Miroslav N. Velev* Randal E. Bryant

Transcription

1 134 Int. J. Embedded Systems, Vol. 1, Nos. 1/2, 2005 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure for the logc of equalty wth unnterpreted functons and memores Mroslav N. Velev* Consultant, USA E-mal: mvelev@eee.org *Correspondng author Randal E. Bryant School of Computer Scence, Carnege Mellon Unversty, Pttsburgh, PA 15213, USA E-mal: Randy.Bryant@cs.cmu.edu Abstract: We present a tool flow for hgh-level desgn and formal verfcaton of embedded processors. The tool flow conssts of the term-level symbolc smulator TLSm, the decson procedure EVC (Equalty Valdty Checker) for the logc of Equalty wth Unnterpreted Functons and Memores (EUFM), and any SAT solver. TLSm accepts hgh-level models of a ppelned mplementaton processor and ts non-ppelned specfcaton, as well as a command fle ndcatng how to smulate them symbolcally, and produces an EUFM formula for the correctness of the mplementaton. EVC explots the property of Postve Equalty and other optmsatons n order to translate the EUFM formula to an equvalent Boolean formula that can be solved wth any SAT procedure. An earler verson of our tool flow was used to formally verfy a model of the M CORE processor at Motorola, and detected bugs. Keywords: desgn automaton; hardware desgn languages; logc; mcroprocessors; smulaton; symbolc manpulaton. Reference to ths paper should be made as follows: Velev, M.N. and Bryant, R.E. (2005) TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure for the logc of equalty wth unnterpreted functons and memores, Int. J. Embedded Systems, Vol. 1, Nos. 1/2, pp Bographcal notes: Mroslav N. Velev receved BS and MS n Electrcal Engneerng and BS n Economcs from Yale Unversty, New Haven, CT n 1994, and PhD n Electrcal and Computer Engneerng from Carnege Mellon Unversty, Pttsburgh, PA n In 2002 and 2003, he was an Instructor at the School of Electrcal and Computer Engneerng at the Georga Insttute of Technology n Atlanta, Georga. He has over 45 refereed publcatons. He s Member of the edtoral boards of the Journal of Unversal Computer Scence (JUCS), and the Journal on Satsfablty, Boolean Modelng and Computaton (JSAT). He has served on the techncal program commttees of over 70 conferences, ncludng AAAI, ASP-DAC, CADE, CASES, CHARME, DATE, ICCD, ISCAS, ISQED, MEMOCODE, RTAS, and SAT. He was an nvted speaker at the Internatonal SoC Desgn Conference (ISOCC 05), Seoul, Korea, October He s the recpent of the Franz Tuteur Memoral Prze for the Most Outstandng Senor Project n Electrcal Engneerng, Yale Unversty, May 1994, and of the 2005 EDAA Outstandng Dssertaton Award for the Topc New Drectons n Logc and System Desgn. Randal E. Bryant s Dean of the Carnege Mellon Unversty School of Computer Scence. He has been on the faculty at Carnege Mellon snce 1984, startng as an Assstant Professor and progressng to hs current rank of Unversty Professor. Hs research focuses on methods for formally verfyng dgtal hardware, and more recently some forms of software. He has receved wdespread recognton for hs work. He s a Fellow of the IEEE and the ACM, as well as a Member of the Natonal Academy of Engneerng. Hs awards nclude the 1997 ACM Kanellaks Theory and Practce Award, as well as the 1989 IEEE W.R.G. Baker Prze for the best paper appearng n any IEEE publcaton durng the precedng year. He receved hs BS n Appled Mathematcs from the Unversty of Mchgan n 1973, and hs PhD from MIT n Copyrght 2005 Inderscence Enterprses Ltd.

2 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure Introducton In the near future, there wll be trllons of mcroprocessors hundreds per person. Many of the desgns wll be custom talored and hghly optmsed for specfc applcatons. Most wll functon autonomously, wthout the drect supervson of humans and many wll be used n safety-crtcal applcatons (Tennenhouse, 2000). Thus, t s crucal that processors be desgned wthout errors. The tme to market for new desgns wll decrease, whle ther complexty wll ncrease. Extensve bnary smulaton s already mpossble. What s unque about the mcroprocessor ndustry s that bugs may requre the recall and replacement of all unts sold Intel had to replace 5 mllon Pentum chps (Grove, 1999) when the floatng-pont dvson error was dscovered n Ths s unlke most other ndustres, where t s possble to replace or even fx only the defectve component, as opposed to the entre product, hence, the hgh cost of mcroprocessor bugs $475 mllon n the case of the Intel Pentum n 1994 (Grove, 1999), and $2.1 bllon n the case of a buggy Toshba floppy mcrocontroller n 1999 (Pasztor and Landers, 1999). Every tme the desgn of computer systems was shfted to a hgher level of abstracton, productvty ncreased, as also observed by Jones (2002). Albn (2001) smlarly advocates the adopton of hgher levels of abstracton. Keutzer et al. (2000) even argue that desgn at hgher levels of abstracton results n mplementatons of hgher qualty. The logc of Equalty wth Unnterpreted Functons and Memores (EUFM) (Burch and Dll, 1994) see Secton 2 allows us to abstract functonal unts and memores, whle completely modellng the control of a processor. In our earler work on applyng EUFM to formal verfcaton of ppelned and superscalar processors, we mposed some smple restrctons (Velev and Bryant, 1999a; 1999b) on the modelng style for defnng processors, resultng n correctness formulas where most of the terms (abstracted word-level values) appear only n postve equatons (equalty comparsons). Such term varables can be treated as dstnct constants (Velev and Bryant, 1999a; 1999b), thus sgnfcantly smplfyng the EUFM correctness formulas, prunng the soluton space and resultng n orders of magntude speedup of the formal verfcaton; we call ths property Postve Equalty. These restrctons, together wth technques to model multcycle functonal unts, exceptons and branch predcton (Velev and Bryant, 2000), allowed our tool flow (see Secton 3) to be used to formally verfy a model of the M CORE processor at Motorola (Lahr et al., 2001), and detected three bugs, as well as corner cases that were not fully mplemented. The tool flow was also used n two edtons of an advanced computer archtecture course (Velev, 2005a, 2003b), where undergraduate and graduate students wthout pror knowledge of formal methods desgned and formally verfed sngle-ssue ppelned DLX processors (Hennessy and Patterson, 2002), as well as extensons wth exceptons and branch predcton, and dual-ssue superscalar mplementatons. Our tool flow conssts of: the term-level symbolc smulator, TLSm, used to symbolcally smulate the hgh-level mplementaton and specfcaton processors, defned n our hgh-level hardware descrpton language AbsHDL, and produce an EUFM formula for correctness of the mplementaton wth respect to the specfcaton; the decson procedure EVC that explots Postve Equalty and other optmsatons to translate the EUFM correctness formula nto a satsfablty-equvalent Boolean formula; and any effcent SAT solver, used to prove that the Boolean correctness formula produced by EVC s a tautology,.e., the orgnal EUFM formula s vald. Recent dramatc mprovements n SAT solvers (Moskewcz et al., 2001; Goldberg and Novkov, 2002; Ryan, 2003) see Le Berre and Smon (2005), and Velev and Bryant (2003) for comparatve studes, and Bere and Kunz (2002), Kautz and Selman (2003), and Zhang and Malk (2002) for surveys sgnfcantly sped up the solvng of Boolean formulas generated by our tool flow. However, as found n Velev and Bryant (2003), the new effcent SAT solvers would not have scaled for solvng the Boolean formulas f not for the property of Postve Equalty that results n at least fve orders of magntude speedup when formally verfyng dual-ssue superscalar processors wth realstc features. Effcent translatons from propostonal logc to CNF (Velev, 2004a, 2004c, 2004d), explotng the specal structure of EUFM formulas produced wth the modelng restrctons, resulted n addtonal speedup of two orders of magntude (see Secton 6.3). The contrbutons made wth ths paper are the hgh-level hardware descrpton language AbsHDL, the term-level symbolc smulator TLSm, and the decson procedure EVC. The rest of the paper s organsed as follows. Secton 2 presents the background of ths work. Secton 3 outlnes our tool flow. Secton 4 defnes the hgh-level hardware descrpton language AbsHDL. Secton 5 descrbes the term-level symbolc smulator TLSm. Secton 6 presents the mplementaton of the decson procedure EVC. Secton 7 summarses expermental results. Secton 8 dscusses related work, and Secton 9 concludes the paper. 2 Background The formal verfcaton s done by correspondence checkng comparson of a ppelned mplementaton aganst a non-ppelned specfcaton, usng flushng (Burch and Dll, 1994; Burch, 1996) to automatcally compute an abstracton functon that maps an mplementaton state to an equvalent specfcaton state. The safety property (see Fgure 1) s expressed as a formula n the logc of EUFM, and checks whether one step of the mplementaton

3 136 M.N. Velev and R.E. Bryant corresponds to between 0 and k steps of the specfcaton, where k s the ssue wdth of the mplementaton. F Impl s the transton functon of the mplementaton, and F s the transton functon of the specfcaton. We wll refer to the sequence of frst applyng the abstracton functon and then exercsng the specfcaton as the specfcaton sde of the commutatve dagram n Fgure 1, and to the sequence of frst exercsng the mplementaton for one step and then applyng the abstracton functon as the mplementaton sde of the commutatve dagram. * the specfcaton sde of the dagram. Let PC, RegFle *, and * DMem be the state of the PC, regster fle, and data memory, respectvely, n specfcaton state * Q, reached after the mplementaton sde of the dagram. Then, each dsjunct equalty ( = 0,..., k) s defned as equalty pc rf dm, where pc ( PC = PC ), * Fgure 1 The safety correctness property for an mplementaton processor wth ssue wdth k: one step of the mplementaton should correspond to between 0 and k steps of the specfcaton, when the mplementaton starts from arbtrary ntal state Q Impl that s possbly restrcted by nvarant constrants rf ( RegFle = RegFle ), * dm ( DMem = DMem ). * That s, equalty s the conjuncton of the parwse equalty comparsons for all archtectural state elements, thus ensurng that the archtectural state elements are updated n synchrony by the same number of nstructons. In processors wth more archtectural state elements, an equalty comparson s conjuncted smlarly for each addtonal state element. Hence, for ths mplementaton processor, the safety property equalty 0 equalty 1 equalty k = true, (1) s equvalently represented as pc 0 rf 0 dm 0 pc k rf k dm k = true. (1 ) For an mplementaton wth n archtectural state elements, the safety property s m 1,0 m 2,0 m n,0 The safety property s the nductve step of a proof by nducton, snce the ntal mplementaton state, Q Impl, s completely arbtrary. If the mplementaton s correct for all transtons that can be made for one step from an arbtrary ntal state, then the mplementaton wll be correct for one step from the next mplementaton state, Q Impl, snce that state wll be a specal case of an arbtrary state, as used for the ntal state, and so on for any number of steps. For some processors, e.g., where the control logc s optmsed by usng unreachable states as don t-care condtons, we mght have to mpose a set of nvarant constrants for the ntal mplementaton state to exclude unreachable states. Then, we need to prove that those constrants wll be satsfed n the mplementaton state after one step, Q Impl, so that the correctness wll hold by nducton for that state, and so on for all subsequent states. The reader s referred to Aagaard et al. (2002; 2003) for a dscusson of correctness crtera. To llustrate the safety property n Fgure 1, let the mplementaton and specfcaton have three archtectural state elements program counter (PC), regster fle, and data memory. Let, PC, RegFle and DMem be the state of the PC, regster fle, and data memory, respectvely, n specfcaton state Q ( = 0,..., k) along m 1,k m 2,k m n,k = true, (1 ) where m,j (1 n, 0 j k) s the condton that the state of archtectural state element after the mplementaton sde of the dagram equals the state of that archtectural state element after j steps of the specfcaton along the specfcaton sde of the dagram. To prove lveness that the processor wll complete at least one new nstructon after a fnte number of steps, n we can smulate the mplementaton symbolcally for n steps and prove that equalty 1 equalty 2 equalty n k = true, (2) omttng equalty 0. al abstractons and an ndrect method for provng lveness, resultng n orders of magntude speedup, are presented n Velev (2004b). Technques for provng lveness of ppelned processors wth multcycle functonal unts are presented n Velev (2005b). The syntax of EUFM (Burch and Dll, 1994) ncludes terms and formulas see Fgure 2. Terms are used to abstract word-level values of data, regster dentfers, memory addresses, as well as the entre states of memores. A term can be an Unnterpreted Functon (UF) appled to a lst of argument terms, a term varable, or an ITE

4 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure 137 (for f-then-else ) operator selectng between two argument terms based on a controllng formula, such that ITE(formula, term 1, term 2 ) wll evaluate to term 1 when formula = true and to term 2 when formula = false. The syntax for terms can be extended to model memores by means of functons read and wrte (Burch and Dll, 1994; Velev, 2001). Formulas are used to model the control path of a mcroprocessor, as well as to express the correctness condton. A formula can be an Unnterpreted Predcate (UP) appled to a lst of argument terms, a propostonal varable, an ITE operator selectng between two argument formulas based on a controllng formula, or an equaton (equalty comparson) of two terms. Formulas can be negated and combned wth Boolean connectves. We wll refer to both terms and formulas as expressons. Fgure 2 Syntax of the logc of EUFM UFs and UPs are used to abstract the mplementaton detals of functonal unts by replacng them wth black boxes that satsfy no partcular propertes other than that of functonal consstency, namely, that equal combnatons of values to the nputs of the UF (or UP) produce equal output values. Then, t no longer matters whether the orgnal functonal unt s an adder, or a multpler, etc., as long as the same UF (or UP) s used to abstract t n both the mplementaton and the specfcaton. Thus, we wll prove a more general problem that the processor s correct for any functonally consstent mplementaton of ts functonal unts but ths problem s easer to prove. Functon read takes two argument terms servng as memory state and address, respectvely, and returns a term for the data at that address n the gven memory. Functon wrte takes three argument terms servng as memory state, address, and data, and returns a term for the new memory state. Functons read and wrte satsfy the forwardng property of the memory semantcs: read(wrte(mem, waddr, wdata), raddr) s equvalent to ITE((raddr = waddr), wdata, read(mem, raddr)),.e., f ths rule s appled recursvely, a read operaton returns the data most recently wrtten to an equal address, or otherwse the ntal state of the memory for that address. A hybrd memory model where the forwardng property of the memory semantcs s satsfed only for those pars of one read and one wrte address that also determne stallng condtons can be appled automatcally, based on rewrtng rules and conservatve approxmatons (Velev, 2001). Versons of read and wrte that extend the syntax for formulas can be defned smlarly, such that the former returns a formula, whle the latter takes a formula as ts thrd argument. Note that the forwardng property ntroduces address equatons n dual polartes n postve polarty when selectng the then-expresson of the ITE, but n negated polarty when selectng the else-expresson. The property of functonal consstency of UFs and UPs can be enforced by Ackermann constrants (Ackermann, 1954), or by nested ITEs (Velev and Bryant, 1998c). The Ackermann scheme replaces each UF (UP) applcaton n the EUFM formula F wth a new term (Boolean) varable and then adds external constrants for functonal consstency. For example, the UF applcaton g(a 1, b 1 ) wll be replaced by a new term varable c 1, and another applcaton of the same UF, g(a 2, b 2 ), wll be replaced by a new term varable c 2. Then, the resultng EUFM formula F wll be extended as [(a 1 = a 2 ) (b 1 = b 2 ) (c 1 = c 2 )] F. Note that the new formula s equvalent to (a 1 = a 2 ) (b 1 = b 2 ) (c 1 = c 2 ) F, so that the new term varables, c 1 and c 2, appear n a negated equaton. In the nested-ite scheme, the frst applcaton of a UF wll stll be replaced by a new term varable c 1. However, the second wll be replaced by ITE((a 2 = a 1 ) (b 2 = b 1 ), c 1, c 2 ), where c 2 s a new term varable. A thrd applcaton, g(a 3, b 3 ), wll be replaced by ITE((a 3 = a 1 ) (b 3 = b 1 ), c 1, ITE((a 3 = a 2 ) (b 3 = b 2 ), c 2, c 3 )), where c 3 s a new term varable, and so on. UPs are elmnated smlarly, but usng new Boolean varables. In the general case of each scheme, the formulas that express equalty of arguments of UF (UP) applcatons wth k arguments wll be conjunctons of k equatons, one for each par of correspondng arguments. To avod creatng crcular dependences when usng the nested-ite scheme, UFs and UPs have to be elmnated based on ther topologcal order,.e., all applcatons of a gven UF (UP) have to be elmnated from the arguments of another applcaton of the same UF (UP), before that applcaton s elmnated. Otherwse, the equatons between correspondng arguments wll lead to cyclc dependency. We can check whether an EUFM formula s vald,.e., always true, ether by usng a specalzed decson procedure such as the Stanford Valdty Checker (SVC) (Burch and Dll, 1994; Jones et al., 1995; Barrett et al., 1996; Levtt and Olukotun, 1997), and the Integrated Canonzer and Solver (Fllâtre et al., 2001), or by translatng an EUFM formula to a satsfablty-equvalent Boolean formula that has to be a tautology n order for the orgnal EUFM formula to be vald. Wth our decson procedure, the Equalty Valdty Checker (EVC) (Velev and Bryant, 2001), we pursue the second approach. The effcency of our tool flow consstng of TLSm, EVC, and a SAT solver s due to the property of Postve Equalty (Bryant et al., 2001) that EVC uses when translatng EUFM formulas to equvalent Boolean formulas. To explot Postve Equalty, a mcroprocessor desgner has to follow some smple restrctons (Velev and Bryant, 1999a; 1999b) when defnng the hgh-level mcroprocessors. Frst, equalty comparators between data operands e.g., used to check whether to take a branch-on-equal nstructon, such that the resultng sgnal s used n postve polarty when updatng the PC wth the

5 138 M.N. Velev and R.E. Bryant branch target address, but n negated polarty when squashng subsequent nstructons should be abstracted wth a new unnterpreted predcate n both the mplementaton and the specfcaton. Second, the Data Memory should be abstracted wth a conservatve Fnte State Machne (FSM) model of a memory, where the nterpreted functons read and wrte that satsfy the forwardng property of the memory semantcs are replaced by new unnterpreted functons, f r and f w, respectvely, that take the same arguments, but do not satsfy the forwardng property; then we would only check whether the mplementaton and the specfcaton perform the same sequence of memory operatons wth the same argument terms, but that s suffcent for processors that do not reorder the memory operatons, as s the case n the models that are formally verfed n ths paper. As a result of the above restrctons, we get EUFM correctness formulas where most of the terms appear only as arguments of postve (not negated) equatons, called p-equatons, or as arguments to UFs and UPs; we call such terms p-terms. Only a few of the terms appear as arguments of equatons that are used n both postve and negated polarty, and so are called g-equatons (for general equatons); we call such terms g-terms. Furthermore, when usng the nested-ite scheme to elmnate UF applcatons that appear as p-terms, we can treat the ntroduced new term varables as p-terms (Bryant et al., 2001). The resultng structure of the EUFM correctness formulas allows us to consder syntactcally dstnct p-term varables as not equal when evaluatng the valdty of an EUFM formula, thus sgnfcantly smplfyng the formula, prunng the soluton space, and achevng orders of magntude speedup. The speedup s at least fve orders of magntude when formally verfyng dual-ssue superscalar DLX processors wth realstc features see Secton 7. However, each g-equaton can be ether true or false, and s encoded wth Boolean varables (Goel et al., 1998; Pnuel et al., 2002; Velev, 2003a) by accountng for the property of transtvty of equalty (Bryant and Velev, 2002) when translatng an EUFM formula to an equvalent Boolean formula. mplementaton processor, and can be analysed to correct that bug. Fgure 3 Our tool flow 4 The hardware descrpton language AbsHDL The syntax of AbsHDL wll be llustrated wth the three-stage ppelned processor, ppe3, shown n Fgure 4. That processor has a combned nstructon fetch and decode stage (IFD), an execute stage (EX), and a wrte-back stage (WB). It can execute only ALU nstructons wth a sngle data operand. Read-after-wrte hazards (Hennessy and Patterson, 2002) are avoded wth one level of forwardng. The AbsHDL defnton of ppe3 s shown n Fgure 5. We wll use the extenson.abs for fles n AbsHDL. Fgure 4 Block dagram of the three-stage ppelned processor ppe3 3 The tool flow Fgure 3 summarses our tool flow. The term-level symbolc smulator TLSm (see Secton 5) accepts an mplementaton processor and ts specfcaton, both defned n AbsHDL (see Secton 4), as well as a command fle ndcatng how to smulate the two processors symbolcally accordng to the nductve correctness crteron n Fgure 1, and outputs an EUFM correctness formula n the format of the SVC ( Our decson procedure EVC (see Secton 6) takes an EUFM correctness formula and translates t to an equvalent Boolean formula that has to be a tautology n order for the orgnal EUFM formula to be vald,.e., for the mplementaton processor to be correct. A falsfyng assgnment for the Boolean correctness formula ndcates a condton that trggers a bug n the An AbsHDL processor descrpton begns wth declaraton of sgnals (see Fgure 5). Bt-level sgnals are declared wth the keyword bt, and word-level sgnals wth the keyword term. Sgnals that are prmary nputs, e.g., phase clocks, are addtonally declared wth the keyword nput. The language has constructs for basc logc gates and, or, not, mux such that and and or gates can have multple nputs. Equalty comparators are gates of

6 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure 139 type =, e.g., RegsEqual = (= IFD_EX_SrcReg EX_WB_DestReg) n the EX stage, where the = before the left parenthess desgnates an assgnment, and the one after that the type of the gate. Gates that are not of the above types are unnterpreted functons f the output s a word-level sgnal e.g., sequentalpc = (PCAdder PC) and Result = (ALU IFD_EX_Op EX_Data1) n Fgure 5 but unnterpreted predcates f the output s a bt-level sgnal. Unnterpreted functons and unnterpreted predcates are used to abstract the mplementatons of combnatonal functonal unts. In the two examples above, PCAdder and ALU are unnterpreted functons that abstract, respectvely, the adder for ncrementng the PC and the ALU n ppe3. We can use an unnterpreted predcate to abstract a functonal unt that decdes whether to take a condtonal branch, or to abstract a functonal unt that ndcates whether an ALU excepton s rased. We can mplement a Fnte State Machne to model the behavour of a multcycle functonal unt (Velev and Bryant, 2000). Fgure 5 AbsHDL descrpton of the three-stage ppelned processor ppe3 AbsHDL has constructs for latches and memores, defned wth the keywords latch and memory, respectvely. Both can have nput and/or output ports, defned wth the keywords nport and outport, respectvely. Input ports of latches have an enable sgnal, whch has to be hgh for a wrte operaton to take place at that port, and a lst (enclosed n parentheses) of nput data sgnals that provde the values to be wrtten to the latch. Smlarly, output ports of latches have an enable sgnal, whch has to be hgh for a read operaton to take place at that port and a lst of output data sgnals that wll get the values stored n the latch. An output data sgnal can get values only from nput data sgnals that appear n the same poston n the lst of data sgnals for an nput port n the same latch. Memores are defned smlarly, except that ports addtonally have an address nput that s lsted rght after the enable nput see memory RegFle n Fgure 5. The correct nstructon semantcs are defned by the Instructon Set Archtecture (ISA), and are modeled wth a non-ppelned specfcaton processor bult from the same unnterpreted functons, unnterpreted predcates and archtectural state elements (the PC and the Regster Fle n ppe3) as the ppelned mplementaton. Snce the specfcaton s non-ppelned, t lacks ppelne latches (IFD_EX and EX_WB n ppe3) and mechansms to avod hazards (the forwardng logc n ppe3), and executes one nstructon at a tme. When defnng ppelned processors and ther specfcatons, we assume that they do not execute self-modfyng code, whch allows us to model the Instructon Memory as a read-only memory, separate from a Data Memory n the case of processors wth load and store nstructons. In Fgure 5, the Instructon Memory has one read port that takes the PC as address and produces the four felds of an nstructon n the gven ISA: RegWrte, a bt ndcatng whether the nstructon wll update the Regster Fle; DestReg, destnaton regster dentfer; Op, opcode to be used by the ALU; and SrcReg, source regster dentfer. Alternatvely, a read-only nstructon memory can be modelled wth a collecton of unnterpreted functons and unnterpreted predcates, each takng as nput the nstructon address and mappng t to a feld from the nstructon encodng. In the case when some of the above felds do not have a counterpart n the nstructon encodng, but are produced by decodng logc, both models can be vewed as encapsulatng the orgnal read-only nstructon memory and the decodng logc. To model decodng logc that s separate from the nstructon memory, we can use unnterpreted functons and unnterpreted predcates, each mappng a feld from the orgnal nstructon encodng to a control sgnal. AbsHDL does not model delays of logc gates, memores and latches. It s assumed that the clock cycle wll be long enough to satsfy all tmng requrements. Sgnal Flush n Fgures 4 and 5, when asserted to 1, s used to dsable fetchng of nstructons and to feed the ppelne wth bubbles, allowng partally executed nstructons to complete. Then, smulatng the ppelne for a suffcent number of clock cycles as determned by the ppelne depth and possble stallng condtons wll map all partally executed nstructons to the archtectural state elements (the PC and the Regster Fle n ppe3). The contents of the archtectural state elements, wth no pendng updates n the ppelne, can be drectly compared wth the contents of the archtectural state elements of the specfcaton. In the case of ppe3, whch has two ppelne latches and no stallng logc, settng sgnal Flush to 1 and smulatng the processor for two cycles wll complete any nstructons that are orgnally n the ppelne. Ths

7 140 M.N. Velev and R.E. Bryant mechansm for automatcally mappng the state of an mplementaton processor to ts archtectural state elements was proposed by Burch and Dll (1994), and Burch (1996). Note that most processors have a smlar sgnal ndcatng whether the Instructon Cache provded a vald nstructon n the current clock cycle, so that we can acheve the above effect by forcng that sgnal to the value ndcatng an nvald nstructon. Addng sgnal Flush to allow completon of partally executed nstructons n a ppelned or superscalar processor wthout fetchng new nstructons can be vewed as desgn for formal verfcaton. Sgnal Flush, when set to 1, should nvaldate all control bts that ndcate updates of archtectural state elements. The phase clocks n an AbsHDL processor descrpton are used to ensure the proper flow of sgnals n the ppelne stages, as well as to determne the order of memory port operatons. In Fgure 5, we assume that the phase clocks become hgh n the order of ther numbers. Thus, n Fgure 5, the ppelne latches and the PC are read on ph1, then the Regster Fle s wrtten on ph2 and read on ph3 (so that the Regster Fle behaves as a wrte-before-read memory and provdes nternal forwardng of the result wrtten n the current clock cycle), and fnally the ppelne latches and the PC are wrtten on ph4, whch concludes a clock cycle. We defned our own HDL, nstead of usng an exstng commercal HDL, n order to have complete freedom n expermentng wth modellng at a hgh level of abstracton, wthout havng to worry about compatblty wth a commercal HDL. A descrpton n AbsHDL can be translated easly nto any exstng bt-level HDL. Ths s left for our future work. 5 The term-level symbolc smulator TLSm To account for an arbtrary ntal mplementaton state and for all possble transtons from t, the tool flow employs term-level symbolc smulaton. (The reader s referred to Blank et al. (2001) for a dscusson of symbolc smulaton methods.) The term-level symbolc smulator TLSm accepts an mplementaton processor and ts specfcaton, both descrbed n AbsHDL, as well as a command fle ndcatng how to smulate the two processors symbolcally and when to compare ther archtectural state elements, and produces an EUFM formula for correctness of the mplementaton wth respect to the gven specfcaton. The command fle for term-level symbolc smulaton of ppe3 and ts specfcaton sa.abs wth TLSm, accordng to the nductve correctness crteron n Fgure 1, s shown n Fgure 6. As dscussed n Secton 4, t takes two cycles to flush ppe3 after settng sgnal Flush to 1. Fgure 6 Command fle for symbolc smulaton of ppe3 and ts specfcaton wth TLSm

8 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure 141 The term-level symbolc smulator TLSm automatcally ntroduces new symbolc varables for the ntal state of term-level or bt-level sgnals produced by memores and latches. TLSm propagates those varables through the processor logc, buldng symbolc expressons for the values of logc gates, unnterpreted functons, unnterpreted predcates, memores and latches. The symbolc expressons are defned n the scrpt language of the SVC ( so that the EUFM correctness formulas produced by TLSm can be checked for valdty wth any EUFM decson procedure that accepts the SVC nput format. Some processors may requre that ther ntal mplementaton state, Q Impl, n the commutatve dagram n Fgure 1 be restrcted by nvarant constrants, to exclude unreachable states that lead to false negatves. Then, the verfcaton engneer should check whether the nvarant constrants are satsfed n the next mplementaton state, Q Impl. In our tool flow, the condton for each nvarant constrant has to be defned as the output of an extra crcut added to the AbsHDL descrpton of the mplementaton processor. (That extra crcut wll be removed when an automatc tool translates the mplementaton nto a synthessable bt-level descrpton.) The TLSm command constrant, followed by the name of a sgnal, allows us to use the value of that sgnal at the partcular tme step when the command appears n the smulaton sequence as a constrant for checkng the valdty of the EUFM correctness formula. To check the nvarance of a constrant n the next mplementaton state, the verfcaton engneer needs to use the command check_vald, followed by the name of the constrant sgnal. 6 The decson procedure EVC 6.1 Steps for translaton from EUFM to propostonal logc We proceed through a seres of transformatons, startng from an EUFM correctness formula and endng wth a Boolean correctness formula that has to be a tautology n order for the orgnal EUFM formula to be vald. At each step we apply varous optmsatons and smplfcatons. The major steps are as follows: 1 Replace equatons of the form m 1 = m 2, where m 1 and m 2 are terms for two states of a memory, wth the equaton read(m 1, a) = read(m 2, a), where a s a new term varable that s unque for that memory. As defned earler, such equatons can appear only as p-equatons n an EUFM correctness formula checkng f the two sdes of the commutatve dagram have updated the ntal state of a memory n exactly the same way. Snce the new term varable a represents an arbtrary address, f the two sdes of the commutatve dagram have modfed that address dentcally, then they have modfed all addresses dentcally. The same new term varable has to be used when replacng all equatons between states of a gven memory. 2 Elmnate all reads from updated memory states by accountng for the forwardng property of the memory semantcs (see Secton 2). In EVC, ths step s performed dynamcally, whle parsng the expressons of an EUFM correctness formula. The result s that a read s replaced by a nested-ite expresson, havng as a leaf a read from the ntal state of that memory. 3 For every memory, replace each read from the ntal state of the memory (the ntal state s abstracted by a term varable that s unque for each memory) wth an applcaton of a new UF that s unque for ths memory and maps an address term (argument of a replaced read) to a term for the ntal state of that address n the gven memory. 4 Classfy the equatons as p-equatons and g-equatons. Classfy the terms as p-terms and g-terms. 5 Elmnate all UFs by usng the nested-ite scheme (see Secton 2); classfy as p-terms all new term varables ntroduced when elmnatng a UF that was classfed as a p-term. Elmnate all UPs by usng ether the nested-ite or the Ackermann scheme. 6 Replace each equaton that has the same term varable as both arguments wth the constant true. Replace each p-equaton between dfferent term varables wth the constant false, by the property of Postve Equalty. Encode each g-equaton wth Boolean varables, by usng one of the methods (Goel et al., 1998; Pnuel et al., 2002; Velev, 2003a). 7 Check f the resultng Boolean correctness formula s a tautology (or the CNF of the negated Boolean formula s unsatsfable), whch mples that the orgnal EUFM formula s vald. Otherwse, a falsfyng assgnment for the Boolean correctness formula (a satsfyng assgnment for the CNF of the negated Boolean formula) s a condton that trggers a bug n the mplementaton processor. 6.2 Hashng of expressons EVC uses a hashng scheme to ensure that there wll be no duplcate gates and thus to ncrease the effcency of SAT-checkng the Boolean correctness formula. Durng all stages of translaton from EUFM to propostonal logc, the correctness formula s represented as a shared Drected Acyclc Graph, where each node s assgned an ndex and s dentfed by a unque key. The key s formed as the type of the node (AND, OR, NOT, ITE, equaton, read, wrte, unnterpreted-functon, unnterpreted-predcate), followed by the lst of ndces of the nput nodes. For nodes of type ITE, read, wrte, unnterpreted-functon, and unnterpreted-predcate, the order of lstng the nput ndces s the same as the order of ther nodes n the nput lst for the node that s beng hashed. For nodes of type equaton, the nput ndces are sorted n ascendng order; f the two nput ndces are the same, then the equaton node s replaced wth the constant true. For nodes of type AND and

9 142 M.N. Velev and R.E. Bryant OR, the nput ndces are also sorted n ascendng order, and duplcate nput ndces are removed. Furthermore, an AND (OR) node havng nputs that are complements of each other (one s the negaton of the other) s replaced wth false (true). An AND node that has another AND node as nput s replaced wth a sngle AND node that has all the nputs of the two nodes, except for the elmnated node; smlarly for an OR node that has another OR node as nput. That s, the fnal Boolean formula has nether AND gates that drectly drve other AND gates nor OR gates that drectly drve other OR gates. Table 1 presents optmzatons used when hashng expressons. Table 1 Optmzatons used when hashng expressons Expresson that s beng hashed NOT(NOT(c)) Retuned ponter to expresson c ITE(NOT(c), a, b) ITE(c, b, a) ITE(c, a, a) a ITE(true, a, b) a ITE(false, a, b) b ITE(c, ITE(c, a, b), d) ITE(c, a, d) ITE(c, a, ITE(c, b, d)) ITE(c, a, d) ITE(a, true, c) OR(a, c) ITE(a, false, c) AND(NOT(a), c) ITE(a, b, true) OR(NOT(a), b) ITE(a, b, false) AND(a, b) ITE(a, b, a) AND(a, b) ITE(a, a, c) OR(a, c) In Table 1, a chan of two NOTs s replaced wth the nput to the chan. An expresson ITE(NOT(c), a, b), where the controllng formula s the negaton of another formula c, s replaced wth the equvalent expresson ITE(c, b, a), controlled by the negaton of the orgnal controllng formula,.e., by c and havng the orgnal then-nput and else-nput swapped. An expresson ITE(c, a, a), where the then-nput and the else-nput are the same expresson a, s replaced wth expresson a, snce t wll be selected always. If the controllng formula of an ITE s the constant true (false), then the ITE s replaced wth ts then-nput (else-nput). A chan of two ITEs that have the same controllng formula s replaced wth one ITE after accountng for the truth value that has to be assgned to the controllng formula of the upper ITE to select the lower ITE, and then smplfyng the lower ITE. That s, n ITE(c, ITE(c, a, b), d), the lower ITE wll be selected when the upper ITE s controllng formula c s true, so that the lower ITE wll be equvalent to ITE(true, a, b) f selected and thus can be smplfed to a; hence, the orgnal chan of two ITEs can be replaced wth ITE(c, a, d). Smlarly, ITE(c, a, ITE(c, b, d)) can be replaced wth ITE(c, a, d), snce formula c wll be false when the lower ITE s selected. The rest of the optmsatons are based on the defnton of an ITE(c, a, b) as c a c b and smplfcatons. In EVC, the fnal Boolean correctness formula conssts of AND, OR, NOT, and ITE gates. EVC can evaluate that formula by usng Bnary Decson Dagrams (Bryant, 1986, 1992; Bryant and Menel, 2001) va a bult-n nterface to the CUDD package (Somenz, 1999, 2001), or by usng Boolean Expresson Dagrams (Hulgaard et al., 1999; Wllams, 2000) a non-canoncal representaton of Boolean functons that can be converted to Bnary Decson Dagrams. Alternatvely, the Boolean correctness formula can be saved to a fle and then checked for beng a tautology wth a SAT solver. The supported formats are CNF (Johnson and Trck, 1993), ISCAS (Brglez and Fujwara, 1985), ISCAS-CGRASP (Marques-Slva and e Slva, 1999), and Prover a SAT solver based on Stålmarck s method (Stålmarck, 1989; Sheeran and Stålmarck, 2000). However, our comparson of SAT procedures (Velev and Bryant, 2003) determned that the most effcent way to evaluate the Boolean correctness formulas produced by EVC s wth an effcent SAT solver. Chaff (Moskewcz et al., 2001) was the break-through SAT solver. Later t was surpassed by BerkMn (Goldberg and Novkov, 2002), sege (Ryan, 2003), and other tools see Le Berre and Smon (2005) for the results from the most recent SAT solver competton. 6.3 Effcent translaton to CNF After the g-equatons are encoded wth Boolean varables, we have a purely Boolean formula that has to be a tautology for the orgnal EUFM formula to be vald. We can check whether a Boolean formula s a tautology by negatng t and provng that the resultng formula s unsatsfable (.e., there s no assgnment to the Boolean varables that makes the formula true) by usng any Boolean Satsfablty (SAT) solver. The most common nput format of SAT solvers s Conjunctve Normal Form (CNF) (Johnson and Trck, 1993), where a Boolean formula s represented as a conjuncton of clauses, and every clause s a dsjuncton of lterals CNF varables or ther negatons. In conventonal translaton of Boolean formulas to CNF (Tsetn, 1968), a new CNF varable s ntroduced for the output of every logc connectve, and a set of CNF clauses s used to correlate that varable wth the varables for the nputs of the connectve, gven the functon of the connectve see Table 2. Then, the CNF for a Boolean formula s the conjuncton of the clauses for all gates, conjuncted wth the 1-lteral clause expressng the condton that the CNF varable for the output of the formula should be true. Tsetn (1968) was among the frst to use such CNF translaton, whch was later optmsed by Plasted and Greenbaum (1985), and used for testng of dgtal crcuts by Larrabee (1992).

10 TLSm and EVC: a term-level symbolc smulator and an effcent decson procedure 143 Table 2 Conventonal translaton of basc logc gates to CNF Logc gate Equvalent constrants CNF clauses o AND( 1, 2,..., n ) 1 o ( 1 o) o OR( 1, 2,..., n ) o ITE(, t, e) o NOT() 2 o ( 2 o) n o ( n o) n o ( n o) 1 o ( 1 o) 2 o ( 2 o) n o ( n o) n o ( n o) t o ( t o) t o ( t o) e o ( e o ) e o ( e o) o ( o) o ( o) CNF-based SAT solvers face two man hurdles to further mprovements. Frst, the operaton-ntensve Boolean Constrant Propagaton reflectng a CNF varable s assgnment on all the clauses contanng that varable or ts negaton takes up to 90% of the SAT-solvng tme (Moskewcz et al., 2001) and generates many non-sequental memory accesses that are prone to L2-cache msses. Furthermore, Boolean Constrant Propagaton requres data-dependent branches that are hard to predct and so frequently ncur the branch mspredcton penalty at least 19 cycles, and up to 125 nstructons n the Intel Pentum 4 (Hennessy and Patterson, 2002). Second, many L2-cache msses occur for bg formulas (Zhang and Malk, 2003), resultng n expensve accesses to man memory; the L2-cache mss penalty s up to hundreds of cycles currently and s ncreasng (Hennessy and Patterson, 2002). To reduce the above two hurdles when translatng to CNF, we can preserve the ITE-tree structure of equaton arguments, nstead of replacng each equaton wth a dsjuncton of conjunctons of formulas, as done n Bryant et al. (2001), Velev and Bryant (1999b), Velev and Bryant (2001). For example, the equaton ITE(c 1, a 1, a 2 ) = ITE(c 2, b 1, b 2 ) wll be replaced wth ITE(c 1, ITE(c 2, a 1 = b 1, a 1 = b 2 ), ITE(c 2, a 2 = b 1, a 2 = b 2 )), as done n Velev (2004d). Ths results n Boolean correctness formulas wth ITE-trees, where each ITE nsde a tree has fanout count of 1,.e., drves only one gate that s another ITE nsde the same tree. An ITE-tree can be translated nto CNF wth a unfed set of clauses (Velev, 2004d), wthout ntermedate varables for outputs of ITEs nsde the tree see the paths from nputs a 2 and a 3 to the output o n Fgure 7. Furthermore, ITE-trees can be merged wth one level of ther AND/OR leaves, where each leaf has a fanout count 1 see the paths from G 1 and G 2 to o n Fgure 7. We can smlarly merge ITE-trees wth two levels of ther leaves. And we can also merge other gate groups (Velev, 2004c), e.g., AND-ITE, OR-ITE, AND-OR, ITE- OR, OR-AND, and ITE- AND, but ths results n only small addtonal mprovements f ITE-trees are merged (Velev, 2004d). The benefts from mergng ITE-trees wth ther leaves nclude fewer varables and clauses and thus reduced soluton space, smaller CNF fle szes, and fewer L2-cache msses; reduced Boolean Constrant Propagaton, due to the elmnated ntermedate varables for outputs of ITEs nsde a tree; automatc use of sgnal unobservablty all clauses for a path n an ITE-tree become satsfed when an ITE-controllng sgnal selects another path; and gudng the SAT-solver branchng and learnng each path n an ITE-tree s due to a dfferent symbolc-executon trace, so that we pont the SAT solver toward processng one symbolc-executon trace at a tme and make t easer for the SAT solver to prune nfeasble paths. If Ackermann constrants are used to elmnate the UFs and UPs, as n Barrett et al. (2002), Goel et al. (1999), Pnuel et al. (2002), Tveretna and Zantema (2003), and Zantema and Groote (2003), the resultng Boolean formulas wll have fewer or no ITE-tees and so wll beneft less from ths optmsaton. The speedup from mergng ITE-trees s up to two orders of magntude, when formally verfyng complex processors (Velev, 2004d). Fgure 7 Mergng an ITE-tree wth one level of ts AND/OR leaves that have a fanout count of 1. Each ITE-tree s represented as the conjuncton of all clauses for paths from leaves to the tree output 7 Summary of results Experments were conducted on a Dell OptPlex GX260 havng a 3.06-GHz Intel Pentum 4 processor wth a 512-KB on-chp L2-cache, 2 GB of physcal memory, and runnng Red Hat Lnux 9.0. Our tool flow, consstng of TLSm and EVC, was combned wth the SAT solvers

11 144 M.N. Velev and R.E. Bryant sege_v4 (Ryan, 2003), and BerkMn621 (Goldberg and Novkov, 2003). The e j encodng (Goel et al., 1999) was used for g-equatons, snce t was found to outperform the encodngs from Pnuel et al. (2002), and Velev (2003a). The Boolean correctness formulas were translated to CNF usng the method descrbed n Secton 6.3. The experments were to formally verfy safety of the benchmarks: 1dlx_c, a sngle-ssue fve-stage ppelned DLX (Hennessy and Patterson, 2002), modelled as descrbed n Velev and Bryant (1999b); 2dlx_ca, a dual-ssue superscalar DLX, wth one complete and one ALU ppelne (Velev and Bryant, 1999b); 2dlx_cc_mc_ex_bp, a dual-ssue superscalar DLX, wth two complete ppelnes, exceptons, branch predcton and multcycle functonal unts (Velev and Bryant, 2000); ooo_engne6, an out-of-order processor wth a completely mplemented sx-entry reorder buffer, completely mplemented and nstantated sx reservaton statons, regster renamng, and ALU nstructons ths processor was modelled and formally verfed as descrbed n Velev (2004a), and s based on the descrpton of the PowerPC 750 (IBM Corporaton, 1999), an embedded processor that s compatble wth the PowerPC ISA and has sx reorder buffer entres and sx reservaton statons n contrast to other out-of-order models (Hosabettu et al., 1999; Jhala and McMllan, 2002; Lahr and Bryant, 2003), ooo_engne6 has a completely mplemented reorder buffer, and completely mplemented and nstantated reservaton statons; and 9vlw_bp_mc_ex_9stages_q5, a nnestage, nne-wde VLIW processor that mtates the Intel Itanum (Intel Corporaton, 1999; Sharangpan and Arora, 2000) n features such as predcated executon, regster remappng, advanced loads, branch predcton, and multcycle functonal unts, exceptons, and a fve-entry nstructon queue (a smpler verson of ths processor wth fewer ppelne stages and no nstructon queue was formally verfed n Velev (2000), and Velev and Bryant (2003)). The abstracton functon was computed by controlled flushng (Burch, 1996), where the user provdes a stallng schedule to overrde the processor stall sgnals, thus elmnatng the ambguty of the nstructon flow durng flushng and producng a smpler EUFM correctness formula. The benchmark 1dlx_c was formally verfed n a total of 0.06 seconds; 2dlx_ca n 0.2 seconds; 2dlx_cc_mc_ex_bp n 0.9 seconds; ooo_engne6 n four hours; and 9vlw_bp_mc_ex_9stages_q5 n eght hours and nne mnutes. The SAT solver sege_v4 was used for the frst four benchmarks, snce t was faster than BerkMn621 on ther CNF formulas, whle BerkMn621 had advantage for the last benchmark and was used for t. Wthout Postve Equalty usng the e j encodng for all equatons, ncludng p-equatons between p-terms the formal verfcaton of 2dlx_cc_mc_ex_bp dd not complete n 90,000 seconds. Hence, Postve Equalty results n at least fve orders of magntude speedup for realstc dual-ssue superscalar processors. Furthermore, the speedup s ncreasng wth the complexty of the mplementaton. 8 Related work Before the use of Postve Equalty and other optmsatons to translate EUFM formulas to SAT, the most wdely used method for formal verfcaton of ppelned processors was theorem provng. However, the formal verfcaton of a fve-stage ppelned DLX or ARM comparable to 1dlx_c from Secton 7 requred extensve manual work by experts and often long CPU tmes (Börger and Mazzant, 1997; Cyrluk, 1996; Fox, 2002; Hosabettu et al., 1998; Huggns and Van Campenhout, 1998; Jacob and Krönng, 2000; Krönng and Paul, 2001; Müller and Paul, 2000; Tahar and Kumar, 1998; Wndley, 1995). Even three-stage ppelnes, executng only ALU nstructons, took sgnfcant manual nterventon to formally verfy wth theorem provng (Manolos, 2000; Sawada, 2000), or wth assume-guarantee reasonng (Henznger et al., 1998; Henznger et al., 2000). Symbolc Trajectory Evaluaton (Intel Corporaton, 2000; Jan et al., 1996; Nelson et al., 1997; Seger and Bryant, 1995) also requred extensve manual work to prove the correctness of just a regster-mmedate OR nstructon n a bt-level fve-stage ARM processor (Patankar et al., 1999). Other researchers had to lmt the data values to four bts, the regster fle to one regster, and the ISA to 16 nstructons, to symbolcally verfy a bt-level ppelned processor (Bhagwat and Devadas, 1994). Varous symbolc tools requred long CPU tme when formally verfyng a ppelned DLX (Hnrchsen et al., 1999; Rtter et al., 1999), or ran out of memory (Isles et al., 1998). Custom-talored, manually defned rewrtng rules were used to formally verfy a fve-stage DLX (Levtt and Olukotun, 1997), and smlar four-stage processors (Harman, 2001; Ls, 2000; Matthews and Launchbury, 1999), but would requre modfcatons to work on desgns descrbed n a dfferent codng style and sgnfcant extensons to scale for dual-ssue superscalar processors. Other researchers proved only few propertes of a ppelned DLX (Ivanov, 2002; Ramesh and Bhadur, 1999), or dd not present completeness argument (Mshra and Dutt, 2002) that the propertes proved wll ensure correctness under all possble scenaros. Hstorcally, the nductve correctness crteron n Fgure 1 dates back to Mlner (1971), and Hoare (1972), who used t to formally verfy programs by manually defnng an abstracton functon to map the state of an mplementaton program to the state of a specfcaton program. Srvas and Bckford (1990) were frst to formally verfy a ppelned processor by usng a theorem-provng approach and also manually defned abstracton functon. Burch and Dll (1994) proposed flushng as a way to automatcally compute an abstracton functon and were frst to formally verfy a ppelned DLX. However, they had to manually provde a case-splttng expresson for the condtons when the processor wll fetch and complete a new nstructon. Burch (1996) appled the same method to a dual-ssue superscalar DLX, but had to manually defne 28 case-splttng expressons and to decompose the safety correctness crteron. That decomposton was subtle enough