Automatic verification of safety and liveness for XScale-like processor models using WEB refinements

Abstract

We show how to automatically verify that a complex XScale-like pipelined machine model is a WEB-refinement of an instruction set architecture model, which implies that the machines satisfy the same safety and liveness properties. Automation is achieved by reducing the WEB-refinement proof obligation to a formula in the logic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU). We use UCLID to transform the resulting CLU formula into a CNF formula, which is then checked with a SAT solver. We define several XScale-like models with out of order completion, including models with precise exceptions, branch prediction, and interrupts. We use two types of refinement maps. In one, flushing is used to map pipelined machine states to instruction set architecture states; in the other, we use the commitment approach, which is the dual of flushing, since partially completed instructions are invalidated. We present experimental results for all the machines modeled, including verification times. For our application, we found that the SAT solver Siege provides superior performance over Chaff and that the amount of time spent proving liveness when using the commitment approach is less than 1% of the overall verification time, whereas when flushing is employed, the liveness proof accounts for about 10% of the verification time.

The Challenge of Hardware-Software Co-verification

“…For example, a big advantage over previous work is that we can handle liveness; in fact, we show that with our approach the time spent proving liveness accounts for only 5% of the total verification time [17].…”

Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

“…5. Another approach suitable for proving both safety and liveness of pipelined processors was proposed in [24], but was not applied to designs with multicycle functional units.…”

Automatic memory reductions for RTL model verification

“…In fact, BAT was able to solve the specification without calling the SAT solver by using the rewrite rules described in Section 4. Two Stage Pipelined Machine (2f ) Benchmarks: The 2f is a flushing based refinement theorem [14] for a simple 2 stage pipelined machine that implements only an add instruction and has two memory elements, which are the instruction memory and the register file as shown in Figure 5(a). We used the 2f benchmarks to compare BAT with VCEGAR, and found that VCEGAR cannot handle any of these benchmarks.…”

“…We did not use VCEGAR to check the 5f and the 5fb benchmarks, as they are far more complex than the 2f benchmarks, which VCEGAR was not able to handle. Three Stage Pipelined Machine (3c) Benchmarks: The 3c benchmark is a commitment based refinement theorem [14] for a 3 stage pipeline, which has an instruction memory, a register file, and a data memory. Table 2 shows the BAT verification times for the 3c benchmarks obtained by increasing the number of words in the memory elements (N).…”

“…If rewrite rules are not used, the number of words in the resulting memory abstractions are large, and are significantly more difficult for BAT to analyze. Five Stage Pipelined Machine (5f ) Benchmarks: The 5f benchmark is a flushing based refinement theorem [14] for a 5 stage pipelined machine model that implements simple ALU, load, store, and branch instructions. To support these instructions, the model has an instruction memory, a register file, and a data memory.…”