Relating Multi-step and Single-Step Microprocessor Correctness Statements

Aagaard, Mark; Day, Nancy A.; Lou, Meng

doi:10.1007/3-540-36126-x_8

Cited by 22 publications

(11 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The approaches in the above nine papers will require significant manual work to apply to the models that are automatically checked for both safety and liveness in the current paper. Aagaard et al [1] formulated a liveness condition, but did not present results.…”

Section: Related Workmentioning

confidence: 83%

“…Then, we need to prove that those constraints are satisfied in the implementation state after one step, Q′ Impl , so that the correctness will hold by induction for that state, and so on for all subsequent states. (See [1][2] for a discussion of correctness criteria. )…”

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

“…We can prove liveness by a modified version of the safety correctness criterion-by symbolically simulating the implementation for a finite number of steps, n, and proving that: (1) where k is the issue width of the implementation. The formula proves that n steps of the implementation match between 1 and n × k steps of the specification, when the implementation starts from an arbitrary initial state that may be restricted by invariant constraints.…”

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

See 2 more Smart Citations

Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

Velev¹

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Previous work on microprocessor formal verification has almost exclusively addressed the proof of safety-that if a processor does something during a step, it will do it correctly-as also observed in [2], while ignoring the proof of liveness-that a processor will complete a new instruction after a finite number of steps. Several authors used theorem proving to check liveness [15] Functional units in recent state-of-the-art processors usually have latencies of up to 20 -30 cycles, and rarely up to 200 cycles, but it is expected that the memory latencies in next generation high-performance designs will reach 1,000 cycles [13]. Thus, the need to develop automatic techniques to prove the liveness of pipelined processors where the functional units can have latencies of up to thousands of cycles.In the current paper, the implementation and specification are described in the highlevel hardware description language HDL [46], based on the logic of Equality with Uninterpreted Functions and Memories (EUFM) [7]. In EUFM, word-level values are abstracted with terms (see Sect. 4) whose only relevant property is that of equality with other terms. Restrictions on the style for describing high-level processors [35][36] reduced the number of terms that appear in both positive and negated equality comparisons-and are so called g-terms (for general terms)-and increased the number of http://www.ece.cmu.edu/~mvelev mvelev@ece.cmu.eduAbstract. Presented is a highly automatic approach for proving bounded liveness of pipelined processors with multicycle functional units, without the need for the user to set up an inductive argument. Multicycle functional units are abstracted with a placeholder that is suitable for proving both safety and liveness. Abstracting the branch targets and directions with arbitrary terms and formulas, respectively, that are associated with each instruction, made the branch targets and directions independent of the data operands. The observation that the term variables abstracting branch targets of newly fetched instructions can be considered to be in the same equivalence class, allowed the use of a dedicated fresh term variable for all such branch targets and the abstraction of the Instruction Memory with a generator of arbitrary values.To further improve the scaling, the multicycle ALU was abstracted with a placeholder without feedback loops. Also, the equality comparison between the terms written to the PC and the dedicated fresh term variable for branch targets of new instructions was implemented as part of the circuit, thus avoiding the need to apply the abstraction function along the specification side of the commutative diagram for liveness. This approach resulted in 4 orders of magnitude speedup for a 5-stage pipelined DLX processor with a 32-cycle ALU, compared to a previous method for indirect proof of bounded liveness, and scaled for a 5-stage pipelined DLX with a 2048-cycle ALU.Miroslav N. Velev D.

show abstract

Section: Related Workmentioning

confidence: 83%

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

See 1 more Smart Citation

Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

Velev¹

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Then, we need to prove that those constraints will be satisfied in the implementation state after one step, Q′ Impl , so that the correctness will hold by induction for that state, and so on for all subsequent states. The reader is referred to [1][2] for a discussion of correctness criteria.…”

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

“…The formula proves that n steps of the implementation match between 1 and n × k steps of the specification, when the implementation starts from an arbitrary initial state that may be restricted by invariant constraints. Note that (1) guarantees that the implementation has made at least one step, while the safety correctness criterion allows the implementation to stay in its initial state when formula equality 0 (checking whether the implementation matches the initial state of the specification) is true. The correctness formula is generated automatically in the same way as the formula for safety, except that the implementation and the specification are symbolically simulated for many steps, and formula equality 0 is not included.…”

Section: Definition Of Safety and Livenessmentioning

confidence: 99%

Using positive equality to prove liveness for pipelined microprocessors

Velev¹

ASP-DAC 2004: Asia and South Pacific Design Automation Conference 2004 (IEEE Cat. No.04EX753)

View full text Add to dashboard Cite

Abstract-The paper presents an indirect method to automatically prove liveness for pipelined microprocessors. This is done by first proving safety-correctness for one step, starting from an arbitrary initial state that is possibly restricted by invariant constraints. By induction, the implementation will be correct for any number of steps; we need to prove that for some fixed number of steps, n, the implementation will fetch at least one instruction that will be completed. This was proved efficiently by using the property of Positive Equality. Modeling restrictions made the method applicable to designs with exceptions and branch prediction. The indirect method and the modeling restrictions resulted in 4 orders of magnitude speedup, enabling the automatic liveness proof for dual-issue superscalar and VLIW designs.

show abstract

Automatic Formal Verification of RISC-V Pipelined Microprocessors with Fault Tolerance by Spatial Redundancy at a High Level of Abstraction

Velev

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Relating Multi-step and Single-Step Microprocessor Correctness Statements

Cited by 22 publications

References 15 publications

Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

Using positive equality to prove liveness for pipelined microprocessors

Automatic Formal Verification of RISC-V Pipelined Microprocessors with Fault Tolerance by Spatial Redundancy at a High Level of Abstraction

Contact Info

Product

Resources

About