Yuichiro Amekawa

Chuck Chuan Ng

Linda A Lumayag

Guan Huat Tan

Seng Chee

Lukman B Wong

Hui Bing Abdulra'uf

Wen Xi Tan

She Mei Tai

Tan

Hong Chai

Liu

Wong

B Lukman

Abdulra'uf

Hui Bing Tan

Wen Xi Tai

She Mei Tan

Jing Lim Chee

Producers' Perceptions of Public GAP and their Land Use. Producers' Perceptions of Public Good Agricultural Practices and their Land Use: the Case of MyGAP for Durian Farming in Pahang, Malaysia

Keywords: MyGAP, public GAP standard, food safety, pesticide use, durian farming, Malaysia

établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Since the early 2000s, several countries of the Association of South-East Asian Nations (ASEAN) have introduced national public GAP standards with the objective of improving the safety and quality of agricultural produce. This is largely a response to the rapidly increasing levels of agricultural pesticide use in the region as well as the increasing concerns of foreign and domestic consumers about food safety [START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF]. They have also emerged in the context where private GAP standards led by GlobalGAP dominate the food safety standardization of the global value chain. Private GAP standards such as GlobalGAP have been reported to have the tendency to give advantage to larger farms over smaller farms due to costly investments in valuable inputs for the applicant forms to meet their relatively stringent standards (e.g., [START_REF] Asfaw | Does EurepGAP standard marginalize poor farmers? Evidence from Kenya[END_REF][START_REF] Mungai | EU rules could destroy horticulture: The protocol on good agricultural practices will have a profound impact on both large and small-scale farmers, although the biggest impact will be on the latter[END_REF]Graffham et al., 2007). In the case of public GAP standards in Southeast Asia, the governments largely bear the costs of audit and certification and generally set lower certification standards than private GAP standards. As compared with private GAP standards, these public GAP standards may have more potential for the inclusion of small-scale farmers in mainstream markets [START_REF] Amekawa | Can a public GAP approach ensure safety and fairness? A comparative study of Q-GAP in Thailand[END_REF].

Table 1 shows the basic information of national public GAP standards in six Southeast

Table 1. Adoption of national public GAP standards in selected countries in Southeast

Asia as shown with the cases of GlobalGAP and AseanGAP

Source: created through reference to the GAP protocol and author's communication with the responsible agency in Southeast Asia.

Asian countries that are currently under implementation, along with that of GlobalGAP and AseanGAP. While sharing the goal of food safety assurance, public GAP standards in ASEAN countries encompass varying levels of grower adoption and differing ways of policy implementation. Thailand's Q-GAP has the largest amount of farms, i.e., about 120,000 farms, mostly small-scale, who maintained certified status in 2015. Its crude scale of certification in ASEAN Secretariat Note: The expression "… Farms who Maintain Certified Status" refers to those who maitain certified status in the partucular year regardless of the year when they got certified of a particular GAP standard. a single country is even comparable with GlobalGAP that has certified farms worldwide.

Compared with the number of farms maintaining certified status in 2012, i.e., about 220,000 farms, however, it has rapidly declined since 2013. In that year, the country introduced the new code of practice (the version TAS 9001-2013: National Bureau of Agricultural Commodity and Food Standards (ACFS), Thailand, 2013), which has made it more difficult for applicant farms to obtain Q-GAP certification or recertification 1 . The amount of farms maintaining a certified status in the other listed ASEAN countries is much lesser, respectively. This is mainly due to the much smaller number of existing fresh fruit and vegetable (FFV) farms and accordingly those applying for a public GAP program than Q-GAP. Yet their higher levels of stringency in compliance for certification might be another cause 2 .

There is a growing body of research on national public GAP standards (Amekawa, 2013a(Amekawa, , 2013b[START_REF] Amekawa | Can a public GAP approach ensure safety and fairness? A comparative study of Q-GAP in Thailand[END_REF]Banzon et al., 2013aBanzon et al., , 2013b;;[START_REF] Islam | Good agricultural practices (GAP) of tomatoes in Malaysia: Evidences from Cameron Highlands[END_REF][START_REF] Mankeb | Adoption of Good Agricultural Practices by durian farmers in Koh Samui district, Surat Thani province[END_REF][START_REF] Nicetic | Good Agricultural Practice (GAP) as a vehicle for transformation to sustainable citrus production in the Mekong Delta of Vietnam[END_REF]Pongvinyoo and Yamao, 2014;Pongvinyoo, Yamao and[START_REF] Pongvinyoo | Factors affecting the implementation of Good Agricultural Practices (GAP) among coffee farmers in Chumphon province, Thailand[END_REF][START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF]Srisopaporna et al., 2015). A critical question regarding the implementation of national public GAP standards is whether they are meeting the original goal of food safety and quality assurance through engaging small-scale farmers in the GAP compliance. The following four studies address the question by examining the level of the quality assurance of Q-GAP certified farms. First, comparing 45 Q-GAP certified and 245 uncertified farms for a total of nine vegetable and fruit crops in a watershed of Chiang Mai Province, Northern Thailand, [START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF] found that there are no significant statistical differences between the two farmer groups in terms of the amount of pesticides used, methods of pest control adopted, and the handling of pesticide. Second, Amekawa 1 The version TAS 9001-2013 has made it more difficult for applicants to get Q-GAP certification than the first version introduced in 2004 mainly in the following three ways: (1) the level of compliance became higher than the previous requirements of 51% compliance in each of the eight categories of the 81 total control points; (2) holding a land title for the land on which the cultivation of a particular crop is related to the application for Q-GAP became mandatory; and (3) compliance with record keeping became mandatory (Interview at Department of Agriculture (DoA) Pitsanulok on August 25, 2015 and at DoA Chiang Mai on August 28, 2015). 2 By way of illustrating the gap in the level of stringency in compliance, MyGAP requires 95-100% of compliance for the 106 total control points out of the total of 163 control points (Department of Agriculture, Malaysia, 2005) whereas of 116 control points Q-GAP requires 100% of compliance for 23 control points and 60% of compliance for 41 control points, along with 54 recommended points (ACFS, 2013).

(2013b) found that 34 of the 64 Q-GAP certified pomelo growers from two communities of Chaiyaphum province, Northeast Thailand, showed a lack of understanding of the basic objective of GAP. In addition, most of those who acknowledged a reduction of their pesticide use around the period of their certification attributed it to the growth stage of pomelo rather than the positive effect of Q-GAP certification. Third, [START_REF] Pongvinyoo | Factors affecting the implementation of Good Agricultural Practices (GAP) among coffee farmers in Chumphon province, Thailand[END_REF] examined the cost efficiency of 112 Q-GAP certified farmers in mangosteen production (of the 2013/4 crop year) in Chanthaburi province by comparing it with the mean data of uncertified farms drawn from the 2013 DoA extension survey. They found that Q-GAP certified mangosteen farmers spend 64% more annual production expenses in mangosteen production (11,554.7 Baht versus 7,007.9 Baht) and earn 2.24 times more annual incomes from mangosteen production (20,131.4 Baht versus 8,968.0 Baht), thus enjoying 47% higher income efficiency (1.74 versus 1.27) than uncertified mangosteen farmers. The authors attribute the result to improved farming practices of certified farmers through their GAP adoption. Yet considering the fact that 64% of mangosteen farmers in the province were Q-GAP certified farmers, there remains a possibility of selection bias in which the economic gap reflects a socioeconomic differential of certified and uncertified farms existing independently from the positive changes of training for certification. Fourth and last, Srisopaporn et al. (2014) compared the agrochemical use of 41 rice farmers who were continued Q-GAP adopters with 66 adopt-then-disadopters and 70 never-adopters. Continued adopters were found to spend significantly less total fertilizer costs than never-adopters and adopt-then-disadopters (at 5% ANOVA), and have significantly less frequencies of pesticides application (at 0.1% ANOVA) except for herbicide application that showed no significant differences. In reference to [START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF] and Amekawa (2013b) which show different results from the study, the authors ascribe the observed differences to the generally easier nature of rice production to reduce pesticides as compared with the case of FFV production 3 . This paper examines the implementation of the Malaysian public GAP standard called MyGAP. Although the number of farms who maintain MyGAP certified status is the second largest among the public GAP standards in Southeast Asia, the existing research on MyGAP has been limited to a case study conducted by a group of researchers at the Universiti Putra Malaysia (Islam et al., 2010[START_REF] Islam | Good agricultural practices (GAP) of tomatoes in Malaysia: Evidences from Cameron Highlands[END_REF]. In this regard, the number of studied tomato farms was only six (three certified and three uncertified farms); these types of farms had significant differences in the farm size, with the former ranging from 10 to 24 ha and the latter ranging from 1.2 to 1.6 ha. Indeed, the amount of MyGAP certified farms at the national level is much less than Q-GAP certified farms and they are scattered around the nation, which practically makes it more difficult to conduct survey on MyGAP. It is imperative, however, that research on MyGAP be conducted with more farm sample so that an international comparison could be made with different public GAP standards in Southeast Asia. This case study aims to investigate the local implementation of MyGAP by examining the effectiveness of the policy in raising the awareness and improving the land use practices of small-scale farmers toward better food safety and quality assurance. This is done with a focus on durian farming in Pahang State, Peninsular Malaysia. This purpose is broken down to two objectives. First, perceptions of Q-GAP certified and uncertified durian farmers are comparatively examined with respect to their (lack of) interests in and understanding of the policy, as well as their own assessments of the program. Second, farmers' land use practices that should affect the level of their food safety and quality assurance are examined by delving into their experiences of training through local DoA and record keeping practices as well as by comparing the pesticide use and handling of MyGAP certified and uncertified farms. The rest of the paper is organized as follows. The next section provides research contexts and methods. The third section offers research results and discussion. The fourth section closes the paper with conclusions. 251). In the author's communication, the corresponding author acknowledged that the part "when producing rice than vegetables" is misplaced from the way it should be: "when producing vegetables and fruits than rice."

Contexts and methods

In 1997, Malaysia as a net importer of food products had the deficit in food trade of US$1.9 billion. About a quarter of the deficit comprised trade in FFV. The Malaysian government has therefore sought to encourage efficient agricultural production, including FFV, in order to balance the trade by 2010. For this purpose, the third National Agricultural Policy (NAP3) was launched for the target duration from 1998 to 2010. It emphasizes improvements in technology and quality through official support for infrastructural development and incentive creation for the private sector to enhance commercial production [START_REF] Robert | fruit and vegetables in Asia: Experiences of Malaysia, Thailand and Viet Nam[END_REF]. This policy has recast the recognition of agriculture in Malaysia from the stagnant primary sector to the third engine of growth after the manufacturing and service sectors [START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF].

In this changing policy ambient, the Malaysian government established a public GAP certification scheme for fresh fruits and vegetables called SALM (Skim Akreditasi Ladang Malaysia4 or Malaysian Farm Accreditation Scheme) in 2002 [START_REF] Islam | Good agricultural practices (GAP) of tomatoes in Malaysia: Evidences from Cameron Highlands[END_REF][START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF][START_REF] Van Der Valk | National benchmarking against GLOBALGAP: Case studies of Good Agricultural Practices in Kenya, Malaysia, Mexico and Chile[END_REF]. It was the original GAP scheme for MyGAP, along with other GAP schemes for fishery and livestock5 . SALM was aimed at creating vibrancy within the domestic commercial fresh fruit and vegetable (FFV) sector by promoting "agricultural practices that are environment-friendly, sensitive to workers' welfare and yield quality products that are safe for consumption" (Robert and Menon, 2007: pp.31). A steering committee called the National Farm Accreditation Committee (NFAC) makes major decisions (van der Valk and van der Roest, 2009). DoA serves as the secretariat for MyGAP.

The Department of Standard Malaysia (DSM) and any agency licensed by the DSM accredit the farms for good agricultural practices [START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF]. Participation of farms in the MyGAP scheme is voluntary [START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF]. The MyGAP certification for crops consists of 16 categorical items (Table 2), each of which [START_REF] Othman | Malaysia's experiences in training of farmers on good agricultural practice[END_REF]. The DoA sends to the applicant farm a team of auditors who are normally local DoA officers on the regular basis yet could be officers from the DoA Malaysia in Putrajaya once in two years, in order to check if the applicant farm complies with a set of required control points (interview at DoA Raub on 10 December, 2013). Record keeping is one of the most important elements for farm verification. Every farm activity should be recorded for the sake of traceability for the produce or the farm worker [START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF]. A certification requires three times of sample collection of crops and water from the applicant farm for the laboratory residue analysis of pesticides and heavy metals. A certification will last for two years. Before the end of the term, the farm can reapply for recertification. For these farms, samples will be required for residue analyses only once instead of three times [START_REF] Salleh | Status and perspectives on good agricultural practices in Malaysia[END_REF]. The government bears the cost of inspection and residue analysis, providing publicity for promotion (van der Valk and van der Roest, 2009).

According For the purpose of comparison, 57 uncertified durian farms were also surveyed so that the number of interviewed uncertified farms could triple that of surveyed certified farms. Reflecting the regional pattern of durian production in the state of Pahang, the majority of farms surveyed were located in Raub District, the most prosperous durian production area in Malaysia. In addition, one certified and three uncertified farms were located in Bentong District (Fig 1).

Results and discussion

Farmers' adoption of MyGAP

Table 3 shows the socio-economic background of respondent farms. The majority of farm

Fig 2. Educational background of respondent farms

Seventy-nine percent of certified farm managers have secondary education or higher while 58% of uncertified farm managers had primary education or less. Such an observed superiority in the educational background of certified farms over uncertified farms seems to conform to the observations in some literature of good agricultural practices [START_REF] Asfaw | What impact are EU supermarket standards having on developing countries' export of high-value horticultural products? Evidence from Kenya[END_REF]Kersting and Wollni, 2013;Pongvinyoo et al., 2014).

On the issue of why individual farms have decided to participate in the MyGAP program, the majority of certified farm managers (77%) responded that they had decided to apply for MyGAP certification because they expected that once they obtain the certification, they will be eligible to export their produce to overseas markets. This result comes as no surprise because in many cases, DoA extension officers tell farmers that MyGAP certification is a minimum requirement for the export of their durian produce. For most durian farm managers, the farmgate price of durian is their utmost concern since durian sales are their main (or only) source of income. Their main goal is to be able to export durians in order to improve their economic conditions. They claimed it is difficult to negotiate on the prices, however, as middlemen are positioned to play much more powerful roles in controlling farmgate prices.

Apart from economic motives, only five farm managers (26%) considered the improvements

Certified Uncertified

in food quality assurance as a reason for their participation in the MyGAP scheme. In this regard, a significant gap in the expectations of farmers and local DoA officers was observed.

Farmers claimed that economic expectations for MyGAP must be their primary concern of their participation in the food safety program as they make a living based on farming. And yet, DoA officers seemed to undervalue this point. They complained that farmers do not understand the main objective of the policy which is food safety and quality assurance through conducting good agricultural practices, and that they rather insist solely on economic interests.

The primary reason why uncertified farms had not applied for MyGAP at the time of research is that they had little or no knowledge about it. Thirty-seven uncertified farms (74%) responded that they had never heard about it and thus had no clues for applying for it. Of the 20 uncertified farms who had some knowledge of MyGAP, eight farms (40%) pointed to the lack of tangible benefits from MyGAP certification as the reason why they had not applied for the program6 . Even though getting a GAP certificate has become the necessary condition for farmers to export their produce, simply holding it does not guarantee their feasibility to do so as other conditions need to be met. Fruit quality (e.g., flavour, size, and appearance) is the main consideration of middlemen in sending farmers' produce to the export market.

Farmers' understanding of the basic GAP concept

A critical issue in GAP is related to the extent to which certified farm managers do understand the concept and purposes of GAP. All the 19 certified farm managers interviewed correctly pointed to food safety assurance as the main goal of the MyGAP policy, whereas only 11 managers (55%) out of the 20 uncertified farm managers who knew MyGAP did. This result is clearly in contrast to the finding of Amekawa (2013b) on Q-GAP, where over half the interviewed 64 certified pomelo farmers failed to identify the policy objective. This divergence may be largely due to the contextual difference between the countries in terms of the farm recruitment process for public GAP certification. In Thailand, the officially targeted clusters of small-scale farmers who belong to a producer group are collectively promoted for registration and provided education and training for the Q-GAP program. Farmers' decisions to participate still lie with the individuals, yet the opportunities for them to get access to information and resources could be significantly larger than those without a membership of any producer group.

This approach seems to solicit a situation where there are farmers, especially the old and the less educated, who participate in the program rather passively, failing to understand or remember what they have been involved in (Amekawa, 2013b). By contrast, in Malaysia where the amount of small-scale farms nationwide is much less and the proportion of those who belong to a producer group is also much less than in Thailand, the farm recruitment process is largely based individually. And as such, there is not much organizational mechanism for a group-led certification other than personal connections with local DoA officers. Decisions to participate in the MyGAP program lie significantly with individual farmers and their personal ties in their access to information. Once they have decided to join it, therefore, they tend to try to learn, comprehend the fundamental concept, and embrace its significance as best as they can.

Perceived benefits and shortcomings

Perceptions of certified producers about the benefits and shortcomings of MyGAP certification on their farm operation may affect their decisions about reapplication in the next round. Based on the questionnaire response, 10 farm managers (53%) mentioned that there are no benefits from obtaining MyGAP certification, followed by four managers (21%) who referred to 'acquired export opportunities' as a merit of gaining MyGAP certification. It is important to stress that only two farm managers referred to 'increased producer awareness of food safety assurance/improved pesticide management' as such benefits.

A more specific question on perceived economic advantages of MyGAP certification was asked to all the interviewed certified farm managers; they were asked whether they consider themselves to have become economically more advantaged, remained the same, or less advantaged after obtaining certification. Sixteen certified farm managers (86%) said their economic status had remained the same. Eight of them attributed the view to the farmgate price exhibiting no changes after they received certification. There were only three managers (16%) who pointed to increased economic advantages. They considered the advantages to be related to the export opportunities opened for them via gaining MyGAP certification. These results seem to indicate a relative lack of appreciation of MyGAP certification among many certified farm managers who have felt no changes in their economic status via gaining MyGAP certification. This is in part reflected by the limited number of certified farms who enjoy relatively high farmgate prices based on their durian export.

Perceived shortcomings of participation in the MyGAP program involved, among others, the burden of complying with certification requirements as pointed out by six farm managers (32%), followed by five managers (26%) who referred to complex management procedures as such. These results appear consistent with the results on the question of the most difficult thing to do in attempting to obtain MyGAP certification. Five farm managers (26%) pointed to the difficulty in complying with the requirements for pesticide control and/or passing pesticide residue sample analysis. Other five managers referred to the difficulty in following tedious documentation requirements in application and record keeping. A few even confessed regrets in having applied for MyGAP because of the allegedly complicated application procedures required relative to the tangible benefits they have obtained from certification. In the area under study, there are three kinds of synthetic pesticides that durian farmers were using: insecticide, fungicide, and herbicide. Not all the interviewed farms used the three kinds altogether but around 40% of farms used either one or two kinds of synthetic pesticide (Table 4).

Table 4. Pesticide use of respondent farms

To examine whether MyGAP helps reduce the amount of pesticide use, comparisons of certified and uncertified farms were made in terms of the annual quantity of active chemical ingredients contained in and used for each of the three pesticide types respectively 7 . Of the farms who provided available information, uncertified farms were found to use four times more insecticide than certified farms (p < 0.05). As for synthetic herbicide use, of the farms who provided available information, uncertified farms were using 11 times more than certified farms (p < 0.05). Synthetic fungicide tended to be applied as needed to the trees with fungal infections. Of the farms who provided available information, the average amount of fungicide used by uncertified farms was much lesser than the case of insecticide and herbicide, with certified farms showing a slightly smaller amount of use than uncertified farms. The seemingly tiny difference in the use of fungicide is indeed statistically significant (p < 0.1). It is worth 7 In these cases, the farms who do not use any kind of pesticides were included in the analysis with a 'zero' value given to the amount of a pesticide used in terms of active chemical ingredients. The active ingredients identified in the use on surveyed farms include: Abamectin, Beta-cyfluthrin, Carbaryl, Chlorpyrifos, Cypermethrin, Deltamethrin, Diafenthiuron, Dimethoate, Fenthion, Imidacloprid, Lambda-cyhalothrin, Malathion, Monocrotophos, and White Oil for insecticide; Benomyl, Difenoconazole, Fosetyl-aluminium, Maneb, Metalaxyl-m, Methomyl, Metiram, Propineb, and Triforine for fungicide; and Diuron, Glufosinate-ammonium, Glyphosate isopropylamine, Paraquat dichloride, and Phosphorus acid for herbicide. noting that despite the significantly lower pesticide use as shown above, certified farms have achieved the durian yield that is nearly equal to uncertified farms.

Non-synthetic, alternative pest management practices could be employed as part of an integrated pest management strategy for the reduction of pesticide use and associated social and environmental costs. There are six certified (32%) and six uncertified farms (11%) who use one or more pest management methods other than synthetic pesticides, with a statistically significant difference (p < 0.05) (Table 5). Special mention needs to be made of alternative Table 5. Alternative pest management of respondent farms weed management methods. While there are 16 certified farms (84%) who use synthetic herbicide with a much smaller average amount than uncertified farms, there is only one farm who relies on an alternative weed management method: mechanical weed cutter. On the part of uncertified farms, there is only one farm who substitutes herbicide use by a non-synthetic method: manual removal of weeds. This evidence suggests that while using little or no herbicide, the majority of certified farms let weeds grow without caring much about potential adverse ecological consequences such as weed-tree competition over soil nutrients. Many certified durian farmers mentioned that they are not concerned about weed growth very much since they consider its negative effects on tree and fruit growth to be negligible in the case of durian farming in the region. Further, some explained that many farms are just too large for the amount of labor required for manual or mechanical weeding methods, given that weeds regularly grow in weeks after cutting them. Such methods are considered less efficient than the power of herbicide leading to elimination of weeds in several months to come.

Pesticide handling

Pesticide handling practices of certified and uncertified farms were examined comparatively in terms of selected items covered and not covered in MyGAP guidelines (Table the seven items that are not covered in MyGAP guidelines, four items showed a statistically significant difference (item 9 and 10 for p < 0.05 and item 11 and 12 for p < 0.01), with all of them in favor of certified farms. In item 8 (the observance of pesticide labels for pre-harvest intervals), the ratio of farms following the practice appears low for both certified and uncertified farms. The results are misleading because the majority of farms follow their own rules for preharvest intervals. Three certified (16%) and three uncertified farms (5%) mentioned, however, that they use pesticides as needed while not following any pre-harvest intervals.

Overall, pesticide handling practices of certified farms appear to be performed better than uncertified farms with five of the total 14 items exhibiting a statistically significant difference (p < 0.05 or p < 0.01). Although a direct comparison may not be appropriate, it should be noted that this finding parts ways with the aforementioned Schreinemachers et al.'s study (2012) on Q-GAP where no significant differences in pesticide handling were found between certified and uncertified farms for seven items 8 .

Discussion

With the results unfolded above, a question arises as to whether the conceived superiority of MyGAP certified durian farms over uncertified ones in pesticide management is due to improved practices of the former through MyGAP training or due to other causes. Since this study is based on cross-sectional data rather than a time-series comparative approach, we do not keep empirical evidence handy for a direct answer to the question. Nonetheless, there remains a considerable possibility of sampling bias where most applicant farms would have already been well-performing practitioners prior to their application for MyGAP. Pieces of evidence that support the view are: (1) the educational and economic standing of the average certified farm managers over the average uncertified managers are significantly higher than uncertified farm managers;

(2) on average, certified farm managers are significantly younger 8 The seven items in [START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF] include: 1. Use pesticides in a preventive way (regular spraying); 2. Follow product labeling to decide on dosage to use; 3. Take temperature or radiation into account when spraying; 4. Take wind speed and/or direction into account when spraying; 5. Cover mouth when spraying; 6. Cover arms and legs when spraying; and 7. Take a shower and wash clothes after spraying (pp. 524).

than uncertified farm managers, which seems to attest to the former's greater receptivity to a technological novelty over the latter; (3) the majority of both certified and uncertified farms do not draw on DoA but on agrochemical suppliers as their major source of knowledge and advices on pesticides; and (4) The relatively low adoption rate of MyGAP certification in Pahang State (14.5% for 2002-2015, see Table 7) implies that only better prepared and Note: "Certified" here refers to the farms who received certification in the particular year, rather than those who maintain certified status regardless of the year when they got certified.

Adoption rate (%) Registered Certified

Conclusions

This study on Malaysia's MyGAP standard has investigated the local implementation of the policy program by examining its effectiveness in raising the awareness and improving the land use practices of participant small-scale farmers toward better food safety and quality assurance. This has been done by comparing the cases of 19 MyGAP certified and 57 uncertified farms growing durian in Pahang State, Peninsular Malaysia. With regard to effectiveness in raising the awareness, the results are mixed. It was found that all the surveyed certified farm managers understand the basic rationale of MyGAP, while only about half the uncertified farm managers who knew the presence of MyGAP do. The majority of certified farm managers pointed out that they applied for the certification program primarily because they wished to acquire the eligibility of durian export for obtaining better farmgate prices, rather than improve farming practices for food safety and quality assurance. Over half the certified farm managers mentioned there have turned out to be of no benefits from obtaining MyGAP certification, while only two farm managers pointed to the 'increased producer awareness of food safety assurance/improved pesticide management' as such benefits. In regard to effectiveness in improving land use practices, the majority of certified farms keep records every time they engage in field practices, while nearly four-fifths of uncertified farms confessed they never do such practices. Certified farms are also found to use significantly smaller annual amount of pesticides for each kind (insecticide, fungicide, and herbicide) than uncertified farms (p < 0.1). They also exhibited significantly superior performance to uncertified farms in several pesticide handling items. These findings appear different from [START_REF] Schreinemachers | Can public GAP standards reduce agricultural pesticide use? The case of fruit and vegetable farming in northern Thailand[END_REF] groundbreaking study of Thailand's Q-GAP, which found no statistically significant differences in the annual amount of pesticide use and handling between 45 certified and 245 uncertified farms for nine FFV types in Northern Thailand.

The revealed superiority of MyGAP certified durian farms over uncertified ones in pesticide management poses a question as to whether it is due to improved practices of the former through attempted compliance with MyGAP regulations or else. Items of circumstantial evidence on socio-economic constitutes of certified and uncertified farms appear to suggest that the results are likely due to the sampling bias where many applicant farms would have already been well-performing practitioners before they had applied for MyGAP rather than due to improved practices ex post facto. Despite the low adoption rate of MyGAP certification for durian farming in Pahang State, the much higher adoption rates by crop nationwide make it difficult for us to determine the degree to which MyGAP's existing level of stringency in compliance effects such pre-screening determinism.

The small sample size in this study, coupled with the deviation of the adoption rate of MyGAP certification in the durian sector of Pahang State from the recent trend of crop nationwide suggest, however, that the obtained results should not take an outright acceptance, and that some findings should be cautioned for a national level generalization. More studies of MyGAP and other public GAP standards being implemented in ASEAN countries are definitely called for to gain national and ASEAN regional level insights into the true impact of the standardization enterprises for food safety and quality assurance.

In

  schemes established in 2002. Hence, MyGAP emerged as a comprehensive certification scheme for agriculture, aquaculture, and livestock sectors (Ministry of Agriculture and Agrobased Industry Malaysia, 2014).

  to the DoA Malaysia, of the total national (re-)certifications of 313 in 2013, durian comprised the second largest number of certifications after rice. Since our focus for this study was FFV, we chose durian as the target crop for this research. As of July 2013, there were 21 certified durian farms in Malaysia, all of whom were identified in the State of Pahang. Out of them, 19 farms were surveyed. Two certified farms were excluded from this research as they were DoA experimental farms operating on the public basis. The certified farmers were contacted for interview with assistance by local DoA officers using the local official DoA directory of MyGAP certifications for durian in Raub District and Bentong District.

Fig 1 .

 1 Fig 1. Map of Pahang State, Peninsular Malaysia Source: Ramam et al. (2007) Raub comprises seven mukim (territorial divisions), namely Batu Talam, Sega, Semantan Ulu, Dong, Ulu Dong, Gali, and Tras, in the total area of 2,269 km 2 . All the areas of the district

3. 4 .

 4 Fig 3. Frequency of respondent farms' record keeping habits (%) majority of uncertified farm managers (77%) said they never keep record while only seven uncertified managers (12%) noted that they always maintain some form of record keeping. The performance of record keeping of MyGAP certified farms appears much better than the case of Q-GAP certified pomelo farms in Amekawa's (2013b) study, where most of the interviewed 64 certified pomelo farmers ceased to keep records after receiving certification. While it is important to evade overgeneralization, farmers' awareness of the importance of record keeping may be somewhat different between Malaysia and Thailand. Many Thai farmers may be Q-GAP certified based on group solicitation and thus they may not readily understand what the Q-GAP policy is all about. Meanwhile, most Malaysian farmers certified on the more individual basis may have a better understanding of the requirements of MyGAP of which record keeping is part.

  p < 0.01, **p < 0.05, *p < 0.10 a The percentage refers to the number of farms who use a particular pesticide type in question divided by the number of farms whose data are available.Note: Only the first item (number of farms who adopt alternative pest management) was tested for statistical significance.

Table 2 . Control points in SALM/MyGAP code of practice Source

 2

: Department of Agriculture, Malaysia (2005) comprises specific rules or conditions based on the Malaysian Standard MS 1784: 2005 -Crop Commodities -Good Agricultural Practice (GAP)

Table 3 . Socio-economic background of respondent farms managers

 3

	uncertified farms including more employed farm workers (p < 0.01), larger durian farm land
	size (p < 0.05), and more durian sale and that per ha (p < 0.10). It is worth stressing that even
	though certified farms have slightly lower durian produce per ha (1.0% difference), they have
	as much as 51.5% higher durian sale than uncertified farms. This suggests that the former
	receives 52.5% higher mean farmgate prices than the latter as they sell more expensive and
	better quality durians.

are male in both certified and uncertified farm groups. Unlike expectations, the number of certified farms exporting durians is limited (only three), and that of uncertified farms is none. This suggests that with a powerful exporter of durians located nearby (Thailand), even certified farms in the dominant durian production area of Malaysia find it difficult to sell durians overseas. The total durian farm size of certified farms is nearly 60% larger than that of uncertified farms, with the number of employed workers of certified farms being 40% more than the latter. Regarding the compared items for statistical significance, certified farm managers are 11.4 years old younger than uncertified farm managers with statistically significant difference at 1%. Certified farms also show a number of economic advantages over Fig 2 shows comparison of the educational background between the two farm groups.

Table 6 . Pesticide handling of respondent farms

 6 It should be noted that there is one farm who does not have a storage that specializes in the housing of pesticides even though the farm has been MyGAP certified. With regard to

	6). Of the seven items covered in MyGAP guidelines, all of them present no statistically
	significant differences (p > 0.1) except for item 7 on the possession of a pesticide storage (p
	< 0.01).

Iterms not covered in MyGAP guidelines

  The percentage refers to the number of farms who use a particular pesticide type in question divided by the number of farms whose data are available.

	8. Strictly follow the pre-harvest intervals	5	(26% a )	21	(37% a )	NS
	as prescribed on pesticide labels
	9. Smoke while spraying pesticides	0**	(0% a )	4	(7% a )
	10. Eat anything while spraying pesticides	0**	(0% a )	4	(7% a )
	11. Drink anything while spraying pesticides	0***	(0% a )	14	(25% a )
	12. Take shower within one hour after spraying	17	(89% a )	44	(77% a )	NS
	13. Change clothes after spraying and as soon as	19***	(100% a )	45	(79% a )
	arriving at home
	14. Wash clothes used during spraying together	10	(53% a )	25	(44% a )	NS
	with clothes not used for spraying
	*** p < 0.01, **p < 0.05, *p < 0.10; NS not significant at 0.01.

a

Table 7 . MyGAP adoption of durian farms in Pahang State, 2002-2015

 7

	Source: author's communication with DoA Malaysia
	more capable farmers could have passed the certification screening.
	These items of circumstantial evidence notwithstanding, it would be too hasty to assert
	that certification screening occurs in ways that MyGAP's relatively high stringency in
	compliance works to single out the already well-performing farms while screening out not-yet-
	well-practicing farms. MyGAP adoption for crop nationwide shows a different trend of adoption
	rate from the case of durian in Pahang (Table 8). In the first ten years from 2002 till 2011, the

Table 8 . MyGAP adoption by crop nationwide, 2001-2015

 8 Aware that there had been no changes in the content of MyGAP regulations during 2002-2015, we sought through DoA Malaysia the reasons why such a rapid rise in the adoption rate in the last four to five years have occurred. The response was that there has been no research conducted on this aspect but it might be a result of the effective promotion and extension work to farmers and exporters by DoA (correspondence with Ms. Juliana Ritonga binti Saipul Jannah, assistant director of the Crop Quality Control Division, DoA Malaysia on March 30, 2016).

	Source: author's communication with DoA Malaysia
	adoption rate for crop nationwide remained as low as 18.2% (the total number of registered
	farms: 1953 versus that of certified farms: 356). However, the annual number of registered
	and certified farms and the adoption rate have significantly increased since 2012, reaching
	the adoption rate of 61.2% (2,512 registered farms versus 1,538 certified farms) during the
	four years till 2015. Accordingly, the cumulative adoption rate for crop nationwide from 2002
	to 2015 amounts to as high as 42.4% (4,465 registered farms versus 1,894 certified farms).

In the original text ofSrisopaporn et al. (2014), it is stated that such different research findings "can be attributed to the fact that reducing pesticide is most likely more difficult to achieve when producing rice than vegetables" (pp.

The Malay denotation of the scheme was later changed to "Skim Amalan Ladang Baik Malaysia," carrying the same acronym SALM but with the different meaning of 'Malaysian Farm Certification Scheme for Good Agricultural Practice Scheme'[START_REF] Othman | Malaysia's experiences in training of farmers on good agricultural practice[END_REF]. The change was deemed necessary because it was realized that "the DoA was in no position to accredit farms complying with the conditions set by the department"(Salleh & Osman, 2007: pp. 46).

There were two other GAP schemes that were established concomitantly: Malaysian Aquaculture Farm Certification Scheme (SPLAM) by the Department of Fisheries Malaysia and Good Animal Husbandry Scheme (SALT) by the Veterinary Service Department[START_REF] Othman | Malaysia's experiences in training of farmers on good agricultural practice[END_REF].

In addition, six farms (30%) have not applied for MyGAP because the farm managers did not know sufficiently about it, and four farms (20%) attributed their lack of application to the relatively small size of their durian orchard for export.

Acknowledgements

The authors are deeply thankful to the DoA Malaysia, DoA Raub, DoA Bentong and the University of Malaya, Malaysia for allowing us entry and investigation in the districts under study. Special gratitude goes to durian farmers and their producer group leaders for their kind support for interview. Funding: This work was supported by the University of Malaya [University of Malaya Research Grant (UMRG) Project Number: RG186-12SUS].


Christian Jacobi

Kai Weber

Viresh Paruthi

Jason Baumgartner

Automatic Formal Verification of Fused-Multiply-Add FPUs

In this paper we describe a fully-automated methodology for formal verification of fused-multiply-add floating point units (FPUs). Our methodology verifies an implementation FPU against a simple reference model derived from the processor's architectural specification, which may include all aspects of the IEEE specification including denormal operands and exceptions. Our strategy uses a combination of BDD-and SAT-based symbolic simulation. To make this verification task tractable, we use a combination of casesplitting, multiplier isolation, and automatic model reduction techniques. The case-splitting is defined only in terms of the reference model, which makes this approach easily portable to new designs. The methodology is directly applicable to multi-GHz industrial implementation models (e.g., HDL or gate-level circuit representations) that contain all details of the high-performance transistorlevel model, such as aggressive pipelining, clocking, etc. Experimental results are provided to demonstrate the computational efficiency of this approach.

Introduction

Traditionally, industrial floating point units (FPUs) are validated by simulation, often using targeted techniques such as specialized testcase generators [START_REF] Ludden | Functional verification of the POWER4 microprocessor and POWER4 multiprocessor systems[END_REF]. While such approaches are efficient at exposing many bugs, they are based on incomplete methods which cannot achieve full coverage, e.g. evaluation of all operand combinations over all rounding modes and exception states. To compound the coverage problem, designs face shorter time-tomarket (hence lesser verification time) from generation to generation, require higher clock speeds thus a larger degree of pipelining, and acquire additional features such as clock gating for lowpower. Formal and semi-formal verification techniques constitute an increasingly-prevalent mechanism by which to attempt to close the coverage gap imposed by simulation. For example, numerous industrial approaches have proposed the use of a combination of automatic methods and manual theorem-proving techniques to yield complete proofs of correctness of FPUs [START_REF] Moore | A mechanically checked proof of the AMD5K86 floating point division[END_REF][START_REF] O'leary | Formally verifying IEEE compliance of floating point hardware[END_REF][START_REF] Russinoff | A mechanically checked proof of IEEE compliance of the floating point multiplication, division and square root algorithms of the AMD-K7 processor[END_REF].

In this paper, we present an efficient, fully-automated methodology for the verification of fused-multiply-add (FMA) FPUs. This methodology targets exhaustive verification of the complex dataflow of such FPUs, focusing on the arithmetic correctness of a single arbitrary instruction. The presented approach compares the FPU implementation against a simple reference model derived from the processor's architectural specification, which may include all aspects of the IEEE specification such as denormal operands and exceptions. Our methodology is portable to simulation, emulation, semi-formal, and formal verification frameworks; no customized toolset is necessary. To enable formal proofs, we use a combination of case-splitting and automatic model reduction tech-niques, and isolate the multiplier for dedicated verification. All case-splitting is defined in terms of the reference model, ensuring that this overall methodology, as well as the reference model itself, is easily portable to various implementations. The presented methodology is directly applicable to an HDL or gate-level implementation model without a need for manual abstraction. Experimental results demonstrate applicability to HDL implementations of high-performance industrial FPUs which are combinationallyequivalent to -i.e., share the same state encoding as -the (primarily custom-designed) transistor-level circuit, as is a common industrial design style [START_REF] Ludden | Functional verification of the POWER4 microprocessor and POWER4 multiprocessor systems[END_REF]. Coupled with the use of a Boolean equivalence checker to correlate the HDL implementation against the fabricated schematics [START_REF] Kuehlmann | Verity -a formal verification program for custom CMOS circuits[END_REF], this overall approach enables a seamless proof of datapath correctness from the transistor schematics all the way up to the architecture-level specification.

The novel contributions of this paper are the following. First, our paper is the first to address formal datapath verification of FMA FPUs using only common automatic verification tools. Second, ours is the first to address denormal operands and results for FMA instructions. Third, our methodology is easily portable to new implementations because the portable reference model encompasses the case splitting strategy. Fourth, our reference model is also reusable in platforms such as simulation and emulation.

The rest of the paper is organized as follows. Section 2 provides an overview of our verification framework. Section 3 details the reference model and Section 4 describes the case-splitting strategy used to reduce formal complexity. Section 5 provides experimental results and Section 6 discusses the portability of this method, in particular to fully IEEE-compliant FPUs. Section 7 discusses related work. In Section 8, we summarize and conclude the paper.

Verification Overview

The FPU under verification supports the double-precision FMA instruction and its derivatives as defined in the PowerPC 1 architecture [START_REF]The IBM PowerPC Architecture: A New Family of RISC Processors[END_REF]. FMA computes A × B + C on operands A, B, and C. Instructions such as A × B and A + B are computed as A × B + 0 and A × 1 + B, respectively. All four IEEE rounding modes are supported. For implementation details on FMA FPUs refer to [START_REF] Montoye | Design of the IBM RISC System/6000 floating-point execution unit[END_REF].

For clarity, the discussion in this paper primarily focuses on the verification of an FPU which produces IEEE-compliant denormal results, but maps denormal operands to zero. In Section 6 we describe the extension of our methodology to FPUs which support denormal operands. In this paper we do not discuss the details of the special values NaN and infinity; the cases involving such operands are discharged trivially by the formal algorithms.

Our verification methodology compares an implementation FPU against a simple reference model. A driver generates the instructions (opcodes) and the operands, and dispatches them into both FPUs. After all computations are finished, the results are compared and an error is flagged if the results differ. The two FPUs are evaluated independently; there is therefore no need to establish corresponding pipeline stages between these FPU models. Because the number of steps needed to complete a single floating point computation is bounded, we may cast our verification problem as a bounded check using SAT-and BDD-based techniques instead of requiring more expensive unbounded algorithms.

Our goal is to exhaustively verify the datapath functionality. We aim at bugs which cause numerically incorrect results (e.g., incorrect rounding) instead of bugs which, for example, result from unintended interaction between multiple instructions. Hence we restrict our verification to a single arbitrary instruction issued into an empty FPU. Note that bugs in the inter-instruction control may often cause data errors. However, these are often considered a separate class of bugs which may be verified separately from the numerical computation, as per [START_REF] Jacobi | Formal verification of complex out-of-order pipelines by combining model-checking and theorem-proving[END_REF][START_REF] Kaufmann | Verification of pipeline circuits[END_REF]. Though we do not cover inter-instruction aspects, we do exhaustively verify the control logic specific to the execution of a single instruction, including opcode decoding and aspects of the clock gating control (which is particularly nontrivial for modern processors).

There are three building blocks in the FPU that are major hurdles for formal algorithms: namely, the multiplier, the alignment shifter that aligns the addend to the product, and the normalization shifter that eliminates leading zeros in the intermediate result before rounding. Each of these building blocks leads to run-time explosion of SAT, and memory-explosion of BDDs.

To circumvent the difficulties posed by the shifters, we split the overall verification problem into sub-problems as discussed in Section 4. Each sub-problem restricts the shift-amount for both shifters, causing them to "collapse" into simple wires, similar to the case-splitting strategy employed in [START_REF] Chen | Verification of floating point adders[END_REF] for verifying floatingpoint addition. We extend this approach to FMA instructions, and to handle denormal results and operands (refer to Section 6).

To circumvent the difficulties posed by the multiplier, we remove it from the cone-of-influence of the FPU outputs, as depicted in Figure 1. Note that the inputs to the multiplier are the significands of the operands A and B, and its outputs are S and T such that the sum of S and T equals the product of the input significands. Additionally, S and T contain some leading bits known as "hot-ones" which are an artifact of Booth-encoding. To eliminate the multiplier, we override S and T with new signals S and T , causing the multiplier logic to become sinkless and consequently to be removed from the cone-of-influence. Note that the multiplier in both the real and reference FPU is overridden by S and T for consistency.

The FPU relies on two properties that the real multiplier satisfies. We therefore define S and T such that they may take arbitrary values which adhere to these two properties: (i) the sum of S and T lies in the range [START_REF] Ludden | Functional verification of the POWER4 microprocessor and POWER4 multiprocessor systems[END_REF][START_REF] Russinoff | A mechanically checked proof of IEEE compliance of the floating point multiplication, division and square root algorithms of the AMD-K7 processor[END_REF] for normal input significands, and (ii) the most significant bits of S and T can take only specific values, depending on the exact implementation of the multiplier array (hotone bits). To ensure soundness, we formally verify that the original multiplier also satisfies the two constraints, i.e. S and T overapproximate the behavior of S and T . Hence, all possible outputs of the real multiplier are covered in our verification. Practically, this is a simple proof obligation for SAT, since it requires only a fraction of the multiplier logic in the cone-of-influence.

Our formal methodology thus verifies the entire numerical computation except for the actual significand multiplication. We thus cover alignment shifts, end-around-carry addition and leading zero anticipation, normalization with sticky-bit computations, mis-anticipation correction, rounding, overflow and underflow detection, etc. Such implementations are notoriously customized and error-prone, while the multiplier itself is relatively straightforward in comparison. Since our methodology is portable to alternate frameworks, we also validate the design without the multiplier overrides or case-splits using simulation and semi-formal methods. The multiplier may also be formally verified using existing techniques [START_REF] Bryant | Verification of arithmetic circuits with binary moment diagrams[END_REF][START_REF] Stoffel | Verification of integer multipliers on the arithmetic bit level[END_REF] to ensure completeness of the overall process.

Reference FPU

In this section we describe the reference FPU, against which we compare the real FPU. The reference FPU is written in VHDL2 and, as with the real FPU, is transformed into a netlist using a standard VHDL compiler. The primary goal of the reference FPU is simplicity: it must be a concise specification, not prone to the introduction of bugs via the high-performance design and micro-architecture tricks that complicate the real FPU. In industrial designs, blocks such as adders, shifters, and leading-zero counters are often designed at the gate-level in order to match the high-performance circuit structure and facilitate combinational equivalence checking between the two representations [START_REF] Ludden | Functional verification of the POWER4 microprocessor and POWER4 multiprocessor systems[END_REF][START_REF] Kuehlmann | Verity -a formal verification program for custom CMOS circuits[END_REF]. In the multi-GHz design domain, this means that such blocks must be pipelined and hence cannot be specified with high-level VHDL operators such as "+" and "sll". In contrast, we do use such VHDL operators in our reference model since we need not match circuit characteristics or latch points. This simplicity comes at the cost of increased gate count and greater structural dissimilarity with the real FPU which precludes redundancy removal techniques from significantly simplifying the verification problem. This is inevitable with a portable reference model -and addressed by our overall methodology.

Altogether, the core of the reference FPU is only 300 lines of VHDL; the handling of special cases such as operations on NaN and infinity requires another 150 lines of trivial if-then constructs. The reference FPU is thus approximately 450 lines of VHDL, versus approximately 15,000 for the real FPU.

Algorithm. We now describe the reference FPU algorithm and give some details of its implementation. The reference FPU is required to compute A × B + C for three operands A, B, and C. Other operations like addition or multiplication can be derived from FMA in an obvious way. Let sa denote the sign, ea the unbiased exponent, and fa the significand including the implicit bit of the operand A (similarly for B and C). We define sp = sa xor s b , ep = ea + e b , gap (d) Farout right: the product is much larger than the addend; the addend becomes a sticky bit.

(c) Overlap right: the product is larger than the addend; the addend overlaps with the right part of the product.

(b) Overlap left: the addend is larger than the product; the product overlaps with the right part of the addend.

(a) Farout left: the addend is much larger than the product; there is no overlap, the product becomes a sticky bit.

© bit product ! " # & intermediate result ' ( ) 0 ' ! "
is the intermediate result exponent

A × B + C = [(-1) sa × 2 ea × fa] × [(-1) s b × 2 e b × f b ] + [(-1) sc × 2 ec × fc] = ([(-1) sp × 2 ep × fp] + [(-1) sc × 2 ec × fc]) .
Because the operand significands have 1 bit before and 52 bits behind the binary point, fp has 2 bits before and 104 bits behind the binary point, thus, a total of 106 bits. Let δ := epec denote the difference of the product exponent and the addend exponent. For simplicity, the reference FPU is implemented as a case-statement distinguishing the following four cases. In a real FPU, one would reuse as much logic as possible between these cases, decreasing circuit size but increasing implementation complexity. Far-out left: δ ≤ -55. In this case, the addend is much larger than the product, hence lies completely to its left as in Figure 2(a). The addend is thus used as an intermediate result and the product is reduced to a single sticky bit used for rounding. 3Overlap left: If δ ∈ {-54, . . . , -1}, the addend is larger than the product but the product vector overlaps with the right end of the addend vector as in Figure 2

significand is incremented. A carry-out is

Based on the guard, sticky, and rounding mode, the g Far-out right: δ ≥ 106. This is the case where the addend is much smaller than the product, hence lies completely to its right as in Figure 2(d). In this case, the product becomes the intermediate result, and the addend is reduced to a sticky bit.

G H I P Q S U V G H I P Q S U V result exponent + fraction X Y `a b c Y `a b c G H I P shift by S U V e X g h p q s t u v G H I P w nlz = #
The maximum width for the intermediate result in these cases is 161 bits -this accounts for 1 carry-out bit, 53 bits of the addend, 106 bits of product, plus 1 guard bit. In all cases an intermediate result of this width is computed; if the overlap is small (or a farout case happens), the intermediate result is padded with 0's. The intermediate exponent eint is the weight of the most-significant bit.

The intermediate result is next passed to the rounder, depicted in Figure 3. First, the rounder counts the number of leading zeros nlz of the intermediate result. This is necessary since, in the overlap cases, the addend and the product may cancel-out some positions. Next, the intermediate result is shifted to the left by nlz places, and the intermediate exponent is adjusted by subtracting nlz from it. However, the shift-amount is bounded if necessary to prevent the exponent from becoming negative; note that a denormal result may be generated here due to such partial normalization. Finally, the normalized intermediate result is rounded according to the rounding mode and the bits behind the significand, as well as the sticky bits generated in the two far-out cases. The rounder also produces flags such as overflow, underflow, and inexact, which are readily computed from the exponent and the rounding decision.

Case-Splitting

The FPU's alignment and normalization shifters are inherently difficult for both BDD-and SAT-based algorithms, due to shifts of variable values by variable amounts. In order to make the verification task feasible, the overall problem must be divided into sub-cases. The general idea of case-splitting is to fix the shift amounts of both shifters to a constant in each case, rendering the shifters amenable to BDD-and SAT-based analysis within each case. To ensure complete coverage, all possible combinations of shift amounts must be included in at least one case. This general scheme of case-splitting was also used in [START_REF] Chen | Verification of floating point adders[END_REF] for the verification of floating-point addition. We now describe the case-splits needed for the verification of FMA, and contrast to those of [START_REF] Chen | Verification of floating point adders[END_REF] below. First, we distinguish between overlap and far-out cases: i) Far-out: in the far-out cases, the intermediate result is the product and the addend is reduced to a single sticky bit, or vice versa. This case does not need to be sub-divided further.

ii) Overlap: this is the case where the addend and the product overlap, i.e., δ ∈ {-54, . . . , 105}. The alignment-shift amount is determined by δ. This case is divided into a subcase for each of the 160 different δ-values to trivialize the alignment shifter. These 160 cases belong to two classes: (a) No cancellation: if δ / ∈ {-2, -1, 0, 1}, the mostsignificant bits of the addend and the product are at least two bit-positions apart. In this case, no massive cancellation can occur. The small normalization shift amounts between 0 and 2 due to carry-outs or borrow-outs during the addition can be handled by the formal algorithms without further splitting. (b) Cancellation: if δ ∈ {-2, -1, 0, 1}, the product and the addend may cancel out leading bits when doing effective subtraction. In this case the normalization shift amount is determined by the leading-zero counter in the reference FPU and by a leading-zero-anticipator [START_REF] Montoye | Design of the IBM RISC System/6000 floating-point execution unit[END_REF] in the real FPU. Both methods normalize at most to the extent that the exponent does not drop below 0 as per Figure 3. Since in these cases the normalization shifter can perform shifts by arbitrary amounts, we sub-divide these four δ-values into sub-cases for every normalization-shift-amount, i.e., into 107 sub-cases. 4We thus have one far-out case, 156 non-cancellation overlap cases, and 4 × 107 cancellation overlap cases, totaling 585 cases which are independently verified. Note that these cases naturally reflect the way in which every FPU must generate results, from simple reference models to multi-GHz implementations using any variety of design and micro-architectural techniques. We thus feel that these case-splits will directly apply to any design, which is substantiated by our having successfully applied them to four industrial FPUs.

There is an interesting case hidden in the above case-splits: the product of two normal numbers may be denormal. If such a product is added to a zero addend, the result is the appropriately denormalized product. For example, e prod = -15 and ec = 0 would cause a denormalization of the significand product by 15 places to the right. In the reference FPU, this is handled as an overlap-left case, because δ = -15. This provides the correct number of 0's in front of the product. Since the intermediate exponent eint = ec + 1 = 1 in this case, the normalization shift amount is limited to 1. This is also a fixed shift amount, hence this can be handled simultaneously with the standard δ = -15 non-cancellation case-split as described above. Note that this case also applies to the multiplicationinstruction, where the addend is always zero.

Constraining. Case-splitting is achieved by "constraining" certain signals in the reference FPU corresponding to the sub-case. Formal algorithms use the constraints to define a care-set, and may simplify their processing with respect to the defined care-set.

The distinction between far-out and overlap, and between the different δ-values, is defined by a constraint on the operand exponents. Specifically, we define a constraint C δ := (ea + e b = ec + δ) for every δ-case. The constraint for the far-out cases is the respective inequality over the operand exponents.

As regards the additional constraints for the cancellation cases, the normalization shift amount depends on the number of leading zeros of the intermediate result and the intermediate exponent eint, cf. Figure 3. Hence, it is difficult to define these constraints directly upon the operands while still ensuring that the case-split is complete and still sufficient to trivialize the normalization shifter. For this reason, the normalization shift constraint is defined directly on the shift-amount signal sha of the reference FPU. We define a constraint C sha := (sha = X) for all 107 possible shift-amounts. 4 The disjunction of all the cases is easily provable as a tautology, guaranteeing completeness of our methodology.

The definition of the C sha constraints is simple, since the sha signal may be directly referenced from the reference FPU. However, the logic driving this signal has considerable complexity. The number of leading zeros in the intermediate result is obtained from a 161-bit addition of the product and the addend. The addition itself is based on the (constrained) alignment shifts of the product and the addend. Nevertheless, the C sha constraint alone suffices to bound BDD size both for the reference and real FPU computations without any explicit constraint on the real FPU. This is a significant observation and demonstrates the benefit of using constraints as a mechanism for case-splitting: the sha signal is a function of the operand and opcode values represented as a BDD. A constraint on sha is therefore effectively a constraint on the operand and opcode; although the BDD-minimization algorithms are heuristic, they are powerful enough to automatically carry over this constraint from the reference to the real FPU, effectively constraining the real FPU's shift amount as well. This is non-trivial, considering that the real FPU's shift-amount is obtained from a completely dissimilar piece of logic, namely a limited leading-zero anticipator (LZA) working in parallel with the adder (such as the one described in [START_REF] Montoye | Design of the IBM RISC System/6000 floating-point execution unit[END_REF]). The shift-amount signal in the real FPU may even differ in value from sha in the reference FPU, e.g., offset by a constant preshift, or simply offset by one due to the possible shift-amount anticipation error inherent in the LZA.

Discussion. The distinction between far-out and overlap with and without cancellation cases as described above was also done in [START_REF] Chen | Verification of floating point adders[END_REF]. They do not need to sub-divide the δ = -2 case into different normalization cases, since this case can lead to cancellation only in FMA due to the two bits in front of the binary point of the product. In our approach, the C δ constraint is defined similar to [START_REF] Chen | Verification of floating point adders[END_REF]. The normalization shift case-split, however, is done differently: Chen and Bryant define their constraints directly on the operand significands, while we use the reference FPU's sha signal, which imposes a constraint on the operands implicitly. This is necessary in our methodology because denormal results may be produced (whereas [START_REF] Chen | Verification of floating point adders[END_REF] does not verify denormal results), which requires a comparison of the number of leading zeros to the intermediate exponent. This becomes even more complex with denormal operands as discussed in Section 6. Performing such a case splitting strategy for FMA explicitly on the operands would thus be error-prone and amplify the difficulty of ensuring completeness across the cases. The verification task in [START_REF] Chen | Verification of floating point adders[END_REF] is further sub-divided into effective addition/subtraction because cancellation can only happen during the latter. In our setting, this additional split is unnecessary.

Verification results

Our experiments were run on IBM pSeries computers with POWER4 processors running at 1.7GHz, using the IBM internal verification tool SixthSense. All designs are mapped into a netlist representation containing only 2-input AND gates, inverters, and registers, using straight-forward logic synthesis techniques [START_REF] Kuehlmann | Robust Boolean reasoning for equivalence checking and functional property verification[END_REF]. As described, our real FPU comprises approximately 15,000 lines of VHDL. After compilation and phase abstraction [START_REF] Baumgartner | An abstraction algorithm for the verification of level-sensitive latch-based netlists[END_REF], the netlist of the real FPU has approximately 4,800 registers and 55,000 AND gates. We employed automated redundancy removal algorithms [START_REF] Kuehlmann | Robust Boolean reasoning for equivalence checking and functional property verification[END_REF] to reduce the size of the netlist prior to application of BDD-and SAT-based analysis. ifying the add-instruction was approximately 16 hours. Multiplication took only 5 minutes; the accumulated run-time for all FMA jobs was 73 hours. A complete regression of all jobs takes less than a day when running 10 jobs in parallel. Table 1 lists the average and peak number of BDD nodes and run-times for the different types of runs (n/a refers to cases where SAT was used).

We use both SAT-and BDD-based symbolic simulation as our verification engines for FMA. The SAT-solver uses an interleaved BDD-sweeping and structural satisfiability checking technique as described in [START_REF] Kuehlmann | Robust Boolean reasoning for equivalence checking and functional property verification[END_REF], and operates upon an unfolded combinational netlist. The BDD-based symbolic simulator operates directly upon the sequential netlist. Satisfiability checking was used to verify the "far-out" cases and took 53 minutes to complete. The SATsolver is able to identify that the shifters which align the addend to the product are not needed in this case, and thus automatically removes these unused shifters from the cone-of-influence. In contrast, BDD-based symbolic simulation would build the BDDs for these unneeded shifters anyway because only in later time-steps would it become apparent that they are not needed for this case. The overlap cases were verified using BDD-based symbolic simulation with the described case-splits applied as discussed in Section 4.

The addition instruction was verified with the multiplier in the cone-of-influence since the second operand of the multiplication is 1.0; constant propagation automatically replaces the multiplier by trivial logic. The applied case-splitting is similar to the FMA instruction, with the unnecessary splits removed.

We used satisfiability checking for the verification of the multiply instruction. After the multiplier is removed from the coneof-influence, the only difficult aspect of the proof is the possible denormalization (cf. Section 4). Verification of this is possible without case-splitting because the SAT solver and redundancy removal techniques are able to identify structural similarities between the denormalization shifters in the real and the reference FPU, and use this fact to simplify the satisfiability check.

For the cases solved by BDD-based methods, we provided an efficient statically-derived variable ordering to the symbolic simulator. Initially, we attempted to use more generically-computed initial orders coupled with dynamic variable reordering. However, those runs consumed considerably more time and memory, even suffering from memory-explosion at times. The superior orders are intuitively derivable: the operand exponents come first, followed by the fractions intertwined with the pseudo-inputs S and T for the multiplier override; the fractions and S and T are aligned according to the δ of each individual run (similar to those in [START_REF] Chen | Verification of floating point adders[END_REF]). These orders are readily portable to other FPU designs since they are defined in terms only of the operands and pseudo-inputs. Using these orders, we disable dynamic variable ordering as it unnecessarily consumes run-time without yielding a superior order.

We also experimented with different BDD minimization algo-rithms (using the care-sets defined by the constraints). The BDD operation constrain [START_REF] Coudert | Verification of sequential machines using boolean functional vectors[END_REF] was overall the best choice: it is fast when the number of nodes is manageable. More aggressive minimization algorithms yielded greater reductions in the peak number of BDD nodes, but their overall run-time was significantly higher.

6 Portability of this methodology We have adapted the reference FPU and the verification environment to several different FPUs under development at IBM, some of which are fully IEEE-compliant and thus handle denormal operands and results in hardware, and may also perform exponent-wrapping on overflows and underflows. The adaptation of the reference FPU and the verification environment was done within only a few days. The enhancement of the reference FPU to interpret denormal numbers according to the IEEE standard was simple; note that this modification is a one-time effort which does not need to be redone for subsequent FPUs. Also the rules for signals S and T , overriding the multiplier output, had to be adapted: the properties asserted for S and T now also specify the range of the product if one or both operands are denormal. For example, it is asserted that the product lies in the range [0, 1) if both operands are denormal. This is the obvious generalization of the property "the sum of S and T lies in the range [1, 4)" described in Section 2. It is still simple for SAT to prove that the real multiplier also satisfies these properties and hence that the multiplier isolation is sound.

1 0 N N N O O O R S T 1 U U U O O O 0 0 W X 0 0 0 U U U O O O 1 O O O U U U U O O O U U [ N N N O O O cancellation amount
The rest of the methodology can be applied with little modification. The case-splitting strategy can be reused, due to the facts that (i) the motivation for each individual case-split is architecturebased rather than implementation-specific, and (ii) the definition of the case-splits is done in terms of the reused reference FPU instead of the real FPU. However, more overlap cases can now lead to cancellation in the event of denormal operands. This happens, for example, when a normal and a denormal number are multiplied yielding a product with leading zeros. In this case the (normal) aligned addend might just start at the leading '1' of the product (Figure 4), possibly causing massive cancellation. Hence, all overlap cases with potential cancellation must be sub-divided in order to handle the normalization-shifter. This is a straightforward enhancement to the case-splitting described in Section 4; each case has similar runtime to the cases described in Section 5. Although the number of cases becomes larger (quadratic in the number of δ-cases), the overall task is still tractable for discharging automatically, especially given a larger network of machines to parallelize the task. We discharge the approximately 17,000 cases with an accumulated runtime of 1416 hours, which takes approximately one day given 50 machines. We are currently experimenting with techniques to reduce the total number of cases, to decrease the cumulative run-time; we omit such details for the sake of brevity.

Adaptations of our methodology to subsequent FPU designs required less than one day of effort each. Only the rules for S and T had to be adjusted, as these are the only implementation-specific aspect of our methodology. This clearly demonstrates the portability of this methodology.

Related Work

Floating-point verification has been extensively studied both in academia and industry. However, we are not aware of any fullyautomated attempts to formally verify FMA datapaths, nor any which cover denormal operands or results for such operations.

Researchers at Intel [START_REF] O'leary | Formally verifying IEEE compliance of floating point hardware[END_REF][START_REF] Kaivola | Formal verification of the Pentium 4 floating-point multiplier[END_REF] and AMD [START_REF] Russinoff | A case study in formal verification of registertransfer logic with ACL2: The floating point adder of the AMD Athlon processor[END_REF][START_REF] Russinoff | A mechanically checked proof of IEEE compliance of the floating point multiplication, division and square root algorithms of the AMD-K7 processor[END_REF] have also applied formal methods to the verification of FPUs. At Intel, FPUs are verified using a customized toolset combining STE and theoremproving, likely requiring implementation-specific manual effort. Recently, a sketch of the application of this approach to the verification of Intel's Itanium fused-multiply-add datapath was provided in [START_REF] Slobodova | Formal verification of floating point multiply add on Itanium processors[END_REF]. In contrast to our work, their approach does not address details of the case-splits necessary for tractability, and does not cover denormal results nor operands. The verification at AMD uses the theorem prover ACL2, which requires manually-guided proofs. Our approach is fully automatic and portable.

Aagaard and Seger [START_REF] Aagaard | The formal verification of a pipelined double-precision IEEE floating-point multiplier[END_REF] verified a floating-point multiplier using a customized toolset combining STE and theorem proving. Their multiplier does not include a denormalization shifter for multiplication because it traps on denormal results. The multiplier array is verified by sub-dividing the hardware into a Booth-decoder and an addition network. The two parts are combined using theorem proving. A similar approach is taken in [START_REF] Kaivola | Formal verification of the Pentium 4 floating-point multiplier[END_REF] for the verification of Intel's Pentium 4 multiplier.

Berg and Jacobi [START_REF] Berg | Formal verification of the VAMP floating point unit[END_REF] used the PVS theorem proving system to verify an IEEE-compliant FPU against a mathematical formulation of the IEEE standard. The use of a theorem prover is quite labor intensive, especially at low levels of abstraction such as the gatelevel. Furthermore, such low level proofs are tailored to the specific implementation, and hence are difficult to adapt to a different FPU.

The approach of Chen and Bryant [START_REF] Chen | Verification of floating point adders[END_REF] to verify floating-point addition comes closest to our work. In particular, our case-splitting strategy is similar to theirs, as discussed in Section 4. We extend their technique for applicability to the fused-multiply-add instruction, and to cover denormal results and operands. Additionally, our approach uses standard BDD-and SAT-based analysis (exploiting bit-level redundancy removal), whereas that of [START_REF] Chen | Verification of floating point adders[END_REF] requires wordlevel PHDDs for computational efficiency.

Various research has addressed the automatic verification of integer multipliers, e.g., [START_REF] Bryant | Verification of arithmetic circuits with binary moment diagrams[END_REF][START_REF] Stoffel | Verification of integer multipliers on the arithmetic bit level[END_REF]. One promising future direction is to incorporate such techniques into our methodology to verify the multiplier along with the rest of the FPU, without isolation.

Summary

We have presented a fully-automated approach for verifying floating-point addition, multiplication, and fused-multiply-add instructions by comparing their implementation against a simple reference FPU. To reduce formal complexity, we isolate the multiplier from the cone-of-influence by overriding it with conservative variables. We additionally present a case-splitting strategy necessary to make the verification feasible with automatic formal methods. All case-splitting is defined exclusively in terms of the reference FPU, and our specification is synthesizable (hence portable to simulation, emulation, and arbitrary formal frameworks without a need for customized tools), rendering a highly-portable overall methodology.

We have adapted this methodology to partially as well as fully IEEE-compliant designs. Our experiments demonstrate this to be an efficient and scalable approach for the verification of floating point datapaths. The methodology is currently being applied to four FPUs under development at IBM. Dozens of high-quality bugs have been exposed by these efforts, some of which would likely have slipped into first silicon otherwise.

1Figure 1 :

 1 Figure 1: Removal of the multiplier from the cone-of-influence

Figure 2 :

 2 Figure 2: The four cases of the reference FPU's algorithm and fp = fa × f b . The FMA operation can be rewritten as

  (b). In this case the intermediate result is computed by adding/subtracting the properly aligned product to the addend, depending on the signs and opcode. Aligning means shifting by an amount depending upon δ. Overlap right: δ ∈ {0, . . . , 105}. Similar to the previous case, now the addend overlaps with the right side of the product D E propagated into the exponent.

Figure 3 :

 3 Figure 3: Block level diagram of the reference FPU's rounder as in Figure 2(c). Here the intermediate result is computed by adding/subtracting the properly aligned addend to the product.Far-out right: δ ≥ 106. This is the case where the addend is much smaller than the product, hence lies completely to its right as in Figure2(d). In this case, the product becomes the intermediate result, and the addend is reduced to a sticky bit.The maximum width for the intermediate result in these cases is 161 bits -this accounts for 1 carry-out bit, 53 bits of the addend, 106 bits of product, plus 1 guard bit. In all cases an intermediate result of this width is computed; if the overlap is small (or a farout case happens), the intermediate result is padded with 0's. The intermediate exponent eint is the weight of the most-significant bit.The intermediate result is next passed to the rounder, depicted in Figure3. First, the rounder counts the number of leading zeros nlz of the intermediate result. This is necessary since, in the overlap cases, the addend and the product may cancel-out some positions. Next, the intermediate result is shifted to the left by nlz places, and the intermediate exponent is adjusted by subtracting nlz from it. However, the shift-amount is bounded if necessary to prevent the exponent from becoming negative; note that a denormal result may be generated here due to such partial normalization. Finally, the normalized intermediate result is rounded according to the rounding mode and the bits behind the significand, as well as the sticky bits generated in the two far-out cases. The rounder also produces flags such as overflow, underflow, and inexact, which are readily computed from the exponent and the rounding decision.

Figure 4 :

 4 Figure 4: Denormal operands may cause cancellation even for large δ's

Table 1 :

 1 The accumulated run-time for ver-BDD nodes and runtimes for the double-precision cases

		Nodes [10 6 ] Time [mins]
	Instr. Case	avg max avg max
	add overlap w/ cancellation	0.2	0.4	3	5
	add overlap w/o cancellation	0.3	0.5	3	4
	add far-out	n/a	n/a		12
	mult n/a	n/a	n/a		5
	FMA overlap w/ cancellation	6.9 26.0	8	24
	FMA overlap w/o cancellation	2.1	4.7	5	10
	FMA far-out	n/a	n/a		53

Others have formalized the IEEE standard in a theorem prover as a mathematical specification[START_REF] Miner | Defining the IEEE-854 floating-point standard in PVS[END_REF][START_REF] Berg | Formal verification of the VAMP floating point unit[END_REF]; we use an HDL-based reference model for portability to simulation, emulation, semi-formal, and formal verification frameworks.

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05)

The -55 boundary is derived as follows (cf. Figure2(a)): the addend has 52 bits behind the binary point, while δ reflects the distance between the most-significant addend bit and the first bit left of the binary point of the product. Hence, if this distance is 52, i.e. δ = -52, the two bits left of the binary point of the product lie below the two LSBs of the addend. At a distance of 54, the product lies directly behind the addend, but then the MSB of the product would be the guard bit for rounding. At a distance of greater or equal to 55 (δ ≤ -55), the product is completely reduced to a sticky-bit for rounding. The other boundaries can be derived similarly.

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05) 1530-1591/05 $ 20.00 IEEE

This includes all 106 possible shift amounts, plus one additional case C sha/rest := (sha > 106) to cover the remaining values. The C sha/rest case defines an empty care-set, hence this case is trivially discharged; it is checked only for completeness.