[PPT] - VERIFYING LARGE MULTIPLIERS BY COMBINING SAT AND COMPUTER ALGEBRA PowerPoint Presentation

SLIDE 1

VERIFYING LARGE MULTIPLIERS BY COMBINING SAT AND COMPUTER ALGEBRA

Daniela Kaufmann, Armin Biere and Manuel Kauers

Johannes Kepler University Linz, Austria

FMCAD 2019

October 23, 2019

San Jose, CA, USA

SLIDE 2

Circuits

Given: Gate-level multiplier for fixed bit-width n. Question: For all possible ai, bi ∈ B : (2a1 + a0) ∗ (2b1 + b0) = 8s3 + 4s2 + 2s1 + s0? Verification Techniques SAT using CNF encoding Binary Moment Diagrams (BMD) Algebraic reasoning a1b1 a0b1 a1b0 a0b0 g1 g2 g3 g4 s0 s1 s2 s3

1

SLIDE 3

Basic Idea of Algebraic Approach

Multiplier

a1 b1 a0 b1 a1 b0 a0 b0 g1 g2 g3 g4 s0 s1 s2 s3

Polynomials

B = { x − a0 ∗ b0, y − a1 ∗ b1, s0 − x ∗ y, . . . }

Specification

2n−1

i=0

2isi− n−1

i=0

2iai n−1

i=0

2ibi

Ideal Membership Test

= 0 ✗ = 0 ✓

2

SLIDE 4

Contributions

1. Modular Reasoning
2. Combine SAT and Computer Algebra
3. Preprocessing Techniques
4. Tool: AMULET

3

SLIDE 5

Multiplier Specification

Unsigned integers: Un =

2n−1

i=0

2isi − n−1

i=0

2iai n−1

i=0

2ibi

∈ Z[X]

4

SLIDE 6

Multiplier Specification

Unsigned integers: Un =

2n−1

i=0

2isi − n−1

i=0

2iai n−1

i=0

2ibi

∈ Z[X]

Signed integers: Sn = −22n−1s2n−1 +

2n−2

i=0

2isi −

−2n−1an−1 +

n−2

i=0

2iai

−2n−1bn−1 +

n−2

i=0

2ibi

∈ Z[X]

4

SLIDE 7

Multiplier Specification

Unsigned integers: Un =

2n−1

i=0

2isi − n−1

i=0

2iai n−1

i=0

2ibi

∈ Z[X]

Signed integers: Sn = −22n−1s2n−1 +

2n−2

i=0

2isi −

−2n−1an−1 +

n−2

i=0

2iai

−2n−1bn−1 +

n−2

i=0

2ibi

∈ Z[X]

Truncated multiplication of integers: Tn =

2n−1

i=0

2isi − n−1

i=0

2iai n−1

i=0

2ibi

∈ Z2n[X]

4

SLIDE 8

Circuit Polynomials

Gate polynomials G(C).

s3 = g1 ∧ g4 −s3 + g1g4, s2 = g1 ⊕ g4 −s2 + g1 + g4 − 2g1g4, g4 = g2 ∧ g3 −g4 + g2g3, s1 = g2 ⊕ g3 −s1 + g2 + g3 − 2g2g3, g1 = a1 ∧ b1 −g1 + a1b1, g2 = a0 ∧ b1 −g2 + a0b1, g3 = a1 ∧ b0 −g3 + a1b0, s0 = a0 ∧ b0 −s0 + a0b0

Boolean value constraints B0(C).

a1, a0 ∈ B a1(1 − a1), a0(1 − a0), b1, b0 ∈ B b1(1 − b1), b0(1 − b0)

a1b1 a0b1 a1b0 a0b0 g1 g2 g3 g4 s0 s1 s2 s3

5

SLIDE 9

Ideals

Ideal. Let R be a ring. A nonempty subset I ⊆ R[X] is called an ideal if

∀ p, q ∈ I : p + q ∈ I and ∀ p ∈ R[X] ∀ q ∈ I : pq ∈ I Ideal membership test. Given a polynomial q ∈ R[X] and a (finite) set of polynomials P ⊆ R[X], decide whether q ∈ P, where P is the smallest ideal containing all elements

f P, also known as the ideal generated by P.

Un ∈ G(C) ∪ B0(C) ⊆ Z[X] Sn ∈ G(C) ∪ B0(C) ⊆ Z[X] Tn ∈ G(C) ∪ B0(C) ⊆ Z2n[X]

6

SLIDE 10

Ideals

Ideal. Let R be a ring. A nonempty subset I ⊆ R[X] is called an ideal if

∀ p, q ∈ I : p + q ∈ I and ∀ p ∈ R[X] ∀ q ∈ I : pq ∈ I Ideal membership test. Given a polynomial q ∈ R[X] and a (finite) set of polynomials P ⊆ R[X], decide whether q ∈ P, where P is the smallest ideal containing all elements

f P, also known as the ideal generated by P.
UMLT. Let P ⊆ R[X]. If for a certain term order, all leading terms of P only consist of a

single variable with exponent 1 and are unique and further lc(p) ∈ R× for all p ∈ P, then we say P has unique monic leading terms.

6

SLIDE 11

Soundness and completeness

P ⊢R q ⇐ ⇒ q ∈ P + B0(P) P | =R q ⇐ ⇒ ∀ϕ : ∀p ∈ P : ϕ(p) = 0 ⇒ ϕ(q) = 0

Theorem (Soundness)

Let P ⊆ R[X] be a finite set of polynomials with UMLT and q ∈ R[X], then P ⊢R q ⇒ P | =R q.

Theorem (Completeness)

Let P ⊆ R[X] be a finite set of polynomials with UMLT. Then for every q ∈ R[X] we have P | =R q ⇒ P ⊢R q.

7

SLIDE 12

Modular reasoning

Previous work: Q[X] unsigned integers contains Z[X] Q is a field Gröbner basis theory Now: Zl[X] for l ∈ N truncated multiplication elimination of monomials

8

SLIDE 13

Modular reasoning

Unsigned integers: Un =

2n−1

i=0

2isi − n−1

i=0

2iai n−1

i=0

2ibi

∈ Z22n[X]

Signed integers: Sn = −22n−1s2n−1 +

2n−2

i=0

2isi −

−2n−1an−1 +

n−2

i=0

2iai

−2n−1bn−1 +

n−2

i=0

2ibi

∈ Z22n[X]

Truncated multiplication of integers: Tn =

n−1

i=0

2isi −

n−1

i=0

n−1−i

j=0

2i+jaibj ∈ Z2n[X]

8

SLIDE 14

Modular reasoning

Previous work: Q[X] unsigned integers contains Z[X] Q is a field Gröbner basis theory Now: Zl[X] for l ∈ N truncated multiplication elimination of monomials Z[X] Z is a principal ideal domain D-Gröbner basis theory

8

SLIDE 15

D-Gröbner basis

Gröbner bases theory, where coefficient domains D are PIDs. Offers decision procedure (D-reduction) for ideal membership test in D[X]. Let q ∈ D[X] and P ⊆ D[X] : q ∈ P ⇔ q

P

− → 0 Every ideal of D[X] has a D-Gröbner basis. There is an (expensive) algorithm which, given an arbitrary basis of an ideal, computes a D-Gröbner basis.

9

SLIDE 16

D-Gröbner basis applied to circuit verification

Theorem

Let R be a PID and let G(C) ∪ B0(C) ⊆ R[X] have UMLT. Then G(C) ∪ B0(C) is a D-Gröbner basis of G(C) ∪ B0(C) ⊆ R[X].

10

SLIDE 17

D-Gröbner basis applied to circuit verification

Theorem

Let R be a PID and let G(C) ∪ B0(C) ⊆ R[X] have UMLT. Then G(C) ∪ B0(C) is a D-Gröbner basis of G(C) ∪ B0(C) ⊆ R[X]. We want R = Zl for l ∈ N. Zl is not a PID. Z is a PID.

10

SLIDE 18

D-Gröbner basis applied to circuit verification

Theorem

Let R be a PID and let G(C) ∪ B0(C) ⊆ R[X] have UMLT. Then G(C) ∪ B0(C) is a D-Gröbner basis of G(C) ∪ B0(C) ⊆ R[X]. We want R = Zl for l ∈ N. Zl is not a PID. Z is a PID.

Lemma

Let l ∈ N and let G(C) ∪ B0(C) ⊆ Z[X] have UMLT. Then G(C) ∪ B0(C) ∪ {l} is a D-Gröbner basis of G(C) ∪ B0(C)+l ⊆ Z[X].

10

SLIDE 19

Correspondence lemma

Lemma

Let l ∈ N and let I ⊆ Z[X] be an ideal. There is a bijective correspondence from q ∈ I + l ⊆ Z[X] to [q] ∈ {[p] | p ∈ I} ⊆ Z[X]/l, where [q] is the equivalence class of q. Furthermore Z[X]/l ∼ = Zl[X].

11

SLIDE 20

Simple Multiplier with Ripple-Carry Adder

2 IN1[0] 4 IN1[1] 6 IN1[2] 8 IN1[3] 10 IN1[4] 12 IN1[5] 14 IN1[6] 16 IN1[7] 18 IN2[0] 20 IN2[1] 22 IN2[2] 24 IN2[3] 26 IN2[4] 28 IN2[5] 30 IN2[6] 32 IN2[7] 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 82 84 86 88 90 92 94 96 98 100 102 104 106 108 110 112 114 116 118 120 122 124 126 128 130 132 134 136 138 140 142 144 146 148 150 152 154 156 158 160 162 164 166 168 170 172 174 176 178 180 182 184 186 188 190 192 194 196 198 200 202 204 206 208 210 212 214 216 218 220 222 224 226 228 230 232 234 236 238 240 242 244 246 248 250 252 254 256 258 260 262 264 266 268 270 272 274 276 278 280 282 284 286 288 290 292 294 296 298 300 302 304 306 308 310 312 314 316 318 320 322 324 326 328 330 332 334 336 338 340 342 344 346 348 350 352 354 356 358 360 362 364 366 368 370 372 374 376 378 380 382 384 386 388 390 392 394 396 398 400 402 404 406 408 410 412 414 416 418 420 422 424 426 428 430 432 434 436 438 440 442 444 446 448 450 452 454 456 458 460 462 464 466 468 470 472 474 476 478 480 482 484 486 488 490 492 494 496 498 500 502 504 506 508 510 512 514 516 518 520 522 524 526 528 530 532 534 536 538 540 542 544 546 548 550 552 554 556 558 560 562 564 566 568 570 572 574 576 578 580 582 584 586 588 590 592 594 596 598 600 602 604 606 608 610 612 614 616 618 620 622 624 626 628 630 632 634 636 638 640 642 644 646 648 650 652 654 656 658 660 662 664 666 668 670 672 674 676 678 680 682 684 686 688 690 692 694 696 698 700 702 704 706 708 710 712 714 716 718 720 722 724 726 728 730 732 734 736 738 740 742 744 746 748 750 752 754 756 758 760 762 764 766 768 770 772 774 776 778 780 782 784 786 788 790 792 794 796 798 800 802 804 806 808 810 812 814 816 818 820 822 824 826 828 830 832 834 836 838 840 842 844 846 848 850 852 854 856 858 860 862 864 866 868 870 872 874 876 878 880 882 884 886 888 890 892 894 896 898 900 902 904 906 908 910 912 914 916 918 920 922 924 926 928 930 932 934 936 938 940 942 944 946 948 950 952 954 956 958 960 962 964 966 968 970 972 974 976 978 980 982 984 986 988 990 992 994 996 998 1000 1002 1004 1006 1008 1010 1012 1014 1016 1018 1020 1022 1024 1026 1028 1030 1032 1034 1036 1038 1040 1042 1044 1046 1048 1050 1052 1054 1056 1058 1060 1062 1064 1066 1068 1070 1072 1074 1076 1078 1080 1082 1084 1086 1088 1090 1092 1094 1096 1098 1100 1102 1104 1106 1108 1110 1112 1114 1116 1118 1120 1122 1124 1126 1128 1130 1132 1134 1136 1138 1140 1142 1144 1146 1148 1150 1152 1154 1156 1158 1160 1162 1164 1166 1168 1170 1172 1174 1176 1178 1180 1182 1184 1186 1188 1190 1192 1194 1196 1198 1200 1202 1204 1206 1208 1210 1212 1214 1216 1218 1220 1222 1224 1226 1228 1230 1232 1234 1236 1238 1240 1242 1244 1246 1248 1250 1252 1254 1256 1258 1260 1262 1264 1266 1268 1270 1272 1274 1276 1278 1280 P[0] P[1] P[2] P[3] P[4] P[5] P[6] P[7] P[8] P[9] P[10] P[11] P[12] P[13] P[14] P[15]

12

SLIDE 21

Complex Multiplier with Generate-and-Propagate Adder

2 IN1[0] 4 IN1[1] 6 IN1[2] 8 IN1[3] 10 IN1[4] 12 IN1[5] 14 IN1[6] 16 IN1[7] 18 IN2[0] 20 IN2[1] 22 IN2[2] 24 IN2[3] 26 IN2[4] 28 IN2[5] 30 IN2[6] 32 IN2[7] 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 82 84 86 88 90 92 94 96 98 100 102 104 106 108 110 112 114 116 118 120 122 124 126 128 130 132 134 136 138 140 142 144 146 148 150 152 154 156 158 160 162 164 166 168 170 172 174 176 178 180 182 184 186 188 190 192 194 196 198 200 202 204 206 208 210 212 214 216 218 220 222 224 226 228 230 232 234 236 238 240 242 244 246 248 250 252 254 256 258 260 262 264 266 268 270 272 274 276 278 280 282 284 286 288 290 292 294 296 298 300 302 304 306 308 310 312 314 316 318 320 322 324 326 328 330 332 334 336 338 340 342 344 346 348 350 352 354 356 358 360 362 364 366 368 370 372 374 376 378 380 382 384 386 388 390 392 394 396 398 400 402 404 406 408 410 412 414 416 418 420 422 424 426 428 430 432 434 436 438 440 442 444 446 448 450 452 454 456 458 460 462 464 466 468 470 472 474 476 478 480 482 484 486 488 490 492 494 496 498 500 502 504 506 508 510 512 514 516 518 520 522 524 526 528 530 532 534 536 538 540 542 544 546 548 550 552 554 556 558 560 562 564 566 568 570 572 574 576 578 580 582 584 586 588 590 592 594 596 598 600 602 604 606 608 610 612 614 616 618 620 622 624 626 628 630 632 634 636 638 640 642 644 646 648 650 652 654 656 658 660 662 664 666 668 670 672 674 676 678 680 682 684 686 688 690 692 694 696 698 700 702 704 706 708 710 712 714 716 718 720 722 724 726 728 730 732 734 736 738 740 742 744 746 748 750 752 754 756 758 760 762 764 766 768 770 772 774 776 778 780 782 784 786 788 790 792 794 796 798 800 802 804 806 808 810 812 814 816 818 820 822 824 826 828 830 832 834 836 838 840 842 844 846 848 850 852 854 856 858 860 862 864 866 868 870 872 874 876 878 880 882 884 886 888 890 892 894 896 898 900 902 904 906 908 910 912 914 916 918 920 922 924 926 928 930 932 934 936 938 940 942 944 946 948 950 952 954 956 958 960 962 964 966 968 970 972 974 976 978 980 982 984 986 988 990 992 994 996 998 1000 1002 1004 1006 1008 1010 1012 1014 1016 1018 1020 1022 1024 1026 1028 1030 1032 1034 1036 1038 1040 1042 1044 1046 1048 1050 1052 1054 1056 1058 1060 1062 1064 1066 1068 1070 1072 1074 1076 1078 1080 1082 1084 1086 1088 1090 1092 1094 1096 1098 1100 1102 1104 1106 1108 1110 1112 1114 1116 1118 1120 1122 1124 1126 1128 1130 1132 1134 1136 1138 1140 1142 1144 1146 1148 1150 1152 1154 1156 1158 1160 1162 1164 1166 1168 1170 1172 1174 1176 1178 1180 1182 1184 1186 1188 1190 1192 1194 1196 1198 1200 1202 1204 1206 1208 1210 1212 1214 1216 1218 1220 1222 1224 1226 1228 1230 1232 1234 1236 1238 1240 1242 1244 1246 1248 1250 1252 1254 1256 1258 1260 1262 1264 1266 1268 1270 1272 1274 1276 1278 1280 1282 1284 1286 1288 1290 1292 1294 1296 1298 1300 1302 1304 1306 1308 1310 1312 1314 1316 1318 1320 1322 1324 1326 1328 1330 1332 1334 1336 1338 1340 1342 1344 1346 1348 1350 1352 1354 1356 1358 1360 1362 1364 1366 1368 1370 1372 1374 1376 1378 1380 1382 1384 1386 1388 1390 1392 1394 1396 1398 1400 1402 1404 1406 1408 1410 1412 1414 1416 1418 1420 1422 1424 1426 1428 1430 1432 1434 1436 1438 1440 1442 1444 1446 1448 1450 1452 1454 1456 1458 1460 1462 1464 1466 1468 1470 1472 1474 1476 1478 1480 1482 1484 1486 1488 1490 1492 1494 1496 1498 1500 1502 1504 1506 1508 P[0] P[1] P[2] P[3] P[4] P[5] P[6] P[7] P[8] P[9] P[10] P[11] P[12] P[13] P[14] P[15]

13

SLIDE 22

Complex Multiplier with Generate-and-Propagate Adder

13

SLIDE 23

Complex Multiplier with Generate-and-Propagate Adder

13

SLIDE 24

OR Gates

= o2 ∨ x0

−o + o2 + x0 − o2x0,

2 = o1 ∨ x1

−o2 + o1 + x1 − o1x1,

1 = x3 ∨ x2

−o1 + x3 + x2 − x3x2

x3

1
2

x2 x1 x0

14

SLIDE 25

OR Gates

= o2 ∨ x0

−o + o2 + x0 − o2x0,

2 = o1 ∨ x1

−o2 + o1 + x1 − o1x1,

1 = x3 ∨ x2

−o1 + x3 + x2 − x3x2

x3

1
2

x2 x1 x0

= x0 + x1 − x0x1 + x2 − x0x2 − x1x2 + x0x1x2 + x3 − x0x3 − x1x3 + x0x1x3 − x2x3 + x0x2x3 +

x1x2x3 − x0x1x2x3 15 = 24 − 1 monomials

14

SLIDE 26

Adder Substitution

Partial Product Generation

Partial Product Accumulation

Final Stage Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1 Adder substitution

Partial Product Generation

Partial Product Accumulation

Ripple Carry Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1

15

SLIDE 27

Adder Substitution

SAT

Partial Product Generation

Partial Product Accumulation

Final Stage Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1 Adder substitution

Partial Product Generation

Partial Product Accumulation

Ripple Carry Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1

15

SLIDE 28

Adder Substitution

SAT Computer Algebra

Partial Product Generation

Partial Product Accumulation

Final Stage Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1 Adder substitution

Partial Product Generation

Partial Product Accumulation

Ripple Carry Adder

an−1, . . . , a0 bn−1, . . . , b0 xm ym . . . x0 y0 cin sk . . . s0 sk+1 . . . s2n−2 s2n−1 s′ . . . s′

m

cm+1

15

SLIDE 29

Adder Substitution

Generate-and-Propagate Adder

xm ym . . . x0 y0 cin s′ . . . s′

m

cm+1

s′

i = pi ⊕ ci

pi = xi ⊕ yi ci = (xi−1 ∧yi−1)∨(ci−1 ∧pi−1)

16

SLIDE 30

Adder Substitution

Generate-and-Propagate Adder

xm ym . . . x0 y0 cin s′ . . . s′

m

cm+1 sk+1 . . . s2n−2 s2n−1

s′

i = pi ⊕ ci

pi = xi ⊕ yi ci = (xi−1 ∧yi−1)∨(ci−1 ∧pi−1) Algorithm: Identifying GP adders in AMULET

Input : Circuit C in AIG format Output: Determine whether C might contain a GP adder

1 j ← 2n − 2, τ ← 1; 2 while τ and j ≥ 0 do 3

τ, cj, pj ← Check-if-XOR-and-Identify-pj-and-cj (sj);

4

xj, yj ←Declare-Adder-Inputs (pj, τ);

5

j ← j − 1;

6 end 7 cin ← cj; 8 for i ← j to 2n − 1 do 9

m ← Follow-and-Mark-Paths(si);

10 end 11 return m = 0

16

SLIDE 31

SAT

Bitlevel Miter 1

Generate-and-Propagate Adder

xm ym . . . x0 y0 cin

s0

. . .

sm cm+1

Ripple Carry Adder

xm ym . . . x0 y0 cin

s′

. . .

s′

m

c′

m+1

AIG is translated to CNF. CNF is given to SAT solver. To show correctness SAT solver needs to return UNSAT.

17

SLIDE 32

Computer Algebra

a0b0 a0b1 a1b0 a1b1 p00 p01 p10 p11 c1 c2 s0 s1 s2 s3

G0 G1 G2 G3 C0 C1 C2 C3 C4

Algorithm: Verification flow in AMULET

Input : Substituted circuit C in AIG format Output: Determine whether C is a multiplier

1 for i ← 0 to 2n − 1 do 2

Si ← Define-Cone-of-Influence(i);

3

Order (Si);

4

Search-for-Booth-Encoding (Si);

5

Local-Elimination (Si);

6 end 7 Global-Elimination (); 8 C0 ← Incremental-Reduction ();

FMCAD’17

9 return C0 = 0

18

SLIDE 33

Variable Elimination

Local Elimination iterate over each slice eliminate leading variable if it only

ccurs in one other polynomial

inside the slice repeat until all leading variables are either contained in other slices or

ccur in multiple polynomials

subsumes “Adder-Rewriting”, “XOR-Rewriting”, “Common-Rewriting”. Global Elimination eliminate marked variables found in “Search-for-Booth-Encoding()” need to consider all slices

19

SLIDE 34

Incremental Reduction

Computer Algebra System Too general for our purpose. Reduction Engine: AMULET Designed to make use of UMLT property. D-reduction amounts to substitution. On-the-fly reduction of Boolean value constraints. On-the-fly generation of proof certificates in PAC format1.

1D. Ritirc, A. Biere, M. Kauers. A Practical Polynomial Calculus for Arithmetic Circuit Verification. In SC2, 2018.

20

SLIDE 35

Tool Flow

Verify AMULET substition AMULET verify CADICAL

SAT solver

.aig .cnf ✗ | ✓ ✗ | ✓ .aig Certify Check AMULET substitution AMULET certify CADICAL

SAT solver

PACTRIM

Proof checker

DRAT-TRIM

Proof checker

.aig .cnf .proof .polys .pac .spec .aig ✗ | ✓ ✗ | ✓ ✗ | ✓

21

SLIDE 36

Verification Time

Verify MGD CSYY KBK

architecture

n

SPEC nosub nomod noelim sub cnf aig tot

DAC19 TCAD19 FMSD19 sp-ar-rc 64 u 1 1 2 1 1 NA2 11 sp-dt-lf 64 u TO 1 3 2 2 31 NA3 TO sp-wt-cl 64 u TO TO 3 9 1 11 96 NA3 TO sp-bd-ks 64 u TO TO 2 1 1 3 162 NA3 TO sp-ar-ck 64 u TO 1 2 1 1 143 NA3 TO bp-ar-rc 64 u 1 TO 118 1 1 53 NA3 TO bp-ct-bk 64 u TO TO 100 1 2 119 NA3 TO bp-os-cu 64 u 2 TO TO 2 2 95 NA3 TO bp-wt-cs 64 u 1 TO 114 1 1 75 NA3 TO sp-ar-rc 64 s 1 1 2 1 1 NA1 NA1 bp-wt-cl 64 s TO 3 109 10 1 11 NA1 NA3 NA1 btor 64 t NA3 1 1 NA1 NA1 NA1

time in sec NA1: tool not applicable to type SPEC NA2: tool not yet available NA3: incompleteness TO: 3600 sec 22

SLIDE 37

Verification and Certification Time

Verify Certify Check proof size

architecture

n

SPEC sub cnf aig tot

sub cnf aig tot cnf aig tot total cnf aig sp-ar-rc 64 u 1 1 2 2 3 3 5 0 188 290 sp-dt-lf 64 u 2 2 2 3 3 3 6 34 423 186 170 sp-wt-cl 64 u 9 1 11 9 2 12 7 3 10 21 264 471 191 623 sp-bd-ks 64 u 1 1 3 2 2 4 1 3 4 8 78 567 190 915 sp-ar-ck 64 u 1 1 2 2 3 3 5 1 432 187 251 bp-ar-rc 64 u 1 1 2 2 3 3 5 0 161 815 bp-ct-bk 64 u 1 2 2 2 3 3 5 27 552 138 179 bp-os-cu 64 u 2 2 3 3 4 4 7 0 166 967 bp-wt-cs 64 u 1 1 2 2 3 3 6 0 161 747 sp-ar-rc 64 s 1 1 2 2 3 3 6 0 188 426 bp-wt-cl 64 s 0 10 1 11 0 10 2 12 7 3 10 22 261 650 151 355 btor 64 t 1 1 1 1 1 2 70 374

time in sec 23

SLIDE 38

Verification and Certification Time of Large Multipliers

Verify Certify Check input proof size

architecture

n sub cnf aig tot sub cnf aig tot cnf aig tot total aig cnf aig btor 512 16 16 23 23 7 7 30 2 m 7 m kjvnkv 512 13 13 15 15 9 9 25 3 m 12 m sp-ar-rc 512 13 13 16 16 10 10 26 3 m 12 m sp-dt-lf 512 1 1 25 26 1 1 25 26 11 11 37 3 m 1 m 12 m sp-wt-bk 512 1 26 27 26 26 11 11 38 3 m 626 k 12 m btor 1024 2 177 179 2 219 219 51 51 272 8 m 31 m kjvnkv 1024 2 91 93 2 172 172 72 72 245 12 m 49 m btor 2048 17 0 1 493 1 510 17 0 2 552 2 552 430 430 2 982 33 m 0 125 m kjvnkv 2048 18 0 1 129 1 147 18 0 2 077 2 077 0 1 228 1 228 3 307 50 m 0 196 m

time in min

24

SLIDE 39

Conclusion

SAT and Computer Algebra Adder substitution Polynomial reasoning over more general rings Modular reasoning AMULET Variable elimination Combination of these ideas scales up to 2048 bits

25

SLIDE 40

VERIFYING LARGE MULTIPLIERS BY COMBINING SAT AND COMPUTER ALGEBRA

Daniela Kaufmann, Armin Biere and Manuel Kauers

Johannes Kepler University Linz, Austria

FMCAD 2019

October 23, 2019

San Jose, CA, USA

SLIDE 41

Variable Elimination

Elimination ideal. Let I ⊆ D[X] = D[Y, z] be an ideal. The ideal I ∩ D[Y ] ⊆ D[Y ] is an elimination ideal of I.

1

SLIDE 42

Variable Elimination

Elimination ideal. Let I ⊆ D[X] = D[Y, z] be an ideal. The ideal I ∩ D[Y ] ⊆ D[Y ] is an elimination ideal of I. In general we need to compute a D-Gröbner basis w.r.t. a different term order. Element to be eliminated has to be largest element in order. Special case: UMLT property.

1

SLIDE 43

Variable Elimination

Elimination ideal. Let I ⊆ D[X] = D[Y, z] be an ideal. The ideal I ∩ D[Y ] ⊆ D[Y ] is an elimination ideal of I. In general we need to compute a D-Gröbner basis w.r.t. a different term order. Element to be eliminated has to be largest element in order. Special case: UMLT property. Example: I ⊆ D[o, x, y, a, b]. Eliminate y.

Ideal Reduced ideal Elimination ideal I = { I = { I ∩ D[o, y, a, b] = { −o + xy − x − y + 1 −o + xab − x − ab + 1 −o + xab − −x − ab + 1 −x + ab − a − b + 1 −x + ab − a − b + 1 −x + ab − a − b + 1} −y + ab} −y + ab}

1

SLIDE 44

Variable Elimination

Definition

Let P ⊆ D[X] be a D-Gröbner basis of P with UMLT. We say P is reduced for z if the variable z ∈ X is contained in exactly one polynomial p ∈ P and lt(p) = z.

Lemma

Let P be a D-Gröbner basis with UMLT and let p ∈ P. Let H = P be such that all polynomials h = p ∈ H are D-reduced w.r.t. p. Then H is reduced for lt(p) = z.

Theorem

Let I ⊆ D[X] be an ideal. Let P be a D-Gröbner basis of I with UMLT which is reduced for z. Let p ∈ P be the polynomial with lt(p) = z. Then P \ {p} is a D-Gröbner basis with UMLT for the ideal J = I ∩ D[X \ {z}].

2