Verification of Floating-Point Adders

Transcription

1 Verifiction of Floting-Point Adders Yirng-An Chen nd Rndl E. Brynt Computer cience Dept. Crnegie Mellon Univ. Pittsburgh PA Abstrct. The floting-point(fp) division bug in Intel s Pentium processor nd the overflow flg errtum of the FIT instruction in Intel s Pentium Pro nd Pentium II processor hve demonstrted the importnce nd the difficulty of verifying FP rithmetic circuits. In this pper we present the verifiction of FP dders with reusble specifictions using extended word-level MV which is improved by using the Multiplictive Power DDs (*PDDs) nd by incorporting conditionl symbolic simultion s well s short-circuiting technique. Bsed on the cse nlysis the specifictions of FP dders re divided into severl hundreds of implementtion-independent sub-specifictions. We pplied our system nd these specifictions to verify the IEEE double precision FP dder in the Auror III Chip t the University of Michign. Our system found severl design errors in this FP dder nd generted one counterexmple for ech error within severl minutes. A vrint of the corrected FP dder is creted to illustrte the cpbility of our system to hndle different FP dder designs. For ech of FP dders the verifiction tsk finished in 2 CPU hours on un UltrPARC-II server. 1 Introduction The floting-point (FP) division bug [7] in Intel s Pentium processor nd the overflow flg errtum of the FIT instruction (FP to integer conversion) [9] in Intel s Pentium Pro nd Pentium II processors hve demonstrted the importnce nd the difficulty of verifying FP rithmetic circuits nd the high cost of n rithmetic bug. FP dders re the most common units in FP processors. Modern high-speed FP dders [14 15] re very complicted becuse they require mny types of modules: right shifter for lignment left shifter for normliztion leding zero nticiptor (LZA) n dder for mntisss rounding unit etc. Exhustive simultion or forml verifiction cn be used to ensure the correctness of FP dders. Most of the IEEE FP stndrd hve been formlized by Crreño nd Miner [2] in the OL nd PV theorem provers. Theorem provers hve been used to verify rithmetic circuits [12]. owever theorem provers require users to mke use of detiled circuit knowledge nd the verifiction process for FP circuits is very tedious. Another drwbck of theorem provers is tht the proofs re implementtion-dependent. After the fmous Pentium division bug [7] Intel reserchers pplied word-level MV [6] with ybrid Decision Digrms (DDs) [5] to verify the functionlity of the FP unit in one of Intel s processors [4]. Due to the limittions of DDs the FP dder ws prtitioned into severl sub-circuits to be verified. The correctness of the overll circuit hd to be scertined mnully from the verified specifictions of the sub-circuits. This prtitioning pproch requires user interventions nd thus could be error prone. Moreover their specifictions re highly dependent on the circuit implementtions. This reserch is sponsored by the Defense Advnced Reserch Projects Agency (DARPA) under contrct number DABT63-96-C-0071.

2 The combintion of model checking nd theorem prover techniques ws used to verify IEEE double precision FP multiplier [1]. The circuit ws prtitioned into severl sub-circuits which cn be verified by model checking. The theorem prover hndled the completeness of the proofs by composing the verified specifictions. This pproch combines the strengths of both techniques. owever the proofs re still implementtiondependent. In this pper we present the verifiction of FP dders with reusble specifictions using extended word-level MV which is improved by using the Multiplictive Power DDs (*PDDs) [3] to represent the FP functions nd by incorporting conditionl symbolic simultion s well s short-circuiting technique. The specifictions of FP dders re divided into severl hundreds of sub-specifictions bsed on the signs nd the reltions of two exponents. These sub-specifictions re implementtion-independent since they use only the input nd output signls of FP dders. The concept of conditionl symbolic simultion is to perform the symbolic simultion of the circuit with some conditions to restrict the behvior of the circuit. This pproch cn be viewed s dynmiclly extrcting circuit behvior under the given conditions without modifying the ctul circuit. Cn we verify the specifictions of FP dders using conditionl forwrd simultion voiding ny use of circuit knowledge? We identify conflict of vrible orderings between the mntiss comprtor nd mntiss dder which cuses the BDD explosion in conditionl forwrd simultion. A short-circuiting technique to overcome this ordering conflict problem is presented nd integrted into word-level MV pckge. In generl this short-circuiting technique cn be used in the verifiction which only exercises prts of the circuits. We used our system nd these specifictions to verify the FP dder in the Auror III Chip [10] t the University of Michign. This FP dder is bsed on the design described in [14] nd supports IEEE double precision nd ll 4 IEEE rounding modes. In this verifiction work we verified the FP dder only in the round-to-nerest mode becuse we believe tht this is the most chllenging rounding mode for verifiction. Our system found severl design errors nd generted one counterexmple for ech error within severl minutes. A vrint of the corrected FP dder is creted nd verified to illustrte the cpbility of our system to hndle different FP dder designs. For ech of FP dders the verifiction tsk tkes 2 CPU hours for IEEE double precision. We believe tht our system nd specifictions cn be pplied to directly verify other FP dder designs nd to help finding design errors. The overflow flg errtum of the FIT instruction (FP to integer conversion) [9] in Intel s Pentium Pro nd Pentium II processors hs illustrted the importnce of verifiction of the conversion circuits which convert the dt from one formt to nother formt (e.g. IEEE single precision to double precision). ince these circuits re much simpler thn FP dders nd only hve one input opernd we believe tht our system cn be used to verify the correctness of these circuits. 2 Floting-Point Adders Let us consider the representtion of FP numbers by IEEE stndrd 754. Doubleprecision FP numbers re stored in 64 bits: 1 bit for the sign ( ) 11 bits for the exponent ( ) nd 52 bits for the mntiss ( ). The exponent is signed number represented with bis ( ) of The mntiss ( ) represents number less thn 1.

3 b 8 A E < Bsed on the vlue of the exponent the IEEE FP formt cn be divided into four cses: !#"$" 1 " /10 0 &%(')+* "- 05!#"$" -234%(')+* 1 & !#"$" 1 & 0 0 where : denotes Not--Number nd ; represents infinity. Let < 1. or 0.. Let be the number of mntiss bits including the bit on the left of the binry point nd > be number of exponent bits. For IEEE double precision 53 nd > 11.? * X * Tble 1. ummry of the FP ddition of two numbers of nd?. A represents the norml nd denorml numbers. * indictes FP invlid rithmetic opernds. Due to this encoding n opertion on two FP numbers cnnot be rewritten s n rithmetic function of two inputs. For exmple the ddition of two FP numbers F ( < ) nd G ( I < ) cn not be expressed s F + G becuse of specil cses when one of them is : or J;. Tble 1 summrizes the possible results of the FP ddition of two numbers F nd G where K represents normlized or denormlized number. The result cn be expressed s LMNO>QPIR-FT5GVU only when both opernds hve norml or denorml vlues. Otherwise the result is determined by the cse. When one opernd is ; nd the other is WX; the FP dder should rise the FP invlid rithmetic opernd exception. Figure 1. shows the block digrm of the NAP FP dder designed t tnford University [14]. As n lterntive to the NAP design the ones complementer fter the mntiss dder cn be voided if we ensure tht input Y (shown in Figure 1.) of the mntiss dder is smller thn or equl to input Z (shown in Figure 1.) when the exponent difference is 0 nd the opertion of mntiss dder is subtrction. To ensure this property mntiss comprtor nd extr circuits s shown in [15] re needed to swp the mntisss correctly. Figure 1.b shows vrint of the NAP FP dder with this modifiction (the compre unit is dded nd the ones complementer is deleted). This [ M \O:(]^ unit exists in mny modern high-speed FP dder designs [15] nd mkes the verifiction hrder described in ection 4.2. Figure 2 shows the detiled circuit of the compre unit which genertes the signl to swp the mntisss. The signl V 9 comes from the exponent subtrctor. When or nd < 1) Z is < (i.e. the mntisss re swpped). Otherwise Z is <. ` (i.e. 3 pecifictions of FP Adders In this section we focus on the generl specifictions of the FP dder especilly when both opernds hve denorml or norml vlues. For the cses in which t lest one of opernds is : or ; the specifictions cn be esily written t the bit level. For exmple when both opernds re : the expected output is c: (i.e. the exponent is ll 1s nd the mntiss is not equl to zero). The specifiction cn be expressed s the "AND" of the exponent output bits is 1 nd the "OR" of the mntiss output bits is 1.

4 F x y E x E y M x M y ubtrctor wp x y E x E y M x M y ign elect Exp. elect Encode MuxAbs Pth elect A Adder LZA Mux Right hift & ticky Bit C GR Exp. elect ign elect ubtrctor MuxAbs Pth elect Compre A Adder LZA Mux wp Right hift & ticky Bit C GR Ones Compl Encode Left hift Exp. Offset Exp. Adjust Left hift Fine Adjust Mux Exp. Offset Exp. Adjust Fine Adjust Mux out Eout Mout out Eout Mout () (b) Fig. 1. The tnford NAP FP dder () nd its vrint (b). M x < M y E x E y E x < E y d e And f Or h g Fig. 2. Detil circuit of the compre unit When both opernds hve norml or denorml vlues the idel specifiction is L MNI>QPIR-F G U. owever FP ddition hs exponentil complexity with the word size of the exponent prt for *PDDs. Thus the specifiction must be divided into severl sub-specifictions for verifiction. According to the signs of both opernds the function F G cn be rewritten s Eqution 1. imilrly for FP subtrction the function F W9G cn be lso rewritten s true ddition when both opernds hve different signs nd true subtrction when both opernds hve the sme sign. I R 2 F G RW 1U < < 2 U I R]NI^1:(P(P M>QU R 2 < W < 2 U R]NI^ N]: [ (1) M>QU 3.1 True Addition The *PDDs for the true ddition nd subtrction still grow exponentilly. Bsed on the sizes of the two exponents the function F G for true ddition cn be rewritten s: 9G RW 1U 2 R < 2 R&< R < R&< " U U &UU! where $# W #.

5 When the exponent is!" nd the mntiss is the sum of < nd < right shifted by bits (i.e. < in the eqution). # # W cn rnge from 0 to 2 W 2 but the number of mntiss bits in FP formt is only bits. M x M x M y M y L G R L G R M out M out () E x -E y <m (b) E x -E y >m Fig. 3. Cses of true ddition for the mntiss prt. Figure 3 illustrtes the possible cses of true ddition for bsed on the vlues of W. In Figure 3. for 0 W the intermedite (precise) result contins more thn bits. The right portion of the result contins L nd bits where is the lest significtion bit of the mntiss. The rounding mode will use these bits to perform the rounding nd generte the finl result(< ) in -bit formt. When W s shown in Figure 3.b the right shifted < only contributes to the intermedite result in the L nd bits. Depending the rounding mode the output mntiss will be < or < Therefore we only need one specifiction in ech rounding mode for the cses W. A similr nlysis cn be pplied to the cse. Thus the specifictions for true ddition with rounding cn be written s: " Y 1 LMNO>QPIR R W 1U 2 R&< R&< " &UU U 0 Y 2 LMNO>QPIRRW 1U 2 R&< R&< U UU " Y 3 LMNO>QPIR R W 1U 2 R < R < U UU 0 " Y 4 LMNO>QPIRRW 1U 2 R&< R < U UU where Y 1 Y 2 Y 3 nd Y 4 re YM>QP : P(P & YM>QP :(P(P & Y M>QP :(P(P & nd YM>QP :(P(P & respectively. YM>QP :(P(P represents the condition for true ddition nd exponent rnge (i.e. norml nd denorml numbers only). is composed from the outputs nd <. While building BDDs nd *PDDs for from the circuit the functionon left side of will be used to simplify the BDDs utomticlly by conditionl forwrd simultion. The number of specifictions for true ddition is 2 1. For instnce the vlue of for IEEE double precision is 53 thus the number of specifictions for true ddition is 107. ince the specifictions re very similr to one nother they cn be generted by looping construct in word-level MV. 3.2 True ubtrction The specifiction for true subtrction cn be divided into two cses: fr ( # # W 1) nd close ( W 01 or -1). For the fr cse the result of mntiss subtrction does not require mssive left shift (i.e. LZA is not ctive). imilr to the true ddition the specifictions for true subtrction cn be written s:

6 < W W W < < " Y 1 LMNO>QPIRRW 1U 2 R&< W R < &UU U 2 " Y 2 LMNI>QPORRW 1U 2 R&< R&< U UU Y 3 LMNO>QPIRRW 1U 2 R&< W R < U UU 2 " Y 4 LMNI>QPORRW 1U 2 R < W R < U U U where Y 1 Y 2 Y 3 nd Y 4 re YM>QP N & YM>QP N & YM>QP 4N & nd YM>QP 4N & respectively. YM>QP 4N represents the condition for true subtrction. For the close cse the difference of the two mntisss my generte some leding zeroes such tht normliztion is required to product result in IEEE formt. For exmple when W 0 < W < must be left shifted by W 1 bits to The number bits to left shift is computed in the Z circuit nd fed into the left shifter to perform normliztion nd into the subtrctor to djust the exponent. The number of bits to be left shifted rnges from 0 to nd is function of < nd <. The combintion of left shifting nd mntiss subtrction mke the *PDDs become irregulr nd grow exponentilly. Therefore the specifictions for these cses must be divided further to tke cre of the exponentil growth of *PDD sizes. Bsed on the number of leding zeroes in the intermedite result of mntiss subtrction the specifictions for the true subtrction close cse re divided s: " Y 1 L MNI>QPIR R W 1U 2 R&< R&< 1U U U 0 Y 2 L MNI>QPIR R W 1U 2 R < R&< 1UU U 0 Y 3 &U LMNI>QPIR RW 1U 2 R&< W < UU 1 Y 4 &U LMNI>QPIR RW 1U 2 R&< W < U U 1 where Y 1 Y 2 Y 3 nd Y 4 re YM>QP N & 1 & YM>QP 4N & 1 & YM>QP 4N & &< & nd YM>QP 4N & 1&< & respectively nd 4 represent the conditions tht the intermedite result hs leding zeroes to be left shifted nd " 4 re computed by 1 2 < WTR&< 1U < WTR&< 1U < W < 2 nd 2 < W < 2 ) respectively. A specil cse is tht the output is zero when is equl to nd < is equl to <. The specifiction is s follows: R YM>QP 4N & &< U pecifiction Coverge ince the specifictions of floting-point dders re split into severl hundred subspecifictions do these sub-specifictions cover the entire input spce? To nswer this question one might use theorem prover to check the cse splitting. In contrst we propose BDD pproch to compute the coverge of our specifictions. Our pproch is bsed on the observtion tht our specifictions re in the form " [ M>QP MN ^ \I^ [ ^ P ]^ N " nd [ M>QP is only dependent on the inputs of the circuits. Thus the union of the [ M>QP s of our specifictions which cn be computed by BDD opertions must be TRUE when our specifictions cover the entire input spce. In other words the union of the [ M>QP s cn be used to compute the percentge of input spce covered by our specifictions nd to generte the missing cses. 4 Verifiction ystem: Extended Word-Level MV with *PDDs To verify integer rithmetic circuits word-level MV [6] with DDs [5] extended MV [13] to hndle word level expressions in the specifiction formuls. For verific-

7 < tion of FP circuits we replced DDs in word-level MV with *PDDs nd introduced reltionl opertors for FP numbers. As in word-level MV only the word-level functions re represented by *PDDs nd the rest of the functions re represented by BDDs. 4.1 Conditionl ymbolic imultion We hve introduced conditionl symbolic simultion technique into word-level MV. ymbolic simultion performs the simultion with inputs hving symbolic vlues (i.e. Boolen vribles or Boolen functions). The simultion process builds BDDs for the circuits. If ech input is Boolen vrible this pproch my cuse the explosion of BDD sizes in the middle of the process becuse it tries to simulte the entire circuit for ll possible inputs t once. The concept of conditionl symbolic simultion is to perform the simultion process under restricted condition expressed s Boolen function over the inputs. In [11] Jin nd Goplkrishnn encoded the conditions together with the originl inputs s new inputs to the symbolic simultor using prmetric form of Boolen expressions but it is hrd to incorporte this pproch into word-level MV. Our pproch is to pply the conditions directly during the symbolic simultion process. Right fter building the BDD for circuit gte the condition is used to simplify the BDDs using the restrict [8] lgorithm. Then the simplified BDD is used s the input function for the gtes connected to this one. This process is repeted until the outputs re reched. This pproch cn be viewed s dynmiclly extrcting the circuit behvior under the specified condition without modifying the ctul circuit. 4.2 hort-circuiting Technique Cn we verify the specifictions of FP dders by conditionl forwrd simultion? In our experience ll specifictions for the FP dder design without mntiss comprtor s in Figure 1. cn be verified by conditionl forwrd simultion but not so for the FP dder contining mntiss comprtor s in Figure 1.b. This is cused by conflict of vrible orderings for the mntiss dder nd the mntiss comprtor which genertes the signl < (i.e. signl P in Figure 2). The best vrible ordering for the comprtor is to interleve the two vectors from the most significnt bit to the lest significnt bit (i.e ). Tble 2 shows the CPU time in seconds nd the BDD size of the signl P under different vrible orderings where ordering offset represents the number of bit offset from the best ordering. For exmple the ordering is when the ordering offset is 5. Clerly the BDD size grows exponentilly with the offset. In contrst to the comprtor the best ordering for the mntiss dder is when the exponent difference is. We observed tht the best ordering for the specifiction represented by *PDDs is the sme ordering s the best ordering for the mntiss dder. Thus the extended word-level MV cn not build the BDDs for both the mntiss comprtor nd mntiss dder by conditionl forwrd simultion when the exponent difference is lrge. Let us exmine the compre unit crefully. We find tht the signl P is used only when. In other words it is not necessry to build the BDDs for it when # # W is greter thn 0. Bsed on this fct we introduce short-circuiting technique to eliminte unnecessry computtions s erly s possible. The word-level MV nd *PDD pckges re modified to incorporte this technique. In the *PDD pckge

8 the BDD opertors such s And nd Or re modified to bort the opertion nd return specil token when the number of newly creted BDD nodes within this BDD cll is greter thn size threshold. In word-level MV for n And gte with two inputs if the first input evlutes 0 0 will be returned without building the BDDs for the second input. Otherwise the second input will be evluted. If the second input evlutes to 0 nd the first input evlutes to specil token 0 is returned. imilr technique is pplied to Or gtes with two inputs. Nnd(Nor) gtes cn be decomposed into Not nd And (Or) gtes nd use the sme technique to terminte erlier. For other logic gtes with two inputs the result is specil token if ny of the inputs evlutes to specil token. If the specil token is propgted to the output of the circuit then the size threshold is doubled nd the output is recomputed. This process is repeted until the output BDD is built. For exmple when the exponent difference is 30 the size threshold is the ordering is the best ordering of mntiss dder nd the evlution sequence of the compre unit shown in Figure 2 is P ^ nd b the vlues of signls P ^ nd b will be specil token nd 1 respectively by conditionl forwrd simultion. With these modifiction the new system cn verify ll of the specifictions for both types of FP dders by conditionl forwrd simultion. We believe tht this short-circuitingtechnique cn be generlized nd used in the verifiction which only exercises prt of the circuits. Ordering Offset BDD ize CPU Time (ec.) Tble 2. Performnce mesurements of 52-bit comprtor with different orderings. 5 Verifiction of FP Adders In this section we used the FP dder in the Auror III Chip [10] designed by Dr. uff s prt of his PhD disserttion t the University of Michign s n exmple to illustrte the verifiction of FP dders. This dder is bsed on the sme pproch s the NAP FP dder [14] t tnford University. Dr. uff found severl errors with the pproch described in [14]. This FP dder only hndles opernds with norml vlues. When the result is denorml vlue it is truncted to 0. This dder supports IEEE double precision formt nd the 4 IEEE rounding modes. In this verifiction work we verify the dder only in round to nerest mode becuse we believe tht the round to nerest mode is the hrdest one to verify. All experiments were crried out on un 248 Mz UltrPARC-II server with 1.5 GB memory. The FP dder is described in the Verilog lnguge in hierrchicl mnner. The circuit ws synthesized into flttened gte-level Verilog by Dr. John Zhong t GI. Then simple Perl script ws used to trnslte the circuit from gte-level Verilog to MV formt nd to perform ltch removl.

9 5.1 Ltch Removl uff s FP dder is pipelined two phse design with ltency of three clock cycles. We hndled the ltches during the trnsltion from gte-level Verilog to MV formt. Figure 4. shows the ltches in the pipelined two phse design. In the design phse 2 clock is the complement of the phse 1 clock. ince we only verify the functionl correctness of the design nd the FP dder does not hve ny feedbck loops the ltches cn be removed. One pproch is to direct connect the input of the ltch to the output of the ltch. This pproch will eliminte some logic circuits relted to the ltch enble signls s shown on the right side of the ltches in Figure 4.. With this pproch the correctness of these circuits cn not be checked. For exmple n design error in the circuit lwys generted 0s for the enble signls of ltches cn not be found if we use this pproch to remove the ltches. Ltch Logic Phse 1 clock And Logic Phse 1 clock Logic Logic Ltch Logic Phse 2 clock And Logic Phse 1 clock () Fig. 4. Ltch Removl. () The pipelined two phse design. (b) The design fter ltch removl. Our pproch for ltch removl is bsed on this observtion: the dt re written into the ltches when the enble signls re 1. To ensure the correctness of the circuits for the enble signls the ltches cn be replced by Z>QP gtes s shown in Figure 4.b without losing the functionl behvior of the circuit. ince phse 2 clock is the complement of the phse 1 clock we must replce the phse 2 clock by the phse 1 clock. Otherwise the circuit behvior will be incorrect. With this pproch we cn lso check the correctness of circuits for the enble signls of the ltches. 5.2 Design with Bugs During the verifiction process our system found severl design errors in uff s FP dder. These errors were not cught by rndom simultion performed by Dr. uff. The first error we found is the cse when Z Y Z Y nd the rounding logic decides to dd 1 to the lest significnt bit (i.e. the result should be Z Y 1) but the circuit design outputs A+C s the result. This error is cused by the incorrect logic in the pth select unit which ctegorized this cse s no shift cse insted of right shift by 1. While we were verifying the specifiction of true ddition our system generted counterexmple for this cse in round 50 seconds. To ensure tht this bug is not introduced by the trnsltion we hve used Cdence s Verilog simultion to verify this bug in the originl design by simulting the input pttern generted from our system. Another design error we found is in the sticky bit genertion. The sticky bit genertion is bsed on the tble given in pge 10 of Quch s pper describing the NAP FP (b)

10 dder [14]. The tble only hndles cses when the bsolute vlue of the exponent difference is less thn 54. The sticky bit is set 1 when the bsolute vlue of the exponent difference is greter thn 53 (for norml numbers only). The bug is tht the sticky bit is not lwys 1 when the bsolute vlue of the exponent difference is equl to 54. Figure 5 shows the sticky bit genertion when W 54. ince hs 52 bits the leding 1 will be the Round (L ) bit nd the sticky ( ) bit is the L of ll of bits which my be 0. Therefore n entry for the cse # # W 54 is needed in the tble of Quch s pper [14]. 1. N x 1. Ny L G R Fig. 5. ticky bit genertion when Corrected Designs After identifying the bugs we fixed the circuit in the MV formt. In ddition we creted nother FP dder by dding the compre unit in Figure 1.b into uff s FP dder. This new dder is equivlent to the FP dder in Figure 1.b since the ones complement unit will not be ctive t ny time. To verify the FP dders we combined the specifictions for both ddition nd subtrction instructions into the specifiction of true ddition nd subtrction. We use the sme specifictions to verify both FP dders. Tble 3 shows the CPU time in seconds nd the mximum memory required for the verifiction of both FP dders. The CPU time is the totl time for verifying ll specifictions. The FP dder II cn not be verified by conditionl forwrd simultion without the short-circuiting technique. The mximum memory is the mximum memory requirement of these 18 runs. For both FP dders the verifiction cn be done within two hours nd requires less thn 55 MB. Ech individul specifiction cn be verified in less thn 200 seconds. In our experience the decomposition type of the subtrhend s vribles for the true subtrction cses is very importnt to the verifiction time. For the true subtrction cses the best decomposition type of the subtrhend s vribles is negtive Dvio decomposition. If the subtrhend s vribles use the positive Dvio decomposition the *PDDs for cn not be built fter long CPU time (> 4 hours). CPU Time (ec.) Mx. Memory(MB) Cse FP dder I FP dder II FP dder I FP dder II True ddition True subtrction(fr) True subtrction (close) Tble 3. Performnce mesurements of verifiction of FP dders. FP dder I is uff s FP dder with bugs fixed. FP dder II is FP dder I with the compre unit in Figure 1.b. For true subtrction fr represent cses 1 nd close represent cses 1. For the coverge the verified specifictions cover 99.78% of the input spce for the FP dders in IEEE round-to-nerest mode. The reson for uncovered input spce (0.22%) is tht the circuit does not cused by the unimplemented fetures includes the cses of ny opernds with denorml : or ; vlues nd the cses of tht the result of the true subtrction is denorml vlue

11 Our results should not be compred with the results in [4] since the FP dders hndle difference precision nd the CPU performnce rtio of two different mchines is unknown. owever their pproch is implementtion-dependent while our pproch is implementtion-independent. 6 Conversion Circuits The overflow flg errtum of the FIT instruction(fp to integer conversion) [9] in Intel s Pentium Pro nd Pentium II processors hs illustrted the importnce of verifiction of conversion circuits [10] which convert the dt from one formt to nother. For exmple the MIP processor supports conversions between ny of the three number formts: integer IEEE single precision nd IEEE double precision. We believe tht the verifiction of the conversion circuits is much esier thn the verifiction of FP dders since these circuits re much simple thn FP dders nd only hve one opernd(i.e. less vribles thn FP dders). For exmple the specifiction of the double-to-single opertion which converts the dt from double precision to single precision cn be written s "(overflow flg expected overflow) & (not overflow flg (output expected output))" where overflow flg nd output re directly from the circuit nd expected overflow nd expected output re computed in terms of the inputs. This specifiction covers double precision which cnnot be represented in single precision. For exmple expected output is computed by LMNI>QPIR RW 1U < 2 U. imilrly expected overflow cn be computed from the inputs. For nother exmple the specifiction of the single-to-double opertion cn be written s "output input" since every number represented in single precision cn be represented in double precision without rounding(i.e. the output represents the exct vlue of input). 7 Conclusions nd Future Work We presented the verifiction of FP dders with reusble specifictions using extended word-level MV which were improved by using the Multiplictive Power DDs (*PDDs) nd by incorporting conditionl symbolic simultion s well s shortcircuiting technique. Bsed on the cse nlysis the specifictions of FP dders re divided into severl hundreds of implementtion-independent sub-specifictions. Conditionl forwrd simultion hs the dvntge of implementtion-independent specifictions. The short-circuiting technique mkes these specifictions reusble to ny implementtions of FP dders. We used our system nd reusble specifictions to verify FP dder from University of Michign. Our system found severl bugs in uff s FP dder nd generted counterexmples within severl minutes. A vrint of the corrected FP dder is creted nd verified to demonstrte the cpbility of our system to hndle different FP dder designs. For ech of FP dders the verifiction tsk finished in 2 CPU hours on un UltrPARC-II server for IEEE double precision. We believe tht our system nd specifictions cn be pplied to directly verify FP dders nd to help finding errors. The overflow flg errtum of the FIT instruction [9] in Intel s Pentium Pro nd Pentium II processors hs illustrted the importnce of verifiction of the conversion circuits which convert the dt from one formt to nother formt. ince these circuits re much simpler thn FP dders nd only hve one input opernd we believe tht our system cn be used to verify the correctness of these circuits. We pln to verify the conversion circuits in the Auror III chip.

12 % Acknowledgement We thnk Prof. Brown Dr. uff nd Mr. Riepe t University of Michign for providing us with uff s FP dder nd vluble discussions. We thnk Dr. John Zhong t GI for helping us to synthesize the FP dder into flttened gte-level Verilog. We lso thnk Bwolen Yng nd enry A. Rowley for proofreding this pper. References 1. AAGAARD M. D. AND EGER C.-J.. The forml verifiction of pipelined doubleprecision IEEE floting-point multiplier. In Proceedings of the Interntionl Conference on Computer-Aided Design (November 1995) pp CARRE O V. A. AND MINER P.. pecifiction of the IEEE-854 floting-point stndrd in OL nd PV. In igh Order Logic Theorem Proving nd Its Applictions (eptember 1995). 3. CEN Y.-A. AND BRYANT R. E. *PDD: An efficient grph representtion for floting point circuit verifiction. In Proceedings of the Interntionl Conference on Computer- Aided Design (November 1997) pp CEN Y.-A. CLARKE E. M. O P.-. OKOTE Y. KAM T. KAIRA M. O LEARY J. AND ZAO X. Verifiction of ll circuits in floting-point unit using word-level model checking. In Proceedings of the Forml Methods on Computer-Aided Design (November 1996) pp CLARKE E. M. FUJITA M. AND ZAO X. ybrid decision digrms overcoming the limittions of MTBDDs nd BMDs. In Proceedings of the Interntionl Conference on Computer-Aided Design (November 1995) pp CLARKE E. M. KAIRA M. AND ZAO X. Word level model checking Avoiding the Pentium FDIV error. In Proceedings of the 33rd ACM/IEEE Design Automtion Conference (June 1996) pp COE T. Inside the Pentium Fdiv bug. Dr. Dobbs Journl (April 1996) pp COUDERT O. AND MADRE J. C. A unified frmework for the forml verifiction of sequentil circuits. In Proceedingsof the Interntionl Conferenceon Computer-Aided Design (November 1990) pp FIER L. M. Flw reported in new intel chip. New York Times (My ) D 4: UFF T. R. Architecturl nd circuit issues for high clock rte floting-point processor. PhD Disserttion in Electricl Engineering Deprtment University of Michign (1995). 11. JAIN P. AND GOPALAKRINAN G. Efficient symbolic simultion-bsed verifiction using the prmetric form of boolen expressions. In IEEE Trnsctions on Computer-Aided Design of Integrted Circuits nd ystems (August 1994) pp LEEER M. AND O LEARY J. Verifiction of subtrctive rdix-2 squre root lgorithm nd implementtion. In Proceedings of 1995 IEEE Interntionl Conference on Computer Design: VLI in Computer nd Processors (October 1995) pp MCMILLAN K. L. ymbolic Model Checking. Kluwer Acdemic Publishers QUAC N. AND FLYNN M. Design nd implementtion of the NAP floting-point dder. Tech. Rep. CL-TR tnford University December UZUKI. MORINAKA. IROI MAKINO NAKAE Y. MAIKO K. AND UMI T. Leding-zero nticiptory logic for high-speed floting point ddition. IEEE Journl of olid-tte Circuits (August 1996) pp This rticle ws processed using the LAT E X mcro pckge with LLNC style