Automatic Formal Verification of Liveness for Pipelined Processors with Multicycle Functional Units

Abstract

Previous work on microprocessor formal verification has almost exclusively addressed the proof of safety-that if a processor does something during a step, it will do it correctly-as also observed in [2], while ignoring the proof of liveness-that a processor will complete a new instruction after a finite number of steps. Several authors used theorem proving to check liveness [15] Functional units in recent state-of-the-art processors usually have latencies of up to 20 -30 cycles, and rarely up to 200 cycles, but it is expected that the memory latencies in next generation high-performance designs will reach 1,000 cycles [13]. Thus, the need to develop automatic techniques to prove the liveness of pipelined processors where the functional units can have latencies of up to thousands of cycles.In the current paper, the implementation and specification are described in the highlevel hardware description language HDL [46], based on the logic of Equality with Uninterpreted Functions and Memories (EUFM) [7]. In EUFM, word-level values are abstracted with terms (see Sect. 4) whose only relevant property is that of equality with other terms. Restrictions on the style for describing high-level processors [35][36] reduced the number of terms that appear in both positive and negated equality comparisons-and are so called g-terms (for general terms)-and increased the number of http://www.ece.cmu.edu/~mvelev mvelev@ece.cmu.eduAbstract. Presented is a highly automatic approach for proving bounded liveness of pipelined processors with multicycle functional units, without the need for the user to set up an inductive argument. Multicycle functional units are abstracted with a placeholder that is suitable for proving both safety and liveness. Abstracting the branch targets and directions with arbitrary terms and formulas, respectively, that are associated with each instruction, made the branch targets and directions independent of the data operands. The observation that the term variables abstracting branch targets of newly fetched instructions can be considered to be in the same equivalence class, allowed the use of a dedicated fresh term variable for all such branch targets and the abstraction of the Instruction Memory with a generator of arbitrary values.To further improve the scaling, the multicycle ALU was abstracted with a placeholder without feedback loops. Also, the equality comparison between the terms written to the PC and the dedicated fresh term variable for branch targets of new instructions was implemented as part of the circuit, thus avoiding the need to apply the abstraction function along the specification side of the commutative diagram for liveness. This approach resulted in 4 orders of magnitude speedup for a 5-stage pipelined DLX processor with a 32-cycle ALU, compared to a previous method for indirect proof of bounded liveness, and scaled for a 5-stage pipelined DLX with a 2048-cycle ALU.Miroslav N. Velev D.

Formal verification of safety of polymorphic heterogeneous multi-core architectures

“…We can prove liveness indirectly [32,38]-by first proving safety, thus inductively the implementation correctness for n steps, and then using Positive Equality to prove that the implementation processor will make forward progress by analyzing only the updates of the Program Counter.…”

TLSim and EVC: a term-level symbolic simulator and an efficient decision procedure for the logic of equality with uninterpreted functions and memories

“…Special abstractions and an indirect method for proving liveness, resulting in orders of magnitude speedup, are presented in Velev (2004b). Techniques for proving liveness of pipelined processors with multicycle functional units are presented in Velev (2005b). The syntax of EUFM (Burch and Dill, 1994) includes terms and formulas--see Figure 2.…”