Our Procedure for Automatic Word Level Assertion Generation

Generation

In a typical flow for automatic assertion generation using machine learning [28], [29], [31], [34], an RTL design is simulated using random or directed tests and the simulation traces are passed as data to a machine learning engine. Bit level features and targets are selected. The learning algorithm then infers rules among features and targets from the data. Each rule corresponds to a candidate assertion for the target. Formal verification tool can be used to filter spurious assertions [29], [34].

word level assertions, we require word level predicates to be provided as features or targets. Our extension, which is shown in the dotted block in Figure 5.2, is a preprocessing step for automatic assertion generation. Phase 1 in the flow discovers word level targets. Given a discovered word level target from phase 1 or bit level target, phase 2 is responsible for discovering word level features in the logic cone of the target. The discovered word level features and targets are instrumented in the RTL code. The updated RTL is simulated and the resulting traces are provided to the learning engine to generate candidate assertions.

Features and targets

RTL source code RTL predicates instrumentation Simulation on new RTL Learning engine New RTL Traces Word level assertions Phase 1.1:

Identifying constant assignments to word level output variables

Phase 1.2: Discovering word level targets

Phase 2.2:

Simulation guided weakest precondition computation to discover

word level features Phase 2.1:

Identifying word level conditional expressions in target’s logic cone

Bit level targets

Bit level features in logic cone of target

Figure 5.2: Our procedure for automatic word level assertion generation. Our contributions, which are shown in dotted block, focus how to automatically discover word level features and targets.

5.4.1

Phase 1: Discovering Word Level Targets

In Phase 1, we first identify the target we want to generation assertions for. Bit level outputs or word level predicates on outputs are set as targets for assertion generation. For word level targets, we consider bit-vector output variables with constant assignments in the RTL code.

In the bit level assertion generation, the target bit level variable’s value is deci- phered by the machine learning algorithm itself. Bit level variables can have one

of two values: 0 and 1. Therefore the two propositions in the consequent for any bit level target variable t are (t = 0) and (t = 1). The machine learning algorithm thus deciphers the bit level predicate. However, at the word level, the variables are bit-vectors and can have many possible values. Deciphering all these values by a machine learning algorithm may lead to too many assertions, many of which could be spurious or irrelevant to the design. Hence, we provide the word level predicate itself as a target to the learning algorithm. In other words, the word level variable along with its intended value is given as a proposition. Consequently, the learning algorithm does not need to decipher the value of the word level variable.

We analyze all assignments to each word level output variable in RTL code. If all the assignments assign constant values to the word level output, we then produce the word level predicate as a target encoding whether the word level variable is equal to the assigned constant. In Figure 5.1, alu op = ‘ALU N OP , alu op = ‘ALU IM M , alu op = ‘ALU OR and alu op = ‘ALU ADD can all be word level targets.

5.4.2

Phase 2: Discovering Word Level Features

In Phase 2, we discover all the word level features that are in the logic cone of the target from Phase 1. Phase 2 has two subphases. The first subphase identifies all word level conditional expressions within the logic cone of the target from the RTL code. These expressions are set as word level predicates. However, they may not be in terms of primary inputs. Therefore, the second subphase uses a simulation guided weakest precondition computation to discover all word level features in terms of the primary inputs from the word level predicates. This phase will be elaborated in section 5.5.

It should be noted that the variable, which is in target’s logic cone but not used by any discovered word level feature, should also be output as feature. Moreover, if a word level variable is already used by a discovered word level feature, some bits of the variable may be selected as features. The reason is that our method is based on the simulation, which may fail to cover all potential features.

5.4.3

Data Generation and Learning Algorithm

After the discovery of the word level targets and features, every bit of the corre- sponding word level variable will be hidden from the learning algorithm. To get the concrete simulation values of these features and targets for learning engine, we instrument them back to RTL code and rerun the simulation. The new simulation traces are then provided to learning engine.

The machine learning algorithm tries to infer a logical relationship between the target and features from simulation traces. Our word level feature or target discov- ery approach is independent of the machine learning algorithm. We use a decision tree based learning algorithm from GoldMine [29].

b1: rst|flushpipe b2: id_insn<={6’h… b3: !id_freeze b4: id_insn<=if_insn b5: id_insn<=id_insn b6: b7: b8: rst b9: alu_op<=`ALU_NOP b10: !ex_freeze&id… b11: alu_op<=`ALU_NOP b12: !ex_freeze b14: alu_op<=`ALU_NOP b19: b13: id_insn[31:26] b15: `OR32_J b17: alu_op<=`ALU_IMM b16: `OR32_ORI b18: alu_op<=`ALU_OR … CDFG1 CDFG2

Concrete path in cycle 1

Concrete path in cycle 2

UD chain id_insn

b2 b4 b5

...

...

Figure 5.3: Data structures for weakest precondition computation. The data structures are used for logic cone identification and simulation guided weakest precondition computation. The bold arrow lines show the concrete paths during simulation.