Timed Dependence Flow Graphs , an Intermediate Form for Verified High-Level Synthesis Technical Report 94-17 Richard Chapman 1-205-844-6314 chapman@eng.auburn.edu Department of Computer Science and Engineering Auburn University , 36849-5347 October 26 , 1994 Timed Dependence Flow Graphs , an Intermediate Form for Verified High-level Synthesis Abstract We present timed dependence flow graphs , an intermediate form for high-level synthesis from specifications written in behavioral hardware description languages . Timed dependence flow graphs express data , control , resource access , and timing dependences , and can be constructed in linear time from behavioral VHDL descriptions . We also present a formal execution semantics for timed dependence flow graphs , which we are using in verification of our high-level synthesis tools . 1 Introduction and Related Work To compile a behavioral description of hardware , either for high-level synthesis or for simulation , one must first translate the HDL specification into a form that exposes data , control , timing , and resource dependences present in the specification . The timed dependence flow graph -LRB- tdfg -RRB- maintains this dependence information in a form appropriate for partitioning , optimization , scheduling , data path allocation . Timed dfg 's can be constructed in linear time and also possess a formal execution semantics , making it easy to reason about the correctness of construction and optimization algorithms . The dependence flow graph -LRB- dfg -RRB- was originally developed for compiling imperative languages for dataflow architectures . It was also employed as an intermediate form for use in optimizing , parallelizing FORTRAN compilers for conventional architectures -LSB- BJP91 , Bec92 -RSB- . Dependence flow graphs integrate data and control dependence information into a single structure , making efficient algorithms for program analysis and optimization possible -LSB- JP93 , Joh95 -RSB- . Dependence flow graphs for even unstructured code can be constructed in linear time -LSB- JPP94 -RSB- . Also , dependence flow graphs possess a compositional formal execution semantics . -LSB- PBJ +91 -RSB- The author adapted the original dependence flow graphs for use in the BEDROC high-level synthesis system -LSB- LCA +93 -RSB- , a system that translated a specification written as single sequential process in the hardware description language HardwarePal to an implementation as a set of Xilinx field-programmable gate arrays . The hardware dependence flow graph -LSB- CBL92 , LAL +91 -RSB- was used as a basis for technologyindependent optimization , scheduling , and datapath allocation . The semantics were extended to model the kinds of input/output behavior a single sequential process could demonstrate . The hardware dfg 's operational semantics were used to prove correctness of the front-end and scheduler of the BEDROC synthesis system -LSB- Cha94 -RSB- . Other 's have provided net-based semantics for VHDL -LSB- DJS93 , OC93 -RSB- , but have not used them as an intermediate form for synthesis . Our primary aim is to produce verified , efficient high level synthesis tools , and our approach to verification is to provide operational semantics to every representation format used in our systems . A similar intermediate form is the data flow graph exchange format -LSB- ES92 -RSB- , which is also a dataflow-inspired graph incorporating data and control dependences used for high-level synthesis . Here we extend hardware dependence flow graphs to model the timing information present in a specification written in behavioral VHDL -LSB- Ins88 -RSB- , and to model parallelism and communication for a group of concurrently executing sequential processes . We extend the formal semantics of hardware dependence flow graphs to model timing and concurrency . We discuss use of tdfg 's for high-level synthesis from behavioral VHDL . 2 Representing Dependence Information Timed dependence flow graphs consist of a set of nodes representing operations and a set of edges representing the dependences and precedence relations that exist between those operations . We use tdfg 's as an intermediate form for compiling behavioral VHDL specifications . We construct tdfg 's from VHDL entities consisting of communicating sequential processes , each specified by a VHDL process statement . We construct a tdfg for each process . During execution according to our operational semantics , the tdfg for each process communicates with the other tdfgs via operations that update or read signal output waveforms , maintained as part of the shared state . The grammar in Figure 1 , which refers to the grammar contained in the VHDL Language Reference Manual -LSB- Ins88 -RSB- describes the subset of VHDL for which we construct tdfg 's . process ? statement : : = process ? label : process process ? declarative ? part begin sequential ? statements end process process ? label sequential ? statements : : = sequential ? statement j sequential ? statements ; sequential ? statement sequential ? statement : : = variable ? assignment ? statement j signal ? assignment ? statement j if ? statement j loop ? statement j null ? statement j wait ? statement Figure 1 : supported subset of VHDL Several sorts of dependences are present in these process descriptions , including data dependence , in which one operation uses a value computed by a previous operation , and resource dependence , an ordering between subsequent operations that access the same port , to prevent operations from accessing a shared resource at the same time . There are also timing dependences imposed by the VHDL wait statement and the after clause in signal assignments that impose constraints on the length of the time interval that can exist between two operations . Finally , loops and conditionals impose control dependences between operations , such that the result of one operation determines whether the other is executed or not . In the tdfg we represent data and resource dependences by edges . As in the dataflow model of computation , we represent control dependences with switch and merge nodes that route data and resource dependences to several different destinations based on the control condition 's value . We handle timing de - pendences by routing data and resource dependences through wait nodes , parametrized by a delay time , boolean expression , or sensitivity list . For the VHDL process in Figure 2 , we show the timed dfg we build . s2 s3 waits1 s2 s3 merges1 switchs1 s2 s3 waits1 s2 s3 oscillate : process begins1 < = ' 0 ' wait 25 ns ; s1 < = ' 1 ' wait 25 ns ; end process oscillate ; end start signaloutput signaloutput const const ' 0 ' ' 1 ' signalinput negate signaloutput resource dependence data dependence s2 < = not -LRB- s3 -RRB- ; . Figure 2 : The tdfg for a VHDL process 3 Execution semantics In fact , the tdfgs for a system of VHDL processes contain enough information that the system of tdfgs may itself be executed according to an operational semantics , giving as a result the same set of output waveforms produced by direct simulation of the VHDL specification . We define a token-passing execution semantics for tdfgs : edges serve as conduits along which tokens flow . We model the state of the tokens in the graph with an environment function which maps a pair consisting of -LRB- edge name , time -RRB- to the value found on that edge at that time . Alternatively , one may view the items that flow along edges as -LRB- time , token -RRB- pairs . A value may be a data item or a dependence token -LRB- say $ -RRB- whose value is unimportant . In general , a node receiving tokens at some subset if its incoming edges can produce tokens at its outgoing edges . The condition for a node to execute is given by a set of rules , formulated as rewriting rules that modify the execution environment by updating the mapping . The value produced by executing a node also has an associated time value determined by the times of the tokens at the inputs to the nodes and the nature of the operation performed by the node . We also keep track -LRB- in a separate component of the environment -RRB- of transactions in the signals ' output waveforms as they are computed by execution of signal assignment -LRB- write -RRB- nodes . The state of the signals ' output waveforms is shared among the tdfgs for all the processes in the specification , and it is through these shared data structures that interprocess communication is accomplished . We currently restrict the VHDL processes we model to allow only one assignment to a signal at any time , for reasons discussed below -LRB- in future work we plan to find a way to relax this restriction -RRB- . When a value is assigned to a signal 's output waveform , a -LRB- value , time -RRB- transaction may be added to the environment component for that signal , depending on the current value of the signal , the type of signal assignment -LRB- inertial or transport -RRB- , and the time of the signal assignment , in a manner consistent with the semantics specified in the VHDL language reference manual . The tdfgs for different processes execute asynchronously -LCB- there is no kernel process to keep the tdfg 's synchronized . Furthermore , the order in which particular nodes execute within a single tdfg is not deterministic : any node may execute whenever its execution conditions are met . In an acyclic dependence flow graph , each node will execute only once . However , for edges occurring in cycles in the tdfg , we must keep track not only of the values and times that tokens appear on the edges ; we must also keep track of the iteration number corresponding to each token . We follow the dynamic dataflowinspired convention used by Pingali , et al. by appending a vector of iteration indices , one vector element per enclosing loop , to edge names -LSB- PBJ +91 -RSB- . The static edge depicted in the graph is a template for a number of dynamic instantiations of that edge , one per iteration . For example , an edge named e1 enclosed in the inner loop of two nested loops would be instantiated as e1.i.j in the ith iteration of the outer loop and the jth iteration of the inner loop . In the example rules below we omit the vector of indices in the interest of simplicity . Suppose that a dfg consists of a set of nodes N = fn1 ; : : : ; nkg and a set of edges E = fe1 ; : : : ; ejg . The execution environment consists of two components < ae ; oe > : ffl A mapping ae : E ? Time ! f $ ; 1 ; g such that ae -LRB- ei ; t -RRB- = v means a token with value v is present on edge ei at time t. ffl A mapping oe : Signals ? Time ! f1 ; g giving effective values as a function of time for each signal present in the VHDL from which the tdfg was derived . We define the operation of the graph with a number of rules of the form P redicate -LRB- ae ; oe -RRB- < ae ; oe > ?! < ae0 ; oe0 > that describe when a node may execute . For example , a node for the boolean and operation as shown in and wait v1in v2in vout din vout dout din dout -LRB- condition -RRB- signal read -LRB- signame -RRB- condition = sensitivity-list delayboolean exp Figure 3 : Example tdfg nodes Figure 3 , may execute whenever both its input edges have values , and the output will be present immediately . 8t : -LRB- vout ; t -RRB- 2 = dom -LRB- ae -RRB- 9t1 : ae -LRB- v1in ; t1 -RRB- = v1 ^ 8t01 < = t1 : -LRB- v1in ; t01 -RRB- 2 = dom -LRB- ae -RRB- 9t2 : ae -LRB- v2in ; t2 -RRB- = v2 ^ 8t02 < = t1 : -LRB- v2in ; t02 -RRB- 2 = dom -LRB- ae -RRB- < ae ; oe > ?! < ae -LSB- -LRB- vout ; max -LRB- t1 ; t2 -RRB- -RRB- ! v1 ^ v2 -RSB- ; oe > All execution rules satisfy the property that output token times are no earlier than the latest input token 's time . Let us discuss the mechanism that ensures synchronization of accesses to the signal waveforms . We require that a read operation at time t can only occur after a write operation for time t has established the value of the signal at that time . The rules for execution of the signal read node , given below , block execution of that node , if no value has yet been written to the signal at a time greater than or equal to t. Consequently , when an incoming resource dependence token arrives at a signal read node , signifying that the value of that signal and the time at which the signal is to be read , the data structure containing the state of that signal is checked for a transaction valid at that time . If no such transaction exists , execution of the read node must wait until a value is written for that time . Given the restriction we impose on the writer of the VHDL specification that no more than one process may simultaneously write to any signal , the value of a signal at a particular time is unambiguously defined if it is defined at all . The node for a signal read operation -LRB- see Fig. 3 -RRB- has one incoming dependence edge din -LRB- to order operations on the signal -RRB- and two outgoing edges , one dependence edge dout and one edge vout carrying the value read from the signal at the time the incoming dependence edge was satisfied : 8t : -LRB- dout ; t -RRB- 2 = dom -LRB- ae -RRB- 9t1 : ae -LRB- din ; t1 -RRB- = $ ^ 8t2 < = t1 : -LRB- din ; t2 -RRB- 2 = dom -LRB- ae -RRB- oe -LRB- signame ; t1 -RRB- = v < ae ; oe > ?! < ae -LSB- -LRB- dout ; t1 -RRB- ! $ ; -LRB- vout ; t1 -RRB- ! v -RSB- ; oe > The tdfg wait node is used to implement the VHDL wait statement . A wait node passes tokens that arrive at the input edge to the output edge , but increases the time value associated with the token in one of three ways , one for each type of waiting condition allowed in the VHDL wait statement . The nodes can be composed to model a wait statement with more than one condition . Here we show two examples of wait nodes , one modeling the wait for delay statement and one modeling the wait on sensitivity-list statement . A tdfg wait node delays a token passing from input edge vin to output edge vout for some fixed time , or until a transition is observed on some signal from a list of signal names , or until a given boolean expression is satisfied . Here is the condition for firing of a wait for delay node : 8t : -LRB- dout ; t -RRB- 2 = dom -LRB- ae -RRB- 9t1 : ae -LRB- din ; t1 -RRB- = v ^ 8t2 < = t1 : -LRB- din ; t2 -RRB- 2 = dom -LRB- ae -RRB- < ae ; oe > ?! < ae -LSB- -LRB- dout ; t1 + delay -RRB- ! v -RSB- ; oe > And for wait on signame : 8t : -LRB- dout ; t -RRB- 2 = dom -LRB- ae -RRB- 9t1 : ae -LRB- din ; t1 -RRB- = v ^ 8t2 < = t1 : -LRB- din ; t2 -RRB- 2 = dom -LRB- ae -RRB- 9t3 > t11 : oe -LRB- signame ; t3 -RRB- < > oe -LRB- signame ; t1 -RRB- < ae ; oe > ?! < ae -LSB- -LRB- dout ; t3 -RRB- ! v -RSB- ; oe > Due to space constraints we omit the rules for other nodes , which are mostly straightforward extensions of the rules for hardware dependence flow graphs -LSB- Cha94 -RSB- . Many rules are simply extended to handle the fact that tokens are now time , value pairs rather than single values , and the transition is extended to include a specification for computing the time value to be associated with any output token that is generated . 4 Construction and Synthesis A VHDL process has a control flow structure like that of an imperative program , and the construction algorithms for dependence flow graphs from FORTRAN -LSB- JPP94 -RSB- can be used . This two-phase algorithm first discovers control dependence equivalence regions in the process , then routes dfg dependences edges for all appropriate data items and resources into the control dependence regions in which they are used . The dfg for a single control dependence region is acyclic and can be constructed in a syntax-directed manner . If the VHDL process is entirely a structured code , a simpler construction algorithm -LSB- Cha94 -RSB- can be used , since control dependence equivalence can be deduced from the syntax tree in a straightforward way . Both construction algorithms run in time linear in the size of the VHDL process . The departure of our net-based semantics from relying on a kernel process to enforce the simulation semantics specified in the language reference manual makes tdfg 's well-suited for synthesis . Computational const ' 1 ' signal reads1 sig writes2 xor gate 2ns delay const ' 1 ' xor signal reads1 sig writes2 wait2 ns s2 < = s1 xor ' 1 ' after 2 ns ; . . Figure 4 : Rewriting a tdfg during synthesis operations specified by sequential statements in a VHDL program do not take time to execute per se -LCB- the VHDL programmer must include appropriate wait and after specifications in the program to model the delays present in real hardware , and the simulation kernel keeps track of the simulated times at which the operations occur instantaneously . By modeling waiting with additional dfg nodes whose behavior is similar to that of the other nodes in the graph , we avoid introducing an explicit global manager to keep the processes synchronized . While such a global manager may ease the task of guaranteeing behavior consistent with VHDL 's simulation-based semantics , it must somehow be eliminated during the synthesis process . Rather , we begin the synthesis task of transforming that graph into a register-transfer level design by replacing groups of nodes in the graph with new \ hardware '' nodes representing the standard cells available to the synthesis system . If execution rules are provided for these rules , we can reason that replacement of the abstract tdfg nodes with hardware does not change the behavior of the graph as a whole . An example is shown in Figure 4 . Once operations have been mapped to available functional units , scheduling can take place . In previous work -LSB- Cha94 , LCBW93 -RSB- the author developed a scheduling algorithm for hardware dfg 's that was transformational . An initial as-soon-as-possible schedule was derived in a single pass over the dfg , and that schedule was used as a basis for optimizing transformations . The extension of hardware dfgs to timed dfgs does not invalidate this approach . An additional advantage to this approach to scheduling is that the simple algorithm for arriving at the initial schedule and each optimizing transformation can be proved correct independently of the others . The transformations can then be applied according to any strategy without worry that the resulting schedule is incorrect . 5 Discussion and Future Work In other work we are developing process-algebraic semantics for tdfg 's based on CSP -LSB- Hoa85 -RSB- , and hope to show the equivalence of the operational semantics presented here with the process-algebraic model . We plan to use the semantics presented here in proving the correctness of optimizations on tdfgs . Due to the compositional nature of the semantics , if we can partition the graph into a subgraph and a context , then show that an optimization transforming the subgraph does not affect the semantics of the edges at the boundary of the subgraph , we can conclude that the behavior of the overall graph consisting of transformed subgraph and the context is unchanged . We plan also to investigate using tdfg 's for efficient code scheduling for simulation of VHDL specifications . The reasons that convince us that tdfg 's are useful for scheduling in synthesis seem to apply to simulation as well . Finally we would like also to relax the restriction that only a single process may write to a signal at a given time . To do so we must devise a way to guarantee that a signal read node is not allowed to execute until the resolved value of the signal has been computed for the time at which the read node desires the signal 's value . References -LSB- Bec92 -RSB- Micah Beck . Translating FORTRAN to Dataflow Graphs . PhD thesis , Cornell University , Ithaca , New York , May 1992 . -LSB- BJP91 -RSB- Micah Beck , Richard Johnson , and Keshav Pingali . From control flow to data flow . Journal of Parallel and Distributed Computing , pages 12:118 -LCB- 129 , 1991 . -LSB- CBL92 -RSB- Richard Chapman , Geoffrey Brown , and Miriam Leeser . Verified high-level synthesis in BEDROC . In Proceedings of 1992 European Design Automation Conference , pages 59 -LCB- 63 . IEEE Press , March 1992 . -LSB- Cha94 -RSB- Richard Chapman . Verified High Level Synthesis . PhD thesis , Cornell University , Ithaca , New York , January 1994 . -LSB- DJS93 -RSB- W. Damm , B. Josko , and R. Schlor . A net-based semantics for VHDL . In Proceedings of 1993 European Design Automation Conference with Euro-VHDL . IEEE , IEEE Press , 1993 . -LSB- ES92 -RSB- Jos T.v. Eijndhoven and Leon Stok . A data flow graph exchange format . In Proceedings of 1992 European Design Automation Conference . IEEE Press , March 1992 . -LSB- Hoa85 -RSB- C.A.R. Hoare . Communicating Sequential Processes . Prentice-Hall International , 1985 . -LSB- Ins88 -RSB- Institute of Electrical and Electronics Engineers . IEEE Standard VHDL Language Reference Manual . IEEE Press , 1988 . -LSB- Joh95 -RSB- Richard Craig Johnson . Efficient Program Analysis Using Dependence Flow Graphs . PhD thesis , Cornell University , Ithaca , New York , January 1995 . -LSB- JP93 -RSB- Richard Johnson and Keshav Pingali . Dependence-based program analysis . In Proceedings of the 1993 SIGPLAN Conference on Program Design and Implementation . ACM Press , 1993 . -LSB- JPP94 -RSB- Richard Johnson , David Pearson , and Keshav Pingali . The program structure tree : Computing control regions in linear time . In Proceedings of the ACM SIGPLAN '94 Conference on Programming language design and implementation . ACM , 1994 . -LSB- LAL +91 -RSB- Miriam Leeser , Mark Aagaard , Mark Linderman , Richard Chapman , Richard Johnson , and Stephan Meier . The BEDROC high-level synthesis system . In Proceedings of the 4th IEEE International ASIC Conference and Exhibit , pages P2 -LCB- 5.1 -LCB- P2 -LCB- 5.6 . IEEE Press , September 1991 . -LSB- LCA +93 -RSB- Miriam Leeser , Richard Chapman , Mark Aagaard , Mark Linderman , and Stephan Meier . High level synthesis and generating FPGA 's with the BEDROC system . The Journal of VLSI Signal Processing , 6 -LRB- 2 -RRB- :193 -LCB- 216 , 1993 . -LSB- LCBW93 -RSB- Miriam Leeser , Richard Chapman , Michael Bertone , and Alan Wenban . Implementing filters with programmable logic . In Proceedings of the Third International Workshop on Field Programmable Logic and Applications , Oxford , UK , September 1993 . -LSB- OC93 -RSB- S. Olcoz and J. M. Colom . Towards a formal semantics of IEEE std . VHDL 1076 . In Proceedings of 1993 European Design Automation Conference with Euro-VHDL . IEEE , IEEE Press , 1993 . -LSB- PBJ +91 -RSB- Keshav Pingali , Micah Beck , Richard Johnson , Mayan Moudgill , and Paul Stodghill . Dependence flow graphs : An algebraic approach to program dependencies . In 18th Annual ACM Symposium on Principles of Programming Languages , pages 67 -LCB- 78 , January 1991 .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

design correctness
formal specification languages
formal techniques for verification
formal verification