Using Formal Verification of Parameterized Systems in RAW Hazard Analysis in Microprocessors

HADES: Microprocessor Hazard Analysis via Formal Verification of Parameterized Systems

“…Finally, the last column represents the number of hazard cases that had to be generated and checked. This number differs from the one computed in [7,8] due to HADES newly does not include hazard cases on the program counter among data hazards. These cases will be treated in separate control hazard detection phase, which is currently under implementation.…”

“…Compared with [6,7,8], we enriched the number of variants for the above introduced processors, which gave us 17 unique test cases in total. The variants of the particular processors differ in the following aspects: (i) the way how data hazards are avoided (pipeline stalling and clearing, data bypassing), (ii) the presence of flag / status registers, and (iii) utilization of so-called auto-increment (AI) logic.…”

“…The verification approach of HADES was proposed in [7,8]. It leverages the current advances in SMT solvers for bit-vector logic and in formal verification of systems with a parameterized number of processes-for short, referred to as parameterized systems (PSs) below.…”

“…Here, the main idea is that, this way, a high degree of automation and scalability can be achieved since only parts of a design related to a specific error are to be investigated. The above idea has been followed, e.g., in the works [6,7] that proposed fully automated approaches for (1) checking correctness of individual execution of processor instructions and (2) for verifying absence of read-after-write (RAW) hazards when the instructions are pipelined. In [8], the approach was extended by covering write-after-write (WAW) and write-after-read (WAR) hazards.…”

“…In particular, the paper presents the HADES tool, developed by VeriFIT research group at FIT BUT, that implements a slightly improved version of the approaches proposed in [7,8]. Namely, after briefly discussing related works, we specify how the input of HADES looks like, we describe its architecture and implementation, and provide experimental results on a larger set of microprocessors than in [7,8]. Moreover, we include a more detailed discussion of the needed verification time and its decomposition to the computing times needed by the different analysis phases implemented in HADES.…”