Relational STE and theorem proving for formal verification of industrial circuit designs

Abstract

Model checking by symbolic trajectory evaluation, orchestrated in a flexible functional-programming framework, is a well-established technology for correctness verification of industrial-scale circuit designs. Most verifications in this domain require decomposition into subproblems that symbolic trajectory evaluation can handle, and deductive theorem proving has long been proposed as a complement to symbolic trajectory evaluation to enable such compositional reasoning. This paper describes an approach to verification by symbolic simulation, called Relational STE, that raises verification properties to the purely logical level suitable for compositional reasoning in a theorem prover. We also introduce a new deductive theorem prover, called Goaled, that has been integrated into Intel's Forte verification framework for this purpose. We illustrate the effectiveness of this combination of technologies by describing a general framework, accessible to non-experts, that is widely used for verification and regression validation of integer multipliers at Intel.

Universal boolean functional vectors

“…Nevertheless, the data structure is still widely used in industry to solve real-world hardware verification problems, for example at companies such as Intel [23], IBM [24], [29], and Centaur [28]. Furthermore, contemporary commercial FV tools also include BDDs in their spectrum of technologies.…”

Verifying Relative Error Bounds Using Symbolic Simulation

“…The advantage of this approach is that it mechanizes the high level reasoning needed to reduce the relative error specification to a form suitable for automatic analysis. Our approach currently relies on pen-and-paper meta-theorems to support this reduction, although we are confident they could be mechanized using the Goaled theorem prover integrated with Forte [10]. However, the advantage of our approach is that it works directly on the register transfer level (RTL)-there is no need to construct a high level model of its behaviour-and it can also be applied to verify the relative error bounds of EXP2.…”

“…We were able to verify that the relative error bound was 2 −22 and 2 −23 , respectively, for these instructions. 10 The time accounted to symbolic simulation also involves a non-negligible component for a cone-of-influence reduction.…”

“…Our method has been implemented in reFLect, the lazy functional language used to program Intel's Forte tool suite [14], and sits as a specification layer on top of the Relational STE [10] symbolic simulator. The design under verification was from a next-generation many-core CPU under development at Intel R .…”

“…Spec Time is the time for just computing the relative error specification; the time for symbolic simulation is not included. 10 Mem is the maximum virtual memory, in GB, the Forte process used during execution. Alg indicated which of the decision procedures from Sect.…”