programmable IPs against their operational ISA model Markus Wedler, - PowerPoint PPT Presentation

Designing Correct Circuits 2010 Gap-Free verification of weakly programmable IPs against their operational ISA model Markus Wedler, Sacha Loitz, Wolfgang Kunz Department of Electrical and Computer Engineering University of Kaiserslautern/Germany

Designing Correct Circuits 2010 Outline  Challenges for Formal Verification imposed by Weakly-Programmable IPs (WPIP)  Interval Property Checking  Specification Methodology  Gap-Free Specifications  Operational ISA model  Operation-oriented specification  Software Constraints  Completeness considerations  Applications 29.03.2010 Slide-2

Designing Correct Circuits 2010 Example WPIP FlexiTreP 29.03.2010 Slide-3

Designing Correct Circuits 2010 Example WPIP FlexiTreP Challenges:  Deep pipelines  hard to control operations in uppermost stages  Out-of-order memory access  Implicit use of software constraints for optimization of the pipeline  Huge number of configurations  ISA model not available 29.03.2010 Slide-4

Designing Correct Circuits 2010 Standard design flow for ASIPs SW Generic Algorithm Processor Profiling Additional Instructions Combine ASIP 29.03.2010 Slide-5

Designing Correct Circuits 2010 Bottom-up Design Flow for WPIPs Hallo WPIP Design Pipeline Functional Blocks Flexibility Analyze Requirements Micro- Micro- Micro- Architecture Architecture Architecture Algorithm A Algorithm B Algorithm C 29.03.2010 Slide-6

Designing Correct Circuits 2010 WPIP FlexiTreP MAP MEM LLR  MAP BM REC BUF micro-architecture BUF  Turbo DeInt DeInt AP/ Int Int AP micro-architecture Survivor  Viterbi TB micro-architecture MEM BM REC LLR/TB 29.03.2010 Slide-7

Designing Correct Circuits 2010 SAT-based Property Checking Iterative Circuit Model: from i = t to i = t + k Y t X t +1 Y t +1 X t+k Y t+k X t  t+k ,  t+k  t ,  t  t +1 ,  t +1 s t s’ t = s t +1 s’ t +1 = s t +2 p = 1? Boolean function to represent property Boolean satisfiability problem (SAT) SAT modulo Theory (SMT) problem 29.03.2010 Slide-8

Designing Correct Circuits 2010 SAT-based Property Checking Y t X t +1 Y t +1 X t+k Y t+k X t  t+k ,  t+k  t ,  t  t +1 ,  t +1 s t s’ t = s t +1 s’ t +1 = s t +2 p = 1? Boolean function to represent property  Unsatisfiability guarantees unbounded validity of G ( p )  p is specified by a timed Boolean predicate ( TBP ) in terms of design signals consisting of: Boolean connectives ( ∧,∨,…)  Generated next state operator X t   A TBP p refers to bounded inspection interval of time [t f ,t l ] 29.03.2010 Slide-9

Designing Correct Circuits 2010 RT-level module verification: operation by operation Typical methodology for Property Checking of SoC modules: Control 1  Adopt an operational view of the design  Each operation can be associated with certain important control states in which the operation starts and ends  Specify a set of properties for every operation, i.e., for every important control state n cycles  Verify the module operation by operation by moving along the important control states of the design Control 2  The module is verified when every operation has been covered by a set of properties 29.03.2010 Slide-10

Designing Correct Circuits 2010 Property Checking of processor pipeline Goal: Prove that instructions are performed correctly Spec: Safety properties of type: G ( a  c ) with bounded inspection interval Example: Property in ITL (Interval Language) property instr_XYZ assume: at t: next_instr_can_be_issued(); at t: command_dec(XYZ,res,op1,op2); "assumptions" during[t,t+3]: no_reset; during[t,t+3]: no_interrupt; … prove: at t+3: res == compute_res(XYZ,op1,op2); at t+3: stable_other_regs(res); "commitments" at t+1: next_instr_can_be_issued(); end 29.03.2010 Slide-11

Designing Correct Circuits 2010 CPU verification: instruction by instruction Control 1 Property 1: G( a control 1  c control 2 ) / data_path_control_signals data path n cycles Control 2 Property 2: G( a control 2  c control … ) Slide-12

Designing Correct Circuits 2010 RT-level module verification: operation by operation Typical methodology for property checking of SoC modules: Control 1  Adopt an operational view of the design  Each operation can be associated with certain important control states in which the operation starts and ends How to guarantee  Specify a set of properties for every that every operation, i.e., for every important scenario is control state covered? n cycles  Verify the module operation by operation by moving along the important control states of the design Control 2  The module is verified when every operation has been covered by a set of properties 29.03.2010 Slide-13

Designing Correct Circuits 2010 Mutation coverage A set of (operational) properties P is complete for a design C with respect to a set of mutations M ={ C 1 ,…, C n }, if C satisfies the properties in P and for every mutation C i at least one property fails. Problems:  Criterion design-dependent  Do the mutations reflect designer mistakes? 29.03.2010 Slide-14

Designing Correct Circuits 2010 Completeness A set of (operational) properties P is complete if every two designs C 1 , C 2 satisfying the properties in P are sequentially equivalent. ∧ p ( x , s 1 , o 1 ) 1! K. Claessen : “A Coverage Analysis for Safety Property p ∈ P Lists”, FMCAD 2007 empty model for C 1 1? x empty model for J. Bormann and H. Busch: C 2 „ Method for determining the ∧ p ( x , s 2 , o 2 ) 1! quality of a set of properties” European Patent Application, p ∈ P Publication Number EP1764715, 2005. 29.03.2010 Slide-15

Designing Correct Circuits 2010 Completeness 1! ∧ p ( x , s 1 , o 1 )  Practical extensions: p ∈ P  Allow explicit constraints on empty model inputs of designs for C 1 1? x  Weaken sequential equivalence empty model for C 2 condition by introduction of determination requirements 1! ∧ p ( x , s 2 , o 2 ) p ∈ P  Decompose proof with respect to the given properties p ∈ P.  Sucessor /Case-Split Test: Every input trace can be covered with a uniquely determined sequence of properties ( p i | i ∈ ℕ ) such that the determination intervals match without gaps.  Determination Test: Every property uniquely determines the outputs within its determination interval. 29.03.2010 Slide-16

Designing Correct Circuits 2010 Completeness state insig outsig1 outsig2  Decompose proof with respect to the given properties p ∈ P.  Sucessor /Case-Split Test: Every input trace can be covered with a uniquely determined sequence of properties ( p i | i ∈ ℕ ) such that the determination intervals match without gaps.  Determination Test: Every property uniquely determines the outputs within its determination interval. 29.03.2010 Slide-17

Designing Correct Circuits 2010 Operational ISA model  Due to specific programming models WPIPs often lack a classical ISA model  Instructions correspond to hundreds of classical RISC instructions (referred to a nuclei)  Semantics often implicitly given by functional blocks (operations) involved in the execution How to specify functional behavior of a WPIP? 29.03.2010 Slide-18

Designing Correct Circuits 2010 Operational ISA model  The operational ISA model for a WPIP consists of:  A relation OISA ⊆ I × O between the set of instructions I and the set of (pipeline) operations O  Timed Boolean predicates:  instr i Fetched(): determines whether the instruction i ∈ I is issued into the pipeline at a time-point t  op o (): specifies functionality of the operation o ∈ O op 1 op 3 op k Instrreg … op 2 op 4 op 5 FE o 1 o 2 o 3 o 4 o n 29.03.2010 Slide-19

Designing Correct Circuits 2010 Operational ISA model Manual specifications given by the verification engineer  OISA ⊆ I × O  instr i Fetched(): determines whether the instruction i ∈ I is issued into the pipeline at a time-point t  op o (): specifies functionality of the operation o ∈ O Everything else will be generated automatically! Slide-20

Designing Correct Circuits 2010 Operational ISA model  Timed Boolean predicates that are automatically generated from operational ISA model :  instr i Performed() = ∧ ( i,o ) ∈ OISA op o ()  op o Triggered() = ∨ ( i,o ) ∈ OISA instr i Fetched()  Per-Instruction properties:  instr i Exec()= nextInstrState() ∧ instr i Fetched()  instr i Performed() ∧ X t( i ) nextInstrState() Just another operation  Per-Operation properties: nextInstrState() ∧ op o Triggered()  op o ()  op o Exec()= 29.03.2010 Slide-21

Designing Correct Circuits 2010 Hazards imply software constraints op 1 op 3 op k Instrreg … op 2 op 4 op 5 FE o 1 o 2 o 3 o 4 shared resource  Determine every pair of op k , op j k ≠ j that refer to the same resource with time slack t  For all related instructions i k , i j store (i k , i j , op k , op j , t ) in conflict list 29.03.2010 Slide-22