where the hardware design is modified to correct errors in the hardware design that caused the unexpected behavior. Once the hardware design has been modified, the modified hardware design may be re-verified (e.g., blocks 202-210 may be reused for the modified hardware design).

[0118] Despite Figure 2 In the exemplary method 200 , blocks 204 and 206 are performed sequentially, but in other examples, they may be performed in the reverse order (eg, block 206 may be performed before block 204 ) and / or they may be performed in parallel.

[0119] Despite Figure 2 In the exemplary method 200 of FIG. 1 , the verification described with respect to blocks 204 and 206 is performed by formal verification, but in other examples, verification can be performed by other suitable verification methods. For example, one or more verifications described with respect to blocks 204 and 206 can be performed by simulation-based verification instead.

[0120] Now refer to Figure 5 , which shows the Figure 2 The system 500 may be implemented by one or more computing-based devices, such as those described below with respect to Figure 6 The computing-based device 600. For example, Figure 5 One or more components of system 500 may be implemented as computer-readable instructions that, when executed on a computing-based device, cause the computing-based device to perform the functions of the component as described below.

[0121] System 500 includes a hardware design for a component that implements: permutation-related functions 502; a formal verification tool 504; a set of base case assertions and conditions 506; and a set of permutation assertions and conditions 508 for each input vector permutation to be verified. Depending on the format of the assertions, system 500 may also include a second instance of the hardware design 510 and / or a model of the hardware design 512. Specifically, if one or more assertions compare the output of an instantiation of the hardware design to another instantiation of the hardware design, system 500 may include the second instance of the hardware design, and if one or more assertions compare the output of an instantiation of the hardware design to the output of a model of the hardware design, system 500 may include the model of the hardware design 514. Typically, formal verification tool 504 is configured to formally verify assertions that are true for the hardware design under associated conditions using mathematical reasoning.

[0122] As described above, a hardware design is a description of the structure and functionality of an integrated circuit that, when processed in an integrated circuit manufacturing system, causes the integrated circuit manufacturing system to generate the integrated circuit described by the hardware design. Thus, the hardware designs 502, 512 for components that implement permutation-related functions are descriptions of the structure and functionality of an integrated circuit that implements the permutation-related functions. When processed in an integrated circuit manufacturing system, the descriptions cause the integrated circuit manufacturing system to generate an integrated circuit that implements the permutation-related functions.

[0123] As described above, the formal verification tool 504 is a software tool capable of performing formal verification on a hardware design. Formal verification tools include, but are not limited to, a formal model checker (which may also be referred to as a formal property checker) configured to formally verify properties of a hardware design, and a formal equivalence checker configured to formally verify the equivalence of two designs (e.g., two hardware designs, a hardware configuration and a netlist, or a hardware design and a hardware design model).

[0124] although Figure 5A single formal verification tool 504 is shown, but in other examples, the system may include multiple formal verification tools that allow formal verification of base case assertions and permutation assertions to be performed in parallel. Where there are multiple formal verification tools, all of the formal verification tools may be of the same type (e.g., all of the formal verification tools may be formal model checkers, or all of the formal verification tools may be formal equivalence checkers), or two or more of the formal verification tools may be of different types (e.g., at least one of the formal verification tools may be a formal model checker, and at least one of the formal verification tools may be a formal equivalence checker). In some cases, the formal verification tools may be of different types because, in these cases, it may be more efficient to verify certain assertions using a formal model checker and other assertions using a formal equivalence checker. For example, as described in more detail below, in some cases, it may be more efficient to verify base case assertions using a formal model checker and permutation assertions using a formal equivalence checker.

[0125] Base case assertions and conditions 506 include one or more assertions and one or more conditions under which the assertions are verified, such that if the one or more assertions are verified to be true for the hardware design under specified conditions, then the instantiation of the hardware design 502 is verified to produce correct (or expected) results for a subset of the input vectors of the input space.

[0126] In some cases, base case assertions 506 may include assertions that determine the correct properties of an output based only on the signals and / or state of a single instance of the hardware design. For example, where a component implements a function that sorts input elements in ascending order, the base case assertion may include an assertion that the output is equal to the state of the input. The following is an example of such an assertion, where there are three input elements Xi and three output elements Yi:

[0127] Assert property ((x0 == y0) && (x1 == y1) && (x2 == y2))

[0128] In these cases, formal verification involves evaluating the state of a single instance of the hardware design. Because formal model checkers are optimized to verify properties of a single design within a few clock cycles, it may be beneficial to use a formal model checker to verify such base case assertions in these cases. However, while using a formal model checker in these cases may offer certain advantages (e.g., in terms of efficiency), those skilled in the art will understand that this does not preclude the use of a formal equivalence checker to verify such base case assertions.

[0129] In other cases, base case assertions 506 may include assertions that assert a property that determines that the output of an instantiation of the hardware design is correct (or is the expected output) by comparing the output of the instantiation of the hardware design with the output of the hardware design model. The following is an example of such an assertion, where A is a component of the hardware design, M is a model of the component, and yi is an output element:

[0130] Assert property ((A.y0 == M.y0) && (A.y1 == M.y1) && (A.y2 == M.y2))

[0131] In these cases, formal verification involves comparing an instantiation of the hardware design of the component with a model of the component. Since formal equivalence checkers are designed and optimized for comparing two designs, it may be beneficial in these cases to use a formal equivalence checker to verify such base case assertions. However, while using a formal equivalence checker in these cases may provide certain advantages (e.g., in terms of efficiency), those skilled in the art will understand that this does not preclude the use of a formal model checker to verify such base case assertions. The model of a component is typically a high-level model (e.g., written in C) that simulates the behavior of the component.

[0132] For each permutation verified in block 206, there will be a set of permutation assertions and conditions 508. Each set of permutation assertions includes one or more assertions and one or more conditions under which the assertions are verified, such that if the one or more assertions are verified to be true for the hardware design under the specified conditions, then it will be verified that the instantiation of the hardware design is a permutation with respect to the input vector permutation on a set of input vectors (i.e., the hardware design produces a permutation-dependent output for any input vector and permutation of the input vector).

[0133] Permutation assertions 508 for a particular permutation may include assertions that assert a property that determines the instantiation of the hardware design with respect to the particular permutation by comparing the output of a first instantiation of the hardware design with the output of a second instantiation of the hardware design. The following is an example of such an assertion, where A1 is a component of the first instantiation of the hardware design, A2 is a component of the second instantiation of the hardware design, and yi is an output element:

[0134] Assert property ((A1.y0 == A2.y0) && (A1.y1 == A2.y1) && (A1.y2 == A2.y2))

[0135] In these cases, formal verification involves performing a comparison on two instances of the component's hardware design. Since formal equivalence checkers are designed and optimized for comparing two designs, in these cases, it may be beneficial to use a formal equivalence checker to verify such permutation assertions. However, while using a formal equivalence checker in these cases may offer certain advantages (e.g., in terms of efficiency), those skilled in the art will appreciate that this does not preclude the use of a formal model checker to verify such permutation assertions.

[0136] Each set of assertions and conditions 506, 508 is bound to an appropriate (multiple) hardware design and / or model so that the properties of the assertions can be verified. Then, the (multiple) hardware designs, models (if necessary), base case assertions and conditions, permutation assertions and conditions, and bindings are loaded into a formal verification tool (or formal verification tool). The formal verification tool is then configured to verify each set of assertions for the hardware design under associated conditions. In other words, the formal verification tool is configured to formally verify whether the base case assertions are true for the hardware design under the base case conditions; and for each set of permutation assertions, formally verify that the permutation assertions are true for the hardware design under the associated permutation conditions. In the case of multiple formal verification tools, two or more assertion verifications can be performed in parallel to shorten the time to complete the verification.

[0137] As described above, in formal verification, the hardware design is converted into a mathematical model (such as a state transition system or a flow chart) to provide an instantiation of the hardware design, which can be tested to verify the hardware design, and the formal properties to be verified (such as assertion properties) are expressed using mathematical logic, which uses a precise syntax or a language with precise mathematical syntax and semantics.

[0138] Formal assertions are verified by searching the entire reachable state space of instantiations of the hardware design (e.g., a state transition system or flow chart) without explicitly traversing all states. For example, the search is accomplished by encoding the states using efficient Boolean encodings (using binary decision diagrams (BDDs)) or using advanced SAT-based techniques (bounded model checking based on satisfiability). In some cases, tools can be used to implement techniques such as, but not limited to, abstraction, symmetry, symbolic indexing, and invariants to improve performance and achieve scalability.

[0139] When an assertion is verified using the formal verification tool 504, the formal verification tool 504 may output an indication of whether the assertion is valid (i.e., the assertion property is true for all valid states or state sequences), which may also be referred to herein as a successfully verified assertion. The output may be: yes, the assertion is valid or successfully verified; no, the assertion is invalid (i.e., not true or fails for at least one valid state or state sequence) or not successfully verified; or the formal verification is non-summative. Formal verification may be non-summative, for example, because the computing device running the formal verification tool is out of memory, or because the formal verification tool has determined that a certain amount of progress has not been made after a predetermined period of time.

[0140] In the event that an assertion is invalid or unsuccessfully verified, the formal verification tool 504 may also output information indicating the state or state sequence of the hardware design that caused the assertion to fail. For example, the formal verification tool 504 may output a trace of the verification, indicating at what point, state, or state sequence the failure occurred.

[0141] Where one of the verifications is performed via other verification methods, the system may additionally or alternatively include one or more other verification tools. For example, where one or more verifications is performed via simulation-based verification, the system may include a simulation engine.

[0142] As known to those skilled in the art, a simulation engine is a software tool that can perform simulation-based verification on a hardware design. Specifically, a simulation engine responds to each input vector (e.g., a subset) in a test set. The output of one or more instances of the hardware design is monitored (for each input vector in the hardware design) to determine a particular property (e.g., the output of the instantiation is correct with respect to the function, or the outputs of two different instantiations of the hardware design produce permuted related outputs of the related input vectors).

[0143] The simulation engine can perform simulation-based verification using any known method. For example, the simulation engine can receive a hardware design (e.g., in HDL), convert the HDL into another language (e.g., C), and perform simulation on the C code; the simulation engine can receive the hardware design as, e.g., HDL and perform simulation directly on the HDL; or the simulation engine can implement the hardware design in hardware and perform simulation on the hardware. Once the simulation is complete, the simulation engine can output an indication of whether the hardware design passed the simulation.

[0144] Mathematical Proof 1

[0145] The following is a mathematical proof, which confirms: Assume For all x∈X there exists φ∈R such that For subset For all input vectors x in the set R of relevant permutations, the formal verification A(x)=A(σx) will determine that for all input vectors x in the input space X, A(x)=A(σx).

[0146] Lemma: If for every and σ∈R, we have A(x)=A(σx), then for each x∈X and σ∈R, A(x)=A(σx).

[0147] Proof: Choose x∈X and σ∈R. There exists a permutation φ such that Let y = φx. Then x = φ -1 y and A(x)=A(φ -1 )=A(y). Similarly, there exists a permutation ψ such that Let it = ψ(σx). Then A(z) = A(ψ -1 z)=A(σx). So this is enough to prove that A(z)=A(y).

[0148] Since both y and z are permutations of x, it follows that y and z are permutations of each other: permutation τ = ψσφ -1 Because τy=z and A(y)=A(τy).

[0149] Mathematical Proof 2

[0150] The following is a mathematical proof, which determines that: for each input vector permutation ρ in the set G that generates the group of all relevant permutations R, and for all input vectors x in the input space X, the formal verification A(x) = A(ρx) will determine that for all input vectors x in the input space X, for all σ in R, A(x) = A(σx).

[0151] Lemma: For a component A and a spanning set G = {φ i |i=1,...,m}, for R, if for i=1,...,m and all x∈X, A(x)=A(φ i x), then for all σ∈R and all x∈X, A(x)=A(σx).

[0152] Proof: Since {φ i |i=1,...,m} generates R, then for some i0...i k ∈{1,...m},s0...s k ∈{1,-1}, The proof is by induction on k.

[0153] When k=0, A(x)=A(σx)=A(φ ix), for some i, σ = φ i ,or In the latter case, it can be observed that According to the assumption of the lemma: for all y, A(y)=A(φ i y), so for

[0154] Assume the result holds for all generator strings of length k As an inductive hypothesis, it follows that: And through the demonstration of the basic situation:

[0155] Test results

[0156] The following is a summary of the verification of three components A1, A2, and A2, which all implement a sorting function that receives n input elements x0 to x n-1 A1 takes an input vector x and outputs a vector of the input elements in ascending order. A2 implements a sorting function by comparing all input elements to each other and checking how many times larger each element is. A1 and A2 implement odd-even merge sort, which works by sorting subsets of the input, merging those subsets together, and then sorting them again. A1 and A3 differ in their comparison methods.

[0157] The following formal verifications were performed on each component:

[0158] · Naive Verification — We formally verify that the output of the instantiation of the component is correct for all possible input vectors x in the input space X by formally verifying that the output of the instantiation of the component is equal to the output of the C model (which works similarly to A2).

[0159] · Basic situation specifications - The results according to the specification are formally verified by formally verifying that the output of the instantiation of the component is correct (according to the specification) for all input vectors 2 with the input elements in ascending order.

[0160] · Base Case C Model —Formally verify that the output of an instantiation of the component matches the output of the C-model for all input vectors x in the input space X in ascending order of the input elements.

[0161] · Adjacent transposition ——Formally verified that for adjacent transposition σ at-0 , σ at-1 , σ at-2 , σ at-3 , σ at-4, σ at-5 , σ at-6 For each of the input vectors x in the input set X, Aj(x)=Aj(σ at-i x), where j is the number of the component being verified and the adjacent transposition σ at-i Swap the i-th and (i+1)-th input elements.

[0162] · cycle ——Formally verify that for all x in the input set X, Aj(x)=Aj(σ c x), where j is the number of the component being verified, and σ c is a cyclic permutation in which each input element is shifted by one position, and the last input element (ie, the (n-1)th input element) is shifted to the first position (ie, position zero).

[0163] · Basic situation of expansion —Formally verifies that the output of an instantiation of the component is correct (according to the specification) for all x in the input space X, where the first half of the input elements are in ascending order and the second half of the input elements are in ascending order by formally verifying the output according to the specification.

[0164] Table 2 summarizes: When there are 8 input elements (ie, n=8) and each input element x i The time (in seconds) it takes to complete each of the formal verifications listed above for each of the components A1, A2, and A3 when an 8-bit binary number is included. Note that the adjacent transposition formal verification reported in Table 2 is the average or mean time to complete for a single adjacent transposition verification. Note also that this is a representative set of completion times, and similar relationships between completion times can be seen for other numbers of input elements and other numbers of bits in the input elements. Note also that the "NA" value in Table 2 indicates that the verification was not completed in a reasonable time.

[0165] Table 2

[0166]

[0167]

[0168] Table 2 shows that the time it takes for an instantiation of the verification component to produce correct results for the base case (input vectors with input elements in ascending order) is significantly shorter than the time it takes for an instantiation of the verification component to produce correct results for all inputs. This is expected, as the number of input vectors verified in the base case verification is significantly smaller than the number of input vectors verified in the naive verification. Specifically, in the naive verification, all input vectors x in the input space X are verified, while in the base case, only those input vectors x with input elements x in ascending order are verified. The number of input elements in ascending order is roughly equal to 1 / n of the input vectors in the input space X!

[0169] Table 2 also shows that verifying whether the instantiation of the component is a permutation with respect to adjacent transpositions takes less time on average. Since there may be up to n-1 adjacent transpositions to verify, Table 2 indicates that component A2 can be verified more quickly by verifying whether the component produces the correct result for the base case and then verifying whether the component is a permutation with respect to n-1 adjacent transpositions (even if the adjacent transposition verification is performed sequentially). As for components A1 and A3, Table 2 seems to indicate that although the total time to verify whether the instantiation of the component is a permutation with respect to all adjacent transpositions may be greater than the time to complete the naive verification, if the adjacent transposition verification is performed in parallel, it can be completed in less time than the naive verification.

[0170] However, when adjacent transposition verification is corrupted by adjacent transpositions, it can be seen that some adjacent transposition verifications take much longer than others. This is shown in Table 3, which shows the time (in seconds) to complete each adjacent transposition verification of component A1 (i.e., formally verifying whether the instantiation of the component is a permutation with respect to the adjacent transposition). Note that the results for A3 are similar.

[0171] Table 3

[0172]

[0173] It can be seen that about 97% of the total time to complete the adjacent transposition verification of A1 is spent on verifying whether A1 is about the adjacent transposition σ at-3 This indicates that even if the verification of adjacent transpositions is performed in parallel, the time spent performing naive verification is longer than verifying whether the instantiation of the component is correct with respect to adjacent transpositions σ. at-3 The replacement takes less time.

[0174] We find that if there is no base case of minimum size (i.e., no base case of the input vector with the input elements in ascending order), then the set of base cases is expanded to exclude the fourth adjacent transposition σ from the generating set G of the relevant permutation group R at-3(i.e., the base case consists of an input vector where the first half of the input elements are in ascending order and the second half of the input elements are in ascending order), the fourth adjacent transposition σ at-3 The verification of does not need to be performed. As can be seen in Table 2, increasing the number of base cases in this way only increases the time to verify the correctness of the base cases against the specification from 6 seconds to 38 seconds. This reduces the fastest verification time for A1 from 13281 seconds (3 hours and 41 minutes) to 574 seconds (under 10 minutes). If the base case verification and adjacent transposition verification are performed in parallel, the verification time can be reduced to 265 seconds, which is just less than 2% of the time to complete the naive verification. This can be achieved by further expanding the base case to further include the next slowest adjacent transposition to be verified (i.e., in this case, σ at-1 ) and does not verify adjacent transpositions to reduce the time to complete the verification of A1.

[0175] Table 2 also shows that formal verification tools typically find that the instantiation permutations of the verification test components (A1, A2, and A3) are about the loop permutation σ c The difficulty of permutation. Verification of A2, which is a permutation about cyclic permutations, takes 891 seconds to complete, which is significantly longer than the naive verification for A2. The verification tool cannot even complete the verification of the cyclic permutations for A1 or A3 in a reasonable time. Similar patterns can be seen for other numbers of input elements and for input elements with another digit. Therefore, using a generation set that includes cyclic permutations does not seem to be an effective way to verify the hardware design of a component (which implements the sorting function in a similar manner to A1, A2 and / or A3). However, it can be seen from Table 2 that the ease with which a formal verification tool can complete formal verification of the property may depend on the internal structure of the component being verified, so using a generation set that includes cyclic permutations (or other complex permutations) may be effective for verifying the hardware design of a component that implements another permutation-related function or implements the sorting function in another way.

[0176] Figure 6 Various components are shown of an exemplary computing-based device 600 that may be implemented as any form of computing and / or electronic device and in which embodiments of the methods and systems described herein may be implemented.

[0177] The computing-based device 600 includes one or more processors 602, which may be microprocessors, controllers, or any other suitable type of processors for processing computer-executable instructions to control the operation of the device in order to verify the properties of the hardware design of the component that implements the permutation-related function. In some examples, for example, in the case of a system on a chip architecture, the processor 602 may include one or more fixed function blocks (also referred to as accelerators) that implement a portion of the method for verifying the hardware design of the component (implementing the permutation-related function in hardware rather than software or firmware). Platform software including an operating system 604 or any other suitable platform software may be provided on the computing-based device to enable application software (e.g., formal verification tool 504) to execute on the device.

[0178] Computer executable instructions can be provided using any computer-readable medium accessible by the computing-based device 600. For example, computer-readable media may include computer storage media, such as memory 606 and communication media. Computer storage media (i.e., non-transitory machine-readable media), such as memory 606, include volatile and non-volatile media, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information for access by a computing device. In contrast, communication media may contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transmission mechanism. As defined herein, computer storage media does not include communication media. Although computer storage media (i.e., non-transitory machine-readable media, such as memory 606) are shown within computing-based device 600, it will be appreciated that storage may be distributed or remotely located and accessed via a network or other communications link (e.g., using communications interface 608).

[0179] The computing-based device 600 also includes an input / output controller 610, which is arranged to output display information to a display device 612, which can be separate from or integrated with the computing-based device 600. The display information can provide a graphical user interface. The input / output controller 610 is also arranged to receive and process input from one or more devices, such as a user input device 614 (e.g., a mouse or keyboard). This user input can be used to initiate verification. In an embodiment, if the display device 612 is a touch-sensitive display device, it can also serve as the user input device 614. The input / output controller 610 can also output data to devices other than the display device, such as a locally connected printing device (e.g., a printer). Figure 6 not shown in the figure).

[0180] Figure 7 A computer system is shown in which component 100 can be implemented, which implements permutation-related functions. The computer system includes a CPU 702, a GPU 704, memory 706, and other devices 714, such as a display 716, a speaker 718, and a camera 720. GPU 704 is shown as containing component 100. In other examples, component 100 can be implemented in CPU 702. The components of the computer system can communicate with each other via a communication bus 722.

[0181] The components that implement the permutation-related functions described herein may be included in the hardware of an integrated circuit. Generally, any of the above functions, methods, techniques, or components may be implemented in software, firmware, hardware (e.g., fixed logic circuitry), or any combination thereof. The terms "module," "function," "component," "element," "unit," "block," and "logic" may be used herein to generally represent software, firmware, hardware, or any combination thereof. In the case of a software implementation, a module, function, component, element, unit, block, or logic represents a program code that performs a specified task when executed on a processor. The algorithms and methods described herein may be performed by one or more processors that execute code, which causes (multiple) processors to perform the algorithm / method. Examples of computer-readable storage media include random access memory (RAM), read-only memory (ROM), optical disks, flash memory, hard disk storage, and any other storage devices that may use magnetic, optical, and other technologies to store instructions or other data and that can be accessed by a machine.

[0182] As used herein, the terms computer program code and computer-readable instructions refer to any type of executable code for a processor, including code expressed in machine language, interpreted language, or scripting language. Executable code includes binary code, machine code, bytecode, code that defines an integrated circuit (e.g., hardware description language or netlist), and code expressed in programming language code (e.g., C, Java, or OpenCL). For example, executable code can be any type of software, firmware, script, module, or library that, when properly executed, processed, interpreted, compiled, or executed in a virtual machine or other software environment, causes the processor of a computer system supporting the executable code to perform the tasks specified by the code.

[0183] A processor, computer, or computer system can be any kind of device, machine, or specialized circuit, or a collection or portion thereof, that has processing capabilities that enable it to execute instructions. A processor can be any kind of general-purpose or specialized processor, such as a CPU, GPU, system on a chip, state machine, media processor, application-specific integrated circuit (ASIC), programmable logic array, field-programmable gate array (FPGA), etc. A computer or computer system can include one or more processors.

[0184] It is intended to encompass software that defines the configuration of hardware as described herein, such as HDL (Hardware Description Language), as it is used to design integrated circuits or to configure programmable chips to perform desired functions. That is, a computer-readable storage medium may be provided having computer-readable program code encoded thereon in the form of an integrated circuit definition data set (also referred to as a hardware design) that, when processed (i.e., executed) in an integrated circuit manufacturing system, configures the system to manufacture a computing device including any of the apparatus described herein. For example, the integrated circuit definition data set may be an integrated circuit description.

[0185] Thus, in an integrated circuit manufacturing system, a method of manufacturing a component for implementing the permutation-related function described herein may be provided. Furthermore, an integrated circuit definition data set may be provided that, when processed in the integrated circuit manufacturing system, causes the method of manufacturing a component for implementing the permutation-related function to be performed.

[0186] An integrated circuit definition dataset can take the form of computer code, for example, as a netlist, code used to configure a programmable chip; as a hardware description language that defines hardware suitable for fabrication in any level of integrated circuit, including, for example, register transfer level (RTL) code; as a high-level circuit representation, such as Verilog or VHDL; and as a low-level circuit representation, such as OASIS (RTM) and GDSII. A higher-level representation (e.g., RTL) that logically defines hardware suitable for fabrication in an integrated circuit can be processed in a computer system configured to generate a manufacturing definition of the integrated circuit within the context of a software environment containing definitions of circuit elements and rules for combining those elements, so as to generate a manufacturing definition of the integrated circuit defined thereby. As is typically the case with software executed on a computer system to define a machine, one or more intermediate user steps (e.g., providing commands, variables, etc.) may be required in order for the computer system configured to generate the manufacturing definition of the integrated circuit to execute the code defining the integrated circuit in order to generate the manufacturing definition of the integrated circuit.

[0187] Now about Figure 8 An example of processing an integrated circuit definition data set (eg, a hardware design) at an integrated circuit fabrication system to configure the system to fabricate components that implement permutation-related functions is described.

[0188] Figure 8 An example of an integrated circuit (IC) manufacturing system 802 is shown, configured to manufacture components that implement permutation-related functions as described in any of the examples herein. Specifically, the integrated circuit manufacturing system 802 includes a layout processing system 804 and an integrated circuit generation system 806. The IC manufacturing system 802 is configured to receive an IC definition dataset / hardware design (e.g., defining components that implement permutation-related functions as described in any of the examples herein), process the IC definition dataset, and generate an IC based on the IC definition dataset (e.g., embodying the components as described in any of the examples herein). Processing of the IC definition dataset configures the IC manufacturing system 802 to manufacture integrated circuits that embody components that implement permutation-related functions as described in any of the examples herein.

[0189] The layout processing system 804 is configured to receive and process an IC definition data set / hardware design to determine a circuit layout. For example, with respect to logic components (e.g., NAND, NOR, AND, OR, MUX, and flip-flop components), methods for determining a circuit layout from an IC definition data set are known in the art and may involve, for example, synthesizing RTL code to determine a gate-level representation of the circuit to be generated. The circuit layout can be determined from the gate-level representation of the circuit by determining location information for the logic components. This can be done automatically or with user input to optimize the circuit layout. When the layout processing system 804 determines the circuit layout, it can output a circuit layout definition to the IC generation system 806. For example, the circuit layout definition can be a circuit layout description.

[0190] As is known in the art, IC generation system 806 generates an IC based on a circuit layout definition. For example, IC generation system 806 may implement a semiconductor device manufacturing process to generate an integrated circuit, which may involve a multi-step sequence of photolithography and chemical processing steps during which electronic circuits are gradually created on a wafer made of semiconductor material. The circuit layout definition may be in the form of a mask that can be used in a photolithography process to generate an IC based on the circuit definition. Alternatively, the circuit layout definition provided to IC generation system 1006 may be in the form of computer-readable code that IC generation system 1006 can use to generate a suitable mask for generating the IC.

[0191] The various processes performed by IC manufacturing system 802 may all be performed at a single location, such as by one party. Alternatively, IC manufacturing system 802 may be a distributed system, such that some processes may be performed at different locations and by different parties. For example, some of the following stages may be performed at different locations and / or by different parties: (i) synthesizing RTL code representing an IC definition data set to form a gate-level representation of a circuit to be generated; (ii) generating a circuit layout based on the gate-level representation; (iii) generating a mask based on the circuit layout; and (iv) manufacturing the integrated circuit using the mask.

[0192] In other examples, processing of an integrated circuit definition data set in an integrated circuit manufacturing system may configure the system to manufacture components that implement permutation-related functions without requiring processing of the IC definition data set to determine a circuit layout. For example, the integrated circuit definition data set may define a configuration of a reconfigurable processor (e.g., an FPGA), and processing of the data set may configure the IC manufacturing system to generate a reconfigurable processor having the defined configuration (e.g., by loading the configuration data into the FPGA).

[0193] In some embodiments, when the integrated circuit manufacturing definition data set / hardware design is processed in the integrated circuit manufacturing system, it can cause the integrated circuit manufacturing system to generate the device as described herein. Figure 8 Configuring an integrated circuit manufacturing system from an integrated circuit manufacturing definition data set in the manner described above may enable the apparatus described herein to be manufactured.

[0194] In some examples, the integrated circuit definition data set may include software that runs on or in conjunction with hardware defined by the data set. Figure 8 In the example shown, the IC generation system can also be configured through the integrated circuit definition dataset / hardware design to: load firmware into the integrated circuit according to the program code defined in the integrated circuit definition dataset when manufacturing the integrated circuit, or otherwise provide the integrated circuit with program code for use with the integrated circuit.

[0195] In this application, embodiments of the concepts described in devices, apparatuses, modules and / or systems (and methods implemented herein) may provide performance improvements when compared to known embodiments. Performance improvements may include one or more increased computing performance, reduced latency, increased throughput and / or reduced power consumption. In the process of manufacturing such devices, apparatuses, modules and systems (e.g., in integrated circuits), performance improvements may be weighed against physical implementations to improve manufacturing methods. For example, performance improvements may be weighed against layout area to match the performance of known implementations but using less silicon. For example, this can be accomplished by reusing functional blocks in a serial manner or sharing functional blocks between elements of a device, apparatus, module and / or system. In contrast, the concepts of physical implementations of improving devices, apparatuses, modules and systems (e.g., reduced silicon area) described in this application may be weighed against improved performance. For example, this can be accomplished by manufacturing multiple instances of a module within a predefined area budget.

[0196] The applicants hereby disclose individually each individual feature described herein and any combination of two or more such features, so that according to the common general knowledge of a person skilled in the art such feature or combination can be implemented based on this specification as a whole, without considering whether such feature or combination of features solves any problem disclosed herein. In view of the above description, it will be obvious to a person skilled in the art that various modifications can be made within the scope of the invention.

Claims

1. A method of verifying a hardware design of a component implementing a permutation-related function, the component being configured to receive an input vector comprising a plurality of input elements and to generate an output based on the input vector and the function, the method comprising: verifying, at one or more processors, that an instantiation of the hardware design generates an expected output for each input vector of a subset of valid input vectors; as well as verifying, at the one or more processors, whether the hardware design is valid with respect to all input vector permutations by: formally verifying, using a formal verification tool, whether, for each of one or more input vector permutations, an instantiation of the hardware design generates a permutation-dependent output in response to any input vector in a set of valid input vectors and a permutation of the input vector, the one or more input vector permutations comprising n-1 adjacent transpositions that swap positions of two adjacent input elements, where n is the number of input elements in the input vector; Each valid input vector not in the subset of valid input vectors may be obtained by applying one or more of the one or more input vector permutations to input vectors in the subset.

2. The method according to claim 1, wherein The set of adjacent transposed valid input vectors for exchanging the positions of the i-th input element and the (i+1)-th input element includes: the input vector whose i-th input element is smaller than the (i+1)-th input element, or the input vector whose i-th input element is larger than the (i+1)-th input element.

3. The method according to claim 2, wherein: The set of valid input vectors is equal to all valid input vectors.

4. The method according to claim 1, wherein The one or more input vector permutations include z input vector permutations, and z is less than the number of relevant input vector permutations, where relevant input vector permutations are input vector permutations for which the function is permutation-dependent and not covered by the subset.

5. The method according to any one of claims 1 to 4, wherein: The subset of valid input vectors includes input vectors in which at least a portion of the input elements are in a predetermined order.

6. The method according to any one of claims 1 to 4, wherein: The subset of valid input vectors comprises at least two input vectors for at least one group of input elements.

7. The method according to any one of claims 1 to 4, wherein: Verifying that the instantiation of the hardware design generates the expected output for each input vector of the subset of valid input vectors includes: using a formal verification tool, formally verifying that the instantiation of the hardware design generates the expected output for each input vector of the subset of valid input vectors.

8. The method according to any one of claims 1 to 4, further comprising: One or more signals are outputted indicating whether the verification is successful.

9. The method according to claim 8, further comprising: In response to determining that the one or more output signals indicate that at least one verification was unsuccessful, the hardware design is modified.

10. The method according to claim 9, further comprising re-verifying the modified hardware design.

11. The method according to claim 8, further comprising: In response to determining that the one or more output signals indicate that the verification was successful, an integrated circuit including components according to the hardware design is fabricated using an integrated circuit fabrication system.

12. A system for verifying a hardware design of a component implementing a permutation-related function, the system comprising: A memory comprising: a hardware design of a component implementing the permutation-related function, the component being configured to receive an input vector comprising a plurality of input elements and to generate an output based on the input vector and the function; and one or more verification tools, including formal verification tools; and One or more processors configured to: verifying, using at least one of the one or more verification tools, that an instantiation of the hardware design generates an expected output for each input vector of a subset of valid input vectors; and Verifying that the hardware design is permutable with respect to all input vector permutations by: using the formal verification tool, for each of one or more input vector permutations, verifying that an instantiation of the hardware design generates permutation-dependent outputs for any input vector in a set of valid input vectors and a permutation of the input vector, the one or more input vector permutations comprising n-1 adjacent transpositions that swap positions of two adjacent input elements, where n is the number of input elements in the input vector; Each valid input vector not in the subset of valid input vectors may be obtained by applying one or more of the one or more input vector permutations to the input vectors in the subset.

13. A computer-readable storage medium having computer-readable code encoded thereon, the computer-readable code being configured to cause the method according to any one of claims 1 to 4 to be performed when the code is executed.

Images