Advanced Boolean Techniques: Selected Papers from the 13th International Workshop on Boolean Problems [1st ed.] 978-3-030-20322-1;978-3-030-20323-8

Table of contents :
Front Matter ....Pages i-viii
Self-explaining Digital Systems: Technical View, Implementation Aspects, and Completeness (Görschwin Fey, Rolf Drechsler)....Pages 1-20
Secure Implementation of Lattice-Based Encryption Schemes (Tobias Oder, Tobias Schneider, Tim Güneysu)....Pages 21-49
Derivative Operations for Classes \(\mathcal {C}_N\) of Boolean Functions (Bernd Steinbach, Christian Posthoff)....Pages 51-82
Towards the Structure of a Class of Permutation Matrices Associated with Bent Functions (Radomir S. Stanković, Milena Stanković, Jaakko T. Astola, Claudio Moraga)....Pages 83-105
Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning (Oliver Keszocze, Kenneth Schmitz, Jens Schloeter, Rolf Drechsler)....Pages 107-133
Synthesis of Majority Expressions Through Primitive Function Manipulation (Evandro C. Ferraz, Jeferson de Lima Muniz, Alexandre C. R. da Silva, Gerhard W. Dueck)....Pages 135-158
Literal Selection in Switching Lattice Design (Anna Bernasconi, Fabrizio Luccio, Linda Pagli, Davide Rucci)....Pages 159-175
Exact Synthesis of ESOP Forms (Heinz Riener, Rüdiger Ehlers, Bruno de O. Schmitt, Giovanni De Micheli)....Pages 177-194
An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions (D. Michael Miller, Mathias Soeken)....Pages 195-215
New Results on Reversible Boolean Functions Having Component Functions with Specified Properties (Paweł Kerntopf, Krzysztof Podlaski, Claudio Moraga, Radomir Stanković)....Pages 217-236
Efficient Hardware Operations for the Residue Number System by Boolean Minimization (Danila Gorodecky, Tiziano Villa)....Pages 237-258
Back Matter ....Pages 259-265

Citation preview

Rolf Drechsler · Mathias Soeken Editors

Advanced Boolean Techniques Selected Papers from the 13th International Workshop on Boolean Problems

Advanced Boolean Techniques

Rolf Drechsler • Mathias Soeken Editors

Advanced Boolean Techniques Selected Papers from the 13th International Workshop on Boolean Problems

123

Editors Rolf Drechsler Arbeitsgruppe Rechnerarchitektur Universit¨at Bremen Bremen, Germany

Mathias Soeken École Polytechnique Fédérale de Lausanne Lausanne, Switzerland

ISBN 978-3-030-20322-1 ISBN 978-3-030-20323-8 (eBook) https://doi.org/10.1007/978-3-030-20323-8 © Springer Nature Switzerland AG 2020 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors, and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. This Springer imprint is published by the registered company Springer Nature Switzerland AG. The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland

Preface

Boolean functions are at the core of today’s computer science and find application in circuit and system specification, synthesis, design understanding, and cryptography. The International Workshop on Boolean Problems1 is a bi-annually held and wellestablished forum to discuss the recent advances on problems related to Boolean logic and Boolean algebra. In 2018, the 13th edition of the workshop was held in Bremen, Germany, from September 19th to September 21st. The workshop provided a forum for researchers and engineers from different disciplines to exchange ideas as well as to discuss problems and solutions. The workshop is devoted to both theoretical discoveries and practical applications. This edited book contains a selection of best papers presented at the workshop. The papers in this volume demonstrate new accomplishments in the theory of Boolean functions. Furthermore, several papers illustrate how these results find their way into important practical applications such as cryptography and design understanding. The first two chapters in the book are contributions that resulted from the invited keynotes at the conference. In Chap. 1, Görschwin Fey and Rolf Drechsler describe Self-Explaining Digital Systems: Technical View, Implementation Aspects, and Completeness. In Chap. 2, Tobias Oder, Tobias Schneider, and Tim Güneysu write about a Secure Implementation of Lattice-Based Encryption Schemes. The following nine chapters are extended manuscripts based on the workshop handouts. In Chap. 3, Bernd Steinbach and Christian Posthoff write about Derivative Operations for Classes CN of Boolean Functions. In Chap. 4, Radomir S. Stankovi´c, Milena Stankovi´c, Jaakko T. Astola, and Claudio Moraga investigate bent functions in Towards the Structure of a Class of Permutation Matrices With Bent Functions. Oliver Keszocze, Kenneth Schmitz, Jens Schloeter, and Rolf Drechsler show how to improve the performance of SAT solvers in Improving SAT Solving Using Monte Carlo Tree Search-based Clause Learning in Chap. 5. The following three chapters are about logic synthesis applications. In Chap. 6, Evandro C. Ferraz,

1 See

www.informatik.uni-bremen.de/iwsbp. v

vi

Preface

Jeferson de Lima Muniz, Alexandre C. R. da Silva, and Gerhard W. Dueck explore majority-based logic synthesis in Synthesis of Majority Expressions through Primitive Function Manipulation. Anna Bernasconi, Fabrizio Luccio, Linda Pagli, and Davide Rucci target synthesis for switching lattices in Chap. 7 Literal Selection in Switching Lattice Design. In Chap. 8, Heinz Riener, Rüdiger Ehlers, Bruno Schmitt, and Giovanni De Micheli propose an exact synthesis approach in Exact Synthesis of ESOP Forms. D. Michael Miller and Mathias Soeken introduce An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions in Chap. 9. Chapter 10 targets reversible functions with New Results on Reversible Boolean Functions Having Component Functions with Specified Properties by Paweł Kerntopf, Krzysztof Podlaski, Claudio Moraga, and Radomir S. Stankovi´c. The book is concluded in Chap. 11 by Danila Gorodecky and Tiziano Villa on Efficient Hardware Operations for the Residue Number System by Boolean Minimization. We would like to express our thanks to the program committee of the 13th International Workshop on Boolean Problems as well as to the organizational team, in particular Lisa Jungmann and Kristiane Schmitt. Furthermore, we thank all the authors of contributed chapters who did a great job in submitting their manuscripts of very high quality. A special thank goes to the keynote speakers of the workshop, Prof. Görschwin Fey (Hamburg University of Technology) and Prof. Tim Güneysu (Ruhr-Universität Bochum). Finally, we would like to thank Brinda Megasyamalan, Brian Halm, and Charles Glaser from Springer. All this would not have been possible without their steady support. Bremen, Germany Lausanne, Switzerland March 2019

Rolf Drechsler Mathias Soeken

Contents

1

Self-explaining Digital Systems: Technical View, Implementation Aspects, and Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . Görschwin Fey and Rolf Drechsler

1

2

Secure Implementation of Lattice-Based Encryption Schemes . . . . . . . Tobias Oder, Tobias Schneider, and Tim Güneysu

21

3

Derivative Operations for Classes CN of Boolean Functions . . . . . . . . . . Bernd Steinbach and Christian Posthoff

51

4

Towards the Structure of a Class of Permutation Matrices Associated with Bent Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Radomir S. Stankovi´c, Milena Stankovi´c, Jaakko T. Astola, and Claudio Moraga

83

5

Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Oliver Keszocze, Kenneth Schmitz, Jens Schloeter, and Rolf Drechsler

6

Synthesis of Majority Expressions Through Primitive Function Manipulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Evandro C. Ferraz, Jeferson de Lima Muniz, Alexandre C. R. da Silva, and Gerhard W. Dueck

7

Literal Selection in Switching Lattice Design . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Anna Bernasconi, Fabrizio Luccio, Linda Pagli, and Davide Rucci

8

Exact Synthesis of ESOP Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Heinz Riener, Rüdiger Ehlers, Bruno de O. Schmitt, and Giovanni De Micheli

9

An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 D. Michael Miller and Mathias Soeken vii

viii

Contents

10

New Results on Reversible Boolean Functions Having Component Functions with Specified Properties. . . . . . . . . . . . . . . . . . . . . . . . 217 Paweł Kerntopf, Krzysztof Podlaski, Claudio Moraga, and Radomir Stankovi´c

11

Efficient Hardware Operations for the Residue Number System by Boolean Minimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 Danila Gorodecky and Tiziano Villa

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Chapter 1

Self-explaining Digital Systems: Technical View, Implementation Aspects, and Completeness Görschwin Fey and Rolf Drechsler

1.1 Introduction Digital systems continuously increase in their complexity due to integration of various new features. Systems handle failures and have complex decision mechanisms for adaptability and autonomy. Understanding why a system performs certain actions becomes more and more difficult for users. Also designers have to cope with the complexity while developing the system or parts of it. The main difficulties are the inaccessibility of the inner logic of the digital system or a lack in understanding all the details. An explanation for actions executed by a digital system unveils the reasons for these actions and, by this, can serve various purposes. From the outside a user may be puzzled why a technical device performs a certain action, e.g., “why does the traffic light turn red?” In simple cases the user will know the reason, e.g., “a pedestrian pushed the button, so pedestrians get green light, cars get red light.” In more complex cases, explanations for actions may not as easily be accessible. When the digital system that controls the larger technical device provides an explanation, the user can understand why something happens. This raises the user’s confidence in the correct behavior. The explanation for actions required in this case must refer to external input to the system, e.g., through sensors, and to an abstraction of the internal state that is understandable for a user.

G. Fey () Hamburg University of Technology, Hamburg, Germany e-mail: [email protected] R. Drechsler University of Bremen, Bremen, Germany DFKI Bremen, Bremen, Germany © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_1

1

2

G. Fey and R. Drechsler

Also designers of digital systems can benefit from explanations. A typical design task is debugging where a designer has to find the reason for certain actions executed by a digital system. Depending on the current design task a designer may use the same explanations that help users. Additionally, more detailed explanations, e.g., justifying data exchange between functional units may be useful. Thus, debugging and development are supported by explanations giving simple access points for a designer justifying the system’s execution paths. At design time a designer can use explanations to understand the relation between the specification and the implementation. Correctness of the system is validated through explanations if these explanations provide an alternative view that justifies the actual output. For in-field operation explanations may even be exploited for monitoring as a side-check that validates the actual execution of the system to detect failures and unexpected usage. In particular, problems are detected earlier when explanations cannot be generated, are not wellformed, or are not consistent with respect to the actual behavior. The notion of explanation used here are cause–effect chains as often used in the philosophical domain. Moreover, granularity, addressee, and purpose are defined at design time of a system that then explains all its observable actions at run time. We consider such as system to be self-explaining. Given a digital system the question is how to provide an explanation for observable actions online. While on first sight this mainly concerns functional aspects also non-functional aspects like actual power consumption or response time of the system deserve explanations. During online operation either the system itself or some dedicated additional entity must provide the explanations. This incurs a cost, e.g., for storing historical data that explains and, by this, also justifies current and future actions. This overhead must be kept as low as possible. A non-trivial challenge is to provide concise explanations in a cost-efficient way. While some actions of a system may have very simple explanations, e.g., “the power-on button has been pressed,” other actions may require a deep understanding of the system, e.g., “when the distance to an energy source is large and the battery level is low, we save energy by reducing speed as well as light and move towards the energy source.” Such an explanation may in turn require knowledge about what an energy source is, what thresholds are used, and how the system detects where the next energy source may be found. Our contributions are the following: – We formalize explanations and define what a self-explaining system is. We explain how to verify whether a system is self-explaining. – We propose a conceptual framework that yields layered explanations providing details where necessary, but keeping explanations understandable at the same time. – We provide a technical solution for explanations on the functional level and discuss how to automatically infer them.

1 Self-explaining Digital Systems

3

– We discuss implementation aspects enabling a trade-off between the degree of completeness in explanations and implementation cost. In particular, when certain actions of the system and certain specification aspects are known to be more important than others, this guides the trade-off. – We consider a robot controller implemented at the register transfer level in Verilog as a case study. Besides giving details of the implementation, we prove completeness of explanations for the main controller of the robot. This chapter extends the overview on self-explanation in combination with selfverification published in [7] that mainly considered methodology without giving technical details. The work in [10] gives the formal definition, but no conceptual framework for different abstraction levels, provides fewer properties about the robot controller, and does not prove completeness. The chapter is structured as follows: While there is no directly related work, Sect. 1.2 considers the aspect of explanation in other areas. Section 1.3 formalizes explanations, defines a self-explaining system, its implementation, and verification. Section 1.4 studies a self-explaining controller for an autonomous robot. Extensions and automation for self-explanation are discussed in Sect. 1.5. Section 1.6 draws conclusions.

1.2 Related Work The concept of self-explaining digital systems is new but related to explanation as understood in other domains. Causation has a long history in philosophy where [19] is a more recent approach that relates events and their causes in chains such that one event can cause a next one. Often underlying hidden relations make this simple approach controversial. A rigorous mathematical approach instead can use statistical models to cope with non-understood as well as truly non-deterministic dependencies [31]. Artificial intelligence particularly in the form of artificial neural networks made a significant progress in the recent past modeling such relations. A large number of training samples train the neural network that afterwards carries out a task or performs a classification on new samples. However, given an artificial neural network it is not understandable how it internally processes data, e.g., what kind of features from the data samples are used or extracted, how they are represented, etc. First approaches to reconstruct this information in the input space have been proposed [12, 26]. Decision procedures are a class of very complex algorithms producing results needed to formally certify the integrity of systems. The pairing of complexity and certification stimulated the search for understanding the verdict provided by a decision procedure. Typically, this verdict either yields a feasible solution to some task, e.g., a satisfying assignment in case of Boolean satisfiability (SAT), or denies the existence of any solution at all, e.g., unsatisfiability in case of SAT solving. A feasible solution can easily be checked, e.g., as a recipe to solve some task.

4

G. Fey and R. Drechsler

Understanding why some task cannot be solved is more difficult. Proofs [13, 35], unsatisfiable cores [30], or Craig-interpolants [15] provide natural explanations. Proofs provide a natural explanation why something is not possible [13, 35]; unsatisfiable cores [30] (in particular, if all minimal unsatisfiable cores are available [20]) provide a cause for unsatisfiability; Craig-interpolants focus on the interface between parts of the system to provide a cause; for design debugging interpolants [15] and particularly sequence interpolants provide a stepwise explanation [37] converging to unsatisfiability. Understanding complex programs is a tedious task requiring tool support [34]. One example is the analysis of data-flow in programs and of root causes for certain output. Static [33] and dynamic [17] slicing show how specific data has been produced by a program. This can, e.g., be used for debugging [36]. Dynamic dependency graphs track the behavior, e.g., to extract formal properties [24]. Debugging circuits is hard due to the lack of observability into a chip. Trace buffers provide an opportunity to record internal signals [6]. The careful selection of signals [23] and their processing allows to reconstruct longer traces. The abstraction level of trace buffers is exactly at the bit-level implementation of the digital system. Restricted storage capacity limits the recorded history and number of signals being traced. Coupling with software extensions allows to much more accurately pin point time windows for recording [21]. Verification and in particular formal verification requires a deep understanding of a system’s functionality. Model checking [4] is a well-established and automated approach for formal verification. Typically, logic languages like Linear Temporal Logic (LTL), Computation Tree Logic (CTL), or System Verilog Assertions (SVA) are used to express properties that are then verified. Today’s verification languages like System Verilog Assertions (SVA) are more expressive to allow for “nicer” formulation of properties. These properties summarize the functionality of a design in a different way and thus explain the behavior. Verification methodology [1, 2] ensures that properties capture an abstraction rather than the technical details of an implementation. Beyond pure design time verification is the idea of proof carrying code to allow for a simplified online verification before execution [29]. Self-awareness of computing systems [16] on various levels has been proposed as a concept to improve online adaption and optimization. Application areas range from hardware level to coordination of production processes, e.g., [28, 32]. The information extracted for self-awareness relates to explanation usually focused towards a specific optimization goal. While all these aspects relate to explanation, self-explanation has been rarely discussed. For organic computing, self-explanation has been postulated as a useful concept for increasing acceptance by users [27]. The human-oriented aspect has intensively been studied in intelligent human computer interfaces and support systems [25]. Self-explanation has also been proposed for software systems although limited to the narrow domain of agent-based software [8] and mainly been studied in the form of ontologies for information retrieval [9]. Expert systems as one very relevant domain in artificial intelligence formalize and reason on knowledge within a

1 Self-explaining Digital Systems

5

specific context with the goal to diagnose, control, and/or explain. Particularly, realtime expert systems have been proposed, e.g., for fault tolerance [22]. Aspects like online-reasoning on formalized knowledge have been considered in this domain. This brief overview of very diverse works in several fields shows that understanding a system has a long tradition and is extremely important. Recent advances in autonomy and complexity reinforce this demand. In contrast to previous work, we show how to turn a given digital system into a self-explaining system.

1.3 Self-explanation Figure 1.1 gives a high-level view for self-explanation as proposed here. The digital system is enhanced by a layer for self-explanation that holds a—potentially abstracted—model of the system. Any action executed by the system at a certain point in time is an event (bold black arrows in the figure). The explanation layer stores events and their immediate causes as an explanation and provides a unique tag to the system (dotted black arrows). While processing data, the system relates follow-up events to previous ones based on these tags (blue zig-zag arrows). Besides events, references to the specification can provide causes for actions. The user or designer may retrieve an explanation for events observable at the output of the system as a cause–effect chain (green dots connected by arrows). This cause–effect chain only refers to input provided to the system, the—abstracted—system model, and the specification. In the following we formalize self-explanation and provide an approach for implementation and verification. We also propose a conceptual framework that uses different layers for making explanations more digestible for designers and users, respectively. Fig. 1.1 Approach

User, designer

Self-Explanation (abstract) system model + requirements

Digital system

6

G. Fey and R. Drechsler

1.3.1 Formalizing Explanations We consider explanations in terms of cause–effect relationships. Before defining explanations we describe our system model. The system is represented by a set of variables V composed of disjoint sets of input variables I , output variables O, and internal variables. A variable is mapped to a value at any time while the system executes. This system model is quite general. For a digital system a variable may correspond to a variable in software or to a signal in (digital) hardware. For a cyber-physical system a variable may also represent the activation of an actuator or a message sent over the network. A fresh variable not part of the system may be used to model an abstract concept, e.g., “move forward” instead of actual control signals for a motor driver. Run-time reconfiguration of a system, which may impact explanations, is modeled as a larger system with configurations and configuration changes stored in variables. A hierarchical system architecture can be represented by organizing the variables—and related actions–into disjoint subsets. However, continuous behavior in time or continuous values are not within the scope of this work. Based on this system model we introduce our notion of actions, events, causes, and explanations to formalize them afterwards. An action of a system fixes a subset of variables to certain values.1 An observable action fixes observable output values of the system. An input action fixes input variables that are not controlled by the system, but by the environment. An action executed at a specific point in time by the running system is an event. We assume that a set of requirements is available for the system from a precise specification. A cause is an event or a requirement. An explanation for an event consists of one or more causes. These terms now need more formal definitions to reason about explanations. An action assigns values to a subset of either I , O, or V /(O ∪ I ) of the variables. We define an ordered set of actions A with i(a) for a ∈ A providing the unique index of a, a set of requirements R, and the set of explanations E ⊆ A × N × 2R × 2A × N|A| . An explanation e = (a, t, R, A, T ) ∈ E relates the action a with unique tag t, i.e., the event (a, t) to its causes. The tag t may be thought of as the value of a system-wide wall-clock time when executing the action. However, such a strong notion of timing is not mandatory. Having the same tag for a particular action occurring at most once is sufficient for our purpose and is easier to implement in an asynchronous distributed system. The vector T in an explanation relates all actions in A to their unique tags using the index function i(a) such that a ∈ A is related to the event (a, Ti(a) ), where Tj denotes the j th element of vector T . Since A ⊆ A the relation |A| ≤ |T | holds, so unused tags in T are

1 An

extension of our formalism could consider more complex actions that include a certain series of assignments over time, e.g., to first send an address and afterwards data over a communication channel. However, for simplicity we assume here that an appropriate abstraction layer is available. Nonetheless, multiple valuations of the variables may be associated to the same action, e.g., the action “moving towards front left” may abstract from the radius of the curve followed by a system.

1 Self-explaining Digital Systems

7

simply disregarded. Technically, the reference to prior events directly refers to their explanations. Note that there may be multiple justifications for the same action, e.g., the light may be turned off because there is sufficient ambient light or because the battery is low. We require such ambiguities to be resolved during run time based on the actual implementation of the system. Only for simplicity this formalization precludes the dependence of an event on multiple previous events executing the same action. Lewis [19] requires for counterfactual dependence of an event e on its cause c that c → e and ¬c → ¬e. However, an event is identified with precisely the actual occurrence of this event. There may be alternative ways to cause a similar event, but the actual event e was precisely due to the cause c. Consider the event that “the window was broken by a stone thrown by Joe.” The window may have alternatively been broken by a ball thrown by Joe, but this would have been a different “window broken” event. Lewis achieves this precision by associating the actual event e with a proposition O(e) that is true iff e occurs and false otherwise. These propositions allow to abstract from the imprecise natural language. Here we achieve this precision by adding tags to actions. Lewis [19] defines causation as a transitive relationship where the cause of an event is an event itself that has its own causes. Similarly, we traverse the cause–effect chain of events to identify root causes for some observable action as formalized in the following. Definition 1.1 For an explanation e = (a, t, R, A, T ), the immediate set of explanations is given by   E(e) = e = (a  , t  , R  , A , T  ) ∈ E|a  ∈ A and t  = Ti(a  ) Definition 1.2 The full set of explanations E ∗ (e) is the transitive closure of E(e) with respect to the causing events, i.e., if e = (a  , t  , R  , A , T  ) ∈ E ∗ (e) and  there exists e = (a  , t  , R  , A , T  ) ∈ E with a  ∈ A and t  = Ti(a  ) ,  ∗ then e ∈ E (e). Now we define well-formed explanations that provide a unique explanation for any action and must ultimately be explained by input data and requirements only. Definition 1.3 A set of explanations E is well-formed, iff 1. for any e = (a, t, R, A, T ) ∈ E there does not exist e = (a, t, R  , A , T  ) ∈ E ∗ (e) with (R, A, T ) = (R  , A , T  ), 2. for any e ∈ E if e = (a  , t  , R  , A , T  ) ∈ E ∗ (e), then for any a  ∈ A /A↓I , where A↓I is the set of actions in A that fix values of inputs I there exists (a  , t  , R  , A , T  ) ∈ E ∗ (e). Our notation is similar to classical message-based events for formalizing asynchronous distributed systems, e.g., used in the seminal work of Lamport [18] that explains how to deduce a system-wide wall-clock time. An important difference is,

8

G. Fey and R. Drechsler

however, that in our case the execution of the system perfectly describes the order of events. An explanation then captures this order without additional mechanisms for synchronization. The only requirement is the association of an action with a unique tag to form an event, i.e., any action occurs at most once with a particular tag. Our formalism provides the basis for extending an actual digital system to provide explanations for each observable action. The sets of variables, actions, requirements, and explanations are freely defined. This leaves freedom to decide on the granularity of explanations available during run time, e.g., whether an action only captures the driving direction of a robot or the precise values of motor control signals. The set of observable actions must be derived at first. The methodology must ensure that for each possible system output there is a related action. This is possible, e.g., by mapping the variables and their assignments from the system model to implementation level variables and their assignments. This mapping then produces a mapping of actions onto system variables. A more precise definition depends on the actual system under consideration. While in some system an action may only occur when the output changes, in other systems a certain control signal may start a new action in each time step where this signal is active. We delegate this refinement for defining actions to the actual implementation. Definition 1.4 A set of observable actions is complete with respect to a given system iff for any observable output of the system there exists a related observable action. Definition 1.5 A set of explanations is complete iff it is well-formed and explains all observable actions. Definition 1.6 A digital system is self-explaining iff it has a complete set of observable actions and creates a complete set of explanations.

1.3.2 Implementation Practically, explanations are produced by adding appropriate statements to the design description. To create the cause–effect chain, we think of functional units that are connected to each other. A functional unit may be a hardware module or a software function. To produce explanations for the actions, each unit records the actions and their explanations from preceding units together with the input. By this, data being processed can always be related to its causes, likewise actions triggered by that data can be associated to their causes. In the following we describe a concrete approach to implement a self-explaining digital system. While the approach explained here is mainly manual, we discuss how this can be automated in Sect. 1.5.2. Functional units derive causes for their actions. We associate an explanation unit for storage, reference, and usage of explanations to each functional unit. Whenever a functional unit executes an action, the cause for that action is forwarded to the

1 Self-explaining Digital Systems Fig. 1.2 Implementation

9

FU1 c a

t

EU1

FU2 explanation unit. The explanation unit then provides unique tags for the action to form an event, merges it with the cause, and stores the resulting explanation. Other functional units query the explanation unit to associate incoming data with an event and its explanation. This information must then be passed jointly while processing the data to provide the causes for an action. Figure 1.2 illustrates this. Functional unit FU1 executes an action a passed to functional unit FU2. The cause c of a is stored in explanation unit EU1 that provides a unique tag t. FU2 refers to the event (a, t) to derive causes for its own actions. For this step we rely on the designer to enhance the implementation with functionality to pass causes and drive explanation units by adding appropriate code. The designer also decides whether actions are defined in terms of existing variables of the design or whether new variables are introduced to allow for abstraction.

1.3.3 Verification and Validation Validating and verifying the semantics of the explanations requires consistency checks with the actual design and observing whether explanations fit the actual behavior in the environment. This is difficult to automate as a precise environment model is required. However, given a digital system we can analyze whether it is self-explaining according to Definition 1.6. This analysis can either be applied to validate an execution trace or to formally verify self-explanation of a system. The analysis proceeds in the following steps: 1. Check whether the set of observable actions is complete (see Definition 1.4). Without any abstraction in the explanations any change in output values must be an action. If abstraction is used, the output values corresponding to each observable action must be precisely specified. 2. Check whether the explanations are well-formed (see Definition 1.3). A directed graph is built containing all explanations where nodes represent events and incoming edges start at the causes. If there is a node in the graph without predecessors, this node must represent an input action or a requirement. 3. Check whether the explanations are complete (see Definition 1.5). Upon the first occurrence of output values belonging to a particular action an explanation must be produced by the system.

10

G. Fey and R. Drechsler

Of course, a designer may choose to implement a system that is not fully selfexplaining, but only partially, e.g., by only providing explanations for the most important output variables instead of all. In practice this can be used to reduce the cost incurred by adding explanations to the system, but to still self-explain, e.g., control decisions or safety aspects.

1.3.4 Explanations of Different Granularity Depending on the usage of explanations and the perspective on the system, explanations may be used to answer different questions. We suggest several types of explanations supporting users and designers in different ways and with different levels of detail. Consider the following conceptual framework for different types of explanations together with the questions addressed: – User-understandable explanation—which part of the input data and user-visible conceptual state triggers the action? – Environment-defined explanation—which part of the input triggers the action? – Specification-defined explanation—which part of the specification requires a certain action? – Transaction-level explanation—which series of transactions initiated and then implied the action? – Architectural explanation—which functional units contribute to triggering the action, which part of the internal state triggers the action? – Unit-level explanation—which are the conceptual states and input events triggering an action in each functional unit? – Program-level explanation—which statements trigger actions? The implementation proposed in Sect. 1.3.2 yields program-level explanations. We consider these as the most detailed level of explanations. Explanations on the other levels are derived from these program-level explanations by removing details and joining cause–effect chains.

1.4 Case Study We apply our approach to a small robot controller that explains actions executed with the controlled robot. Figure 1.3 shows an abstract view of the actual robot. The robot has wheels on the left and on the right side, each equipped with a motor that is commanded by the robot controller. The passive wheel on the back turns freely such that by commanding the two motors the robot controller can steer and move the robot. The main sensors of the robot are light sensors and microphones on the four sides as well as eight push-buttons at its corners to detect collisions.

1 Self-explaining Digital Systems

11

Fig. 1.3 Robot

front (f) fr

fl

lr

lf

right (r)

left (l)

back (b) Lightsensor (ls) + Microphone (mi) Active wheel (wl) Table 1.1 Specification

Fig. 1.4 Functional units of the robot controller

No. R0 R1 R2 R3 R4

Push-button (pb) Passive wheel

Description There are three battery levels: strong, medium, low If battery level is strong, move towards noise Unless battery level is strong, move towards light If battery level is low, use only half speed If push-button is pressed, move towards other direction overriding requirements R0 to R3

Sensors Battery Sensor Main

Power

Motor Actuators

The specification in Table 1.1 describes the functionality. The robot controller moves the robot towards the noise detected by the microphones as long as the power levels indicated by the battery are sufficient. When power gets low, the controller steers towards the light detected by the light sensors. Upon a collision detected by a push-button, the robot turns away from that button’s contact point. The four boxes shown in Fig. 1.4 implement the robot controller in Verilog modules. Thus, in this case a functional unit directly corresponds to a Verilog module. Sensors and battery provide input data to the controller that provides output to the motors. The battery state directly impacts the motor speed.

12

G. Fey and R. Drechsler

1.4.1 Adding Explanations We consider cause–effect chains on the unit-level where actions fix the output values. Each module is equipped with an extra output that provides all causes for an action to form an explanation for each event. All kinds of actions are known in advance, so their dependence on causes is hard-coded into the system. Each module explains all its output data. The causes for the output data of one module are generated by preceding module’s actions and requirements, so the causes explaining an action are encoded as a bit string for referencing them. The semantics of explanations for the robot controller is as follows: All observable actions of the robot controller are attributed to the motor control signals. The motor control module yields explanations in terms of requirement R3 where the speed is adjusted according to input by the power control module. Additionally, the direction and speed of the motors are commanded and explained by the main module. The main module in turn decides whether to follow noise or light depending on the power status provided by the power module. The actual direction depends on the respective sensors. Requirements, powerstate, and sensor input define the explanations for the main module. Power module and sensor module simply depend on input data which directly explains their output. The explanations of the robot controller already make an abstraction from actual data. For example, instead of explaining the precise speed of the two motors, this is abstracted to one of the driving directions “straight,” “forward left,” “forward right,” or “turn.” To have reproducible explanations and record their dependence, we equip every module with a separate module implementing the explanation unit. The explanation unit stores explanations and provides unique tags for events. An explanation unit essentially is a memory that stores the explanation which is a bit vector encoding the causes for an action. The memory address serves as the unique tag for the event associated to the current action of the respective module. By this, the unique tag also serves as reference to the explanation for the event. This tag is accessible for subsequent modules to produce their explanations. Uniqueness of these tags for events is subject to the limited size of the memory. By using a simple wrap-around arithmetic for the memory addresses, the size of the memory in the explanation unit decides on the length of the history that can be recorded. For example, the main module’s explanations always depend on the actions of the sensor module and the power module together with the respective requirements. Receiving data from the power module or the sensor module corresponds to an action of these modules associated to an explanation with a unique tag. The main module stores the unique tags for the explanations to generate the explanation for its own action. Assuming that unique tags for explanations have 8 bits, an explanation of the main module contains – an action—2 bits (4 bits in our implementation) for the direction “straight,” “forward left,” “forward right,” or “turn,”

1 Self-explaining Digital Systems

13

– the first cause—2 bits (4 bits in our implementation) for the sensor “push-button (pb),” “microphone (mi),” or “light sensor (ls)” used to calculate the direction according to the requirements, – the second cause—8 bits for the reference to the unique tag for the triggering event of the sensor module, and – the third cause—8 bits for the reference to the unique tag for the triggering event of the power module. This totals to 20 bits; in our implementation we used 24 bits to conveniently represent direction and sensors using hexadecimal digits. Explanations for the other modules have different lengths depending on their needs.

1.4.2 Results Figure 1.5 shows an extract of the recorded explanations where nodes denote events and edges lead from a cause to an event. In this excerpt sensor input and powerstate ultimately explain driving direction and speed. Node “Main: 21” gives an explanation with unique tag “21” for the main module. According to the powerstate medium (node “Power: 02”) and Requirement R2 the robot goes “straight” to the light sensors “ls.” This is one reason for the observable actions in nodes “Motor_left: 21” and “Motor_right: 21.” The other reason is the current powerstate. The original design has 257 lines of code, extensions for self-explanation require 119 lines, and the explanation unit has 28 lines. Table 1.2 gives an impression about the design and the cost for explanation. The numbers of state bits and gates are shown for four configurations: the plain robot controller without explanation and with explanation units having 4, 32, and 256 entries. In the table these memories are counted as state bits plus decoding and encoding logic that adds to the gates in the circuit. The robot controller without any explanations is a relatively simple design that has 113 flipflops and 5962 gates. The data path has a width of up to 8 bits at most. When adding explanations, the size of the memories in the explanation units dominates the size of the design. For memories with 256 entries about 2 KByte of memory are required (the numbers in the table count bits). Note that the encoding Fig. 1.5 Excerpt from explanations

Power: 02 Act: medium

Sensors: 17 Act: changed: ls

Main: 21 Act: straight ls,powerNotStrong

Motor_right: 21

Motor_left: 21

14 Table 1.2 Implementation sizes

G. Fey and R. Drechsler

No explanation With explanation With explanation With explanation

Entries – 4 32 256

#State bits 113 437 2, 250 16, 605

#Gates 5, 692 8, 643 21, 714 123, 572

Column “entries,” number of addresses in explanation units Column “#state bits” and “#gates,” size of the implementation

Table 1.3 Wrap around in tags for a trace of 10,000 cycles

Entries 4 32 256

Main 269 32 3

Motor_left 252 30 2

Motor_right 252 30 2

Power 15 1 0

Sensor 158 18 1

Column “entries,” number of addresses in explanation units Other columns, number of wrap arounds for unique tags of modules

of explanations was not optimized for size. The main aims were a simplified implementation and easily separable reasons in a hexadecimal representation. Note that this implementation of the robot controller is rather simplistic having the full functionality implemented directly in Verilog modules with a data path of at most 8 bit. A rather typical implementation would implement power control, sensor data collection, and main control in different hardware units, some of them as software in microcontrollers. These units would then communicate, e.g., via CANbus. However, the style of explanations could directly be kept as they are abstracting from all the low-level details on CAN-communication, process execution, etc. In this case a memory of less than 2 KByte for 256 entries would be negligible in a system that includes microcontrollers. The number of entries in the memories decides for how long an explanation can be traced back before the unique tags for explanations wrap to zero again, i.e., are not unique anymore. This restricts self-explanation to recent history. Table 1.3 shows how many times the tags were set back to zero for the different explanation units in a run of 10,000 cycles. The number of wrap arounds per module are different as the number of events also differs between the modules. Some of the events of one module do not necessarily trigger a follow-up event in a subsequent module, e.g., values of the microphones are only relevant, if the robot currently follows the sound. Obviously a memory of size 4 is too small to explain a long historical trace. Already 32 entries cause at most 32 wrap arounds in module “Main” within 10,000 cycles, i.e., explanations are unique for traces of about 312 cycles. With 256 entries the length of the history increases to 3300 cycles on average for the main module having 3 wrap arounds.

1 Self-explaining Digital Systems

15

Obviously, optimizations in the size required for explanations are possible, e.g., by adjusting the number of entries of explanation units per module or by encoding explanations in fewer bits. But this is not within the scope of this chapter which focuses on the concept of self-explanation.

1.4.3 Reasoning About Explanations Having the design enhanced with explanations immediately supports a user or a designer in understanding the design’s actions. Additionally, consistency of the explanations and the related actions is an interesting question. Due to the abstraction, e.g., in case of the driving direction it may not be fully clear what kind of actions precisely correspond to an explanation. We give some examples how to clarify this using model checking. We assume that the reader is familiar with model checking [5] so we do not provide any details for this process. Considering the main module some facts can be analyzed by model checking, e.g., if the explanation of the main module says a certain action means moving “straight,” this should imply that both motors are commanded to move in the same direction with the same speed. Indeed the simple robot controller always moves forward at full speed. In CTL this is proven using the formula: AG( exp[23:20] =straight → ( speed_left[7:0]=255 ∧ speed_right[7:0]=255 ∧ direction_right=fwd ∧ direction_left=fwd) ) The 24-bit vector “exp” refers to the explanation of the main module where only the bits corresponding to the description of the action are selected; the 8-bit vectors “speed_right” and “speed_left” correspond to the speed for the left and right motor, respectively; likewise the “direction”-variables. A similar property proves that “turn” always means opposite directions for the left and right motor: AG( exp[23:20]=turn → ( ( direction_right=bwd ∧ direction_left=fwd ) ∨( direction_right=fwd ∧ direction_left=bwd )) ) These invariants are relatively simple consistency properties. By making the case split for all possible valuations of “exp[23:20]” complete and showing that the consequents partition all possible valuations of the output, completeness of observable actions for the main module can be checked as proposed in Sect. 1.3.3. Abstracted reasoning using model checking can be conveniently performed on top of explanations. Consider the following example: any transition into the powerstate “low” causes the main module to move to the light using the light sensor as guidance for the direction unless one of the push-buttons is pressed which immediately requires to move away from an obstacle. The following property in

16

G. Fey and R. Drechsler

LTL proves this behavior referring to explanations only: G( ((expPower[3:0]=strong ∨ expPower[3:0]=medium) ∧ X(expPower[3:0]=low)) → F(expMain[19:16]=pb ∨ expMain[19:16]=ls) ) Using a more expressive language like SVA, properties may be formulated in an even nicer way, e.g., using expressions over bit vectors. The underlying concepts for explanation remain the same.

1.4.4 Module “Main” Is Self-explaining We briefly explain how to show that the module “main” of the robot is selfexplaining according to the definitions given in Sect. 1.3. The output vector “exp” of module main encodes the explanations as described in Sect. 1.4.1. As discussed in Sect. 1.3.3 we proceed in the following three steps: 1. Check whether the set of observable actions is complete (see Definition 1.4). 2. Check whether the explanations are well-formed (see Definition 1.3). 3. Check whether the explanations are complete (see Definition 1.5). Check 1 We have four actions stored in “exp[23:20],” namely “straight,” “forward left,” “forward right,” or “turn.” By making a case split we show that these actions partition the output space using the following properties (where the initial AX) skips the initial state with uninitialized state values): AX(AG( exp[23:20]=turn ∨ exp[23:20]=straight ∨ exp[23:20]=fwd_right ∨ exp[23:20]=fwd_left ) ) Each of the four actions is related to certain output assignments: AG( exp[23:20] =straight → ( speed_left[7:0]=255 ∧ speed_right[7:0]=255 ∧ direction_right=fwd ∧ direction_left=fwd) ) AG( exp[23:20]=turn → ( ( ( direction_right=bwd ∧ direction_left=fwd ) ∨ ( direction_right=fwd ∧ direction_left=bwd )) ∧ speed_left[7:0]=5 ∧ speed_right[7:0]=5 )) AG( exp[23:20]=fwd_left → ( direction_right=fwd ∧ direction_left=fwd ∧ speed_left[7:0]=245 ∧ speed_right[7:0]=255 )) AG( exp[23:20]=fwd_right → ( direction_right=fwd ∧ direction_left=fwd ∧ speed_left[7:0]=255 ∧ speed_right[7:0]=245 ))

1 Self-explaining Digital Systems

17

There are no other possible output assignments (again skipping the initial output value): AX(AG((speed_left[7:0]=255 ∧ speed_right[7:0]=255 ∧ direction_right=fwd ∧ direction_left=fwd) ∨ ( ((direction_right=bwd ∧ direction_left=fwd) ∨ ( direction_right=fwd ∧ direction_left=bwd)) ∧ speed_left[7:0]=5 ∧ speed_right[7:0]=5 ) ∨ (direction_right=fwd ∧ direction_left=fwd ∧ speed_left[7:0]=245 ∧ speed_right[7:0]=255) ∨ (direction_right=fwd ∧ direction_left=fwd ∧ speed_left[7:0]=255 ∧ speed_right[7:0]=245))) Check 2 This check is trivial for the main module since each explanation immediately refers to preceding modules and requirements only, but not to an internal state. Check 3 Whenever we transition from one action to another, a new explanation is produced. Indeed we prove that certain output values also imply a certain action encoded in the explanation, i.e., the ←-direction of the properties in Check 1. This implies that a transition also causes a new explanation.

1.5 Future Extensions The proposed formalization of self-explanation has some limitations that may be waived. Moreover, in a practical setting automation is needed to add self-explanation to an existing system.

1.5.1 Extending Explanations Currently, an action is defined to be a variable assignment. In practice, more complex actions may be of interest, e.g., to perform a burst access to a communication resource. Appropriate extensions are possible by allowing for a more general specification of an action, e.g., in terms of a formal property language that describes conditional sequential traces. We propose completeness and well-formedness as basic criteria for self-explanation. Further properties of interest are aspects like determinism or consistency with an environment model. The systems considered here are limited to generating explanations for themselves and out of the available view onto the environment which is largely unknown to the system. If the system itself incorporates a more detailed model of the environment, the expected impact on the environment can also be incorporated into the explanations. This provides an even deeper insight for

18

G. Fey and R. Drechsler

the observer of the system and would immediately allow to judge the consistency of explanations with the actual behavior. Potentially this serves as the basis for an autonomous diagnosis loop. Non-functional aspects like reaction time or power consumption similarly require self-reflexive functionality in the system, e.g., to determine the current processing load or current sensors and a prediction on future activities. This again can be seen as a model of the environment within the digital system.

1.5.2 Automated Inference Manually enhancing a design for self-explanation may be time consuming. Thus, further automation is useful. Technically, one option to automatically derive explanations is the use of model checking engines. Given a precise specification of an observable action in terms of a formal language, model checking can derive all possible ways to execute this observable action. For each execution trace the causes can automatically be derived along the lines of [11] by debugging only input changes or [24] by backtracing dependency graphs. Logic queries [3] may serve as a monolithic natural tool to identify causes, potentially at a high computational cost. Enhancements enable all of these techniques to identify not only a single set of causes but all possible sets of causes. Deriving these causes in terms of inputs of a functional unit and then continuing to preceding functional units allows to automatically derive well-formed explanations. Completeness must be ensured by formalizing all observable actions properly. Completeness of observable actions could be checked similar to completeness of a set of properties using a similar approach like [14].

1.6 Conclusions Future complex systems driving real-world processes must be self-explaining. Naturally, our proposal is just one technical solution that cannot consider many of the alternative ways to create a self-explaining system. We provided a formal notion of self-explanation, a conceptual framework, and a proof-of-concept realization. We studied a robot controller as a use case. We gave an idea on how to automatically provide self-explanations. The extension to reactive systems in general and to systems where new actions may be defined on-the-fly remains for future work.

1 Self-explaining Digital Systems

19

References 1. Basu, P., Das, S., Banerjee, A., Dasgupta, P., Chakrabarti, P., Mohan, C., Fix, L., Armoni, R.: Design-intent coverage: a new paradigm for formal property verification. IEEE Trans. CAD 25(10), 1922–1934 (2006) 2. Bormann, J.: Complete Functional Verification. Ph.D. Thesis, University of Kaiserslautern (2009). English translation 2017 3. Chan, W.: Temporal-logic queries. In: Computer Aided Verification. Lecture Notes in Computer Science, vol. 1855, pp. 450–463 (2000) 4. Clarke, E., Grumberg, O., Long, D.: Model checking and abstraction. In: Symposium on Principles of Programming Languages, pp. 342–354 (1992) 5. Clarke, E.M., Grumberg, O., Peled, D.: Model Checking. MIT Press, Cambridge, MA (2001) 6. Deutsch, S., Chakrabarty, K.: Massive signal tracing using on-chip dram for in-system silicon debug. In: 2014 International Test Conference, pp. 1–10. IEEE, Piscataway (2014). https://doi. org/10.1109/TEST.2014.7035363 7. Drechsler, R., Lüth, C., Fey, G., Güneysu, T.: Towards self-explaining digital systems: a design methodology for the next generation. In: International Verification and Security Workshop (IVSW), pp. 1–6. IEEE, Piscataway (2018) 8. Fähndrich, J., Ahrndt, S., Albayrak, S.: Towards self-explaining agents. In: Trends in Practical Applications of Agents and Multiagent Systems, pp. 147–154. Springer, Berlin (2013) 9. Fähndrich, J., Ahrndt, S., Albayrak, S.: Self-explanation through semantic annotation: a survey. In: Position Papers of the 2015 Federated Conference on Computer Science and Information Systems (FedCSIS) (2015) 10. Fey, G., Drechsler, R.: Self-explaining digital systems—some technical steps. In: ITG/GI/GMM-Workshop Methoden und Beschreibungssprachen zur Modellierung und Verifikation von Schaltungen und Systemen (MBMV) (2019) 11. Fey, G., Staber, S., Bloem, R., Drechsler, R.: Automatic fault localization for property checking. IEEE Trans. CAD 27(6), 1138–1149 (2008) 12. Fraud, R., Clrot, F.: A methodology to explain neural network classification. Neural Netw. 15(2), 237–246 (2002). https://doi.org/10.1016/S0893-6080(01)00127-7 13. Goldberg, E., Novikov, Y.: Verification of proofs of unsatisfiability for CNF formulas. In: Design, Automation and Test in Europe, pp. 886–891. IEEE Computer Society, Washington, DC (2003) 14. Große, D., Kühne, U., Drechsler, R.: Analyzing functional coverage in bounded model checking. IEEE Trans. CAD 27(7), 1305–1314 (2008) 15. Keng, B., Veneris, A.: Scaling VLSI design debugging with interpolation. In: International Conference on Formal Methods in CAD, pp. 144–151. IEEE, Piscataway (2009). https://doi. org/10.1109/FMCAD.2009.5351130 16. Kephart, J.O., Chess, D.M.: The vision of autonomic computing. Computer 36(1), 41–50 (2003) 17. Korel, B., Laski, J.: Dynamic program slicing. Inf. Process. Lett. 29(3), 155–163 (1988). https://doi.org/10.1016/0020-0190(88)90054-3 18. Lamport, L.: Time, clocks, and the ordering of events in a distributed system. Commun. ACM 21(7), 558–565 (1978). https://doi.org/10.1145/359545.359563 19. Lewis, D.: Causation. J. Philos. 70(17), 556–567 (1973) 20. Liffiton, M., Sakallah, K.: Algorithms for computing minimal unsatisfiable subsets of constraints. J. Autom. Reason. 40(1), 1–33 (2007) 21. Lin, D., Singh, E., Barrett, C., Mitra, S.: A structured approach to post-silicon validation and debug using symbolic quick error detection. In: 2015 IEEE International Test Conference (ITC), pp. 1–10. IEEE, Piscataway (2015). https://doi.org/10.1109/TEST.2015.7342397 22. Liu, W.: Real-time fault-tolerant control systems. In: Leondes, C.T. (ed.) Expert Systems, pp. 267–304. Academic, London (2002)

20

G. Fey and R. Drechsler

23. Liu, X., Xu, Q.: Trace signal selection for visibility enhancement in post-silicon validation. In: Design, Automation and Test in Europe, pp. 1338–1343. IEEE, Piscataway (2009). https://doi. org/10.1109/DATE.2009.5090872 24. Malburg, J., Flenker, T., Fey, G.: Property mining using dynamic dependency graphs. In: ASP Design Automation Conference, pp. 244–250. IEEE, Piscataway (2017). https://doi.org/10. 1109/ASPDAC.2017.7858327 25. Maybury, M.T., Wahlster, W. (eds.): Readings in Intelligent User Interfaces. Morgan Kaufmann Publishers, Los Altos (1998) 26. Montavon, G., Samek, W., Mller, K.R.: Methods for interpreting and understanding deep neural networks. Digital Signal Process. 73, 1–15 (2018). https://doi.org/https://doi.org/10.1016/j.dsp. 2017.10.011 27. Müller-Schloer, C., Tomforde, S.: Organic Computing: Technical Systems for Survival in the Real World. Birkhäuser, Basel (2017) 28. Mstl, M., Schlatow, J., Ernst, R., Hoffmann, H., Merchant, A., Shraer, A.: Self-aware systems for the internet-of-things. In: International Conference on Hardware/Software Codesign and System Synthesis (CODES+ISSS), pp. 1–9. IEEE, Piscataway (2016) 29. Necula, G.C., Lee, P.: Safe, untrusted agents using proof-carrying code. In: Vigna, G. (ed.) Mobile Agents and Security, pp. 61–91. Springer, Berlin (1998) 30. Oh, Y., Mneimneh, M.N., Andraus, Z.S., Sakallah, K.A., Markov, I.L.: AMUSE: a minimallyunsatisfiable subformula extractor. In: Design Automation Conference, pp. 518–523 (2004) 31. Pearl, J.: Causality. Cambridge University Press, Cambridge (2010) 32. Siafara, L.C., Kholerdi, H.A., Bratukhin, A., Taherinejad, N., Jantsch, A.: SAMBA—an architecture for adaptive cognitive control of distributed cyber-physical production systems based on its self-awareness. Elektrotech. Informationstech. 135(3), 270–277 (2018) 33. Weiser, M.: Program slicing. In: International Conference on Software Engineering, pp. 439– 449. IEEE, Piscataway (1981) 34. Woods, S., Yang, Q.: The program understanding problem: analysis and a heuristic approach. In: International Conference on Software Engineering, pp. 6–15. IEEE, Piscataway (1996) 35. Zhang, L., Malik, S.: Validating SAT solvers using an independent resolution-based checker: practical implementations and other applications. In: Design, Automation and Test in Europe, pp. 880–885. IEEE, Piscataway (2003) 36. Zhang, X., He, H., Gupta, N., Gupta, R.: Experimental evaluation of using dynamic slices for fault location. In: International Symposium on Automated Analysis-Driven Debugging (AADEBUG), pp. 33–42. ACM, New York (2005). http://doi.acm.org/10.1145/1085130. 1085135 37. Zhu, C.S., Weissenbacher, G., Malik, S.: Silicon fault diagnosis using sequence interpolation with backbones. In: International Conference on CAD, pp. 348–355 (2014). https://doi.org/10. 1109/ICCAD.2014.7001373

Chapter 2

Secure Implementation of Lattice-Based Encryption Schemes Tobias Oder, Tobias Schneider, and Tim Güneysu

2.1 Introduction Cryptographic key-exchange mechanisms (KEMs) are essential to secure confidential information that gets transmitted over an insecure channel. By using a KEM, the communicating parties can agree on a shared secret key that they can use to encrypt data without an eavesdropper being able to derive any information about that key. The majority of KEMs that are in use today base their cryptographic security on either the prime factorization problem or the discrete logarithm problem. However, given a fairly powerful quantum computer, one can break cryptographic schemes based on these mathematical problems using Shor’s algorithm [52]. The ubiquitous threat posed by recent advances in quantum computing to currently employed KEMs

The majority of the work was performed while Tobias Schneider was with Ruhr-Universität Bochum. T. Oder Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany e-mail: [email protected] T. Schneider ICTEAM/ELEN/Crypto Group, Université Catholique de Louvain, Louvain, Belgium e-mail: [email protected] T. Güneysu () Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany DFKI, Bremen, Germany e-mail: [email protected] © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_2

21

22

T. Oder et al.

has therefore caused a massive rise in research activities in the area of post-quantum cryptography (PQC) in the last couple of years. These research efforts culminated in the NIST requesting candidates for quantum-secure cryptographic algorithms in December 2016 [36] and releasing the list of submissions in December 2017. The KEMs submitted to NIST base their security on entirely different security assumptions that (by the current state of knowledge) cannot be attacked by quantum algorithms. The majority of submitted KEMs is either based on linear codes, multivariate quadratics, or lattices. Lattice-based schemes constitute the largest group with 20 submitted KEMs in the first round of the standardization process and still nine schemes in the second round. There are a couple of reasons for the popularity of lattice-based cryptosystems. They offer reasonable parameter sizes, high efficiency, and flexibility regarding their potential applications. The most commonly used mathematical problem to build lattice-based KEMs is the learning with errors (LWE) problem or its variant ring-LWE that works with polynomial rings over finite fields and leads to even more efficient parameters. With the advent of a Smart World and the Internet of Things, billions of devices are becoming connected, exchanging massive amounts of data, often combined with high demand on data security. Embedded applications of cryptography are therefore of major relevance for today’s world. At the same time, these embedded targets that require the application of security solutions often have access to only limited resources. Implementations on embedded and constrained devices therefore have the requirement to be efficient in terms of performance and memory. Furthermore, in many embedded use cases an attacker has physical access to a device that contains a secret key. This physical access can then be used to extract information about intermediate values that appear during the execution of a cryptographic operation by observing physical properties of the device. For instance, the dynamic power consumption of the device can leak sensitive information about the secret key that is used in the cryptographic operation. By collecting a large number of power traces and analyzing them by statistical means, an attacker might be able to break a KEM even if it is mathematically sound. Implementations targeting embedded devices therefore also have to take into account side-channel attacks and apply appropriate countermeasures. Because of the high efficiency, schemes based on ring-LWE can be easily implemented on embedded devices as shown by many publications, like [1, 27, 29, 30, 50]. Most of the aforementioned implementations are only protected against timing side-channels, i.e., the execution time of the implementation is independent from any secret data. In this chapter, we show how to further on protect KEMs based on ring-LWE against power analysis. To do so, we utilize masking, a common countermeasures against power attacks. Masking schemes for ring-LWE KEMs have already been investigated by Reparaz, Roy, Vercauteren, and Verbauwhede in [43, 46] and Reparaz, de Clercq, Roy, Vercauteren, and Verbauwhede in [45]. Our solution significantly improves the proposed masking schemes in terms of performance and failure rate and is also provably secure. To show the practicality of our approach, we also present an implementation on an ARM Cortex-M4 and conduct practical measurements that support our claims.

2 Secure Implementation of Lattice-Based Encryption Schemes

23

2.2 Background 2.2.1 Notation Unless explicitly stated, we denote addition (resp. subtraction) modulo q with + (resp. −). We denote multiplication by · and point-wise multiplication by ◦. We use ⊕ as operator for addition modulo 2. Polynomials in Rq = Zq [x]/x n + 1 are labeled by bold lowercase letters. Polynomials in NTT domain are additionally marked with a tilde (˜a). When we access a single bit of a bit vector, we use an index in square brackets to identify the respective bit.

2.2.2 Cryptographic Background In the following, we introduce the necessary cryptographic concepts. Key Encapsulation Mechanisms Encrypted communication can either be conducted using symmetric or asymmetric cryptography. In symmetric cryptography both parties share the same secret key that they use to encrypt their communication with. In asymmetric cryptography on the other hand, each party has a pair of keys consisting of one private key that is only known to the owner of the key and one public key that is also known to potential communication partners. Symmetric cryptography is much more efficient and therefore the primary choice to realize encrypted communication. The major drawback however is that both parties have to agree on a secret key in such a way that an eavesdropper does not get any information about that key. Therefore asymmetric cryptography is usually used to agree on a shared, symmetric key and all further communication is then encrypted symmetrically. The asymmetric primitives used to exchange a symmetric key are called Key Encapsulation Mechanisms (KEMs). Hash Functions A cryptographic hash function is a one-way function that maps data of arbitrary size to data of fixed size. The most important properties of cryptographic hash functions are pre-image resistance, second pre-image resistance, and collision resistance. Pre-image resistance describes the one-way property of a hash functions, i.e., the difficulty to find an input that if hashed matches a given output. Second pre-image resistance on the other hand means that given a certain input, it is difficult to find another (different) input that generates the same hash value. Collision resistance means that it is hard to find any pair of different inputs that generate the same hash value. If the output is not fixed but variable, the algorithm is called an extendable-output function (XOF). Hash functions are also often used to instantiate random oracles in cryptographic schemes. Security Model The security of encryption schemes (or KEMs) can be analyzed regarding different attacker models. The simplest attacker model is to assume that the attacker has access to some plaintext–ciphertext pair and tries to deduce

24

T. Oder et al.

information about the secret key from the given pair. The difference to a chosenplaintext attack (CPA) setting is that in this case the attacker has access to a plaintext–ciphertext pair that was generated from a plaintext that the attacker was able to choose. An even stronger assumption is the chosen-ciphertext (CCA) setting. In this case, the attacker has access to a decryption oracle and can generate plaintext–ciphertext pairs by performing a decryption operation on a ciphertext of his choice. In an adaptive chosen-ciphertext attack (CCA2), the attacker can even adapt his queries to the decryption oracle. Number-Theoretic Transform The number-theoretic transform (NTT) is a discrete Fourier transform over a finite field. An interesting property of the discrete Fourier transform, which is also highly interesting for lattice-based cryptography, is the ability to reduce the overall complexity of (polynomial) multiplication to O(n · log n). To allow efficient computation of the NTT the coefficient ring has to contain primitive roots of unity. Definition 2.1 (Primitive Roof of Unity [57]) Let R be a ring, n ∈ N≥1 , and ω ∈ R. The value ω is an n-th root of unity if ωn = 1. The value ω is a primitive n-th root of unity (or root of unity of order n) if it is an n-th root of unity, n ∈ R is a unit in R, and ωn/t − 1 is not a zero divisor for any prime divisor t of n. For a given primitive n-th root of unity ω in Zq , the NTT of a vector a = (an−1 , . . . , a0 ) is the vector a˜ = (a˜ n−1 , . . . , a˜ 0 ) that is computed as a˜ i =



0≤j 0.

(3.13)

Then all vectorial derivatives of f (x) with regard to x0 g1 (x) = der f (x) x0

belong to the class

 CN 1 g1re (x), g1id (x) with the mark function of the vectorial derivative of the class CN with regard to x0 g1re (x) = der f re (x), x0

and the independence function g1id (x) associated with IDM(g1 ) = UM(IDM(f re (x)), x0 );

(3.14)

3 Derivative Operations for Classes CN of Boolean Functions

69

all vectorial minima of f (x) with regard to x0 g2 (x) = min f (x) x0

belong to the class

 CN 2 g2re (x), g2id (x) with the mark function of the vectorial minimum of the class CN with regard to x0 g2re (x) = min f re (x), x0

(3.15)

and the independence function g2id (x) associated with IDM(g2 ) = UM(IDM(f re (x)), x0 ); and all vectorial maxima of f (x) with regard to x0 g3 (x) = max f (x) x0

belong to the class

 CN 3 g3re (x), g3id (x) with the mark function of the vectorial maximum of the class CN with regard to x0 g3re (x) = max f re (x), x0

(3.16)

and the independence function g3id (x) associated with IDM(g3 ) = UM(IDM(f re (x)), x0 ). The three independence functions are equal to each other: g1id (x) = g2id (x) = g3id (x) = g id (x), with IDM(g) = UM(IDM(f ), x0 )

(3.17)

70

B. Steinbach and C. Posthoff

and rank(IDM(g)) = rank(IDM(f )) + 1. If Condition (3.13) is not satisfied, we have smin = MIDC(IDM(f ), x0 ) = 0 and all functions of the given class CN do not depend on the simultaneous change of x0 . In this case of the vectorial derivative operations of the  the mark functions  given class CN f re (x), f id (x) are g1re (x) = 0,

IDM(g1 ) = In ,

(3.18)

g2re (x) = f re (x),

IDM(g2 ) = IDM(f ),

(3.19)

g3re (x) = f re (x),

IDM(g3 ) = IDM(f ),

(3.20)

where In is the identity matrix of the size n. From (3.18) follows that the vectorial derivatives with regard to x0 of all  functions f (x) of the given class CN f re (x), f id (x) , which do not depend on the simultaneous change of x0 , i.e., smin = 0, are equal to the constant function f (x) = 0(x). Example 3.8 Figure 3.2 shows the Karnaugh-maps of the 16 Boolean functions of one class CN of bent functions of four variables. These 16 functions depend on all 24 − 1 = 15 directions of change, i.e., all vectorial derivatives of these functions are not equal to 0; hence, the independence matrix of this class CN is an empty matrix of the size 4 and the independence function f id (x) = 0. Obviously, it is more convenient to represent this class of bent functions by CN x1 x2 ⊕ x3 x4 ⊕ x1 x3 ⊕ x1 x4 , 0 instead of the enumeration of all 16 functions: CN = { x1 x2 ⊕ x3 x4 ⊕ x1 x3 ⊕ x1 x4 , x 1 x2 ⊕ x3 x4 ⊕ x 1 x3 ⊕ x 1 x4 , x1 x 2 ⊕ x3 x4 ⊕ x1 x3 ⊕ x1 x4 , x 1 x 2 ⊕ x3 x4 ⊕ x 1 x3 ⊕ x 1 x4 , x1 x2 ⊕ x 3 x4 ⊕ x1 x 3 ⊕ x1 x4 , x 1 x2 ⊕ x 3 x4 ⊕ x 1 x 3 ⊕ x 1 x4 , x1 x 2 ⊕ x 3 x4 ⊕ x1 x 3 ⊕ x1 x4 , x 1 x 2 ⊕ x 3 x4 ⊕ x 1 x 3 ⊕ x 1 x4 , x1 x2 ⊕ x3 x 4 ⊕ x1 x3 ⊕ x1 x 4 , x 1 x2 ⊕ x3 x 4 ⊕ x 1 x3 ⊕ x 1 x 4 , x1 x 2 ⊕ x3 x 4 ⊕ x1 x3 ⊕ x1 x 4 , x 1 x 2 ⊕ x3 x 4 ⊕ x 1 x3 ⊕ x 1 x 4 ,

3 Derivative Operations for Classes CN of Boolean Functions

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

0 0 1 0 0 0

0 0 1 0 1 0

1 0 0 0 1 1

f0 (x) 0 1 1 1 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

0 1 0 0 0 0

0 1 0 0 1 0

0 0 0 1 1 1

f4 (x) 1 1 1 0 0 x2 1 x1

0 0 0 1 0 0

0 0 0 1 1 0

0 1 0 0 1 1

f8 (x) 1 0 1 1 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

1 0 0 0 0 0

1 0 0 0 1 0

0 0 1 0 1 1

f12 (x) 1 1 0 1 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

0 1 1 1 0 0

1 0 0 0 1 0

0 0 1 0 1 1

f1 (x) 0 0 1 0 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

1 1 1 0 0 0

0 0 0 1 1 0

0 1 0 0 1 1

f5 (x) 0 1 0 0 0 x2 1 x1

1 0 1 1 0 0

0 1 0 0 1 0

0 0 0 1 1 1

f9 (x) 0 0 0 1 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

1 1 0 1 0 0

0 0 1 0 1 0

1 0 0 0 1 1

f13 (x) 1 0 0 0 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

0 0 1 0 0 0

0 0 1 0 1 0

71

0 1 1 1 1 1

f2 (x) 1 0 0 0 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

x3 x4 0 0 0 1 1 1 1 0

0 1 0 0 0 0

0 1 0 0 1 0

1 1 1 0 1 1

f6 (x) 0 0 0 1 0 x2 1 x1

0 0 0 1 0 0

0 0 0 1 1 0

1 0 1 1 1 1

f10 (x) 0 1 0 0 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

1 0 0 0 0 0

1 0 0 0 1 0

1 1 0 1 1 1

f14 (x) 0 0 1 0 0 x2 1 x1

x3 x4 0 0 0 1 1 1 1 0

1 0 0 0 0 0

0 1 1 1 1 0

0 0 1 0 1 1

f3 (x) 0 0 1 0 0 x2 1 x1

0 0 0 1 0 0

1 1 1 0 1 0

0 1 0 0 1 1

f7 (x) 0 1 0 0 0 x2 1 x1

0 1 0 0 0 0

1 0 1 1 1 0

0 0 0 1 1 1

f11 (x) 0 0 0 1 0 x2 1 x1

0 0 1 0 0 0

1 1 0 1 1 0

1 0 0 0 1 1

f15 (x) 1 0 0 0 0 x2 1 x1

Fig. 3.2 One class of 16 bent functions of four variables

x1 x2 ⊕ x 3 x 4 ⊕ x1 x 3 ⊕ x1 x 4 , x 1 x2 ⊕ x 3 x 4 ⊕ x 1 x 3 ⊕ x 1 x 4 , x1 x 2 ⊕ x 3 x 4 ⊕ x1 x 3 ⊕ x1 x 4 , x 1 x 2 ⊕ x 3 x 4 ⊕ x 1 x 3 ⊕ x 1 x 4 } . Besides the comparison of the alternative representations of this class CN of 16 bent functions it is the aim of this example to calculate all vectorial maxima of this class with regard to x0 = (x2 , x4 ). Using the representative function f re (x) = f0 (x) = x1 x2 ⊕ x3 x4 ⊕ x1 x3 ⊕ x1 x4 and (3.16) we get the representative function of the vectorial maximum of the class CN with regard to x0 = (x2 , x4 ) g re (x) = max f re (x) = (x1 (x2 ⊕ x4 )) ∨ x3 (x2 ,x4 )

72

B. Steinbach and C. Posthoff

Fig. 3.3 Karnaugh-map of the representative function g re (x) and the independence matrix IDM(CN (g(x))) that specify the eight Boolean functions of the calculated vectorial maximum with regard to (x2 , x4 )

x3 x4 0 0 0 1 1 1 1 0

0 0 1 1 0 0

0 0 1 1 1 0

g re (x) 1 0 0 1 1 1 1 1 1 0 x2 1 1 x1

i 1 2 3 4

j1 2 3 4 0 0 0 0

0 1 0 0

0 0 0 0

0 1 0 0

IDM(CN (g(x)))

and independence function of the resulting class g id (x) = der g(x) . (x2 ,x4 )

This independence function contains one vectorial derivative; hence, the associated independence matrix contains two values 1 in the second row, the rank of this independence matrix is rank(IDM(CN (g(x)))) = 1, so that the class

 CN (x1 (x2 ⊕ x4 )) ∨ x3 , der g(x) (x2 ,x4 )

contains 2n−rank(IDM(CN (g))) = 24−1 = 23 = 8 functions g(x) of four variables. Due to the value 1 of IDM(g)[ 2, 2 ] we have c2 = 0 and the eight functions of the class CN (g) can be generated using g re (x) and the three coefficients c1 , c3 , and c4 of (3.1). Figure 3.3 shows the Karnaugh-map of the representative function g re (x) and the independence matrix IDM(CN (g(x))) which determine the resulting class CN (g(x)) of the vectorial maximum of the given class CN (f (x)) with regard to (x2 , x4 ).

3.3.3 Single Derivative Operations of Classes CN of Boolean Functions The restriction of the set of variables x0 to the single variables xi leads to the adapted Theorem 3.7 for derivative operations with regard to a single variable for   all functions f (x) of the given class CN f re (x), f id (x) . Theorem 3.7 (Single Derivative Operations of a Class CN of Boolean Functions) Let f (x) = f (xi , x1 ) = f (x1 , x2 , . . . , xn )

3 Derivative Operations for Classes CN of Boolean Functions

73

  be a Boolean function of n variables that belongs to the class CN f re (x), f id (x) defined by (3.1), where f re (x) depends on the change of the value of the variable xi : MIDC(IDM(f re (x)), xi ) > 0.

(3.21)

Then all single derivatives of f (x) with regard to xi g1 (x) = der f (x) xi

belong to the class

 CN 1 g1re (x), g1id (x) with the mark function of the single derivative of the class CN with regard to xi g1re (x) = der f re (x), xi

(3.22)

and the independence function g1id (x) associated with IDM(g1 ) = UM(IDM(f re (x)), xi ); all single minima of f (x) with regard to xi g2 (x) = min f (x) xi

belong to the class

 CN 2 g2re (x), g2id (x) with the mark function of the single minimum of the class CN with regard to xi g2re (x) = min f re (x), xi

and the independence function g2id (x) associated with IDM(g2 ) = UM(IDM(f re (x)), xi ); and all single maxima of f (x) with regard to xi g3 (x) = max f (x) xi

(3.23)

74

B. Steinbach and C. Posthoff

belong to the class

 CN 3 g3re (x), g3id (x) with the mark function of the single maximum of the class CN with regard to xi g3re (x) = max f re (x), xi

(3.24)

and the independence function g3id (x) associated with IDM(g3 ) = UM(IDM(f re (x)), xi ). The three independence functions are equal to each other: g1id (x) = g2id (x) = g3id (x) = g id (x),

(3.25)

with IDM(g) = UM(IDM(f ), xi ) and rank(IDM(g)) = rank(IDM(f )) + 1. If Condition (3.21) is not satisfied, we have smin = MIDC(IDM(f ), xi ) = 0 and all functions of the given class CN do not depend on the change of xi . In this case the mark functions of the single derivative operations of the given class CN f re (x), f id (x) are g1re (x) = 0,

IDM(g1 ) = In ,

(3.26)

g2re (x) = f re (x),

IDM(g2 ) = IDM(f ),

(3.27)

g3re (x) = f re (x),

IDM(g3 ) = IDM(f ),

(3.28)

where In is the identity matrix of the size n. From (3.26) follows that the single derivatives with regard to xi of all functions  f (x) of the given class CN f re (x), f id (x) , which do not depend on the change of xi , i.e., smin = 0, are equal to the constant function f (x) = 0(x).

3 Derivative Operations for Classes CN of Boolean Functions

75

Example 3.9 We use the resulting class CN (g(x)) of Example 3.8, rename this class to CN (f (x)), and calculate the single derivative with regard to x2 . The renamed independence matrix IDM(CN (f (x))) is not empty (see Fig. 3.3) so that it must be verified whether Condition (3.21) is satisfied. The binary vector of x2 for functions of four variables is BV (x2 ) = (0100). The result calculated by Algorithm 1 (MIDC) for x2 and IDM(CN (f (x))) is smin = (0001), so that Condition (3.21) is satisfied and the representative function of all single derivatives of the class

 CN (x1 (x2 ⊕ x4 )) ∨ x3 , der f (x) (x2 ,x4 )

with regard to x2 can be calculated using (3.22): g re (x) = der f re (x) = x1 x 3 . x2

Due to (3.21) Algorithm 2 (UM) must be used to adjust the resulting independence matrix of this single derivative of the class CN (f ). Algorithm 2 determines in line 2 smin = (0001) so that the condition of line 3 is satisfied and the index of the most significant bit is assigned in line 4: j = 4. In the second swap of the while-loop of lines 6–11 the condition of line 7 is satisfied so that the ⊕-operation removes rightmost 1 in the second row of the independence matrix IDM(CN (g(x))). No other changes occur in the while-loop, and smin is stored into the last row of IDM(CN (g(x))) in line 12 of Algorithm 2 (UM). The independence function g id (x) associated with the resulting independence matrix IDM(CN (g(x))) is g id (x) = der g(x) ∨ der g(x). x2

x4

This independence function contains two single derivatives; hence, the associated independence matrix contains two values 1 in the main diagonal, the rank of this independence matrix is rank(IDM(CN (g(x)))) = 2, so that the class



CN x1 x 3 , der g(x) ∨ der g(x) x2

x4

contains 2n−rank(IDM(CN (g))) = 24−2 = 22 = 4 functions g(x) of four variables. This confirms that each vectorial (and also single) derivative with regard to a direction of change the class is depending on divides the number of functions of the given class in halves.

76

B. Steinbach and C. Posthoff

Fig. 3.4 Karnaugh-map of the representative function g re (x) and the independence matrix IDM(CN (g(x))) that specify the four Boolean functions of the calculated single derivative with regard to x2

x3 x4 0 0 0 1 1 1 1 0

0 0 0 0 0 0

0 0 0 0 1 0

g re (x) 1 1 1 1 0 0 0 0 1 0 x2 1 1 x1

i 1 2 3 4

j1 2 3 4 0 0 0 0

0 1 0 0

0 0 0 0

0 0 0 1

IDM(CN (g(x)))

Figure 3.4 shows the Karnaugh-map of the representative function g re (x) using the original Boolean space B4 and the independence matrix IDM(CN (g(x))) which determine the resulting class CN (g(x)) of the single derivative of the given class CN (f (x)). Algorithm 1 found for the given direction of change x2 (BV (x2 ) = (0100)) the vector smin = (0001) of the associated variable x4 ; hence, the single derivative of the given class CN (f (x)) with f id = der(x2 ,x4 ) f (x) has the same result if it is calculated with regard to x2 or with regard to x4 . All Boolean functions of the resulting class CN (g(x)) are independent of x2 , x4 , and the simultaneous change of (x2 , x4 ): der g(x) = 0, x2

der g(x) = 0, x4

der g(x) = 0;

(x2 ,x4 )

hence, all four Boolean functions of the resulting class CN (g(x)) contain quadruples of identical function values. Each pair of these three derivatives specifies this property. Algorithm 2 selected as unique representation the two single derivatives.

3.3.4 k-Fold Derivative Operations of Classes CN of Boolean Functions Repeated derivative operations of the same type with regard to different variables are summarized to k-fold derivative operations. It is a consequence of Theorem 3.7 that   each k-fold derivative operation of a given class CN f re (x), f id (x) results again in a class CN of Boolean functions. Theorem 3.8 (k-Fold Derivative Operations of a Class CN of Boolean Functions) Let f (x) = f (x0 , x1 ) = f (x1 , x2 , . . . , xn )   be a Boolean function of n variables that belongs to the class CN f re (x), f id (x) defined by (3.1), and there is at least one x0i ∈ x0 with der f (x) = 0. x0i

(3.29)

3 Derivative Operations for Classes CN of Boolean Functions

77

Then all k-fold derivatives of f (x) with regard to x0 g1 (x) = derk f (x) x0

belong to the class

 CN 1 g1re (x), g1id (x) with the mark function of the k-fold derivative of the class CN with regard to x0 g1re (x) = derk f re (x), x0

(3.30)

and the independence function g1id (x) that is associated with IDM(g1 ) satisfies ∀x0i ∈ x0 :

MIDC(IDM(g1 ), x0i ) = 0;

all k-fold minima of f (x) with regard to x0 g2 (x) = mink f (x) x0

belong to the class

 CN 2 g2re (x), g2id (x) with the mark function of the k-fold minimum of the class CN with regard to x0 g2re (x) = mink f re (x), x0

(3.31)

and the independence function g2id (x) that is associated with IDM(g2 ) satisfies ∀x0i ∈ x0 :

MIDC(IDM(g2 ), x0i ) = 0;

all k-fold maxima of f (x) with regard to x0 g3 (x) = maxk f (x) x0

belong to the class

 CN 3 g3re (x), g3id (x)

78

B. Steinbach and C. Posthoff

with the mark function of the k-fold maximum of the class CN with regard to x0 g3re (x) = maxk f re (x), x0

(3.32)

and the independence function g3id (x) that is associated with IDM(g3 ) satisfies ∀x0i ∈ x0 :

MIDC(IDM(g3 ), x0i ) = 0;

and all Δ-operations of f (x) with regard to x0 g4 (x) = Δx0 f (x) belong to the class

 CN 4 g4re (x), g4id (x) with the mark function of the Δ-operation with regard to x0 g4re (x) = Δx0 f re (x),

(3.33)

and the independence function g4id (x) associated with IDM(g4 ) satisfies ∀x0i ∈ x0 :

MIDC(IDM(g4 ), x0i ) = 0.

The four independence functions are equal to each other: g1id (x) = g2id (x) = g3id (x) = g4id (x) = g id (x),

(3.34)

IDM(g) = UM(. . . UM(IDM(f ), x01 ), . . . , x0k )

(3.35)

with

and rank(IDM(f )) + 1 ≤ rank(IDM(g)) ≤ rank(IDM(f )) + k. If Condition (3.29) is not satisfied, we have ∀x0i ∈ x0 :

smin = MIDC(IDM(f ), x0i ) = 0

3 Derivative Operations for Classes CN of Boolean Functions

79

and all functions of the given class CN do not depend on the change of all x0i ∈ x0 . In this  case the mark  functions of the k-fold derivative operations of the given class CN f re (x), f id (x) are g1re (x) = 0,

IDM(g1 ) = In ,

(3.36)

g2re (x) = f re (x),

IDM(g2 ) = IDM(f ),

(3.37)

g3re (x) = f re (x),

IDM(g3 ) = IDM(f ),

(3.38)

g4re (x) = 0,

IDM(g4 ) = In ,

(3.39)

where In is the identity matrix of the size n. From (3.36) and (3.39) follows that the k-fold derivatives as well with regard to x0 of all functions  as the Δ-operation  f (x) of the given class CN f re (x), f id (x) , which do not depend on the change of all x0i ∈ x0 , i.e., smin = 0 for all these x0i , are equal to the constant function f (x) = 0(x).   Example 3.10 A class CN f re (x), f id (x) of eight Boolean functions of four variables is given by the unique representative function: f re (x) = x2 ∨ x 1 x 3 x4 ∨ x1 x3 x 4 and the independence function: f id (x) =

der

(x1 ,x3 ,x4 )

f (x).

Figure 3.5 shows the Karnaugh-map of the representative function f re (x) and the independence matrix IDM(CN (f (x))) of the given class. Which Boolean functions belong to a class CN (g(x)) that is the result of the twofold derivative of the class CN (f (x)) with regard to (x2 , x4 )? The verification of the Condition (3.29) using Algorithm 1 (MIDC) leads to the result that the Boolean functions of the given class CN (f (x)) depend on both x2 and Fig. 3.5 Karnaugh-map of the representative function f re (x) and the independence matrix IDM(CN (f (x))) of the give class

x3 x4 0 0 0 1 1 1 1 0

0 1 0 0 0 0

1 1 1 1 1 0

f re (x) 1 0 1 0 1 0 1 1 1 0 x2 1 1 x1

i 1 2 3 4

j1 2 3 4 1 0 0 0

0 0 0 0

1 0 0 0

1 0 0 0

IDM(CN (f (x)))

80

B. Steinbach and C. Posthoff

x4 ; hence, the twofold derivative of the CN (f (x)) can be calculated by (3.30) g re (x) = derk f re (x) = x1  x3 . x0

The independence matrix IDM(CN (g(x))) must be iteratively calculated for x2 and x4 using (3.35): – the execution of Algorithm 2 (UM) for x2 includes the binary vector BV (x2 ) = (0100) into the second row of the copied independence matrix IDM(CN (g(x))); – the execution of Algorithm 2 (UM) for x4 removes rightmost the value 1 in the first row (IDM(CN (g(x)))[1, 4] = 1) and includes the binary vector BV (x4 ) = (0001) into the fourth row of the intermediate independence matrix IDM(CN (g(x))); hence, the resulting independence function is g id (x) = der g(x) ∨ der g(x) ∨ der g(x). (x1 ,x3 )

x2

x4

This independence function contains one vectorial derivative and two single derivatives; hence, the associated independence matrix contains three values 1 in the main diagonal, the rank of this independence matrix is rank(IDM(CN (g(x)))) = 3 so that the class



CN x1  x3 , der g(x) ∨ der g(x) ∨ der g(x) (x1 ,x3 )

x2

x4

contains 2n−rank(IDM(CN (g))) = 24−3 = 21 = 2 functions g(x) of four (or reduced only 2) variables. This confirms that due to the two used directions of change for which given class is depending on the number of the eight given functions has been reduced by a factor of 22 = 4 so that the resulting class contains only the two functions: CN (g(x)) = {x1  x3 , x1 ⊕ x3 }. Figure 3.6 shows the Karnaugh-map of the representative function g re (x) using the original Boolean space B4 and the independence matrix IDM(CN (g(x))) that specify the two Boolean functions of the calculated twofold derivative with regard to (x2 , x4 ).

3 Derivative Operations for Classes CN of Boolean Functions Fig. 3.6 Karnaugh-map of the representative function g re (x) and the independence matrix IDM(CN (g(x))) that specify the two Boolean functions of the calculated twofold derivative with regard to (x2 , x4 )

x3 x4 0 0 0 1 1 1 1 0

1 1 0 0 0 0

1 1 0 0 1 0

g re (x) 0 0 0 0 1 1 1 1 1 0 x2 1 1 x1

81

i 1 2 3 4

j1 2 3 4 1 0 0 0

0 1 0 0

1 0 0 0

0 0 0 1

IDM(CN (g(x)))

3.4 Conclusion This contribution extends the theory of derivative   operations of the Boolean differential calculus to classes CN f re (x), f id (x) of Boolean functions, where f re (x) is a representative function of this equivalence class and the independence function f id (x) indicates the directions of change all functions of this class are independent of. It has been shown that all  derivative operations transform such a class into another class CN g re (x), g id (x) of the same type. If a direction of change is used for a vectorial derivative operation (which include the single derivative operations) the given class is depending on, the number of Boolean function of the resulting class is reduced to one halve of the given functions. A vectorial derivative of the different Boolean functions of a class CN has in general different Boolean functions as result. However, if the result of a vectorial derivative of one Boolean function of a class CN is equal to 0, then the results of the same vectorial derivatives of all other Boolean functions of this class CN are also equal to 0. The proof of the associated theorem is a remarkable result of this contribution that significantly decreases the effort to calculate all derivative operations for classes CN of Boolean functions. Based on the provided theory it is not necessary to calculate the derivative operation for each function of the class separately; it is sufficient to calculate the required derivative operation for a representative function of the given class and adjust the associated independence matrix. Algorithms that uniquely determine the directions of change all functions of the class are not depending on could be reused from the theory of derivative operations of lattices of Boolean function.

References 1. Posthoff, C., Steinbach, B.: Logic Functions and Equations – Binary Models for Computer Science, 2nd edn. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-02420-8 2. Stankovi´c, R. S., Astola, J., Steinbach, B.: Former and recent work in classification of switching functions. In: Steinbach, B. (ed.) Proceedings of the 8th International Workshops on Boolean Problems, September 18–19, 2008, pp. 115–126. Freiberg University of Mining and Technology, Freiberg (2008). ISBN 978-3-86012-346-1 3. Steinbach, B.: Generalized Lattices of Boolean Functions Utilized for Derivative Operations. Materialy konferencyjne KNWS13, Lagów, pp. 1–17 (2013). https://doi.org/10.13140/2.1.1874. 3680

82

B. Steinbach and C. Posthoff

4. Steinbach, B., Posthoff, Ch.: Boolean differential calculus – theory and applications. J. Comput. Theor. Nanosci. 7(6), 933–981 (2010). https://doi.org/10.1166/jctn.2010.1441. American Scientific Publishers, Valencia, CA 5. Steinbach, B., Posthoff, Ch.: Boolean Differential Equations. Morgan & Claypool Publishers, San Rafael (2013), ISBN 978-1-62705-241-2 (paperback), 978-1-62705-242-9 (ebook). https:// doi.org/10.2200/S00511ED1V01Y201305DCS042 6. Steinbach, B., Posthoff, Ch.: Derivative Operations for Lattices of Boolean Functions. Proceedings Reed-Muller Workshop, pp. 110–119, Toyama (2013). https://doi.org/10.13140/2.1.2398. 6568 7. Steinbach, B., Posthoff, Ch.: Vectorial bi-decompositions for lattices of Boolean functions. In: Steinbach, B. (ed.) Proceedings of the 12th International Workshops on Boolean Problems, pp. 93–104, September 22–23, 2016, Freiberg University of Mining and Technology, Freiberg (2016). ISBN 978-3-86012-488-8 8. Steinbach, B., Posthoff, Ch.: Boolean Differential Calculus. Morgan & Claypool Publishers, San Rafael (2017). https://doi.org/10.2200/S00766ED1V01Y201704DCS052

Chapter 4

Towards the Structure of a Class of Permutation Matrices Associated with Bent Functions Radomir S. Stankovi´c, Milena Stankovi´c, Jaakko T. Astola, and Claudio Moraga

4.1 Introduction Bent functions are a special class of Boolean functions with interesting properties, as high nonlinearity, and due to that, with important applications in few areas including cryptography as probably the most attractive among them [1, 15]. They are a very small portion of the total number of Boolean functions for a given number of variables. From the spectral point of view, all bent functions belong to the single class of functions with the flat Walsh spectrum. This property implies that spectra of bent functions are mutually different in the order of Walsh coefficients, with all the coefficients having the same absolute value equal 2n/2 , where n is the number of variables. The same statement about the mutual difference of bent functions in terms of permutations is true also in the Boolean domain recalling that bent functions have a determined number of non-zero values and, therefore, can be split into two subsets of functions with respect to the number of non-zero values. These subsets are of the same cardinality and functions in a subset are logic complements of functions in the other. Permutations that relate two bent functions are hard to observe either in the Boolean or Walsh spectral domain, since in both cases, there are just two different values in the vectors of function values and spectral coefficients to be permuted. The

R. S. Stankovi´c () Mathematical Institute of SASA, Belgrade, Serbia M. Stankovi´c Department of Computer Science, Faculty of Electronic Engineering, Niš, Serbia J. T. Astola Department of Signal Processing, Tampere University of Technology, Tampere, Finland C. Moraga Technical University of Dortmund, Dortmund, Germany © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_4

83

84

R. S. Stankovi´c et al.

transition to Gibbs coefficients of bent functions determined by the Gibbs dyadic derivative suggested in [10] and further extended to multiple-valued functions in [11–13] permits to clearly differentiate the values to be permuted and determine the related permutation matrices the structure of which is the subject of study in the present chapter. It turns out that the Gibbs derivative written as a vector of Gibbs coefficients of a bent function corresponds to a permutation unique to the function and its complement [14]. On the other hand the truth table of a bent function can be permuted in a huge number of ways without changing the function given. The transition to Gibbs coefficients of bent functions determined by the Gibbs dyadic derivative was suggested in [10] and used to check bentness of Boolean functions. An important advantage is taken from the property that computing the Gibbs derivatives can be performed over GPU systems by exploiting both data and task parallelism [9]. The same transition permits to clearly differentiate the values to be permuted and determine the related permutation matrices assigned to bent functions. This property is used in [12] as a mean to define a characterization of ternary bent functions. In [13], the permutation matrices assigned to binary bent functions are used to generate quaternary bent functions due to their encoding by binary values. In the present work, we analyze the structure of permutation matrices assigned to bent functions by the Gibbs derivative in terms of appropriately determined submatrices and their positions within the permutation matrix.

4.2 Background Theory In this section, we present a necessary theoretical background upon which the further considerations are based.

4.2.1 Bent Functions A Boolean function f in n variables, defined as a mapping f : {0, 1}n → {0, 1}, where n is even, is bent if its nonlinearity is as large as possible, i.e., 2n−1 − 2n/2−1 . The Hamming weight, i.e., the number of 1 values in the truth-vector of a bent function is uniquely specified as either 2n−1 − 2n/2−1 or 2n−1 + 2n/2−1 . Thus, every bent function takes the same values as any affine function at the number of points equal to the Hamming weight. The nonlinearity is defined as the minimum number of points at which a function equals any affine function and, therefore, for bent functions it is the maximum possible 2n−1 − 2n/2−1 . The degree of a bent function f , defined as the maximum number of variables in a product term in the positive polarity Reed–Muller expression for f , is n/2. Example 4.1 Let f be a bent function. If n = 2, its Hamming weight is 1 or 3, whereas if n = 4, its Hamming weight is 6 or 10.

4 Permutation Matrices Associated to Bent Functions

85

Depending on the number of non-zero values, we split the sets of all Boolean functions into two subsets. The first set contains functions with 2n−1 − 2n/2−1 nonzero values and the other set contains their logic complements. In this area, logic values 0 and 1 are usually encoded by 1 and −1, respectively, and interpreted as integers.

4.2.2 Walsh Transform Consider the finite dyadic group Gn defined as the set of binary n-tuples under the operation componentwise addition modulo 2, EXOR, whose elements can be identified with the first 2n non-negative integers Bn = {0, 1, . . . , 2n − 1}. The discrete Walsh transform in Hadamard ordering is defined in matrix notation by the (2n × 2n ) Walsh transform matrix W(n) =

n  i=1



W(1),

 1 1 W(1) = , 1 −1

where ⊗ denotes the Kronecker product of matrices. For a function f on Bn with the truth-vector F = [f (0), f (1), . . . , f (2n − 1)]T , the Walsh spectrum Sf = [Sf (0), Sf (1), . . . , Sf (2n − 1)]T is defined as Sf = W(n)F. In computing the Walsh spectrum, the truth-vector F is replaced by the function vector in the (0, 1) → (1, −1) encoding.

4.2.3 Walsh Transform and Bent Functions Walsh spectral coefficients Sf (i), i = 0, 1, . . . , 2n − 1, of a bent function have the same absolute value equal to 2n/2 [8]. Due to that, bent functions are alternatively defined as Boolean functions with a flat Walsh spectrum. Definition 4.1 A Boolean function derived from the Walsh spectrum of a bent function f by multiplication of the Walsh coefficients with 2−n/2 is called the dual function fd of f . Example 4.2 Consider the function defined by the function vector F1 = [−1, −1, 1, −1, −1, 1, 1, 1, 1, 1, −1, 1, −1, 1, 1, 1]T ,

86

R. S. Stankovi´c et al.

where the elements of F1 are obtained with the (0, 1) → (1, −1) encoding. Its Walsh spectrum is Sf1 = [4, −4, −4, −4, −4, 4, 4, 4, −4, 4, −4, −4, −4, 4, −4, −4]T and since it is flat, the function is bent. Its dual function is Fd1 = [1, −1, −1, −1, −1, 1, 1, 1, −1, 1, −1, −1, −1, 1, −1, −1]T . Notice that in this example, the initial function f1 and its dual function fd1 have 6 and 10 non-zero values, respectively. The function f2 specified by the function vector F2 = [1, 1, 1, 1, 1, 1, −1, −1, 1, −1, 1, −1, 1, −1, −1, 1]T is bent since its Walsh spectrum is Sf2 = [4, 4, 4, 4, 4, 4, −4, −4, 4, −4, 4, −4, 4, −4, −4, 4]T , and its dual function fd2 is Fd2 = [1, 1, 1, 1, 1, 1, −1, −1, 1, −1, 1, −1, 1, −1, −1, 1]T = F2 . This function has the same number of non-zero values as the initial function, moreover, the Walsh spectrum is equal to the function vector multiplied by 4. The function f3 specified by the function vector F3 = [1, 1, 1, −1, 1, 1, 1, −1, −1, −1, −1, 1, 1, 1, 1, −1]T has the Walsh spectrum Sf3 = [4, 4, 4, −4, −4, −4, −4, 4, 4, 4, 4, −4, 4, 4, 4, −4]T , and its dual function fd3 has the same number of non-zero elements but, it is not identical to f3 Fd3 = [1, 1, 1, −1, −1, −1, −1, 1, 1, 1, 1, −1, 1, 1, 1, −1]T .

4.3 Gibbs Dyadic Derivative For the sake of completeness, Sects. 4.3 and 4.4 review some aspects of Gibbs derivatives, most of them already presented in [10–12].

4 Permutation Matrices Associated to Bent Functions

87

Gibbs dyadic derivative is defined as a differential operator that has in the Walsh dyadic analysis a role corresponding to that of the Newton–Leibniz derivative in classical mathematical analysis [2]. Definition 4.2 For a function f on Gn , equally on Bn , the Gibbs dyadic derivative is defined as f [1] (x) =

1 (f (x ⊕ 2r ) − f (x))2r , 2 n−1

x ∈ Bn ,

r=0

and the operator Dn f = f [1] is called the Gibbs differentiator [2]. This operator can be equally applied to either complex-valued functions or Boolean functions, but in this case the logic values 0 and 1 are interpreted as the corresponding integers due to the arithmetic operations in Definition 4.2. Further, the abovementioned encoding of Boolean values (0, 1) → (1, −1) is assumed. It follows that the values of the Gibbs dyadic derivative are in the general case complex numbers, and integers in the case of Boolean functions. In matrix notation, the Gibbs dyadic derivative is defined by the (2n × 2n ) matrix D(n) = [dξ,η ], ξ, η ∈ {0, 1, . . . , 2n − 1}, whose entries are defined as dξ,η

  n−1  1 n r r = 2 δ(ξ ⊕ η, 2 ) , (2 − 1)δ(ξ ⊕ η, 0) − 2 r=0

where the function δ is the Kronecker delta. The matrix D(n) is called the Gibbs matrix, and the Gibbs dyadic derivative Df = [d(0), d(1), . . . , d(2n − 1)]T of a function f specified by the function vector F is determined as Df = D(n)F. The elements d(i), i = 0, 1, . . . , 2n − 1, of Df , which in the case of Boolean functions are integers, are called the Gibbs coefficients. It is shown already in [2] that the Gibbs matrix can be written as D(n) = −

1 W(n)G(n)W(n), 2n

where G(n) = diag(0, 1, . . . , 2n − 1) is the diagonal matrix whose elements are non-negative integers smaller than 2n − 1. Example 4.3 For n = 3, the matrix G(n) = diag(0, 1, 2, 3, 4, 5, 6, 7), and  W(3) =

1 1 1 −1

⊗3 ,

88

R. S. Stankovi´c et al.

where ⊗3 is the 3-th power Kronecker product of matrices. A simple computation yields the Gibbs matrix ⎡

⎤ −7 1 2 0 4 0 0 0 ⎢ 1 −7 0 2 0 4 0 0 ⎥ ⎢ ⎥ ⎢ 2 0 −7 1 0 0 4 0 ⎥ ⎢ ⎥ ⎥ 1⎢ ⎢ 0 2 1 −7 0 0 0 4 ⎥ D(3) = − ⎢ ⎥. 2 ⎢ 4 0 0 0 −7 1 2 0 ⎥ ⎢ ⎥ ⎢ 0 4 0 0 1 −7 0 2 ⎥ ⎢ ⎥ ⎣ 0 0 4 0 2 0 −7 1 ⎦ 0 0 0 4 0 2 1 −7 The discrete Walsh functions are eigenfunctions of the dyadic Gibbs derivative with eigenvalues in Bn = {0, 1, 2, . . . , 2n − 1} [9], i.e., they are equal to sequencies (number of zero crossings) of Walsh functions in the so-called sequency ordering [6]. This statement can be easily seen if we multiply the Gibbs matrix from the right with the Walsh matrix, i.e., D(n)W(n) = 2−n (W(n)G(n)W(n))W(n) = W(n)G(n), since the Walsh matrix is a self-inverse matrix up to the constant 2n . Recall that the Walsh matrix is a symmetric matrix whose rows, equivalently, columns are Walsh functions wal(i, x), i = 0, 1, . . . , 2n − 1, x = (x1 , x2 , . . . , xn ), and it follows: D(n)W(n) = D(n)[wal(0, x), wal(1, x), . . . , wal(2n − 1, x)] = [0, 1 · wal(1, x), 2 · wal(2, x), . . . , (2n − 1) · wal(2n − 1, x)], and, therefore, the Walsh functions wal(i, x) are eigenfunction of the Gibbs derivative with eigenvalues 0, 1, . . . , 2n − 1, correspondingly [3–5]. It is useful to observe that the Gibbs matrix is a convolution-like matrix [7], and although being a singular operator it is possible to reconstruct the function from its Gibbs dyadic derivative [2]. Another property of the Gibbs derivative is that the sum of the Gibbs coefficients is 0. This property follows from the convolution structure of the Gibbs matrix and the property that the sum of elements per rows is 0, as illustrated by Example 4.3. This property can be seen to hold as follows. Denote by 1 = [1, 1, . . . , 1] a vector of 2n elements that are all equal to 1. Then, [1, 1, . . . , 1]D(n)F = [1, 1, . . . , 1]W(n)G(n)W(n)F = 2n [1, 0, . . . , 0] · diag[0, 1, . . . , 2n − 1]W(n)F = 0.

4 Permutation Matrices Associated to Bent Functions

89

4.3.1 Partial Gibbs Dyadic Derivatives In some applications, and especially for computation purposes, it is convenient to consider the definition of the Gibbs derivatives in terms of the partial Gibbs derivatives with respect to all the variables in a function f (x1 , x2 , . . . , xn ). Definition 4.3 The partial Gibbs derivative with respect to the variable xi , i = 1, 2, . . . , n, is defined as Di f = f (x1 , . . . , xi ⊕ 1, . . . , xn ) − f (x1 , . . . , xn ). Definition 4.4 In matrix notation, the partial Gibbs derivative is defined as ⎧  ⎪ −1 1 ⎪ ⎪ , (j = i), ⎪ ⎪ 1 −1 n−1 ⎨  Aj , Aj = Di =   ⎪ ⎪ j =0 ⎪ 10 ⎪ ⎪ , (j = i). ⎩ 01 Definition 4.5 In matrix notation, the Gibbs derivative is defined in terms of the partial Gibbs derivatives as 1  n−i−1 2 Di . 2 n−1

D=−

i=0

4.4 Gibbs Dyadic Derivative of Bent Functions The Gibbs derivative of a bent function can be represented as a vector whose elements are all elements in the set Bn [10]. The i-th Gibbs coefficient d(i) has the same sign as the function value f (i). In other words, the Gibbs derivative does not change the sign of function values. Lemma 4.1 Absolute values of Gibbs coefficients of bent functions are nonnegative integers 0, 1, . . . , 2n − 1, i.e., eigenvalues of the Gibbs dyadic derivative. We present here the proof of this lemma for the case of quadratic bent functions. Recall that a function is called quadratic if its positive polarity Reed–Muller expression consists of the sum of pairs of variables. Example 4.4 For n = 4, the function f = x1 x2 ⊕ x3 x4 is a quadratic bent function, and it is often considered as the basic bent function in the space of four variable bent functions. Its function vector in the (0, 1) → (1, −1) encoding is F = [1, 1, 1, −1, 1, 1, 1, −1, 1, 1, 1, −1, −1, −1, −1, 1]T ,

90

R. S. Stankovi´c et al.

and the Walsh spectrum is Sf = 4F = [4, 4, 4, −4, 4, 4, 4, −4, 4, 4, 4, −4, −4, −4, −4, 4]T . The Gibbs dyadic derivative of this function is Df = [0, 2, 1, −3, 8, 10, 9, 11, 4, 6, 5, −7, −12, −14, −13, 15]T . The logic complement of f is specified by the function vector F = [−1, −1, −1, 1, −1, −1, −1, 1, −1, −1, −1, 1, 1, 1, 1, −1]T , whose Walsh spectrum is Sf = [−4, −4, −4, 4, −4, −4, −4, 4, −4, −4, −4, 4, 4, 4, 4, −4]T , and the Gibbs dyadic derivative Df = [0, −2, −1, 3, −8, −10, −9, 11, −4, −6, −5, 7, 12, 14, 13, −15]T . To prove the above lemma, we write the values of partial Gibbs derivatives determined in Definition 4.3 as a (2n ×n) matrix Q = [qx,k ], where qx,k = Dk f (x). ˜ = [|qx,k |] of the absolute values of qx,k We aim at showing that the matrix Q is such that its rows consist of all bit patterns in binary representations of integers 0, 1, . . . , 2n − 1. Moreover, all the non-zero values on the row x of Q are positive or negative depending on the value of f (x) which is either 0 or 1. Let us use the {0, 1}n domain for x, the domain {0, 1} for f (x) and denote by ˜ f (x) = (−1)f (x) for clarity. Consider the partial Gibbs derivative with respect to the first variable x1 , thus, D1 f˜(x). All other partial derivatives are similar D1 f˜(x) = (−1)f (x⊕e1 ) − (−1)f (x) = (−1)(x1 ⊕1)(x2 )⊕x3 x4 ⊕···⊕xn−1 xn − (−1)x1 x2 ⊕x3 x4 ⊕···⊕xn−1 xn = (−1)(x2 ⊕x1 x2 ⊕···⊕xn−1 xn ) − (−1)(x1 x2 ⊕···⊕xn−1 xn ) = ((−1)x2 − 1)(−1)(x1 x2 ⊕···⊕xn−1 xn ) = −2δ(x2 − 1)f˜(x) =

−2f˜(x), if x2 = 1, 0, if x2 = 0,

where δ is the Kronecker delta.

4 Permutation Matrices Associated to Bent Functions

91

Correspondingly, D2 f˜(x) =

−2f˜(x), if x1 = 1, 0, if x1 = 0.

So, D2l+1 f˜(x) =

−2f˜(x), if x2l+2 = 1, 0, otherwise,

D2l+2 f˜(x) =

−2f˜(x), if x2l+1 = 1, 0, otherwise,

for l = 0, 1, 2, . . . , n/2 − 1. Notice that if we put the partial derivatives in order D2 , D1 , D4 , D3 and ignore signs we get the binary numbers in the order 1, 2, 3, . . . , 15. This is identity permutation and others come in the same natural way.  Example 4.5 The partial Gibbs dyadic derivatives with respect to all variables in the function f = x1 x2 ⊕ x3 x4 are D1 D2 D3 D4

= [0, 0, −1, 1, 0, 0, −1, = [0, −1, 0, 1, 0, −1, 0, = [0, 0, 0, 0, 0, 0, 0, = [0, 0, 0, 0, −1, −1, −1,

1, 0, 0, −1, 1, 1, 0, −1, 0, 1, 0, −1, −1, −1, 1, 1, 0, 0, 0, 0,

0, 0, 1, 1,

0, 1, 1, 1,

1, 0, 1, 1,

−1]T −1]T −1]T −1]T .

It is obvious that ignoring signs all bit patterns are present looking elementwise. Each 4-tuple has either 0s, and +1 or 0s and −1 values. Weighting the rows by 8, 4, 2, 1 the absolute values of the integers corresponding to the 4-tuples of elements di (j ) are the elements of B4 .

4.4.1 Properties of the Gibbs Dyadic Derivative of Bent Functions Besides the property that the absolute values of Gibbs dyadic coefficients are integers in the set of Gibbs eigenvalues, other main features of the Gibbs dyadic derivative of bent functions relevant for the considerations in the context of permutation matrices are the following. Under relevance, we mean restrictions that these features impose on the structure, i.e., position of non-zero elements in the Gibbs permutation matrices.

92

R. S. Stankovi´c et al.

1. The Gibbs derivative does not change the sign of the function values of bent functions in the (0, 1) → (1, −1) encoding. This feature can be easily seen for the functions in Example 4.4 and their Gibbs dyadic derivatives. 2. The Gibbs coefficients of a function f and its logic complement f have identical absolute values and the sign opposite to each other. That is, if the i-th Gibbs coefficient of f has the value di = r, then the value of the corresponding Gibbs coefficient of f is d i = −r. This feature is illustrated again by the functions in Example 4.4. 3. The sum of positive Gibbs coefficients is equal to the sum of negative Gibbs coefficients and it is (2n − 1)(2n−2 ). This feature can be illustrated by the functions in Examples 4.6 and 4.8 below for n = 4 and n = 6. It is easy to verify that the sum of positive as well as the negative Gibbs coefficients in these examples has magnitude 60 and 1008, for n = 4 and n = 6, respectively.

4.5 Gibbs Permutation Matrices From the above considerations, it follows that the Gibbs coefficients are permuted versions of the vector Bn = [0, 1, 2, . . . , 2n − 1]T . A different permutation of these values corresponds to each bent function and, therefore, bent functions can be characterized by the permutations determined by the Gibbs coefficients [10]. These permutations are conveniently represented by the permutation matrices that we call the Gibbs permutation matrices assigned to bent functions by the Gibbs derivative. They are defined as follows. Definition 4.6 The permutation matrix P assigned by the Gibbs derivative to a bent function f in n variables is the (2n ×2n ) permutation matrix that permutes the vector Bn = [0, 1, 2, . . . , 2n − 1]T into the vector of absolute values of Gibbs coefficients of f . Since for bent functions the Gibbs coefficients are eigenvalues of the Gibbs derivative, it follows Definition 4.7. Definition 4.7 The Gibbs permutation matrix is a (2n × 2n ) matrix Pg = [pi,j ], whose elements pi,j = 1 if the i-th Gibbs coefficient has the absolute value j , otherwise pi,j = 0. Example 4.6 For function f1 in Example 4.2 the Gibbs derivative is Df1 = [−10, −12, 11, −13, −3, 5, 2, 4, 14, 8, −15, 9, −7, 1, 6, 0]T ,

4 Permutation Matrices Associated to Bent Functions

93

and the corresponding permutation matrix is ⎡

Pf1

0 ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 =⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎣0 1

0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0

1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0

0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0

⎤ 0 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥. 0⎥ ⎥ 0⎥ ⎥ ⎥ 1⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎦ 0

The permutation represented by this permutation matrix can also be represented as a product of cycles as follows: P = (5)(0, 15, 10)(1, 13, 3, 4, 7, 12)(2, 6, 14, 8, 9, 11), which leads to a factorization with three sparse matrices.

4.6 Structure of Gibbs Permutation Matrices In this section, we specify requirements that should be satisfied in order that a (2n × 2n ) permutation matrix, where n is a natural number, be a Gibbs permutation matrix. Each Gibbs permutation matrix is composed of the following five submatrices:  A=

         00 01 00 10 00 ,B = ,C = ,D = ,0 = . 01 00 10 00 00

Except the zero submatrix 0, each submatrix appears 2(n−2) times in the (2n × 2n ) Gibbs permutation matrix.

94

R. S. Stankovi´c et al.

Being a permutation matrix, the single non-zero element should be in each row and column which determines the possible distribution of these submatrices within a Gibbs permutation matrix. Therefore, the following requirements should be satisfied: 1. No two identical submatrices can appear in the same row or column except for the submatrix 0. Therefore, no AA, or BB, or CC, or DD in the same row or column, 2. No two A and C in the same row, 3. No two B and D in the same row, 4. No two A and B in the same column, 5. No two C and D in the same column, 6. Allowed combinations of submatrices are A, B, and C, D for rows and A, C, and B, D for columns. An additional requirement is that each four of these different non-zero submatrices should be placed in such a way that form vertices of a rectangle. In each rectangle, the position of the vertices should be such that the componentwise sum of binary representations of the coordinates should be the zero 2(n − 1)-tuple. In other words, if ai,j , bi,j , ci,j , and di,j are elements of the submatrices A, B, C, and D, then it should be a00 ⊕ b00 ⊕ c00 ⊕ d00 = 0, a01 ⊕ b01 ⊕ c01 ⊕ d01 = 0, a10 ⊕ b10 ⊕ c10 ⊕ d10 = 0, a11 ⊕ b11 ⊕ c11 ⊕ d11 = 0. These requirements specified above determine the structure of the Gibbs permutation matrices and they are necessary and sufficient conditions for a (2n × 2n ) permutation matrix to be a Gibbs permutation matrix. Example 4.7 Figure 4.1 shows a permutation matrix for the function specified by the (0, 1) → (1, −1) encoded function vector F2 = [1, 1, 1, −1, 1, −1, 1, 1, 1, −1, −1, −1, 1, 1, −1, 1]T , with rectangles. The coordinates of matrix elements in their vertices are a00 a01 a10 a00

= 000|011, = 000|100, = 010|011, = 010|100,

b00 b01 b10 b11

= 001|000, = 001|111, = 011|000, = 011|111,

c00 c01 c10 c11

= 100|001, = 100|110, = 110|001, = 110|110,

d00 d01 d10 d11

= 101|010, = 101|101, = 111|010, = 111|101.

4 Permutation Matrices Associated to Bent Functions Fig. 4.1 The permutation matrix assigned to the function f2 in Example 4.7

95

000 000

001 010 011

P5 = 100 101

110 111

0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0

0001

0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0

010

011

0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1

100

0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0

101

1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0

110

0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0

111

0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0

It is obvious that a00 ⊕ b00 ⊕ c00 ⊕ d00 a01 ⊕ b01 ⊕ c01 ⊕ d01 a10 ⊕ b10 ⊕ c10 ⊕ d10 a11 ⊕ b11 ⊕ c11 ⊕ d11

= 000|011 ⊕ 001|000 ⊕ 100|001 ⊕ 101|010 = 000|000, = 000|100 ⊕ 001|111 ⊕ 100|110 ⊕ 101|101 = 000|000, = 010|011 ⊕ 011|000 ⊕ 110|001 ⊕ 111|010 = 000|000, = 010|100 ⊕ 011|111 ⊕ 110|110 ⊕ 111|101 = 000|000.

This permutation matrix can be specified in terms of cycles as P = (10)(0, 9, 13, 12, 2)(1, 7, 15, 5, 6)(3, 14, 11, 4, 8). Example 4.8 Consider the bent function f4 in 6 variables specified by the (0, 1) → (1, −1) encoded function vector F4 = [1, 1, −1, 1, −1, −1, −1, 1, −1, −1, 1, −1, −1, −1, −1, 1, −1, −1, 1, −1, 1, 1, 1, −1, 1, 1, 1, −1, 1, 1, −1, 1, 1, 1, −1, 1, −1, −1, −1, 1, −1, −1, 1, −1, −1, −1, −1, 1, 1, 1, −1, 1, −1, −1, −1, 1, −1, −1, −1, 1, −1, −1, 1, −1]T . Its Gibbs derivative is Df4 = [30, 28, −27, 25, −20, −22, −17, 19, −26, −24, 15, −13, −16, −18, −5, 7, −62, −60, 51, −49, 52, 54, 57, −59, 56, 58, 37, −39, 50, 48, −47, 45, 14, 12, −11, 9, −4, −6, −1, 3, −10, −8, 31, −29, 0, −2, −21, 23, 46, 44, −35, 33, −36, −38, −41, 43, −40, −42, −53, 55, −34, −32, 63, −61]T .

96

R. S. Stankovi´c et al.

P6=

O O O O O O O O O O O O O O O O O O O B O O D O O O O O O O O O

O O O O O O O O O O O O O O O O O O O A O O C O O O O O O O O O

O O O O O O O B O O O O O O O O O O D O O O O O O O O O O O O O

O O O O O O O A O O O O O O O O O O C O O O O O O O O O O O O O

O O O O O O O O O O O O O O O O O A O O C O O O O O O O O O O O

O O O O O O O O O O O O O O O O O B O O D O O O O O O O O O O O

O O O O O A O O O O O O O O O O C O O O O O O O O O O O O O O O

O O O O O B O O O O O O O O O O D O O O O O O O O O O O O O O O

O O O B O O D O O O O O O O O O O O O O O O O O O O O O O O O O

O O O A O O C O O O O O O O O O O O O O O O O O O O O O O O O O

O O D O O O O O O O O O O O O O O O O O O O O B O O O O O O O O

O O C O O O O O O O O O O O O O O O O O O O O A O O O O O O O O

O A O O C O O O O O O O O O O O O O O O O O O O O O O O O O O O

O B O O D O O O O O O O O O O O O O O O O O O O O O O O O O O O

C O O O O O O O O O O O O O O O O O O O O A O O O O O O O O O O

D O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O

O O O O O O O O O O O O O O O O O O O O O O O O O A O O O O C O

O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O D O

O O O O O O O O O O O O O B O O O O O O O O O O O O D O O O O O

O O O O O O O O O O O O O A O O O O O O O O O O O O C O O O O O

O O O O O O O O O O O O O O O O O O O O O O O O O O O B D O O O

O O O O O O O O O O O O O O O O O O O O O O O O O O O A C O O O

O O O O O O O O O O O O O O O A O O O O O O O O C O O O O O O O

O O O O O O O O O O O O O O O B O O O O O O O O D O O O O O O O

O O O O O O O O O A O O O O C O O O O O O O O O O O O O O O O O

O O O O O O O O O B O O O O D O O O O O O O O O O O O O O O O O

O O O O O O O O O O D O O O O O O O O O O O O O O O O O O B O O

O O O O O O O O O O C O O O O O O O O O O O O O O O O O O A O O

O O O O O O O O O O O B D O O O O O O O O O O O O O O O O O O O

O O O O O O O O O O O A C O O O O O O O O O O O O O O O O O O O

O O O O O O O O C O O O O O O O O O O O O O O O O O O O O O O A

O O O O O O O O D O O O O O O O O O O O O O O O O O O O O O O B

Fig. 4.2 The permutation matrix assigned to the function f3 in Example 4.8

Figure 4.2 shows the corresponding Gibbs permutation matrix written in terms of submatrices in vertices of the required rectangles. The permutation represented by this permutation matrix can be represented in terms of cycles as a cycle of length four elements and a cycle of length 60 as P = (4, 20, 52, 36)(0, 30, 47, 23, 59, 55, 43, 29, 48, 46, 21, 54, 41, 8, 26, 37, 6, 17, 60, 34, 11, 13, 18, 51, 33, 12, 16, 62, 63, 61, 32, 14, 5, 22, 57, 42, 31, 45, 2, 27, 39, 3, 25, 58, 53, 38, 1, 28, 50, 35, 9, 24, 56, 40, 10, 15, 7, 19, 49, 44).

4.7 Computer Exploration of Bent Functions in Four Variables In this section, we present some observations derived from a computer verification of certain properties of Gibbs permutation matrices for functions in four variables. For n = 4, there are 896 bent functions, half of them, 448, are logic complements of the other half. Therefore, in this computer verification, we consider 448 bent functions with 6 non-zero values. Functions with 10 non-zero values are their logic complements. Since the Gibbs permutation matrices are defined with respect to the absolute values of Gibbs coefficients, there are 448 different permutation matrices.

4 Permutation Matrices Associated to Bent Functions

97

Recall that the Gibbs coefficients for a function f and its logic complement f differ just in the sign but have identical absolute values. Remark 4.1 When a given Gibbs permutation matrix is applied to all bent functions, all these functions are again obtained. It follows that each Gibbs permutation matrix converts a bent function into a bent function of the same number of variables. When all Gibbs permutation matrices are applied to the same bent function, a subset of bent functions is obtained. This observation will be discussed in more detail in the following example. Consider the basic bent function for n = 4 and two functions derived from it by permuting the variables fb1 = x1 x2 ⊕ x3 x4 , fb2 = x1 x3 ⊕ x2 x4 , fb3 = x1 x4 ⊕ x2 x3 . When all 448 Gibbs permutation matrices are applied to fb1 , we obtain 1. 192 other mutually different bent functions. 2. Additional 16 functions are obtained 16 times each. This means that 16 different Gibbs permutation matrices produce a specific bent function fs1 when applied to fb1 . Another 16 Gibbs permutation matrices produce another specific function fs2 . There are 16 specific functions produced by 16 different subsets of Gibbs permutation matrices. 3. 240 bent functions are not generated from fb1 by the application of all 448 Gibbs permutation matrices. The term specific functions is used with no other reason or justification but to differentiate these 16 functions that cannot be obtained from the three basic bent functions from other bent functions obtained by the application of the Gibbs permutation matrices to them. The same results are obtained when the permutation matrices are applied to other two basic functions derived by permuting variables in fb1 . For the three basic functions, the sets of 192 functions obtained by the application of all Gibbs permutation matrices as well as sets of 16 functions obtained 16 times are different but not disjoint. The same is true when all Gibbs permutation matrices are applied to any bent function not just the basic functions. When all permutation matrices are applied to two basic bent functions, for example, fb1 = x1 x2 ⊕x3 x4 and fb2 = x1 x3 ⊕x2 x4 , then 256 functions are generated a single time, 64 are generated 2 times, 32 are generated 16 times, and 96 functions are not generated. The same results are obtained for any combination of two basic functions. When we apply all 448 permutation matrices to the three basic bent functions, all bent functions except 16 are produced. These 16 functions that cannot be

98

R. S. Stankovi´c et al.

obtained in this way and their Reed–Muller spectra and the corresponding functional expressions are given in Table 4.1. In this case, 192 functions are generated a single time, other 192 functions are generated two times, and 48 functions are obtained 16 times. It means, for each of these 48 functions there are 16 permutation matrices that generate them. The 16 functions that cannot be generated by the Gibbs permutation matrices from the basic bent functions are defined as functions whose Reed–Muller expression consists of products of all possible pairs of variables and all possible linear functions for n = 4, with the linear functions in more than two variables negated. In Table 4.2 these 16 functions are written in terms of the function q defined in terms of all possible pairs of variables as q = x1 x2 ⊕ x1 x3 ⊕ x1 x4 ⊕ x2 x3 ⊕ x2 x4 ⊕ x3 x4 . In this table, the second column shows integers whose binary representations are the corresponding function vectors. In other words, the integer rf representation of 2n −1 i a function is determined as rf = i=0 2 f (i), where f (i) are elements of the truth-vector F of f . These 16 functions are obtained by the application of the Gibbs permutation matrices to some bent functions other than these three basic functions. The specific bent functions can be obtained from other bent functions by using different Gibbs permutation matrices. Table 4.3 shows 8 functions from which the specific function with integer representation 6017 is obtained. In this table, the first column shows the integer corresponding to the function the permutation matrix assigned to which is applied to the function in the second column. The third column is the vector of Gibbs coefficients determining the used permutation matrix and the function vector of the function to which the permutation matrix is applied to get the function with the integer representation 6017. It is interesting to observe that the considered specific 16 functions are a closed set with respect to the Gibbs permutation matrices in the sense that if any Gibbs permutation matrix is applied to them, the same set of bent functions is reproduced. Table 4.4 shows the correspondence between the considered 16 specific bent functions with respect to the Gibbs permutation matrix assigned to the basic bent function fb1 . The second and the third column show the integers representing functions to which the Gibbs permutation matrix for fb1 is applied and the obtained functions, respectively. It should be observed that in the case of functions enumerated as 1, 6, 11, 16 the application of the selected Gibbs permutation matrix produces the initial functions. There are pairs of functions reciprocal to each other, 2 and 3, 4 and 5, 7 and 10, 8 and 9, 12 and 13, 14 and 15.

4 Permutation Matrices Associated to Bent Functions

99

Table 4.1 16 Bent functions that cannot be obtained by Gibbs permutation matrices from the three basic bent functions f 1

2

3

4

5

6

7

8

9

10

11

12

13

F and Srm F1 = [1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0]T Srm1 = [1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f1 = 1 ⊕ x4 ⊕ x3 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F2 = [1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0]T Srm2 = [1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f2 = 1 ⊕ x4 ⊕ x3 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F3 = [0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0]T Srm3 = [0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f3 = x4 ⊕ x3 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F4 = [1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0]T Srm4 = [1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f4 = 1 ⊕ x4 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F5 = [0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0]T Srm5 = [0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f5 = x4 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F6 = [0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0]T Srm6 = [0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f6 = x4 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F7 = [1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0]T Srm7 = [1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f7 = 1 ⊕ x3 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F8 = [0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0]T Srm8 = [0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f8 = x3 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F9 = [0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0]T Srm9 = [0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f9 = x3 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F10 = [0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0]T Srm10 = [0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f10 = x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F11 = [1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1]T Srm11 = [1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f11 = 1 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F12 = [0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1]T Srm12 = [0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f12 = x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F13 = [0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1]T Srm13 = [0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f13 = x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 (continued)

100

R. S. Stankovi´c et al.

Table 4.1 (continued) f 14

15

16

F and Srm F14 = [0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1]T Srm14 = [0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f14 = x3 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F15 = [0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1]T Srm15 = [0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0]T f15 = x4 ⊕ x3 x4 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2 F16 = [1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1]T Srm16 = [1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0]T f16 = 1 ⊕ x4 ⊕ x3 ⊕ x3 x4 ⊕ x2 ⊕ x2 x4 ⊕ x2 x3 ⊕ x1 ⊕ x1 x4 ⊕ x1 x3 ⊕ x1 x2

Table 4.2 The 16 bent functions that cannot be obtained by permutation matrices from the three basic bent functions in terms of q

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

rf 33,047 33,256 36,376 45,604 54,338 28,952 19,748 11,074 17,108 9394 6286 16,939 9293 6257 6017 59,521

Expression for f f1 = q ⊕ 1 f2 = q ⊕ x1 f3 = q ⊕ x2 f4 = q ⊕ x3 f5 = q ⊕ x4 f6 = q ⊕ ⊕x2 ⊕ x1 f7 = q ⊕ x3 ⊕ x1 f8 = q ⊕ x4 ⊕ x1 f9 = q ⊕ x3 ⊕ x2 f10 = q ⊕ x4 ⊕ x2 f11 = q ⊕ x4 ⊕ x3 f12 = q ⊕ 1 ⊕ x3 ⊕ x2 ⊕ x1 f13 = q ⊕ 1 ⊕ x4 ⊕ x2 ⊕ x1 f14 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x1 f15 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x2 f16 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x2 ⊕ x1

Similar conclusions are obtained when Gibbs permutation matrices assigned to other two basic bent functions are used, since these functions differ in just permutation of variables. The following examples illustrate different aspects of the application of Gibbs permutation matrices to bent functions as discussed above. Example 4.9 Consider the bent function for n = 4 specified by the function vector F5 = [1, −1, −1, 1, −1, 1, −1, 1, −1, −1, 1, 1, 1, 1, 1, 1]T .

4 Permutation Matrices Associated to Bent Functions

101

Table 4.3 An example of 8 bent functions from which the first specific bent function with the integer representation 6017 is obtained by using different Gibbs permutation matrices 1

854

6017 16,939

2

857

13,834

3

869

7714

4

874

16,939

5

23,648

45,604

6

59,416

36,376

7

59,428

45,604

8

59,458

54,338

f

Df and F Df1 = [0, 8, 4, 12, 2, 10, −6, −14, 1, −9, 5, −13, 3, −11, −7, 15]T F1 = [0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1]T Df2 = [0, 8, 4, 12, 10, 2, −14, −6, 5, −13, 1, −9, −15, 7, 11, −3]T F2 = [0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0]T Df3 = [0, 8, 12, 4, 2, 10, −14, −6, 3, −11, −15, 7, 1, −9, 13, −5]T F3 = [0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0]T Df4 = [8, 0, 4, 12, 2, 10, −14, −6, −15, 7, 3, −11, 5, −13, 9, −1]T F4 = [0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1]T Df5 = [5, −1, 9, −13, −14, −10, 2, 6, 3, −7, −15, 11, 8, 12, 4, 0]T F5 = [1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0]T Df6 = [−8, −14, −13, 11, −3, 5, 6, 0, 12, 10, 9, −15, −7, 1, 2, 4]T F6 = [1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0]T Df7 = [−8, −14, −5, 3, −11, 13, 6, 0, 10, 12, −7, 1, 9, −15, 4, 2]T F7 = [1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0]T Df8 = [−8, −6, −13, 3, −11, 5, 14, 0, 9, −7, 12, 2, 10, 4, −15, 1]T F8 = [1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0]T

Table 4.4 Correspondence between 16 specific bent functions with respect to the Gibbs permutation matrix assigned to fb1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Initial f 33,047 36,376 33,256 54,338 45,604 28,952 9394 17,108 11,074 19,748 6286 9293 16,939 6017 6257 59,521

Derived f 33,047 33,256 36,376 45,604 54,338 28,952 19,748 11,074 17,108 9394 6286 16,939 9293 6257 6017 59,521

Expression for derived f f1 = q ⊕ 1 f2 = q ⊕ x1 f3 = q ⊕ x2 f4 = q ⊕ x3 f5 = q ⊕ x4 f6 = q ⊕ ⊕x2 ⊕ x1 f7 = q ⊕ x3 ⊕ x1 f8 = q ⊕ x4 ⊕ x1 f9 = q ⊕ x3 ⊕ x2 f10 = q ⊕ x4 ⊕ x2 f11 = q ⊕ x4 ⊕ x3 f12 = q ⊕ 1 ⊕ x3 ⊕ x2 ⊕ x1 f13 = q ⊕ 1 ⊕ x4 ⊕ x2 ⊕ x1 f14 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x1 f15 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x2 f16 = q ⊕ 1 ⊕ x4 ⊕ x3 ⊕ x2 ⊕ x1

102

R. S. Stankovi´c et al.

The Gibbs permutation matrix assigned to this function is ⎡

0 ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 P=⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎣0 1

0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0

0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0

⎤ 1 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥. 0⎥ ⎥ 0⎥ ⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎦ 0

In terms of cycles, the permutation represented by this permutation matrix can be expressed as P = (3)(5)(10)(12)(0, 15)(1, 7)(2, 11)(4, 13)(6, 9)(8, 14). When this Gibbs permutation matrix is applied to the following bent functions: F6 = [1, −1, 1, −1, 1, 1, −1, −1, 1, −1, −1, 1, 1, 1, 1, 1]T , F7 = [1, 1, −1, −1, 1, −1, −1, 1, 1, −1, 1, −1, 1, 1, 1, 1]T , F8 = [1, −1, −1, 1, 1, 1, −1, −1, 1, −1, 1, −1, 1, 1, 1, 1]T , F9 = [1, −1, −1, 1, 1, −1, 1, −1, 1, 1, −1, −1, 1, 1, 1, 1]T , the same functions are obtained. There are in total 32 bent functions which this matrix converts into themselves. If this matrix is applied to other bent functions with 6 non-zero values, different bent functions are obtained. Example 4.10 Consider the function f specified by the function vector F10 = [−1, 1, 1, −1, −1, 1, −1, 1, −1, −1, 1, 1, 1, 1, 1, 1]T .

4 Permutation Matrices Associated to Bent Functions

103

The Gibbs dyadic derivative assigns to f the permutation matrix ⎡

0 ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 P=⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎢0 ⎢ ⎣0 1

0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0

1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0

0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0

⎤ 0 0⎥ ⎥ 0⎥ ⎥ 1⎥ ⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥. 0⎥ ⎥ 0⎥ ⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎥ ⎥ 0⎦ 0

In terms of cycles the permutation represented by this permutation matrix can be represented as P = (12)(0, 3, 15)(1, 11, 10, 2, 7, 5)(4, 9, 14, 8, 6, 13). If this matrix applied to the bent function defined by the function vector F11 = [1, 1, 1, −1, 1, 1, −1, 1, 1, −1, 1, 1, 1, −1, −1, −1]T , it is obtained the bent function whose truth-vector is F12 = [−1, 1, 1, −1, −1, 1, −1, 1, −1, −1, 1, 1, 1, 1, 1, 1]T .

4.8 Closing Remarks Bent functions have a strictly specified number of non-zero values that depends on the number of variables n. Therefore, for a given n bent functions mutually differ in the permutation of function values. The same property is true in the Walsh spectral domain, since all bent functions belong to the same class of functions, i.e., functions with flat Walsh spectrum. In both cases, the permutations converting a bent function into another are not easy observable, since there are just two different values 1 and −1, or −2n/2 and 2n/2 out of the total 2n values to be permuted.

104

R. S. Stankovi´c et al.

The Gibbs dyadic derivative of a bent function is the set of eigenvalues of this operator with the signs corresponding to that in the function values, and it consists of first 2n non-negative integers. In this way, the Gibbs dyadic derivative associates with each bent function an easily determined Gibbs permutation matrix. These matrices are not the same as matrices converting a bent function into another in either Boolean or Walsh spectral domain, since they relate these functions in the Gibbs dyadic derivative domain. They however still can be used to establish relationships among bent functions and to generate them from the subsets of bent functions. We show that Gibbs permutation matrices have a particular block structure which can be expressed in terms of four precisely defined submatrices.

References 1. Cusic, T.W., St˘anic˘a, P.: Cryptographic Boolean Functions and Applications. Academic/Elsevier, Cambridge (2009) 2. Gibbs, J.E.: Walsh spectrometry, a form of spectral analysis well suited to binary digital computation, p. 24. National Physical Laboratory, Teddington (1967) 3. Gibbs, J.E.: Sine waves and Walsh waves in physics. In: Proc. Sympos. Applic. Walsh Functions, pp. 260–274, Washington, DC, 1970 March 31–April 3 (1970) 4. Gibbs, J.E., Gebbie, H.A.: Application of Walsh functions to transform spectroscopy. Nature 224(5223), 1012–1013 (1969). 5. Gibbs, J.E., Ireland, B.: Walsh Functions and differentiation. In: Schreiber, H., Sandy, G.F. (eds.) Applications of Walsh Functions and Sequency Theory, pp. 147–176. IEEE, New York (1974) 6. Karpovsky, M.G., Stankovi´c, R.S., Astola, J.T.: Spectral Logic and Its Application in the Design of Digital Devices. Wiley, Hoboken (2008) 7. Pichler, F.: Walsh Functions and Linear System Theory. Tech. Res. Rept, Dept. of Electrical Engineering, University of Maryland, Report T-70-05 (1970) 8. Rothaus, O.S.: On ‘bent’ functions. J. Combin. Theory, Ser. A 20, 300–305 (1976) 9. Stankovi´c, R.S., Moraga, C., Astola, J.T.: Fourier Analysis on Finite Non-Abelian Groups with Applications in Signal Processing and System Design. Wiley/IEEE Press, Hoboken (2005) 10. Stankovi´c, R.S., Astola, J.T., Moraga, C., Stankovi´c, M., Gaji´c, D.: Remarks on characterization of bent functions in terms of Gibbs dyadic derivatives, EUROCAST 2015. In: Moreno-Diaz, R., Pichler, F., Quesada-Arencibia, A. (eds.) Computer Aided Systems Theory – EUROCAST 2015, 15th International Conference, Las Palmas de Gran Canaria, February 8–13, 2015. Revised Selected Papers LNCS, vol. 9520, pp. 632–639. Springer, Berlin (2015) 11. Stankovi´c, R.S., Stankovi´c, M., Astola, J.T., Moraga, C.: Gibbs characterization of binary and ternary bent functions. In: Proceedings 46th International Symposium on Multiple-Valued Logic, pp. 205–210, Sapporo, May 18–20 (2016) 12. Stankovi´c, R.S., Stankovi´c, M., Astola, J.T., Moraga, C.: Towards the Gibbs characterization of a class of quaternary bent functions. In: Proceedings 47th International Symposium on Multiple-Valued Logic, pp. 73–78, Novi Sad, May 22–24 (2017) 13. Stankovi´c, R.S., Stankovi´c, M., Astola, J.T., Moraga, C.: Quaternary generalized Boolean bent functions obtained through permutation of binary Boolean bent functions. In: Proceedings 48th International Symposium on Multiple-Valued Logic, Linz, May 16–18 (2018)

4 Permutation Matrices Associated to Bent Functions

105

14. Stankovi´c, M., Moraga, C., Stankovi´c, R. S., Some spectral invariant operations for functions with disjoint products in the polynomial form. In: Moreno-Diaz, R., Pichler, F., QuesadaArencibia, A. (eds.) 16th International Conference Computer Aided Systems Theory – EUROCAST 2017, Las Palmas de Gran Canaria, February 19–24, 2017. Revised Selected Papers, LNCS, vol. 10672, Part 2, pp. 262–269 Springer, Berlin (2018) 15. Tokareva, N., Bent Functions Results and Applications to Cryptography. Elsevier, Amsterdam (2015). ISBN 978-0-12-802318-1

Chapter 5

Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning Oliver Keszocze, Kenneth Schmitz, Jens Schloeter, and Rolf Drechsler

5.1 Introduction and Related Work The Boolean Satisfiability (SAT) problem is an NP-complete decision problem, which has applications in a number of topics like automatic test case generation [15], formal verification [4], and many more. One main reason for the usage of SAT in those fields is the existence of efficiently performing solvers. As Marques-Silva et al. [10] point out, most SAT solvers are based on the Davis–Putnam–Logemann–Loveland algorithm and use backtracking to determine a solution. While those solvers proved to be successful in practice, the success of the Monte Carlo Tree Search (MCTS) algorithm in other domains such as General Game Playing and different combinatorial problems [1] led to recent work towards using it to solve SAT, MaxSAT [3], and other related problems [9]. For example, Previti et al. [13] presented a solver that uses the MCTS algorithm in combination with classical SAT solving techniques like unit propagation [2]. Their experiments showed that the MCTS-based approach performed well if the SAT instance has an underlying structure. While they had some success to combine the MCTS-based approach with SAT solving techniques like unit propagation [2], they did not include other key features of modern state-of-the-art SAT solvers like Conflict-Driven Clause Learning (CDCL) [11]. Therefore a more recent approach extended the algorithm by using CDCL [14].

O. Keszocze () Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen, Germany e-mail: [email protected] K. Schmitz · J. Schloeter · R. Drechsler Institute of Computer Architecture, University of Bremen, Bremen, Germany e-mail: [email protected]; [email protected]; [email protected] © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_5

107

108

O. Keszocze et al.

One contribution of this chapter is to visualize the search trees that are produced by MCTS-based algorithms and use them to analyze and illustrate the behavior of different variants of the algorithm. Based on the analysis this chapter will introduce different SAT specific MCTS heuristics that focus on learning “good” clauses that benefit different SAT solver features. The impact of this heuristics is illustrated by benchmarks. It turns out that, even with the use of additional features like CDCL, the MCTSbased approach cannot compete with modern state-of-the-art SAT solvers without further improvements and engineering. Therefore, the main contribution of this chapter is to exploit the ability of the MCTS-based CDCL algorithm to learn “good” clauses. The presented method is used as a preprocessor for a backtracking-based solver. We will show that the performance of the backtracking-based solver can be improved in many cases.

5.2 Monte Carlo Tree Search-Based SAT Solving This section presents the fundamentals of the MCTS-based CDCL solver. After a brief introduction to the SAT problem, the basis for the SAT solver proposed in this work is presented: an MCTS-based SAT solving algorithm similar to UCTSAT by Previti et al. [13].

5.2.1 Problem Formulation and Unit Propagation The SAT problem is to decide whether there exists a variable assignment for a given Boolean formula such that the formula evaluates to true. Almost all state-of-the-art SAT solvers accept Boolean formulas in Conjunctive Normal Form (CNF) that is a conjunction of clauses. The CNF (x ∨ y) ¯ ∧ z ∧ (x¯ ∨ z¯ ) consists of three clauses C1 = x ∨ y, ¯ C2 = z, and C3 = x¯ ∨ z¯ . It is satisfiable with the assignment x = 0, y = 0, and z = 1. One key technique in SAT solving is unit propagation, see, e.g. [2]. A clause C is called unit if and only if it consists of a single literal only. The merit of unit clauses is that they enforce the assignment of their unit literal as it must be assigned to truth value 1 to satisfy the clause. In the above CNF, C2 is a unit clause enforcing z = 1 or z¯ = 0, respectively. This reduces C3 to the unit clause x. ¯ The forced assignment of x = 0, again, reduces the next clause, C1 , to become unit. The process of repeatedly checking for and assigning unit clauses is called unit propagation.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

109

We will make heavy use of unit propagation in the proposed SAT solver. We adopt the process to work on the graph structures used by the solver, see Sects. 5.2.2 and 5.3.

5.2.2 Monte Carlo Tree Search-Based SAT Solving This section presents the fundamentals of the MCTS-based CDCL solver based on [13]. Like most implementations of Monte Carlo Tree Search, it is based on the U CB1 algorithm for multi-armed bandit problems and uses the Upper Confidence Bounds for Trees (UCT) formula to decide in which direction to expand the search tree [12]. The main goal of using the UCT formula is to build an asymmetric search tree that is expanded at the most promising nodes, i.e., at the nodes with the highest estimated values. As the estimated value can be biased, the use of the UCT formula also encourages exploring new paths of the search tree. In this case, every node of the search tree represents a (partial) variable assignment and is marked with a variable that is unassigned in the node but becomes assigned in its children. The root node represents the empty assignment, i.e., an assignment where every variable is unassigned. Each non-root node n has a reference to its parent node (n.parent) and stores its parent’s variable assignment (n.assignment). We additionally define that each of this variable assignment must be an explicit assignment, i.e., an assignment that is not implied via unit propagation. Then, each assignment represents the explicit assignment and all further assignments that follow via unit propagation. Using this definition, the assignments on the path from the root node to node n including all additional assignments that follow by unit propagation define the (partial) variable assignment of n. To implement this definition, the algorithm will execute all implied assignments after a variable is explicitly assigned. Thereby, unit propagation is integrated in the search tree used by the MCTS algorithm. In Sect. 5.3 we will see that by integrating CDCL, the usage of unit propagation in the search tree must be adapted. In Fig. 5.1, an exemplary search tree and the partial variable assignments that are represented by the search tree nodes for f = (¬x1 ∨ x2 ) ∧ (x1 ∨ x3 ) ∧ (x4 ∨ x5 ) are shown. For example, the variable assignment of node n3 contains the assignments x1 = 0 and x2 = 0, because they are the explicit assignments on the path from the root node to n3 . Additionally it contains x3 = 1 as the assignment x1 = 0 and the clause (x1 ∨ x3 ) imply the assignment of x3 via unit propagation. Note that n1 and n2 have different variables in the example despite being children of the same node. This can happen as the assignment of x1 either implies the assignment of x2 or x3 and thus, dependent on the value of x1 , either x2 or x3 does not need to be explicitly implied and cannot be the variable of a search tree node. To be able to use the UCT formula, each node has an estimated value as well as a counter for the number of times the algorithm has traversed through it in the selection phase as explained below. Both of these properties, n.estimatedV alue

110

O. Keszocze et al.

root(x1 ) n1 (x2 ) n3 (x4 )

Node Represented partial assignment root n1 n2 n3 n4

n2 (x3 ) n4 (x4 )

x1 = 0, x3 = 1 x1 = 1, x2 = 1 x1 = 0, x3 = 1, x2 = 0 x1 = 0, x3 = 1, x2 = 1

Fig. 5.1 Excerpt of a possible search tree and partial variable assignments of the search tree nodes for the formula f = (¬x1 ∨ x2 ) ∧ (x1 ∨ x3 ) ∧ (x4 ∨ x5 ). The variable of each node is notated in parenthesis behind the node name and we assume that the left child assigns the parent’s variable to zero, while the right child assigns it to one

and n.counter, are used to calculate the UCT value of a node n, where the UCT value of n consists of the exploration value as shown in Eq. (5.1) and the exploitation value as shown in Eq. (5.2).  U CTExplore (n) =

U CTExploit (n) =

2 ln n.parent.counter n.counter

node.estimatedV alue node.counter

(5.1)

(5.2)

The UCT value of n can be calculated by adding up both values as shown in Eq. (5.3): U CT (n) = U CTExploit (n) + C · U CTExplore (n)

(5.3)

The factor C in Eq. (5.3) is the so-called exploration constant that can be used to weight the summands. Note that the algorithm never calculates the UCT value of the root node and thus n.parent.counter can safely be used as stated in Eq. (5.1). Given a CNF formula, the UCT based solver executes iterations until a satisfying assignment is found or the formula is proved to be unsatisfiable. In each iteration, one node is added to the search tree, its value is estimated, and the values of the trees nodes are refreshed. During the iteration, an instance of the given formula is kept up to date by executing encountered assignments and—after each assignment—unit propagation on this formula. The algorithm iterates through four phases—selection, expansion, simulation, and backpropagation—until a satisfying assignment is found or the root node is marked as conflicting and thus the formula is unsatisfiable. The four phases are explained in the following: 1. The selection phase of the algorithm is used to decide at which point to expand the search tree. To do so, the algorithm starts from the root node and traverses through the tree until one of its leaves, or a not fully expanded node, is reached. During this process the next node to be traversed through is always the child of the current node with the highest UCT value. A node that is encountered during this phase can have a conflicting assignment if all of its children proved to result

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

(1)

· · ·

n4

· · · (3)

· · ·

root

n2

n1 n3

(2)

root

111

n4

U CT (n1 ) ≥ U CT (n2 )

(4)

root

n

n.counter = n.counter + 1

n

· · ·

· · ·

root

n

n.value = n.value + h(f, a)

h(f, a)

h(f, a)

Fig. 5.2 Illustration of one iteration through the four MCTS phases. (1) Selection phase: the graph is traversed starting from the root node along edges to nodes with higher UCT value until node n4 is reached (square-shaped nodes). (2) Expansion phase: a new child node representing an assignment for the variable of the parent node is added (diamond-shaped nodes). After the creation of the node, unit propagation is performed. (3) Simulation phase: starting from the partial assignment created by the new node, a simulation is started to compute the value h(f, a) that estimates the value of the new node. (4) Backpropagation phase: the estimation computed in the last step is propagated back through the nodes previously traversed to find the expansion point (square-shaped nodes)

in conflicts. If such a node occurs, it is marked as conflicting and removed from the search tree. In Fig. 5.2(1), the selection phase is illustrated. The square-shaped nodes are the nodes that are selected in the selection phase. We see that they form a path from the root to the fringe of the tree. In the example, n1 was selected instead of n2 because it has the higher U CT value. The selection phase stopped at node n4 , because n4 only has one of the two possible children. 2. After the expansion point of the tree is determined, the expansion phase of the algorithm is executed. In this phase a new child of the selected node is added to the search tree which assigns the variable of the selected node to a value that has not been tried yet. If that assignment proves to result in a conflict, the

112

O. Keszocze et al.

new node is marked as conflicting. The variable of the new node is determined using the variable order heuristic, which is a common part of SAT solvers and determines the next variable to be assigned. The current implementation uses a heuristic similar to the Variable State Independent Decaying Sum (VSIDS) order heuristic [7]. In Fig. 5.2(2), this phase is illustrated by highlighting the new node n that was added as the new child of the previously selected node n4 with a diamond shape. 3. To estimate the value of the new node, the simulation phase is executed, which— starting with the current formula and the assignment of the new node—selects variables according to the variable order heuristic and assigns them randomly until a conflict or a satisfying assignment is reached. Again, unit propagation is executed after each assignment. The value of a so-called scoring heuristic, in this case the number of satisfied clauses in the resulting formula, is then used as an initial estimation on the value of the new node. Note that this is only one possible heuristic to estimate the value of a node and different scoring heuristics are presented in Sect. 5.4. During the selection phase, a normalized form of this value is used in the UCT formula. If the simulation finds a satisfying assignment, the problem is solved and the algorithm can stop. In Fig. 5.2(3), the simulation phase is shown by illustrating the iterative variable assignment with a curved arrow and denoting the scoring heuristic value, that is determined after the simulation, with h(f, a); f and a indicate that the heuristic value depends on the formula and the variable assignment that is present after the iterative variable assignment led to a conflict. 4. After a simulation is executed, its result is backpropagated through the search tree and the estimated value as well as the counter of every node on the path from the root to the new node is refreshed, i.e., their counters are increased by one and their estimated values are increased by the estimated value of the new node. Afterwards, the algorithm continues with Step 1. In Fig. 5.2(4), the backpropagation phase is indicated by highlighting all nodes that are traversed through in the backpropagation phase as squares. Note that these nodes are exactly the node n that was added in the expansion phase, and all nodes that were traversed in the selection phase. While iterating through these nodes, the algorithm will refresh the values of all square-shaped nodes as the figure exemplary shows for node n.

5.3 Conflict-Driven Clause Learning As already mentioned, the learning and usage of new clauses is a key aspect of modern SAT solvers. This section introduces the concept of Conflict-Driven Clause Learning and shows how it can be used in the MCTS-based algorithm. Afterwards, we will analyze the behavior of the algorithm by visualizing the search trees that are produced by the MCTS-based CDCL solver.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

113

5.3.1 MCTS-Based CDCL Solver The clause learning usually takes place whenever a conflict occurs and determines a new clause that formulates the reason for the conflict. The new clause is learned using an implication graph that is defined by the assigned variables and the clauses that implied assignments due to unit propagation and added to the overall formula. For a more detailed explanation on clause learning, see [10]. In the following, the integration of CDCL into an MCTS-based solver that was first presented in [14] is introduced. This approach for an MCTS-based CDCL solver learns a new clause whenever a simulation leads to a conflict or a conflicting node is detected in the search tree and to add it to the formula when the algorithm starts a new iteration. The main aspect to consider is that at each node that is created during the expansion phase of the algorithm, a number of variables are already assigned to a value. While no node is created that has a variable assignment that directly causes a conflict, the learning of additional clauses can lead to the existence of nodes that have assignments which lead to a conflict in one of the learned clauses. As those nodes do not lead to a solution, they can be pruned from the search tree. Therefore we modify the algorithm to check the nodes that are traversed through during the selection phase for such conflicts. The left part of Fig. 5.3 shows a situation where the algorithm is determining the successor of the diamond-shaped node formed during the selection phase and notices that assigning the current variable xk to 0 would lead to a conflict such that the dashed node is conflicting. The figure shows that the algorithm only has the choice to select the assignment xk = 1 because the alternative would lead into a conflict. At this point, there are two possible reasons for this conflict. First, the variable assignment could directly lead

xk xk = 1 xk = 0 xk+1

xk+1

xk+1 xk+1 = 1

xk+1 = 1

xk+1 = 0 xk+2

xk+1 = 0 xk+2

xk+2

xk+2

Fig. 5.3 Encountering (left) and resolving (right) a conflicting node during the selection phase

114

O. Keszocze et al.

to the conflict and second, the unit propagation after the assignment could lead to the conflict. If the variable assignment would directly lead into a conflict, it would mean that a clause C must exist which is unit in the variable assignment of the current node and has the unit literal xk . This is an important aspect as the algorithm was defined to execute unit propagation after each variable assignment, so after assigning the precursor variables of xk , the unit propagation must have already led to the assignment xk = 1. Because of that, not only the dashed node becomes unnecessary but also the diamond-shaped one as its variable must already have been assigned, so the algorithm can prune both nodes—including the child nodes of the conflicting node—and continue in the state shown in the right part of Fig. 5.3. To detect this case, the algorithm only has to check if the variable of the current node has already been assigned due to unit propagation. If, on the other hand, the unit propagation after the assignment xk = 0 leads to the conflict, the diamondshaped node does not become redundant as its assignment was not already executed due to unit propagation in the previous nodes. In this case, the dashed node can still be pruned, but the diamond-shaped one needs to be retained. This case can be detected by checking whether a variable assignment led to a conflict during the selection phase. Note that if this second case occurs, a new conflict was found and thus a new clause is learned. Because this newly learned clause could lead to previous visited nodes becoming conflicting, we adjust the algorithm to directly execute the backpropagation phase and afterwards start a new iteration whenever this case occurs. The backpropagation phase is modified to take into account that parts of the search tree can never be reached again. Let v be a node that is removed from the search tree because it was detected to be conflicting. Another aspect to consider is that for each iteration i of the algorithm that traversed through v, the estimated value of i was backpropagated from v to the root node whereupon also the counter of all nodes on the path from v to the root was increased. Therefore iterations after the pruning of v would make decisions in the selection phase based on simulations in parts of the search space that can never be reached again. To prevent this, we modify the backpropagation phase to subtract the estimated value and counter of node v from the estimated value and counter of all nodes on the path from the root to v. Figure 5.4 illustrates the modification by showing that if a search tree node np — and consequently all of it successors, as highlighted by the dotted nodes in the figure—is pruned, the values of all nodes on the path from the direct predecessor of np to the root nodes are refreshed. The affected nodes are indicated by squareshaped nodes. The refreshment of the values is exemplary shown for node n. Note that starting a new iteration from the root node of the tree instead of executing a backjump comes with an advantage of being able to choose the most promising point (according to the UCT formula) to continue the solving process. A backjump simply continues at the last node that is known to be conflict free.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

115

root

n.counter = n.counter − np .counter

n

n.value = n.value − np .value

np

.. . .. . .. .

.. .

Fig. 5.4 Illustration of the modified backpropagation phase that occurs if a node np inside the search tree is pruned during the selection phase

5.3.2 Analysis of the MCTS-Based CDCL Solver To analyze the behavior of the algorithm, we implemented the MCTS-based CDCL Solver, used it to solve various benchmark problems, and were able to confirm that the addition of CDCL significantly improves the performance of the algorithm in comparison to the pure MCTS-based solver. As the detailed benchmark results can be found in [14], we will only exemplary illustrate the performance improvement by using visualizations of the search trees produced by the algorithm. The problems that were solved to create the search trees were taken from http://www.cs.ubc.ca/~ hoos/SATLIB/benchm.html. The visualizations mark nodes that could be pruned as opaque crosses, if they were pruned because they were conflicting and as triangles, if they were found out to be redundant, i.e., if their assignment was already enforced by unit propagation on the learned clauses (see Sect. 5.3). Additionally the root node of the tree is highlighted as a diamond and the starting point of the simulation that eventually found a solution is highlighted as a square. The executed simulations are not shown in the visualization. Figure 5.5 illustrates the main benefits of CDCL by showing that the algorithm that actually used CDCL was able to create a much smaller search tree by pruning nodes near the root of the tree and exploiting unit propagation to find a solution near the root. The comparison of both trees indicates that two benefits of the addition of CDCL are the reduction of the memory needed to store the search tree and the running time to execute the simulations. This benefits are confirmed by the benchmark results in [14]. To illustrate another benefit of MCTS, Fig. 5.6 compares the search trees of an algorithm with a low and high value for the exploration constant. The left search tree shows that the algorithm focused on expanding the search tree at the top of the picture and was able to prune whole branches before finding the solution. In contrast we see that the branches at the bottom of the picture are merely unexplored, because

116

O. Keszocze et al.

Fig. 5.5 Search trees produced by the MCTS-based solver with (left) and without clause learning on the graph coloring problem sw100-68 with 500 variables and 3100 clauses

Fig. 5.6 Search trees produced by an algorithm with a small (left) and large exploration constant on the planning problem logistics.a with 828 variables and 6718 clauses

they were ignored due to a low estimated value. In contrast, the right tree is more equally explored in every direction. In this example, the variant with the small exploration constant worked better and was able to find a solution in less time and with a smaller search tree. One clearly sees that the used heuristics led the search into the correct direction and thus the exploitation in this direction turned out to be a good choice. In contrast the variant with a large exploration constant wasted time exploring other branches. While the usage of a low exploration constant turned out to be successful for this example, it highly relies on the usage of accurate heuristics and on accurate value estimations for the tree nodes. Despite all these advantages, the MCTS-based CDCL solver was still not able to compete with state-of-the-art solvers and to solve hard instances. Nevertheless,

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

117

Fig. 5.7 Search tree produced by the MCTS-based CDCL solver in the first 10 s of solving a pigeon hole instance with 14 holes. See, e.g. [5] for a definition of the pigeon hole problem

when visualizing the search trees that were produced on harder instances (see Fig. 5.7, for example), the trees still showed the same characteristics as the ones we analyzed before. In particular, the algorithm was often still able to prune the search tree near to its root, because of the learned clauses. As such clauses are valuable because they reduce the search space by a large factor, the question arises whether one can take advantage of the algorithm’s ability to learn them. The next sections of the chapter will discuss how the MCTS-based CDCL solver can be used to actively search for “good” clauses and how to take advantage of them.

5.4 MCTS Specific Heuristics While the performance improvement was the main motivation to use CDCL in combination with MCTS, the usage of CDCL also gives access to more information about the problem that is to be solved. Obviously, the learned clauses themselves are additional knowledge about the problem, but there is also the possibility to collect statistics about the clause learning process. This section introduces MCTS specific heuristics that exploit the described information.

5.4.1 Scoring Heuristics In Sect. 5.2, the scoring mechanism of the MCTS-based SAT solver was introduced and defined to use the number of satisfied clauses as a measurement for the quality of a simulation. This is very intuitive as the goal of the solver is to satisfy all clauses

118

O. Keszocze et al.

and thus the maximization of the number of satisfied clauses—like in the MaxSAT problem—is the consequent approach. While this measurement was successfully used in the MCTS-based SAT solver with and without clause learning, this section presents alternative measurements to adapt to the addition of CDCL to the plain algorithm. This gives access to more information during the course of the algorithm that can be exploited in the scoring heuristic. One common approach when designing SAT solving heuristics is to accredit more importance to clauses and variables that have a high impact on the clause learning procedure. For example, the learning rate based heuristic [8] uses such a measurement to order the variables. There are different ways to define scoring heuristics that follow this approach, where the easiest one is the initially introduced heuristic that just uses the number of satisfied clauses as a measurement (see Eq. (5.4), where sat clauses(f, a) is the set of satisfied clauses in formula f for the variable assignment a). When this heuristic is used in the context of the MCTS-based CDCL algorithm, the number of clauses raises through the course of its execution and thus the fulfillment of learned clauses gains extra importance by enabling higher scores. fnum (f, a) =



1

(5.4)

c∈sat clauses(f,a)

To explain a second scoring heuristic that follows the described approach we define the activity act (c) of a clause c as the number of times c occurred during the resolution process of the clause learning procedure. Equation (5.5) uses this measurement to benefit the satisfying of clauses with high activity values. We also tried a similar scoring heuristic that is inspired by the VSIDS variable order heuristic which benefits variables that occur in newly learned clauses and uses the age of clauses, i.e., the number of MCTS iterations that occurred since the clauses were added, to benefit the satisfying of new clauses. This heuristic behaved similarly and thus is not further considered.  factivity (f, a) = act (c) (5.5) c∈sat clauses(f,a)

Another approach is to not directly optimize the satisfying of as many clauses as possible but to optimize the collection of useful information. As already concluded in the analysis of the search trees, a great benefit of the MCTS-based CDCL solver may be the ability to learn valuable clauses. We now introduce different heuristics that aim on learning clauses that fulfill different criteria and reward the learning of “good” clauses. One simple and commonly used criteria for the quality of learned clauses is their length, which leads to the scoring heuristic as defined in Eq. (5.6), where length(c) is the number of literals in the newly learned clause c. flength (Clause) = −length(Clause)

(5.6)

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

119

Another criterion to measure the quality of learned clauses is to benefit the learning of clauses that enable the algorithm to cut the search space near to its root. To do so, we define fdepth in Eq. (5.7)—where depth(s) is the number of decisions, i.e., variable assignments that were not caused by unit propagation, that were executed in a simulation s—that rewards simulations which lead to a conflict after a low number of decisions and therefore learn clauses that prune the search tree near to its root. fdepth (Simulation) = −depth(Simulation)

(5.7)

A last scoring heuristic aims to reward simulations that enforce many variable assignments due to unit propagation. As formulated in Eq. (5.8), where assigned(s) is the number of variables that were assigned in simulation s, the heuristic gives those simulations a high value that executed a high proportion of their assignments due to unit propagation. funit (Simulation) =

assigned(Simulation) depth(Simulation)

(5.8)

Of course, the different heuristics can be combined to follow both approaches or benefit different criteria. For example, one could reward the occurrence of early conflicts while satisfying as many clauses as possible (see Eq. (5.9)). fcombined (Simulation) =

fnum (Simulation) fdepth (Simulation)

(5.9)

In Sect. 5.6 we will see that the different heuristics succeed in optimizing their respective criteria.

5.4.2 Probability Heuristics In Sect. 5.2 the simulations of the MCTS-based CDCL solver were defined to assign the variables of the formula uniformly at random. While this is an approach that can be used to solve SAT and is quite standard when using MCTS, it is also common to use domain specific knowledge—if it is available—to weight the probabilities in the simulation phase [1]. This section focuses on using knowledge that can be extracted from the given SAT formula as well as from the learned clauses to weight the probabilities. In backtracking-based SAT solvers, the decision to which value to assign the variables is made using the Phase Selection Heuristic, where one approach is to assign a variable xi to 1 if the literal xi occurs more often in the formula than ¬xi and vice versa. We adapted this approach and used probabilities according to Eq. (5.10) during the simulation phase, where num(xi ) is the number of occurrences of literal

120

O. Keszocze et al.

xi in the formula and P (xi = 1) is the probability of assigning variable xi to 1. P (xi = 1) =

num(xi ) num(xi ) + num(¬xi )

(5.10)

Note that the number of occurrences of a literal in the formula changes during the course of the algorithm because of the newly added clauses. We experimented with different probabilities when solving benchmark problems, but were not able to reach clear results, meaning that for some problems the probabilities according to Eq. (5.10) performed better and for others the uniform random assignment outperformed the competitor. The results of this experiments can be found in [14]. Because we were not able to obtain clear results on the benefits of using nonuniform probability heuristics, all experiments in Sect. 5.6 used the uniform random probability heuristic.

5.4.3 Analysis of Different Scoring Heuristics Similar to Sect. 5.3.2 we now will analyze the impact of the different heuristics by using visualizations of search trees that were produced using the heuristics. We therefore used the MCTS-based CDCL solver with different scoring heuristics to again solve a pigeon hole instance with 14 holes and in the following will use the produced search trees to exemplary analyze the impact of the heuristics. Later, in the experiments section, we will quantify the results of this exemplary analysis with more data. As a starting point for the analysis, we will look at the search trees that were produced using the initially introduced scoring heuristic, i.e., the number of satisfied clauses after a simulation (fnum ). Figure 5.8 shows the search trees produced 30 s into the solving with an exploration constant of 0.1 and 0.3. We again see that in both cases the search tree is asymmetric, but the variant with the higher exploration constant more intensely explored both branches of the root and the variant with the lower exploration constant was able to exploit its greedy nature to create and prune more nodes in the branch left of the root. In comparison, Fig. 5.9 shows the search trees of the same situation when the fdepth heuristic is used instead. We can observe that the share of pruned nodes is higher for both exploration constants than in the search trees that were produced using the fnum heuristic. This is exactly how the search trees should look like by design of the heuristic. As fdepth was designed to encourage early conflicts, it also encourages the pruning of nodes near the root, which explains the higher share of pruned nodes. A second aspect we can observe when comparing the search trees with an exploration constant of 0.3 is that the search tree that was produced using the fnum heuristic is “more symmetric” than the one that was produced using fdepth , meaning that the less explored branch of the root contains more nodes and thus the tree is more balanced. This means that the usage of heuristic fdepth led to clearer

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

121

Fig. 5.8 Search trees produced by the MCTS-based CDCL solver using the fnum scoring heuristic in the first 30 s of solving a pigeon hole instance with 14 holes using an exploration constant of 0.1 (left) and 0.3 (right)

Fig. 5.9 Search trees produced by the MCTS-based CDCL solver using the fdepth scoring heuristic in the first 30 s of solving a pigeon hole instance with 14 holes using an exploration constant of 0.1 (left) and 0.3 (right)

results on where to expand the search tree and thus one branch of the root node was more intensely exploited. Therefore one could argue that the heuristic fdepth works better on this example, because the main goal of the algorithm is to be able to find and exploit areas of the search space where the heuristic leads to high scores. A more unbalanced tree means that the algorithm was more successful to do just that. To further elaborate on this thought, we take a look at the search trees produced in the same situation while using the factivity heuristic as illustrated in Fig. 5.10. We

122

O. Keszocze et al.

Fig. 5.10 Search trees produced by the MCTS-based CDCL solver using the factivity scoring heuristic in the first 30 s of solving a pigeon hole instance with 14 holes using an exploration constant of 0.1 (left) and 0.3 (right)

can observe that the search trees produced for both exploration constants explored both branches of the root fairly equally and also led to quite balanced sub trees. Thus, the algorithm was not able to find areas of the search space such that the factivity heuristic reached high enough results to exploit. We can conclude that, by using the factivity heuristic, we do not gain any information about the problem as the results seem to be similar in all explored areas of the search space and the search tree is built more or less in a breadth-first search fashion. Therefore, the factivity heuristic probably is not a good choice for at least this example. To sum up the analysis, recap that we observed that the fdepth heuristic reached its design goal by successfully pruning more nodes near to the root node than the other heuristics. In the experiments section we will quantify this observation and investigate whether the other heuristics reach their design goals as well. We also observed that the heuristics differ in their ability to create asymmetric search trees and argued that this ability is an indicator if a heuristic can be successfully used for a specific problem. In the experiments section we will collect statistics on the symmetry of the search trees and quantify which heuristics succeed to create asymmetric trees for different problems.

5.5 Using Multiple Solver Instances for Preprocessing In the previous sections we designed heuristics that enable an MCTS-based CDCL solver to actively search for “good” clauses. However, the current implementation of the algorithm cannot compete with established solvers. Therefore this section will focus on how to combine the MCTS-based approach with different solvers and

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

123

thereby take advantage of the clauses learned by an MCTS-based algorithm that uses the previously introduced heuristics. As stated in the previous section, it is possible to configure the algorithm to optimize different SAT related aspects like the usage of unit propagation, the learning of short clauses, and the cutting of the search space near its root. All of these aspects are strongly related to the learned clauses. This leads to the assumption that different solvers can benefit from importing those clauses. Our approach is to generate such clauses by running a portfolio of instances of the algorithm as a preprocessor for another solver. The MCTS-based solver instances of the portfolio are configured to encourage the pruning of the search tree, the learning of short clauses, and the usage of unit propagation by using the corresponding scoring heuristics that were introduced in Sect. 5.4. For a given SAT instance, the portfolio is run for a fixed time to learn clauses that benefit the mentioned aspects. After that, a backtracking-based solver is started on the given problem—including the previously learned clauses. The hypothesis is that these clauses improve the performance of the second solver, as they were learned to encourage the mentioned SAT related aspects. If the preprocessor was able to actually solve the given problem, the second solver is not started. For the experiments described in Sect. 5.6, four instances of the MCTS-based CDCL solver are used to preprocess a backtracking-based CDCL solver. The instances were configured to use fdepth , funit , flength , respectively, fnum as scoring heuristics. The selection of this four heuristics will be explained in Sect. 5.6. As the experiments will show, the preprocessing was able to improve the performance of the backtracking-based algorithm on several benchmark problems.

5.6 Experiments To verify the existence of the mentioned benefits, we implemented an MCTS-based SAT solver as specified in Sect. 5.2 as well as all extensions of the algorithm that were introduced in this chapter and used them to solve the following benchmark problems.

5.6.1 Benchmark Problems As already seen in Sects. 5.3.2 and 5.4.3, we considered different instances of the easily scalable pigeon hole problem. Additionally, we considered different sets of randomly generated instances. First, we used random satisfiable and unsatisfiable 3-SAT instances from http://www.cs.ubc.ca/~hoos/SATLIB/benchm.html with 250 variables and 1065 clauses. In the following, this problem sets will be called random SAT and random UNSAT, respectively. Both problem sets consist of 100 different instances.

124

O. Keszocze et al.

Furthermore, we considered harder randomly generated instances that were used in the SAT competitions of 2007 and 2009.1 These randomly generated instances consist of the following problem sets, where each set consists of ten different instances. – Random set 1: The satisfiable 3-SAT instances with 360 variables from the SAT competition of 2009. – Random set 2: The randomly generated instances in the 2 + p category with p = 0.7 and 3500 variables from the SAT competition of 2007. – Random set 3: The randomly generated instances in the 2 + p category with p = 0.8 and 1295 variables from the SAT competition of 2007. Finally, we considered larger, especially designed benchmarks as well as industrial benchmarks by again taking instances from the SAT competitions of 2007 and 2009. More precisely, we used the following problem instances: – – – – – – – –

q_query_3_l42_lambda gss-13-s100 gss-14-s100 gss-16-s100 mod3block_3vars_9gates_restr mod3_4vars_6gates AProVE07-09 AProVE07-08

In the following, we will present the results of different experiments we executed using the introduced problems.

5.6.2 Scoring Heuristics In Sect. 5.4.3 we were able to exemplarily observe that different heuristics lead to differently balanced search trees and argued that an asymmetric search tree is an indicator that the algorithm works as intended when using a heuristic. If the search tree is asymmetric the algorithm was able to find areas of the search tree, where the heuristic reached higher values and thus can be exploited. In order to determine which heuristics can be used to find such areas for the different benchmark problems, we used them on the problems and collected the following data: 1. Let n be a node of the search tree and let c1 and c2 be the children of n, then dist(n) as defined in the equation below is an indicator of how balanced the subtree, that is induced by n, is. If, for example, dist(n) = 0.5 holds, then it

1 http://www.satcompetition.org/.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

125

means that both children of n were equally often visited and thus c1 and c2 both have equally many successors. Thus, the more dist(n) deviates from 0.5, the less balanced the sub tree of n is. dist(n) =

max(c1 .counter, c2 .counter) n.counter

Therefore, if V is the set of nodes in the search tree, distmax (V ) = maxn∈V {dist(n)} and distavg (V ) = avgn∈V {dist(n)} are indicators whether the search tree is balanced. 2. Let again n be a node of the search tree and c1 , respectively, c2 be the children of n, then diff (n) is an indicator on how balanced the subtree, that is induced by n, is because a higher value means that one of the children was more often visited. diff (n) = |c1 .counter − c2 .counter| Again, if V is the set of nodes, then diff max (V ) = maxn∈V {diff (n)} and diff avg (V ) = avgn∈V {diff (n)} are indicators whether the search tree is balanced. We collected the data for distavg and distmax , diff avg and diff max in the first 30 s of solving the benchmark problems with the MCTS-based CDCL solver when using the different introduced scoring heuristics and exploration constants of 0.1, respectively, 0.3. Given that we aim to use the different scoring heuristics in the context of the preprocessing approach as introduced in Sect. 5.5, the time interval at the beginning of the solving process is of special importance and thus we consider the first 30 s. Note that, when calculating the values for the different measurements, we only included nodes with two children, as both, the dist and diff statistic, are only defined for such nodes. The results for the distmax measurement are illustrated in Fig. 5.11. As already observed when analyzing the search trees in Sect. 5.4.3, the data confirms that the factivity heuristic leads to fairly balanced search trees. In fact, for each problem set the distmax value is close to 0.5 over the whole observed time interval even for the small exploration constant of 0.1. We conclude that the MCTS-based CDCL solver does not work as intended when the factivity heuristic is used and will therefore not include it in the further experiments. Apart from this observation the data shows that all other heuristics lead to asymmetric search trees for all used problem sets. For the pigeon hole instance, we can observe that the heuristic fnum leads to a more balanced tree than the other heuristics, which again fits to the observations of Sect. 5.4.3. This transfers to the random and crafted and industrial problem sets as the data shows that fnum and funit lead to slightly more balanced trees than the other heuristics. Nevertheless, we can conclude that all heuristics apart from factivity succeed to find areas of the search space to exploit within the first 30 s of the solving for all considered problem sets. As a final observation, we can note that for the crafted, respectively, industrial problems, which are significantly larger than the other considered benchmark

0.8

0.6 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Random Set 3, Exploration Constant 0.1 1

0.8

0.6 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Crafted and industrial instances, Exploration Constant 0.1 1 0.8 0.6 0.4

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Average maximum symmetry ratio

Pigeon instance with 10 holes, Exploration Constant 0.1 1

Average maximum symmetry ratio

O. Keszocze et al.

Average maximum symmetry ratio

Average maximum symmetry ratio

Average maximum symmetry ratio

Average maximum symmetry ratio

126

Pigeon instance with 10 holes, Exploration Constant 0.3 1

0.8

0.6 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Random Set 3, Exploration Constant 0.3 1

0.8

0.6 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Crafted and industrial instances, Exploration Constant 0.3

0.8

0.6

0

5,000

10,000

15,000 20, Time in ms

25,000

Number of satisfied clauses

Clause Length

Conflict Depth

Unit Propagation

Combined

Activity of satisfied clauses

30,000

Fig. 5.11 Average maximum symmetry ratio over the first 30 s of solving different problem sets using different exploration constants

problems, more time is needed until the created search trees reach an asymmetric form. This observation should be considered in the context of the preprocessed backtracking-based CDCL solver as introduced in Sect. 5.5 when defining the preprocessing time. Using the symmetry data we were able to confirm that the scoring heuristics— apart from the factivity heuristic—can be used by the algorithm while taking advantage of its ability to create asymmetric search trees. So only the question whether the scoring heuristics indeed fulfill their design goals remains. In Sect. 5.4.3 we exemplary observed that the fdepth heuristic succeeded to prune the search tree closer to its root node than, for example, the fnum heuristic, which is exactly the intent behind the fdepth heuristic. In order to determine whether this also holds over all considered benchmark problems and for all scoring heuristics that were introduced in Sect. 5.4, they were used to solve different benchmark problems, whereupon the following data was collected.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

127

1. The number of pruned nodes to evaluate which scoring heuristic encourages the pruning of the search tree. 2. The average depth of pruned nodes, excluding nodes that were only pruned because they were children of other pruned nodes, as another measurement for the ability to reduce the search tree near its root. 3. The average size of learned clauses to determine which scoring heuristic benefits the learning of short clauses. 4. The average number of assigned variables per decision to determine which scoring heuristic enables the most usage of unit propagation.

30,000

Average size of learned clauses

30,000

Average number of pruned nodes

Average number of assignments per decision

Average depth of pruned nodes

Figures 5.12, 5.13, 5.14, and 5.15 exemplary show the values for the four introduced measurements over the first 30 s of solving the random set 1, respectively, the industrial and crafted instances with exploration constants of 0.1 and 0.3. We will now review whether the different heuristics fulfill their design goals. We first can observe that the heuristic flength , that was designed to encourage the learning of short clauses, indeed produces the shortest clauses—with restrictions for the crafted and industrial instances with an exploration constant of 0.3 where the heuristic does not produce the shortest clauses and all heuristics determine similar sized clauses—and thus fulfills its design goals in the observed time interval. We continue with considering the values of the fdepth heuristic, which was designed to encourage early conflicts. Therefore the heuristic should enable the algorithm to prune nodes near to the root of the search tree, which in turn should lead to a higher total number of pruned nodes. In the data for random set 1 the heuristic clearly

30

20

0

5,000

10,000

15,000 20,000 Time in ms

25,000

8 7 6 5 0

5,000

10,000

15,000 20,000 Time in ms

25,000

25

20

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

2,000

1,000

0

Number of satisfied clauses

Clause Length

Conflict Depth

Unit Propagation

Combined

Fig. 5.12 Data collected when solving all instances in the random set 1 using an exploration constant of 0.1

18 16 14 12 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

7

6

5 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Average size of learned clauses

O. Keszocze et al.

Average number of pruned nodes

Average number of assignments per decision

Average depth of pruned nodes

128

18 17 16

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

2,000

1,000

0

Number of satisfied clauses

Clause Length

Conflict Depth

Unit Propagation

Combined

8 6 4 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

800 600 400 200 0 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Average size of learned clauses

10

Average number of pruned nodes

Average number of assignments per decision

Average depth of pruned nodes

Fig. 5.13 Data collected when solving all instances in the random set 1 using an exploration constant of 0.3

25

20

15

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

400

200

0

Number of satisfied clauses

Clause Length

Conflict Depth

Unit Propagation

Combined

Fig. 5.14 Data collected when solving all industrial and crafted instances using an exploration constant of 0.1

4 0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

20

15

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

Average size of learned clauses

6

Average number of pruned nodes

Average size of learned clauses

Average depth of pruned nodes

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

129

20

15

0

5,000

10,000

15,000 20,000 Time in ms

25,000

30,000

300 200 100 0 0

5,000

10,000

15,000 20,000 Time in ms

Number of satisfied clauses

Clause Length

Conflict Depth

Unit Propagation

25,000

30,000

Combined

Fig. 5.15 Data collected when solving all industrial and crafted instances using an exploration constant of 0.3

fulfills this criteria as it has the lowest values for the average depth of pruned nodes and the highest values for the total number of pruned nodes, albeit the values are close especially for the constant of 0.1. The average number of assignments per decision is high if a large number of variables is assigned via unit propagation and therefore the heuristic funit should score high values for this measurements. Indeed, the heuristic leads to high values in that regard, whereupon the heuristic fdepth still performs slightly better. Per definition of the heuristics it makes sense that funit and fdepth correlate not only in the average number of assignments per decisions but for all introduced measurements as simulation depth is a divisor in the definition of funit . Additionally, it seems reasonable that a high number of variables that are assigned due to unit propagation corresponds to early conflict, i.e., conflicts after a low number of decisions. Thus, the correlation between the two heuristics is not surprising at all. We conclude that funit fulfills its design goal as well. The heuristics fnum and fcombined again lead to similar values of the measurements and all problem sets. The correlation is again not surprising because of the heuristics definitions. We can observe that both heuristics perform among the worst in every category over the observed time interval. This is not surprising, because the other heuristics were designed to optimize the introduced measurements, in contrast to fnum and fcombined . As the heuristics performed similarly on the other benchmark sets, the result indicates that the heuristics, that were introduced in Sect. 5.4, can actually be used to optimize different characteristics of the behavior of the algorithm.

130

O. Keszocze et al.

Overall, the experiments showed that it is possible to configure the MCTS-based CDCL solver to optimize different criteria—especially the learning of clauses that allow the pruning of the search tree near its root. As we additionally saw that all heuristics—apart from the factivity heuristic—enable the algorithm to find and exploit areas of the search space where the respective heuristics lead to high values within the first 30 s of the solving, we conjecture that the algorithm may be able to determine useful information about the problems and their search space in little time. In the following section we use experiments in order to determine, whether this can be exploited using the preprocessing approach as introduced in Sect. 5.5. For the experiments the heuristics fdepth , flength , funit , and fnum will be used. The first three were selected, because the experiments that were introduced in this sections confirmed their ability to optimize their measurement and fnum was selected in order to experiment with at least one “greedy” heuristic and because it performed better than fcombined in most categories and experiments.

5.6.3 Using the MCTS-Based Solver as Preprocessor In this section, we evaluate the impact of the preprocessing as introduced in Sect. 5.5 on the solving time of a third-party SAT solver. We used all benchmark problems that were introduced in Sect. 5.6.1. As a solver, Sat4j [6] was used. All experiments were executed at least thirty times and the following results are the average solving time over all executions. The results of the experiments can been found in Table 5.1, where column improvement states whether an actual improvement (values > 1) was achieved and the results of the randomly generated test sets are averages over the solving time for all contained instances. As discussed previously, the preprocessor should be run for differently large time spans in order to account for the different sizes and difficulties of the considered benchmarks sets. Therefore we used a small preprocessing time of 250 ms for the problem sets random SAT and random UNSAT and can observe that the preprocessing led to a significant speedup for the first set and at least did not (significantly) slow down the solving of the second set. For the more difficult pigeon hole instances, we used a preprocessing time of 1 s. The upper part of Table 5.1 shows that the preprocessed instances were solvable in shorter time in two out of three cases. To solve the larger and more difficult remaining sets of randomly generated instances, a larger preprocessing time of 2 s was used and achieved a speedup in for each set. Finally, the significantly larger and more difficult crafted, respectively, industrial instances were solved using a preprocessing time of 10 s. The lower part of Table 5.1 shows that in the majority of the cases the preprocessed instances could be solved in shorter time.

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

131

Table 5.1 Run time in milliseconds for solving different problems using Sat4j and the preprocessed Sat4j Benchmark Pigeon 9 Pigeon 10 Pigeon 11 Random SAT Random UNSAT Random set 1 Random set 2 Random set 3 qquery3l42lambda gss-13-s100 gss-14-s100 gss-16-s100 mod3block3vars9gatesr estr mod34vars6gates AProVE07-09 AProVE07-08

w/o preproc. 90,172 335,897 6,380,764 7544 10,248 31,456 242,268 527,738 21,042 92,078 122,405 768,782 115,320 410,409 686,304 1,512,648

w/ preprocessing 71,674 (1 s) 367,237 (1 s) 6,270,727 (1 s) 5363 (250 ms) 10,287 (250 ms) 16,606 (2 s) 190,592 (2 s) 478,709 (2 s) 19,274 (10 s) 65,341 (10 s) 152,834 (10 s) 301,306 (10 s) 130,358 (10 s) 300,104 (10 s) 675,980 (10 s) 1,365,943 (10 s)

Improvement 1.26 0.91 1.02 1.40 0.99 1.89 1.27 1.10 1.09 1.40 0.8 2.55 0.88 1.36 1.02 1.11

The running time for the preprocessed Sat4j includes the running time of the preprocessor, which is displayed in parentheses

All in all the results of this experiments indicate that the usage of MCTSbased CDCL solvers as preprocessors can improve the performance of established backtracking-based solvers.

5.7 Conclusion and Outlook In this chapter we analyzed the behavior of a Monte Carlo Tree Search-based Conflict-Driven Clause Learning SAT solver and showed that the usage of CDCL is beneficial for the SAT solving process. The improvement is achieved by pruning the search tree and directing the simulations in better directions via unit propagation on the learned clauses. The visualization of the search trees indicates the importance of an accurate value estimation of the tree nodes as it enables the algorithm to ignore large parts of the search space. Additionally they illustrate the ability of the algorithm to learn valuable clauses. To further take advantage of that ability, different scoring heuristics were introduced that can be used to actively search for valuable clauses. Our experiments showed that it is indeed possible to use those heuristics to configure the algorithm to optimize different SAT related aspects—like the learning of short clauses or the early occurrence of conflicts.

132

O. Keszocze et al.

This fact was exploited by preprocessing SAT instances before handing them to other solvers. While a lot of open questions—like the duration of the preprocessing or which clauses to import—exist, the experiments indicate that the preprocessing can be very benefiting and improve the performance of established SAT solvers. As this result also indicates that other solvers can benefit from importing the clauses learned by our solver, we will investigate whether using the MCTS-based CDCL solver in a portfolio approach can be beneficial. This could be done either using the MCTS-based solver exclusively or by integrating it in a more diverse portfolio employing a range of different solvers. In its current development stage, our solver is not capable of competing with established SAT solvers as a stand-alone solver. Therefore we additionally will pursue the obvious next step of improving the solver by means of software engineering.

References 1. Browne, C., Powley, E., Whitehouse, D., Lucas, S.M., Cowling, P.I., Rohlfshagen, P., Tavener, S., Perez, D., Samothrakis, S., Colton, S.: A survey of Monte Carlo tree search methods. IEEE Trans. Comput. Intell. AI Games 4(1), 1–43 (2012) 2. Davis, M., Putnam, H.: A computing procedure for quantification theory. J. ACM 7(3), 201– 215 (1960) 3. Goffinet, J., Ramanujan, R.: Monte-Carlo tree search for the maximum satisfiability problem. In: Principles and Practice of Constraint Programming, pp. 251–267 (2016) 4. Gupta, A., Ganai, M.K., Wang, C.: SAT-based verification methods and applications in hardware verification. In: Formal Methods for Hardware Verification, pp. 108–143 (2006) 5. Knuth, D.E.: Fascicle 6: Satisfiability, the Art of Computer Programming. Combinatorial Algorithms, vol. 4. Addison-Wesley, Boston (2015) 6. Le Berre, D., Parrain, A.: The SAT4J library, release 2.2, system description. J. Satisfiabil. Boolean Model. Comput. 7, 59–64 (2010) 7. Liang, J.H., Ganesh, V., Zulkoski, E., Zaman, A., Czarnecki, K.: Understanding VSIDS branching heuristics in conflict-driven clause-learning SAT solvers. In: Haifa Verification Conference, pp. 225–241. Springer, Berlin (2015) 8. Liang, J.H., Ganesh, V., Poupart, P., Czarnecki, K.: Learning rate based branching heuristic for SAT solvers. In: International Conference on Theory and Applications of Satisfiability Testing, pp. 123–140. Springer, Berlin (2016) 9. Loth, M., Sebag, M., Hamadi, Y., Schoenauer, M.: Bandit-based search for constraint programming. In: International Conference on Principles and Practice of Constraint Programming, pp. 464–480. Springer, Berlin (2013) 10. Marques-Silva, J.P., Lynce, I., Malik, S.: Conflict-driven clause learning SAT solvers. In: Handbook of Satisfiability, pp. 131–153 (2009) 11. Moskewicz, M., Madigan, C., Zhao, Y., Zhang, L., Malik, S.: Chaff: engineering an efficient SAT solver. In: Design Automation Conference, pp. 530–535 (2001) 12. Munos, R.: From bandits to Monte-Carlo tree search: the optimistic principle applied to optimization and planning. Tech. Rep. (2014). https://hal.archives-ouvertes.fr/hal-00747575 13. Previti, A., Ramanujan, R., Schaerf, M., Selman, B.: Monte-Carlo style UCT search for Boolean satisfiability. In: AI*IA 2011: Artificial Intelligence Around Man and Beyond, pp. 177–188 (2011)

5 Improving SAT Solving Using Monte Carlo Tree Search-Based Clause Learning

133

14. Schloeter, J.: A Monte Carlo tree search based conflict-driven clause learning SAT solver. In: Eibl, M., Gaedke, M. (eds.) INFORMATIK 2017, pp. 2549–2560. Gesellschaft für Informatik, Bonn (2017) 15. Stephan, P., Brayton, R.K., Sangiovanni-Vincentelli, A.L.: Combinational test generation using satisfiability. IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst. 15(9), 1167–1176 (1996)

Chapter 6

Synthesis of Majority Expressions Through Primitive Function Manipulation Evandro C. Ferraz, Jeferson de Lima Muniz, Alexandre C. R. da Silva, and Gerhard W. Dueck

6.1 Introduction Majority logic allows the creation of nanoelectronic circuits for several different technologies, which justifies the search for majority based algorithms that generates optimized circuits. Among the first works that deal with majority logic are Lindaman [11], Cohn [8], and Akers [1]. Lindaman [11] proposed the first theorem for applying majority logic in binary decision problems, introducing the majority operator to classical Boolean algebra. The theorem, shown in Eq. (6.1), proposes a Boolean function equivalent to a majority operation. M(A, B, C) = A · B + A · C + B · C

(6.1)

Subsequently, a set of axioms that defines the majority algebra independently of the classical Boolean algebra was presented in [8], creating the basis for current majority algebra axiomatization (Ω). Moreover, the authors in [21] presented a method that performs the mapping of all 3-input Boolean functions into a 3-dimensional cube, generating 13 possible patterns, where each pattern has a different formula to convert a classical Boolean function into a majority equivalent. Similarly, the authors in [19] presented a method that uses a 4-dimensional cube to map 4-input functions, generating a total of 143 representation patterns. All 143 patterns also have a specific formula to find their equivalent majority functions.

E. C. Ferraz () · J. de Lima Muniz · A. C. R. da Silva Department of Electrical Engineering, FEIS - S˜ao Paulo State University, Ilha Solteira, SP, Brazil G. W. Dueck Faculty of Computer Science, University of New Brunswick, Fredericton, NB, Canada © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_6

135

136

E. C. Ferraz et al.

In majority algebra, simplification algorithms based on primitive functions are widely used. Primitive functions are functions with at most one majority gate in their optimized form. An algorithm that maps each of the primitive functions and uses the obtained maps to generate more complex functions was proposed in [18]. The mapping of functions is realized with Karnaugh maps, a graphical method proposed by Maurice Karnaugh in 1953, which aims to simplify a classic Boolean function by mapping its truth table [10]. In [12] a similar algorithm was developed, the B2M (Boolean to Majority). The B2M receives a Boolean function as input and generates a majority function that covers the same set of minterms. The generation of an output function is also done with the combination of primitives, selected by their MLD (Modified Levenshtein Distance). The authors in [22] developed the program denominated as MALS (Majority Logic Synthesizer). It was the first program to minimize majority functions with more than three inputs. The MALS receives an algebraically minimized Boolean function as input and returns an equivalent majority function. The algorithm starts by preprocessing the input function, this process aims to decompose the input function in a way that no node has more than three input variables. To do this process the program SI ST OOL is used [14]. After the preprocessing, the algorithm converts each node in a reduced majority function. This is done by the method presented in [18]. But this method was not able to find minimal solutions for all functions given that the algorithm works individually on each node instead of the function as a whole. The authors in [20] proposed a methodology that combines lower level majority functions, starting from primitives, to form higher level majority functions. The goal of this method is to build a majority expressions Look-Up Table (MLU T ) that stores the majority equivalent for all possible 4-input Boolean functions. Using the MLU T , the algorithm will then search the equivalent majority expression for every node in the input network, generating a majority network as output. The authors in [16] proposed the exact_mig algorithm, which is considered state of the art. As input, the algorithm receives a truth table or a Majority Inverter Graph (MI G) [3], with a maximum of six input variables, and returns a majority function that covers the same set of minterms. A MI G is a graph that represents a majority function. The most important characteristic of this algorithm is the proposal of an exact synthesis for majority functions. The function is built from a set of constraints (K) that shape a given problem accordingly to the definitions of the majority Boolean algebra. The majority output function is generated with the application of K to an SMT (Satisfiability Module Theory) solver [9]. As cost criteria the exact_mig takes into consideration the number of levels and gates in the output function, making it possible to choose which of these criteria will be prioritized. In [7] the authors developed a decomposition methodology that uses XOR and majority operators as a base. The input function is converted into a XORMajority Graph (XMG), a MI G with the addition of the XOR operator, and decomposed into simplified sub-functions. To perform the decomposition, the

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

137

algorithm combines theories of majority algebra, Shannon decomposition [15], and disjoint-support decomposition (DSD)[5]. In [17] the authors proposed adaptations of the exact synthesis used in the exact_mig, applied to normal Boolean functions. New technologies based on constraints and SMT solvers are also presented and compared. In this work the MP C algorithm is proposed. Similar to the methodology proposed in [20], the algorithm checks all possible combinations among primitive functions and creates a table to store them. For each function, the covered set of minterms is also stored. If there are two functions that cover the same set of minterms, the lowest cost function is kept and the other function is discarded. As a result, we have a table (M2 ) that lists all the sets covered by majority functions with two levels. As cost criteria the algorithm considers the depth, followed by the number of gates, the number of inverters, and the number of gate inputs in the output function. The MP C can be used to synthesize Boolean functions with a maximum of 5-input variables. For 3-input variables the algorithm returns an optimal solution for all possible functions. For 4 and 5-input variables the algorithm guarantees an optimal solution for functions covered by M2 or by a primitive, and uses a specific synthesis to cover functions with a higher number of levels. For five variables however, functions with four or more levels are generated by the application of the Shannon theorem. This article is organized as follows: In Sect. 6.2, we present an explanation about majority algebra, including its axiomatization and the concept of primitive majority functions. Section 6.3 presents the MP C algorithm, explaining how it works for 3, 4, and 5-input variables. Section 6.4 presents the results obtained comparing the MP C and the exact_mig. Section 6.5 presents the conclusion of what was realized in the paper.

6.2 Majority Boolean Algebra The majority Boolean algebra is composed by the set {B, ¬, M}. The elements B and ¬, as in classical Boolean algebra, represent the binary values {0, 1} and the inversion operator, respectively, and M represents the majority operator [6]. A majority function returns as output the most present binary value among its inputs. Therefore, an operator M that has a total of three input variables will return a true value only if two or more inputs are true. The truth table presented in Table 6.1 exemplifies a majority operation for the variables X, Y , and Z. From a majority operation it’s also possible to obtain AND and OR functions, performed by fixing one of the input variables to a constant binary value. As an example, the function M(A, B, C) is considered. Setting the value of A to 0, we have an AND function between B and C. Setting the value of A to 1, we have an OR function between B and C. This example is shown in Table 6.2.

138

E. C. Ferraz et al.

Table 6.1 Example of a majority operation

Table 6.2 Generation of functions AN D and OR

Table 6.3 Equivalence between M(A, B, C) and its dual form

X 0 0 0 0 1 1 1 1

B 0 0 1 1

C 0 1 0 1

B ·C 0 0 0 1

A 0 0 0 0 1 1 1 1

Z 0 1 0 1 0 1 0 1

M(X, Y, Z) 0 0 0 1 0 1 1 1

B +C 0 1 1 1

M(1, B, C) 0 1 1 1

M(A, B, C) 0 0 0 1 0 1 1 1

M(A, B, C) 0 0 0 1 0 1 1 1

M(0, B, C) 0 0 0 1

B 0 0 1 1 0 0 1 1

C 0 1 0 1 0 1 0 1

Y 0 0 1 1 0 0 1 1

Majority functions are also self-dual functions, meaning that a majority function is always equivalent to its dual form. A function’s dual form can be obtained by complementing all input variables and gates [13]. For example, the function (X · Y ) + (X · Z) is equal to its dual form (X + Y ) · (X + Z). Table 6.3 shows the equivalence between a majority function M(A, B, C) and its dual form M(A, B, C).

6.2.1 Axiomatization of Majority Functions (Ω) The set of axioms that defines the majority algebra is represented by Ω and can be divided into axioms of Commutativity, Associativity, Distribution, Inverter Propagation, and Majority [4]. Every axiom in Ω can be proved by perfect induction.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation Table 6.4 Proof of Ω.C by perfect induction

A 0 0 0 0 1 1 1 1

B 0 0 1 1 0 0 1 1

C 0 1 0 1 0 1 0 1

M(A, B, C) M(0,0,0) = 0 M(0,0,1) = 0 M(0,1,0) = 0 M(0,1,1) = 1 M(1,0,0) = 0 M(1,0,1) = 1 M(1,1,0) = 1 M(1,1,1) = 1

M(A, C, B) M(0,0,0) = 0 M(0,1,0) = 0 M(0,0,1) = 0 M(0,1,1) = 1 M(1,0,0) = 0 M(1,1,0) = 1 M(1,0,1) = 1 M(1,1,1) = 1

139 M(C, B, A) M(0,0,0) = 0 M(1,0,0) = 0 M(0,1,0) = 0 M(1,1,0) = 1 M(0,0,1) = 0 M(1,0,1) = 1 M(0,1,1) = 1 M(1,1,1) = 1

The Commutativity axiom (Ω.C), represented in Eq. (6.2), determines that the input order doesn’t change the output value. M(A, B, C) = M(A, C, B) = M(C, B, A)

(6.2)

Table 6.4 proves Ω.C by perfect induction. The Associativity axiom (Ω.A) states that the exchange of variables between two functions is possible, as long as they are at subsequent levels and have one variable in common. An example of an Ω.A application is presented in Eq. (6.3). M(A, D, M(B, D, C)) = M(C, D, M(B, D, A))

(6.3)

Note that the variable shared between levels is D. Therefore, it’s possible to substitute the remaining variable in the upper level for one in the subsequent level. In the presented example, we had an exchange between the variables A and C. Table 6.5 proves Ω.A by perfect induction. The Distribution axiom (Ω.D) determines that it’s possible to distribute a set of variables to gates in subsequent levels. In Eq. (6.4) an example of this theorem is given, where the distributed set is {A, B}. M(A, B, M(D, E, C)) = M(M(A, B, D), M(A, B, E), M(A, B, C))

(6.4)

Table 6.6 proves Ω.D by perfect induction. The Inverter Propagation axiom (Ω.I ), represented in Eq. (6.5), determines that a majority function is self-dual [2]. M(A, B, C) = M(A, B, C)

(6.5)

Table 6.7 proves Ω.I by perfect induction. The Majority (Ω.M) can be divided in two equations. Equation (6.6) shows that the output of a majority gate is equal to the most common value among its inputs.

140

E. C. Ferraz et al.

Table 6.5 Proof of Ω.A by perfect induction A 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1

B 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1

C 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1

D 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1

M(A, D, M(B, D, C)) M(0,0,M(0,0,0)) = 0 M(0,1,M(0,1,0)) = 0 M(0,0,M(0,0,1)) = 0 M(0,1,M(0,1,1)) = 1 M(0,0,M(1,0,0)) = 0 M(0,1,M(1,1,0)) = 1 M(0,0,M(1,0,1)) = 0 M(0,1,M(1,1,1)) = 1 M(1,0,M(0,0,0)) = 0 M(1,0,M(0,0,1)) = 0 M(1,0,M(0,1,0)) = 0 M(1,1,M(0,1,1)) = 1 M(1,0,M(1,0,0)) = 0 M(1,1,M(1,1,0)) = 1 M(1,0,M(1,0,1)) = 1 M(1,1,M(1,1,1)) = 1

M(C, D, M(B, D, A)) M(0,0,M(0,0,0)) = 0 M(0,1,M(0,1,0)) = 0 M(1,0,M(0,0,0)) = 0 M(1,1,M(0,1,0)) = 1 M(0,0,M(1,0,0)) = 0 M(0,1,M(1,1,0)) = 1 M(1,0,M(1,0,0)) = 0 M(1,1,M(1,1,0)) = 1 M(0,0,M(0,0,1)) = 0 M(1,1,M(0,1,0)) = 0 M(1,0,M(1,0,1)) = 0 M(1,1,M(0,1,1)) = 1 M(0,0,M(1,0,1)) = 0 M(0,1,M(1,1,1)) = 1 M(1,0,M(1,0,1)) = 1 M(1,1,M(1,1,1)) = 1

Equation (6.7) shows that the output value will be equal to the tie-breaking variable in functions with the same number of true and false values. M(A, A, B) = A

(6.6)

M(A, A, B) = B

(6.7)

Table 6.8 proves Ω.M by perfect induction.

6.2.2 Primitive Majority Functions Primitive functions can be obtained by a single gate. In the majority algebra, primitive functions (also called primitives) can be used as a base for the construction of more complex functions. All primitives can be obtained from the sets C, V , G, and T , where each set corresponds to functions with a specific number of inputs. The total number of primitives is obtained by summing the functions in C, V , G, and T [20]. The set C represents functions with no input variables, covering the constants 0 and 1. Therefore, |C| = 2.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

141

Table 6.6 Proof of Ω.D by perfect induction A 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

B 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1

C 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1

D 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1

E 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1

M(A, B, M(D, E, C)) M(0,0,M(0,0,0)) = 0 M(0,0,M(0,1,0)) = 0 M(0,0,M(1,0,0)) = 0 M(0,0,M(1,1,0)) = 0 M(0,0,M(0,0,1)) = 0 M(0,0,M(0,1,1)) = 0 M(0,0,M(1,0,1)) = 0 M(0,0,M(1,1,1)) = 0 M(0,1,M(0,0,0)) = 0 M(0,1,M(0,1,0)) = 0 M(0,1,M(1,0,0)) = 0 M(0,1,M(1,1,0)) = 1 M(0,1,M(0,0,1)) = 0 M(0,1,M(0,1,1)) = 1 M(0,1,M(1,0,1)) = 1 M(0,1,M(1,1,1)) = 1 M(1,0,M(0,0,0)) = 0 M(1,0,M(0,1,0)) = 0 M(1,0,M(1,0,0)) = 0 M(1,0,M(1,1,0)) = 1 M(1,0,M(0,0,1)) = 0 M(1,0,M(0,1,1)) = 1 M(1,0,M(1,0,1)) = 1 M(1,0,M(1,1,1)) = 1 M(1,1,M(0,0,0)) = 1 M(1,1,M(0,1,0)) = 1 M(1,1,M(1,0,0)) = 1 M(1,1,M(1,1,0)) = 1 M(1,1,M(0,0,1)) = 1 M(1,1,M(0,1,1)) = 1 M(1,1,M(1,0,1)) = 1 M(1,1,M(1,1,1)) = 1

M(M(A, B, D), M(A, B, E), M(A, B, C)) M(M(0,0,0), M(0,0,0), M(0,0,0)) = 0 M(M(0,0,0), M(0,0,1), M(0,0,0)) = 0 M(M(0,0,1), M(0,0,0), M(0,0,0)) = 0 M(M(0,0,1), M(0,0,1), M(0,0,0)) = 0 M(M(0,0,0), M(0,0,0), M(0,0,1)) = 0 M(M(0,0,0), M(0,0,1), M(0,0,1)) = 0 M(M(0,0,1), M(0,0,0), M(0,0,1)) = 0 M(M(0,0,1), M(0,0,1), M(0,0,1)) = 0 M(M(0,1,0), M(0,1,0), M(0,1,0)) = 0 M(M(0,1,0), M(0,1,1), M(0,1,0)) = 0 M(M(0,1,1), M(0,1,0), M(0,0,0)) = 0 M(M(0,1,1), M(0,1,1), M(0,1,0)) = 1 M(M(0,1,0), M(0,1,0), M(0,1,1)) = 0 M(M(0,1,0), M(0,1,1), M(0,1,1)) = 1 M(M(0,1,1), M(0,1,0), M(0,1,1)) = 1 M(M(0,1,1), M(0,1,1), M(0,1,1)) = 1 M(M(1,0,0), M(1,0,0), M(1,0,0)) = 0 M(M(1,0,0), M(1,0,1), M(1,0,0)) = 0 M(M(1,0,0), M(1,0,0), M(1,0,0)) = 0 M(M(1,0,1), M(1,0,1), M(1,0,0)) = 1 M(M(1,0,0), M(1,0,0), M(1,0,1)) = 0 M(M(1,0,0), M(1,0,1), M(1,0,1)) = 1 M(M(1,0,1), M(1,0,0), M(1,0,1)) = 1 M(M(1,0,1), M(1,0,1), M(1,0,1)) = 1 M(M(1,1,0), M(1,1,0), M(1,1,0)) = 1 M(M(1,1,0), M(1,1,1), M(1,1,0)) = 1 M(M(1,1,1), M(1,1,0), M(1,1,0)) = 1 M(M(1,1,1), M(1,1,1), M(1,1,0)) = 1 M(M(1,1,0), M(1,1,0), M(1,1,1)) = 1 M(M(1,1,0), M(1,1,1), M(1,1,1)) = 1 M(M(1,1,1), M(1,1,0), M(1,1,1)) = 1 M(M(1,1,1), M(1,1,1), M(1,1,1)) = 1

The set V represents all functions formed by a single input variable, in its complemented form or not. Equation (6.8) shows how to calculate the number of functions in V . |V | = 2 · n

(6.8)

In Table 6.9, we can observe the listing of V for three input variables. The number of input variables are represented by n. Note that the classical functions and their

142

E. C. Ferraz et al.

Table 6.7 Proof of Ω.I by perfect induction

Table 6.8 Proof of Ω.M by perfect induction

Table 6.9 List of set V for n=3

A 0 0 0 0 1 1 1 1

A 0 0 1 1

B 0 1 0 1

B 0 0 1 1 0 0 1 1

C 0 1 0 1 0 1 0 1

M(A, B, C) 1 1 1 0 1 0 0 0

M(A, B, C) 1 1 1 0 1 0 0 0

M(A, A, B) = A M(0,0,0) = 0 M(0,0,1) = 0 M(1,1,0) = 1 M(1,1,1) = 1

M(A, A, B) = B M(0,1,0) = 0 M(0,1,1) = 1 M(1,0,0) = 0 M(1,0,1) = 1

Classic function A B C A B C

Majority function A B C A B C

corresponding majority forms are equal because the V set is composed only by functions without operators. The set G is formed by functions with a single AND or OR operator, having a total of 2 input variables. The number of functions in G can be calculated by Eq. (6.9). The variables E and O represent the possible combinations of inputs, for AND and OR operations, respectively. For n = 3, we have E = {A · B, A · C, B · C} and O = {A + B, A + C, B + C}. Each combination has A + B, for example, has the variations 4 inversion variations, the combination  A + B, A + B, A + B, A + B . |G| = (4 · |E|) + (4 · |O|)

(6.9)

In Table 6.10, we present the functions in G for n = 3. The set T represents functions with a single majority gate, no constant value and no repeated variable as input. Equation (6.10) calculates the number of functions in T . The variable t represents the number of possible combinations among the input

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

143

Table 6.10 List of set G for n=3

Classic function A·B A·B A·B A·B A·C A·C A·C A·C B ·C B ·C B ·C B ·C A+B A+B A+B A+B A+C A+C A+C A+C B +C B +C B +C B +C

Majority function M(A, B, 0) M(A, B, 0) M(A, B, 0) M(A, B, 1) M(A, 0, C) M(A, 0, C) M(A, 0, C) M(A, 1, C) M(0, B, C) M(0, B, C) M(0, B, C) M(1, B, C) M(A, B, 1) M(A, B, 1) M(A, B, 1) M(A, B, 0) M(A, 1, C) M(A, 1, C) M(A, 1, C) M(A, 0, C) M(1, B, C) M(1, B, C) M(1, B, C) M(0, B, C)

Table 6.11 List of set T for n=3

Classic function AB + AC + BC A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C

Majority function M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C)

variables, considering three inputs per combination. Note that each combination has eight variations of inverters and, for n = 3, there is only one possible combination. |T | = t · 8 Table 6.11 shows the list of functions in T , for n = 3.

(6.10)

144

E. C. Ferraz et al.

Table 6.12 Complete list of primitives for n = 3 N 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

Classic function 0 1 A B C A B C A·B A·B A·B A·B A·C A·C A·C A·C B ·C B ·C B ·C B ·C

Majority function 0 1 A B C A B C M(A, B, 0) M(A, B, 0) M(A, B, 0) M(A, B, 1) M(A, 0, C) M(A, 0, C) M(A, 0, C) M(A, 1, C) M(0, B, C) M(0, B, C) M(0, B, C) M(1, B, C)

N 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

Classic function A+B A+B A+B A+B A+C A+C A+C A+C B +C B +C B +C B +C AB + AC + BC A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C A·B +A·C+B ·C

Majority function M(A, B, 1) M(A, B, 1) M(A, B, 1) M(A, B, 0) M(A, 0, C) M(A, 1, C) M(A, 1, C) M(A, 0, C) M(1, B, C) M(1, B, C) M(1, B, C) M(0, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C) M(A, B, C)

Table 6.12 shows the complete primitives table for n = 3. Note that |C| + |V | + |G| + |T | = 40.

6.3 The MP C Algorithm In this section we propose the MP C algorithm. The MP C receives a truth table f as input and returns a majority function that covers the same set of minterms. To generate a valid output function we use the expression M(X1 , X2 , X3 ). Each variable Xc , where 1 ≤ c ≤ 3, represents a majority primitive or a 2-level majority function.

6.3.1 Tables Formulation The first step of MP C is the tables formulation phase, where the functions used to build M(X1 , X2 , X3 ) are formulated. The algorithm receives an input truth table f , identifies the number of input variables, represented by n, and generates the

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

145

primitives table based on the sets C, V , G, and T . We also store the set of minterms covered by every primitive function. Note that each primitive function is the optimal solution of its respective set of minterms. The second table built by the MP C is the M2 table, formed by the application of all possible combinations among primitive functions in the expression M(X1 , X2 , X3 ), without considering repeated primitives. For each generated function the set of covered minterms is also stored. If a set is covered by two or more functions, the one with the lowest cost is kept and the others are discarded. Therefore, the table M2 lists all sets of minterms that can be covered by a 2-level majority function and, since they are obtained exhaustively, M2 functions are also an optimal solution for their respective set of minterms. It is also important to point out that, for computational performance optimization, the M2 is stored as a LU T (Look-Up Table) in the MP C code. As an example of a M2 function, we have M(X1 , X2 , X3 ) = M(A, M(A, B, 0), M(A, B, C)), where X1 = A, X2 = M(A, B, 0), and X3 = M(A, B, C). The cost criteria used by the MP C is primarily the number of levels and gates in the output function, followed by the number of inverters and gate inputs. To ensure the minimization of inverters, the single gate primitives follow four possible patterns: – – – –

M(A, B, C), no inverters; M(A, B, C), a single complemented input; M(A, B, C), a single inverter applied to the output value; M(A, B, C), a single input and the output complemented.

Note that in cases where the gate has two inverters, even though the number of inverters stay the same, it’s better to complement the output and only one input, since M(X, Y, Z) = M(X, Y , Z). This allows the application of Ω.I to minimize the number of inverters when the primitives are being used to build functions with two or more levels. To exemplify this application we consider: M(M(A, B, C), D, 0), which has 2 levels, 2 gates, and 3 inverters. By applying Ω.I we have M(M(A, B, C), D, 0) = M(M(A, B, C), D, 1), which has the same number of levels and gates, but has one less inverter. It’s also important to point out that repeated gates are not considered in the cost calculation. In the function M(M(0, A, C), M(1, A, M(B, C, D)), M(1, C, M(B, C, D))), for example, given that the gate M(B, C, D) appears twice, we count a total of five gates in the function cost. The total of possible functions for a specific number of inputs is represented by the variable S, and can be calculated by 2m . Note that m = 2n , and represents the number of minterms in the input truth table f . For n = 3, S = 256. The primitives table covers 40 of these functions. The 216 left are covered by the M2 table. Therefore, S can be completely covered by majority expressions with at most two levels, which makes the table formulation phase enough for obtaining all optimal solutions for n = 3.

146

E. C. Ferraz et al.

For n = 4, S = 65,536 and 90 of these functions are primitives, with at most one majority gate. In the formulation of M2 , only 10,260 functions can be covered. For the remaining 55,186, 55,184 can be covered by majority expressions with three levels. The remaining two functions need a majority expression with four levels to be covered.

6.3.2 MP C Synthesis for 4-Input Functions This section presents the synthesis used in MP C for the construction of majority functions where n = 4. The objective of this synthesis is to formulate M(X1 , X2 , X3 ) with the combination of primitives and M2 functions, generating a majority function that covers the same minterms of f . Note that this synthesis is only applied if f can’t be covered by any function in the M2 table or by any primitive. The synthesis is composed by two different loops, each one having their own characteristics. If an output function couldn’t be found in the first loop the second starts. The first loop is composed by the following steps: 1. Any primitive or M2 function that doesn’t cover at least one minterm of f is discarded from its respective table. 2. Build a new table P , selecting every pair of primitives (p1 + p2 ), where: – Every minterm covered by f is also covered at least once by p1 + p2 ; – The pair p1 + p2 only covers minterms covered by f . 3. Select a pair of primitives from P , as X1 and X2 . 4. Create a vector v with 2n elements that will be used to build the truth table for X3 . Every element in v represents a minterm in f . The vector v is updated according to the set of minterms covered by X1 and X2 . If a minterm i is covered by both functions, vi = 2. If it’s covered by only one function, vi = 1. And if it isn’t covered by any function, vi = 0. For example, given f = {0, 1, 5, 8}, X1 = {0, 1, 4, 5} and X2 = {0, 1, 2, 8, 10}. Then v has the values shown in Table 6.13. 5. Create the truth table for X3 , represented by the vector X3 f . Positions where vi = 2 or vi = 0 are considered as don’t care states (represented by x). For positions where vi = 1 and i is also covered by f , we have X3 fi = 1. If vi = 1 and i isn’t covered by f , we have X3 fi = 0. Therefore, for the example presented in Table 6.13, we have X3 f = [xx0x01xx1x0xxxxx]. 6. Generate every possible truth table manipulating the don’t care states in X3 f . Each possibility is searched in the M2 table. From the functions, a new table, P3 , is constructed.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

147

Table 6.13 Generation of vector v Minterms 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

f = {0, 1, 5, 8} 1 1 0 0 0 1 0 0 1 0 0 0 0 0 0 0

X1 = {0, 1, 4, 5} 1 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0

X2 = {0, 1, 2, 8, 10} 1 1 1 0 0 0 0 0 1 0 1 0 0 0 0 0

v 2 2 1 0 1 1 0 0 1 0 1 0 0 0 0 0

7. For every function in P3 composed by a gate that also composes X1 or X2 , we reduce its cost by 1. This rule exists because each gate is counted only once in the calculation of a majority function size. 8. Select the lowest cost function in P3 , that hasn’t been selected yet, as X3 . If there’s no valid X3 , we go back to step 3 and find a new primitive pair. 9. With the selection of X3 we now have a valid output M(X1 , X2 , X3 ). To minimize inverters, Ω.I is applied to every level of the function built. If the function post Ω.I application has a lower cost, the previous function is substituted. 10. The loop ends when every possible pair in P has been combined with a function from M2 , and every M(X1 , X2 , X3 ) found is stored in table Z. 11. By the end of the loop, the algorithm returns the function with the lowest cost in Z. If no function could be found the second loop starts. To exemplify an iteration of the first loop, consider n = 4 and f = {4, 5, 6, 9, 15}. A valid output function can be found in the iteration where X1 = M(A, D, 0) and X2 = M(A, B, C), X1 covering the minterms {9, 11, 13, 15} and X2 covering {2, 3, 4, 5, 6, 7, 14, 15}. Table 6.14 shows vector v updated from X1 and X2 . The minterms considered don’t care states, where vi = 2 or vi = 0, are {0, 1, 8, 10, 12, 15}. The minterms where vi = 1 and fi = 1 are {4, 5, 6, 9}, and the minterms where vi = 1 and fi = 0 are {2, 3, 7, 11, 13, 14}. Therefore, X3 f = xx001110x1x0x00x. We select as X3 , from the M2 table, the lowest cost function that fits the truth table pattern formed by X3 f . We select X3 = M(C, M(B, D, 1), M(A, B, 0))

148 Table 6.14 Vector v updated from X1 and X2 , for the first loop example

E. C. Ferraz et al. Minterms 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

f 0 0 0 0 1 1 1 0 0 1 0 0 0 0 0 1

X1 0 0 0 0 0 0 0 0 0 1 0 1 0 1 0 1

X2 0 0 1 1 1 1 1 1 0 0 0 0 0 0 1 1

v 0 0 1 1 1 1 1 1 0 1 0 1 0 1 1 2

that covers the minterms {0, 1, 4, 5, 6, 8, 9, 12}, and has 1100111011001000 as truth table. Accordingly, we have M(X1 , X2 , X3 ) = M(M(A, D, 0), M(A, B, C), M(C, M(B, D, 1), M(A, B, 0))). The dual form of M(M(A, D, 0), M(A, B, C), M(C, M(B, D, 1), M(A, B, 0))) is equal to M(M(A, D, 1), M(A, B, C), M(C, M(B, D, 0), M(A, B, 1))), which has a higher amount of inverters. Therefore, for f = {4, 5, 6, 9, 15}, the MP C algorithm adds M(M(A, D, 0), M(A, B, C), M(C, M(B, D, 1), M(A, B, 0))) to its table of possible outputs Z. The loop ends when every pair of functions in P are selected and combined with a function from M2 , and returns the lowest cost function in Z as output. From all 55,184 sets of minterms that can be covered by a 3-level function, 50,016 can be covered by functions where two elements of Xc are primitives. Those functions are found by the first loop. Among the 5168 remaining sets, 5056 can be covered by functions where only one element of Xc is a primitive. The 112 remaining sets can only be covered by functions where all elements of Xc are 2-level functions from M2 . Those functions are found by the second loop. The second loop is composed by the following steps: 1. Select X1 from the primitives table. If every primitive function has been selected as X1 and a valid output function could not be found, X1 is selected from a group of functions R. The group R is formed by every M2 function with size r, where r represents the number of gates in a M2 function. Therefore, r starts at 2, the lowest number of gates that a 2-level majority function can have, and is incremented if a group R with higher size functions must be defined.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

149

2. Create two new vectors, v0 and v−1 . The vector v0 contains the positions of f that haven’t been covered yet; therefore, v0 = f − X1 . The vector v−1 has the positions of v that can’t be covered one more time; therefore, v−1 = X1 − f . 3. From v0 and v−1 the truth tables for X2 , represented by the variable X2 f are generated. X2 f represents a truth table, with the same size of f , that can have binary values or don’t care states. For the minterms stored in v0 , X2 fi = 1. For minterms stored in v−1 , X2 f i = 0. The other minterms are all considered don’t care states. 4. Every possible truth table manipulating the don’t care states in X2 f is generated. Each possibility is searched in the M2 table. From these functions a new table, P2 , is created. 5. For every function in P2 that is composed by a gate that also composes X1 , its cost is reduced by one. 6. Select the lowest cost function in P2 , that was not selected yet, as X2 . If there’s no valid X2 , go back to the first step and select a new X1 . 7. To find X3 create X3 f based on v−1 and a new vector v1 . The vector v1 stores the minterms of f covered only once by Xc . Therefore, the minterms in v1 must be covered by X3 . For the minterms stored in v−1 , X3 f = 0. For the minterms stored in v1 , X3 f = 1. 8. To find all possibilities for X3 f , search the respective functions in the M2 table and build P3 from them. 9. Again, update the cost of the functions in P3 based on the gates in X1 and X2 . 10. Select the lowest cost function in P3 , that hasn’t been selected yet, as X3 . If there’s no valid X3 , go back to step 6 and select a new X2 . 11. With the selection of X3 we now have a valid output M(X1 , X2 , X3 ). For the minimization of inverters we also apply Ω.I to every level of the function built and we substitute it if the function post Ω.I application has a lower cost. 12. Every M(X1 , X2 , X3 ) found is stored in table Z and the loop stops when all primitive functions are selected as X1 . If no function could be found, the algorithm goes back to the first step and restarts selecting X1 from a group R, stopping when all functions in R were selected as X1 . If yet no function could be found, the algorithm increments r and restarts the loop with a new group R. The algorithm returns the lowest cost function stored in Z as output. For the two sets that need a function with four levels to be covered, we first select X1 from the primitives table, then we build X2 and X3 as 3-level functions using the explained synthesis.

6.3.3 MP C Synthesis for 5-Input Functions The synthesis for 5-input (n = 5) functions also uses the primitives and the M2 table as a base to build functions with a higher number of levels.

150

E. C. Ferraz et al.

For n = 5, S = 4,294,967,296 and 172 of these sets can be covered by primitives, with at most one majority gate. The M2 table stores the 253,560 sets that can be covered by majority functions with 2 levels. The remaining sets need more than 2 levels to be covered. To build 3-level functions the algorithm also uses the expression M(X1 , X2 , X3 ), realizing the combination of primitives and M2 functions, selected by their lowest cost. The complete synthesis for 3-level functions is composed by the following steps: 1. Order by cost every function from the primitives and M2 tables. 2. Select the function with the lowest cost as X1 . 3. Reduce the cost by one for every primitive or M2 function that is composed by a gate that also composes X1 . 4. Create v0 and v−1 , where v0 = f − X1 and v−1 = X1 − f . 5. Select X2 , firstly from the primitives, as the lowest cost function that: – Covers all minterms in v0 . – Doesn’t cover any minterm in v−1 . If no valid X2 could be found among the primitives, select X2 from the M2 table. If still no valid X2 could be found, go back to step 2 and select a new X1 . 6. Again, update the cost of the primitives and M2 functions based on the gates in X1 and X2 . 7. Create v1 , where v1 stores the minterms covered by f and only once by Xc . 8. Select X3 , firstly from the primitives, the lowest cost function that: – Covers all minterms in v1 . – Doesn’t cover any minterm in v−1 . If no valid X3 could be found among the primitives, select X3 from the M2 table. If still no valid X3 could be found, go back to step 5 and select a new X2 . 9. With the selection of X3 we now have a valid output. Next apply Ω.I to every level of M(X1 , X2 , X3 ) and return the lowest cost version as output. To exemplify the second loop, consider n = 5 and f = {2, 4, 6, 7, 8, 11, 13, 14, 15}. A valid output function can be found in the iteration where X1 = C, covering the minterms {4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31}. Updating the vector v based on X1 , we have v0 = {2, 8, 11} and v−1 = {5, 12, 20, 21, 22, 23, 28, 29, 30, 31}. Table 6.15 shows v after the selection of X1 . As X2 , we select the lowest cost function from M2 that covers every minterm in v0 but doesn’t cover any of the minterms in v−1 . We select X2 = M(M(C, D, 1), M(B, E, 0), M(A, B, E)) that covers {0, 1, 2, 4, 6, 8, 9, 11, 13, 15, 16, 17, 24, 25}. From X2 , we update v again, generating v1 = {2, 7, 8, 11, 14} and v−1 = {0, 1, 5, 9, 12, 16, 17, 20, 21, 22, 23, 24, 25, 28, 29, 30, 31}. Table 6.16 shows v updated after X2 ’s selection. As X3 , we select the lowest cost function from M2 that doesn’t cover any minterms in v−1 and covers all minterms in v1 .

6 Synthesis of Majority Expressions Through Primitive Function Manipulation Table 6.15 Vector v updated from X1 , for the second loop example

Minterms 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

151 f 0 0 1 0 1 0 1 1 1 0 0 1 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

X1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1

v 0 0 0 0 1 −1 1 1 0 0 0 0 −1 1 1 1 0 0 0 0 −1 −1 −1 −1 0 0 0 0 −1 −1 −1 −1

We have X3 = M(M(A, D, 0), M(B, C, 0), M(A, B, E)), covering the minterms {2, 3, 6, 7, 8, 10, 11, 14}. With the selection of X3 , MP C returns M(X1 , X2 , X3 ) = M(C, M(M(C, D, 1), M(B, E, 0), M(A, B, E)), M(M(A, D, 0), M(B, C, 0), M(A, B, E))) as output, which has less inverters than its dual form.

152

E. C. Ferraz et al.

Table 6.16 Vector v updated from X2 , for the second loop example

Minterms 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

f 0 0 1 0 1 0 1 1 1 0 0 1 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

X2 1 1 1 0 1 0 1 0 1 1 0 1 0 1 0 1 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0

v −1 −1 1 0 2 −1 2 1 1 −1 0 1 −1 2 1 2 −1 −1 0 0 −1 −1 −1 −1 −1 −1 0 0 −1 −1 −1 −1

For functions that need more than three levels to be covered we apply the reduction of fan-ins by Shannon expansion. Equation (6.11) shows the equivalent majority version of the Shannon theorem, applied to the set of inputs {A, B, C, D, E}. M(A, B, C, D, E) = M(M(F1 , 0, A), M(F2 , 0, A), 1)

(6.11)

The variable A represents the isolated variable and F1 and F2 represent functions built with the remaining inputs {B,C,D,E}.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation Table 6.17 Example of f1 ’s and f2 ’s generation by Shannon theorem

Minterms 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

B 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1

C 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1

D 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1

153 E 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1

f1 0 1 1 1 0 0 0 1 1 0 0 0 1 0 1 0

f2 0 0 0 0 1 1 1 0 0 1 0 1 0 1 0 1

The first step to apply this equation in the MP C algorithm is to isolate the first input (A). Then split the input truth table f in two pieces to form 2 new truth tables, f1 and f2 . Table 6.17 shows an example of f1 ’s and f2 ’s generation. For this example, f = [01110001100010100000111001010101] and the set of inputs are {A, B, C, D, E} (n = 5). Note that, by splitting f in 2 equal size tables, we have f1 = [0111000110001010] and f2 = [0000111001010101], where the set of inputs became {B, C, D, E} (n = 4) and the variable A is isolated. To find F1 and F2 we apply the MP C synthesis for n = 4, explained in the previous section, to f1 and f2 , respectively. Note that the functions built by the Shannon Theorem aren’t an optimal solution for f , since Eq. (6.11) adds two levels and three gates by itself.

6.4 Results In this section results obtained from the comparison of the algorithms MP C and exact_mig are presented. For n = 4 both algorithms were executed for all 65,536 possible functions. The obtained results were then compared based on the cost criteria used by the MP C that prioritizes first the number of levels in the output function, followed by the number of gates, the number of inverters, and the number of gate inputs. In Table 6.18 each column corresponds to a group Si , where 0 ≤ i ≤ 2n . Each Si represents a total of functions that covers a specific number of minterms. S4 , for example, represents every function that covers 4 minterms among the 65,536

154

E. C. Ferraz et al.

Table 6.18 Cost comparison between MP C and exact_mig i 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Total

Si 1 16 120 560 1820 4368 8008 11,440 12,870 11,440 8008 4368 1820 560 120 16 1 65,536

MP C < exactmig 0 16 41 324 808 2906 4493 7188 8108 7536 6273 3334 1373 482 93 12 0 42,987

MP C < exactmig 0 0 8 60 708 583 2276 3300 3474 3022 1121 512 279 0 8 0 0 15,351

MP C < exactmig 1 0 71 176 304 879 1239 952 1288 882 614 522 168 78 19 4 1 7198

possibilities. Equation (6.12) shows the calculation of Si . Note that m = 2n , and represents the total of minterms for a specific number of inputs. For n = 4, m = 16. Si =

m! i! · (m − i)!

(6.12)

For each Si the table shows the quantity of functions where MP C generated results with a lower, higher, and equal cost than exact_mig. The MP C generates lower cost results for 42,987 (66%) functions, generates results with equal cost for 7198 (11%) functions, and generates results with higher cost for the remaining 15,351 (23%). Note that MP C is able to generate better results because exact_mig aims for the exact synthesis of only depth and size, while MP C considers also the number of inverters and the number of gate inputs as cost criteria. In this comparison, the exact_mig functions were generated with the prioritization of depth, followed by the function size, differing from MP C only by the addition of the number of inverters and gate inputs as third and fourth criteria, respectively. Functions where the MP C returns a higher cost than exact_mig exist because the MP C builds M(X1 , X2 , X3 ) prioritizing X1 and X2 as primitives, only using functions from M2 if needed. This rule is essential for the formation of optimized functions in the majority of the cases, but there are cases where the prioritization of 2-level functions would generate a lower cost result.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

155

As an example consider f = 1000000000000001. The MP C returns the function M(M(B, C, 1), M(B, D, 0), M(1, M(A, C, 0), M(A, D, 1))) as output that has 3 levels and 6 gates. The exact_mig algorithm returns M(M(0, C, D), M(1, D, M(A, B, D)), M(0, C, M(A, B, D))), which has 3 levels and 5 gates. In the presented case, the MP C generated a result prioritizing the use of two primitive functions (X1 = M(B, C, 1) and X2 = M(B, D, 0)), and a single 2level function (X3 = M(1, M(A, C, 0), M(A, D, 1))), while exact_mig was able to generate better results with a single primitive and 2-level functions, since the combination of both functions uses the gate M(A, B, D) twice and the cost of repeated gates is disconsidered. As example of a function where the MP C generated better results, we have f = 0000001001000100, where the MP C generated the function M(M(A, C, 0), M(C, D, 1), M(0, B, M(A, D, 1))) as output that has 3 levels, 5 gates, and 2 inverters. The exact_mig generated the function M(M(0, B, C), M(0, D, M(A, C, D)), M(D, M(A, C, D), M(0, B, C))) for the same truth table f that has 3 levels, 5 gates, and 5 inverters. Note that the MP C generates a function with the same number of levels and gates, but with less inverters. In Tables 6.19 and 6.20, comparisons about the runtime of both algorithms are presented. Table 6.19 shows the total and average runtime for every Si . Table 6.20 shows the total and average runtime for all functions with a specific depth. The comparisons were made in a computer with 8 GB RAM and a 1.7 GHZ CPU.

Table 6.19 Runtime comparison between MP C and exact_mig by Si i 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Total

Si 1 16 120 560 1820 4368 8008 11,440 12,870 11,440 8008 4368 1820 560 120 16 1 65, 536

MP C Total runtime 0.01 s 1.10 s 30.02 s 8.29 min 23.41 min 3.10 h 11.39 h 24.76 h 19.64 h 24.85 h 11.69 h 3.67 h 29.81 min 7.42 min 31.56 s 0.99 s 0.01 s 100.26 h

Avg. runtime 0.01 s 0.06 s 0.25 s 0.88 s 0.77 s 2.55 s 5.12 s 7.79 s 5.49 s 7.82 s 5.25 s 3.03 s 0.98 s 0.79 s 0.26 s 0.06 s 0.01 s 5.50 s

exact mig Total runtime 0.01 s 1.65 s 17.85 s 4.57 min 21.44 min 2.09 h 3.84 h 21.74 h 9.36 h 20.76 h 3.54 h 2.27 h 22.12 min 4.81 min 18.68 s 2.24 s 0.01 s 64.49 h

Avg. runtime 0.01 s 0.10 s 0.14 s 0.49 s 0.70 s 1.72 s 1.73 s 6.84 s 2.61 s 6.53 s 1.59 s 1.89 s 0.73 s 0.51 s 0.15 s 0.14 s 0.01 s 3.54 s

156

E. C. Ferraz et al.

Table 6.20 Runtime comparison between MP C and exact_mig by Depth Depth 0 1 2 3 4

Total functions 10 80 10,260 55,184 2

Table 6.21 Comparison of average memory usage for n=4

MP C Total runtime 0.12 s 1.07 s 103.81 s 91.80 h 8.46 h

Avg. runtime 0.01 s 0.01 s 0.01 s 5.98 s 4.23 h

i 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Total

exact mig Total runtime 0.23 s 1.62 s 318.34 s 50.26 h 14.22 h

Si 1 16 120 560 1.820 4.368 8.008 11.440 12.870 11.440 8.008 4.368 1.820 560 120 16 1 65,536

MP C 3.36 MB 4.38 MB 4.72 MB 5.06 MB 5.27 MB 5.34 MB 5.51 MB 5.64 MB 5.87 MB 5.61 MB 5.53 MB 5.32 MB 5.21 MB 5.23 MB 4.67 MB 4.41 MB 3.39 MB 5.56 MB

Avg. runtime 0.02 s 0.02 sec 0.03 s 3.27 s 7.11 h

exact mig 0.01 MB 3.00 MB 3.01 MB 3.28 MB 3.26 MB 3.55 MB 3.39 MB 3.61 MB 3.63 MB 3.61 MB 3.38 MB 3.55 MB 3.27 MB 3.28 MB 3.02 MB 3.00 MB 0.01 MB 3.52 MB

Note that even though the MP C can generate faster results for functions with 0, 1, 2, or 4 levels, in most cases it is still slower than exact_mig. In Table 6.21, we present the average memory usage in the synthesis of every group Si , in megabytes (MB). Note that the MP C has an average memory usage of 5.36 MB, while the exact_mig has an average memory usage of 3.52 MB. For n = 5 a sample of 1000 randomly generated functions was used and the MP C algorithm was able to achieve lower cost results for 477 (48%) functions, and equal cost results for 112 (11%). The MP C’s total runtime for the generated sample was 11.62 h, with an average runtime of 41.63 s. The exact_mig’s total runtime was 19.33 h, with an average runtime of 1.15 min.

6 Synthesis of Majority Expressions Through Primitive Function Manipulation

157

Therefore, the MP C was able to generate results 66% faster than exact_mig. The MP C’s average memory usage was 40.32 MB, while the exact_mig’s was only 5.05 MB. Note that results for n = 3 are not presented because both algorithms return optimal solutions for all 256 possible functions.

6.5 Conclusions In this paper we present the MP C algorithm, which aims to generate majority functions based on an input truth table. We also present a study on the main concepts of majority Boolean algebra and primitive functions. With the proposed cost criteria the MP C presented, in the most part, results better or equal to exact_mig. It’s important to point out that the MP C is able to find better results only considering two additional cost criteria: the number of inverters and gate inputs. For functions with n = 4, from a total of 65,536 possible functions, the MP C generated functions with lower cost in 42,987 (66%) cases and functions with equal cost in 7198 (11%) cases, reaching a total of 50,185 (77%) functions with equal or lower cost than exact_mig. The MP C had an average computational time of 5.50 s and an average memory usage of 5.56 MB, while the exact_mig had an average computational time of 3.54 s and an average memory usage of 3.52 MB. For functions with n = 5, from a sample of 1000 functions, the MP C found better or equal results for a total of 589 (59%) functions, where 477 (48%) had lower cost and 112 (11%) had equal cost. The MP C’s average computational time and memory usage were 41.63 s and 40.32 MB, while exact_mig’s average computational time and memory usage were 1.15 min and 5.05 MB, respectively. The MP C’s code is available at: https://github.com/EvandroFerraz/mpc. The list of functions used to compare MP C and exact_mig for 5-input functions can also be find in the link.

References 1. Akers, S.B.: A truth table method for the synthesis of combinational logic. IRE Trans. Electron. Comput. 4, 604–615 (1961) 2. Akers, S.B.: Synthesis of combinational logic using three-input majority gates. In: Proceedings of the Third Annual Symposium on Switching Circuit Theory and Logical Design, 1962. SWCT 1962, pp. 149–158. IEEE, Sri Lanka (1962) 3. Amarú, L., Gaillardon, P.E., De Micheli, G.: Majority-inverter graph: a novel data-structure and algorithms for efficient logic optimization. In: Proceedings of the 51st Annual Design Automation Conference, pp. 1–6. ACM, New York (2014) 4. Amaru, L., Gaillardon, P.E., Chattopadhyay, A., De Micheli, G.: A sound and complete axiomatization of majority-n logic. IEEE Trans. Comput. 65(9), 2889–2895 (2016) 5. Bertacco, V., Damiani, M.: The disjunctive decomposition of logic functions. In: International conference on Computer-aided design (ICCAD), pp. 78–82. IEEE, San Jose (1997)

158

E. C. Ferraz et al.

6. Chattopadhyay, A., Amarú, L., Soeken, M., Gaillardon, P.E., De Micheli, G.: Notes on majority Boolean algebra. In: 2016 IEEE 46th International Symposium on Multiple-Valued Logic (ISMVL), pp. 50–55. IEEE, Sri Lanka (2016) 7. Chu, Z., Soeken, M., Xia, Y., De Micheli, G.: Functional decomposition using majority. In: Asia and South Pacific Design Automation Conference, pp. 676–681. IEEE, Jeju (2018) 8. Cohn, M., Lindaman, R.: Axiomatic majority-decision logic. IRE Trans. Electron Comput. (1), 17–21 (1961) 9. De Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: International Conference on Tools and Algorithms for the Construction and Analysis of Systems, pp. 337–340. Springer, New York (2008) 10. Karnaugh, M.: The map method for synthesis of combinational logic circuits. Trans. Am. Inst. Electr. Eng. Part I Commun. Electron. 72(5), 593–599 (1953) 11. Lindaman, R.: A theorem for deriving majority-logic networks within an augmented Boolean algebra. IRE Trans. Electron. Comp. (3), 338–342 (1960) 12. Mishra, V.K., Thapliyal, H.: Heuristic based majority/minority logic synthesis for emerging technologies. In: 2017 30th International Conference on VLSI Design and 2017 16th International Conference on Embedded Systems (VLSID), pp. 295–300. IEEE, Jeju (2017) 13. Sasao, T.: Switching Theory for Logic Synthesis, 1st edn. Springer Science & Business Media, Berlin (2012) 14. Sentovich, E.M., Singh, K.J., Lavagno, L., Moon, C., Murgai, R., Saldanha, A., Savoj, H., Stephan, P.R., Brayton, R.K., Sangiovanni-Vincentelli, A.: Sis: a system for sequential circuit synthesis. Tech. rep., EECS Department, University of California, CA (1992). http://www2. eecs.berkeley.edu/Pubs/TechRpts/1992/2010.html 15. Shannon, C.E.: The synthesis of two-terminal switching circuits. Bell Syst. Tech. J. 28(1), 59–98 (1949) 16. Soeken, M., Amaru, L.G., Gaillardon, P.E., De Micheli, G.: Exact synthesis of majorityinverter graphs and its applications. IEEE Trans. Comput. Aided Des. Integr. Circuits Syst. 36(11), 1842–1855 (2017) 17. Soeken, M., Haaswijk, W., Testa, E., Mishchenko, A., Amarù, L.G., Brayton, R.K., De Micheli, G.: Practical exact synthesis. In: 2018 Design, Automation and Test in Europe Conference and Exhibition (DATE), pp. 309–314. IEEE, Dresden (2018) 18. Walus, K., Schulhof, G., Jullien, G., Zhang, R., Wang, W.: Circuit design based on majority gates for applications with quantum-dot cellular automata. In: Conference Record of the Thirty-Eighth Asilomar Conference on Signals, Systems and Computers 2004, vol. 2, pp. 1354–1357. IEEE, Dresden (2004) 19. Wang, P., Niamat, M., Vemuru, S.: Minimal majority gate mapping of 4-variable functions for quantum cellular automata. In: 2011 11th IEEE Conference on Nanotechnology (IEEENANO), pp. 1307–1312. IEEE, Dresden (2011) 20. Wang, P., Niamat, M.Y., Vemuru, S.R., Alam, M., Killian, T.: Synthesis of majority/minority logic networks. IEEE Trans. Nanotechnol. 14(3), 473–483 (2015) 21. Zhang, R., Walus, K., Wang, W., Jullien, G.A.: A method of majority logic reduction for quantum cellular automata. IEEE Trans. Nanotechnol. 3(4), 443–450 (2004) 22. Zhang, R., Gupta, P., Jha, N.K.: Majority and minority network synthesis with application to QCA-, SET-, and TPL-based nanotechnologies. IEEE Trans. Comput. Aided Des. Integr. Circuits Syst. 26(7), 1233–1245 (2007)

Chapter 7

Literal Selection in Switching Lattice Design Anna Bernasconi, Fabrizio Luccio, Linda Pagli, and Davide Rucci

7.1 Introduction A switching lattice is a two-dimensional lattice of four-terminal switches linked to the four neighbors of a lattice cell, so that these are either all connected or disconnected. A Boolean function can be implemented by a lattice associating each four-terminal switch to a Boolean literal, so that if the literal takes the value 1 the corresponding switch is ON and connected to its four neighbors; otherwise, it is not connected. The function evaluates to 1 if and only if there exists a connected path between two opposing edges of the lattice, e.g., the top and the bottom edges (see Fig. 7.1 for an example). The idea of using regular two-dimensional arrays of switches to implement Boolean functions dates back to a seminal paper by Akers [1], but has found a renewed interest recently, thanks to the development of a variety of nanoscale technologies. Synthesis algorithms targeting lattices of multi-terminal switches have been designed [2, 4, 26, 31], and methods based on function decomposition techniques [15–17] and on function regularities [10–14] have been exploited to mitigate the cost of implementing switching lattices [18–20, 23, 24]. Moreover, several studies on fault tolerance for nano-crossbar arrays have been published recently [5, 22, 32–34]. The synthesis problem on a lattice consists of finding an assignment of literals to switches in order to implement a target function with a lattice of minimal size. In [3, 4], Altun and Riedel developed a synthesis method which assigns at least one literal to each lattice position, with the literal controlling the corresponding switch.

A. Bernasconi () · F. Luccio · L. Pagli · D. Rucci Dipartimento di Informatica, Università di Pisa, Pisa, Italy e-mail: [email protected]; [email protected]; [email protected] © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_7

159

160

A. Bernasconi et al. TOP

TOP x1

x3

x3

x2

x3

x1

x2

x3

x2

x3

x3

x1

x3

x3

x3

x1

x2

x3 BOTTOM

BOTTOM

(a)

(b)

TOP

TOP

x1

x3

x3

x1

x3

x3

x3

x1

x2

x3

x1

x2

x2

x3

x3

x2

x3

x3

BOTTOM

BOTTOM

(c)

(d)

Fig. 7.1 A network of four-terminal switches implementing the function f = x 1 x 2 x 3 + x1 x3 + x2 x3 (a); the corresponding lattice (b); the lattice evaluated on the assignments 1,0,1 (c) and 0, 1, 0 (d), with gray and white squares representing ON and OFF switches, respectively

If several literals are assigned to a switch the choice of the controlling literal is arbitrary. Starting from the lattice obtained by the Altun–Riedel method, we consider two different minimization problems related to the assignment of one literal to each switch in case of different choices at the switch. We first study how to assign a single literal to each switch, in order to minimize the maximum number of lattice switches assigned to the same literal. Then, we study how to assign the literals in order to minimize the number of lattice portions of adjacent cells whose switches are associated with the same literal, a problem that has already been investigated in [21, 29]. These two problems are motivated by different aspects related to the physical layout of switching lattices: for the first problem the goal is to keep under control the input load for each literal in the lattice, whereas the goal of the second problem is to minimize the number of layers needed for connecting the subsets of switches with the same input literal. Interestingly enough, the two problems exhibit a very

7 Literal Selection in Switching Lattice Design

161

different behavior regarding their computational complexity: the first one can be solved in time polynomial in the size of the lattice, while the second is intractable. We design and implement heuristic algorithms for both problems and evaluate their performances on a set of lattices implementing known circuit benchmarks. We also analyze the effect of the two different literal selection policies on the physical layout of lattices. The paper is organized as follows: Preliminaries on switching lattices are reviewed in Sect. 7.2 and the general problem of literal selection is discussed in Sect. 7.3. Section 7.4 introduces and discusses the minimal degree assignment (MDA) problem that consists in minimizing the maximum number of lattice cells assigned to the same literal, whereas Sect. 7.5 studies the minimal partition assignment (MPA) problem consisting in minimizing the number of lattice portions of adjacent cells whose switches are associated with the same literal. Experiments on a set of standard benchmark circuits are reported in Sect. 7.6, and Sect. 7.7 concludes the paper.

7.2 Switching Lattices In this section we briefly review some basic notions and results [1, 4, 26]. A switching lattice is a two-dimensional array of four-terminal switches each contained in a cell. The four terminals of the switch link to the four neighbors of the cell, so that these are either all connected with each other (when the switch is ON), or disconnected (when the switch is OFF). A Boolean function can be implemented by a lattice with the following rules: – each four-terminal switch is controlled by a Boolean literal or by the constant 0, or 1; – if the literal or the constant takes the value 1 the corresponding switch is connected to its neighbors; otherwise, it is not connected; – the function evaluates to 1 if and only if there exists a connected path between two opposing edges of the lattice, e.g., the top and the bottom edges; – input assignments that leave the edges unconnected correspond to output 0. For instance, the 3 × 3 network of switches in Fig. 7.1a corresponds to the lattice in Fig. 7.1b, which implements the function f = x 1 x 2 x 3 + x1 x3 + x2 x3 . If we assign the values 1, 0, 1 to the variables x1 , x2 , x3 , respectively, we obtain paths of gray square connecting the top and the bottom edges of the lattices (Fig. 7.1c), and f evaluates to 1. On the contrary, the assignment x1 = 0, x2 = 1, x3 = 0 does not produce any path from the top to the bottom edge and f evaluates to 0 (Fig. 7.1d). The synthesis problem on a lattice consists in finding an assignment of literals to switches in order to implement a given target function with a lattice of minimal size measured in terms of the number of switches in the lattice. A switching lattice can similarly be equipped with left edge to right edge connectivity, so that a single lattice can implement two different functions. This fact

162

A. Bernasconi et al.

is exploited in [3, 4] where the authors propose a synthesis method for switching lattices simultaneously implementing a function f according to the connectivity between the top and the bottom plates, and its dual function1 f D according to the connectivity between the left and the right plates. This method produces lattices with a size that grows linearly with the number of products in an irredundant sum of products (SOP) representation of f , and consists of the following steps: 1. find an irredundant, or a minimal, SOP representation for f and f D : SOP (f ) = p1 + p2 + · · · + pM

SOP (f D ) = q1 + q2 + · · · + qN ;

2. form a N × M switching lattice and assign each product pj (1 ≤ j ≤ M) of SOP (f ) to a column and each product qi (1 ≤ i ≤ N ) of SOP (f D ) to a row; 3. for all 1 ≤ i ≤ N and all 1 ≤ j ≤ M, assign to the switch on the lattice site (i, j ) one literal which is shared by qi and pj (the fact that f and f D are duals guarantees that such a shared literal exists for all i and j , as proved in [4]). If several literals are shared by the two products qi and pj in step 3, the choice of the controlling literal is arbitrary. This synthesis algorithm produces a lattice for f whose size depends on the number of products in the irredundant SOP representations of f and f D , and it comes with the dual function implemented for free. For instance, the lattice depicted in Fig. 7.1 has been built according to this algorithm, and it implements both the function f = x 1 x 2 x 3 + x1 x3 + x2 x3 and its dual f D = x1 x2 x 3 + x 1 x3 + x 2 x3 . The time complexity of the algorithm is polynomial in the number of products. However, the method does not always build lattices of minimal size for every target function, since it ties the dimensions of the lattices to the number of products in the SOP forms for f and f D . In particular this method is not effective for Boolean functions whose duals have a very large number of products, as the size of the lattice is M × N and both factors can be exponential in the number n of variables. An immediate comparison can be carried out between the lattice and the layout of a PLA implementing the same function whose size is 2n × M. In the example of Fig. 7.1 the lattice consists of 3 × 3 = 9 cells, while an equivalent PLA would require 6 × 3 = 18 cells, but other functions may be strongly negative for the lattice. A different approach was proposed in [26] where the synthesis of minimalsized lattices was formulated as a satisfiability problem in quantified Boolean logic and solved by quantified Boolean formula solvers. This method uses the previous algorithm to find an upper bound on the dimensions of the lattice, then searches for successively better implementations until either an optimal solution is found or a preset time limit has been exceeded. Experimental results show how this alternative method can decrease lattice sizes considerably. In this approach the use

1 The

dual of a Boolean function f of n binary variables is the function f D such that f (x1 , x2 , . . . , xn ) = f D (x 1 , x 2 , . . . , x n ).

7 Literal Selection in Switching Lattice Design

163

of constant inputs is allowed and only the top-to-bottom paths are used to implement the function f but not its dual.

7.3 The Problem of Literal Selection In this work we only consider lattices obtained by the Altun–Riedel method, and study how to exploit the degree of freedom arising from the multiple choices associated with some of the switches. Consider the N × M lattice as a non-directed graph G = (V , E) whose vertices correspond to the switches (then |V | = NM) and whose edges correspond to the horizontal and vertical connections between adjacent switches (then E = 2N M − N − M). We shall refer indifferently to the lattice or to the graph, to switches (or cells) or to vertices, and to connections or to edges. Occasionally a vertex will be indicated with a pair of integers (i, j ) denoting the row and the column of the lattice where the vertex lays, with 1 ≤ i ≤ N and 1 ≤ j ≤ M, or with vh , with 1 ≤ h ≤ N M. Observe that h = j + (i − 1)M, that is, h spans the lattice row by row. Obviously the vertices have degree two or three if they lay on the corners or on the borders of the lattice, and have degree four if they are internal to the lattice. Finally, let L be the set of literals occurring in the Boolean function. Each vertex vi is associated with a non-void subset Li of L, from which one literal has to be eventually assigned to vi . Consider, for instance, the 3 × 3 lattice in Fig. 7.2a taken from [4] which presents multiple choices on the diagonal cells. The set of literals occurring in the lattice is L = {x1 , x2 , x3 }. The vertices v1 , v5 , v9 corresponding to the three diagonal cells are associated with the three subsets L1 = {x1 , x2 }, L5 = {x1 , x3 }, and L9 = {x2 , x3 }, respectively, while all other vertices are associated with one literal. Once a single literal has been assigned to each vertex of the lattice, we can define the notions of degree and area: Definition 7.1 The degree of a literal l in a lattice is the number of switches controlled by l. The degree of the lattice is the maximum degree of its literals, i.e., the maximum number of lattice cells assigned to the same literal. Definition 7.2 An area denotes a maximal connected subgraph of G (or connected portion of the lattice) where all vertices have the same literal assigned, called the literal of the area. Note that two areas A1 , A2 with the same literal must be disjoint and no two vertices a1 ∈ A1 , a2 ∈ A2 may be adjacent in G. Both notions play an important role in the physical implementation of switching lattices. The degree is related to the current supply needed for the literals in the lattice, while the areas are related to the number of layers needed for connecting

164 Fig. 7.2 (a) A lattice for the function f = x1 x2 + x1 x3 + x2 x3 , with multiple choices on the diagonal cells; (b) a lattice for f with an arbitrary choice of the controlling literals on the diagonal cells, with seven areas of adjacent cells associated with the same literal, and maximum degree 4; (c) a lattice for f that minimizes the maximum degree, with five areas and maximum degree 3; (d) a lattice for f that minimizes the number of areas, with four areas and maximum degree 4

A. Bernasconi et al.

{x1 , x2 }

{ x1 }

{ x2 }

x2

x1

x2

{ x1 }

{x1 , x3 }

{ x3 }

x1

x1

x3

{ x2 }

{ x3 }

{x2 , x3 }

x2

x3

x2

(a)

(b)

x1

x1

x2

x1

x1

x2

x1

x3

x3

x1

x1

x3

x2

x3

x2

x2

x3

x3

(c)

(d)

all subsets of switches with the same input literal. We make the following assumptions: 1. Equal literals must be connected together, and to an external terminal on one side (e.g., the top edge) of the lattice. This may require using different layers, and vias to connect cells of adjacent layers. 2. Connections can be laid out horizontally or vertically (but not diagonally) between adjacent cells. 3. Each cell can be occupied by a switch, or by a portion of a connecting wire, or by a via. No two such elements can share a cell on the same layer. As a consequence the circuit will be generally built starting from the original N ×M lattice and superimposing to it a certain number H of layers, to give rise to a threedimensional grid of size N × M × H . Note that if the switches associated with the same literal cannot be connected all together on the same layer, several subsets of these switches will form areas on different layers and these areas will be connected through vias. Therefore, if several layers will be needed, new areas will have to be identified in the lattice configurations arising layer by layer. As recalled in Sect. 7.2, if several literals are assigned to a switch in the Altun–Riedel synthesis method the choice of the controlling literal is left arbitrary. Consider the lattice in Fig. 7.2a which presents multiple choices on the diagonal cells. If we arbitrarily select the controlling literals for these cells, we obtain, e.g., the lattice in Fig. 7.2b which includes seven areas and has degree four, as literal x2 controls four switches. With different choices of the controlling literals in the

7 Literal Selection in Switching Lattice Design

165

diagonal cells, we could obtain lattices for the same target function with a lower degree or with a smaller number of areas. For instance, the lattice in Fig. 7.2c has degree 3, and the lattice in Fig. 7.2d has only four areas, one for x1 , one for x3 , and two disjoint areas for x2 . Motivated by the previous considerations, we pose the following two optimization problems: Minimal Degree Assignment (MDA) Problem Find a literal assignment that minimizes the degree of the lattice. Minimal Partition Assignment (MPA) Problem Find a literal assignment that minimizes the number of areas in the lattice.

7.4 The MDA Problem The MDA problem is motivated by the need of avoiding an excessive load to any single circuit generating an input variable. For this reason, our first optimization problem focuses on minimizing the lattice degree, i.e., minimizing the maximum number of lattice cells assigned to the same literal. Although this problem has not been directly studied in the past, we have found some interesting connections to many different and known problems such as graph orientation problems [6], network flow problems [28], and a variant of bipartite maximum matching called semi-matching used to solve a particular type of the offline scheduling problem [27]. These problems are all solvable in polynomial time, making our problem polynomially solvable too, thanks to simple and immediate reductions. Interestingly enough, the weighted versions of all these problems are NP-hard, thus making the MDA problem NP-hard as well whenever an integer weight is assigned to each switch and the degree is computed taking into account the weights. The area of scheduling problems is the one that provided the most useful reductions. In particular MDA is equivalent to a restricted version of the offline parallel machine scheduling problem, or PMS, which has received great attention in the literature (e.g., see [25, 30]). PMS consists of assigning m jobs to n identical, unrelated, machines, with the goal of minimizing one or more objective functions, for instance, the makespan2 of the scheduling. The restricted version of PMS equivalent to MDA is the version where each job requires one unit of time to complete, and can be executed only on a specific subset of the available machines. Proposition 7.1 MDA problem on an N × M lattice with  different literals is equivalent to the restricted PMS with NM unit-time jobs and  machines. 2 The makespan of a schedule is the difference in time between its start and its end. With unitlength jobs, as we assume below, makespan represents the maximum number of jobs assigned to a machine.

166

A. Bernasconi et al.

Proof Consider each lattice switch s as a unit-time job, and each literal that occurs at least once in the lattice as a machine. Moreover, let every subset Ls of literals assigned to a switch s represent the subset of machines that can execute job s. A solution of the restricted PMS problem on this instance, i.e., an assignment of each job to a machine, corresponds to an assignment of each switch to a single literal. Since the jobs require one unit of time to complete, an optimal solution that minimizes the makespan is equivalent to an optimal solution that minimizes the maximum number of jobs assigned to a machine. This, in turn, is equivalent to minimize the maximum number of switches assigned to the same literal, i.e., to minimize the lattice degree.   For example, the top left cell v1 of the lattice in Fig. 7.2a represents a job that can be executed by the two machines associated with the literals x1 and x2 . In [27], two exact polynomial time algorithms for the restricted PMS have been proposed which can be immediately adapted to solving MDA. Let m = N M be the lattice size, and let  be the number of distinct literals occurring in the lattice. Notice that n ≤  ≤ 2n, where n is the number of input variables of the function f implemented by the lattice. We denote by K the size of the input instance, that is, the total number of elements in the collection S of sets Li , 1 ≤ i ≤ m, of literals that could be assigned to each switch si of the lattice. Note that K = O(mn). The first exact algorithm is theoretically more efficient, with a time complexity of order O(mK) = O(m2 n). Since m = NM, with N and M given by the number of products in irredundant SOP representations of f and f D (see Sect. 7.2), the algorithm can be very time consuming. Indeed, N and M could be exponential in the number of input variables n. The second algorithm proposed in [27] has a worst case running time O(m2 n2 ) worse than the previous one, but in practice performs better. Due to the high cost of these algorithms, we propose a very efficient heuristic algorithm, called HMDA, for solving the MDA problem, which shows a very high success rate with respect to an always-optimal algorithm (see Sect. 7.6) and whose cost in time is linear in the size K of the input instance. To this end we state an immediate lower bound on the minimal degree d ∗ of the lattice that will be exploited by the heuristic. Proposition 7.2 d ∗ ≥  m  The input to HMDA is the collection S. Each set R in S has an additional attribute R.pos which holds the position h, 1 ≤ h ≤ m, of the corresponding switch in the lattice. The sets in S are first sorted by their cardinality in ascending order to provide more freedom for the choice of literals as the algorithm proceeds. The selection strategy of the heuristic is the following: 1. Among all literals in the current subset that have not been chosen more than  m  times, choose the one with the lowest number of occurrences across all the (remaining) subsets. 2. If such a literal does not exist, or in case of ties, select the literal chosen the lowest number of times so far.

7 Literal Selection in Switching Lattice Design

167

3. In case of successive ties select a literal arbitrarily. The algorithm makes use of two arrays occ, f req of size , and of an array Lit of size m. The arrays occ and f req keep track of the occurrences of the literals in the lattice and of the number of times each literal has been chosen, respectively; Lit stores the literal assigned to each lattice switch. HMDA (input S = {Li | 1 ≤ i ≤ m}, output Lit) sort the sets in S in non decreasing order of cardinality, using a linear time algorithm; define two arrays occ, f req of size , and set to 0 their elements; for all R ∈ S do for all v ∈ R do occ[v] ← occ[v] + 1; /* count the occurrences of each literal */ for all R ∈ S do lito ← the first literal v ∈ R with the lowest occ value; litf ← the first literal v ∈ R with the lowest f req value; if (f req[lito ] <  m ) Lit[R.pos] ← lito ; else Lit[R.pos] ← litf ; f req[Lit[R.pos]] ← f req[Lit[R.pos]] + 1; /* update the frequency of Lit[R.pos] */ for all v ∈ R do occ[v] ← occ[v] − 1; /* update the occurrences of the literals in R */

7.5 The MPA Problem The MPA problem has already been studied in [29] for general graphs and for some variations, showing that it is NP-hard on a lattice. Moreover, in [21] it has been shown how the problem may be simplified reducing the number of literals contained in the subsets associated with the vertices, and a very simple heuristic has been proposed. Here we develop two more skilled heuristics for the problem and analyze their performances on a set of known benchmarks. First of all, from [21] we recall the rule used to simplify the input instance of the problem. Rule 1 Let vj be a vertex, v1 , v2 , v3 , v4 be the four vertices adjacent to vj (if any), and Lj , L1 , L2 , L3 , L4 be the relative subsets of literals. Apply in sequence the following steps: Step 1.

Step 2.

Let |Lj | > 1. If a literal x ∈ Lj does not appear in any of the sets Li , for 1 ≤ i ≤ 4, cancel x from Lj and repeat the step until at least one element remains in Lj . Let |Lj | > 1, and let Lk ⊂ Lj with k ∈ {1, 2, 3, 4}. If a literal x ∈ Lj appears in exactly one set Lh with h ∈ {1, 2, 3, 4} and h = k, then cancel x from Lj and repeat the step until at least the literals of Lk remain in Lj .

Proposition 7.3 (From [21]) The application of Rule 1 does not prevent finding an MPA.

168 Fig. 7.3 Canceling a literal from a multiple choice using step 2 of Rule 1. Literals are denoted by a, b, c, d, e, f, g. Literal c in cells vj , vh is canceled from vj

A. Bernasconi et al.

vh c e

vk

a b

a b c d

vj d g

d f

An example of application of step 2 of Rule 1 is shown in Fig. 7.3. Note that a literal cancelation from Lj may induce a further cancelation in an adjacent cell. In the example of Fig. 7.3, if all the cells adjacent to vh except for vj do not contain the literal c, the cancelation of c from Lj induces the cancelation of c from Lh if step 1 of Rule 1 is subsequently applied to vh . As suggested in [21], before running any algorithm for solving MPA the sets Li may be reduced using Rule 1 through a scanning of the lattice. Moreover, several successive scans may be applied for further reduction until no change occurs in a whole scan. These operations constitute the first phase of any algorithm. Then, as the problem is computationally intractable, a heuristic must be applied. The one proposed in [21] is the simplest possible: – scan the lattice row-wise: for any vertex vi reduce the associated set of literals Li to just one of its elements chosen at random; – for any vertex vi not yet included in an area, build a tree Ti spanning the maximal connected subgraph whose vertices hold the same label of Ti and include the vertices of Ti in a new area. Here we propose two new heuristics that can be applied after the preliminary phase consisting of the application of Rule 1 to the whole lattice. Recall that we can represent an N ×M lattice as a grid G. For simplicity a vertex of G corresponding to cell (i, j ) will be indicated with an integer h, with 1 ≤ h ≤ N M. The first heuristic called HMPA1 builds each area of G as a BFS tree, looking for a subset of adjacent vertices that share a same literal and assigning that literal to them. The algorithm makes use of an internal queue Z to store the vertices that will eventually become the roots of the BFS trees, and of five vectors A, R, L, Q, P of N M elements with the following contents for each vertex h: A(h): number a assigned to the area Aa to which vertex h belongs, with a = 1, 2, . . . ; R(h): root of the BFS tree of Aa ; L(h): literal assigned to vertex h; Q(h): indicator that vertex h is present (Q(h) = 1) or not (Q(h) = 0) in the queue Z; P (h): pointer to the ordered subset Lh of literals associated with vertex h.

7 Literal Selection in Switching Lattice Design

169

HMPA1 (input {G, P }, output {A, R, L, Q}) set to 0 all the elements of A, R, L, Q; define an empty queue Z; push 1 → Z; /* start with vertex 1 in the queue */ a ← 1; /* a is an area number */ while Z non empty pop Z → h; A(h) ← a; R(h) ← h; access Lh through P (h); select a literal x from Lh at random; L(h) ← x; traverse G building a BFS tree with root h; let s be the vertex currently encountered; if (A(s) = 0) access Ls through P (s); if (x ∈ Ls ) A(s) ← a; R(s) ← h; L(s) ← x; else if (Q(s) = 0) push s → Z; Q(s) ← 1; until no more vertices s with (A(s) = 0) AND (Q(s) = 0) are encountered; a ← a + 1;

The second heuristic called HMPA2 scans the vertices vh of G assigning a final literal to each vertex encountered. In this process Rule 1 is applied again at each step. Since the subsets of literals of two out of four vertices adjacent to h have already been reduced to a sole literal, both steps of the rule are likely to induce a new reduction of Lh before a literal is assigned to h. At the end of the scan, a graph traversal is needed to build the areas, e.g., via BSF. A queue Z and the vectors A, R, L, Q, P can be used as in HMPA1, but this traversal is simpler because a literal has already been assigned to each vertex. HMPA2 (input {G, P }, output {A, R, L, Q}) set to 0 all the elements of A, R, L, Q; define an empty queue Z; for h = 1 to N M access Lh through P (h); apply Rule 1 to Lh ; select a literal x from Lh at random; L(h) ← x; push 1 → Z; a ← 1; while Z non empty pop Z → h; A(h) ← a; R(h) ← h; traverse the graph G building a BFS tree with root h let s be the vertex currently encountered if (L(s) = L(h))

170

A. Bernasconi et al.

A(s) ← a; R(s) ← h; else if (Q(s) = 0) push s → Z; Q(s) ← 1; until no more vertices s with (L(s) = L(h)) AND (Q(s) = 0) are encountered; a ← a + 1;

7.6 Experimental Results In this section we report the experimental results conducted for evaluating the effectiveness of the proposed heuristics and the effect of the two different literal selection policies on the physical layout of lattices. The aim of the first experimentation is to measure the success rate of the heuristic HMDA for the minimization of the lattice degree with respect to always-optimal algorithms, whereas the aim of the second experimentation is to determine if and how much the heuristics HMPA1 and HMPA2 for the minimization of the number of areas guarantee a reduction of the number of layers in the physical layout of the lattices. In our work we have considered the lattices obtained applying the Altun–Riedel method to the benchmarks taken from LGSynth93 [35], where each output has been treated as a separate Boolean function, for a total number of 1918 lattices examined. The experiments have been run on an Intel Core i7-3520M dual core, 2.90 GHz CPU with 8 GB of main memory, running macOS 10.13.4. The three heuristic algorithms, HMDA, HMPA1, HMPA2, have been implemented in C++. For the sake of brevity we report in Table 7.1 and in Table 7.2 only the results on a very limited subset of lattices (in fact, 26 out of 1918) as representative of our experiments. These lattices have been chosen among those of biggest size and with the largest numbers of areas. In Table 7.1 we report the results of the experimental evaluation of the heuristic HMDA for the minimization of the lattice degree. The first column reports the name and the number of the separate output function of the benchmark circuit. The following two columns report the dimension (N × M) of the lattice and the number of different literals occurring in it. The next two columns report the lattice degree computed by the heuristic HMDA, together with the corresponding running time expressed in milliseconds. Finally, the last two columns report the lattice degree computed by the second of the two optimal algorithms proposed in [27], with its running time expressed in milliseconds. Indeed, as expected (see Sect. 7.4) this algorithm has always performed better than the first one. For each lattice, we bolded the best degree and the best running time. By comparing the results, we note that HMDA provides optimal results for the degree for about 30% of the (bigger) lattices reported in Table 7.1 and that the increase in the degree w.r.t. the optimal one is very limited on average, only about 0.62%. Considering the whole set of 1918 benchmarks examined, the heuristic

7 Literal Selection in Switching Lattice Design

171

Table 7.1 Heuristic vs optimal lattice degree for a subset of standard benchmark circuits taken from [16] Benchmark b3(14) bcc(29) ex1010(1) ex1010(3) ex1010(4) ex1010(6) ex1010(8) in4(13) mainpla(5) mainpla(9) mainpla(10) mainpla(16) mainpla(26) mainpla(27) mainpla(28) mainpla(35) mainpla(36) max1024(4) max1024(5) sym10(0) test3(13) test3(29) tial(2) tial(3) tial(5) xparc(24) Total

N×M 125 × 96 93×71 89×48 94×49 92×47 91×44 90×49 125×96 100×54 105×55 113×65 105×64 99×66 93×66 104×72 127×73 110×64 83×82 117×122 130×210 93×46 94×47 90×90 66×188 181×181 143×80

lit 32 26 10 10 10 10 10 32 27 27 27 27 27 27 27 27 27 10 10 10 10 10 14 14 14 41

HMDA Degree 1840 263 218 236 223 205 224 1840 338 343 385 431 607 484 515 638 570 366 733 2537 217 225 487 588 1967 530 17, 010

Time 4.1 1.3 1.6 0.9 1.0 0.8 0.7 2.1 0.7 1.6 1.4 1.3 1.0 2.5 1.3 1.0 1.2 2.5 16.5 6.9 2.5 0.7 1.5 2.2 6.2 2.9 65.4

[27] Degree 1840 262 214 231 218 201 222 1840 338 339 385 427 607 479 508 621 570 365 718 2536 214 221 486 588 1967 509 16, 906

Time 469.1 11.6 4.1 5.2 21.3 3.8 3.5 315.7 118.1 87.6 183.8 52.2 57.3 130.5 197.5 455.8 103.8 6.0 13.2 65.4 3.4 3.4 12.5 10.4 47.4 80.0 2462.5

The selection of literals has been performed with the heuristic HMDA and with the second optimal algorithm proposed in [27]. Running times are expressed in milliseconds

found the optimal degree for about 89% of the lattices (1707 out of 1918). Again, the average increase in the degree computed heuristically is very limited (0.64%). The running times of the heuristic are smaller in all but one case for the benchmarks in Table 7.1, and the gain in computational time is of about 97% on average. For whole set of 1918 benchmarks examined, the heuristic was faster for all but 28 benchmarks, with an average gain of about 95%. We have then conducted an experimental evaluation of the heuristics HMPA1 and HMPA2 for the minimization of the number of areas. First of all, we have applied Rule 1 to reduce the sets of literals assigned to each lattice cell and we have verified that Rule 1 allows to completely solve the MPA problem in 55% of the lattices (1051

172

A. Bernasconi et al.

Table 7.2 Number of areas and layers for a subset of standard benchmark circuits taken from [35] HMPA1 Benchmark Areas Time Deg. b3(14) 3226 39.3 4653 bcc(29) 2915 23.2 524 ex1010(1) 2062 20.2 398 ex1010(3) 2022 16.5 347 ex1010(4) 2104 17.4 330 ex1010(6) 2084 18.4 369 ex1010(8) 2114 17.8 549 in4(13) 3021 38.3 4779 mainpla(5) 2022 20.0 731 mainpla(9) 2186 20.0 910 mainpla(10) 2528 23.5 1044 mainpla(16) 2078 27.5 1155 mainpla(26) 2002 23.0 1332 mainpla(27) 2053 21.1 1365 mainpla(28) 2372 21.9 1441 mainpla(35) 3204 36.1 1460 mainpla(36) 2527 27.0 1376 max1024(4) 3200 27.0 720 max1024(5) 6254 74.8 1177 sym10(0) 3606 71.5 4247 test3(13) 2183 17.5 370 test3(29) 2234 24.0 419 tial(2) 3410 28.9 1458 tial(3) 3269 38.2 1868 tial(5) 11, 873 11.9 6161 xparc(24) 3427 45.9 943 Total 79, 976 751.0 40, 126

HMPA2 Layers Areas Time Deg. HPMA1 HPMA2 Random 3387 90.9 3726 16 16 17 2969 26.7 458 16 17 19 2103 14.1 400 19 17 21 2122 16.4 371 18 17 23 2137 15.1 304 16 18 24 2094 16.7 338 17 16 21 2136 14.6 561 16 15 34 3197 96.8 3780 15 15 18 2117 25.6 662 19 16 19 2294 25.3 805 18 17 17 2667 38.0 835 17 18 16 2217 34.0 862 14 15 18 2056 35.3 1437 16 15 18 2145 29.8 1230 17 16 17 2548 38.8 1296 16 17 21 3298 49.2 1499 17 16 18 2577 31.9 1404 17 18 19 3293 22.4 647 22 22 23 6709 62.6 1145 19 19 31 5114 31.7 5466 11 11 11 2209 19.6 380 18 18 29 2235 14.1 419 20 18 26 3456 35.7 1516 15 16 20 3582 113.0 1626 19 17 22 12, 474 22.6 6356 21 21 21 3565 82.4 942 17 17 18 84, 701 1003.2 38, 465 446 438 541

The selection of literals has been performed with the two heuristics HMPA1 and HMPA2, or at random. Running times are expressed in milliseconds

out of 1918) reducing all subsets with more than one literal, when present, to just one literal. For the remaining lattices, we have run the two heuristics HMPA1 and HMPA2. The results reported in Table 7.2 are relative to the lattices with the largest numbers of areas, already examined before. The first column reports the name and the number of the separate output function of the benchmark circuit. The following six columns report the number of areas computed by heuristics HMPA1 and HMPA2, together with the corresponding running time expressed in millisecond, and the degree of the resulting lattice. For each lattice, we bolded the best area, the best running time, and the best degree. Finally, the last three columns report the number of layers needed for connecting

7 Literal Selection in Switching Lattice Design

173

all areas of switches controlled by the same input literal as estimate running the best-first heuristic described in [21]. Again, we bolded the best results. By comparing the results, we note that HMPA1 provides better results on the number of areas and it is slightly more time efficient than HMPA2 in most cases. We also note that the increase in the number of areas computed with the second heuristic appears quite limited on average, while it can be relevant on single lattices as in the case of benchmark sym10(0) in Table 7.2. The lattice degrees are in both cases much bigger than those computed running heuristic HMDA after the Altun– Riedel synthesis algorithm, showing how the two minimization goals (degree versus area) are in contrast with each other, as one could reasonably expect. Regarding the physical layout, the results of this last experimentation show how the two heuristics for the minimization of the number of areas guarantee a reduction of the number of layers, when compared with the layout for lattices synthesized with arbitrary assignment of literals at switches when multiple choices are possible. The reduction in the number of layers is of about 19% for the subset of (bigger) lattices reported in Table 7.2, and of about 14% for the whole set of lattices for which Rule 1 does not allow to completely solve MPA. Since such improvements are obtained in a very limited time, running one of these two heuristics before the physical implementation of lattices appears to be an advisable post-processing step to be performed after the Altun–Riedel synthesis algorithm.

7.7 Concluding Remarks We have discussed two different combinatorial problems related to the assignment of input literals to switches in lattices synthesized with the Altun and Riedel method [4]. We have proposed and developed efficient heuristic algorithms for finding satisfactory solutions for both problems, and discussed the implication of the different solutions on the layout of switching lattices. As future work on this subject, we plan to study better heuristics and to test them on larger data samples. More in general, we would like to study the effectiveness of the switching lattice model to represent and deal with Boolean functions related to biological problems, as those presented in [7–9].

References 1. Akers, S.B.: A rectangular logic array. IEEE Trans. Comput. 21(8), 848–857 (1972) 2. Alexandrescu, D., Altun, M., Anghel, L., Bernasconi, A., Ciriani, V., Frontini, L., Tahoori, M.B.: Logic synthesis and testing techniques for switching nano-crossbar arrays. Microprocess. Microsyst. Embed. Hardw. Des. 54, 14–25 (2017) 3. Altun, M., Riedel, M.D.: Lattice-based computation of Boolean functions. In: Proceedings of the 47th Design Automation Conference, DAC 2010, Anaheim, CA, July 13–18, pp. 609–612 (2010)

174

A. Bernasconi et al.

4. Altun, M., Riedel, M.D.: Logic synthesis for switching lattices. IEEE Trans. Comput. 61(11), 1588–1600 (2012) 5. Altun, M., Ciriani, V., Tahoori, M.B.: Computing with nano-crossbar arrays: logic synthesis and fault tolerance. In: Design, Automation & Test in Europe Conference & Exhibition, DATE 2017, Lausanne, March 27–31, 2017, pp. 278–281 (2017) 6. Asahiro, Y., Miyano, E., Ono, H., Zenmyo, K.: Graph orientation algorithms to minimize the maximum outdegree. Int. J. Found. Comput. Sci. 18(2) 197–215 (2010) 7. Barbuti, R., Gori, R., Milazzo, P.: Multiset patterns and their application to dynamic causalities in membrane systems. In: Membrane Computing - 18th International Conference, CMC 2017, Bradford, July 25–28, 2017. Revised Selected Papers, pp. 54–73 8. Barbuti, R., Bernasconi, A., Gori, R., Milazzo, P.: Computing preimages and ancestors in reaction systems. In: Theory and Practice of Natural Computing - 7th International Conference, TPNC 2018, Dublin, December 12–14, 2018, Proceedings, pp. 23–35 9. Barbuti, R., Gori, R., Milazzo, P.: Predictors for flat membrane systems. Theor. Comput. Sci. 736, 79–102 (2018) 10. Bernasconi, A., Ciriani, V.: DRedSOP: synthesis of a new class of regular functions. In: Euromicro Conference on Digital Systems Design (DSD), pp. 377–384 (2006) 11. Bernasconi, A., Ciriani, V.: Logic synthesis and testability of d-reducible functions. In: VLSISoC, pp. 280–285 (2010) 12. Bernasconi, A., Ciriani, V.: Dimension-reducible Boolean functions based on affine spaces. ACM Trans. Des. Autom. Electron. Syst. 16(2), 13 (2011) 13. Bernasconi, A., Ciriani, V., Luccio, F., Pagli, L.: Exploiting regularities for Boolean function synthesis. Theory Comput. Syst. 39(4), 485–501 (2006) 14. Bernasconi, A., Ciriani, V., Luccio, F., Pagli, L.: Synthesis of autosymmetric functions in a new three-level form. Theory Comput. Syst. 42(4), 450–464 (2008) 15. Bernasconi, A., Ciriani, V., Trucco, G., Villa, T.: Logic synthesis by signal-driven decomposition. In: Gulati, K. (ed.) Advanced Techniques in Logic Synthesis, Optimizations and Applications, pp. 9–29. Springer, New York (2011) 16. Bernasconi, A., Ciriani, V., Liberali, V., Trucco, G., Villa, T.: Synthesis of p-circuits for logic restructuring. Integration 45(3), 282–293 (2012) 17. Bernasconi, A., Ciriani, V., Trucco, G., Villa, T.: Using flexibility in P-circuits by Boolean relations. IEEE Trans. Comput. 64(12), 3605–3618 (2015) 18. Bernasconi, A., Ciriani, V., Frontini, L., Liberali, V., Trucco, G., Villa, T.: Logic synthesis for switching lattices by decomposition with p-circuits. In: 2016 Euromicro Conference on Digital System Design, DSD 2016, Limassol, August 31–September 2, 2016, pp. 423–430 19. Bernasconi, A., Ciriani, V., Frontini, L., Trucco, G.: Synthesis on switching lattices of dimension-reducible Boolean functions. In: IFIP/IEEE International Conference on Very Large Scale Integration (VLSI-SoC) (2016) 20. Bernasconi, A., Ciriani, V., Frontini, L., Trucco, G.: Composition of switching lattices and autosymmetric Boolean function synthesis. In: Euromicro Conference on Digital System Design, DSD 2017, Vienna, August 30–September 1, 2017, pp. 137–144 21. Bernasconi, A., Boffa, A., Luccio, F., Pagli, L.: Two combinatorial problems on the layout of switching lattices. In: IFIP/IEEE International Conference on Very Large Scale Integration (VLSI-SoC) (2018) 22. Bernasconi, A., Ciriani, V., Frontini, L.: Testability of switching lattices in the stuck at fault model. In: IFIP/IEEE International Conference on Very Large Scale Integration (VLSI-SoC) (2018) 23. Bernasconi, A., Ciriani, V., Frontini, L., Liberali, V., Trucco, G., Villa, T.: Enhancing logic synthesis of switching lattices by generalized Shannon decomposition methods. Microprocess. Microsyst. Embed. Hardw. Des. 56, 193–203 (2018) 24. Bernasconi, A., Ciriani, V., Frontini, L., Trucco, G.: Composition of switching lattices for regular and for decomposed functions. Microprocess. Microsyst. Embed. Hardw. Des. 60, 207– 218 (2018)

7 Literal Selection in Switching Lattice Design

175

25. Cheng, T.C.E., Sin, C.C.S.: A state-of-the-art review of parallel machine scheduling research. Eur. J. Oper. Res. (47), 271–292 (1990) 26. Gange, G., Søndergaard, H., Stuckey, P.J.: Synthesizing optimal switching lattices. ACM Trans. Des. Autom. Electron. Syst. 20(1), 6:1–6:14 (2014) 27. Harvey, N.J., Ladner, R.E., Lovász, L., Tamir, T.: Semi-matchings for bipartite graphs and load balancing. J. Algorithm. 59(1), 53–78 (2006) 28. Lin, Y., Li, W.: Parallel machine scheduling of machine-dependent jobs with unit-length. Eur. J. Oper. Res. 156(1), 261–266 (2004) 29. Luccio, F., Xia, M.: The MPA graph problem. Department of Informatics, University of Pisa. Technical Report (2018) 30. Mokotoff, E.: Parallel machine scheduling problems: a survey. Asia-Pacific J. Oper. Res. 18(2), 193–242 (2001) 31. Morgul, M.C., Altun, M.: Synthesis and optimization of switching nanoarrays. In: 2015 IEEE International Symposium on Design and Diagnostics of Electronic Circuits and Systems (DDECS), pp. 161–164. IEEE, Piscataway (2015) 32. Tunali, O., Altun, M.: Permanent and transient fault tolerance for reconfigurable nano-crossbar arrays. IEEE Trans. CAD Integr. Circuits Syst. 36(5), 747–760 (2017) 33. Tunali, O., Altun, M.: A survey of fault-tolerance algorithms for reconfigurable nano-crossbar arrays. ACM Comput. Surv. 50(6), 79:1–79:35 (2017) 34. Tunali, O., Altun, M.: Logic synthesis and defect tolerance for memristive crossbar arrays. In: 2018 Design, Automation & Test in Europe Conference & Exhibition, DATE 2018, Dresden, March 19–23, 2018, pp. 425–430 35. Yang, S.: Logic Synthesis and Optimization Benchmarks User Guide Version 3.0. User Guide, Microelectronic Center (1991)

Chapter 8

Exact Synthesis of ESOP Forms Heinz Riener, Rüdiger Ehlers, Bruno de O. Schmitt, and Giovanni De Micheli

8.1 Introduction In the design of Very Large-Scale Integration (VLSI) systems, two-level logic representations are classically used to represent and manipulate Boolean functions. Exclusive-or Sum-of-Products (ESOP) is a two-level normal form representation of a Boolean function that consists of one level of multi-input AND gates followed on the next level by one multi-input XOR gate. ESOP forms play an important role in logic synthesis due to their improved compactness for arithmetic or communication circuits with respect to other two-level representations [26] and their excellent testability properties [13]. The inherent reversibility of the XOR operation, moreover, makes ESOP forms particularly suitable in applications such as security [16, 21] or quantum computation [8]. The ESOP representation of a Boolean function is not unique, i.e., the same Boolean function can be expressed as multiple structurally different, but semantically equivalent ESOP forms. In practice, it is important to find a small representation of an ESOP form to reduce the overall costs for realizing it in hardware or implementing it in software. The problem of synthesizing an ESOP form for a given Boolean function is to identify a set of product terms over the Boolean variables of the function such that each minterm in the OFF-set of the function is covered by the product terms an even number of times and each minterm in the ON-set of the Boolean function is covered an odd number of times.

H. Riener () · B. d. O. Schmitt · G. De Micheli EPFL, Lausanne, Switzerland e-mail: [email protected] R. Ehlers University of Bremen, Bremen, Germany © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_8

177

178

H. Riener et al.

Finding ESOP forms with a small or a minimal number of product terms is hard and numerous exact and heuristic synthesis methods [11, 19, 22, 23, 25, 30] for solving this problem have been proposed. Heuristic methods focus on finding small (but not necessarily minimal) ESOP forms; they are fast, but only examine a subset of the possible search space. Heuristic methods, e.g., the Exorcism approach [19], usually operate in two phases. In the first phase, an ESOP form with a suboptimal number of product terms is derived from the Boolean function, e.g., by translating each minterm of the Boolean function into one product term or translating the function into special cases of ESOP forms such as Pseudo-Kronecker Expressions [6]. In the second phase, the ESOP form is iteratively optimized and reshaped using cube transformations with the overall goal of merging as many product terms as possible. The cube transformations are applied to each pair of product terms that potentially lead to merging them or with other product terms of the ESOP form. The second phase terminates when, after several iterations, no further size reduction is achieved. Heuristic methods produce small ESOP forms in reasonable time, but suffer from local minima that cannot easily be escaped. In contrast, exact methods find an “exact” ESOP form, i.e., an ESOP form with a minimal number of product terms, but either require to store large tables of precomputed information [22, 25] or suffer from long runtimes [23]. For instance, the tabular-based methods described by Gaidukov [11] or Papakonstantinou [22] require pre-computed tables of all exact ESOP forms for Boolean functions over n − 1 Boolean variables to derive an exact ESOP form for a Boolean function over n Boolean variables. Due to the exponential growth of the number of Boolean functions in the number of Boolean variables, these methods become too time and memory consuming when n > 6. Alternative exact synthesis approaches such as a recent formulation of the ESOP synthesis problem using non-linear programming [23] can take several minutes for synthesizing a single exact ESOP form. Until today, a large gap between the number of product terms optimized with heuristic methods and exact methods remains. Where exact methods hardly can deal with more than 8 Boolean variables and a few product terms, heuristic methods nowadays, e.g., in the quantum domain, have to deal with the optimization of ESOP forms with 105 or 106 products terms over 16 and more Boolean variables [27]. Our experiments with large-scale ESOP forms showed that heuristic optimization method can often achieve a reduction of 50−80% in the number of ESOP terms with respect to the size of the initial ESOP form. Due to the large combinational search space of the ESOP synthesis problem, lower bounds on the number of required product terms are only known for Boolean functions with a few Boolean variables, such that the capabilities of ESOP optimization techniques remain unclear. In this paper, we investigate the exact synthesis of ESOP forms using Boolean satisfiability (SAT). SAT-based approaches are very successful on a variety of different verification and synthesis problems. We present an exact synthesis approach for computing ESOP forms with a minimal number of product terms. Starting from a specification in form of a possibly incompletely specified Boolean function, our approach iteratively constructs a Boolean constraint satisfaction problem that is

8 Exact Synthesis of ESOP Forms

179

satisfiable if and only if an ESOP form with k (initially k = 1) product terms that implements the specification exists. The problem is then solved utilizing a SATsolver and, if satisfiable, an ESOP form with k product terms is returned. Otherwise, if unsatisfiable, k is increased and the synthesis process is restarted. The synthesis approach is hardly affected by the number of Boolean variables and particularly fast if the Boolean function can be expressed by using only a few product terms. We argue that such a SAT-based exact synthesis procedure can be a backbone of a new generation of heuristic ESOP optimization methods that, instead of relying on cube transformations applied to a pair of product terms, are capable of optimizing small subsets (windows) of product terms. The proposed approach is the first ESOP synthesis technique based on Boolean satisfiability. We further present a relaxation of the technique to compute ESOP forms with size close to minimal leveraging the SAT-solver’s conflict limit. We have implemented SAT-based exact synthesis for ESOPs and the relaxation of the approach using an off-the-shelf SAT-solver and show in the experiments that SATbased ESOP synthesis can be readily used to synthesize ESOP forms with up to 8 Boolean variables and up to 100 terms. As benchmarks, we use completely specified Boolean functions that are used as representatives of the NPN4 equivalence classes [12] as well as completely specified Boolean functions that appeared in technology mapping using look-up tables (LUTs) with at most 8 inputs (8-LUT mapping). Moreover, we use a set of randomly generated incompletely specified Boolean functions with up to 8 Boolean variables.

8.2 Background Exclusive-or Sum-of-Products (ESOP) Let B = {0, 1} and B3 = {0, 1, −} with the third element “−” which denotes don’t care. An ESOP form in n Boolean variables x1 , . . . , xn is a Boolean expression  n k ! " j =1

 l xi i,j

,

(8.1)

i=1

where the operators ⊕ and ∧ denote standard addition (XOR) and multiplication (AND) in the Galois field with two-elements, respectively, each li,j ∈ B3 is a constant and each expression

l

xi i,j =

⎧ ⎪ ⎪ ⎨x¯i , if li,j = 0

xi , if li,j = 1 ⎪ ⎪ ⎩1, if l = − i,j

(8.2)

180

H. Riener et al.

for 1 ≤ i ≤ n and 1 ≤ j ≤ k. We say that k is the size of the ESOP form and call l l each conjunction x11,j · · · xnn,j , 1 ≤ j ≤ k, that appears in the ESOP form a product term. The Boolean expression in (8.1) is often compactly notated as a list of words l1,1 · · · ln,1

l1,2 · · · ln,2

...

l1,k · · · ln,k ,

(8.3)

where each word l1,j · · · ln,j is of fixed length n. Distance of Product Terms Suppose that l

l

u = x11,p · · · xnn,p

and

l

l

v = x11,q · · · xnn,q

(8.4)

are two product terms in n Boolean variables. We define the distance d(u, v) of u and v as the number of different li,j for 1 ≤ i ≤ n and j ∈ {p, q}, i.e., d(u, v) =

n 

[li,p = li,q ],

(8.5)

i=1

where [.] denote the Iverson brackets. We say if d(u, v) = m, then u and v have distance m or are m-distant. ESOPs Describing Boolean Functions An ESOP form semantically describes a (single-output) Boolean function f : Bn → B, which maps assignments of the Boolean variables x1 , . . . , xn ∈ B to truth values f (x1 , . . . , xn ) ∈ B. Each assignment to all Boolean variables  x1 , . . . , xn is called a minterm and can be interpreted as the decimal number ni=1 xi 2i−1 when read as (xn · · · x1 )2 . A completely specified Boolean function f : Bn → B over n Boolean variables can be uniquely represented as a truth table, i.e., a word b2n S · · · b1 of length 2n , where bj = f (j − 1) for 1 ≤ j ≤ 2n . An incompletely specified Boolean function g : Bn → B3 can be represented by two completely specified Boolean functions f : Bn → B and c : Bn → B, where f (x) = [g(x) = 1] and c(x) = [g(x) = −]. We call c the care function of g. Two ESOP forms are semantically equivalent if they describe the same Boolean function. An ESOP form with size k is minimal if and only if no semantically equivalent ESOP form with fewer product terms exists. Minimal ESOP forms are in general not unique.

8.3 SAT-Based Exact ESOP Synthesis 8.3.1 Exact Synthesis of ESOP Forms Objective We aim for synthesizing minimal ESOP forms in n Boolean variables when a completely specified Boolean function or incompletely specified Boolean

8 Exact Synthesis of ESOP Forms

181

function is provided as specification. In case of completely specified Boolean functions, this objective can be formally described as follows: given a single-output Boolean function f : Bn → B over n Boolean variables x1 , . . . , xn , find an integer k and constants li,j ∈ B3 for 1 ≤ i ≤ n and 1 ≤ j ≤ k such that  n k ! " j =1

 l xi i,j

= f (x1 , . . . , xn ) for all x1 , . . . , xn ∈ Bn

(8.6)

i=1

and k is minimal. The case of incompletely specified Boolean functions can be addressed similarly to (8.6). Example 8.1 As an introductory example, consider the incompletely specified Boolean function described by the truth table 0x688C8020282222221 over 6 Boolean variables with care function 0x6AAEFF3FFEBFEAA6. A minimal ESOP form, for instance, is x¯1 x3 x¯4 x¯5 x6 ⊕ x¯1 x2 x¯3 x5 x¯6 ⊕ x¯1 x¯3 x¯4 x¯6 ⊕ x¯2 x¯5 x¯6 ⊕ x¯1 x2 x6 ,

(8.7)

which requires 5 product terms and can be equivalently written as 0-1001

0-00-0 -0--00 010-10

01---1.

(8.8)

In general, minimal ESOPs are not unique. The same Boolean function may also be represented as the ESOP form 0-1001 0100-0

-0--00 0-0-10 01---1

(8.9)

or 0-1001 0-00-0 ----00 011-10

01----.

(8.10)

Finding minimal ESOP forms is, due to the large combinational search space, a challenging problem. In [23], a minimal ESOP form for the Boolean function in the previous example was found on average in roughly 668.22 s using integer non-linear programming using different starting points and Matlab as a solving engine. The authors, moreover, point out that decomposition-based ESOP synthesis approaches, e.g., [25], require up to 4 h for synthesizing minimal ESOP forms for incompletely specified Boolean functions over 6 Boolean variables.

1 We

use hexadecimal notation to shorten the string representation of the (binary) truth tables of Boolean functions.

182

H. Riener et al.

8.3.2 SAT-Based Exact Synthesis Procedure In this section, we propose a SAT-based exact synthesis approach for ESOP forms. The approach is based on ideas from Knuth [15] (originally proposed by Kamath et al. [14]) and our previous work on learning two-level patches to correct combinational Boolean circuits [24]. Our approach synthesizes an ESOP form for the Boolean function in Example 8.1 in less than a second. We formalize the search problem as a series of Boolean constraint satisfaction problems—one for each possible ESOP size k (starting with k = 1) and employ a decision procedure for Boolean satisfiability to decide the satisfiability of the constraints. The constraints are constructed in such a way that they are satisfiable if and only if an ESOP form with k product terms exists and each satisfying assignment corresponds to an ESOP form with k product terms. If the constraints are unsatisfiable, then no ESOP form restricted to k product terms, that is equivalent to the provided Boolean function, exists. By systematically solving the constraint satisfaction problem for increasing values of the size parameter k, a minimal ESOP form is guaranteed to be found. Formulation of the Constraint Satisfaction Problem Suppose that f : Bn3 → B is a (single-output) Boolean function over n Boolean variables. We formulate the problem of finding an ESOP form equivalent to f with k product terms as a constraint satisfaction problem in propositional logic using 2nk Boolean variables, p = p1,1 , . . . , pk,n and q = q1,1 , . . . , qk,n , where n is the number of Boolean variables of f , k is the size of the ESOP form, and pj,l = [xl in product term j ]

qj,l = [x¯l in product term j ]

and

(8.11)

for 1 ≤ j ≤ k and 1 ≤ l ≤ n. For each assignment x1 · · · xn ∈ Bn3 of the Boolean function f with the corresponding output value f (x1 , . . . , xn ) = b, we introduce k auxiliary Boolean variables z = z1 , . . . , zk and add k · n + k clauses n k " " # $ z¯ j ∨ ITE(xi , q¯j,l , p¯ j,l )

and

j =1 l=1

k "



j =1

zj ∨

n

 ITE(xi , qj,l , pj,l ) ,

l=1

(8.12) which ensure that if and only if zj = 1, then the j -th product term evaluates to 1 for assignment x1 · · · xn . The if-then-else-operator is defined as

ITE(xi , vj,l , uj,l ) =

⎧ ⎪ ⎪ ⎨vj,l , uj,l , ⎪ ⎪ ⎩f alse,

if xi = 1 if xi = 0 otherwise

(8.13)

8 Exact Synthesis of ESOP Forms

183

with vj,l ∈ {qj,l , q¯j,l } and uj,l ∈ {pj,l , p¯ j,l }, respectively. One additional XORconstraint ⎞ ⎛ k ! ⎝ zj ⎠ = b (8.14) j =1

per assignment guarantees that an odd number of zj s evaluates to 1 if b = 1 and an even number if b = 0. This constraint satisfaction problem is satisfiable if and only if an ESOP form of size k exists and each satisfying assignment pˆ 1,1 , . . . , pˆ k,n and qˆ1,1 , . . . , qˆk,n corresponds to one possible implementation. Translating XOR-Constraints to CNF All XOR-constraints in the constraint satisfaction problem are, by construction, formulated over disjoint sets of Boolean variables such that techniques like Gaussian elimination are not effective. Instead, we translate each XOR-constraint first into an equivalent XOR-clause by flipping one of the Boolean variables if and only if b = 0, i.e.,  (z1 ⊕ · · · ⊕ zk ) = b

=⇒

z1 ⊕ · · · ⊕ zk , if b = 1 z1 ⊕ · · · ⊕ z¯ k , if b = 0.

(8.15)

Then, we select two literals la , lb from the XOR-clause and apply the Tseitin transformation to generate four clauses (¯za ∨ z¯ b ∨ u), ¯ (za ∨ zb ∨ u), ¯ (za ∨ z¯ b ∨ u), (¯za ∨ zb ∨ u) with the newly introduced Boolean variable u and repeat this process until only one literal is left which is added as a unit clause. SAT-Based Exact ESOP Synthesis The overall exact synthesis procedure is sketched in Algorithm 3. The function MakeCSP constructs the constraint satisfaction problem ϕ in the Boolean variables p, q, z for a given Boolean function f and size parameter k as described above. The function SAT refers to the invocation of a decision procedure for the Boolean satisfiability problem, usually called a SAT-solver, and is assumed to decide the satisfiability of ϕ and, if satisfiable, to also provide a satisfying assignment pˆ and qˆ for variables p and q. The

Algorithm 3 SAT-based exact ESOP synthesis input : a (possibly incompletely-specified) Boolean function f output: a minimal ESOP functionally equivalent to f for k ← 1, 2, . . . do ϕ(p, q, z) ← MakeCSP(k,f ); if p, ˆ qˆ |= SAT(∃z : ϕ(p, q, z)) then return MakeESOP(p, ˆ q); ˆ end end

184

H. Riener et al.

Algorithm 4 SAT-based exact synthesis guided by counterexamples input : a (possibly incompletely-specified) Boolean function f output: a minimal ESOP r functionally equivalent to f r ← ; k ← 1; ϕ(p, q, z) ← true; while m ← NotEquivalent(f ,r) do ϕ ← AddConstraints(ϕ,m); if p, ˆ qˆ |= SAT(∃z : ϕ(p, q, z)) then r ← MakeESOP(p, ˆ q); ˆ else r ← ; k ← k + 1; ϕ(p, q, z) ← true; end end return r;

assignment to the intermediate Boolean variables z is for the construction of no further interest and not returned. Finally, the function MakeESOP constructs an ESOP form from the assignment pˆ and qˆ according to the rules described in (8.11). Note that Algorithm 3 always terminates, but may run out of resources (memory or time) if the minimal ESOP requires many product terms. Thus in practice usually an additional termination criterion in form of an upper bound for the size parameter k or maximum number of conflicts examined by the SAT-solver is provided. Counterexample-Guided Abstraction-Refinement Algorithm 3 synthesizes an ESOP form in one step. Alternatively, counterexample-guided abstractionrefinement can be employed as shown in Algorithm 4. The idea of the abstraction-refinement loop is to iteratively update a candidate ESOP form r (starting from the empty ESOP form ) until it eventually becomes semantically equivalent to the Boolean function f to be synthesized. In each iteration, the constraints of one assignment x = x1 · · · xn for which r and f evaluate differently (r(x) = f (x)) are added (AddConstraints) to the constraint satisfaction problem and r is resynthesized. If ϕ becomes unsatisfiable, then the constraints cannot be solved within the current restriction to k product terms and k needs to be relaxed. If f and r are equivalent, i.e., no counterexample x = x1 · · · xn is found by NotEquivalent, then r is returned as an ESOP form semantically equivalent to f . The main advantage of Algorithms 4 over 3 lies in its ability to abstract from unnecessary constraints which keeps the constraint satisfaction problem as small as possible. The algorithm is fast mainly because modern backtrack searchbased SAT-solvers support incremental solving [7] and are able to maintain learned information when new constraints are added to a satisfiability problem. The oracle NotEquivalent has to be capable of verifying whether a candidate ESOP form r is functionally equivalent to the Boolean function f . For Boolean functions with up to 16 Boolean variables, simulation using explicit representations such as truth

8 Exact Synthesis of ESOP Forms

185

tables can be done very quickly. For Boolean functions with more than 16 Boolean variables, a BDD- or SAT-based procedure can be employed.

8.3.3 Extensions and Variations Downward vs. Upward Search Algorithm 4 describes an upward search procedure to find a minimal ESOP form starting with 1 term. This approach can be easily modified into a downward search by starting from a maximum number of terms kˆ and iteratively decreasing the number of terms by 1 as long as the constraint system is satisfiable. If the constraint system becomes unsatisfiable for a certain number k of terms, the previous k + 1 terms correspond to a minimal ESOP form. In practice downward and upward search procedures are useful. An upward search procedure is fast if the expected minimal k is small. Otherwise, proving unsatisfiability with a SAT-solver becomes too time consuming. A downward search procedure is fast if ˆ the expected minimal k is close to the initially provided term limit k. Conflict Limit For a SAT-solver proving unsatisfiability of a set of constraints, i.e., showing that no assignment exists that satisfies the constraints, often requires labor-intensive analysis. If the search space is sufficiently large, these proofs are often not completed within reasonable time. Most modern SAT-solver provides a conflict limit to allow a user to specify a maximum number of possible solving attempts. If the SAT-solver is unable to find a satisfying assignment within the given conflict limit, the solver reports “unknown” as solution. In this case, the synthesis algorithm can choose to increase or decrease the current k, hoping that the next k is easier to solve because the corresponding constraint system is less or more constrained, respectively. When a conflict limit is employed in Algorithm 4, due to the possible “unknown” solutions, a minimal ESOP form may not be found. However, in case of a downward search, which systematically decreases k, an intermediate “unknown” solution for k1 can be safely ignored if the constraint system is later proved satisfiable for k2 < k1 , whereas in case of an upward search, an intermediate “unknown” solution for k1 can be ignored if the constraint system is proved unsatisfiable for a later k2 > k1 .

8.4 ESOP Synthesis for Quantum Computation ESOP-based logic synthesis and optimization techniques have recently attracted interest due to their application for quantum computing, where ESOP forms are used as an intermediate representation to map Boolean functions into quantum circuits [20]. The appeal of the idea stems from the fact that, in contrast to other mapping approaches, ESOP-based synthesis does not introduce additional garbage

186

H. Riener et al. ESOP form

Boolean function ESOP synthesis

Reversible logic. synthesis

Reverisble circuit

Mapping (Cliff.+T)

Quantum circuit

Fig. 8.1 ESOP-based synthesis flow from a Boolean function to a quantum circuit

outputs (often called ancillæ) and, consequently, can be realized with fewer qubits— a highly critical resource on today’s quantum computers. In this section, we survey ESOP-based synthesis for quantum circuits. We describe how an ESOP form can be mapped to a quantum circuit and show by example that optimizing ESOP forms has a positive effect on the cost functions for realizing them. Reversible Logic Synthesis for Quantum Computing Figure 8.1 illustrates an ESOP-based synthesis flow that stepwisely transforms a Boolean function into a quantum circuit leveraging ESOP forms and reversible logic circuits as intermediate representations. The so-called ESOP-based reversible logic synthesis [20] has proven effective while keeping the number of extra qubits required for transforming the ESOP form as low as possible. In fact, for translating an ESOP form with n Boolean variables, we present a construction that requires at most n + 2 qubits. We describe reversible logic circuits in terms of reversible gates using a formalism introduced by Toffoli and Fredkin [10]. Given a fixed set X = x1 , . . . , xn of Boolean variables, a (mixed-polarity multiple-controlled) Toffoli gate is a pair (C, xt ) of control lines C ⊂ {x, x¯ | x ∈ X} and a target line xt ∈ X with {x, x} ¯ ⊂ C for all x ∈ X

and

{xt , x¯t } ∪ C = ∅.

(8.16)

Each Toffoli gate defines a bijective Boolean function g : Bn → Bn (x1 , . . . , xn ) &→ (x1 , . . . , xt−1 , xt ⊕ f (x1 , . . . , xn ), xt+1 , . . . , xn ),

(8.17)

with control function f : Bn−1 → B (x1 , . . . , xt−1 , xt+1 , . . . , xn ) &→

"

c.

(8.18)

c∈C

The reversible gate flips the Boolean value on the target line if the control function f evaluates to true for the values observed on the control lines. A reversible logic circuit is a cascade of Toffoli gates and the function defined by the reversible logic circuit is the composition function of the individual functions defined by its reversible gates. We use a graphical notation based on Feynman [9] to denote reversible circuits as diagrams. Figure 8.2 illustrates the graphical notation: on the top-left, the figure shows one reversible single-target gate with an arbitrary

8 Exact Synthesis of ESOP Forms

x1 .. . xt−1 xt+1 .. .

187

x1 .. . xt−1

f

xt+1 .. .

x1

x1

x2

x2

xn

xn

x3

x3

xt

xt ⊕ f (x1 , . . . , xt−1 , xt+1 , xn )

y

y ⊕ h(x1 , x2 , x3 )

(a)

(b)

x1

T†

x2

x1

T† T

x3 y

H

T

T

T†

T†

H

T†

H

T

T†

T

T† H

T

x2

T

x3 y⊕h

(c) Fig. 8.2 Graphical notation of reversible logic circuits and quantum circuits. (a) Toffoli gate. (b) Reversible circuit. (c) Quantum circuit

control function f ; on the top-right, a concrete example of a reversible circuit is given consisting of the cascade of the two Toffoli gates ({x1 , x¯2 }, x5 ) and ({x2 , x3 }, x5 ), where the composition function h(x1 , x2 , x3 ) = x1 x¯2 ⊕ x2 x3 of the two gates can be observed on line y. In this notation, the line with the ⊕ denotes the target line, whereas black and white dots denote positive and negative control lines, respectively. On the bottom, a quantum circuit is shown for the same example. We show this example for completeness, but will not discuss the graphical notation of quantum circuits (see, e.g., Soeken et al. [27] for details). Mapping ESOP forms into reversible circuits is straightforward. An ESOP form c1 ⊕· · ·⊕ck with k product terms and n Boolean variables is functionally equivalent to a reversible circuit with at most n + 2 lines and k Toffoli gates, where the control function of each gate is exactly one ci for 1 ≤ i ≤ k. Since each Toffoli gate is reversible, the concrete order of the Toffoli gates does not matter. Next, Toffoli gates are mapped into a quantum gate library [18]. In this paper, we focus on the universal fault-tolerant quantum gate library Clifford+T [17] and use the number of T -gates as cost function. This simple cost model is based on the assumption that T -gates are far more expensive to realize than all other gates in the Clifford+T library [1]. Based on concrete mappings for Toffoli gates with small number of control lines [18] and a decomposition schemata [3] for larger Toffoli gates, an overapproximation for the number of T -gates necessary to realize an ESOP form c1 ⊕ · · · ⊕ ck can be computed as T (c1 ⊕ · · · ⊕ ck ) =

k  i=1

Tcube (|ci |)

(8.19)

188

H. Riener et al.

with

Tcube (l) =

⎧ ⎪ 0, ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨7, 16, ⎪ ⎪ ⎪ ⎪ 8(l − 1), ⎪ ⎪ ⎪ ⎩ 16(l − 1),

l≤1 l=2 l=3 l >3∧n≥

(8.20) 3l+1 2

else.

8.5 Experimental Evaluation We have implemented Algorithm 4 in easy, an open-source toolkit for manipulating ESOP forms2 using the prominent state-of-the-art SAT-solver Glucose 4.1 [2] as decision procedure for Boolean satisfiability. We have evaluated the SAT-based synthesis approach in four experiments3 : 1. NPN4: We synthesized all ESOP forms of minimal size for the representatives of the NPN4 equivalence class. 2. LUT mapping: We synthesized one ESOP form of fixed-size and one of minimal size for each of the Boolean functions that occurred during LUT mapping of Boolean networks. 3. Random: We synthesized one ESOP form of fixed-size and one of minimal size for randomly generated Boolean functions. 4. Reversible logic synthesis: We generate Pseudo-Kronecker Expressions (PKRMs)—a special case of ESOPs—and ESOP using our exact method and analyze the effect of ESOP size minimization on the size of the corresponding quantum circuits. For evaluation, we use the T -metric presented in Sect. 8.4. All experiments have been conducted on an Intel® Core™ i7-7567U CPU @ 3.50 GHz with 16 GB RAM. Correctness All computed ESOP forms have been verified against their specifications, i.e., we simulated all ESOP forms for all possible values and compared the results of simulation with the initial truth tables of the provided Boolean functions. Note that it is not possible to verify the minimality of the ESOP forms. NPN4 We synthesized all ESOP forms of minimum size for all 222 representatives of the NPN4 equivalence classes [12]. Computing one minimal ESOP form for each representatives takes 1.6 s, computing all minimal ESOP forms for each representatives takes 9.2 s. Figure 8.3 shows the histogram of the size of the minimal

2 Easy,

https://github.com/hriener/easy. benchmarks and a detailed evaluation of the synthesis results can be found at https://hriener. github.io/misc/2018_easy.html. 3 The

8 Exact Synthesis of ESOP Forms

189

Minimal size of ESOP

Number of ESOPs per function

100

80

100

60

40

50

20

0 0

1

2

3

4

5

0 0

50

100

150

Fig. 8.3 Synthesis of minimal ESOP forms for NPN4

Fig. 8.4 Karnaugh map of 0x166A

ESOP forms for the representatives (on the left) and the number of ESOP forms of minimal size per representative (on the right). On average a representative has 12 structurally different minimal ESOP forms. Some representatives can have 100 or more ESOP forms of minimal size. The Boolean function 0x166A (shown in Fig. 8.4) has the most minimal ESOP forms (in total 126) within the NPN4 classes. LUT Mapping We synthesized one ESOP form for a fixed number of ESOP terms and one ESOP form of minimal size using downward and upward search, respectively, for each Boolean function that occurred in LUT mapping of the EPFL benchmark suite. For LUT mapping, we used the ABC command if -K 8 [4]. After LUT mapping, we applied exactmine [28] to extract all Boolean functions from the benchmarks. We obtained 4001 different Boolean functions with up to 8 Boolean variables and used SAT-based ESOP synthesis to compute ESOP forms. For this experiment, we consider a fixed conflict limit of 10,000. The synthesis results are presented in Table 8.1: the first column (Terms) is a user-specified upper limit on the number of terms. The rest of the table is organized in three

190

H. Riener et al.

Table 8.1 Synthesis of ESOP forms for LUT mapping Terms 8 16 32

Fixed-size R C 3735 266 3806 195 3966 35

k 5.19 7.10 8.45

T 49.65 s 50.56 s 42.67s

Downward search R C k T 3854 147 3.60 300.44 s 3965 36 3.82 695.08 s 4001 0 3.94 1430.41s

Upward search R C k 3857 3854 3.60 3965 36 3.82 4001 0 3.94

T 248.07 s 338.72 s 355.49 s

105

104

103

102

101

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

Fig. 8.5 SAT-solver results for different k for 0xF550311031100000

parts. The first part (fixed-size) is dedicated to synthesis of an ESOP form for the given term limit (without minimizing the number of terms). In this case, the SAT-solver’s heuristics decides whether unnecessary terms are canceled or kept. The second part (downward search) is dedicated to a synthesis procedure that iteratively synthesizes ESOP forms starting from the upper term limit and decreases the number of terms until the constraint system becomes unsatisfiable (as described in Algorithm 4). The satisfying assignment with the smallest number of terms is used for deriving an ESOP form. The last part (upward search) is similar to the second part, but starts with 1 term and increases the number if the constraint system is unsatisfiable. The satisfying assignment with the largest number of terms is used to derive an ESOP form. For each part, we list the number of Boolean functions successfully realized (R), the number of Boolean functions that could not be synthesized because the SAT-solver’s conflict limit (C) was exceeded, the average number of terms (k) for all realizable Boolean functions, and the total runtime (T) for synthesizing all Boolean functions. The runtime includes the time for synthesizing the realizable Boolean function and the time spent in unsuccessful synthesis attempts. Example 8.2 We illustrate the effect of the conflict limit on upward and downward search with a simple example. Consider the completely specified Boolean function 0xF550311031100000. We attempt to synthesize an ESOP form of minimal size with at most 16 terms and a conflict limit of 10,000 using the upward and downward search procedures, respectively. Figure 8.5 shows the number of conflicts explored by the SAT-solver in logarithmic scale parameterized by the number of

8 Exact Synthesis of ESOP Forms

191

terms (k). The colors encode the decision results: green denotes satisfiable, blue denotes unsatisfiable, and gray denotes unknown. For those k for which the conflict limit of 10,000 was reached, we repeated synthesis with a much higher conflict limit of 500,000 to understand what conflict limit would allow us to conclude the correct result. The results for k = 7 and k = 8, however, remain unknown, i.e., we do not know whether the constraints are satisfiable, because the conflict limit of 500,000 was also exceeded. The downward search starts with 16 terms and systematically decreases the number of terms. During the search, the conflict limit is reached with k = 13 for the first; the search procedure interprets this as potentially satisfiable, such that the procedure proceeds until finally k = 4 is reached. For k = 4, the procedure concludes unsatisfiability, terminates, and returns the smallest constructed ESOP form with 9 terms determined during the search process. The upward search procedure solves the constraint system with increasing number of terms starting with 1. For k ≤ 4, the SAT-solver proves unsatisfiability of the constraint system. For 5 ≤ k ≤ 8, the SAT-solver reaches the conflict limit, which is interpreted as potentially unsatisfiable by our search procedure, such that the search proceeds until k = 9. For k = 9 terms, the constraint system becomes for the first time satisfiable and the corresponding ESOP form with 9 terms is returned. Random We synthesized ESOP forms for randomly generated, incompletely specified Boolean functions over 5, 6, 7, and 8 Boolean variables. Each bit in the Boolean function and its care function was chosen by flipping a fair coin. In total, we generated 100 Boolean functions for each number of Boolean variables. Table 8.2 summarizes the results for synthesizing ESOP forms. The first two columns list the number of Boolean variables (Var.) and a fixed bound on the number of terms (Terms). The rest of the table is organized as Table 8.1. Due to the symmetric design of downward and upward search, they reached exactly the same minimal ESOP forms. Overall downward search is slower due to the fact that unsatisfiability is typically harder to prove and can only be concluded by the SAT-solver for sufficiently small k. Consequently, the downward search procedure on average analyzes many more cases before unsatisfiability is reached. In contrast, upward search keeps searching until satisfiability is reached for the first time, which can occur early in the search process.

Table 8.2 Synthesis of ESOP forms for randomly generated Boolean functions Var. 5 6 7 8

Fixed-size Terms R C k T 16 100 0 8.58 0.11 s 16 99 1 11.32 0.42 s 32 86 14 24.91 3.71 s 96 79 21 54.35 19.64 s

Downward search R C k T 100 0 3.34 1.35 s 100 0 5.62 24.70 s 100 0 17.96 276.70 s 100 0 45.41 2156.96 s

Upward search R C k T 100 0 3.34 0.12 s 100 0 5.62 15.99 s 100 0 17.96 210.02 s 100 0 45.41 1151.75 s

192

H. Riener et al.

Table 8.3 Synthesis of ESOP forms for Boolean functions from DBS Benchmark 1 0x50455400 2 0x0880 3 0x00f07800 4 0x00070000 5 0x0007f000 7 0x0000ff80 8 0x06170360 9 0x4770ce38 9 0x6a0a4b6e 10 0x4727724a 

PKRM k 18 2 4 8 8 6 12 18 18 18 112

Time [s] 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

T -gates 355 64 78 174 165 151 188 298 339 335 2147

Exact k 4 2 3 2 3 2 5 6 6 7 40

Time [s] 0.01 0.02 0.11 0.01 0.01 0.01 0.03 0.28 0.25 0.33 1.06

T -gates 128 64 80 80 96 39 135 151 167 167 1107

Reversible Logic Synthesis We synthesized ESOP forms for Boolean functions obtained from decomposition-based synthesis (DBS), a recent approach to map permutations into quantum circuits [5, 29]. We extracted the Boolean functions from the DBS approach and synthesized for each Boolean function, a Pseudo-Kronecker Expressions (PKRM)—a special case of ESOP forms—using the approach proposed by Drechsler [6], and an exact ESOP form using our proposed method with downward search. Table 8.3 shows experimental results for 10 Boolean functions; each of them corresponds to one Toffoli gate in the quantum circuit. For both synthesis techniques, the table lists the number of product terms (k), the required runtime (Time), and the number of T -gates computed using Eq. (8.19). The example illustrates the positive effect of ESOP optimization for reducing the cost of realizing a quantum circuits. By using our exact ESOP synthesis method, the over-approximated number of T -gates could be reduced by 48.44%, while the additional runtime can be almost neglected.

8.6 Conclusion We have presented an exact synthesis approach for computing ESOP forms using Boolean satisfiability. The approach needs no pre-computed information, synthesizes one or multiple ESOP forms of minimal size, and can take completely specified or incompletely specified Boolean functions as specifications. We have implemented the approach using an off-the-shelf SAT-solver and have further presented a relaxation that leverages the SAT-solver’s conflict limit to find ESOP forms with almost minimal size. We have also presented evidence that the synthesis procedure can deal with small-scale ESOP forms with up to 8 Boolean variables and up to 100 terms. As benchmarks, we have used Boolean functions in the

8 Exact Synthesis of ESOP Forms

193

NPN4 equivalence class, Boolean functions that appeared during 8-LUT mapping, and randomly generated Boolean functions. Moreover, we show how the proposed techniques can be used to reduce the costs for implemented quantum circuits. We envision that the proposed SAT-based synthesis technique can be integrated with large-scale ESOP optimization procedures, e.g., by selecting windows of terms and resynthesizing them. Acknowledgements This research was supported by H2020-ERC-2014-ADG 669354 CyberCare (200021-146600) and the Institutional Strategy of the University of Bremen, funded by the German Excellence Initiative.

References 1. Amy, M., Maslov, D., Mosca, M., Roetteler, M.: A meet-in-the-middle algorithm for fast synthesis of depth-optimal quantum circuits. IEEE Trans. CAD Integr. Circuits Syst. 32(6), 818–830 (2013) 2. Audemard, G., Simon, L.: On the glucose SAT solver. Int. J. Artif. Intell. Tools 27(1), 1–25 (2018) 3. Barenco, A., Bennett, C.H., Cleve, R., Divincenzo, D.P., Margolus, N., Shor, P., Sleator, T., Smolin, J.A., Weinfurter, H.: Elementary gates for quantum computation. Phys. Rev. A: At. Mol. Opt. Phys. 52(5), 3457–3467 (1995) 4. Brayton, R.K., Mishchenko, A.: ABC: an academic industrial-strength verification tool. In: Proceedings of Computer Aided Verification, 22nd International Conference, CAV 2010, Edinburgh, July 15–19, 2010, pp. 24–40 5. De Vos, A., Van Rentergem, Y.: Young subgroups for reversible computers. Adv. Math. Commun. 2(2), 183–200 (2008) 6. Drechsler, R.: Preudo-Kronecker expressions for symmetric functions. IEEE Trans. Comput. 48(9), 987–990 (1999) 7. Eén, N., Sörensson, N.: An extensible SAT-solver. In: Theory and Applications of Satisfiability Testing, 6th International Conference, SAT 2003. Santa Margherita Ligure, Italy, May 5–8, 2003 Selected Revised Papers, pp. 502–518 8. Fazel, K., Thornton, M.A., Rice, J.E.: ESOP-based Toffoli gate cascade generation. In: Pacific Rim Conference on Communications, Computers and Signal Processing (2007) 9. Feynman, R.P.: Quantum mechanical computers. Opt. News 11, 11–20 (1985) 10. Fredkin, E., Toffoli, T.: Conservative logic. Int. J. Theor. Phys. 21(3–4), 219–253 (1982) 11. Gaidukov, A.: Algorithm to derive minimum ESOP for 6-variable function. In: International Workshop on Boolean Problems, pp. 141–148 (2002) 12. Goto, E., Takahasi, H.: Some theorems useful in threshold logic for enumerating Boolean functions. In: IFIP Congress, pp. 747–752 (1962) 13. Kalay, U., Hall, D.V., Perkowski, M.A.: A minimal universal test set for self-test of EXORsum-of-products circuits. IEEE Trans. Comput. 49(3), 267–276 (2000) 14. Kamath, A.P., Karmarkar, N., Ramakrishnan, K.G., and Resende, M.G.C.: A continuous approach to inductive inference. Math. Program. 57, 215–238 (1992) 15. Knuth, D.E.: The Art of Computer Programming, vol. 4. Fascicle 6: Satisfiability, 1st edn. Addison-Wesley Professional, Boston (2015) 16. Kolesnikov, V., Schneider, T.: Improved garbled circuit: free XOR gates and applications. In: Proceedings Automata, Languages and Programming, 35th International Colloquium, ICALP 2008, Reykjavik, July 7–11, 2008, pp. 486–498

194

H. Riener et al.

17. Linke, N.M., Maslov, D., Rötteler, M., Debnath, S., Figgatt, C., Landsman, K.A., Wright, K., Monroe, C.R.: Experimental comparison of two quantum computing architectures. Quant. Phys. Comput. Sci. Emer. Technol. (2017). abs/1702.01852 18. Maslov, D.: Advantages of using relative-phase Toffoli gates with an application to multiple control Toffoli optimization. Phys. Rev. A 93(2), 022311 (2016) 19. Mishchenko, A., Perkowski, M.A.: Fast heuristic minimization of exclusive-sums-of-products. In: Reed-Muller Workshop (2001) 20. Mishchenko, A., Perkowski, M.A.: Logic synthesis of reversible wave cascades. In: International Workshop on Logic Synthesis, pp. 197–202 (2002) 21. Mizuki, T., Otagiri, T., Sone, H.: An application of ESOP expressions to secure computations. J. Circuits Syst. Comput. 16(2), 191–198 (2007) 22. Papakonstantinou, G.K.: A parallel algorithm for minimizing ESOP expressions. J. Circuits Syst. Comput. 23(1), 1450015 (2014) 23. Papakonstantinou, K.G., Papakonstantinou, G.: A nonlinear integer programming approach for the minimization of Boolean expressions. J. Circuits Syst. Comput. 29(10), 1850163 (2018) 24. Riener, H., Ehlers, R., Fey, G.: CEGAR-based EF synthesis of Boolean functions with an application to circuit rectification. In: 22nd Asia and South Pacific Design Automation Conference, ASP-DAC 2017, Chiba, January 16–19, 2017, pp. 251–256 25. Sampson, M., Kalathas, M., Voudouris, D., Papakonstantinou, G.K.: Exact ESOP expressions for incompletely specified functions. Integration 45(2), 197–204 (2012) 26. Sasao, T., Fujita, M. (eds.): Representations of Logic Functions Using EXOR Operators, pp. 29–54. Springer, New York (1996) 27. Soeken, M., Roetteler, M., Wiebe, N., De Micheli, G.: Design automation and design space exploration for quantum computers. In: Design, Automation and Test in Europe, pp. 470–475 (2017) 28. Soeken, M., Riener, H., Haaswijk, W., De Micheli, G.: The EPFL logic synthesis libraries (2018). arXiv e-prints 1805.05121 29. Soeken, M., Mozafari, F., Schmitt, B., De Micheli, G.: Compiling permutations for superconducting QPUs. In: Design Automation Conference (2019) 30. Stergiou, S., Papakonstantinou, G.K.: Exact minimization of ESOP expressions with less than eight product terms. J. Circuits Syst. Comput. 13(1), 1–15 (2004)

Chapter 9

An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions D. Michael Miller and Mathias Soeken

9.1 Introduction The classification of Boolean functions has been a topic of interest for some time. Two Boolean functions are equivalent with respect to a particular class of translations if there is a sequence of translations that maps one function to the other. Function equivalence partitions the Boolean functions for a particular number of variables into equivalence classes. Such classes are of interest since, for example, if one has an inexpensive implementation for one function f in the class, knowing that and a sequence of translations to map g to f provides a potentially efficient implementation for g. Finding the least costly translation sequence affects the overall cost. NPN equivalence which allows for negation of inputs, permutation of inputs and negation of the function was considered in 1963 by Harrison [5]. NPN equivalence has been applied in technology mapping [19] and a variety of other applications in logic design. A Boolean function can be transformed to the Rademacher-Walsh spectral domain [7–9, 14, 19, 20]. Unlike the functional domain where the individual 2n function values provide local information, each of the 2n integer-valued spectral coefficients provide global information about the function. Two XOR-based spectral translations added to the NPN operations allow for the spectral classification of Boolean functions where the number of equivalence classes is far smaller than for NPN equivalence [3, 7–9]. In addition, by restricting the translations used, Boolean functions can be partitioned into linear or affine equivalence classes [6, 15]. D. M. Miller Department of Computer Science, University of Victoria, Victoria, BC, Canada M. Soeken () Integrated Systems Laboratory, EPFL, Lausanne, Switzerland e-mail: [email protected] © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_9

195

196

D. M. Miller and M. Soeken

In this chapter, we present a novel algorithm that transforms the spectrum of a function to the spectrum of the unique representative function for the equivalence class that contains the original function. The algorithm applies for linear, affine or spectral classification. We validate the algorithm by generating all linear, affine and spectral equivalence classes for 1 ≤ n ≤ 5 variables. For n < 4, this is done by an exhaustive examination of all Boolean functions. For n = 5, an exhaustive search is not feasible due to the number of functions. One approach which uses NPN class representative functions as the starting point generates all affine and spectral classes but only finds 98.6% of the linear classes. We also present an alternative approach based on function neighbourhood searching that finds all linear, affine and spectral classes for ≤ 5 much more efficiently than the exhaustive function and NPN examination approaches. Its one drawback is that it does not provide information on the sizes of the classes. For larger n, generating the equivalence classes is computationally very costly, although we anticipate future progress using the neighbourhood search method. Note that the transform algorithm presented here can be used for larger n to quickly determine if two functions fall within the same equivalence class and, if they do, to find the sequence of translations to map one to the other. Since linear, affine and spectral equivalence are XOR based, the presented algorithm has potential applications in cryptography [1, 2], reversible circuits [16], quantum computation [18] and arithmetic verification [11]. In [15], Sasao et al. presented autocorrelation and spectral-based techniques to determine if two functions are in the same affine equivalence class. The algorithm presented here is complementary to that work as it determines a sequence of translations to map between equivalent functions. Use of the techniques from [15] to improve the efficiency of our approach is left for future work.

9.2 Background 9.2.1 Spectra of Boolean Functions Definition 9.1 An n-input Boolean function f (x1 , x2 , . . . , xn ) is a mapping f : Bn → B, where B = {0, 1}. A Boolean function f can be represented by a ‘truth’ (column) vector, denoted F , with 2n entries. In this work, we use the so-called {1, −1} coding [8], where 1 denotes logic 0 and −1 denotes logic 1. For example, the majority function for 3 variables has ) *t F = 1 1 1 −1 1 −1 −1 −1

(9.1)

Note that column vectors are written as transposed row vectors for space considerations.

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

197

Definition 9.2 The Hadamard transform matrix [7] for a given n is defined by  Tn =

 ) * T n−1 T n−1 , T0 = 1 n−1 n−1 T −T

(9.2)

For example, for n = 3 ⎡ 1 1 1 1 1 1 ⎢1 −1 1 −1 1 −1 ⎢ ⎢1 1 −1 −1 1 1 ⎢ ⎢ ⎢1 −1 −1 1 1 −1 3 T =⎢ ⎢1 1 1 1 −1 −1 ⎢ ⎢1 −1 1 −1 −1 1 ⎢ ⎣1 1 −1 −1 −1 −1 1 −1 −1 1 −1 1

⎤ 1 1 1 −1⎥ ⎥ −1 −1⎥ ⎥ ⎥ −1 1⎥ ⎥ −1 −1⎥ ⎥ −1 1⎥ ⎥ 1 1⎦ 1 −1

Definition 9.3 The Rademacher-Walsh spectrum, in Hadamard order, of a Boolean function is given by S = T nF

(9.3)

For example, for F given in (9.1), the spectrum is ) *t S = 0 4 4 0 4 0 0 −4

(9.4)

It is readily verified that (T n )−1 = 21n T n . As a consequence we observe that the spectrum of a Boolean function is unique. We have presented the calculation of the spectrum as a matrix multiplication for clarity. In practice, fast transform techniques [8] are used and the computational complexity is O(n2n ). Given [1, −1] coding, each row of the transform matrix represents a function which is the XOR of a subset of the variables x1 , x2 , . . . , xn . Note that the top row denotes the constant 0 function, i.e. the XOR of no variables. The elements of S are for this reason identified by the variables involved in the corresponding XOR function where, as is standard notation, 0 denotes the empty set, i.e. no variables. For example, for n = 3 ) *t S = s0 s1 s2 s12 s3 s13 s23 s123

(9.5)

Each spectral coefficient can be seen to measure the correlation of f and the XOR function corresponding to the coefficient. A value of 2n indicates perfect correlation, i.e. f is the XOR function, whereas a value of −2n indicates perfect correlation to the inverse of the XOR function.

198

D. M. Miller and M. Soeken

The coefficients in (9.5) are in Hadamard order. In this work we use what is commonly called Rademacher-Walsh order [7] which groups the coefficients by the number of variables in the XOR function. For n = 3, this order is ) *t S = s0 |s1 s2 s3 |s12 s13 s23 |s123

(9.6)

As can be seen, the coefficients are ordered with the 0-order coefficient first, followed by the first-order, second-order, third-order coefficients and so on. We shall refer to this as RW order for brevity. In general RW order is as follows: S = [s0 |s1 s2 s3 . . . sn |s12 s13 s23 s14 s24 s34 . . . s(n−1)n | s123 s124 s134 s234 . . . s(n−2)(n−1)n | . . . |s12...n ]t

(9.7)

The following definitions introduce key concepts for our approach to function classification. Definition 9.4 Given two Boolean functions f (x1 , x2 , . . . , xn ) and g(x1 , x2 , . . . , xn ) with spectra Sf and Sg , respectively, we say f precedes g, denoted f ≺ g if for the first coefficient position (in RW order) for which the coefficients from Sf and Sg differ, the coefficient from Sf has larger magnitude, or if the two coefficients have the same magnitude, the coefficient from Sf is positive. Note that for convenience we will also write Sf ≺ Sg . Definition 9.5 Clearly, a function equivalence class must contain a function f R that precedes every other function in the class. We term f R the representative function for the class.

9.2.2 Spectral Translations Five spectral translations [3, 7, 8] will be used for the linear, affine or spectral classification of Boolean functions. Given a Boolean function f (x1 , x2 , . . . , xn ) with spectrum S, the translations are defined as follows: Translation 1 Interchange of the input variables xi and xj . This interchanges the 2n−2 pairs of spectral coefficients given by siα ↔ sj α for all α ⊆ {1, 2, .., i − 1, i + 1, . . . , j − 1, j + 1, . . . , n}.

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

199

Translation 2 Negation of the input variables xi . This negates the 2n−1 spectral coefficients with i in their subscripts. Translation 3 Negation of the function. This negates all the spectral coefficients. Translation 4 Replacement of input variable xi by xi ⊕ xj . This interchanges the 2n−2 pairs of spectral coefficients given by siα ↔ sij α for all α ⊆ {1, 2, .., i − 1, i + 1, . . . , j − 1, j + 1, . . . , n}. Translation 5 Replacement of the function f by f ⊕xi . This interchanges the 2n−1 pairs of spectral coefficients given by siα ↔ sα for all α ⊆ {1, 2, .., i − 1, i + 1, . . . , n}. It is important to note that Translation 1 reorders certain coefficients within the same orders, Translations 4 and 5 reorder certain coefficients between adjacent orders and Translations 2 and 3 change the signs of certain coefficients leaving them in the same positions in the spectrum. Application of these translations leads to the following key concept: Definition 9.6 Two Boolean functions f (x1 , x2 , . . . , xn ) and g(x1 , x2 , . . . , xn ) are equivalent with respect to a particular subset of the 5 spectral translations if f can be transformed into g by the application of some sequence of those translations. Note that the translations are all self-inverse, so the reverse sequence of translations will transform g to f . Also as shown in the definitions of the translations they can be directly carried out in the spectral domain, i.e. it is straightforward to transform between the spectra of f and g.

9.3 Classification of Boolean Functions NPN classification [5], which uses negation of variables, permutation of variable and negation of the function, is well known and well studied [17]. We make use of NPN classes for the case n = 5. We consider the linear, affine and spectral classification schemes in detail. As shown in Table 9.1, each classification scheme involves the application of particular translations. The algorithm presented below does not apply for the NPN case for reasons explained after the algorithm is presented. The sizes of the various equivalence classes up to n = 6 are given in Table 9.2.

200

D. M. Miller and M. Soeken

Table 9.1 Function classification schemes

Classification NPN Linear Affine Spectral

Translations 1, 2, 3 1, 4 1, 2, 4 1, 2, 3, 4, 5

Table 9.2 Equivalence class sizes n 1 2 3 4 5 6

Functions 4 16 256 65,536  4.3 × 109  1.8 × 1019

NPN [5] 2 4 14 222 616,126  2.0 × 1014

Linear [10] 4 8 20 92 2,744  9.5 × 108

Affine [10] 3 5 10 32 382  1.5 × 107

Spectral [8, 12] 1 2 3 8 48 150,357

The problem addressed in this paper can be stated as follows: Problem Statement: Given a Boolean function f (with spectrum S ) find a low cost sequence of spectral translations that transforms f to the representative function f R (with spectrum S R ) of the equivalence class that contains f for linear, affine or spectral classification. The cost of a sequence of translations depends on the cost model used. If all translations are assumed to have unit cost, the cost is simply the number of translations. Assigning 0 cost to each translation means that any sequence leading to fR is equally acceptable. In this paper we use the following costs: – Translation 1 interchanges 2 variables and requires a swap gate which can be implemented using 3 XOR gates. We thus assume a cost of 3. – Translations 2 and 3 each require a single NOT gate to implement an inversion and we use a cost of 1. – Translations 4 and 5 each require a single XOR gate and again we use a cost of 1. Note that alternative cost models including a model where the cost of a translation varies by context can be used. For reversible or quantum circuits the XOR gates mentioned above are implemented as controlled-NOT (CNOT) gates [13]. Given an algorithm to transform f to f R , it is possible to find the equivalence n classes for n variables, at least for small n, by applying it to all 22 functions and R keeping track of the unique f encountered. Such a transformation algorithm can also be applied to map an n variable function to its canonical form for subsequent synthesis.

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

201

9.4 Transformation Algorithm Procedure TRANSFORM maps a function f , with RW spectrum S, to the representative function f R , with spectrum S R , for the equivalence class that contains f . In doing so it finds a low cost sequence of translations but does not necessarily find the minimal cost sequence as the algorithm does not search all possible translation sequences. The parameters to the procedure are the spectrum S, the number of function variables n and a third parameter v explained below. When the procedure completes the result is the spectrum S R and the sequence of translations is in T R . T is used to record a sequence of translations as it is built. S R , T R and T are for simplicity and implementation efficiency global to the procedures. TRANSFORM uses a secondary procedure called PRECEDES. It accepts a spectrum, parameter S, and compares it to the spectrum S R which as noted above is a global. S R is replaced by S and the sequence of translations T replaces T R if S ≺ S R , see Definition 9.4. If S and S R are the same, PRECEDES T R by T if the latter has lower cost. TRANSFORM also employs five procedures trans1 . . . trans5 associated with the five spectral translations described above. Each applies a translation to the parameter spectrum S. The translation is also appended to end of the global T . Note that it is important that T is maintained in the order the translations are to be applied. Note that TRANSFORM as described here employs all five spectral translations. It thus implements spectral classification, see Table 9.1. For linear or affine classification, TRANSFORM has to be modified to only generate type 1 and 4 translations (linear) or type 1, 2 and 4 translations (affine). This can be implemented by adding appropriate conditional compilation or, more simply, by adding execution time switches to disable the unwanted translations. 1: procedure TRANSFORM(S, n, v) 2: if v = 0 then 3: SR ← S 4: TR ← φ 5: end if 6: find the min and max absolute coefficient values 7: consider all coefficients if v = 0 8: otherwise consider all Sα with a p ∈ α, p ≥ v 9: if v > n or max = 0 then 10: if S0 < 0 then 11: trans3(S, n) 12: end if 13: for every first order coefficient Si < 0 do 14: trans2(S, n, i) 15: end for 16: precedes(S, n) 17: return

202 18: end if 19: for each Sα (in RW order) starting at S0 if v = 0 20: or S1 otherwise do 21: if |Sα | = max then 22: S1 ← S 23: if v = 0 then 24: T ←φ 25: end if 26: save ← ||T || 27: if α = 0 then 28: k ← lowest variable index in α 29: α ← α − {k} 30: for each p ∈ α do 31: trans4(S 1 , n, k, p) 32: end for 33: if v = 0 then 34: trans5(S 1 , n, k) 35: else 36: if k = v then 37: trans1(S 1 , n, k, v) 38: end if 39: end if 40: end if 41: transf orm(S 1 , n, v + 1) 42: if v = 0 and min = max then 43: return 44: end if 45: ||T || ← save 46: end if 47: end for 48: return 49: end procedure 1: procedure PRECEDES(S, n) 2: find the first α (in RW order) such that Sα = SαR 3: if there is no such α and cost (T ) < cost (B) or 4: |Sα | > |SαR | or 5: |Sα | = |SαR | and Sα > 0 then R 6: S ←S 7: TR ← T 8: end if 9: return 10: end procedure

D. M. Miller and M. Soeken

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

203

TRANSFORM implements a recursive search of depth n + 1 that chooses appropriate translations to assign in order values to S0R , S1R , S2R , . . . , SnR . Parameter v identifies which coefficient of S R is under consideration so the initial call to TRANSFORM should be TRANSFORM(S, n, 0). The operation of TRANSFORM is as follows: – Lines 2–5: v = 0 is the top of the search so S R is initialized to S, the spectrum of interest, and T R , the sequence of translations to map S to S R , is set to empty. – Lines 6–8: The min and max absolute coefficient values are found by a simple linear search. All coefficients are considered if v = 0; otherwise, the coefficients with v or greater in their index are considered. – Lines 9–18: This is the terminal case for the recursion which is when v > n or when max = 0. The latter indicates that all coefficients left to be considered are 0 in which case no translations are available to further modify the spectrum. Specific steps are as follows: • 10–12: If S0 < 0 a type 3 translation is applied to invert the function. • 13–15: Type 2 translations are applied as needed so that all first-order coefficients are ≥ 0. • 16: PRECEDES is called and if S ≺ S R or S = S R and cost (S) < cost (S R ), S will be copied into S R and T will be copied into T R . • 17: Return because this is a terminal case in the recursion. – Lines 19–47: The coefficients are considered in RW order. S0 is only considered if v = 0 which is the case for choosing the appropriate value for S0R . • 21: Consider the coefficients where |Sα | = max. • 22–25: Make S 1 a copy of S and if v = 0 (the top of the recursion) set the sequence of translations T to empty. S 1 is needed so that upon return from a recursion S is unchanged. • 26: Save the current length of T . This is necessary to restore the sequence of translations upon return from a recursion. • 27–40: If α = 0 translations may be required to move Sα1 to Sv1 . – 28–32: Set k to be the lowest index in α and then apply type 4 translations to move Sα1 to Sk1 . – 33–34: If v = 0, a type 5 translation is applied to move Sk1 to S01 . – 35–38: Else if k = v, apply a type 1 translation to move Sk1 to Sv1 . • 41: This is the recursive call to transform S 1 for v + 1, the next level of recursion. • 42–44: At the top of the recursion (v = 0) this avoids excessive searching of a ‘flat’ spectrum (min = max) which is when all coefficients have the same absolute value. • 45: Restore the length of T to its value before the last coefficient considered in preparation for the next Sα to be considered. – Line 48: The recursion options are exhausted so return.

204

D. M. Miller and M. Soeken

It is important to note that all coefficients, except for S0 when v > 0, are considered in line 19. This may seem odd since for v > 0 choices have already been made for positions 0, 1, . . . , v − 1 and one might think only coefficients in positions v or higher need to be considered. The consideration of already placed coefficients is necessary to ensure potential variable swaps are properly considered. As noted earlier, the above describes using TRANSFORM for spectral classification, and that linear and affine classification can be implemented by simply ‘turning off’ certain translations. TRANSFORM cannot be easily adapted for NPN classification. The reason is that TRANSFORM relies on using type 4 translations to move spectral coefficients from one order to another. This is applicable to linear, affine and spectral classification, but type 4 translations are not available in NPN classification. A key result of using type 4 translations is that for linear, affine and spectral classification the representative function f R for a class always has a nonzero first-order coefficient for a variable, unless all coefficients involving that variable are zero. That is not true for the NPN classification case. NPN classification requires using type 1 translations (permutations) to move spectral coefficients within a group. NPN classification thus requires the choice of appropriate negations and sorting of coefficients within orders. An NPN classification algorithm thus has a structure and approach quite different from TRANSFORM.

9.5 Experimental Results All experiments were performed on a PC with an Intel i5 2 Core processor running at 3.2 GHz and 3.0 GB RAM. Our first experiment was to generate the linear, affine and spectral classes for n = 1, 2, 3, 4. The execution times and the number of classes (in brackets) are given in Table 9.3. In each case we found the number of classes given in Table 9.2. The results for n = 1, 2, 3, 4 were found by applying TRANSFORM to all Boolean functions of the given number of variables and maintaining a list of the representative functions found in each case. The classes found are shown in Tables 9.4, 9.5, and 9.6 except for the linear case for n = 4 which has 92 classes. For each class, we show the representative function f R coded as a decimal number, the count of the number of functions in the class and the spectrum for Table 9.3 CPU sec. for class generation

n 1 2 3 4

Linear classes 0.003 (4) 0.005 (8) 0.019 (20) 8.298 (92)

Affine classes 0.002 (3) 0.003 (5) 0.100 (10) 9.212 (32)

Spectral classes 0.002(1) 0.002(2) 0.006(3) 12.53(8)

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

205

Table 9.4 Linear equivalence classes n = 1, 2, 3 Class (n = 1) 1 2 3 4

fR 0 1 2 3

Class (n = 2) 1 2 3 4 5 6 7 8 Class (n = 3) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

fR 0 1 5 8 10 11 14 15 fR 0 1 17 43 69 84 85 128 136 168 170 171 187 213 232 234 238 239 254 255

Count 1 1 7 28 21 7 7 7 21 28 7 7 21 28 28 21 7 7 1 1

Count 1 1 1 1 Spectrum 0 4 2 0 2 0 −2 −2 −4

Count 1 1 3 3 3 3 1 1 Spectrum 0 8 6 4 0 2 2 0 6 4 2 0 −2 −4 −2 0 −2 −4 −6 −6 −8

1 0 −2 −4 4 −6 −6 −8 2 4 6 8 6 4 −6 4 6 4 2 2 0

2 0 −2 −4 −4 2 2 0 2 4 2 0 −2 −4 2 4 2 4 2 2 0

1 0 −2 −4 2 4 2 2 0 3 0 −2 0 −4 −2 2 0 2 0 2 0 −2 0 2 4 2 0 −2 2 0

12 0 −2 −4 0 2 2 0 −2 −4 −2 0 −2 −4 −2 0 2 4 2 2 0

Spectrum 0 2 0 0 −2

1 0 −2 2 0

2 0 −2 0 2 0 −2 2 0

12 0 −2 0 −2 0 −2 2 0

13 0 −2 0 0 −2 2 0 −2 0 −2 0 −2 0 −2 0 2 0 −2 2 0

23 0 −2 0 0 −2 2 0 −2 0 2 0 −2 0 −2 0 −2 0 −2 2 0

123 0 −2 0 −4 −2 2 0 2 0 −2 0 −2 0 2 −4 −2 0 −2 2 0

the representative function. Note the significantly different sizes of the equivalence classes. The distribution of the linear class sizes for n = 4 is shown in Fig. 9.1. 5 For n = 5 there are 22 = 4,294,967,296 Boolean functions which makes the above approach impractical. We thus consider one function from each of the 616,126

206

D. M. Miller and M. Soeken

Table 9.5 Affine equivalence classes n = 1, 2, 3, 4 Class (n = 1) 1 2 3

fR 0 2 3

Class (n = 2) 1 2 3 4 5

fR 0 8 10 14 15

Class (n = 3) 1 2 3 4 5 6 7 8 9 10

Spectrum 0 4 2 0 −2 −4

Count 1 4 6 4 1

fR 0 128 136 168 170 232 234 238 254 255

Spectrum 0 2 0 −2

Count 1 2 1

Count 1 8 28 56 14 56 56 28 8 1

Spectrum 0 1 8 0 6 2 4 4 2 6 0 8 0 4 −2 6 −4 4 −6 2 −8 0

2 0 2 4 2 0 4 2 4 2 0

3 0 2 0 2 0 4 2 0 2 0

1 0 2 4 2 0

12 0 −2 −4 −2 0 0 2 4 2 0

1 0 2 0

2 0 2 0 2 0 13 0 −2 0 −2 0 0 2 0 2 0

12 0 −2 0 2 0 23 0 −2 0 2 0 0 −2 0 2 0

123 0 2 0 −2 0 −4 −2 0 2 0

Spectrum Class (n = 4) f R

Count 0

1

2 3 4 12

13

23

14

24

34

123 124 134 234 1234

1

0

1

16

0

0 0 0

0

0

0

0

0

0

0

0

0

0

0

2

27,328

448

4

4

4 4 4

4

4

−4

−4

4

4

−4

−4

−4

−4

4

3

32,488

448

−4

4

4 4 4

4

4

4

4

4

4

−4

−4

−4

−4

−4

4

32,768

16

14

2

2 2 2 −2

−2

−2

−2

−2

−2

2

2

2

2

−2

5

32,896

120

12

4

4 4 0 −4

−4

−4

0

0

0

4

0

0

0

0

6

34,944

560

10

6

6 2 2 −6

−2

−2

−2

−2

2

2

2

−2

−2

2

7

34,952

140

8

8

8 0 0 −8

0

0

0

0

0

0

0

0

0

0

8

43,136

1680

8

8

4 4 4 −4

−4

0

−4

0

0

0

0

0

−4

4

9

43,144

1680

6

10

6 2 2 −6

−2

2

−2

2

−2

−2

−2

2

−2

2

10

43,176

840

4

12

4 4 0 −4

−4

4

0

0

0

−4

0

0

0

0

11

43,688

240

2

14

2 2 2

-2

2

-2

2

2

-2

-2

-2

2

-2

12

43,690

30

0

16

0 0 0

0

0

0

0

0

0

0

0

0

0

0

13

59,520

2688

6

6

6 6 6

-2

-2

-2

-2

-2

-2

-2

-2

-2

-2

6

14

59,528

6720

4

8

8 4 4

-4

0

0

0

0

-4

-4

-4

0

0

4

15

59,560

6720

2

10

6 6 2

-2

-2

2

2

-2

-2

-6

-2

-2

2

2

16

59,624

840

0

8

8 8 0

0

0

0

0

0

0

-8

0

0

0

0

-2

(continued)

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

207

Table 9.5 (continued) Spectrum Class (n = 4) f R

Count

2 3 4

12

17

60,072

1920

0

0 12 4 4 4

1

0

0

0

0

0

0

−4

−4

−4

4

0

18

60,074

240

−2 14 2 2 2

2

2

−2

2

−2

−2

−2

−2

−2

2

2

19

60,104 10,080

8 4 4

0

4

−4

−4

4

0

−4

−4

0

0

0

20

60,136

−2 10 6 6 2

2

2

−2

−2

2

2

−6

−2

−2

2

−2

21

60,138

840

−4 12 4 4 0

4

4

−4

0

0

0

−4

0

0

0

0

22

61,152

4480

−2 6

6 6 6

6

−2

−2

−2

−2

6

−2

−2

−2

−2

−2

23

61,160

6720

−4 8

8 4 4

4

0

0

0

0

4

−4

−4

0

0

−4

24

61,162

1680

−6 10 6 2 2

6

2

−2

2

−2

2

−2

−2

2

−2

−2

25

61,166

140

−8 8

26

63,624

4480

2 6

27

65,256

2688

28

65,258

1680

29

65,262

30 31 32

0 8

6720

8 0 0

13 23

14

24

34

123 124 134 234 1234

8

0

0

0

0

0

0

0

0

0

0

6 6 6 −6

2

2

2

2

−6

−2

−2

−2

−2

2

−6 6

6 6 6

2

2

2

2

2

2

−2

−2

−2

−2

−6

−8 8

4 4 4

4

4

0

4

0

0

0

0

0

−4

−4

560

−10 6

6 2 2

6

2

2

2

2

−2

2

2

−2

−2

−2

65,278

120

−12 4

4 4 0

4

4

4

0

0

0

4

0

0

0

0

65,534

16

−14 2

2 2 2

2

2

2

2

2

2

2

2

2

2

2

65,535

1

−16 0

0 0 0

0

0

0

0

0

0

0

0

0

0

0

Spectrum 0 2

1 0

Table 9.6 Spectral equivalence classes n = 1, 2, 3, 4 Class (n = 1) 1

fR 0

Class (n = 2) 1 2

fR 0 8

Class (n = 3) 1 2 3 Class (n = 4) 1 2 3 4 5 6 7 8

Count 4

fR 0 27,328 32,768 32,896 34,944 34,952 43,136 59,520

fR 0 128 136 Count 32 896 512 3840 17,920 1120 26,880 14,336

Spectrum 0 1 4 0 2 2

Count 8 8 Count 16 128 112 Spectrum 0 1 2 3 16 0 0 0 4 4 4 4 14 2 2 2 12 4 4 4 10 6 6 2 8 8 8 0 8 8 4 4 6 6 6 6

Spectrum 0 1 8 0 6 2 4 4

2 0 2 4

4 0 4 2 0 2 0 4 6

23 0 −4 −2 −4 −2 0 0 −2

12 0 4 −2 −4 −6 −8 −4 −2

13 0 4 −2 −4 −2 0 −4 −2

3 0 2 0 14 0 −4 −2 0 −2 0 −4 −2

12 0 −2 −4

2 0 2 13 0 −2 0

12 0 −2 23 0 −2 0

123 0 2 0

24 34 123 124 134 234 1234 0 0 0 0 0 0 0 4 4 −4 −4 −4 −4 4 −2 −2 2 2 2 2 −2 0 0 4 0 0 0 0 −2 2 2 2 −2 −2 2 0 0 0 0 0 0 0 0 0 0 0 0 −4 4 −2 −2 −2 −2 −2 −2 6

208

D. M. Miller and M. Soeken

3000 2500 2000 1500 1000 500 0

1

6

11

16

21

26

31

36

41

46

51

56

61

66

71

76

81

86

91

Fig. 9.1 Linear class size distribution n = 4 Table 9.7 Summary of results for n = 5

Linear Affine Spectral

CPU (sec.) 3728.6 11,036.59 5177.77

Classes 2706 (2744) 382 48

NPN classes. Note that for linear and affine classification, we must consider both the function and its inverse since function negation is not allowed in those classification schemes. Execution times and class numbers are given in Table 9.7. The spectral case considers half the number of functions as the other two since the complement of a function is always in the same spectral class as the function itself. For the linear case, this experiment identified 2706 equivalence classes rather than the expected 2744. The reason for the discrepancy is that linear classification does not employ variable negation (type 2 translation) but we are starting from NPN classes which do use variable negation. Indeed, it is a bit surprising that this approach found 98.6% of the linear equivalence classes for n = 5. While the total CPU time is high, the execution time per function is reasonable. For example, for the case of affine classification 1,232,252 functions are considered, one from each NPN class and the complement of that function, so the average CPU time per function is 8.96 ms. The linear and affine cases are too large to list the classes here. The spectral equivalence classes for n = 5 are presented in Table 9.10. In this case, the count is the number of NPN classes that fall within the spectral class. Figure 9.2a–c shows the distribution of class sizes in terms of the number of functions from the NPN classes. The disparity in class size is similar to that shown by the results above. Recall that the number of functions in the linear and affine cases is twice that of the spectral case because the first two need to consider the inverse functions separately.

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

209

3500 3000 2500 2000 1500 1000

0

1 52 103 154 205 256 307 358 409 460 511 562 613 664 715 766 817 868 919 970 1021 1072 1123 1174 1225 1276 1327 1378 1429 1480 1531 1582 1633 1684 1735 1786 1837 1888 1939 1990 2041 2092 2143 2194 2245 2296 2347 2398 2449 2500 2551 2602 2653 2704

500

(a) 25000

20000

15000

10000

0

1 9 17 25 33 41 49 57 65 73 81 89 97 105 113 121 129 137 145 153 161 169 177 185 193 201 209 217 225 233 241 249 257 265 273 281 289 297 305 313 321 329 337 345 353 361 369 377

5000

(b) 100000 90000 80000 70000 60000 50000 40000 30000 20000 10000 0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

(c) Fig. 9.2 Class size distribution n = 5. (a) Linear class size distribution. (b) Affine class size distribution. (c) Spectral class size distribution

210

D. M. Miller and M. Soeken

Table 9.8 Average translations per function

n Linear Affine Spectral

1 0 0.250 1

2 0.875 1.187 1.5

3 2.609 2.969 3.504

4 6.006 6.382 6.765

5 12.693 13.657 13.908

Table 9.9 CPU sec. for class generation n 1 2 3 4 5

Linear Runtime 0.00007 0.00013 0.00115 0.13561 126.44800

Classes 4 8 20 92 2744

Affine Runtime 0.00005 0.00010 0.00108 0.21747 254.95300

Classes 3 5 10 32 382

Spectral Runtime 0.00004 0.00006 0.00063 0.10147 122.68800

Classes 1 2 3 8 48

As noted above, the TRANSFORM procedure attempts to find a low cost translation sequence. Table 9.8 reports the average number of translations per function for linear, affine and spectral classification for each n.

9.6 An Alternate Approach to Class Generation The approach above is limited by the rate at which the number of Boolean functions grows with n. Even for n = 5 we had to use NPN class representatives rather than all functions. In this section, we outline an alternate approach which is much more efficient. That raises the possibility of applying it for n > 5. Its limitation is that, because it does not examine all functions or all NPN classes, this approach does not yield information on the size of a class. Rather than checking all function or NPN classes, the alternate approach uses a search procedure based on Algorithm 4.2.1 from J. E. Fuller’s PhD thesis [4] to generate all linear, affine or spectral class representatives for Boolean functions with n variables. Note that the presentation in [4] considered only what we have here termed the spectral case which in her work Fuller refers to as the affine case. The search procedure employs the concept of the 1-neighbourhood of a Boolean function [4]. Definition 9.7 A function g is in the 1-neighbourhood of function f , if g differs from f for precisely one input assignment. The search begins with a stack containing the single class representative constant0 function. A recursive search is employed and whenever a neighbourhood function is not equivalent to any of the representatives found so far, it is added to the stack. The procedure terminates when no more new representatives are found in the neighbourhoods of the representatives on the stack. The advantage of the approach is that not all Boolean functions need to be explored.

fR

0

680,042,496

1,790,995,136

1,791,549,440

1,791,550,016

2,022,213,768

2,147,483,648

2,147,516,416

2,155,905,024

2,155,905,152

2,290,122,752

2,290,122,880

2,290,124,928

2,290,649,216

2,290,649,224

2,826,993,664

2,826,993,792

2,826,995,840

2,827,004,032

2,827,520,128

2827,526,272

2,833,303,552

2,860,548,224

3,095,701,632

3,163,070,592

Class

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

6

87,680

4672

3130

57,864

3750

988

923

5242

5242

2044

47

134

630

630

630

134

134

50

6

914

2036

22,550

46

404

Count

12

12

18

14

16

16

16

18

20

22

16

18

20

22

24

24

26

28

30

12

8

12

8

20

32

0

12

12

14

10

16

16

16

14

12

10

16

14

12

10

8

8

6

4

2

12

8

8

8

12

0

1

Spectrum

8

8

6

10

8

12

8

10

8

6

16

14

12

10

8

8

6

4

2

12

8

8

8

4

0

2

8

8

6

10

8

4

8

6

8

6

0

2

4

6

4

8

6

4

2

4

8

8

8

4

0

3

8

8

6

6

4

4

8

6

4

6

0

2

4

2

4

0

2

4

2

4

8

8

8

4

0

4

8

−6

−4

−2

2 −10

0 −12

2 −14

−8

−2

−6

−8

−8

4 −8

6 −2

6 −6

4 −8

8 −8

−8

−4

0 −8

4 −12

−8

−6

4 −8

2 −10

0

−4

4 −8

−6

−8

0 −8

0 −16

−6

2 −6

6 −6

−2

−4

2 −2

0 −4

8 4

4

8

4

8

4

4 −12

8

0

−4

4 −4

13 0

12

0

0

5

Table 9.10 Spectral equivalence classes n = 5

−2

4

4

−6

−2

0

0

0

−2

−4

−2

0

−2

−4

−6

−4

−8

−6

−4

0

−8

−6

−6

−4

−4

−8

−6

−4

−6

0

−2

−4

−2

−4

0

−2

−4

−2

4

−8

−8 4

−8 −4

−8 −4

−4

0

14

4

0

23

4

4

2

−6

4

0

0

−2

0

−2

0

−2

−4

−2

−4

0

−2

−4

−2

4

8

4

8

4

0

24

−4

−4

2

2

−4

0

0

2

0

−2

0

2

4

2

0

0

−2

−4

−2

−4

0

−4

8

−4

0

34

0

4

−6

−6

−4

−4

0

−2

−4

−6

0

−2

0

−2

−4

0

−2

0

−2

4

−4

−4

0

−4

0

15

−4

0

2

2

−4

0

0

2

0

−2

0

−2

0

−2

−4

0

−2

0

−2

4

−4

−4

0

−4

0

25

4

0

2

−6

4

0

0

−2

0

−2

0

2

0

2

0

0

−2

0

−2

−4

4

4

0

4

0

35

−4

0

−6

6

0

0

0

−2

−4

−2

0

2

0

−2

0

0

2

0

−2

−4

4

4

0

4

0

45

4

4

6

−6

0

0

0

2

4

2

0

2

4

6

4

8

6

4

2

−4

−8

−8

−8

−4

0

123

−4

4

−2

6

−4

0

0

2

0

2

0

2

4

2

4

0

2

4

2

−4

−8

−8

−8

−4

0

124

4

−4

−2

−2

4

0

0

−2

0

2

0

−2

−4

−2

0

0

2

4

2

−4

0

0

−8

4

0

134

−8

−8

−2

−2

−4

−4

−8

−6

−4

−2

0

−2

−4

−2

0

0

2

4

2

−4

0

0

−8

−4

0

234

4

0

−2

−2

4

0

0

−2

0

2

0

2

0

2

4

0

2

0

2

−4

4

0

0

4

0

125

−4

0

−2

6

−4

0

0

2

0

2

0

−2

0

−2

0

0

2

0

2

−4

−4

−8

0

−4

0

135

−8

−4

−2

−2

−4

−4

0

−2

−4

−2

0

−2

0

−2

0

0

2

0

2

−4

−4

0

0

−4

0

235

−4

0

6

2

0

0

0

2

4

2

0

−2

0

2

0

0

−2

0

2

−4

−4

0

0

−4

0

145

0

−4

−2

−6

0

−4

0

−2

0

−2

0

−2

0

2

0

0

−2

0

2

−4

−4

−8

0

−4

0

245

0

4

−2

−6

0

4

0

2

0

−2

0

2

0

−2

−4

0

−2

0

2

4

−4

−8

0

−4

0

345

0

8

2

2

4

4

8

6

4

2

0

2

4

2

0

0

−2

−4

−2

4

0

4

8

4

0

1234

0

−4

2

2

4

4

0

2

4

2

0

2

0

2

0

0

−2

0

−2

4

4

4

0

4

0

1235

0

−4

2

−2

0

4

0

2

0

2

0

2

0

−2

0

0

2

0

−2

4

4

4

0

4

0

1245

0

4

2

−2

0

−4

0

−2

0

2

0

−2

0

2

4

0

2

0

−2

4

4

4

0

4

0

1345

4

0

−2

2

0

0

0

−2

−4

−6

0

2

0

−2

−4

0

−2

0

2

−4

−4

0

0

−4

0

12,345

(continued)

4

0

2

6

0

0

0

2

4

6

0

−2

0

2

4

0

2

0

−2

4

4

4

0

4

0

2345

fR

3,769,157,760

3,783,297,152

3,900,735,488

3,900,735,490

3,900,735,616

3,900,737,664

3,900,745,856

3,900,762,240

3,900,803,200

3,900,827,776

3,901,261,952

3,902,834,816

3,904,940,160

3,917,512,832

3,919,626,376

3,921,717,376

3,934,290,048

3,939,000,896

3,969,943,680

4,001,669,216

4,169,173,120

4,169,697,408

4,238,379,136

Class

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

44,828

5740

60,842

1474

57,864

700

39,792

15,608

14,656

3130

13,196

45,288

3466

404

21,246

404

4770

32,700

21,246

4478

4478

15,954

3976

Count

Table 9.10 (continued)

10

12

14

8

12

8

16

10

10

16

12

14

14

10

14

12

14

16

18

18

20

16

12

10

12

10

8

12

8

12

10

10

8

12

14

14

10

10

12

14

12

10

10

8

8

12

1

Spectrum

0

2

10

12

10

8

12

8

8

10

10

8

12

10

14

10

10

12

10

12

10

6

8

8

12

3

10

8

10

8

8

8

8

10

10

8

12

10

6

10

6

12

10

8

10

6

8

8

12

4

10

8

10

8

8

8

8

10

6

8

8

6

6

10

6

12

10

8

6

6

8

8

4

5

−2 −6 −4 −6

−2

−6

−8

−6

6

0 −6

8 −12

10 −6 2

0

−2

0

−8 −2

0

2

0

−2

−8

0

−8

−8

−4

−6

6

0

−8

−2

−2

−6

−6

−4

−6

−4

−2

−2

−4

0

−8

−4

8

8

14 4

−8

−6

−6

−8

−4

−2

−2

−6

−6

−4

−2

−4

−6

−6

−4

−8

8

−4

23 −4

8

−4

6 −10

8

8

8

6

−6

−8

−8

8 −6

−4

−4

−6

−6

−6

4

6

−6

−6 −2

−6

2

6 −10

0

−4

−4

−4

−6

−8

−8

−4

13 −4

12

−4

6 −10

2

4

6

6

8

4

4

24

−6

0

−2

0

−8

8

0

2

−2

0

0

−6

−2

−6

−6

−4

−2

−4

−2

−6

−4

0

−4

34

2

−4

−2

0

4

0

0

2

−2

0

0

2

−2

−6

−2

−4

−2

0

−2

−6

−4

0

−4

15

2

0

2

0

0

−8

−4

6

−2

0

4

−2

−2

2

2

0

2

0

−2

−2

−4

4

−4

25

2

0

2

−8

0

−8

0

−2

6

0

−4

2

−2

2

2

0

−2

0

−2

−6

−4

4

4

35

−6

−4

−6

8

−4

0

0

−2

−2

0

−4

−6

−2

2

−2

0

−2

−4

−2

−6

−4

−4

−4

45

−6

−4

−6

−8

−4

0

−8

−2

−6

−8

0

−2

−2

2

−2

0

−2

−4

−6

−6

−4

−4

4

123

2

0

2

0

0

−8

4

−6

−6

0

−4

−2

−2

−6

−2

−4

−2

0

2

2

0

0

−4

124

2

0

2

0

0

−8

−4

2

−2

0

0

2

−2

−6

−2

−4

−2

0

−2

2

0

0

−4

134

−6

−4

−6

0

−4

0

−4

2

−2

0

0

−6

−2

−6

−6

−4

−2

−4

−2

2

0

0

−4

234

−6

−4

−6

0

−4

0

0

−6

6

0

−8

−2

−2

−6

−6

−4

−6

−4

−2

−2

0

0

4

125

−6

0

−2

0

−8

8

−4

−2

−2

0

−4

−6

−2

2

−2

0

−2

−4

−2

2

0

−4

−4

135

2

−4

−2

0

4

0

−4

−2

6

0

−4

2

−2

2

2

0

−2

0

−2

2

0

4

4

235

−6

−4

−2

0

−4

0

0

6

−2

0

4

−2

−2

2

2

0

2

0

−2

−2

0

4

−4

145

−6

−4

−2

0

−4

0

4

−2

2

0

0

−2

−2

2

2

0

−2

0

2

2

0

−4

−4

245

2

−4

−2

0

4

0

0

−2

2

0

0

2

−2

2

2

0

2

0

2

−2

0

−4

−4

345

2

8

6

0

0

0

0

−2

−6

0

0

2

6

2

6

0

2

4

2

−2

0

4

4

1234

2

4

6

0

4

0

4

10

6

8

8

6

6

10

6

12

10

8

6

6

4

8

4

1235

2

4

2

−8

4

0

4

6

6

8

4

6

6

2

6

0

2

4

6

6

4

4

4

1245

2

4

2

8

4

0

4

−2

−6

0

0

2

6

2

6

0

2

4

2

6

4

4

4

2

0

2

8

0

0

4

−2

2

0

0

2

−2

2

2

0

2

0

2

6

4

−4

−4

1345

2

0

2

0

0

0

0

−2

2

0

0

−2

−2

2

2

0

−2

0

2

2

4

−4

−4

2345

2

0

−2

−8

0

0

−4

−2

−6

−8

0

−2

−2

2

−2

0

−2

−4

−6

−6

−8

−4

4

12,345

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

213

A key component in Fuller’s algorithm is the equivalence check. We use the TRANSFORM algorithm proposed in this work for the linear, affine and spectral cases in the manner described in the previous section. For this experiment, we used an implementation of the TRANSFORM algorithm inside the C++ truth table package kitty.1 The experimental results were generated using the example application spectral_enumeration_fuller on a laptop with an Intel i5 2 Core processor running at 2.7 GHz and 8.0 GB RAM. The results are shown in Table 9.9. The expected number of classes are produced in all cases—they are in fact the same classes as reported in the previous section except for the linear case for n = 5 where this time all 2744 classes were found. The efficiency of this alternate approach is clear from the execution times shown in Table 9.9 compared to those reported above in Tables 9.3 and 9.7. For example, generating the affine classes for n = 5 takes 254.9 CPU sec. for the alternate approach as compared to 11,036.6 CPU sec. for the NPN search approach, i.e. a speedup of 43.3 times (Table 9.10).

9.7 Conclusion In this work, we presented a single algorithm that can be used to identify the linear, affine or spectral equivalence class of a Boolean function. For n ≤ 4, we showed that the algorithm can be used to find the expected number of linear, affine and spectral equivalence classes. For n = 5, we showed that starting from the NPN classes, the algorithm can be used to find all affine and spectral classes, but because of not being able to check all Boolean functions only 98.6% of the linear classes are found. We also outlined an alternate approach that does efficiently find all linear, affine and spectral classes for n ≤ 5 but without class size information. We provided the representative functions for the classes for many cases and all results, including those too extensive to include in this paper, are available on the web.2 A key facet of our approach is that the TRANSFORM algorithm identifies the sequence of translations required to map a function to the representative function for the equivalence class containing that function. Since the translations are self-inverse, the algorithm can be used to find a sequence of translations to map a function to any other function in the same equivalence class. Our future work will concentrate on improving the efficiency of our implementation and on considering how to extend the function classification work to n > 5. We also plan, now that we have a procedure for linear and affine classification to consider those techniques in the synthesis of reversible and quantum circuits. We

1 https://github.com/msoeken/kitty. 2 www.cs.uvic.ca/~mmiller/fclasses.

214

D. M. Miller and M. Soeken

emphasize again that the algorithm can be used to determine the linear, affine or spectral equivalence of two functions for arbitrary n. The approaches discussed in this chapter are searches dependent on the number of variables and the actual spectral coefficient values. Spectra where a large number of coefficients have equal magnitude values appear to lead to the longest searches. We are looking at techniques to prune the searches and will undertake a formal analysis of the computational complexity once those techniques are incorporated. Acknowledgements The authors gratefully acknowledge the constructive comments from the referees of an earlier paper presented at IWSBP2018 which led to improvements in the presentation of this work.

References 1. Boyar, J., Matthews, P., Peralta, R.: Logic minimization techniques with applications to cryptology. J. Cryptol. 26(2), 280–312 (2013) 2. Boyar, J., Peralta, R.: A new combinational logic minimization technique with applications to cryptology. In: International Symposium on Experimental Algorithms, pp. 178–189 (2010) 3. Edwards, C.R.: The application of the Rademacher-Walsh transform to Boolean function classification and threshold logic synthesis. IEEE Trans. Comput. 24(1), 48–62 (1975) 4. Fuller, J.E.: Analysis of affine equivalent Boolean functions for cryptography. Ph.D. Thesis, Queensland University of Technology (2003) 5. Harrison, M.A.: Introduction to Switching and Automata Theory. McGraw Hill, New York (1963) 6. Harrison, M.A.: On the classification of Boolean functions by the general linear and affine group. SIAM J. 12, 284–299 (1964) 7. Hurst, S.L.: The Logical Processing of Digital Signals. Arnold, London (1978) 8. Hurst, S.L., Miller, D.M., Muzio, J.C.: Spectral Techniques in Digital Logic. Academic, London (1985) 9. Karpovsky, M.G.: Finite Orthogonal Series in the Design of Digital Devices. Wiley, New York (1976) 10. Lechner, R.J.: Harmonic analysis of switching functions. In: Mukhopadhyay, A. (ed.) Recent Developments in Switching Theory. Academic, London (1971) 11. Lv, J., Kalla, P., Enescu, F.: Verification of composite Galois field multipliers over GF((2m )n ) using computer algebra techniques. In: International High Level Design Validation and Test Workshop, pp. 136–143 (2011) 12. Maiorana, J.A.: A classification of the cosets of the Reed-Muller code r(1, 6). Math. Comput. 57(195), 403–414 (1991) 13. Nielsen, M.A., Chuang, I.L.: Quantum Computation and Quantum Information. Cambridge University Press, Cambridge (2000) 14. Rademacher, H.: Einige sitze uber reihen von allgemeinen orthogonal-funktionen. Math. Ann. 87, 112–138 (1922) 15. Sasao, T., Matsuura, K., Iguchi, Y.: A method to identify affine equivalence classes of logic functions. In: Proc. SASIMI, pp. 266–271 (2018) 16. Soeken, M., Abdessaied, N., De Micheli, G.: Enumeration of reversible functions and its application to circuit complexity. In: International Conference on Reversible Computation. pp. 255–270 (2016)

9 An Algorithm for Linear, Affine and Spectral Classification of Boolean Functions

215

17. Soeken, M., Mishchenko, A., Petkovska, A., Sterin, B., Ienne, P., Brayton, R.K., De Micheli, G.: Heuristic NPN classification for large functions using AIGs and LEXSAT. In: Creignou, N., Berre, D.L. (eds.) Theory and Applications of Satisfiability Testing - SAT 2016. Lecture Notes in Computer Science, vol. 9710. Springer, Berlin (2016) 18. Soeken, M., Roetteler, M., Wiebe, N., De Micheli, G.: Logic synthesis for quantum computing (2017). arXiv1706.02721 19. Thornton, M.A., Drechsler, R., Miller, D.M.: Spectral Techniques in VLSI CAD. Kluwer Academic Publishers, Boston (2001) 20. Walsh, J.L.: A closed set of orthogonal functions. Am. J. Math 45, 5–24 (1923)

Chapter 10

New Results on Reversible Boolean Functions Having Component Functions with Specified Properties Paweł Kerntopf, Krzysztof Podlaski, Claudio Moraga, and Radomir Stankovi´c

10.1 Introduction Recent advances in nanotechnology, low-power design, and quantum computing have renewed interest in reversible logic synthesis since they allow reducing the power dissipation in related circuits and the potential speed-up in quantum computations. More details can be found in [1, 2] and the references therein. A reversible function is defined as a bijective mapping f : An → An , where A is any finite set of elements which can be conveniently identified with non-negative integers {0, 1, . . . , p−1}. In particular, for p = 2 and p = 3, we speak about binary or Boolean and ternary reversible functions, respectively. Therefore, an n-variable reversible function is actually a permutation on An , and can be viewed as a vector of n functions called the component functions (CFs), i.e., F = (f1 , f2 ,..., fn ). In [3], the term components is applied in the similar meaning, meanwhile in the literature on cryptography the term coordinate functions is used, see, e.g., [4, 5]. However, in [5] the term component function means a linear combination of coordinate functions.

P. Kerntopf () Institute of Computer Science, Warsaw University of Technology, Warsaw, Poland e-mail: [email protected] K. Podlaski Faculty of Physics and Applied Informatics, University of Łód´z, Łód´z, Poland e-mail: [email protected] C. Moraga Faculty of Computer Science, Technical University of Dortmund, Dortmund, Germany e-mail: [email protected] R. Stankovi´c Department of Computer Science, Faculty of Electronic Engineering, University of Niš, Niš, Serbia © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_10

217

218

P. Kerntopf et al.

Correspondingly, a reversible circuit is a circuit that realizes a reversible function, i.e., performs a bijective mapping of n input signals onto n output signals in a manner specified by the function to be realized. Recently in [6, 7], we discussed the question if it is possible to extend a Boolean function f : {0, 1}n → {0, 1} into a reversible function F: {0, 1}n → {0, 1}n , under the condition that all its component functions have a homogeneous property. The term homogeneous property means that all component functions express the same particular property Boolean functions might have, e.g., all the component functions belong to the same equivalence class in a particular classification of Boolean functions. The motivation was that if such an embedding of a Boolean function into a reversible function is possible, then new classes of reversible functions can be defined. In [8, 9] the same question is explored for ternary functions F: {0, 1, 2}n → {0, 1, 2}n . Notice that there are significant differences in the theory of binary and ternary reversible functions, especially in the case of linear component functions. As homogeneous properties we have chosen typical ones considered in classical logic synthesis: symmetry, affinity, linearity, nonlinearity, self-duality, selfcomplementarity, monotonicity, and unateness (see, e.g., [10]). In our previous papers [6–9] the exemplary functions used in proofs of the results were obtained by a constructive manner. Here we present new results on properties of component functions of Boolean reversible functions obtained by the extrapolation approach. The presentation is organized as follows. For the sake of completeness, necessary definitions and basic results from the theory of standard Boolean as well as reversible Boolean functions are provided in Sect. 10.2. In Sect. 10.3, a brief overview of related and background work is presented. Section 10.4 demonstrates our approach to extrapolating desired properties of reversible functions. Sections 10.5 and 10.6 describe the main results of our research on the existence of Boolean reversible functions with all component functions having at least one linear variable or belonging to different equivalence classes. The presented research is summarized in Sect. 10.7.

10.2 Preliminaries In this section the basic definitions and known results are provided for the convenience of the reader. Let us first briefly survey fundamental notions related to standard Boolean functions and reversible Boolean functions. Any Boolean function f : {0, 1}n → {0, 1} can be described using an EXOR-sum of products (ESOP) expression. In ESOPs each variable may appear in both uncomplemented and complemented forms. The positive polarity Reed–Muller (PPRM) expression is an ESOP expression which uses only uncomplemented variables. It is a canonical expression and for small functions can be easily generated from a truth table or another representation of the Boolean function.

10 New Results on Reversible Boolean Functions Having Component. . .

219

Definition 10.1 A Boolean function f : {0, 1}n → {0, 1} is called balanced if it takes value 1 the same number of times as value 0. In the case of Boolean functions, depending on the operations allowed in a particular classification, the P-equivalent, NP-equivalent, and NPN-equivalent functions are distinguished. In some applications, equivalence classes defined with respect to a restricted set of operations are of a particular interest, as for example, in [11, 12]. In the present paper, we are particularly interested in P-equivalent functions when studying properties of component functions. Definition 10.2 Two Boolean functions are 1. P-equivalent if they can be converted to each other by the permutation of variables, 2. NP-equivalent if they can be converted to each other by the negation and/or permutation of variables, 3. NPN-equivalent if they can be converted to each other by negation of variables, permutation of variables, and negation of the function. Definition 10.3 A Boolean function f is self-complementary (SC) if f and f ’ are NP-equivalent, where f ’ denotes negation of f. Definition 10.4 A Boolean function f is self-dual (SD) if f (x1 , x2 , . . . , xn ) = f



+  ,   x1 , x2 , . . . , xn .

Definition 10.5 A Boolean function f is linear with respect to a variable xi if the function f can be expressed in the form f = xi ⊕ g, where g is a function independent of xi (then the variable xi is called linear in f ). A function f is called linear (L) if all its variables are linear in f. Otherwise it is called nonlinear. A function has property LV if it contains at least one linear variable. Example 10.1 f1 (x, y, z) = x ⊕ y ⊕ yz is linear with respect to x as then g = y ⊕ yz is independent of x, but f1 is not linear with respect to y as then g = x ⊕ yz is dependent of y. Similarly, f2 (x, y) = x ⊕ y ⊕ xy is linear with respect to neither x nor y. The following results are well known: Lemma 10.1 1. 2. 3. 4.

All self-complementary functions are balanced, All self-dual functions are self-complementary, All functions having property LV are self-complementary, If a Boolean function f is linear with respect to a variable xi, then 

f (xi = 1) = f (xi = 0) .

220

P. Kerntopf et al.

Definition 10.6 A mapping F: {0, 1}n → {0, 1}n is called an n∗ n reversible function if it is bijective. It will also be considered as a vector of standard Boolean functions that we will called component functions fi : {0, 1}n → {0, 1}, 1 ≤ i ≤ n. They are defined at every x  {0, 1}n by F(x) = (f1 (x), . . . , fn (x)). Since F is bijective hence component functions fi : {0, 1}n → {0, 1}, 1 ≤ i ≤ n, are balanced Boolean functions. By an analogy with the definition of NPN-equivalence classes for standard Boolean functions, the following definition of equivalence classes for Boolean reversible functions can be given. Definition 10.7 Two reversible Boolean functions are NPNP-equivalent if they can be transformed to each other by the following operations (including the combinations that do not use all of these operations): 1. 2. 3. 4.

Negation of variables, Permutation of variables, Negation of component functions, and Permutation of component functions.

Example 10.2 The component functions of a reversible Boolean function F = ( f1 , f2 , f3 ) are as follows: f1 (x, y, z) = x ⊕ yz f2 (x, y, z) = x ⊕ y ⊕ xz f3 (x, y, z) = x ⊕ y ⊕ z ⊕ xy After negating variables x in F we obtain the reversible function G = (g1 , g2 , g3 ): +  , g1 (x, y, z) = f1 x , y, z = (1 ⊕ x) ⊕ yz = 1 ⊕ x ⊕ yz +  , g2 (x, y, z) = f2 x , y, z = (1 ⊕ x) ⊕ y ⊕ (1 ⊕ x) z = 1 ⊕ x ⊕ y ⊕ z ⊕ xz +  , g3 (x, y, z) = f3 x , y, z = (1 ⊕ x) ⊕ y ⊕ z ⊕ (1 ⊕ x) y = 1 ⊕ x ⊕ y ⊕ z ⊕ y ⊕ xy = 1 ⊕ x ⊕ z ⊕ xy The permutation of variables (x, y, z) → (x, z, y) in G leads to the function H(h1 , h2 , h3 ): h1 (x, y, z) = g1 (x, z, y) = 1 ⊕ x ⊕ yz h2 (x, y, z) = g2 (x, z, y) = 1 ⊕ x ⊕ z ⊕ y ⊕ xy h3 (x, y, z) = g3 (x, z, y) = 1 ⊕ x ⊕ y ⊕ xz

10 New Results on Reversible Boolean Functions Having Component. . .

221

Negating all three functions h1 , h2 , and h3 leads to the function K = (k1 , k2 , k3 ): 

k1 (x, y, z) = h1 (x, y, z) = 1 ⊕ (1 ⊕ x ⊕ yz) = x ⊕ yz 

k2 (x, y, z) = h2 (x, y, z) = 1 ⊕ (1 ⊕ x ⊕ z ⊕ y ⊕ xy) = x ⊕ z ⊕ y ⊕ xy 

k3 (x, y, z) = h3 (x, y, z) = 1 ⊕ (1 ⊕ x ⊕ y ⊕ xz) = x ⊕ y ⊕ xz Finally, the following permutation of component functions (k1 , k2 , k3 ) → (k3 , k1 , k2 ) is performed leading to the function L(l1 , l2 , l3 ): l1 (x, y, z) = k3 (x, y, z) = x ⊕ y ⊕ xz l2 (x, y, z) = k1 (x, y, z) = x ⊕ yz l3 (x, y, z) = k2 (x, y, z) = x ⊕ z ⊕ y ⊕ xy Thus the functions F = (f1 , f2 , f3 ), G = (g1 , g2 , g3 ), H = (h1 , h2 , h3 ), K = (k1 , k2 , k3 ), and L = (l1 , l2 , l3 ) are pairwise NPNP-equivalent. Each reversible function can be treated as a permutation. This is why we also recall basic notions connected with permutations. Let A be any set of numbers. A permutation on a set A is a bijective mapping from A to itself. Every permutation can be considered as collection of disjoint cycles. Here such a collection will be called a cycle structure. We will write a cycle in the form , meaning that a1 is mapped onto a2 , ..., ak is mapped onto a1 . It could be written in different ways, e.g., . The number of elements in a cycle is called the length of the cycle. A cycle with the length k is called a k-cycle. A 2-cycle is also called a transposition.

10.3 Previous Work The motivation for our studies of reversible functions toward constructing their classifications is borrowed from the classical logic synthesis by referring to an analogy with related problems. For example, in classical logic synthesis, the equivalence of two functions under permutation of the variables is an important problem due to applications in the synthesis of multiplexer-based field-programmable gate arrays [11, 12]. The problem is called Boolean matching, and two functions match if they have the same P-representative. The extension to NP-representatives is done in [13, 14] in solving the Boolean matching problem in cell-library binding. Classification of Boolean functions is a classical problem in logic synthesis due to its various applications, with fast prototyping and unification of testing procedures being just two of them [15]. However, a considerably smaller amount

222

P. Kerntopf et al.

of work has been done in classification of reversible functions. In [16, 17] it is presented an approach to enumerate equivalence classes of reversible functions with the equivalence classes defined as follows. Denote by G and H the groups of permutations acting on the inputs and outputs of Boolean reversible functions, respectively. Two functions f1 (x) and f2 (x) are equivalent if for each n-tuple x, there is a g  G and an h  H such that f1 (x) = h( f2 (g(x))). It is provided a list of all NPNP-equivalence classes of 3-variable reversible functions as well as a classification based on properties of the inverses of the representative functions for the equivalence classes considered. The lists consist of triples of balanced Boolean functions specified by ESOPs. A technical report from 1962 by Lorens [16] and an article by the same author [17] can be viewed as a starting point of subsequent work on enumeration of equivalence classes of reversible functions by several authors [18–23]. With exception of [22], these publications consider classification of binary reversible functions. These publications were discussed mainly by researchers in combinatorial mathematics and cryptography but hardly used and correspondingly rarely if at all referred within the reversible functions community, the main reason probably being that the term invertible instead of reversible functions has been used. A classification scheme for reversible functions was the subject of a profound study in [24], however, without a concrete solution proposed. Recently, certain aspects of the classification problem have been addressed. In [25], the list of all NPNP-equivalence classes for three variable reversible functions from [17] is presented in the context of a study of complexity of reversible circuits with the representative functions for equivalence classes given in the form of permutations. The minimal number of nonlinear gates needed in the implementation of reversible functions is used as a classification criterion in [26]. The structure of closed classes of reversible functions is described in [27]. Enumeration of equivalence classes under the action of permutation of the inputs and outputs on the domain and the range is presented in [28]. In [6] we showed that the lists published in [17] included (probably typographic) errors and we corrected them. We also solved in [6, 7] several problems of the existence of binary reversible functions with all component functions having the same known property (e.g., symmetry, affinity, linearity, nonlinearity, self-duality, self-complementarity, monotonicity, and unateness). Solutions of such problems for ternary reversible functions are presented by us in [8]. In [9] we presented results on the existence of ternary/multiple-valued reversible functions with all component functions belonging to different P-equivalence classes. In this paper two problems are considered whose solutions have not been published earlier: showing that there exist (1) a reversible Boolean function with all component functions having a linear variable, (2) a reversible Boolean function with all component functions belonging to different P-equivalence classes. We also show how we discovered solutions of these problems by extrapolating some properties of previously found reversible functions of 3- and 4-variables (see [6]).

10 New Results on Reversible Boolean Functions Having Component. . .

223

10.4 Extrapolation Based on Cycle Structures In [29, 30] it has been demonstrated that it is possible to extrapolate some properties of reversible functions by considering their cycle structures. This is why we tried to exploit the same approach to discover infinite sequences of reversible functions with all their component functions having at least one linear variable. First, we were able to check how many such reversible functions exist for n = 3. Namely, in Table 2 of our earlier paper [6] there are 52 NPNP classes of 3-variable reversible functions (denoted R1-R52) and 26 out of these 52 classes of functions possess all component functions depending essentially on all these variables. Among them three classes consist of reversible functions F(c, b, a) all whose component functions have at least one linear variable (let us call such functions in short RevFunCFLVs). Below PPRMs expressions for representatives of these three classes are listed together with the following information: – Sets of linear variables for all component functions. – Cardinality of a class. NPNP Class R28 (Cardinality = 384) A = a ⊕ bc (the set of linear variables = {a}) B = a ⊕ b ⊕ ac (the set of linear variables = {b}) C = a ⊕ b ⊕ c ⊕ ab (the set of linear variables = {c})

NPNP Class R29 (Cardinality = 1152) A = a ⊕ bc (the set of linear variables = {a}) B = a ⊕ b ⊕ ac (the set of linear variables = {b}) C = a ⊕ b ⊕ c ⊕ ac (the set of linear variables = {b})

NPNP Class R32 (Cardinality = 576) A = a ⊕ bc (the set of linear variables = {a}) B = a ⊕ b ⊕ bc (the set of linear variables = {a}) C = a ⊕ c ⊕ bc (the set of linear variables = {a})

224

P. Kerntopf et al.

The above listed PPRM expressions show some regular features. However, our experience is so that extrapolation of such features of PPRMs is very difficult because: (1) usually a component function is obtained which is not balanced, (2) even if all PPRMs correspond to balanced functions, then their collection does not constitute a reversible function. Therefore we have decided to apply extrapolation based on cycle structures. By considering the appropriate mappings {0, 1}3 → {0, 1}3 it is easy to establish that the above three representatives have the following cycle structures (note that here and later on we use the reverse order of variables and component functions and instead of a 3-tuple of binary values (a3 , a2 , a1 ) or (c, b, a) we use its decimal equivalent): The representative of the NPNP class R28: < 0 > < 4 > < 1, 7, 2, 6, 3, 5 >, The representative of the NPNP class R29: < 0 > < 4 > < 5 > < 1, 7, 2, 6, 3 >, The representative of the NPNP class R32: < 0 > < 2 > < 4 > < 1, 7, 6 > < 3, 5 >. However, these cycle structures do not help in formulating conjectures for n > 3. How to get similar results for n = 4 as checking all NPNP classes of 4-variable reversible functions is not possible because of their enormous number? In [6] we calculated all NPN classes of balanced 4-variable functions (presented in Table 1 of [6]). Then we have performed a computational experiment reported in [6]. Let us quote: We have checked that only for the following 18 out of 58 NPN-equivalence classes of balanced Boolean functions up to 4 variables (B1.1, B2.1, B3.1-B3.4, B4.1-B4.52) it is not possible to find four functions belonging to the same class which would constitute a 4variable reversible function: B2.1, B3.2, B4.2, B4.3, B4.4, B4.7 (this class includes only 2 functions), B4.13, B4.15, B4.27, B4.28, B.4.31, B4.33, B4.34, B4.35, B4.38, B4.42, B4.48, B4.51.

Later we found a single representative for each of the NPNP-classes of 4-variable functions which consists of four non-degenerate component functions from the same NPN class of 4-variable balanced functions. Then we have checked that among 52 NPN-equivalence classes of 4-variable balanced functions (Table 1 of [6]) there are 10 classes having at least one linear variable: B4.1, 4.2, B4.3, B4.4, B4.7, B4.8, B4.9, B4.13, B4.15, B4.17. Only four of them lead to RevFunCFLVs depending on all four variables. They are listed below in the same manner as previously 3-variable RevFunCFLVs. NPNP Class Built of Balanced Functions from Class B4.1 (Cardinality = 64) A = a ⊕ bcd (the set of linear variables = {a}) B = b ⊕ ac ⊕ acd (the set of linear variables = {b})

10 New Results on Reversible Boolean Functions Having Component. . .

225

C = c ⊕ ad ⊕ abd (the set of linear variables = {c}) D = d ⊕ ab ⊕ abc (the set of linear variables = {d}) NPNP Class Built of Balanced Functions from Class B4.8 (Cardinality = 192) A = a ⊕ b ⊕ c ⊕ bc ⊕ bcd (the set of linear variables = {a}) B = a ⊕ b ⊕ bc ⊕ bd ⊕ cd ⊕ bcd (the set of linear variables = {a}) C = a ⊕ c ⊕ bc ⊕ bd ⊕ cd ⊕ bcd (the set of linear variables = {a}) D = a ⊕ d ⊕ ab ⊕ ac ⊕ bc ⊕ abc (the set of linear variables = {d})

NPNP Class Built of Balanced Functions from Class B4.9 (Cardinality = 96) A = a ⊕ b ⊕ bd ⊕ cd (the set of linear variables = {a}) B = a ⊕ c ⊕ bc ⊕ bd (the set of linear variables = {a}) C = a ⊕ d ⊕ bc ⊕ cd (the set of linear variables = {a}) D = a ⊕ c ⊕ d ⊕ bd ⊕ cd (the set of linear variables = {a})

NPNP Class Built of Balanced Functions from Class B4.17 (Cardinality = 32) A = a ⊕ b ⊕ bc ⊕ bd ⊕ cd (the set of linear variables = {a}) B = b ⊕ c ⊕ ac ⊕ ad ⊕ cd (the set of linear variables = {b}) C = a ⊕ c ⊕ ab ⊕ ad ⊕ bd (the set of linear variables = {c}) D = a ⊕ b ⊕ c ⊕ d ⊕ ab ⊕ ac ⊕ bc (the set of linear variables = {d})

226

P. Kerntopf et al.

The above 4 representatives of RevFunCFLVs have the following cycle structures: < 0 >< 1 >< 2 >< 4 >< 6 >< 8 >< 10 >< 12 > < 3, 11 >< 5, 7 >< 9, 13 >< 14, 15 > < 0 >< 8 >< 1, 15 >< 2, 3, 4, 5 >< 6, 9, 7, 14 >< 10, 13, 12, 11 > < 0 >< 5 >< 4, 10, 6, 13 >< 1, 15, 8, 12, 11, 9, 3, 14, 7, 2 > < 0 >< 7 >< 8 >< 15 >< 1, 13, 4, 14, 2, 11 >< 3, 10, 6, 12, 5, 9 >, respectively. It is possible to extrapolate the information collected by us about 3- and 4-variable RevFunCFLVs in many ways. First, let us note that there are no simple similarities between cycle structures for 3-variable and 4-variable functions. However, it can be noticed that the cycle structure of the first of the 4-variable representatives is the simplest one, consisting of just 4 transpositions (besides 1element cycles): < 3, 11 >< 5, 7 >< 9, 13 >< 14, 15 > Let us look closer at these transpositions expressing their elements as binary strings and change the order of transpositions in the following way: 15 7 13 11 1111 0111 1101 1011 1110 0101 1001 0011 14 5 9 3 In each of the pairs of binary strings forming a transposition the strings differ exactly in one bit. Moreover, we can observe the following property: – In the first transposition the value of the first position from right is changing. – In the second transposition the value of the second position from right is changing. – In the third transposition the value of the third position from right is changing. – In the fourth transposition the value of the fourth position from right is changing. It is easy to extrapolate these properties and below we show that it leads to the desired infinite sequence of RevFunCFLVs.

10 New Results on Reversible Boolean Functions Having Component. . .

227

10.5 Component Functions Having Linear Variables In this section the existence of Boolean reversible functions with all component functions having at least one linear variable will be proved. Definition 10.8 The reversible Boolean function Gn (xn , xn−1 , . . . , x1 ), n ≥ 3, is defined in such a manner that all non-identical mappings of variable assignments in Gn can be partitioned into transpositions as follows: 1. one of the elements of the first transposition has weight n, 2. one of the elements of the other transpositions has weight n−1 and the only bit 0 in them is moving in a cycle: (a) In the second transposition 0 is at the first position from left; (b) In the third transposition 0 is at the second position from right; (c) In the fourth transposition 0 is at the third position from right; ... (d) In the nth transposition 0 is at the (n−1)th position from right (another words, at the second position from left). 3. the second element of the ith transposition differs from the first element of the same transposition in ith bit from right. Example 10.3 Let n = 6. Then the cycle structure of function Gn consists of the following six transpositions: 63 111111 111110 62

31 011111 011101 29

61 111101 111001 57

59 111011 110011 51

55 110111 100111 39

47 101111 001111 15

By a projection function it is meant a function of one variable. Notice that the ith component function gi of Gn differs from the projection function xi only in two bits which are swapped according to (n−i + 1)th transposition above. Theorem 10.1 Each n∗ n function Gn is reversible for any n ≥ 3. Proof. The function Gn is reversible because it is a bijective mapping. Namely, non-identical mappings of variable assignments in Gn form a set of transpositions. Lemma 10.2 The values of the ith component function of the n∗ n reversible function Gn differ from the values of the projection function xi only for two assignments (as a result of swapping two values according to definition of Gn ). Proof. This property follows from the manner in which the transpositions for function Gn are constructed (see Definition 10.8 and Example 10.3). Theorem 10.2 Any component function fi of the reversible Boolean function Gn is linear with respect to the variable xi for n ≥ 3.

228

P. Kerntopf et al.

Proof. A function f is linear with respect to the variable xi iff negating xi is equivalent to negating the function itself (see Lemma 10.1). It can be easily shown that swapping two values (see Lemma 10.1) of component function fi of the reversible function Gn does not influence the property formulated in the first sentence of this proof.

10.6 Component Functions Belonging to Different P-Classes Now we are going to show that for n ≥ 3 there exist Boolean reversible functions whose all component functions belong to different P-classes. Again, first we study cycle structures of selected functions of small numbers of variables and next try to apply extrapolation. We have checked in Table 2 of our paper [6] how many such reversible functions exist for n = 3. It was noted in Sect. 10.4 that there are 26 NPNP-classes of 3-variable functions (R27–R52) that possess all component functions depending essentially on all three variables. Among them there is only one class that consists of reversible functions all whose component functions belong to different NPN-classes. It is shown below in the same manner as previously 3-variable RevFunCFLVs. NPNP Class R40 (Cardinality = 2304) A = a ⊕ bc B = b ⊕ ac ⊕ bc C = a ⊕ c ⊕ ab ⊕ ac ⊕ bc Its cycle structure is as follows: < 0 >< 2 >< 3 >< 4 >< 1, 5, 7, 6 > . Let us note that binary n-tuples in the unique cycle having more than one element form a regular pattern: 001 101 111 110

10 New Results on Reversible Boolean Functions Having Component. . .

229

Namely, it is easy to note that – The first and the second n-tuples differ only in the 1st bit position, – The second and the third n-tuples differ only in the 2nd bit position, – The third and the forth n-tuples differ only in the 3rd bit position. Thus we observe here a certain periodicity which can be easily extrapolated leading to the desired infinite sequence of reversible functions as will be seen later. In this case extrapolating was even simpler than in the previous section. Definition 10.9 A set of variable assignments over {0, 1} with specified numbers of m 0s and n 1s is called a block and denoted by bm,n . Example 10.4 The set of all 8 variable assignments for three variable Boolean functions can be partitioned into the following four blocks: b3,0 = {000} b2,1 = {001, 010, 100} b1,2 = {011, 101, 110} b0,3 = {111} . Definition 10.10 For any Boolean function f let B0 (f ) and B1 (f ) denote the sets of blocks including all variable assignments for which f is equal 0 and 1, respectively. Example 10.5 Let us consider the following Boolean projection functions: f (x3 , x2 , x1 ) = x3 , g (x3 , x2 , x1 ) = x2 , h (x3 , x2 , x1 ) = x1 . Then B 0 (f ) = { {000} , {001, 010} , {011} } B 1 (f ) = { {100} , {101, 110} , {111} } B 0 (g) = { {000} , {001, 100} {101} } B 1 (g) = { {010} , {011, 110} , {111} } B 0 (h) = { {000} , {010, 100} , {110} } B 1 (h) = { {001} , {011, 101} , {111} } Notice that for each 3-variable Boolean reversible function k the union of B0 (k) and B1 (k) is equal to the set of all 8 Boolean variable assignments. For each of the component functions of an arbitrary reversible function cardinalities of unions of their Bi sets are the same.

230

P. Kerntopf et al.

Example 10.6 Let us consider a 3-variable Boolean reversible function F(x3 , x2 , x1 ) = (f3 , f2 , f1 ) defined in such a manner that the only non-identical mappings of variable assignments in F are as follows: 001 → 101 101 → 111 111 → 110 110 → 001 When we consider the reversible function F as a permutation of output assignments it is a single cycle of four elements: < 001, 101, 111, 110 > Notice that in the above mappings – – – –

In the first row the leftmost bit is being negated, In the second row the second bit is being negated. In the third row the third bit is being negated. In the fourth row all bits are being negated.

This observation will be generalized later to functions of any number of variables. Now let us note what changes have been done in the sets Bi , 0 ≤ i ≤ 1, for functions f3 , f2 , and f1 , in comparison with the sets for the function in Example 10.5 (only assignments moved to another block are shown bolded and underlined): B 0 (f3 ) = B 0 (f2 ) = B 0 (f1 ) =



     {000} , {010} , 011, 110 , B 1 (f3 ) = 001, 100 , {101} , {111} ,



      {000} , {001, 100} , 110 , B 1 (f2 ) = {010} , 011, 101 , {111} ,



     {000} , {010, 100} , 111 , B 1 (f1 ) = {001} , {011, 101} , 110 .

Let us summarize the above observations (notation from Example 10.5 is used below). The values of the function f3 differ from the values of the projection function x3 only for the assignments 001 and 110. Namely, we can notice that f (0, 0, 1) = 0, f3 (0, 0, 1) = 1, f (1, 1, 0) = 1, f3 (1, 1, 0) = 0. As a result, the function f3 can be obtained from the projection function x3 by swapping its values for variable assignments 001 and 110.

10 New Results on Reversible Boolean Functions Having Component. . .

231

Values of each of the other two component functions, f2 and f1 , also differ from the values of the corresponding projection functions only for two assignments. Swaps for f2 in comparison with the projection function x2 are as follows: g (1, 0, 1) = 0, f2 (1, 0, 1) = 1, g (1, 1, 0) = 1, f2 (1, 1, 0) = 0, Swaps for f1 in comparison with the projection function x1 are as follows: h (1, 1, 1) = 1, f1 (1, 1, 1) = 0, h (1, 1, 0) = 0, f1 (1, 1, 0) = 1. Let us show that component functions f2 and f1 belong to different P-equivalence classes. Assume that f2 and f1 belong to the same P-equivalence class. Then, since any permutation over the variable set {x3 , x2 , x1 } does not change the assignment 111 there should be f1 (1, 1, 1) = f2 (1, 1, 1); however, f1 (1, 1, 1) = 0 and f2 (1, 1, 1) = 1. It is in contradiction with our assumption that f2 and f1 belong to the same P-equivalence class. Thus f2 and f1 belong to different P-equivalence classes. In a similar manner it can be shown that the other two pairs of component functions of F, (f3 , f2 ) and (f3 , f1 ), belong to different P-equivalence classes. Let us show that component functions f3 and f2 belong to different P-equivalence classes. Assume that f3 and f2 belong to the same P-equivalence class. Then, any permutation over the variable set {x3 , x2 , x1 } changes variable assignments with specified numbers of 0s and 1s only within one block. Let us consider the block b1,2 = {011, 101, 110} . Note that f2 (0, 1, 1) = f2 (1, 0, 1) = 1, f2 (1, 1, 0) = 0. However, f3 (0, 1, 1) = f3 (1, 0, 1) = f3 (1, 1, 0) = 1. Hence f2 cannot be transformed to f3 by permutation of variables. It is in contradiction with our assumption that f3 and f2 belong to the same P-equivalence class. Thus f3 and f2 belong to different P-equivalence classes. Now let us show that component functions f3 and f1 belong to different Pequivalence classes. Assume that f3 and f1 belong to the same P-equivalence class. Consider the block b1,2 = {011, 101, 110} . Note that f1 (0, 1, 1) = f1 (1, 0, 1) = f1 (1, 1, 0) = 1. However, f3 (0, 1, 1) = 0, f3 (1, 0, 1) = f3 (1, 1, 0) = 1. Hence f1 cannot be transformed to f3 by permutation of variables. It is in contradiction with our assumption that f3 and f1 belong to the same P-equivalence class. Thus f3 and f1 belong to different P-equivalence classes.

232

P. Kerntopf et al.

Now the above presented methodology of proving that two component functions of F belong to different P-equivalence classes will be extended to Boolean reversible functions of any number of variables. To prove that Boolean reversible functions with all component functions belonging to different P-equivalence classes exist for any number of variables n ≥ 3, we will define the following infinite sequence of reversible functions. Definition 10.11 The reversible Boolean function Hn (xn , xn−1 , . . . , x1 ) = ( fn , fn−1 , . . . , f1 ), n ≥ 3, is defined in such a manner that the only non-identical mappings of variable assignments in Hn are as follows (N denotes negation): an , an−1 , . . . , a1 → Na n , an−1 , . . . , a1 N a n , an−1 , . . . , a1 → Na n , Na n−1 , . . . , a1 ... N a n , Na n−1 , . . . , Na 2 , a1 → Na n , Na n−1 , . . . , N a 2 , Na 1 N a n , Na n−1 , . . . , Na 2 , Na 1 → an , an−1 , . . . , a1 , where the starting variable assignment is as follows: an an−1 an−2 . . . a2 a1 = 0 0 0 . . . 0 1. Notice that in the ith row of the mappings in Definitions 10.1 and 10.11 ≤ i ≤ n, the ith bit is being negated, and in the last mapping all bits are being negated. When we consider the function Hn as a permutation of variable assignments it is a single cycle of n + 1 elements: < an , an−1 , . . . , a1 , Nan , an−1 , . . . , a1 , Nan , Nan−1 , . . . , a1 , ..., Nan , Nan−1 , . . . , N a2 , a1 , Nan , Nan−1 , . . . , N a2 , Na1 > . Theorem 10.3 Each n∗ n function Hn is reversible for any n ≥ 3, where Hn is formulated in Definition 10.11. Proof. Because non-identical mappings of variable assignments in Hn form a single cycle so this function is bijective for any n ≥ 3. Hence it is reversible. Lemma 10.3 The values of the ith component function of the n∗ n reversible function Hn differ from the values of the projection function xi only for two assignments (it is a result of swapping two values). Proof. This property follows from the manner in which the cycle for function Hn is constructed in Definition 10.11 (e.g., compare sets B0 , B1 in Examples 10.5 and 10.6).

10 New Results on Reversible Boolean Functions Having Component. . .

233

Theorem 10.4 Any two component functions fr and fs of the Boolean reversible function Hn belong to different P-equivalence classes for n ≥ 3. Proof. Let us write the cycle defining the function Hn (xn , xn−1 , . . . , x1 ) = ( fn , fn−1 , . . . , f1 ) in the form: , where u1 = 000 . . . 001 u2 = 100 . . . 001 u3 = 110 . . . 001 ... un−1 = 111 . . . 101 un = 111 . . . 111 un+1 = 111 . . . 110. Thus the only non-identical mappings of variable assignments in Hn are as follows: 0, 0, . . . , 01 → 1, 0, . . . , 0, 1 1, 0, . . . , 01 → 1, 1, . . . , 0, 1 ... 1, 1, . . . , 0, 1 → 1, 1, . . . , 1, 1 1, 1, . . . , 1, 1 → 1, 1, . . . , 1, 0 1, 1, . . . , 1, 0 → 0, 0, . . . , 0, 1. Thus Hn (ui ) = ui+1 for 1 ≤ i ≤ n and Hn (un+1 ) = u0 . Notice that ui ∈ bn − i, i , 1 ≤ i ≤ n and un + 1 ∈ b1, n − 1 . For any n the number of all assignments in the block n! bn − i, i is equal (n−i)!i! and the block b1, n − 1 contains exactly n assignments. For an arbitrary selected k-th bit, 1 ≤ k ≤ n, there are

(n−1)! (n−i−1)!(i)!

assignments belonging to

(n−1)! assignments bn − i, i and having this k-th bit equal 0. Similarly, there are (n−i)!(i−1)! belonging to bn − i, i and having the k-th bit equal 1. Also, fk (u) = 0 if the k-th bit in the input assignment is 0 (e.g., for n > 3: f2 (u1 ) = 0; f3 (u1 ) = 0,..., fn−1 (u1 ) = 0, fn (u1 ) = 1). For 1 < k ≤ n we have fk (un−k+1 ) = 1 and f1 (un ) = 0. Let us consider the following two cases with respect to i:

A. 1 ≤ i < n • B0 (fk = n−i+1 ) contains • B1 (fk = n−i+1 ) contains

(n−1)! (n−i−1)!i! assignments from bn − i, i , (n−1)! (n−i)!(i−1)! assignments from bn − i, i .

On the other hand, since fk = i (ui ) = 1, so • B 0 (fk = n−i+1 ) contains • B 1 (fk = n−i+1 ) contains

(n−1)! (n−i−1)!i! − 1 assignments from bn − i, i , (n−1)! (n−i)!(i−1)! + 1 assignments from bn − i, i .

234

P. Kerntopf et al.

Thus for any i, 1 ≤ i < n, B1 (fk = n−i + 1 ) and B1 (fk = n−i + 1 ) have different numbers of assignments from the block bn-i,i so the function fk = n−i+1 cannot be transformed to fk = n−i+1 by permutation of variables, as it only changes assignments within the block bn-i,i . B. i = n (i.e., n–i + 1 = 1) • • • •

B1 (fk = 1 ) contains one assignment from b0,n , B1 (fk = 1 ) contains no assignments from b0,n , B0 (fk = 1 ) contains n assignments from b1,n−1 , B0 (fk = 1 ) contains n + 1 assignments from b1,n−1 .

Thus B1 (fk = 1 ) and B1 (fk = 1 ) as well as B1 (fk = 1 ) and B1 (fk = 1 ) have different numbers of assignments from the blocks b0,n and b1,n−1 , respectively. So the function fk = n−i + 1 cannot be transformed to fk = n−i + 1 , for any 1 ≤ i ≤ n, by permutation of variables, as it changes assignments within the corresponding blocks. Hence, if i = j, then fi and fj belong to different P-equivalence classes. It is obvious that by Theorem 10.4 the following result holds. Corollary 10.1 For any n ≥ 3 there exist ternary reversible functions having all component functions that belong to different P-equivalence classes.

10.7 Conclusions and Future Work The paper presents two new results on properties of component functions of Boolean reversible functions. The main subject of the paper is showing that the solutions in this area can be found by extrapolation of cycle structures for 3- and 4-variable Boolean reversible functions obtained in the course of enumerative computations. Namely, the solutions of the two problems have been discovered by using our extrapolation approach. The solved problems are as follows: (1) for any n ≥ 3 there exists a Boolean reversible function with all component functions having at least one linear variable, (2) for any n ≥ 3 there exists a Boolean reversible function with all component functions belonging to different P-equivalence classes. We plan using the abovementioned results together with our previous results presented in [6, 7] to construct a classification of reversible Boolean functions which would be useful in the synthesis of reversible circuits. Acknowledgements The authors acknowledge partial support of COST Action IC1405 on “Reversible Computation - Extending Horizons of Computing.”

10 New Results on Reversible Boolean Functions Having Component. . .

235

References 1. de Vos, A.: Reversible Computing: Fundamentals, Quantum Computing, and Applications. Wiley, Weinheim (2010) 2. Saeedi, M., Markov, I.L.: Synthesis and optimization of reversible circuits: a survey. ACM Comput. Surv. 45(2), 21 (2013) 3. Soeken, M., Wille, R., Keszocze, O., Miller, D.M., Drechsler, R.: Embedding of large Boolean functions for reversible logic. J. Emerg. Technol. Comput. Syst. 12(4), 41 (2015).; also available as preprint arXiv.org:1408.3586, August 15, 2014 4. Carlet, C.: Vectorial Boolean functions for cryptography. In: Crama, Y., Hammer, P. (eds.) Boolean Models and Methods in Mathematics, Computer Science, and Engineering, pp. 398– 472. Cambridge University Press, Cambridge (2010) 5. Tokareva, N.: Bent Functions. Results and Applications to Cryptography. Academic Press, London (2015) 6. Kerntopf, P., Moraga, C., Podlaski, K., Stankovi´c, R.S.: Towards classification of reversible functions. In: Steinbach, B. (ed.) Proceedings of the 12th International Workshop on Boolean Problems, pp. 21–28 (2016) 7. Kerntopf, P., Moraga, C., Podlaski, K., Stankovi´c, R.S.: Towards classification of reversible functions with homogeneous component functions. In: Steinbach, B. (ed.) Further Improvements in the Boolean Domain, pp. 386–406. Cambridge Scholars Publishing, Newcastle upon Tyne (2018) 8. Kerntopf, P., Podlaski, K., Moraga, C., Stankovi´c, R.S.: Study of reversible ternary functions with homogeneous component functions. In: Proceedings of the 47th IEEE International Conference on Multiple-Valued Logic, pp. 191–196 (2017) 9. Kerntopf, P., Stankovi´c, R.S., Podlaski, K., Moraga, C.: Ternary/MV reversible functions with component functions from different equivalence classes. In: Proceedings of the 48th IEEE International Conference on Multiple-Valued Logic, pp. 109–114 (2018) 10. Tsai, C.-C., Marek-Sadowska, M.: Boolean functions classification via fixed polarity ReedMuller forms. IEEE Trans. Comput. 46(2), 173–186 (1997) 11. Debnath, D., Sasao, T.: Fast Boolean matching under variable permutation using representative. In: Proceedings of the Asia and South Pacific Design Automation Conference, pp. 359–362 (1999) 12. Debnath, D., Sasao, T.: Efficient computation of canonical form for Boolean matching in large libraries. In: Proceedings of the Asia and South Pacific Design Automation Conference, pp. 591–596 (2004) 13. Debnath, D., Sasao, T.: Fast Boolean matching under permutation by efficient computation of canonical form. IEICE Trans. Fundam. Electron. Commun. Comput. Sci. E87-A, 3134–3140 (2004) 14. Debnath, D., Sasao, T.: Efficient computation of canonical form under variable permutation and negation for Boolean matching in large libraries. IEICE Trans. Fundam. Electron. Commun. Comput. Sci. E89-A(12), 3443–3450 (2006, Special Section on VLSI Design and CAD Algorithms) 15. Stankovi´c, R.S., Astola, J.T., Steinbach, B.: Former and recent work in classification of switching functions. In: Steinbach, B. (ed.) Proceedings of the 8th International Workshop on Boolean Problems, pp. 115–126 (2008) 16. Lorens, C.S.: Invertible Boolean Functions. Space-General Corp, El Monte (1962) 17. Lorens, C.S.: Invertible Boolean functions. IEEE Trans. Electron. Comput. EC-13(5), 529–541 (1964) 18. Harrison, M.A.: The number of classes of invertible Boolean functions. J. ACM. 10, 25–28 (1963) 19. Strazdins, I.E.: On the number of types of invertible binary networks. Avtomatika Vychislitelnaya Tekhnika. 1, 30–34 (1974) 20. Primenko, E.A.: Invertible Boolean functions and fundamental groups of transformations of algebras of Boolean functions. Avtomatika Vychislitelnaya Tekhnika. 3, 17–21 (1976)

236

P. Kerntopf et al.

21. Primenko, E.A.: On the number of types of invertible Boolean functions. Avtomatika Vychislitelnaya Tekhnika. 6, 12–14 (1977) 22. Primenko, E.A.: On the number of types of invertible transformations in multivalued logic. Kibernetika. 5, 27–29 (1977) 23. Primenko, E.A.: Equivalence classes of invertible Boolean functions. Kibernetika. 6, 1–5 (1984) 24. Rice, J.E.: Considerations for determining a classification scheme for reversible Boolean functions. Technical report TR-CSJR2–2007, University of Lethbridge, Lethbridge (2007) 25. Soeken, M., Abdessaied, N., de Micheli, G.: Enumeration of reversible functions and its application to circuit complexity. In: Devitt, S., Lanese, I. (eds.) Reversible Computation. Proceedings of the 8th International Conference, RC 2016, Bologna, Italy, July 7–8, 2016, Lecture Notes in Computer Science, vol. 9720, pp. 255–270, Springer, Cham (2016) 26. Draper, T.G.: Nonlinear complexity of Boolean permutations. PhD thesis, University of Maryland, College Park (2009) 27. Aaronson, S., Grier, D., Schaeffer, L.: The classification of reversible bit operations. Preprint arXiv:1504.05155 [quant-ph], 68 p. (2015) 28. Cari´c, M., Živkovi´c, M.: On the number of equivalence classes of invertible Boolean functions under action of permutation of variables on domain and range. Publications de l’Institut Mathématique. 100(114), 95–99 (2016)., also available as preprint arXiv:1603.04386v2 [math.CO], 9 pages, April 6, 2016 29. Jegier, J., Kerntopf, P., Szyprowski, M.: An approach to constructing reversible multi-qubit benchmarks with provably minimal implementations. In: Proceedings of the 13th IEEE International Conference on Nanotechnology, pp. 99–104 (2013) 30. Jegier, J., Kerntopf, P.: Progress towards constructing sequences of benchmarks for quantum Boolean circuits synthesis. In: Proceedings of the 14th IEEE International Conference on Nanotechnology, pp. 250–255 (2014)

Chapter 11

Efficient Hardware Operations for the Residue Number System by Boolean Minimization Danila Gorodecky and Tiziano Villa

11.1 Introduction The idea of the residue number system (RNS) goes back to an ancient Chinese source showing how to convert residues into numbers, and was later formalized by C.F. Gauss in the nineteenth century. Since the advent of digital computers, there have been many papers proposing algorithms to implement efficiently RNS on computers. The main advantage of RNS is the speed and reliability of arithmetic computations [3, 21, 23]. The first application of RNS was in the search of prime numbers. Nowadays implementations of RNS can be found in anti-aircraft systems [12], neural computations [3], real-time signal processing (pattern recognition) [6], and cryptography [17]. Modular arithmetic (MA) is effective for processing large data flows (with several hundreds or thousands bits) [15]. So RNS allows to increase significantly hardware performance and to upgrade reliability and noise immunity in signal processing and data transferring. A conference was held in 2005 in Russia on the 50th anniversary of the introduction of RNS in scientific computations [9], and it was reported on the key role of RNS in radars, in space and military aircraft (e.g., Sukhoi) data transferring, and in other important technologies. This contribution describes an efficient combinational hardware computation of modular multiplication and of the modulus function (X(mod P )) for an arbitrary modulo. We report also experimental results and compare with industrial tools.

D. Gorodecky () National Academy of Science of Belarus, Minsk, Belarus e-mail: [email protected] T. Villa University of Verona, Verona, Italy e-mail: [email protected] © Springer Nature Switzerland AG 2020 R. Drechsler, M. Soeken (eds.), Advanced Boolean Techniques, https://doi.org/10.1007/978-3-030-20323-8_11

237

238

D. Gorodecky and T. Villa

11.2 Basic Knowledge About RNS The Chinese reminder theorem [4] states that there is a one-to-one correspondence between a set of residues X1 , X2 , . . . , Xn and a number from 0 to p1 · p2 · . . . · pn − 1 = P − 1. Since the value of the represented number is invariant under any permutation of the residues, RNS is a non-positional number system. These features make RNS an alternative system with pros and cons compared with other systems of representation. For example, on one side it allows to parallelize computations and hence to speed them up, on the other side it does not allow to compare two numbers represented by their residues and figure out which one is greater without additional operations like backward conversion into the positional system. RNS is a form of parallel data processing, where computer arithmetic is performed using the residues of the division by a pre-selected base of co-primes moduli {p1 , p2 , . . . , pm }. The residues have a lower number of digits than the original numbers and arithmetic operations over the residues can be performed separately for each modulo of the base, resulting in faster processing (e.g., faster addition and multiplication), compared to other forms of parallel data processing. The parallelism is achieved by computing on the residues. The residues (A1 , B1 , A2 , B2 , . . . , An , Bn ) are the results of division of the input numbers (A and B) by s pre-selected set of co-primes (p1 , p2 , . . . , pn )—moduli, where p1 · p2 · . . . · pn = P . Computing in RNS is not restricted to arithmetic operations with two operands, and it is suitable for an arbitrary number of operands. Data processing in RNS includes the following steps. First, input operands A1 , A2 , . . . , An are converted from positional to modular representations computing the remainders (or residues) with respect to the moduli {p1 , p2 , . . . , pm } (see left block in Fig. 11.1); then arithmetic operations over the residues of the operands for each modulo pi , where i = 1, . . . , n, are computed (middle block in Fig. 11.1); finally, the results S1 , S2 , . . . , Sm for each modulo are converted back from modular to positional representations S (see right block in Fig. 11.1). Conversion into modular representation (direct conversion) is realized by the modulo X(mod P ) function, whose result is fed into the second step of operations. The second step of the RNS computation requires performing modular summation, multiplication, and other arithmetic functions such as A · B + C. The third step in RNS computes the polynomial form S1 · C1 + S2 · C2 + . . . + Sm · Cm − P · r, where S1 , S2 , . . . are outputs of the previous step, C1 , C2 , . . . are pre-calculated constants, r is a constant which is obtained during the computation of the polynomial, and P = p1 · p2 · . . . · pm . In other words the third step in RNS computes (S1 · C1 + S2 · C2 + . . . + Sm · Cm )(mod P ). Therefore, the main arithmetic operations needed for RNS computations are the modulo function X(mod P ), modular summation, and modular multiplication. For instance, A = 37, B = 19, and P = p1 · p2 · p3 = 3 · 5 · 7 = 105. In this case A1 = 1, B1 = 1, A2 = 2, B2 = 4, A3 = 2, B3 = 5, i.e., A = (1, 2, 2) and B = (1, 4, 6). In this case, addition is produced by summing residues with

11 Hardware Realization of Arithmetic Operations

239

Fig. 11.1 Common structure of RNS

the appropriate index, i.e., A + B = ((A1 + B1 ) mod p1 , (A2 + B2 ) mod p2 , (A3 + B3 ) modp3 ) = (2, 1, 0) = S. There are a couple of ways to convert a number S into a positional number. The most common one is based on the following formula: Z =(X1 · Y1 + X2 · Y2 + . . . + Xn · Yn ) mod P =X1 · Y1 + X2 · Y2 + . . . + Xn · Yn − k · P , where k is a natural number and Yi = q·

P pi

(11.1)

· q, where q should satisfy the condition

pi ) = 1, i = 1, 2, . . . , n and q = 1, 2, . . . , pi − 1. By this formula P pi (mod

S = 2 · 70 + 1 · 21 + 0 · 15 = 161 − 1 · 105 = 56, 105 105 where: Y1 = 105 3 · 2, because 2 · 3 (mod 3) = 1; Y2 = 5 · 1, because 1 · 105 105 105 5 (mod 5) = 1; Y3 = 7 · 1, because 1 · 7 (mod 7) = 1. There are a couple of significant limits of RNS implementation for wide range computing, namely the conversion from the positional system to RNS and backward. In fact, no one electronic design automation (EDA) tool (but Synopsys) can generate a circuit to compute the modulus function. The exception is when modulus P = 2δ , where δ is a natural number, because an arbitrary number with modulus 2δ equals the δ least significant bits of this number. Otherwise, the problem is computationally hard. Backward conversion is slightly easier, because it consists of multipliers and summators (as shown in formula (11.1)). But, eventually, either the modulus function with modulo P must be computed or a comparison with the value k · P must be performed many times in order to find k, or the conventional

240

D. Gorodecky and T. Villa

mixed-radix approach [16] must be applied, in all cases decreasing significantly the performance of the conversion. In practice both problems are solved by choosing from a small set of special moduli, which limits the applicability of RNS.

11.3 Computation of the Modulo Function The modulus function calculation (X(mod P )) is a basic arithmetic operation in cryptography and in the residue number system (RNS). In both cases one must handle huge numbers X with hundreds and thousands of bits. However, there is a significant difference between the two areas in the requirements to compute X(mod P ). The value of P in cryptography is a prime number or one which can be factored with 2 or rarely 3 factors, i.e., P = p1 · p2 · p3 , where p1 , p2 , p3 are prime numbers. In RNS, P can be factored with n factors, where n can be of the order of a few dozens, i.e., P = p1 · p2 · . . . · pn . Despite this difference, the hardware implementation of the modulus function is a bottleneck for both areas. A major limitation when processing large numbers in RNS is the complexity of hardware realization of converters (left and right blocks in Fig. 11.1). This is due to the fact that to compute the modulus function and to recover the positional representation one should perform division, modular multiplication, and comparison. There are different approaches to solve this problem (e.g., [3, 5, 23]), but, mostly, they are restricted with respect to the modular values (e.g., mod 2k −1, mod 2k , mod 2k +1) and to the number of operands. Cryptography demands that the factors of P be as hard as possible. This fact significantly increases the complexity of hardware realization, since an efficient hardware implementation of X(mod P ) for an arbitrary P is unknown. In RNS all factors of P are known. Moreover p1 , p2 , . . . , pn are selected as special numbers for which it is known an efficient hardware realization. But the problem is that the set of special numbers, for which efficient algorithms are known, is very limited. This is the main fact which restricts wide RNS deployment. There are existing [13] approaches for X(modP ) design in hardware, but they are sequential or/and they exhibit high hardware costs and low performance compared with approaches for special number sets. A unit for modulus function computation can be designed with sequential elements, but they require bigger areas and they are slower compared with combinational approaches. On the other hand, the availability of memory allows to compute X(mod P ) for arbitrary value of P and to pipeline the computation. Sequential realizations may store pre-calculated values of the modulus function [10, 13], or be computed by an automaton model [22], or they may resort to pipelining using a chain of homogeneous arithmetic blocks [2]. A pipelining model is based on combinational logic, where pipelining stages are separated by triggers (latches). More recent designs avoid the use of memory elements and use combinational logic to a large extent, and shortly we will consider some of them.

11 Hardware Realization of Arithmetic Operations

241

11.3.1 Approach Based on Reducing the Input Bit-by-Bit In [2], the authors proposed a sequence made by a chain of homogeneous arithmetic blocks, and combinational architectures for pseudorandom number generator. This yields a modulus function architecture based on the following representation: X =P ·Q+R = P · 2δ · qδ + P · 2δ−1 · qδ−1 + . . . + P · 20 · q0 + R

(11.2)

and X(mod P ) = R, where X = (xψ , xψ−1 , . . . , x1 ) and δ is defined by the inequality P · 2δ+1 < 2ψ − 1 ≤ P · 2δ . Notice that P can be an arbitrary number. Every computational block executes comparison, multiplexing, multiplication by a constant, and subtraction. For instance, X = (x10 , x9 , . . . , x1 ) and P = 21, hence δ = 5. In this case (11.2) takes the following form: X = 21 · Q + R = 21 · 25 · q5 + 21 · 24 · q4 + 21 · 23 · q3 + 21 · 22 · q2 + 21 · 21 · q1 + 21 · 20 · q0 + R. This representation consists of seven addends, where the last R is the result of a modulus function computation and the remaining six addends represent an arithmetic unit. We assign X = X5 as input of the first unit; X4 is the output of the first unit and the input of the second unit; X3 is the output of the second unit and the input of the third unit; X2 is the output of the third unit and the input of the fourth unit; X1 is the output of the fourth unit and the input of the fifth unit; X0 is the output of the fifth unit and input of the sixth unit; R is the output of the sixth unit and the result of the X(mod 21) computation. Assume that X = 888. Thus X = 888 (mod 21) will be computed by the following six steps: – – – – – –

as X5 as X4 as X3 as X2 as X1 as X0

≥ 21 · 25 , i.e., 888 ≥ 672, then X4 = 888 − 21 · 25 = 216; < 21 · 24 , i.e., 216 < 336, then X3 = 216; ≥ 21 · 23 , i.e., 216 ≥ 168, then X2 = 216 − 21 · 23 = 48; < 21 · 22 , i.e., 48 < 84, then X1 = 48; ≥ 21 · 21 , i.e., 48 ≥ 42, then X0 = 48 − 21 · 21 = 6; < 21 · 20 , i.e., 6 < 21, then R = 6.

This approach can be pipelined (1-dimensional) very efficiently by including triggers between homogeneous blocks; moreover, it can be simplified by optimizing the arithmetic operations in every block [7] and organizing a 2-dimensional systolic matrix.

242

D. Gorodecky and T. Villa

11.3.2 Approach Based on the Periodic Property of Powers of Two Another approach is based on using the periodic property of residues of 2k (mod P ) [13, 14, 18]. Denoting 2j ≡ 1(mod P ), it is known that 2α·j +i ≡ 2i (mod P ), if value α is the period of the modulus P . It means that an n-bit input can be split into j α-bit vectors starting from the least significant bits. The value “j ” is “order” and can be P − 1 or less. Considering the example from [13], let P = 19 and X = 8988716617110 = 00010100111011011011000101001110110110112 , then α = 18. Thus, the three (as α = 18) 18-bit vectors (adding 14 bits as the most significant to the third vector) can be added to obtain: 00 0000 0000 0000 0001 01 0011 1011 0110 1100 01 0100 1110 1101 1011 10 1000 1010 0100 1000 This corresponds to 166,472. The residue of this 18-bit number can be obtained next by adding the residues of various powers of 2(mod 19). In short, the periodic property of 2k mod m has been used to simplify the computation. Further simplification is possible for moduli satisfying the property 2(P −1)/2 (mod P ). Considering P = 19, we observe that 29 = −1(mod 19), 210 = −2(mod 19), . . . , 217 = 10(mod 19), 218 = 1(mod 19) and 219 = 2(mod 19), etc. [13]. Thus, the residues in the upper half of a period are opposite in sign to those in the lower half of the period. Denoting the successive words of half period length as W0 , W1 , . . . , Wα , (α−1)/2 $ # (α−1)/2   W2i − W2i+1 [13]. For the where α is odd, we need to estimate i=0

i=0

same example we first divide the given word into 9-bit fields starting from the least significant bits as follows: W4 = 0001 W3 = 0 1001 1101 W2 = 1 0110 1100 W1 = 0 1010 0111 W0 = 0 1101 1011 Then, adding W0 , W2 , W4 we get Se = 10 0100 1000 and adding W1 , W3 we get W0 = 1 0100 0100. Subtracting So from S1 we have S = 0001 0000 0100. The word lengths of So and Se can be more than j/2 bits depending on the number of j/2-bit fields in the given binary number. The residue of the resulting word can be found

11 Hardware Realization of Arithmetic Operations

243

easily with another stage by applying the periodic property and a final (mod P ) reduction described earlier.

11.3.3 Approach Based on Modular Exponentiation In this approach the various residues of powers of 2 (i.e., 2x (mod pi )) are obtained using logic functions [19, 20]. Consider as an example 2s3 s2 s1 s0 (mod 13) from [13]. This expression can be rewritten as: 2s3 s2 s1 s0 (mod 13) = 28s3 +4s2 4s1 2s0 (mod 13) = 256s3 16s2 4s1 2s0 (mod 13) = (255s3 + 1)(15s2 + 1)4s1 2s0 (mod 13) = (3s3 s2 + 8s3 + 2s2 + 1)4s1 2s0 (mod 13). Then we can evaluate the bracketed term for various values of s0 , s1 ,, e.g., for s1 = 0, s0 = 0, we have 2s3 s2 s1 s0 (mod 13) = (3s3 s2 + 8s3 + 2s2 + 1)(mod 13). Afterwards, given the four assignments 11, 10, 01, 00 for bits s3 and s2 , the expression 2s3 s2 s1 s0 (mod 13) assumes the values 1, 9, 3, 1, respectively. Finally, the logic function g0 can be used to represent 2s3 s2 s1 s1 (mod 13) for s1 = 0, s0 = 0, according to the assignments of s3 and s2 , as g0 = 8s3 s2 + 2s3 s2 + 1. In the same manner, the other functions corresponding to s1 , s0 , i.e., 01, 10, 11 can be obtained as g1 = 4(s2 ⊕ s3 ) + 2(s3 ⊕ s2 ) + s3 s2 , g2 = 8(s2 ⊕ s3 ) + 4(s3 ⊕ s2 ) + 2s3 s2 , g3 = 4(s2 ⊕ s3 ) + 4s2 s3 + 2(s3 ⊕ s2 ) + (s3 ⊕ s2 ). The logic gates that are used to generate the functions g0 , g1 , g2 , g3 can be shared among the moduli. For instance, 211 (mod 13) can be obtained from g3 (since s0 = s1 ), by substituting s3 = 1, s2 = 0 as 7.

11.3.4 Approach Based on Varying Powers of 2 This technique uses the idea that the residues (mod P ) of various powers of 2 from 1 to 63 can assume values only between 0 and (P − 1) [11]. Thus, the number of “1” bits in the residues corresponding to the 64 bits to be added is less, and it is not the end of it: they can be further reduced by rewriting the residues which have large Hamming weight as the sum of a correction term and of a word with a smaller

244

D. Gorodecky and T. Villa

Hamming weight. This will reduce the number of terms (bits) being added. As an illustration, for modulus 29, the various values of 2x (mod 29) from 20 to 228 are as follows [13]: 1, 2, 4, 8, 16, 3, 6, 12, 24, 19, 9, 18, 7, 14, 28, 27, 25, 21, 13, 26, 23, 17, 5, 10, 20, 11, 22, 15. Given a 64-bit input word, the values repeat again from 229 till 257 , and once more from 258 till 263 , with many of their bits being zero. Consider the residue 27, i.e., 215 (mod 29) with Hamming weight 4. It can be written as (x15 215 )(mod 29) = (27 + 2x15 ) so that when x15 is zero, its value is (27 + 2)(mod 29) = 0. Since 2 has Hamming weight smaller than 27, the number of bits to be added will be reduced. This property applies to residues 19, 28, 27, 25, 21, 13, 26, 23, 11, and 15. Thus, for a 64-bit input word, in a conventional design, 64 5-bit words should be added in the general case; since many of their bits are zero, when deleting all these zero bits, we would need to add 27, 28, 29, 31, and 30 bits in various columns. It can be verified that the numbers of bits to be added in each column (corresponding to 2i for i = 4, 3, 2, 1, 0) are as follows (without Hamming weight optimization and with Hamming weight optimization): – without optimization: 27, 28, 29, 31, 30; – with optimization: 17, 21, 25, 32, 18.

11.3.5 Approach Based on Special Moduli of the Type 2n ± k The approach based on special moduli of the type 2n ± k is the most common technique to design RNS [5, 13, 16]. The are two main reasons to use these values. The first one is due to their simple forward conversion from the positional numerical system to RNS. The second one is that backward conversion from RNS to the positional system can be designed in hardware with smaller costs than using other values of moduli. Combinational approaches efficient with respect to performance and area exploit special moduli sets [16], which are variations of 2s ± v, where v = 1, 3, 5: {2s − 1, 2s , 2s + 1}, {22·s − 1, 2s , 22·s + 1}, {2s − 1, 22·s , 2s + 1, 2s−1 − 1, 2s+1 − 1}, etc. These moduli take advantage of the following identities (considering moduli 2k ± 1): 2k·n (mod (2k − 1)) = 1(mod (2k − 1)) and 2k·n (mod (2k + 1)) = (−1)n−1 (mod (2k + 1)).

11 Hardware Realization of Arithmetic Operations

245

For instance, when P = 24 + 1 and X = 149, we have 149(mod (24 + 1)) = (10010101)2 (mod 17) = ((0101)2 + (−1)2−1 (1001)2 )(mod 17) = (5 − 9)(mod 17)) = −4(mod 17) = 13(mod 17). Given that in the RNS representation the moduli must be co-prime numbers, multiplication of two 1000-bit numbers using the moduli {2s −1, 22·s , 2s +1, 2s−1 − 1, 2s+1 − 1} requires s ≈ 400 bits, which decreases the computational efficiency of the transformation. The same multiplication can be realized using a set of smaller moduli, since there are more than 400 12-bit numbers that are co-prime. Note that, in order to represent uniquely numbers in RNS, the result of the calculation must not exceed P = p1 ·p2 ·. . .·pm . If P = (2s −1)·(22·s )·(2s +1)·(2s−1 −1)·(2s+1 −1), then s requires approximately a 400-bit number.

11.4 Hardware Design of Functions by Modulo The approach that we propose is characterized as follows: 1. It is valid for an arbitrary modulo and bit range of the inputs. 2. It can be applied to modular multiplication, modular addition, and modulo function. 3. It is based on combinational logic. In the proposed procedures, there are some common tasks: 1. Inputs (input factors A · B in multiplication or input X in X(mod P )) are split into subvectors. 2. All subvectors are combined to define a polynomial. 3. This procedure is iterated as long as the result > 2 · P .

11.4.1 Modulo Function Computation We propose the following two-step procedure to compute X(mod P ): 1. X is split into k subvectors with ≤ δ bits in every subvector, where δ = log2 P − 1. 2. The resulting subvectors are combined according to Eq. (11.3): X(mod P ) =

k  i=1

# $ Xi · 2δ·(i−1) (mod P ) .

(11.3)

246

D. Gorodecky and T. Villa

This formula can be applied recursively producing reduced intermediate results at every step. The coefficient 2δ·(i−1) (mod P ) is a constant and it does not exceed P − 1. At the first step, it holds that Xi = 2δ − 1, since Eq. (11.3) achieves the maximum value. Then Eq. (11.3) is called recursively until the result is ≤ 2 · P . At the end, the result is compared with P and, if needed, P is subtracted from the result of the last step. The overall flow (reminiscent of the Fourier computation) is represented by Algorithm. Algorithm Modulus function computation Input: X = (xn , xn−1 , . . . , x1 ) P r = log2 P  k =  nr  length(X)—bit range of X con(p − q : L)—concatenation (p − q) zeros as the most significant bits to L if length(X) < k · r then (k · r − n : X) end if X = (Xk , Xk−1 , · · · , X1 ) X1 = (xr , xr−1 , . . . , x1 ) X2 = (x2·r , x2·(r−1) , . . . , xr+1 ) ··· Xi = (xi·r , xi·(r−1) , . . . , xi·(r+1) ) ··· Xk = (xk·r , xk·(r−1) , . . . , xk·(r+1) ) k  S= Xi · (2i·(r−1) )(modP ) i=1

Stemp = S while Stemp > 2 · P do: ntemp = length(Stemp ) n ktemp =  temp r  if length(Stemp ) < ktemp · r then (ktemp · r − ntemp : Stemp ) end if 1 Stemp = (sr , sr−1 , . . . , s1 ) 2 Stemp = (s2·r , s2·(r−1) , . . . , sr+1 ) ··· i Stemp = (si·r , si·(r−1) , . . . , si·(r+1) ) ··· ktemp Stemp = (sktemp ·r , sktemp ·(r−1) , . . . , sktemp ·(r+1) ) k  i Stemp · (2i·(r−1) )(modP ) Stemp = i=1

end while if P ≤ Stemp then S = Stemp − P else S = Stemp end if

11 Hardware Realization of Arithmetic Operations

247

For illustration, consider the following example. Suppose that X is an 18-bit input and P = 47. Then modulo P is a 6-bit number, and the input X is split into three 6-bit tuples X = (X3 , X2 , X1 ), where X1 = (x6 , x5 , . . . , x1 ), X2 = (x12 , x11 , . . . , x7 ), and X3 = (x18 , x17 , . . . , x13 ). Then 26 (mod 47) = 17(mod 47) and 212 (mod 47) = 7(mod 47). Hence, in the first iteration Eq. (11.3) takes the following form: X(mod 47) = X1 + X2 · 26 (mod 47) + X3 · 212 (mod 47) = X1 + X2 · 17(mod 47) + X3 · 7(mod 47) = S1 If input X = 218 −1, then its binary representation requires 18 bits, i.e., X1 = X2 = X3 = 6310 = 1111112 . Then S1 ≤ 63 + 63 · 17 + 63 · 7 = 157510 = 110001001112 . In this case Eq. (11.3) takes the following form: S1 (mod 47) = S11 + S21 · 26 (mod 47) = S11 + S21 · 17(mod 47) = S2 ≤ 447. If S11 = 10011102 and S21 = 110002 , it follows S2 = 447. The second iteration splits $ # the 9-bit S2 number into two 6-bit and 3-bit tuples: S2 = S22 , S12 , where S22 = $ # # 2 2 2$ s9 , s8 , s7 and S12 = s62 , s52 , . . . , s12 . In this case Eq. (11.3) takes the following form: S2 (mod 47) = S12 + S22 · 17(mod 47) = S3 ≤ 148. If S12 = 1111112 and S22 = 1012 , it follows S3 = 148. The third iteration $ # splits the 8-bit number S3 into two 6-bit and 2-bit tuples: S3 = S23 , S13 , where $ $ # # S23 = s83 , s73 and S13 = s63 , s53 , . . . , s13 . In this case Eq. (11.3) takes the following form: S3 (mod 47) = S13 + S23 · 17(mod 47) = S4 ≤ 54. If S13 = 0101002 and S23 = 102 , it follows S4 = 54. Since S4 < 2 · P = 94, S4 is compared with P = 47: if S4 > 47, then X(mod 47) = S4 − 47, else X(mod 47) = S4 . We provide a Verilog functional representation of this example in Listing 11.1 for X(mod 47), where X is a 100−bit number.

248

D. Gorodecky and T. Villa

Listing 11.1 Modulus function computation

module x_100_mod_47 (X, S ) ; input [ 1 0 0 : 1 ] X; output [ 6 : 1 ] S ; w i r e [ 1 4 : 1 ] S_temp_1 ; w i r e [ 1 1 : 1 ] S_temp_2 ; w i r e [ 9 : 1 ] S_temp_3 ; w i r e [ 8 : 1 ] S_temp_4 ; w i r e [ 7 : 1 ] S_temp_5 ; r e g [ 6 : 1 ] S_temp ; a s s i g n S_temp_1 = X [ 6 : 1 ] + X[ 1 2 : 7 ] * 5 ’ b10001 + X[ 1 8 : 1 3 ] * 3 ’ b111 + X[ 2 4 : 1 9 ] * 5 ’ b11001 + X[ 3 0 : 2 5 ] * 2 ’ b10 + X[ 3 6 : 3 1 ] * 6 ’ b100010 + X[ 4 2 : 3 7 ] * 4 ’ b1110 + X[ 4 8 : 4 3 ] * 2 ’ b11 + X[ 5 4 : 4 9 ] * 3 ’ b100 + X[ 6 0 : 5 5 ] * 5 ’ b10101 + X[ 6 6 : 6 1 ] * 5 ’ b11100 + X[ 7 2 : 6 7 ] * 3 ’ b110 + X[ 7 8 : 7 3 ] * 4 ’ b1000 + X[ 8 4 : 7 9 ] * 6 ’ b101010 + X[ 9 0 : 8 5 ] * 4 ’ b1001 + X[ 9 6 : 9 1 ] * 4 ’ b1100 + X[ 1 0 0 : 9 7 ] * 5 ’ b10000 ; a s s i g n S_temp_2 = S_temp_1 [ 6 : 1 ] + S_temp_1 [ 1 2 : 7 ] * 5 ’ b10001 + S_temp_1 [ 1 4 : 1 3 ] * 3 ’ b111 ; a s s i g n S_temp_3 = S_temp_2 [ 6 : 1 ] + S_temp_2 [ 1 1 : 7 ] * 5 ’ b10001 ; a s s i g n S_temp_4 = S_temp_3 [ 6 : 1 ] + S_temp_3 [ 9 : 7 ] * 5 ’ b10001 ; a s s i g n S_temp_5 = S_temp_4 [ 6 : 1 ] + S_temp_4 [ 8 : 7 ] * 5 ’ b10001 ; a l w a y s @( S_temp_5 ) begin i f ( S_temp_5 >= 6 ’ b101111 ) S_temp 47, the result is S = 64 − 47 = 17. Note that the bit range of S temp is pre-selected.

250

D. Gorodecky and T. Villa

We provide a Verilog functional representation of this example in Listing 11.2 for the modular multiplication of two 6-bit operands by modulo 47. Listing 11.2 Modular multiplication A · B(mod 47)

module m u l t _ m o d _ 4 7 _ b i t s (A, B , R) ; input output wire wire wire reg

[6:1] [6:1] [6:1] [8:1] [7:1] [6:1]

A, B ; R; r1 , r2 , r3 , r4 , r5 , r 6 ; temp_R_1 ; temp_R_2 ; temp_R ;

m u l t _ 3 x 3 l a b e l 1 ( . a1 (A [ 3 ] ) , . a2 (A [ 2 ] ) , . a3 (A [ 1 ] ) , . b1 (B [ 3 ] ) , . b2 (B [ 2 ] ) , . b3 ( B [ 1 ] ) , . r1 ( r1 [ 6 ] ) , . r2 ( r1 [ 5 ] ) , . r3 ( r1 [ 4 ] ) , . r4 ( r1 [ 3 ] ) , . r5 ( r1 [ 2 ] ) , . r6 ( r1 [ 1 ] ) ) ; m u l t _ 3 x 3 _ 8 l a b e l 2 ( . a1 (A [ 3 ] ) , . a2 (A [ 2 ] ) , . a3 (A [ 1 ] ) , . b1 (B [ 6 ] ) , . b2 (B [ 5 ] ) , . b3 (B [ 4 ] ) , . r1 ( r2 [ 6 ] ) , . r2 ( r2 [ 5 ] ) , . r3 ( r2 [ 4 ] ) , . r4 ( r2 [ 3 ] ) , . r5 ( r2 [ 2 ] ) , . r6 ( r2 [ 1 ] ) ) ; m u l t _ 3 x 3 _ 8 l a b e l 3 ( . a1 (A [ 6 ] ) , . a2 (A [ 5 ] ) , . a3 (A [ 4 ] ) , . b1 (B [ 3 ] ) , . b2 (B [ 2 ] ) , . b3 (B [ 1 ] ) , . r1 ( r3 [ 6 ] ) , . r2 ( r3 [ 5 ] ) , . r3 ( r3 [ 4 ] ) , . r4 ( r3 [ 3 ] ) , . r5 ( r3 [ 2 ] ) , . r6 ( r3 [ 1 ] ) ) ; m u l t _ 3 x 3 _ 1 7 l a b e l 4 ( . a1 (A [ 6 ] ) , . a2 (A [ 5 ] ) , . a3 (A [ 4 ] ) , . b1 ( B [ 6 ] ) , . b2 (B [ 5 ] ) , . b3 (B [ 4 ] ) , . r1 ( r4 [ 6 ] ) , . r2 ( r4 [ 5 ] ) , . r3 ( r4 [ 4 ] ) , . r4 ( r4 [ 3 ] ) , . r5 ( r4 [ 2 ] ) , . r6 ( r4 [ 1 ] ) ) ; a s s i g n temp_R_1 = r 1 + r 2 + r 3 + r 4 ; m u l t _ 3 _ 8 l a b e l 5 ( . a1 ( temp_R_1 [ 6 ] ) , . a2 ( temp_R_1 [ 5 ] ) , . a3 ( temp_R_1 [ 4 ] ) , . r1 ( r5 [ 6 ] ) , . r2 ( r5 [ 5 ] ) , . r3 ( r5 [ 4 ] ) , . r4 ( r5 [ 3 ] ) , . r5 ( r5 [ 2 ] ) , . r6 ( r5 [ 1 ] ) ) ; m u l t _ 2 _ 1 7 l a b e l 6 ( . a1 ( temp_R_1 [ 8 ] ) , . a2 ( temp_R_1 [ 7 ] ) , . r1 ( r6 [ 6 ] ) , . r2 ( r6 [ 5 ] ) , . r3 ( r6 [ 4 ] ) , . r4 ( r6 [ 3 ] ) , . r5 ( r6 [ 2 ] ) , . r6 ( r6 [ 1 ] ) ) ;

11 Hardware Realization of Arithmetic Operations

251

a s s i g n temp_R_2 = temp_R_1 [ 3 : 1 ] + r 5 + r 6 ; a l w a y s @( temp_R_2 ) begin i f ( temp_R_2 >= 4 7 ) temp_R