# A Digital Delay Model Supporting Large Adversarial Delay Variations
††thanks: This research was supported by the Austrian Science Fund (FWF)
project DMAC (grant no. P32431).

Daniel Öhlinger, Ulrich Schmid  Embedded Computing Systems Group (E191-02)
TU Wien, Vienna, Austria
{doehlinger<EMAIL_ADDRESS>
###### Abstract

Dynamic digital timing analysis is a promising alternative to analog
simulations for verifying particularly timing-critical parts of a circuit. A
necessary prerequisite is a digital delay model, which allows to accurately
predict the input-to-output delay of a given transition in the input signal(s)
of a gate. Since all existing digital delay models for dynamic digital timing
analysis are deterministic, however, they cannot cover delay fluctuations
caused by PVT variations, aging and analog signal noise. The only exception
known to us is the $\eta$-IDM introduced by Függer et al. at DATE’18, which
allows to add (very) small adversarially chosen delay variations to the
deterministic involution delay model, without endangering its faithfulness. In
this paper, we show that it is possible to extend the range of allowed delay
variations so significantly that realistic PVT variations and aging are
covered by the resulting extended $\eta$-IDM.

©2023 IEEE. Personal use of this material is permitted. Permission from IEEE
must be obtained for all other uses, in any current or future media, including
reprinting/republishing this material for advertising or promotional purposes,
creating new collective works, for resale or redistribution to servers or
lists, or reuse of any copyrighted component of this work in other works.

##  I Introduction

Accurate signal propagation predictions are crucial for modern digital circuit
design. The highest accuracy is currently achievable by analog simulations,
e.g., using SPICE. These suffer, however, from excessive running times. A
considerably more efficient alternative is _dynamic_ digital timing analysis,
which traces individual signal transitions throughout a circuit. Application
examples are clock trees or time-based encoded inter-neuron links in hardware-
implemented spiking neural networks [1], where the (very accurate but worst-
case) delay estimates provided by classic static timing analysis techniques
like CCSM [2] and ECSM [3] are not sufficient for ensuring correct operation.

Existing digital dynamic timing analysis tools like Cadence NC-Sim, Siemens
ModelSim or Synopsis VCS rely on simple gate delay models like pure delays (=
constant delay) or inertial delays (= constant delay, but pulses shorter than
some upper bound are removed) [4]. However, research has also provided more
elaborate _single-history_ delay models like the _degradation delay model_
(DDM) [5] and, in particular, the _involution delay model_ (IDM) [6, 7], where
the input-to-output delay $\delta(T)$ depends on the previous-output-to-input
delay $T$ (see Fig. 1).

The distinguishing feature of the IDM is that it is the only delay model known
so far that is faithful w.r.t. a “canonical” problem called _short-pulse
filtration_ (SPF) [8] (see Definition 1), which means that the
solvability/impossibility border for circuits specified in the IDM matches the
solvability/impossibility border for real circuits: whereas it is possible to
implement unbounded SPF in reality, this is not the case for bounded SPF,
where all output transitions must occur within bounded time. An essential
property required for faithfulness is _continuity_ of the underlying digital
channel model, in the sense that minor changes (which also include short
glitches, at arbitrary positions) of the signal at an input of a gate must
result in minor changes of the output signal only. It has been proved in [8]
that no existing delay model (except the IDM) satisfies this continuity
property.

The defining characteristics of the IDM is a pair of differentiable concave
delay functions (monotonically increasing, with monotonically decreasing
derivative) for rising ($\delta_{\uparrow}(T)$) and falling
($\delta_{\downarrow}(T)$) transitions that satisfy the involution property
$-\delta_{\uparrow}(-\delta_{\downarrow}(T))=T$. It has been proved in [7]
that this ensures continuity and hence faithfulness w.r.t. the SPF problem.
The IDM also comes with public domain tool support, the _Involution Tool_ , a
simulation framework based on ModelSim, which has been used to demonstrate the
good accuracy of the IDM predictions for several simple circuits [9]. Certain
deficiencies of the IDM regarding composition of circuits have been alleviated
in the _Composable Involution Delay Model_ (CIDM) [10].

One shortcoming of all existing delay models, including the original IDM and
the CIDM, are their _deterministic_ delay predictions. After all, e.g.
$\delta_{\uparrow}(T)$ is a _function_ that only depends on the previous-
output-to-input delay $T$. Delay fluctuations caused by other effects, like
PVT variations, aging, and electrical signal noise, cannot be accommodated
here. Given the prominence of these effects in modern VLSI circuits, however,
they should be incorporated somehow. We note that this requirement is even
more pressing in any attempt on formal verification of circuits, which aims at
proving that a given circuit will meet its specification in _every_ feasible
trace.

In their DATE’18 paper [11], Függer at. al. introduced an extension of the
IDM, called $\eta$-IDM, which allows to add a small amount of adversarial
delay variations to the fully deterministic delay predictions of the IDM. That
is, for every signal transition, the standard IDM delay
$\delta_{\uparrow/\downarrow}(T)$ can be replaced by
$\delta_{\uparrow/\downarrow}(T)+\eta$ for some arbitrarily chosen
$\eta\in[-\eta^{-},\eta^{+}]$. This feature can of course be used to cover any
bounded-range delay fluctuation. The authors proved that the resulting
$\eta$-IDM does not invalidate the faithfulness of the original IDM, provided
the variation range $[-\eta^{-},\eta^{+}]$ is (very) small. Unfortunately,
however, SPICE simulation data revealed that even voltage variations of 1 %
and transistor size variations of 10 % already exceeded the allowed range.

In this paper, we show that the allowed range $[-\eta^{-},\eta^{+}]$ can be
extended significantly. The key to our _extended $\eta$-IDM_ is to make the
allowed variation range dependent on $T$, i.e., to allow
$\eta\in[-\eta^{-}(T),\eta^{+}(T)]$ depending on the previous-output-to-input
delay $T$ of the current transition. In particular, except for very small
values of $T$, the variation range may be large.

### Detailed contributions

  1. (1)

We define our extended $\eta$-IDM, by providing the constraints that must be
satisfied by $[-\eta^{-}(T),\eta^{+}(T)]$, and prove that the SPF
implementation already used in [11] also works correctly in this model.

  2. (2)

We show that it is possible to combine the extended $\eta$-IDM with the CIDM
[10], which results in the $\eta$-CIDM that provides the best of both worlds.
We also extended the Involution Tool [9] appropriately.

  3. (3)

We perform elaborate analog simulations under different PVT variations and
aging, and compare the simulated delays with the predicted delays of our
$\eta$-CIDM. It turns out that, unlike the model in [11], our new model can
capture a wide range of such variations.

### Paper organization

In Section II, the necessary basics for the IDM and the $\eta$-IDM are
presented. Section III provides the proofs for the faithfulness for the
extended delay variation range. In Section IV, we sketch how the extended
$\eta$-IDM and the CIDM can be seamlessly combined. The experiments in Section
V demonstrate the substantially increased coverage of our new model. Section
VI concludes our paper.

##  II The Existing $\eta$-IDM

In sharp contrast to all other delay models known so far, the IDM is based on
_unbounded_ single-history channels: Referring to Fig. 1, the gate delay
$\delta(T)$ may also become arbitrarily negative here (for specific values of
the previous-output-to-input delay $T$), which has been proved to be mandatory
for perfect glitch cancellation [8].

Figure 1: Delay calculation for a single-history channel.

In order to also account for PVT variations and aging, [11] introduced the
$\eta$-IDM: On top of the deterministic delay calculations of the IDM, an
adversarial delay $\eta\in[-\eta^{-}_{min},\eta^{+}_{min}]$ is added. More
specifically, the delay $\delta_{n}$ for the $n^{th}$ transition is calculated
as

$\delta_{n}=\delta_{\uparrow}(\max\\{{t_{n}-t_{n-1}-\delta_{n-1},-\delta^{\downarrow}_{\infty}}\\})+\eta_{n}$
(1)

for a rising transition, and

$\delta_{n}=\delta_{\downarrow}(\max\\{{t_{n}-t_{n-1}-\delta_{n-1},-\delta^{\uparrow}_{\infty}}\\})+\eta_{n}$
(2)

for a falling transition, where $t_{n}$ and $t_{n-1}$ are the time of the
current resp. previous input transition, and
$\eta_{n}\in[-\eta^{-}_{min},\eta^{+}_{min}]$. Fig. 2 illustrates two of the
infinitely many possible output signals of a channel in the $\eta$-IDM, for a
fixed input signal, where the dashed lines represent the deterministic delay
prediction by the IDM. It is apparent that the adversary has the power to
cancel or uncancel pulses w.r.t. the deterministic prediction.

Figure 2: Example trace through an $\eta$-involution channel (adapted from
[11]).

Since faithfulness is defined with respect to the _Short-Pulse Filtration_
(SPF) problem, we recall its definition here. Informally, it is similar to the
problem of building an inertial delay channel from a single input up-down
pulse of length $\Delta_{0}$ starting at time $t_{0}$:

######  Definition 1 (Short-Pulse Filtration, see [7]).

A circuit that solves SPF needs to adhere to the following constraints:

  1. F1)

Well-formedness: The circuit has exactly one input and one output port.

  2. F2)

No generation: The circuit does not generate a pulse on the output, if no
pulse is on the input.

  3. F3)

Nontriviality: The output is not the zero signal for all pulses.

  4. F4)

No short pulses: There exists an $\varepsilon>0$ such that the output signal
does not contain pulses of length less than $\varepsilon$.

For the bounded version of SPF, there is an additional constraint:

  1. F5)

Bounded stabilization time: There exists a $K>0$ such that for every input
pulse the last output transition is before time $t_{0}+K$.

For any input signal other than a single pulse, we allow the SPF circuit to
behave arbitrarily.

In order to show that the $\eta$-IDM does not allow to solve bounded SPF, the
authors of [11] used a simple reduction proof: By setting all delay variations
$\eta=0$, the model degenerates to the plain IDM, where this is known to be
impossible [7]. The other case, namely, showing that it is possible to solve
unbounded SPF in the $\eta$-IDM, turned out to be trickier: For the SPF
circuit given in Fig. 3, they analyzed all possible behaviors via a case
distinction on the length of the input pulse $\Delta_{0}$ (short, large and
medium). The most delicate case turned out to be medium pulse lengths, where a
critical (infinite) pulse train with up-time $\Delta$ and down-time
$\Delta^{\prime}$ may be generated. It occurs if the adversary maximally
delays all rising transitions (by $\eta^{+}_{min}$) and minimally delays all
falling transitions (by $-\eta^{-}_{min}$), provided the (quite restrictive)
constraint

$\eta^{+}_{min}+\eta^{-}_{min}<\delta_{\downarrow}(-\eta^{+}_{min})-\delta_{\mathrm{min}}$
(C1)

holds. If the adversary chooses delay variations that ever cause the up-time
of a pulse to become larger than $\Delta$, it cannot revert to pulses with
shorter up-times again, and hence cannot prohibit the feedback loop of the OR
gate to eventually lock at 1. Consequently, a correct SPF circuit is obtained
by letting the high-threshold buffer at the output map all pulse trains with
up-times less or equal $\Delta$ to constant $0$, as all pulse trains that ever
exceed $\Delta$ will lead to a single rising transition at the output.

Figure 3: The SPF circuit for the $\eta$-IDM used in [11]. It consists of an
OR gate with a feed-back $\eta$-IDM channel ($c_{f}$) and a subsequent high-
threshold buffer implemented by another $\eta$-IDM channel ($c_{buf}$).

##  III Extending the Variation Range of the $\eta$-IDM

In this section, we will show that the range of adversarial variations of the
$\eta$-IDM can be increased substantially, without sacrificing faithfulness
with respect to the SPF problem. The crucial idea of our extension is to
introduce $T$-dependent bounds in the variation range
$[-\eta^{-}(T),\eta^{+}(T)]$, which coincide with the original bounds
$[-\eta^{-}_{min},\eta^{+}_{min}]$ only for two very small values of $T$,
which are quite insensitive to delay fluctuations.

Let $\Delta$ be the up-time of the critical pulse train identified in [11]
(which is determined by the fixed point of $f(.)$ given in Eq. 7) and
$\delta_{\mathrm{min}}>0$ be the unique minimum delay value of a strictly
causal111Where $\delta_{\uparrow}(0)>0$ and $\delta_{\downarrow}(0)>0$. IDM
channel, defined by

$\delta_{\uparrow}(-\delta_{\mathrm{min}})=\delta_{\mathrm{min}}=\delta_{\downarrow}(-\delta_{\mathrm{min}})$
(3)

according to [7, Lem. 3].

######  Definition 2.

For some given constants

$\rho^{+}\geq 0,\rho^{-}\geq 0$ (C2)

some $\eta^{+}_{\infty}\geq\eta^{+}_{min}$,
$\eta^{-}_{\infty}\geq\eta^{-}_{min}$, some $\overline{\Delta}$ satisfying
$\overline{\Delta}\geq\delta_{\uparrow}(-\overline{\Delta})+\rho^{+}\cdot(\overline{\Delta}-\Delta)+\eta^{+}_{min}$,
and $\Delta^{\prime}=\delta_{\uparrow}(-\Delta)+\eta^{+}_{min}-\Delta$, let

$\eta^{+}(T)=\begin{cases}\eta^{+}_{\infty}&\text{for}\
T<-\overline{\Delta},\\\ \rho^{+}\cdot(-T-\Delta)+\eta^{+}_{min}&\text{for}\
-\overline{\Delta}\leq T\leq-\Delta,\\\ \eta^{+}_{\infty}&\text{for}\
T>-\Delta,\end{cases}$ (4)

$\eta^{-}(T)=\begin{cases}\eta^{-}_{\infty}&\text{for}\ T<-\Delta^{\prime},\\\
\rho^{-}\cdot(-T+\Delta^{\prime})+\eta^{-}_{min}&\text{for}\
-\Delta^{\prime}\leq T<0,\\\ \eta^{-}_{\infty}&\text{for}\ T\geq
0.\end{cases}$ (5)

Fig. 4 shows the comparison of the old and the new bounds for the $\eta$-IDM.
Note carefully that the only values of $T$ for which the bounds could not be
enlarged are $-\Delta$ and $-\Delta^{\prime}$, i.e., the up-time and the down-
time of the critical infinite pulse train identified in [11]. For the inverter
used in Section V, the actual values are
$\eta^{+}_{min}\approx\eta^{-}_{min}\approx$63\text{\,}\mathrm{fs}$,\eta^{+}_{\infty}\approx\eta^{-}_{\infty}\approx$1.47\text{\,}\mathrm{ns}$,\Delta\approx$191\text{\,}\mathrm{fs}$,\Delta^{\prime}\approx$63\text{\,}\mathrm{fs}$$
and $\overline{\Delta}=$230\text{\,}\mathrm{fs}$$. Both $\eta^{+}_{\infty}$
and $\eta^{-}_{\infty}$ are hence approximately $20$ times larger than the
original bounds $\eta^{+}_{min}$ and $\eta^{-}_{min}$ here.

Figure 4: Comparison of the old bounds (blue) and the new bounds (green). Note
the discontinuity sign on the y-axis. For the example circuit used in our
evaluation in Section V, $\eta^{+}_{\infty}\approx\eta^{-}_{\infty}\approx
20\eta^{+}_{min}\approx 20\eta^{-}_{min}$.

For proving the faithfulness of the extended $\eta$-IDM, we show:

  * G1)

There is no circuit with extended $\eta$-IDM-channels that can solve bounded
SPF.

  * G2)

There exists a circuit with extended $\eta$-IDM-channels that can solve
unbounded SPF.

For G1), the exact same proof as in the original $\eta$-IDM paper [11] can be
used: Setting all the adversarial delays $\eta_{n}=0$ lets the $\eta$-IDM-
channel degenerate to an IDM-channel, which does not allow solve bounded SPF
[7].

The intricate part is again the proof of G2), where we split the range of the
input pulse lengths $\Delta_{0}$ into three intervals.

######  Lemma 3.

If the input pulse length satisfies
$\Delta_{0}\geq\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$ for
$\delta^{\uparrow}_{\infty}=\lim_{T\to\infty}\delta_{\uparrow}(T)$, then the
output of the OR gate $o_{or}$ in Fig. 3 has a rising transition at time $0$
and no falling transitions.

###### Proof.

The rising transition from the input $i_{1}$ arrives at latest at
$t_{1}^{\prime}\leq\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$ at $i_{2}$
(one can assume that the OR gate has been initialized to output 0 at time
$t=-\infty$). Therefore, the falling transition on input $i_{1}$ happens at or
after $t_{1}^{\prime}$, so has no influence on the output of the OR gate: the
feedback loop hence locks at constant $1$. ∎

######  Lemma 4.

If the input pulse length satisfies
$\Delta_{0}\leq\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}-\eta^{+}_{\infty}-\eta^{-}_{\infty}$,
then the output pulse of the OR gate $o_{or}$ in Fig. 3 only contains the
input pulse.

###### Proof.

The earliest time that the rising transition from $i_{1}$ can be propagated to
$i_{2}$ is now
$t_{1}^{\prime}\geq\delta^{\uparrow}_{\infty}-\eta^{-}_{\infty}$. Therefore,
for the falling transition, we get $T=\Delta_{0}-t_{1}^{\prime}$, the falling
output transition on $i_{2}$ hence cannot occur later than
$t_{2}^{\prime}\leq\Delta_{0}+\delta_{\downarrow}(T)+\eta^{+}(T)$. The two
transitions on $i_{2}$ cancel each other out iff $t_{2}^{\prime}\leq
t_{1}^{\prime}$, i.e., iff

$X=\Delta_{0}+\delta_{\downarrow}(T)+\eta^{+}(T)-\delta^{\uparrow}_{\infty}+\eta^{-}_{\infty}\leq
0.$ (6)

Plugging in the upper bound on $\Delta_{0}$ from our lemma into
$\delta_{\downarrow}(T)=\delta_{\downarrow}(\Delta_{0}-t_{1}^{\prime})\leq\delta_{\downarrow}(\Delta_{0}-\delta^{\uparrow}_{\infty}+\eta^{-}_{\infty})$
while recalling monotonicity of $\delta_{\downarrow}(.)$,
$\eta^{+}_{\infty}\geq 0$ reveals
$\delta_{\downarrow}(T)\leq-\delta_{\mathrm{min}}+\delta_{\downarrow}(-\delta_{\mathrm{min}})=0$
according to Eq. 3. Using these upper bounds in Eq. 6 leads to $X\leq 0$,
hence the two transitions indeed cancel each other. ∎

Note that the upper bound on $\Delta_{0}>0$ given in Lemma 4 already implies
the constraint

$\eta^{+}_{\infty}+\eta^{-}_{\infty}<\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}.$
(C3)

The most delicate part of the proof are again medium-sized input pulses, i.e.,
where
$\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}-\eta^{+}_{\infty}-\eta^{-}_{\infty}<\Delta_{0}<\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$.
Inspired by [11], we also consider a self-repeating critical pulse train, by
letting the adversary choose all rising transitions maximally late
($\eta^{+}(T)$) and all falling transitions maximally early ($-\eta^{-}(T)$).
Formally, for a pulse of length $\Delta_{n-1}$, the length of the next pulse
$\Delta_{n}$ can be calculated as:

$\displaystyle\Delta_{n}=$ $\displaystyle g(\Delta_{n-1})=$
$\displaystyle\Delta_{n-1}-\delta_{\uparrow}(-\Delta_{n-1})-\eta^{+}(-\Delta_{n-1})$
$\displaystyle+\delta_{\downarrow}(-\delta_{\uparrow}(-\Delta_{n-1})-\eta^{+}(-\Delta_{n-1})+\Delta_{n-1})$
$\displaystyle-\eta^{-}(-\delta_{\uparrow}(-\Delta_{n-1})-\eta^{+}(-\Delta_{n-1})+\Delta_{n-1}),$
(7)

where $\eta^{+}(T)$ and $\eta^{-}(T)$ are given by Definition 2. The period
$P_{n}=\Delta_{n}+\Delta^{\prime}_{n+1}$ resp.
$P^{\prime}_{n}=\Delta^{\prime}_{n}+\Delta_{n}$ involving the pulse
$\Delta_{n}$, measured from the rising transition of $\Delta_{n}$ to the
rising transition of $\Delta_{n+1}$ resp. the falling transition of
$\Delta_{n-1}$ to the falling transition of $\Delta_{n}$, is

$\displaystyle P_{n}$
$\displaystyle=\delta_{\uparrow}(-\Delta_{n})+\eta^{+}(-\Delta_{n})\mbox{
resp.\ }$ $\displaystyle P^{\prime}_{n}$
$\displaystyle=\delta_{\downarrow}(-\Delta^{\prime}_{n})-\eta^{-}(-\Delta^{\prime}_{n}).$
(8)

We note that the length of the next pulse and the periods of the critical
pulse train established in [11] are

$\displaystyle\Delta_{n}$
$\displaystyle=f(\Delta_{n-1})=\Delta_{n-1}-\delta_{\uparrow}(-\Delta_{n-1})-\eta^{+}_{min}-\eta^{-}_{min}$
$\displaystyle\qquad\qquad+\delta_{\downarrow}\Big{(}-\delta_{\uparrow}(-\Delta_{n-1})-\eta^{+}_{min}+\Delta_{n-1}\Big{)},$
(9) $\displaystyle P_{n}$
$\displaystyle=\delta_{\uparrow}(-\Delta_{n})+\eta^{+}_{min}\mbox{ resp.\
}P^{\prime}_{n}=\delta_{\downarrow}(-\Delta^{\prime}_{n})-\eta^{-}_{min},$

which were shown in [12, Lem. 5] to have a fixed point
$\Delta:=\Delta_{n-1}=\Delta_{n}<\delta_{\mathrm{min}}$ and a period
$P=P^{\prime}=\tau$ for some
$\eta^{+}_{min}+\delta_{\mathrm{min}}<\tau<\min(-\eta^{-}_{min}+\delta^{\downarrow}_{\infty},\eta^{+}_{min}+\delta^{\uparrow}_{\infty})$,
provided the constraint Eq. C1 holds.

The following Lemma 5 shows that $\Delta$ is also a fixed point for Eq. 7:

######  Lemma 5.

The fixed point $f(\Delta)=\Delta$ for the old bounds is also a fixed point
for the new bounds, i.e., $g(\Delta)=\Delta$. The critical pulse train defined
by Eq. 7 hence has the same period $P=P^{\prime}=\tau$ and duty cycle
$\gamma=\Delta/\tau<1$ as the one defined by Eq. 9.

###### Proof.

Plugging in $\Delta$ in Eq. 7 and applying the definition for $\eta^{+}(.)$
and $\eta^{-}(.)$ from Definition 2 yields

$\displaystyle g(\Delta)=$
$\displaystyle\delta_{\downarrow}\Big{(}-\delta_{\uparrow}(-\Delta)-\eta^{+}_{min}+\Delta\Big{)}$
$\displaystyle-\eta^{-}_{min}-\delta_{\uparrow}(-\Delta)-\eta^{+}_{min}+\Delta.$
(10)

A term-wise comparison of Eq. 9 with $\Delta_{n-1}=\Delta_{n}=\Delta$ and Eq.
10 reveals that $g(\Delta)=\Delta$. Plugging in $\Delta$ in Eq. 8 and noting
$\eta^{+}(-\Delta)=\eta^{+}_{min}$ and $\eta^{-}(-\Delta)=\eta^{-}_{min}$ also
confirms the same period and hence duty cycle. ∎

In order to guarantee diverging from the critical pulse train for excessive
pulses, we need a bound on the derivative of $g(.)$:

######  Lemma 6.

For $g(x)$ defined in Eq. 7, we have $g^{\prime}(x)>1$ for
$\overline{\Delta}\geq x\geq\Delta$, provided

$(1-\rho^{-})(\delta_{\uparrow}^{\prime}(-\Delta)-\rho^{+}+1)>1.$ (C4)

###### Proof.

Calculating the derivative of $g(x)$ yields:

$\displaystyle g^{\prime}(x)=$
$\displaystyle\bigg{[}1+\delta_{\downarrow}^{\prime}\Big{(}-\delta_{\uparrow}(-x)-\eta^{+}(-x)+x\Big{)}$
$\displaystyle-\eta^{-^{\prime}}\Big{(}-\delta_{\uparrow}(-x)-\eta^{+}(-x)+x\Big{)}\bigg{]}$
$\displaystyle\cdot\Big{(}\delta_{\uparrow}^{\prime}(-x)+\eta^{+^{\prime}}(-x)+1\Big{)}$
$\displaystyle\geq$
$\displaystyle\bigg{[}1+\delta_{\downarrow}^{\prime}\Big{(}-\delta_{\uparrow}(-x)-\eta^{+}(-x)+x\Big{)}-\rho^{-}\bigg{]}$
$\displaystyle\cdot\Big{(}\delta_{\uparrow}^{\prime}(-x)-\rho^{+}+1\Big{)}$
(11) $\displaystyle>$
$\displaystyle(1-\rho^{-})(\delta_{\uparrow}^{\prime}(-\Delta)-\rho^{+}+1)>1$
(12)

To justify Eq. 11, we note that $\delta_{\uparrow}(.)$ and
$\delta_{\downarrow}(.)$ are strictly increasing and concave, so
$\delta_{\uparrow}^{\prime}(.)>0$ and $\delta_{\downarrow}^{\prime}(.)>0$.
Moreover, $\delta_{\uparrow}^{\prime}(-x)$ is decreasing in $-x$, hence can be
lower bounded by $\delta_{\uparrow}^{\prime}(-\Delta)$ since $x\geq\Delta$,
and $\rho^{+}\geq 0$ and $\rho^{-}\geq 0$ according to Definition 2. Choosing
$\rho^{+}$ and $\rho^{-}$ according to the sufficient condition Eq. C4 finally
ensures $g^{\prime}(x)>1$. ∎

As the next step in our proof, we need to show that pulses that are larger
than $\Delta$ cannot come back, i.e., if $\Delta_{n-1}>\Delta$ ever holds,
then $\Delta_{n-1+k}<\Delta_{n+k}$ for every $k\geq 0$:

######  Lemma 7.

It holds that $g(\Delta_{1})-\Delta>\Delta_{1}-\Delta$ if $\Delta_{1}>\Delta$,
provided that $\rho^{+}$ and $\rho^{-}$ are chosen according to Eq. C4.

###### Proof.

From the mean value theorem of calculus, we know that

$\displaystyle\exists\xi\in(\Delta,\Delta_{1})\ s.t.\
g^{\prime}(\xi)=\frac{g(\Delta_{1})-g(\Delta)}{\Delta_{1}-\Delta}.$ (13)

Applying the fact that $g(\Delta)=\Delta$ and rearranging yields
$g(\Delta_{1})-\Delta=g^{\prime}(\xi)(\Delta_{1}-\Delta)$. From Lemma 6, we
know that
$g^{\prime}(\xi)>(1-\rho^{-})(\delta_{\uparrow}^{\prime}(-\Delta)-\rho^{+}+1)$,
and hence $g(\Delta_{1})-\Delta>\Delta_{1}-\Delta$, if $\rho^{+}$ and
$\rho^{-}$ are chosen appropriately. ∎

It still remains to be shown that the feedback loop locks at 1 when the pulse
width reaches $\overline{\Delta}$ given in Definition 2:

######  Lemma 8.

The feedback loop locks when the pulse length satisfies
$\Delta_{n}\geq\overline{\Delta}\geq\delta_{\uparrow}(-\overline{\Delta})+\rho^{+}\cdot(\overline{\Delta}-\Delta)+\eta^{+}_{min}$.

###### Proof.

The feedback loops locks at 1 if the rising transition of pulse $\Delta_{n+1}$
is scheduled before or at the same time as the falling transition of pulse
$\Delta_{n}$. This cancellation happens when
$\delta_{\uparrow}(-\overline{\Delta})+\eta^{+}(-\overline{\Delta})\leq\overline{\Delta}$,
which is implied by the assumption on $\overline{\Delta}$ stated in our lemma
and the definition of $\eta^{+}(T)$ for $T=-\overline{\Delta}$ given in
Definition 2. ∎

######  Theorem 9.

The new bounds ensure that pulses which are larger than $\Delta$ are
monotonically increasing until the pulse length reaches $\overline{\Delta}$
and the feedback loop locks at 1.

###### Proof.

The theorem immediately follows by combining Lemmas 5, 6, 7 and 8. ∎

######  Theorem 10.

Consider the circuit in Fig. 3 subject to the following constraints:

  1. (C1)

$\eta^{+}_{min}+\eta^{-}_{min}<\delta_{\downarrow}(-\eta^{+}_{min})-\delta_{\mathrm{min}}$

  2. (C2)

$\rho^{+}\geq 0$, $\rho^{-}\geq 0$

  3. (C3)

$\eta^{+}_{\infty}+\eta^{-}_{\infty}<\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}$

  4. (C4)

$(1-\rho^{-})(\delta_{\uparrow}^{\prime}(-\Delta)-\rho^{+}+1)>1$.

The OR gate fed-back by a strictly causal $\eta$-IDM channel has the following
output when the input pulse has length $\Delta_{0}$:

  * (i)

If the input pulse length is
$\Delta_{0}\geq\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$, then the output
of the OR gate $o_{or}$ has a unique rising transition at time $0$ and no
falling transitions.

  * (ii)

If the input pulse length is
$\Delta_{0}\leq\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}-\eta^{+}_{\infty}-\eta^{-}_{\infty}$,
then the output pulse of the OR gate $o_{or}$ only contains the input pulse.

  * (iii)

If
$\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}-\eta^{+}_{\infty}-\eta^{-}_{\infty}<\Delta_{0}<\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$,
then the output may resolve to a constant $0$ or $1$, or may be an (infinite)
pulse train with a maximum pulse up-time of $\Delta$ and a maximum duty cycle
of $\gamma=\Delta/\tau<1$.

###### Proof.

By combining Lemmas 3, 4, 5 and 9, the resolution to 1 resp. the maximum up-
time bound $\Delta$ follow immediately. To also confirm the upper bound on the
duty cycle, we show by contradiction that no infinite pulse train can contain
a pulse with a down-time $\Delta^{\prime}_{n}<P-\Delta$: Since
$P^{\prime}_{n}=\Delta^{\prime}_{n}+\Delta_{n}=\delta_{\downarrow}(-\Delta^{\prime}_{n})-\eta^{-}(-\Delta^{\prime}_{n})$
by Eq. 8, it decreases with both $\Delta^{\prime}_{n}$ and
$\eta^{-}(-\Delta^{\prime}_{n})\geq\eta^{-}_{min}$. Hence, if
$\Delta^{\prime}_{n}<P-\Delta$ ever occurred, we would get
$P^{\prime}_{n}>P^{\prime}=\delta_{\downarrow}(-P+\Delta)-\eta^{-}_{min}=P$.
Hence, it follows that $\Delta_{n}=P^{\prime}_{n}-\Delta^{\prime}_{n}>\Delta$,
which contradicts the upper bound $\Delta_{n}\leq\Delta$ established before. ∎

It only remains to properly choose the high-threshold buffer at the output of
the OR gate. First, it must map infinite and decreasing pulse trains
($\Delta_{n}\leq\Delta$ for $n\geq 0$) according to (iii) in Theorem 10 to the
zero signal. Second, for an increasing pulse train (some $\Delta_{n}>\Delta$),
it needs to be ensured that once the high-threshold buffer switches to one it
never switches back. It has been shown in [11, Lem. 3] that it is possible to
implement a high-threshold buffer with the required properties with a simple
exponential IDM channel (an exp-channel, see [9] for details), which finally
establishes:

######  Theorem 11.

There is a circuit that solves unbounded SPF in the extended $\eta$-IDM.

##  IV The $\eta$-CIDM

In this section, we will sketch how the extended $\eta$-IDM and the Composable
Involution Delay Model (CIDM) [10] can be seamlessly combined. The CIDM
generalizes the IDM by adding a transition-dependent pure-delay shifter
$\Delta^{+/-}$ (with $\Delta^{+}$ resp. $\Delta^{-}$ affecting
$\delta_{\uparrow}(.)$ resp. $\delta_{\downarrow}(.)$ only) at each input of a
gate, and re-ordering/changing the different internal components of IDM
channels, as shown in Fig. 5 for the SPF circuit in Fig. 3. The pure-delay
shifter $\Delta^{+/-}$ can be used to account for threshold voltage variations
between gates, which considerably decreases the circuit characterization
effort: a single threshold voltage like $V_{th}=V_{DD}/2$ can be used for all
gates of a circuit. Moreover, the pure-delay shifter makes it easy to
implement high-threshold buffers with arbitrary threshold voltages.

Figure 5: The SPF circuit of Fig. 3 implemented by means of CIDM channels. The
internal component $\Delta^{+/-}$ resp. $C$ represent the pure delay shifter
resp. the cancellation unit, which removes out-of-order transitions.
$\overline{\delta}_{\uparrow},\overline{\delta}_{\downarrow}$ is a standard
IDM channel without cancellation unit.

CIDM channels are characterized by the delay functions

$\displaystyle\delta_{\uparrow}(T)$
$\displaystyle=\Delta^{+}+\overline{\delta}_{\uparrow}(T+\Delta^{+})\
\textrm{and}$ (14) $\displaystyle\delta_{\downarrow}(T)$
$\displaystyle=\Delta^{-}+\overline{\delta}_{\downarrow}(T+\Delta^{-}),$ (15)

which do not satisfy the involution property. Still, it turned out that the
result of concatenating the tail (the IDM channel
$\overline{\delta}_{\uparrow},\overline{\delta}_{\downarrow}$) of the CIDM of
a predecessor gate with the head (the pure delay shifter $\Delta^{+/-}$ and
the cancellation unit $C$) of the CIDM of the successor gate _does_ form a
regular IDM channel (albeit with delay functions that are usually different
from $\overline{\delta}_{\uparrow}(.)$ and
$\overline{\delta}_{\downarrow}(.)$). Consequently, it is possible to transfer
results obtained for circuits made up of IDM channels to circuits made up of
CIDM channels. In particular, this is true for our extended $\eta$-IDM, as the
SPF circuit shown in Fig. 5 is indeed equivalent (modulo some pure delay
shifts) to Fig. 3.

In the $\eta$-CIDM, a CIDM-channel with an appropriately chosen $\Delta^{+}$
and $\Delta^{-}$ can be used to replace the exp-channel-implementation of the
high-threshold buffer used in [11]:

######  Lemma 12.

For any $\Theta>0$, the high-threshold buffer in Fig. 5 can be implemented by
a strictly causal CIDM-channel, which ensures that all pulses (at $o_{or}$)
with up-time $\Delta_{n}\leq\Theta$ are canceled and the zero signal is
generated at $i_{buf}$ and hence $o_{buf}$.

###### Proof.

The adversaries in the feedback loop ($\eta_{2}$) and between the OR gate and
the high-threshold buffer ($\eta_{1}$) can add variations in the range
[$-{\eta^{-}_{\infty}}_{,2},{\eta^{+}_{\infty}}_{,2}$] resp.
[$-{\eta^{-}_{\infty}}_{,1},{\eta^{+}_{\infty}}_{,1}$]. Note that we can
neglect the $T$-dependency for the adversaries here and just use the maximum
possible delay variation. By back-tracking the pulse $\Delta_{n}$ through
${i_{2}}$, $i_{2}^{\prime}$ and the adversary $\eta_{2}$, the maximum length
of the corresponding up-pulse at $o_{or}^{\prime}$ can be determined as:

$\Delta_{n}^{\prime}=\Delta_{n}+\Delta_{i_{2}}^{+}+{\eta^{+}_{\infty}}_{,2}+{\eta^{-}_{\infty}}_{,2}-\Delta_{i_{2}}^{-}.$
(16)

It is achieved if the rising transition is maximally delayed and the falling
transition is minimally delayed by the adversary. Consequently, we obtain
$\Delta_{n}^{\prime}\leq\Theta^{\prime}$ for
$\Theta^{\prime}=\Theta+\Delta_{i_{2}}^{+}+{\eta^{+}_{\infty}}_{,2}+{\eta^{-}_{\infty}}_{,2}-\Delta_{i_{2}}^{-}$.
It thus suffices to choose $\Delta^{+}_{htb}$ and $\Delta^{-}_{htb}$ such that
all up-pulses $\Delta_{n}^{\prime}\leq\Theta^{\prime}$ are mapped to constant
$0$, which is ensured if

$\Theta^{\prime}+\Delta^{-}_{htb}+{\eta^{+}_{\infty}}_{,1}\leq\Delta^{+}_{htb}-{\eta^{-}_{\infty}}_{,1}$
(17)

holds. Since it has been shown in [10] that $\Delta_{htb}^{+}$ can be chosen
arbitrarily large (whereas $\Delta_{htb}^{-}$ is lower-bounded in order not to
violate strict causality of the CIDM channel), Eq. 17 can always be satisfied.
Note that, unlike for the high-threshold buffer implementation with the exp-
channels used in [11], it is easy to determine the necessary parameters via
Eq. 17 here. Moreover, the upper bound $\gamma$ on the duty cycle established
in Theorem 10 is not needed anymore.

However, we still need to argue that the additional IDM-channel and the
adversary $\eta_{3}$ at the output of the high-threshold buffer do not have
adverse effects. Fortunately, for the output $o$, we only need to distinguish
two possible cases: (i) If there is no transition at $o$, then there is
obviously also no transition at $o_{buf}$. (ii) If there is a single rising
transition at the output $o$ at time $T$, then this single transition is
propagated to $o_{buf}$ at some time $T+K$. The output $o$ is hence still in
accordance with the behavior of a high-threshold buffer. ∎

We hence obtain our desired result:

######  Theorem 13.

There is a circuit that solves unbounded SPF in the $\eta$-CIDM.

###### Proof.

If
$\Delta_{0}\leq\delta^{\uparrow}_{\infty}-\delta_{\mathrm{min}}-\eta^{+}_{\infty}-\eta^{-}_{\infty}$,
then the output $o_{or}$ only contains the input pulse $\Delta_{0}$, according
to Theorem 10. By Lemma 12, we know that we can choose
$(\Delta^{+}_{htb},\Delta^{-}_{htb})$ such that this pulse $\Delta_{0}$ is
mapped to a constant $0$.

If $\Delta_{0}\geq\delta^{\uparrow}_{\infty}+\eta^{+}_{\infty}$, then the
output $o_{or}$ has a single rising transition at $t=0$. Eventually, the
output of the high-threshold buffer also has a single transition to $1$.

If $\Delta_{0}$ is in between the above ranges, two cases can be
distinguished: (i) Suppose that the up-pulse lengths never exceed $\Delta$,
then Lemma 12 for any $\Theta\geq\Delta$ guarantees that the input is mapped
to a constant $0$ at the output of the high-threshold buffer. For the other
case (ii), the pulse length of the pulse train (eventually) exceeds $\Delta$.
By Theorem 9 it is guaranteed that the feedback loop will eventually lock at
constant $1$. If we choose $(\Delta^{+}_{htb},\Delta^{-}_{htb})$ such that all
pulses with a width at most $\Theta=\overline{\Delta}\geq\Delta$ are mapped to
a constant $0$, we can ensure that the high-threshold buffer has exactly one
rising transition after the feedback loop has locked. ∎

##  V Simulation results

In this section, we will show222Due to space constraints, we can only provide
a few of our experimental results. that the delay predictions of our new
$\eta$-CIDM cover the actual delays of an inverter chain under substantial PVT
variations and even under aging.

For our evaluation, we used Cadence Spectre (version 20.1) [13] to simulate a
7-stage inverter chain in UMC $28\text{\,}\mathrm{nm}$ technology
(G-05-LOGIC/MIXED_MODE28N-HPC-SPICE). Since their model cards not only offer
parameter sets for different process corners, i.e., different combinations of
fast and slow n-MOS resp. p-MOS transistors, but also parameters for
simulating _Negative Bias Temperature Instability_ (NBTI), _Positive Bias
Temperature Instability_ (PBTI) and _Hot Carrier Injection_ (HCI), we could
use the RelXpert tool [14] to compute aged versions of the circuit (with
transistors suffering from threshold voltage shifts and gate oxide damages).
Since we did not have a gate library for the used $28\text{\,}\mathrm{nm}$
technology, however, we had to design our own inverter cells. We choose
$W_{DES}=$0.35\text{\,}\mathrm{\SIUnitSymbolMicro m}$$ and
$L_{DES}=$0.035\text{\,}\mathrm{\SIUnitSymbolMicro m}$$, which are within the
specified range according to the data sheet and between the values for
comparable $15\text{\,}\mathrm{nm}$ and $45\text{\,}\mathrm{nm}$ technologies.

To compare the delays of the actual circuit and the predictions of our model,
we had to perform the following steps:

  * (1)

Obtain the delay functions ${\delta_{\uparrow}^{*}}_{def}(T)$ and
${\delta_{\downarrow}^{*}}_{def}(T)$ via analog simulations under the default
environment ($25\text{\,}\mathrm{\SIUnitSymbolCelsius}$,
$V_{DD}=$0.9\text{\,}\mathrm{V}$$).

  * (2)

Extract the parameters for our delay model, based on
${\delta_{\uparrow}^{*}}_{def}(T)$ and ${\delta_{\downarrow}^{*}}_{def}(T)$.

  * (3)

Run analog simulations under PVT variations and aging, and obtain the
appropriate delay functions ${\delta_{\uparrow}^{*}}_{x}(T)$ and
${\delta_{\downarrow}^{*}}_{x}(T)$, where

$x\in\begin{cases}20a&\mbox{20 years aging},\\\
$85\text{\,}\mathrm{\SIUnitSymbolCelsius}$&\mbox{operating temperature},\\\
ss&\mbox{slow nMOS + slow pMOS process corner},\\\ +$10\text{\,}\mathrm{\char
37\relax}$V_{DD}&\mbox{supply voltage}.\end{cases}$

  * (4)

Compare the old and the new “corridor” of the $\eta$-CIDM, i.e., its
deterministic delay prediction + the allowed variation range, with the
actually measured delay functions.

To characterize our circuit in steps (1) and (2), i.e., to determine the
parameters $\delta_{\mathrm{min}},\Delta^{+}$ and $\Delta^{-}$ and the actual
delay function $\delta_{\uparrow}(.)$ and $\delta_{\downarrow}(.)$ of every
gate, we used333The publicly available Involution Tool [9] provides
characterization scripts, which we extended appropriately to perform the
procedure described below fully automatically. the approach from [10]. It is
illustrated in Fig. 6: First, running analog simulations for each pulse width,
a binary search on the input pulse width is used until the output trajectory
for the falling (green) and rising (orange) transition both touch
$V_{th}^{out*}$. Then, the rising input and the corresponding output
trajectory is moved in time until the rising and falling output trajectories
touch each other at $V_{th}^{out*}$. Now, $\delta_{\mathrm{min}}=t_{o}-t_{i}$
is just the time between the touching point $t_{o}$ of the output trajectories
and the crossing point $t_{i}$ of the input trajectories. $\Delta^{+}$ resp.
$\Delta^{-}$ is determined as the time for the rising resp. falling input
trajectory to get from $V_{th}^{in}$ to $V_{th}^{in*}$.

Figure 6: Characterization idea for a buffer (taken from [10]).

In order to determine $\delta_{\uparrow}(.)$ and $\delta_{\downarrow}(.)$, we
first measured the actual delays, by sending longer pulses through the circuit
and recording the pair $(T,\delta(T))$ for each input/output trajectory. Then,
the parameters of a SumExp-IDM channel [9] were fitted to these empirical
delay functions using a least squares approach. For the adversary, we choose
symmetric parameters, i.e.,
$\eta^{+}_{min}=\eta^{-}_{min},\eta^{+}_{\infty}=\eta^{-}_{\infty}$ and
$\rho^{+}=\rho^{-}$.

For step (3), we had to repeat the characterization of the circuit for the PVT
variations and aging considered.

In step (4), all simulated delay functions were compared to the corridor of
the delay predictions of the $\eta$-CIDM: Fig. 7 shows the results for the
rising delay function between the fourth and fifth inverter of the circuit.
The delay function ${\delta_{\uparrow}^{*}}_{def}(T)$ (blue) is the baseline,
obtained via analog simulations. The deterministic delay function
$\delta_{\uparrow}(T)$ of the $\eta$-CIDM (red) has been least squares fitted
to ${\delta_{\uparrow}^{*}}_{def}(T)$. The old (narrow) corridor is shown in
green, whereas the significantly larger new corridor is lilac.

It is immediately apparent that it was already difficult to fit a channel to
the baseline (without PVT variations and aging) when using the old bounds
(compare [11, Fig. 9]), whereas this is absolutely no problem for our bounds.

Figure 7: Actual (measured) delay function ${\delta_{\uparrow}^{*}}_{def}(T)$
between the fourth and fifth inverter of the simulated inverter chain. It is
compared with the calculated delay function $\delta_{\uparrow}(T)$.

Fig. 8 shows the PVT variations and aging results for the rising delay
function between the fourth and fifth inverter. Note that the results for the
other gates in the circuit are comparable. The delay function with 10 %
increased supply voltage is obviously faster than the one under the default
environment. For an increased temperature of
$85\text{\,}\mathrm{\SIUnitSymbolCelsius}$, the resulting delay function is
only slightly slower. The same also holds for the circuit that is aged by 20
years. Fig. 8 also shows the slow down for the process corner _ss_ , i.e. a
slow n-MOS and a slow p-MOS transistor. It is apparent that all these PVT
variations and aging are covered by our new model.

Figure 8: Coverage of various PVT variations and aging under the new bounds of
the $\eta$-IDM.

To complement the above results, we also evaluated the average coverage of the
$\eta$-CIDM for the entire circuit. More specifically, we considered both
$\delta_{\uparrow}(T)$ and $\delta_{\downarrow}(T)$ for all seven inverters
and numerically integrated over the difference between the measured delays and
the respective corridor, for every recorded value of $T$. If the delay
function is inside the corridor, the contribution to the integral is $0$,
otherwise it is the distance to the closest corridor border. By normalizing
the resulting value to the integration interval, we obtain a value that can be
viewed as the average coverage violation, i.e., the average time deviation
from the corridor.

Fig. 9 shows the results for supply voltage variations. It can be seen that
the average deviation is significantly larger for the old bounds, whereas
there is almost no deviation for the new bounds. A significant deviation is
observed only for $-20\text{\,}\mathrm{\char 37\relax}$ $V_{DD}$, which is
unlikely to happen in modern VLSI circuits.

Figure 9: Average deviation for different supply voltages ($V_{DD}$).

Like in the $\eta$-IDM-paper [11], we also considered transistor width
variations. Again, Fig. 10 reveals that our new bounds perfectly cover even
substantial variations, unlike the old bounds, which result in significant
deviations (albeit not as large as for $V_{DD}$ variations).

Figure 10: Average deviation for different values of $W_{DES}$.

Overall, our results confirm that the $\eta$-CIDM indeed surpasses the
coverage of the original $\eta$-IDM of [11] substantially.

##  VI Conclusion

We provided a new unbounded single-history delay model, the $\eta$-CIDM, which
supports a large range of adversarial delay variations. It substantially
improves on the existing $\eta$-IDM, by making the delay variation range
dependent on every transitions’ particular input-to-previous-output time. We
proved analytically that this extension does not invalidate the
implementability of SPF, hence preserves faithfulness. By means of exhaustive
simulations, we showed that our $\eta$-CIDM, unlike the original $\eta$-IDM,
can cover a substantial range of PVT variations and aging.

## References

  * [1] M. Bouvier, A. Valentian, T. Mesquida, F. Rummens, M. Reyboz, E. Vianello, and E. Beigne, “Spiking neural networks hardware implementations and challenges: A survey,” _J. Emerg. Technol. Comput. Syst._ , vol. 15, no. 2, apr 2019\. [Online]. Available: https://doi.org/10.1145/3304103
  * [2] Synopsis Inc., _CCS Timing Library Characterization Guidelines_ , Synopsis Inc., October 2016, version 3.4.
  * [3] Cadence Design Systems, _Effective Current Source Model (ECSM) Timing and Power Specification_ , Jan. 2015, version 2.1.2.
  * [4] S. H. Unger, “Asynchronous sequential switching circuits with unrestricted input changes,” _IEEE ToC_ , vol. 20, no. 12, pp. 1437–1444, 1971.
  * [5] M. J. Bellido-Díaz, J. Juan-Chico, and M. Valencia, _Logic-Timing Simulation and the Degradation Delay Model_. London: Imperial College Press, 2006.
  * [6] M. Függer, R. Najvirt, T. Nowak, and U. Schmid, “Towards binary circuit models that faithfully capture physical solvability,” in _Proc. DATE’15_ , March 2015, pp. 1455–1460.
  * [7] M. Függer, R. Najvirt, T. Nowak, and U. Schmid, “A faithful binary circuit model,” _IEEE TCAD_ , vol. 39, no. 10, pp. 2784–2797, 2020.
  * [8] M. Függer, T. Nowak, and U. Schmid, “Unfaithful glitch propagation in existing binary circuit models,” _IEEE ToC_ , vol. 65, no. 3, pp. 964–978, 2016.
  * [9] D. Öhlinger, J. Maier, M. Függer, and U. Schmid, “The involution tool for accurate digital timing and power analysis,” _Integration_ , vol. 76, pp. 87 – 98, 2021.
  * [10] J. Maier, D. Öhlinger, U. Schmid, M. Függer, and T. Nowak, “A composable glitch-aware delay model,” in _Proc. GLSVLSI’21_ , 2021, pp. 147–154. [Online]. Available: https://doi.org/10.1145/3453688.3461519
  * [11] M. Függer, J. Maier, R. Najvirt, T. Nowak, and U. Schmid, “A faithful binary circuit model with adversarial noise,” in _Proc. DATE’18_ , March 2018, pp. 1327–1332. [Online]. Available: https://ieeexplore.ieee.org/document/8342219/
  * [12] ——, “A faithful binary circuit model with adversarial noise,” 2020. [Online]. Available: https://arxiv.org/abs/2006.08485
  * [13] Cadence Design Systems, _Spectre® Circuit Simulator Reference_ , product version 20.1 ed., Cadence Design Systems, Sep. 2020.
  * [14] ——, _Spectre® RelXpert Reliability Simulator User Guide_ , product version 20.1 ed., Cadence Design Systems, Sep. 2020.