Formal verification of PowerPC arrays using symbolic trajectory evaluation

Abstract

Verifying memory arrays such as on-chip caches and register files is a difficult part of designing a microprocessor. Current tools cannot verify the equivalence of the arrays to their behavioral or RTL models, nor their correct functioning at the transistor level. It is infeasible to run the number of simulation cycles required, and most formal verification tools break down due to the enormous number of state-holding elements in the arrays. The formal method of symbolic trajectory evaluation (STE) appears to offer a solution, however. STE verifies that a circuit satisfies a formula in a carefully restricted temporal logic. For arrays, it requires only a number of variables approximately logarithmic in the number of memory locations. The circuit is modeled at the switch level, so the verification is done on the actual design.We have used STE to verify two arrays from PowerPC microprocessors: a register file, and a data cache tag unit. The tag unit contains over 12,000 latches. We believe it is the largest circuit to have been formally verified, without abstracting away significant detail, in the industry. We also describe an automated technique for identifying state-holding elements in the arrays, a technique which should greatly assist the widespread application of STE.

Validating PowerPC microprocessor custom memories

“…Previous authors have attributed complex timing, multiple clock phases, complex sequential control logic, and the large number of stateholding elements (state explosion) as their reason for using a simulation-based methodology for equivalence checking custom memories. 1,2,17 While these reasons are valid, the fundamental reason for using a simulation-based approach for custom memories is the prevalence of a certain class of custom-designed self-timed logic structures for which no Boolean function can be extracted using existing techniques.…”

“…Prior work focused on establishing that functional properties held for two different representations. [1][2] No notion of completeness was established by their methodology. To the best of our knowledge, this is the first time that a rigorous symbolic simulation methodology has been used to prove the correctness of switch-level models with respect to the registertransfer-level (RTL) models for all modes of operation (functional and nonfunctional).…”

“…14 Benefits of symbolic simulation Symbolic simulation has proved to be a practical and viable technique for validating behavioral, RTL, and switch-level models. 1,2,[8][9][10][11][13][14][15][16][17] It combines switch-level accuracy with formalized reasoning to infer properties about the system.…”

A Formal Framework for Verification of Embedded Custom Memories of the Motorola MPC7450 Microprocessor

“…Such a technique would prove to be prohibitively expensive in case of symbolic simulation because using such an approach, the number of variables needed to represent a memory would be proportional to the number of bits in it. Therefore, symbolic simulation methods, more often than not, make use of symbolic addressing where the number of unique variables needed to represent a memory is proportional to the logarithm of the total number of bits in it [24]. One can further curtail the number of unique variables needed to represent a memory by using behavioral models.…”

“…They introduced the notion of modeling delay calculations based on Multi-Terminal BDDs in order to overcome, firstly, the performance shortcomings in doing exhaustive simulation and secondly, the problems of pessimistic results in static timing analysis. Checking the correspondence between the switch and the gate level views of the memory has been addressed by many researchers [8,14,18,24,25,31]. While others focussed on using STE to verify equivalence by proving functional properties on both the RTL and the transistor level view of circuits, Krishnamurthy et al reported work on generating assertions automatically from RTLs and cross-checking them against transistor level circuits [18].…”