Integrating Formal Verification into an Advanced Computer Architecture Course

Abstract

Abstract. The paper presents a sequence of three projects on design and formal verification of pipelined and superscalar processors. The projects were integrated-by means of lectures and preparatory homework exercises-into an existing advanced computer architecture course taught to both undergraduate and graduate students in a way that required them to have no prior knowledge of formal methods. The first project was on design and formal verification of a 5-stage pipelined DLX processor, implementing the six basic instruction types-register-register-ALU, registerimmediate-ALU, store, load, jump, and branch. The second project was on extending the processor from project one with ALU exceptions, a return-from-exception instruction, and branch prediction; each of the resulting models was formally verified. The third project was on design and formal verification of a dual-issue superscalar version of the DLX from project one. The preparatory homework problems included an exercise on design and formal verification of a staggered ALU, pipelined in the style of the integer ALUs in the Intel Pentium 4. The processors were described in the high-level hardware description language AbsHDL that allows the students to ignore the bit widths of word-level values and the internal implementations of functional units and memories, while focusing entirely on the logic that controls the pipelined or superscalar execution. The formal verification tool flow included the term-level symbolic simulator TLSim, the decision procedure EVC, and an efficient SAT-checker; this tool flow-combined with the same abstraction techniques for defining processors with exceptions and branch prediction, as used in the projects-was applied at Motorola to formally verify a model of the M•CORE processor, and detected bugs. The course went through two iterations-offered at the Georgia Institute of Technology in the summer and fall of 2002-and was taught to 67 students, 25 of whom were undergraduates.

TLSim and EVC: a term-level symbolic simulator and an efficient decision procedure for the logic of equality with uninterpreted functions and memories

“…The tool flow was applied to formally verify a version of the M • CORE processor at Motorola, and detected two bugs in the forwarding logic, one bug in the issue logic, and corner cases that were not fully implemented (Lahiri et al, 2001). The tool flow was also used in two editions of an advanced computer architecture course (Velev, 2005a;2003b), where undergraduate and graduate students without prior knowledge of formal methods designed and formally verified single-issue pipelined DLX processors, as well as extensions with exceptions and branch prediction, and dual-issue superscalar implementations.…”

“…These restrictions, together with techniques to model multicycle functional units, exceptions and branch prediction (Velev and Bryant, 2000), allowed our tool flow (see Section 3) to be used to formally verify a model of the M • CORE processor at Motorola (Lahiri et al, 2001), and detected three bugs, as well as corner cases that were not fully implemented. The tool flow was also used in two editions of an advanced computer architecture course (Velev, 2005a(Velev, , 2003b, where undergraduate and graduate students without prior knowledge of formal methods designed and formally verified single-issue pipelined DLX processors (Hennessy and Patterson, 2002), as well as extensions with exceptions and branch prediction, and dual-issue superscalar implementations.…”

A new generation of ISCAS benchmarks from formal verification of high-level microprocessors

“…Number of formulas in this suite: 23 (17 tautologies, and 6 non-tautologies) Suite 9: Student Buggy Designs 1. These formulas are from student implementations of single-issue, 5-stage pipelined DLX processors [29], designed as a project in an advanced computer architecture course [65]. The models were created by 52 students (40 graduate and 12 undergraduate), working in 24 groups.…”

“…These formulas were generated with a tool flow [62] that was used at Motorola [37] to formally verify a model of the M•CORE processor, and detected 3 bugs as well as corner cases that were not fully implemented. The tool flow was also used in an advanced computer architecture course [65], where students-having no prior knowledge of formal methods-designed and formally verified single-issue pipelined processors, as well as extensions with exceptions and branch prediction, and dualissue superscalar implementations; a detailed description of the student bugs can be found in [67].…”

Using positive equality to prove liveness for pipelined microprocessors

“…This tool flow was used at Motorola [14] to formally verify a model of the M•CORE processor, and detected bugs. The tool flow was also used in an advanced computer architecture course [34] [36], where students designed and formally verified pipelined processors.…”