An implementation of an out-of-order processing unit based on Tomasulo's algorithm is formally verified using compositional model checking techniques. This demonstrates that finite-state methods can be applied to such algorithms, without recourse to higher-order proof systems. The paper introduces a novel compositional system that supports cyclic environment reasoning and multiple environment abstractions per signal. A proof of Tomasulo's algorithm is outlined, based on refinement maps, and relying on the novel features of the compositional system. This proof is fully verified by the SMV verifier, using symmetry to reduce the number of assertions that must be verified.
IntroductionWe present the formal design verification of an "out-of-order" processing unit based on Tomasulo's algorithm [Tom67]. This and related techniques such as "register renaming" are used in modern microprocessors [LR97] to keep multiple or deeply pipelined execution units busy by executing instructions in data-flow order, rather than sequential order. The complex variability of instruction flow in "out-of-order" processors presents a significant opportunity for undetected errors, compared to an "in-order" pipelined machine where the flow of instructions is fixed and orderly. Unfortunately, this variability also makes formal verification of such machines difficult. They are beyond the present capacity of methods based on integrated decision procedures [BD94], and are not amenable to symbolic trajectory analysis [JNB96]. This paper was inspired by Damm and Pnueli, who recently presented a pencil-and-paper proof of an implementation of Tomasulo's algorithm [DP97]. This proof is in two stages, first refining a sequential specification to an intermediate model based on partially ordered executions, and then refining this model to the implementation. The proof presented here has several advantages over this earlier work. First, it is conceptually simpler, since we refine the specification directly to the implementation, with no intermediate step, and no need to reason about second-order objects such as sets or partial orders. Second, the proof here is fully mechanically checked, using a verifier based on symbolic model checking. Although in principle, the proof of [DP97] can be carried out in a higher order prover such as PVS [ORSS94], this would require considerable elaboration. Here, the use of model checking to handle the details of the proof allows the proof to be presented here in the same form in which it is actually presented to the verifier. Third, the implementation here is at the bit level,