This article has been accepted for publication in a future issue of this journal, but has not been
fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
Verification and Synthesis of Clock-Gated Circuits
Yu-Yun Dai∗ , Robert K. Brayton† Department of EECS, University of California, Berkeley, U.S.A.
{yunmeow∗ ,brayton† }@berkeley.edu
Abstract—To reduce dynamic power dissipation in digital
circuits, a dependency graph (DG) is derived for a sequential
circuit to accomplish verification and synthesis of clock-gated
circuits. This is used recursively to derive sufficient conditions
for a given bank of flops (FFs) to be legally clock gated (disabled.)
These conditions are expressed with LTL/PLTL properties, which
can be used to create hardware monitors and justified by
hardware model checkers.
For sequential equivalence checking (SEC), LTL/PLTL prop-
erties are formulated to be proved on a clock-gated circuit (R)
derived from a ”golden” circuit (G). If these sufficient conditions
can be proved on R, then the clock gating structures are proved
redundant and can be removed. This creates a simplified circuit
(R’) and makes the SEC task easier.
Experiments were performed on a set of benchmarks. It was
observed that since the properties are expressed in terms of the
control signals which only appear in the DG, they are quite
easy to prove on R because the DG abstracts away complicated
arithmetic logic. Similarly, the miter between G and R’ is
usually proved easily by model-checking methods because of the
increased similarity between G and R’ in sequential behaviors,
compared to the changes between G and R.
The proposed formulation is extended to provide a systematic
and automatic method for sequential clock-gating synthesis.
Experiments showed that the DG-based framework for synthesis
gave encouraging results.
Index Terms—Synthesis for low power; Control logic extrac-
tion; Model checking; Formal verification; Clock-gating synthesis
I. I NTRODUCTION
Generally a digital circuit can be thought of, at a high
level, as a connection of memory elements (FFs), inputs
and outputs (PIs and POs, I/O), transparent paths that just
conditionally transport data from one part of the circuit to
another, the control part which controls this movement as well
as when various operations are to be done, and combinational
operators. Often the complication of the circuit is due to these
operators which could be multipliers, shifters, etc. Sequential
equivalence checking (SEC), the process of proving sequential
equivalence, between such a circuit and a highly optimized one
can be extremely challenging, but often this task is exacerbated
by the arithmetic operators of the data-path. Thus any method
that can abstract away this source of complication can make
formal verification easier.
To reduce the frequency of updating FFs and hence dynamic
power consumption, clock gating synthesis disables the clock
to a bank of FFs under appropriate conditions. It is highly
effective since FF switching is a major source of power usage.
Usually the change in the circuit from the golden one (G) to
a synthesized clock-gated version (R) is small. However, this
transformation is sequential, i.e. next-state functions of FFs are
different, which makes SEC hard. Since the I/O behavior of
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
1
the two circuits must be equivalent, the extra signals created by
clock gating synthesis must be redundant. If this redundancy
can be identified, proved redundant and removed, SEC can be
made much easier.
We focus on clock-gating done on data paths and identify
clock-gating constructs by building a dependency graph (DG)
for a circuit with conditional dependencies controlled by clock
enabling signals. The DG abstracts away combinational oper-
ators like arithmetic components, which are usually the source
of most of the difficulties in SEC. The DG is used recursively
to formulate LTL/PLTL properties that are sufficient for a
targeted enabling signal to be redundant, i.e. its removal
preserves I/O equivalence. If these redundancies are removed
one by one, then a revised optimized circuit R’ is created,
which is more similar to G. A final step in SEC is to create
a miter between G and R’ and use model checking to prove
equivalence.
For synthesis, the process of clock gating is the reversal of
the above; instead of removing redundancies we add them; a
DG is constructed for G and for each bank of FFs identified as
a candidate for clock gating; an LTL/PLTL property, sufficient
for legal clock gating is formulated. An enabling signal is
synthesized by translating this formula into a monitor using
the methods of [7]. Since this is sufficient, the output of the
monitor provides a legal clock gating signal. This enabling
signal may be stronger than that identified by the designer
since it explores the DG recursively and arbitrarily deeply.
II. P RELIMINARY
A. Sequential Clock-Gating
Clock gating is done usually by replacing the clock input
to a FF by the AND of the clock with an enabling signal
(en) (see Figure 1). When en = 1 the clock input to the flop
causes new data to be captured; otherwise the data in the FF
is unchanged. To represent this in a circuit to be used for
synthesis or verification, we need to model the gated clock
behavior because usually the clock input to the FF is not an
explicit signal. Hence an equivalent model of behavior as in the
right side of the figure is used, which shows a MUX enabled
by en in front of the FF and a feedback loop from the FF
output to an input of the MUX.
FF en FF
in out in 1
D Q
0
D Q out
en clk
clk
Fig. 1. An equivalent model for clock-gating a FF.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
Clock-gating synthesis can be based on either satisfiability
or observability of signals. Satisfiability clock-gating turns off
clocks for FFs when the input data is identical to the value
in the previous time frame. Hence a satisfiability clock-gating
condition depends on circuit behaviors happening from the
past to the current clock cycle. For instance, the algorithm
proposed in [2] focused on finding satisfiability clock-gating
conditions with satisfiability solvers and 3-value abstractions.
On the other hand, observability clock-gating is used to
disable updating FFs when these updates are not observable
at any POs. In other words, the differences (updating or not
updating) of gated FFs cannot be propagated to any of the
POs. Hence an observability clock-gating condition relates to
the circuit behaviors from now to the future.
After clock-gating synthesis using appropriate synthesized
enabling signals for various banks of FFs, verification requires
that the circuits before and after synthesis are sequentially
equivalent [3]. SEC for general circuits is typically formulated
as a model checking problem on the miter between the two
sequential circuits to be compared (where the PI pairs are
merged and the PO pairs are XORed to form the outputs of
the miter circuit). Then, sequential model checking techniques,
including induction [16], bounded model checking (BMC) [8]
and property-directed reachability (PDR) [12], can be applied
to check if the outputs of the two circuits are always identical
under all possible input sequences. If any pair of POs is ever
evaluated to different values under the same input sequence,
sequential equivalence is violated. In this case, model check-
ing can provide an input sequence leading to the violation.
Otherwise, the two circuits are proved sequentially equivalent
(or the problem was too hard).
Due to the P-SPACE complexity of general sequential
model checking, some SEC problems may be too hard. Savoj
et al. [14,15] proposed a combinational approach to SEC
for clock-gating synthesis. This approach aimed at circuits
synthesized using satisfiability and observability don’t cares
(SDC and ODC) [13]. Moreover, Dai et al. [11] constructed
characteristic graphs (CGs) to bypass irrelevant combinational
logic and formulate sufficient conditions of legal clock-gating,
based only on found clock-gating structures. However, the CG
method used in [11] can fail to prove some legal clock-gating
conditions because CGs can lack essential information.
B. Transparent Logic and Data Dependency
To include control logic and data dependency information
for clock-gating conditions while possibly excluding irrelevant
combinational logic in the analysis, a dependency graph (DG)
for a circuit is constructed based on all recognized transparent
logic.
Definition A transparent word is a set of signals, {wk },
with supports, {S k }, where under some evaluation of ∩k S k
(common control), {wk } is equivalent to a subset (data-word)
of ∪k S k .
For example, an m-bit word from a set of 2-to-1 multiplexers
(MUX) controlled by the same selector signal s,
C[m − 1 : 0] = s?A[m − 1 : 0] : B[m − 1 : 0],
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
2
comprises a transparent word C, where ∀j ∈ [0, m − 1],
(C[j] = sA[j] + s0 B[j]). For this case, word C is transparent
from word A or word B, depending on the value assigned
to s. This transparent block (word A, B to word C) is called
completely specified because each minterm of its control signal
s makes the output word equivalent to
one of the input words.
An, incompletely specified transparent block introduces
more complicated data dependencies. Consider the functional
block from words A, B C to I in Figure 2. I is equiv-
alent (transparent) to one of the input words only when
one-hot assignments are applied to the control signals, e.g.
(s1 , s2 , s3 ) = (1, 0, 0) makes I equivalent to A. When a non
one-hot assignment is applied to the control signals, such as
(1, 1, 0), I depends on both A and B. Thus, to establish all
transparencies for incompletely specified transparent blocks,
all minterms of control signals must be examined.
A n
0 √ E n
A0
n
n D Q n{s1 }
1
B n
F2 n
n n
n{s2 } F
D Q G
C n I
s0 n
n
F1 n{s3 } H
Fig. 2. Considering transparent logic in clock-gating. The notation
n{si } used here means a bus with n copies of si . Each AND gate
performs bit-wise AND between one word and the corresponding
bus.
Recognizing transparent logic provides more insight into the
data dependencies in circuits, where the control signals are
used to regulate data flows. Methods for detecting transparent
logic and its control conditions were defined and implemented
in [10]. Considering transparent blocks of logic can strengthen
clock-disabling conditions for some FFs, and hence save more
dynamic power. For satisfiability clock-gating cases, more de-
tailed information about data dependency can assist in defining
more conditions when data in a flop need not be updated. For
observability clock-gating cases, paths to observable outputs
can be blocked by transparent logic, and this can result in the
clock being disabled more often.
Example: Figure 2 contains a set of gated FFs, F2 , which
√
are processed by a word-level square root operation ( ) and
then fed into a transparent block (words A, B, C to I.) I
depends on A (through F2 ) only when F1 = s1 = 1. Hence,
F2 need not be updated when s1 = 0 in the next time frame;
when s0 = 0, the clock to F2 can be disabled. This example
of legal observability clock-gating can be identified only when
transparent logic is considered. Note that transparent logic is
not just simply a set of MUXs controlling a data-path; it can
be an incompletely specified transparent block.
To formulate legal clock-gating conditions on circuits that
may have transparent blocks, we propose to construct a
dependency graph, DG, and then formulate a set of properties
(1) sufficient for legal clock-gating.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
3

(1) Primary Inputs (2) Constants

C. Formulation and Proof of LTL and Past LTL Properties
out out
In this paper, to formulate and verify legal clock-gating PI CST
conditions on sequential circuits, LTL and past LTL operators
(3) Primary Outputs (4) Standard Flip-Flops
are used to represent sequential properties.
in
LTL and Past LTL Properties: PO
in
FF
out

To address observability clock-gating conditions, the fol-

lowing LTL operators are used in this paper: (5) Transparent Blocks (6) Combinational Clouds
in 1 in 1 out1
1) X a – ”next”: a holds in the next cycle.
in 2 in 2 out2
2) [a U b] – ”until”: a remains T rue at least until b becomes ... Trans.
out
Comb.
... ...
T rue, which can happen at the current or a future time in n in n outn
frame. sel

Temporal formulas for satisfiability clock-gating conditions
are expressed in LTL extended with past operators (PLTL).
Only those used for constructing clock-gating properties in
this paper are explained. Detailed formal semantics for PLTL
can be found in [4].
The following PLTL operators are used:
1) Y a – ”yesterday”: a was T rue in the previous time
frame and F alse in the first time frame.
2) Z a – ”invariant yesterday”: a was T rue in the previous
time frame and T rue in the first time frame.
3) [a S b] – ”since”: (1) b was T rue at least once in a past
(or the current) time frame, and (2) a was T rue since
the cycle after b was last T rue.
Note that Y and Z are past-duals of X (next), while S is
the past-dual of U (until) in common LTL.
Proving Properties on Circuits:
Claessen et al. [7] provided methods for expressing
LTL/PLTL formulae as circuits, including G(z ⇒ {op}a)
and G(z ⇒ [a{op}b]), where {op} is an arbitrary LTL or
PLTL operator. They constructed a hardware monitor circuit
to represent each target property to be proved.
In Section IV, after constructing all signals required by
Formulae 2 to 4, the algorithm proposed in [7] is used to
verify clock-gating conditions. For further details, please refer
[7].
III. D EPENDENCY G RAPH
A dependency graph (DG) is an abstraction of a circuit.
The DG addresses clock-gating conditions related to data
dependencies at a high-level, providing essential information
for synthesis and verification.
A. Dependency Graph
A dependency graph, DG = (E, V), is a directed graph,
where each vertex associates a set of signals with a certain sub-
circuit in the corresponding sequential circuit. Each directed
edge represents a data dependency.
Eight types of vertices are defined: (1) primary inputs,
(2) constants, (3) primary outputs, (4) standard flip-flops,
(5) transparent blocks, (6) combinational clouds, (7) signal
branches, and (8) gated flip-flops. The eight types with related
signals are shown in Figure 3.
• Constants, primary inputs and outputs represent pure sig-
nals in circuits. Vertices for primary inputs and constants
(7) Signal Branches (8) Gated Flip-Flops
out1
in out2 in out
FF
...
outn
en
Fig. 3. Eight types of vertices used in a dependency graph
have no inputs, while primary outputs only receive data
from other vertices.
• Standard flip-flop vertices represent groups of FFs in
sequential circuits. Such a vertex receives input data and
propagates it to its output in the next time frame.
• Each transparent block vertex covers one combinational
block in which outputs are recognized as a transparent
word, while inputs are control signals and input words.
A transparent block receives multiple inputs (input words)
and forwards one of them to its output according to the
value of sel (control signals). sel can represent multiple
signals. For example, a set of n-to-1 MUXes switching
among n input words, in1 , ..., inn , can be mapped into
a single DG vertex labeled with a single selector signal
sel with dlog2 (n)e bits.
• A combinational cloud represents a combinational sub-
circuit with no transparent logic. It can cover arithmetic
operators and other complicated computational units. This
type of vertex is used to identify logic that will be
abstracted away when formulating clock-gating proper-
ties. It is possible that some of this logic is relevant
to a more detailed understanding of dependencies, but
such complications are ignored in our approach. This is
conservative but still produces strong enabling signals,
while making verification and synthesis easier.
• A signal branch is used for signals with multiple fanouts.
• A gated FF vertex represents a set of already gated FFs,
gated by the same signal en. This vertex covers a set of
FFs, as well as the combinational logic used for clock-
gating these FFs. These FFs are updated to the data input
only when en = 1. In practice, a set of FFs can be clock-
gated by a sequence of MUXes, but these FFs and all
MUXes can be collapsed and modeled as one gated FF
vertex with one enable signal. More details for such MUX
collapsing are discussed in Section III-B.
Notice that for incompletely specified transparent blocks,
such as words A, B, C to I in Figure 2, the assignments for

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
transparency as well as all possible assignments for selector
signals should be represented in the DG. This is because (1)
there is no guarantee that only the control assignments valid
for transparency can happen, and (2) other assignments can
still result in output updating, which should be considered for
satisfiability clock-gating conditions.
A0 F2 Comb. A
I D Q
s0 Trans.
B n{s1 }
C n
Const
0 s1 s2 s3
Fig. 4. Dependency graph for the circuit in Figure 2.
Example: Figure 4 demonstrates the dependency graph
constructed for the circuit in Figure 2. The square root operator
is represented by a combinational cloud. The transparent
block, which is from words A, B, C to I, is mapped to a single
transparent vertex, controlled by (s1 , s2 , s3 ). A constant node
is introduced to represent the condition when all (s1 , s2 , s3 )
are zero, and thus I = 0. The set F2 of gated FFs is covered
by one gated FF vertex, which includes the MUXes controlled
by s0 . Note that FF F1 is not represented because it is only
used for controlling the transparent block A, B, C to I; F1 has
no further influence on any other path to POs. The edges in
the DG represent data dependencies but not the control signals
for gated FFs or transparent blocks.
B. Construction of Dependency Graph
A DG is constructed from a sequential circuit and its
identified transparent blocks as follows: (1) recognize gated FF
vertices, (2) complete incomplete transparent block vertices,
(3) create other vertices, including combinational clouds, and
(4) build dependencies.
According to the algorithm for identifying transparent
blocks in [10], initially a set of bits is grouped together because
they have identical control signals and assignments. Then for
each group, if some bits are supported by different sources, or
some of them drive different transparent words in their fanout
cones, the group is decomposed into sub-groups as transparent
words. Thus, the identified transparent blocks are examined
and decomposed to ensure that 1) all bits of any one word are
supported by identical input words and 2) all bits support the
same set of words in their fanout cones. Hence for each DG,
a vertex depends on all bits of each vertex supporting it, so
there are no redundancies where a bit is connected to a vertex
but cannot influence the vertex value.
Recognizing gated FF vertices: Given a set of recognized
transparent blocks, MUXes that drive FFs directly are inves-
tigated first. When a fully-specified transparent block forms
a clock-gating structure (see Figure 1), where the FF output
drives one data input of a corresponding 2-to-1 MUX (a MUX
feedback loop), then the other input word is examined. If it
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
4
comes from another transparent word, and each bit of this
is supported by the FF in its fanout cone under the same
control condition, then this transparent block also contributes
to the behavior of a set of clock-gated FFs. The procedure
continues until no such MUXes connecting to the target FFs
can be found. Then all selector signals of the collected MUXes
are combined into a single enable signal for this clock-gating
vertex.
0 C n
0
1 n
PO A
n
1
n
Dn 1
s0 0
B
n F
s4
n{s2 } s3
(a) Original Circuit
C
Trans.
A D
BB Trans. F
s0
Const-0
s1 ,s2 ¬s3 ∧ s4
(b) Dependency Graph
Fig. 5. (a) Circuit with transparent blocks and gated FFs. (b)
Corresponding DG.
Example: In Figure 5(a), the MUXes (controlled by s4 )
directly driving FFs (F ) are examined first. The process
examines the other input side (not driven by F ) and collects
the MUXes controlled by s3 . Continuing, when it reaches
transparent word D, this process terminates because D is
driven by two input words (C and D), where none of them is
F . In this paper, a gated FF vertex can switch only between
one input data and itself, so the block from A, B, F to D
cannot be included in the gated FF vertex. Finally s3 and s4
are combined to form the enable signal of a gated FF vertex,
with data input D.
Note that although the MUXes controlled by s0 are sup-
ported by F , they are excluded from the gated FF vertex
F because there exists another transparent block (outside the
clock-gating part) between its output C and F .
Complete transparent block vertices: After creating all
gated FF vertices, the remaining transparent blocks are ana-
lyzed to create corresponding vertices. For an incompletely
specified transparent block, some assignments of controls do
not result in transparency, but dependencies between inputs
and outputs still exist. Sometimes the transparent logic may
be used to reset some FFs to constants and then make the
output value different from the previous time frame. Hence,
it is necessary to analyze all possible control assignments
and create extra constant vertices to represent the entire
functionality of the block.
Create other vertices: After identifying and creating all
gated FF and transparent block vertices, all transparent words
are collected and covered by vertices. If some input words
are sets of FFs or PIs, then primary input or standard flip-flip
vertices are created to cover these. Other words, consisting of
internal signals (outputs of some combinational clouds), like
A in Figure 2, are labeled temporarily as words. Then vertices
for the remaining FFs, PIs and POs are created one by one,
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
5

where each vertex only covers one signal. Note that if a FF After topologically sorting all existing vertices, Lines 14
or PI only controls transparent blocks (not supporting other to 18 check each vertex and create a signal branch if the
signals), like F1 in Figure 2, a vertex is not needed for it, vertex drives multiple vertices. For combination clouds, signal
because it can only influence paths to POs through controlling branches are created for all output words with multiple fanouts.
the transparent block. This dependency has been addressed in Then each vertex is connected to all vertices supporting it. This
the transparent block vertex. cannot be done without the topological sort, because a branch
The next task is to create combinational cloud vertices. First, vertex should be created before a signal is connected to its
each word or vertex accumulates a list of support vertices fanouts.
(words) by following the fanin cone of this word (vertex) Once the DG is constructed, it can be used to formulate
until reaching another vertex (word). One combinational cloud properties of legal clock-gating conditions as detailed in the
is created for each set of vertices that have identical sets of next section.
support words. Different sets of support words lead to different
combinational vertices. IV. L EGAL C LOCK -G ATING C ONDITIONS
The algorithm for constructing the dependency graph G = The goal of clock-gating synthesis is to create extra control
(V, E) for a sequential circuit, Cir, with its set of identified logic to reduce the frequency of updating FFs. To verify that an
transparent blocks, is shown in Algorithm 1. added clock-gating condition is legal, i.e. the revised circuit is
sequentially equivalent to the original, properties of the circuit
Algorithm 1 Dependency Graph Construction
are formulated that are sufficient for the extra control to be
Require: Cir: a gate-level sequential circuit with the sets of legal.
primary inputs PI, primary outputs PO and flip-flops FF; In this section, we derive and prove sufficient conditions for
TransparentBlocks = (Outputs, Supports, Words) legal satisfiability and observability clock-gating on sequential
Ensure: G = (V, E): dependency graph for Cir, with the set circuits and formulate properties for FFs that are identified
of vertices, V and edges, E. for clock-gating. DGs are used to formulate problems and
1: V = ∅ and E = ∅ to derive properties. Then these properties are proved on the
2: for each block in TransparentBlocks do original sequential circuit. It is important to note that the
3: if block forms clock-gating structure then properties formulated are relatively easy to prove because they
4: en = collectGating(block) are derived using the DG, which is independent of complicated
5: V = V ∪ createGatedF F (block, en) combinational logic in the circuit.
6: for each block in {TransparentBlocks − V} do
7: ConstVs = analyzeT ransparency(block) A. Problem Formulation using DGs
8: V = V ∪ {ConstVs, createT rans(block)}
For a sequential circuit, clock-gating synthesis on a set of
9: for each signal in PO or FF or PI do
FFs can be effected by adding MUXes with feedback loops.
10: if signal is not covered by any v in V then This has several representations in a DG. Given a set of target
11: V = V ∪ createV ertex(signal) FFs, which are covered by a single DG vertex (a standard
12: V = V ∪ createClouds(Cir, V) FF or a gated FF vertex), two possible differences between a
13: topologicalSort(V) golden DG and its revised DG can indicate that clock-gating
14: for each v in V do synthesis has been performed:
15: if v drives multiple fanouts then • There has been a change in the DGs from a standard FF
16: V = V ∪ createBranch(v) to a gated FF vertex. This is done when a standard FF,
17: for each input vertex supporting v do updated to the input data at each time frame, now has a
18: E = E ∪ buildDependency(v, input) proposed control condition en; when en = 0, those FFs
are kept at the same values as saved.
In Lines 2 to 5, gated FF vertices are constructed, where • There has been a change in the en signal of an existing
collectGating(...) performs backtracking to find clock-gating gated FF vertex. The FFs were already gated by enold ,
conditions for each set of gated FFs. Then the remaining but clock-gating synthesis proposed enextra , which is
transparent blocks are processed by Lines 6 to 8, where combined with enold to build ennew = enold ∧ enextra ;
analyzeT ransparency(...) examines all minterms of control thus, (ennew = 1) ⇒ (enold = 1). Note that it is
signals for incompletely specified blocks to ensure all data assumed that enold is legal because it is given as part
dependencies are represented. During the two phases above, of the golden model and in general we may not have
the vertices for some input data words are created if one word enough information to test this for legality.
is a set of PIs or a set of FFs. Both of the above cases can be viewed as changing an
Other vertices, except signal branches and combina- enable signal from enold to ennew , where in the first case,
tional clouds, are created by createV ertex(...). Then enold = constant-1, meaning the set of FFs always keeps
createClouds(...) explores the fanin cone of each word updating to its input. To verify if the synthesis is legal,
and collects the vertices or words supporting it. Finally this the following algorithms only need to check the legality of
function creates one combinational cloud vertex for each set enold ∧ (¬ennew ), because that is where the enabling signal
of words with the same support list. has been changed from 1 to 0 in the revised circuit. Given a

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
sequential circuit with a set of FFs gated by enold , the goal of
this section is to verify if clock-gating these FFs with ennew
(proposed by some clock-gating synthesis methods) is legal.
Definition A proposed clock-gating synthesis condition,
where the enable signal of a set of FFs is modified from enold
to ennew is legal, if and only the circuits before and after this
change are sequentially equivalent.
In the following sections, a set of gated FFs is called out-
of-date when the input can be different from the previous time
frame (updating), but the FF values have been kept the same,
due to en = 0. If such a situation does not happen, the FFs
are called up-to-date.
Definition A set of gated FFs is called up-to-date if its en
must be 1 when its input signal (in) is different from the FF
value in the previous time frame. All standard FFs are always
up-to-date because they keep updating to the current values of
in without any restriction.
B. Observability Clock-Gating Conditions
Observability clock-gating disables updating FFs when their
inputs are never observable. It depends on control conditions
and data dependencies of their fanout signals from now and in
the future. Hence the properties can be expressed by common
LTL operators.
1) Observable Condition: A set of signals at a time frame
is called observable when their current values can influence
primary output values at the current or later time frames.
Definition For a signal s, its observable condition Oc (s) is
a sequential function varying for different time frames. When
Oc (s) = 1 at a certain time frame, the current value of s can
influence any POs in the current or any future time frame.
Given a set of mapped FFs existing in both G and R,
assuming clock-gating synthesis has been applied to this set
of FFs, the enable signal of the corresponding DG nodes
is modified from enold to ennew . Then observability clock-
gating requires checking if the inputs of the target FFs are not
observable when enold ∧(¬ennew ) happens. Because the target
FF can be out-of-date (keep the current value even when the
input signal has been modified in a future time frame), while
the saved old value can be propagated to POs in future time
frames, we cannot just check the observable condition of the
FF outputs in the next time frame. That is,
Theorem: For the target FF with input in, where the enable
signal is modified from enold to ennew , the proposed synthesis
is valid only if the ”observable” property
G((enold ∧ ¬ennew ) ⇒ ¬Oc (in))
holds.
Proof: The proposed clock-gating synthesis is legal if the
circuit with enold and the one with ennew are sequentially
equivalent, meaning there is no input assignment sequence
resulting in differing outputs. If Formula 2 holds, the situation
(enold ∧ ¬ennew ) ∧ Oc (in) never happens. In other words,
applying ennew still can propagate values of in if it is
observable and not restricted by enold . That is, this synthesis
can maintain the sequential behavior of the target circuit.
Hence the proposed clock-gating synthesis is valid.
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
6
For each type of DG vertex, the observable condition of
each input depends on the observable conditions of the vertex’s
outputs and the control signals. See the second column of
Table I for the observable condition of each vertex type.
• Each PO is observable all the time, so the observable
condition is T rue.
• The observable condition is not applicable for PIs or
constants.
• The input of a standard FF is observable only when its
output is observable in the next time frame.
• Each possible input ini of a transparent block, is observ-
able only when the output currently depends on this input
(sel = assigni , meaning the control signals are assigned
to make the output equivalent to ini ) and the output is
observable.
• Any input of a combinational cloud or branch vertex
is observable when any output is observable. Hence we
take the union of the observable conditions of all output
signals. As mentioned, by definition on purpose, this is
independent of the actual logic in the cloud.
• The observable condition for the input of a gated FF
vertex depends on the control condition (en) and the
observable condition of the output from now on. To
make sure that the input data is taken and saved in the
FF, en must be 1 now. Then in the next time frame
either (1) the output is observable (X(Oc (out))), or (2)
the output becomes observable before the FF updates
to another value, i.e. X[(¬en)U(Oc (out))]. Note that
[(¬en)U(Oc (out))] can be F alse only when (en = 1)
happens before Oc (out) = T rue. The X outside the U
formula avoids considering the first time frame where
en = 1.
Example: Consider a gated FF where en = 1 at the nth
time frame, such that the FF receives and saves the input value,
in(n), at the end of this cycle. If the FF output is observable
at the (n + 1)th time frame, the input data from the previous
time frame in(n) is observable. If en is 0 at the (n + 1)th
time frame and remains 0 before the (n + k)th time frame,
the FF keeps the same value, i.e. in(n), before the end of
the (n + k)th time frame. If Oc (out) is T rue at a certain
(n + l)th time frame (n < n + l ≤ n + k), the saved value
(in(n)) is observable. One extreme case is when en = 1 and
Oc (out) = T rue both happen together only at the (n + k)th
time frame. This means that en = 0 holds until the point
where Oc (out) holds. Then the input at the nth time frame
is observable at the (n + k)th time frame because it has been
(2) stored by the FF until this point.
When verifying the clock-gating condition on a target gated
FF vertex, in which the enable signal has been changed from
enold to ennew , the observable condition of the input of the
target gated FF is
Oc (in) = [enold ]∧{X(Oc (out))∨X[(¬ennew )U(Oc (out))]}.
This depends on both enold and ennew . This LTL formula
has two parts: the term [enold ] before the conjunction en-
sures that the current input value is received, while the
term {X(Oc (out))∨X[(¬ennew )U(Oc (out))]} guarantees the
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
7

Vertex Type Observable Condition for in: Oc (in) Update Condition for out: Uc (out)
Primary Input N/A T rue
Constant N/A Z(F alse)
Primary Output T rue N/A
Standard FF X(Oc (out)) W Z(Uc (in)) W
Transparent Block (out) ∧ (sel = assigni )
for ini : OcW ) ∧ Uc (ini )] [sel 6= Y(sel)]
i [(sel = assigniW
Combinational Cloud W i O c (out i ) i Uc (ini )
Signal Branch i Oc (outi ) Uc (in)
Gated FF [enold ] ∧ {X(Oc (out)) ∨ X[(¬ennew )U(Oc (out))]} Z{[en] ∧ [Uc (in) ∨ Y([¬en]S[Uc (in) ∧ ¬en])]}
TABLE I
O BSERVABLE CONDITION FOR THE INPUT OF EACH TYPE OF VERTEX ; U PDATE CONDITION FOR THE OUTPUT OF EACH TYPE OF VERTEX .

value saved in the FF can be observed at the POs before being Algorithm 2 Observable Condition Construction:
replaced by newer values. For the first part, although ennew getObs(DG, target, depth)
might reduce the frequency of receiving new input, it can also Require: DG: a dependency graph, target: a signal, depth:
significantly modify the sequential behavior, so using enold the number of explored time frames.
here is safely conservative when a FF input is observable. Ensure: P: an LTL property
Because there is no extra information for precise conditions 1: if visited(target) then
of essential updates (where the input value is different from the 2: return analyzeLoop(target)
saved value, and the difference is observable), we need to use 3: if depth = 0 then
enold here to make sure we capture all essential updates of the 4: return T rue
target FF. Also, we must use ennew in the second part of this 5: switch type(outputV (target)) do
formula to verify the circuit after clock-gating, and because 6: case Primary Output:
ennew can keep the saved value longer than enold does, we 7: return T rue
need to examine if the out-of-date situation resulting from 8: case Standard FF:
ennew can be observable. Thus, Oc (in) cannot be constructed 9: Oout = getObs(DG, output(target), depth-1)
based solely on ennew or solely on enold . 10: return X(Oout )
2) Property Formulation: Algorithm 2, given a target set 11: case Transparent Block: . as ini
of FFs, constructs an observable condition for the target’s 12: Oout = getObs(DG, output(target), depth)
input Oc (in). Its negation is a sufficient non-observable 13: return Oout ∧ (sel = assigni )
condition. It is constructed to cover enold ∧ ¬ennew , i.e.
(enold ∧ ¬ennew ) ⇒ ¬Oc (in). This can be used to verify 14: case Combinational Cloud or Signal Branch:
that ennew only turns off the clock when the input for the 15: for all outputi of target do
target FF is not observable. 16: {Oout }∪ = getObs(DG, outputi , depth)
W
The function getObs(...) in Algorithm 2 recursively con- 17: return ({Oout })
structs an observable condition for a target signal at a cer- 18: case Gated FF:
tain time frame by exploring the extended fanout cone until 19: Oout = getObs(DG, output(target), depth-1)
reaching either the depth limit (depth), POs, or some visited 20: return (enold ) ∧ (XOout ∨ X[ (¬ennew )UOout ])
vertices.
The term depth indicates how deeply the recursive algorithm
can recur. When depth = 0, the algorithm just goes across Example. In the DG in Figure 4, assume enold for F2 is
one time frame from a FF vertex input to its output. By constant-1 and ennew = s0 . We need to check if
returning T rue immediately, the FF is interpreted as a primary
output. The recursion is terminated after exploring the number G(¬s0 ⇒ ¬Oc (A0 ))
of time frames specified by the initial value of depth If this i.e. G(Oc (A0 ) ⇒ s0 ). Now
algorithm starts with depth < 0, this algorithm keeps recur-
sively exploring fanout cones until reaching primary outputs. Oc (A0 ) = enold ∧ {X(Oc (F2 )) ∨ X[¬s0 U(Oc (F2 ))]},
However, some paths might not ever reach primary outputs,
where enold = T rue, and Oc (F2 ) = Oc (A) = Oc (I) ∧ s1 .
resulting in an infinite recursion where some visited vertices
Because Oc (I) = T rue, Oc (F2 ) = s1 . Additionally, since
are examined again. Hence the function analyzeLoop(...) is
s1 = Y(s0 ) or s1 = Z(s0 ),
used to determine how to handle FFs in loops. Additional
discussion about infinite recursion can be found in [9], but the [¬s0 U(Oc (F2 ))] = [¬s0 U(s1 )]
detailed discussion is omitted in this paper due to the space
limits. is F alse we have
The observable condition formulated here is tight in the Oc (A0 ) = X(Oc (F2 )) = X(s1 ).
sense that it captures all possible data dependencies based
on analyzing control logic only. It is insufficient for true Since G(Xs1 ⇒ s0 ) holds (regardless of the initial condition
observability because data flow could be blocked also by some of s1 ), then G(Oc (A0 ) ⇒ s0 ) holds and hence s0 is a legal
combinational logic. clock-gating condition for F2 .

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
C. Satisfiability Clock-Gating Condition
Satisfiability clock-gating aims at turning off clocks for
FFs when their input data is the same as that saved already
in the FFs. This is related to control conditions and data
dependencies of fanin cones from the past up to now. Common
Linear Temporal Logic (LTL) operators are insufficient to
describe this because reasoning about the past must be done.
1) Update Condition: For a target FF vertex, where the
enable signal is modified from enold to ennew , satisfiability
clock-gating requires that two properties need to be checked,
up-to-date and satisfiability. Both of these properties use the
notion of an update condition.
A set of signals is said to update when the signal values
are different from those in the previous time frame. This is
denoted by Uc (signal).
Definition. The update condition Uc (s) for a signal s is
a sequential function of time. When Uc (s) = 1 at a certain
time frame, the value of s can be different from its value in the
previous time frame. If Uc (s) = 0 at a certain time, s must
be identical to the value it had at the previous time frame.
For each vertex of a DG, the update condition of each output
depends on the update conditions of the vertex inputs, as well
as related control signals. For each type of vertex, the third
column in Table I lists the update condition for outputs in the
current time frame, Uc (out). Note that this formulation omits
the cases where signals may be ”updated”, but to the same
values due to combinational logic, i.e. it omits the cases when
only control logic is used to determine the update condition.
As shown in Table I,
• PIs update in each cycle, independent of the actual input
patterns.
• A constant is always identical to its previous cycle (no
update), but for the first time frame, it updates from
unknown to a certain value. Hence we use ”invariant
yesterday” Z to make sure it is T rue in the first time
frame.
• There is no output signal for PO vertices, so Uc (out) is
not applicable.
• A standard FF updates in the current time frame de-
pending on the update condition of its data input in the
previous time frame. If the input data updates at cycle n
(Uc (in) = T rue at cycle = n), then the output of the
FF will update at cycle n+1, independent of the actual
values. Z is used here because the initial conditions of
FFs are not constrained in this formulation (the same idea
will be applied to gated FFs.)
• The output of a transparent block updates when either
(1) at least one of the support data inputs updates (the
output can depend on more than one input data), or (2)
the selection of input sources is different from that in the
previous cycle. Here ”yesterday” Y is used because the
update conditions for other vertices (PIs, constants and
FFs) guarantee Uc (ini ) must be T rue in the first time
frame; this also holds for the output of each transparent
block.
• The update condition for each output of a combinational
cloud is the union of the update conditions for each input
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
8
to the combinational cloud, Uc (ini ); when any of these
inputs update, the output must update, independent of the
combinational logic. A signal branch vertex behaves like
a combinational vertex.
• A gated FF can receive and update to a new value only
when en = 1 in the previous time frame. Thus, either (1)
the input data must update (Uc (in) = T rue), or (2) the
FF has not updated since its input was last updated, i.e.
Y([¬en]S[Uc (in) ∧ ¬en]) is valid in the previous time
frame.
To explain the condition for a gated FF, the output of the
gated FF is updated at the nth time frame only when en = 1
at the (n − 1)st time frame. Then there are two cases allowing
the FF to receive new values: (1) at the (n − 1)st time frame,
the input data updates and is different from its previous value,
or (2) the input data updates at a previous (n − k)th time
frame while en = 0 at that time. At this point, the FF is out-
of-date. en keeps being 0 before the (n − 1)st time frame,
so the ”since” property holds. Then the FF receives the input
value due to en = 1 at the (n − 1)st time frame, which can
be different from the value kept in the FF since the (n − k)th
time frame. Hence the output of this FF updates at the nth
time frame.
When enold 6= constant-1, it is possible that the target FF
can be out-of-date in the golden model. Therefore the target
FF needs to be examined for being up-to-date. The following
”up-to-date” property,
G(Uc (in) ⇒ enold ), (3)
means any time in updates, this FF receives and updates to
the new value. Otherwise, this FF can be out-of-date.
If Formula 3 holds, ennew can be checked that it only
additionally turns off the clock when the input data remains
the same.
Theorem. If the ”satisfiability” property
G((enold ∧ ¬ennew ) ⇒ ¬Uc (in)), (4)
holds, then the change from enold to ennew is legal for
satisfiability clock-gating.
Proof. The proposed clock-gating synthesis (from enold to
ennew ) is legal only when the circuit maintains its sequential
behavior after this change. When Formula 3 holds, the target
FF must update to its input when the input changes. Then the
property in Formula 4 guarantees that the false case (enold ∧
¬ennew )∧Uc (in) never happens. In other words, ennew must
cover enold ∧Uc (in), which is equivalent to Uc (in) due to the
up-to-date property. That is, the FF with ennew still updates
to its input anytime that the input changes Thus the change on
this FF will not be propagated to the POs. Hence the sequential
behavior must be the same, and the proposed clock-gating
condition is legal.
As mentioned, before verifying a clock-gating synthesis
(from enold to ennew ) on a target FF, enold needs to be
examined. There are two cases:
1) G(Uc (in) ⇒ enold ) holds.
Then (enold ∧ ¬ennew ) ⇒ ¬Uc (in), i.e. ennew only
additionally turns off the clock when G{(enold ∧
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
9

¬ennew ) ⇒ ¬Uc (in)} holds and the change from enold ploration goes across one time frame, so the input depth
to ennew is legal for satisfiability clock-gating. Also, the should be reduced by 1 on the next recursive call. When
target FF is always up-to-date. depth = 1, it explores combinational logic only and returns
2) G(Uc (in) ⇒ enold ) fails. T rue when reaching FFs, meaning those FFs are interpreted
Even when ennew is proposed by a satisfiability clock- as free primary inputs. Generally, a larger depth can result in
gating condition, it is necessary to verify if ennew results more restricted (better) update conditions, which saves more
in extra observable out-of-date conditions (i.e. when power. However, a larger depth also implies possibly more
ennew = 0, the FF can be out-of-date.) Hence, for a effort is spent in formulating and proving the property. The
target FF which fails the up-to-date property, it needs to parameter depth can be used to trade off power consumption
be verified that the proposed ennew satisfies Formula 2, and overall verification effort.
the observable property. Additional discussion and ex-
amples about the issues of combining satisfiability and D. Verification Flow for Clock-Gating
observability conditions can be found in [9].
A valid flow for verifying an arbitrary clock-gating synthesis
following the discussion in the previous section is given in
Algorithm 3 Update Condition Construction:
Figure 6.
getU pd(DG, target, depth)
Require: DG: a dependency graph, target: a vertex output, Target set of FFs,
depth: the number of backtracking time frames. enold and en new
Ensure: P: a PLTL property
No
1: if visited(target) or (depth = 1 and target belongs to Is the set of FFs
always up-to-date?
FF types) then
Yes
2: return T rue
3: switch type(target) do Does the satisfiability Does the observability
clock-gating property hold? No clock-gating property hold?
4: case Primary Input: Yes No
Yes
5: return T rue
6: case Constant:
Legal Clock-Gating Synthesis Unknown
7: return Z(F alse)
8: case Standard FF: Fig. 6. Verification flow for a target set of FFs.
9: Uin = getU pd(DG, inputV (target), depth-1)
10: return Z(Uin ) For a gated FF vertex with input in and original enable
11: case Transparent Block: signal enold , to verify changing enold to ennew , the first step
12: for all inputVi of target do is to check if the set of FFs are always up-to-date (Formula 3).
i If this passes, there is a chance that the proposed clock-gating
13: Uin = getU pd(DG, inputVi , depth)
14:
W
return i [(sel = asgni ) ∧ Uini
] ∨ [sel 6= Y(sel)] is only based on the update condition of in (satisfiability clock-
gating.) Hence it can be verified with Formula 4. If the target
15: case Combinational Cloud or Signal Branch:
FF with ennew satisfies the satisfiability property, it is a legal
16: for all inputVi of target do
clock-gating synthesis.
17: {Uin }∪ = getU pd(DG, inputVi , depth)
W If the target FF vertex can be out-of-date with enold ,
18: return ({Uin }) or it violates the satisfiability property, verification with the
19: case Gated FF: observability condition (Formula 2) is required. If this holds,
20: Uin = getU pd(DG, inputV (target), depth-1) the clock-gating synthesis is valid; if it fails, the proposed
21: return Z{[en] ∧ [Uin ∨ Y([¬en]S[Uin ∧ (¬en)])]} synthesis still can be valid, but cannot be justified with
only control signals and data dependencies; information about
2) Property Formulation: The proposed algorithm of creat- combinational logic is required.
ing the update condition for a target vertex (output) is shown in The formulated sufficient properties for legal clock-gating,
Algorithm 3. The function getU pd(...) constructs the update which fully consider the functionalities of control signals, must
condition for a vertex output by recursively exploring the be proved on the sequential circuit under investigation. The
update conditions of all support vertices. Each type of vertex LTL properties can be recast as new hardware property-outputs
has a specialized process handled by one of the case values. to be proved using hardware model checkers.
We also use the term depth to control how deep the algo-
rithm can recur. When depth < 0, this algorithm terminates V. S EQUENTIAL E QUIVALENCE C HECKING OF
only when reaching primary inputs, constants, or already C LOCK -G ATED C IRCUITS
visited vertices (loops). When working on a loop, which can For two sequential circuits, golden and revised (G and R),
result in an infinite recursion, the algorithm returns T rue with a mapping between their PIs and POs, SEC can be done
immediately. Reasons and examples for stopping immediately in a way similar to the CG method in [11]: (1) identify the
can be found in [9]. additional clock-gating conditions on R, (2) verify if they
Calling getU pd(...) for a vertex FF means that the ex- are legal and (3) if so reduce them on R by connecting the

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
enable signals to constants (because they are redundant). After
removing the extra clock-gating signals, the revised design R’
will be more similar to G, and hence SEC between G and R’
is generally easier.
Note that G may be clock-gated already, possibly using
external satisfiability or observability conditions which we
may not know. Those added clock-gating structures may
modify the sequential behavior of a version of G with no
clock-gating, but they must be assumed legal when considering
external (unknown) logic. Hence there is no need to verify all
clock-gating structures in these designs. Here it is assumed
the clock-gating synthesis from G to R only adds structures,
so in the proposed SEC flow, G remains unchanged, while R
can be simplified to R’.
A. Identifying Clock-Gating Conditions
To identify candidate FFs that have additional clock-gating
signals in R, the dependency graphs for G and R are con-
structed as DG and DR . Because the correspondence of FFs
between G and R is given, each standard or gated FF vertex
in DG has a corresponding vertex in DR . According to
Section IV-A, there are two types of differences in the DGs
that indicate clock-gating synthesis was done. These are used
for comparison between each FF vertex pair to detect any new
clock-gating constructs in DR .
Given a candidate gated FF vertex in DR , the enable signal
is denoted as ennew . If the corresponding vertex in DG is
a standard FF, enold = constant-1; if gated and controlled
by enG , the difference between ennew and enG = enold
needs to be detected. Since it is assumed that clock-gating
synthesis only adds extra logic, i.e. MUXes with feedback
loops, the signal enextra in R can be found by checking
all controls covered by the collapsed clock-gating condition
ennew = enold ∧ enextra . Then the flow described in Sec-
tion IV-D can be followed to verify if the new gating condition
ennew is legal. If legal, then enextra is sequentially redundant
and can be replaced with a constant in R creating R’. When
working on the next candidate FF, DR0 and R’ are used.
B. Algorithm Flow
Algorithm 4 outlines the proposed SEC flow based on DGs
and reports if the input circuits are sequentially equivalent or
returns a counterexample trace. The inputs are the golden and
revised circuits, G and R, and depth, which is used to limit
the number of explored time frames when formulating update
and observable conditions.
Function dependGraph(...) executes Algorithm 1 to con-
struct the dependency graph for each input circuit. Line 4
f indM appedControls(...) merges paired PIs from G and R
and then performs SAT-sweeping on this to identify related
signals that are combinationally equivalent to each other. For
each enable signal of a set of gated FFs in G, there is a
corresponding control signal in R. The matchings between
these controls are returned as controlPairs.
The loop between Line 5 and Line 13 verifies each candidate
and revises DR0 and R’ based on the proved candidates one
by one. At Line 5, compare(...) finds each pair of mapped FF
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
10
Algorithm 4 SEC Flow based on DGs
Require: G and R: two circuits with mapped PIs, POs and
FFs.
Ensure: EQ or NON-EQ
1: R’ = R
2: DG = dependGraph(G)
3: DR0 = dependGraph(R’)
4: controlPairs = f indM appedControls(G, R, DG , DR0 )
5: while ((target, mapF F ) = compare(DG , DR0 )) do
6: ennew = getEnable(target)
7: enold = analyze(ennew , mapF F, controlPairs)
8: P = def P ropty(target, DR0 , enold , ennew , depth)
9: testCir = buildCircuit(P, R’)
10: proof = multiP rove(testCir)
11: if isLegal(proof) then
12: revise(target, enold , DR0 )
13: R’ = simplif y(target, R’, enold , ennew )
14: return SEC(G, R’)
vertices in DG and DR0 and checks if clock-gating has been
applied. If the vertices, (target, mappF F ), as described in
Section IV-A, indicate clock gating has been done, then target
is a candidate. To find enold in R’, analyze(...) explores the
components of ennew and finds the control which is associated
with the enable signal of mapF F .
Based on ennew , enold and depth, def P ropty(...) for-
mulates the update and observable conditions for the input
of target separately, and builds property monitors as in
Section IV-D. Then, based on R0 , buildCircuit(...) constructs
a corresponding circuit with multiple outputs (sub-properties)
for checking the up-to-date condition, and the satisfiability
and observability clock-gating conditions. Hence the model-
checker multiP rove(...) at Line 10 model-checks all proper-
ties and returns lists of proved and disproved outputs.
The clock-gating synthesis on target is legal if it reaches
the ”Legal Clock-Gating Synthesis” terminal in Figure 6. If it
is legal, then revise(...) modifies the enable signal of target
to enold , and simplif y(...) replaces other extra controls with
constants and simplifies R’.
Finally, SEC(G, R’) is invoked to check if G and the
completely revised R’ are sequentially equivalent. If it fails,
a counter-example trace is available. A running example with
detailed explanations can be found in [9].
C. Experimental Results
Experiments were performed on a 16-core 2.60GHz In-
tel(R) Xeon(R) CPU. The example circuits were clock-gated
manually at the RTL, and then synthesized into AIGs to
create R. We compare the DG method against the CG method
introduced in [11]. Both methods are divided into a simplify
part (Simplify) and a final SEC part (SEC). For the DG
method, the simplify part includes transparent logic recogni-
tion, DG construction, property formulation and proving, and
simplifying R. The DG method, including the simplify part
is implemented in ABC [5]. In the following experiments, the
liveness properties for observability clock-gating are simplified
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
into weaker safety properties, which will be explained in
Section VI. The function multiP rove(...) used here is the
pdr command in ABC. We also apply super prove [6] (a
general purpose gate-level model-checker) to the sequential
miter between G and R’ for the final SEC step in Algorithm 4.
Along with the five cases used in [11], we added three
industrial cases to demonstrate that the DG method is more
effective than the CG method. Also, a case from OpenCores,
M d5Core, which is gated by the synthesis presented in the
Section VI, is listed as M d5Core Syn.
The statistics of those cases and the runtimes for both the
methods are shown in Table II.
The last column in Table II indicates the total number of
FFs in which the enable signals have been modified after
the simplifying step. For the cases which have been used
in [11], the reduced numbers are the same for both the
DG and CG methods. For the three industrial cases, the CG
method is incapable of proving and removing any clock-gating
conditions. Also, for M d5Core Syn, the numbers of FFs in
G and R are different, so the CG method cannot simplify it.
Hence for the four cases, the runtimes under the CG − SEC
label refer to the time super prove spends on miters between
the original G and R.
As shown in Table II, for some cases, the proposed DG
method needs more time for the steps before the final SEC,
due to its more sophisticated pre-processing steps. After the
simplification based on DGs, the final SEC problem is easier
than the original SEC problem and can be solved efficiently.
Constructing DGs also provides more insight about the input
circuits. For example, the second case in Table II, M d5Core,
is a pipeline circuit with 64 stages, where each stage has four
32-bit data words and one 512-bit word for control saved in
FFs. Hence the total number of FFs is about (32 × 4 + 512) ×
64 ≈ 40k. In this case, only the control words (one 512-bit
word in each stage) can be gated due to the data dependencies
in G. Also, the revised circuit (R) used in the experiment was
gated for only one stage, so the number of re-synthesized FFs
(the enable conditions are reduced by the DG method) is 512
(one control word) in Table II. However, the control words in
other stages can be gated as well, as shown in the next section
on synthesis.
VI. C LOCK -G ATING S YNTHESIS
The proposed DG concepts, including update and observ-
able conditions, also can be used for clock-gating synthesis.
A. Synthesis with Update Conditions
Given a set of up-to-date target FFs with input in, satisfia-
bility clock-gating aims at building an enable signal ennew =
enold ∧ enextra , which satisfies
G(enold ∧ ¬ennew ⇒ ¬Uc (in)).
This can be rewritten as:
G(enold ∧ ¬(enold ∧ enextra ) ⇒ ¬Uc (in))
G(enold ∧ ¬enextra ⇒ ¬Uc (in))
G(Uc (in) ⇒ ¬enold ∨ enextra ).
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
11
Because the FFs are up-to-date at this point in the flow,
Uc (in) ⇒ enold .
Since ennew = enextra ∧enold , the strongest enabling signal
is enextra ≡ Uc (in). As mentioned before, Uc (in) can be
constructed recursively as an extra signal added to the original
circuit. Note also that the required update condition, Uc (in),
has been constructed for checking the up-to-date condition, i.e.
the precondition of synthesis. Hence satisfiability clock-gating
synthesis is relatively straightforward by reusing Uc (in) di-
rectly.
B. Synthesis with Observable Condition
For a set of target FFs (out) with input in and enold ,
observability clock-gating synthesis requires the construction
of an enable signal enextra that satisfies
G((enold ∧ ¬ennew ) ⇒ ¬Oc (in)),
where ennew = enold ∧ enextra and Oc (in) comes with the
”Until” component as explained before. However, there is
no straightforward way to construct such enextra using the
liveness concept.
To apply the following synthesis method, the property (con-
dition), G(X(Oc (out)) ⇒ enold ), must be proved first. Then,
the synthesis flow takes X(Oc (out)) as enextra . Hence the
signal ennew = enold ∧ enextra is equivalent to X(Oc (out)),
because X(Oc (out)) ⇒ enold .
The proposed ennew = X(Oc (out)) definitely satisfies
the target property because first, ennew = X(Oc (out)
implies (¬ennew )U(Oc (out)) must be constant-0. Then,
G(X(Oc (out)) ⇒ enold ) makes enold ∧ X(Oc (out)) into
X(Oc (out)), so
Oc (in) = (enold ) ∧ (X(Oc (out)) ∨ X[ (¬ennew )U(Oc (out))])
= (enold ) ∧ (X(Oc (out)) ∨ F alse)
= X(Oc (out)).
After substituting ennew = Oc (in) = X(Oc (out)) into the
target property, it is clear that the property holds all the
time. Therefore, enextra ≡ X(O(out)) is a legal clock-gating
condition.
It is possible that the desired observable clock-gating con-
dition cannot be synthesized because it is related to events in
the future, which might not be predictable in the current time
frame.
1) Synthesis with the ”Next” Property: To synthesize a
signal ennew as X(Oc (out)),
a new signal Oout needs to be constructed in the original
circuit. Then the target signal X(Oout ), depends on the fanin
cone of Oout back one time frame.
If Oout has only FFs in its support, X(Oout ) can be
constructed by adding a one time-frame fanin cone of Oout
to the previous time frame, i.e. skipping all FFs between the
two time frames. An example is shown in Figure 7(a).
In Figure 7, Oout is evaluated by a combinational block A,
which is fully supported only by FFs. Those FFs are the next
state function of certain outputs from another block B. The
value of Oout in the next time frame is determined by feeding
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
12

TABLE II
C OMPARISONS WITH THE CG METHOD ON 3 O PEN C ORES [1] CASES , 2 SYNTHETIC CASES , 3 INDUSTRIAL CASES AND 1 CASE
SYNTHESIZED BY THE METHOD OF S ECTION VI.

Clock-Gating AND FF CG method(s) DG method(s)

Circuit Techniques # # Simplify SEC Simplify SEC Reduced #
aes.Round Observability 125k 645 0.67 2.95 24.344 3.606 128
Md5Core Satisfiability 95k 40k 0.92 7.92 4.323 9.448 512
CLA fixed Observability 3k 97 0.66 1.97 0.228 0.553 32
Synthetic 1 Observability 4k 73 0.56 0.23 0.568 0.980 24
Synthetic 2 Both 877 74 0.65 0.43 0.216 0.430 36
Industry 1 Observability 2k 92 N/A 3.046 0.234 2.339 38
Industry 2 Observability 6k 187 N/A 28.449 1.698 6.257 64
Industry 3 Observability 20k 379 N/A 96.327 3.421 34.431 128
Md5Core Syn Satisfiability 95k 40k N/A 438.77 11.116 10.094 32256

decomposed into the union of an infinite number of formulas

PIs PIs
Comb. Comb.
B B
FFs
Comb. Oout
FFs
Comb.
A A
(a)
Fig. 7. Example for synthesizing ennew = X(Oc (out)).
the current outputs of B to A. Hence X(Oout ) can be built by
duplicating A and adding it to B.
If the fanin cone of Oout (A) is supported by a primary
input, it cannot be built because such inputs are free and
unpredictable. Hence, in this case clock-gating synthesis fails.
Moreover, when constructing X(Oc (out)) recursively with
a depth limit, it is possible to reach gated FFs, which can
introduce until (U) properties into the formulation.
2) Synthesis with the ”Until” Property: To synthesize the
observable condition, Oc (in), for the input of a set of gated
FFs, because it is not the target FF, enold = ennew = en.
Therefore
Oc (in) = en ∧ {X(Oc (out)) ∨ X[(¬en)U(Oc (out))]},
where Oc (out) is the observable condition of the output.
To build Oc (in), Oc (out) is constructed in the original
circuit first and then the idea in the previous section is applied
to create X(Oc (out)). If Oc (out) = T rue, or if X(Oc (out))
cannot be built because Oc (in) depends on some primary
input, X(Oc (out)) is set to T rue directly. Therefore, Oc (in)
can be simplified to en.
After X(Oc (out)) 6= T rue has been constructed, the
relationship between en and X(Oc (out)) 6= T rue needs to be
analyzed to resolve the ”until” (U) part of the target property.
If the property
G(X(Oc (out)) ⇒ (en))
holds, then [(¬en)U(Oc (out))] must be F alse. That is, there
is no out-of-date data that can be observable before the FFs
updates to newer data. Then Oc (in) is built as Oc (in) =
[en ∧ X(Oc (out))] = X(Oc (out)).
If the property in Formula 5 fails, then [(¬en)U(Oc (out))]
can be T rue during execution. This sub-formula can be
as follows:
Comb. X(Oout )
A
[¬en ∧ X(Oc (out))]
Oout ∨[¬en ∧ ¬X(Oc (out)) ∧ ¬X(en) ∧ X2 (Oc (out))]
∨[¬en ∧ (¬X(Oc (out) ∧ ... ∧ ¬X2 (en) ∧ X3 (Oc (out))]
(b)
∨...,
which describes all traces where [(¬en)U(Oc (out))] be-
comes T rue. It is impractical to create all sub-formulas
so [(¬en)U(Oc (out))] is approximated as T rue and thus
Oc (in) = en. That is, the observable condition is formulated
with the enable signal of the gated FFs only, while the
observable condition of the outputs are excluded. Hence, the
recursion of formulating Oc (out) is not performed.
Notice that when constructing observable clock-gating con-
ditions, the combinational blocks computing control signals
(e.g. clouds A and B in Figure 7) are used to construct
enable signals for clock-gating. If those combinational blocks
are complicated, the proposed synthesis can result in some
timing and area overheads while the overall reduction in power
consumption is limited. Hence, applying a proposed clock-
gating condition should be determined by a comprehensive
understanding of the changes in area, timing (critical path)
and power consumption.
C. Synthesis Flow
Given a sequential circuit and a set of target FFs, which has
been gated by enold (enold = constant-1 refers to standard
FFs), the flow in Figure 8 is proposed for clock-gating syn-
thesis, in which a new enable condition enextra is synthesized
and the target FFs are gated by ennew = enextra ∧ enold .
In Figure 8, the first step checks if the target FFs are up-
to-date under enold . This can be done by formulating the
update condition for the FFs input and proving Formula 3
with a hardware model checker. If the property holds, the
(5) target FFs can be clock-gated by using update conditions
(satisfiability clock-gating synthesis) to create a legal enabling
signal enextra without considering observable conditions. If
enextra 6= constant-1, then a legal clock-gating synthesis is
possible.
If (1) the target FFs can be out-of-date, and (2) the property
G(X(Oc (out)) ⇒ enold ) is violated, the proposed flow ter-
minates. If the required condition (G(X(Oc (out)) ⇒ enold ))

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
13

Target set of FFs FF vertices are sorted in a topological order. From Line 4 to
and enold
7, each FF vertex is examined and satisfiability clock-gating
Does
is performed one by one. At Line 5, the update condition
Is the set of FFs No No
always up-to-date?
G(XO(out)⇒ enold ) for the vertex input is formulated on the DG, and then the
hold?
Yes Yes
corresponding signal Uin is constructed on the circuit. Based
on Uin and the old enable signal, isU pT oDate(...) uses a
Perform satisfiability Else Perform observability
clock-gating synthesis clock-gating synthesis
hardware model checker to verify if the target is always up-
to-date. If so, the clock-gating condition of target is revised
ennew ≠ enold en new ≠ enold Else
with Uin , both on the DG and the circuit.
Clock-Gating Synthesis No Synthesis Then only FFs which satisfy the required property are
considered for observability clock-gating. As discussed, ob-
Fig. 8. Synthesis flow for a target set of FFs. servability clock-gating synthesis should be done in a reverse
topological order. For each FF vertex, the observable condition
for its output is formulated, and the algorithm also builds
holds, the target FFs can be clock-gated by using observable the corresponding signal Oin = X(Oout ) on the circuit. Note
conditions (observability clock-gating synthesis) to build an that when recursively constructing X(Oout ), to resolve ”until”
enabling signal enextra . The proposed ennew must satisfy the U formulas, synObs(...) may formulate some properties as
property in Formula 2. If no such ennew exists, the flow stops Formula 5 and prove them by a hardware model checker. If
without modifying the circuit. the observable condition cannot be constructed as a signal,
Finally, if an additional enable condition enextra is pro- Oin is set to T rue, while updateEnable(...) returns without
posed, on the corresponding DG, the enable signal of the target doing anything. If Oin can be constructed, both the DG and
FFs is modified to enold ∧ enextra . On the original circuit, it revCir are revised.
can be represented as inserting a set of MUXes controlled Finally, revCir, sequentially equivalent to Cir, is returned
by enextra between the target FFs and their corresponding as a circuit after clock-gating synthesis.
input signals, where there are feedback loops from the FFs to
MUX inputs. In practice, as in Figure 1, it can be achieved D. Experimental Results
by ANDing the clock with enold ∧ enextra .
Based on the flow for each target FF shown in Figure 8, The proposed synthesis flow was implemented in ABC and
for input circuit, Cir, and input parameter depth, a proposed applied to the golden/revised circuits in the benchmark pairs
synthesis algorithm is outlined in Algorithm 5. Functions that were used in the previous verification experiments. In
synU P D(...) and synOBS(...) are used (1) to formulate Table III, the third column indicates the number of gated FFs
update or observable conditions on the DG based on Algo- proposed by a reference manual analysis (which models what a
rithms 2 and 3, and (2) to construct corresponding signals designer might do). Note that the exact number of FFs gated in
on revCir as described in the previous sections. Note that the industrial cases is unknown(*). The fourth column shows
the property formulation part can be terminated earlier when the number of gated FFs proposed by the DG method. The
reaching already analyzed FFs. In addition, enable signals fifth column gives the total runtime for synthesis.
constructed by clock-gating synthesis can be used to build
TABLE III
other clock-gating conditions. E XPERIMENTAL RESULTS OF THE PROPOSED CLOCK - GATING
SYNTHESIS FLOW.
Algorithm 5 Clock-Gating Synthesis
Require: Cir: a sequential circuit; depth: parameter for the Target FF Reference Synthesis with DG
Circuit # Gated FF # Gated # Runtime(s)
functions synU P D(...) and synOBS(...). aes.Round 645 128 128 1.479
Ensure: revCir: the circuit after clock-gating synthesis. Md5Core 40k 512 32256 23.313
1: DG = dependGraph(Cir) CLA fixed 97 32 32 0.192
Synthetic 1 73 24 24 0.241
2: revCir = Cir Synthetic 2 74 36 50 0.201
3: candidates = topologicalSort(F F V ertices(DG)) Industry 1 92 38* 34 0.494
4: for all target in candidates do Industry 2 187 64* 64 4.052
Industry 3 379 128* 128 10.137
5: Uin = synU P D(input(target), depth, revCir, DG)
6: if isU pT oDate(target, Uin ) then As shown in Table III, the proposed method can synthesize
7: updateEnable(revCir, DG, target, Uin ) clock-gating conditions efficiently. For some cases, like the
8: candidates2 = revT opologicalSort(F F V ertices(DG)) pipeline circuit M d5Core, the DG method can propose more
9: for all target in candidates2 do clock-gating conditions than the reference synthesis does,
10: Oin = synOBS(input(target), depth, revCir, DG) demonstrating improved possibilities for achieving low-power
11: if propertyHold(target, Oin ) then circuit design.
12: updateEnable(revCir, DG, target, Oin ) Comparing to the unknown synthesis done on the industrial
13: return revCir cases, the proposed synthesis flow can identify approximately
the same sets of candidate FFs and perform clock-gating
After constructing the DG for Cir, all standard and gated synthesis. However, some legal clock-gating conditions might

0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCAD.2018.2808231, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems
be overlooked (e.g. in Industry 1) by the proposed algo-
rithm, because it is conservative in formulating observable
conditions. Also, it is possible that the candidate FFs might be
gated by less strict conditions, e.g. some internal transparent
blocks might have been missed. Also, in the industrial cases,
words might be split into single bits due to transparent blocks,
so it might take more time to finish the synthesis flow.
For most of the cases in the experiment, the extra logic
synthesized for additional enable conditions is no more than 5
AND gates, while the pipeline circuit M d5Core requires 63
extra FFs for the satisfiability clock-gating conditions used. In
a modern VLSI design flow, a legal clock-gating condition
may be proposed, but not actually used depending on the
overall improvement in power consumption. In general, the
automatic synthesis framework proposed in this paper can
make the whole flow more independent of manual efforts.
VII. C ONCLUSION
To address both verification and synthesis of clock-gated
circuits, an SEC flow and a synthesis flow were proposed
for sequential circuits. These are based on the fact that most
practical sequential clock-gating synthesis only inserts sequen-
tial redundancies into targeted circuits. Reverse engineering is
used to identify transparent logic blocks and this information
is used in constructing dependency graphs to capture strength-
ened properties for clock-gating. Legal clock-gating conditions
are formulated with LTL and PLTL operators on DGs. Those
properties can be converted into equivalent hardware monitors,
allowing both safety and liveness hardware model checkers to
be used in verification or for synthesizing enabling signals for
clock-gating synthesis. Experimental results showed that the
proposed methodologies are effective and efficient for either
verifying proposed clock-gating conditions or for synthesizing
legal clock-gating conditions to reduce the frequencies of
updating FFs.
R EFERENCES
[1] OpenCores. http://opencores.org/.
[2] E. Arbel, O. Rokhlenko, and K. Yorav. Sat-based synthesis of clock
gating functions using 3-valued abstraction. In Formal Methods in
Computer-Aided Design, 2009. FMCAD 2009, pages 198–204. IEEE,
2009.
[3] J. Baumgartner, H. Mony, V. Paruthi, R. Kanzelman, and G. Janssen.
Scalable sequential equivalence checking across arbitrary design trans-
formations. In International Conference on Computer Design, pages
259–266. IEEE, 2006.
[4] A. Biere, K. Heljanko, T. Junttila, T. Latvala, and V. Schuppan. Linear
encodings of bounded LTL model checking. arXiv preprint cs/0611029,
2006.
[5] R. Brayton and A. Mishchenko. Abc: An academic industrial-strength
verification tool. In Computer Aided Verification, pages 24–40. Springer,
2010.
[6] R. K. Brayton, N. Een, and A. Mishchenko. Using speculation for
sequential equivalence checking. In International Workshop on Logic
and Synthesis, pages 139–145, 2012.
[7] K. Claessen, N. Een, and B. Sterin. A circuit approach to LTL model
checking. In Formal Methods in Computer-Aided Design (FMCAD),
2013, pages 53–60. IEEE, 2013.
[8] E. Clarke, A. Biere, R. Raimi, and Y. Zhu. Bounded model checking
using satisfiability solving. Formal Methods in System Design, 19(1):7–
34, 2001.
[9] Y.-Y. Dai. Verification and Synthesis of Clock-Gated Circuits. PhD
thesis, EECS Department, University of California, Berkeley, Jun 2017.
0278-0070 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
14
[10] Y.-Y. Dai and R. Brayton. Identifying transparent logic in gate-level
circuits. International Workshop on Logic and Synthesis(IWLS), 2016.
[11] Y.-Y. Dai, K.-Y. Khoo, and R. Brayton. Sequential equivalence checking
of clock-gated circuits. In Design Automation Conference. ACM, 2015.
[12] N. Een, A. Mishchenko, and R. K. Brayton. Efficient implementation of
property directed reachability. In Formal Methods in Computer-Aided
Design, pages 125–134, 2011.
[13] A. Saldanha, A. R. Wang, R. K. Brayton, and A. L. Sangiovanni-
Vincentelli. Multi-level logic simplification using don’t cares and filters.
In Design Automation Conference, pages 277–282, New York, NY, USA,
1989. ACM.
[14] H. Savoj, D. Berthelot, A. Mishchenko, and R. Brayton. Combinational
techniques for sequential equivalence checking. In Formal Methods in
Computer-Aided Design(FMCAD), pages 145–150. FMCAD Inc, 2010.
[15] H. Savoj, A. Mishchenko, and R. Brayton. Sequential equivalence
checking for clock-gated circuits. IEEE Transactions on Computer-
Aided Design of Integrated Circuits and Systems, 33(2):305–317, 2014.
[16] M. Sheeran, S. Singh, and G. Stalmarck. Checking safety properties
using induction and a sat-solver. In Formal Methods in Computer-Aided
Design, pages 108–125, London, UK, UK, 2000. Springer-Verlag.
VIII. ACKNOWLEDGEMENTS
This work is supported in part by SRC contract 2265.001 and by the NSA via the
TRUST grant. We also thank industrial sponsors of BVSRC, Altera, Atrenta, Cadence,
Calypto, IBM, Intel, Mentor Graphics, Microsemi, Synopsys, and Verific for their
continued support.
Yu-Yun Dai Yu-Yun Dai received the B.S. and M.S.
degrees in electrical engineering from National Tai-
wan University, Taipei, Taiwan, in 2011 and 2013,
respectively. Then she received the Ph.D. degree in
EECS from University of California, Berkeley, in
2017. She is currently a Research Software Devel-
opment Engineer under the AI and Research depart-
ment in Microsoft Corporation, Redmond, WA.
Robert K. Brayton Robert Brayton received the
BSEE degree from Iowa State in 1956 and the Ph.D.
in Math from MIT in 1961. He was at the IBM
Watson Research Center until he joined Berkeley
in 1987. He held the Buttner and Cadence chairs
at Berkeley. He is a member of the US National
Academy of Engineering, and a Fellow of the IEEE.
Awards received include the Iowa State Marston
Medal, the IEEE Piore, ACM Kanallakis, EDAA
lifetime achievement, EDAC/CEDA Kaufmann, the
Pederson Best Paper in IEEE Trans. CAD, the
ACM/IEEE Richard Newton Technical Impact, and the Iowa State University
Outstanding Alumnus. He has authored over 500 technical papers, and 11
books.