Model Checking the IBM Gigahertz Processor: An Abstraction Algorithm for High-Performance Netlists

Abstract

Abstract.A common technique in high-performance hardware design is to intersperse combinatorial logic freely between level-sensitive latch layers (wherein one layer is transparent during the "high" clock phase, and the next during the "low"). Such logic poses a challenge to verificationunless the two-phase netlist N may be abstracted to a full-cycle model N (wherein each memory element may sample every cycle), model checking of N requires at least twice as many state variables as would be necessary to obtain equivalent coverage for N . We present an algorithm to automatically obtain such an abstraction by selectively eliminating latches from both layers. The abstraction is valid for model checking CTL* formulae which reason solely about latches of a single phase. This algorithm has been implemented in IBM's model checker, RuleBase, and has been used to enable model checking of IBM's Gigahertz Processor, which may not have been feasible otherwise. This abstraction has furthermore allowed verification engineers to write properties and environments more efficiently.

Automatic generalized phase abstraction for formal verification

“…Previous work has already established that phase abstraction can increase the verification capacity of model checking by several orders of magnitude [2]. However, there has been very little analysis of where this increase in capacity comes from.…”

“…The process of deriving this simpler design is commonly referred to as phase abstraction ( [1], [2], [3]). …”

“…In the case of a strict two-phase design style, it is not hard to show that the validity status of safety properties will be preserved if the phase abstracted system is generated by substituting either a short circuit or a multiplexor for one of the latch layers, and flip flops for the other [2]. If there are as many φ 1 latches as φ 2 latches, this means that the number of state-holding elements in the abstracted design is reduced by 50%.…”

“…The standard approach to performing two-phase abstraction for model checking proceeds as follows [2]:…”

“…3) Given this information, regions where a strict two-phase design style is followed are identified. 4) For each such region, or Minimal Dependent Layer (MDL) in the terminology of [2], either all the φ 1 or φ 2 latches are removed by the appropriate substitution while the other latches become flip flops.…”