Loading...

PPT – Formal Verification of Iterative Algorithms in Microprocessors PowerPoint presentation | free to view - id: 173850-ZDc1Z

The Adobe Flash plugin is needed to view this content

Formal Verification of Iterative Algorithms in

Microprocessors

- Mark Aagaard Robert Jones
- Roope Kaivola Katherine Kohatsu
- Carl Seger
- Intel Corporation

Outline

- Implementing iterative algorithms in hardware
- Overview of verification strategy
- Detailed example floating-point square root

Straight-Line Algorithms

input

output

Straight-Line Algorithms

input

output

Straight-Line Algorithms

input

output

Straight-Line Algorithms

input

output

Straight-Line Algorithms

input

output

Straight-Line Algorithms

input

output

Verification goal output Spec(input)

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Circuits for Iterative Algorithms

input

output

Verification goal output Spec(input)

Examples of Iterative Algorithms

- Floating point units
- Square root
- Divide
- Front end of microprocessor (update internal

state for each chunk of data) - Mark boundaries between IA32 instructions
- Predict branches
- Back end of microprocessor
- Maintain state to retire instructions in order

Verifying Iterative Algorithms

Input/output specification

output Spec(input)

RTL Circuit

Verifying Iterative Algorithms

- Just as in program verification, iterative

circuits are verified with invariants - Two major properties
- Datapath invariant
- Control circuitry specification
- termination
- correct steering of data
- etc...

Verifying Iterative Algorithms

Input/output specification

output Spec(input)

RTL Circuit

Verifying Iterative Algorithms

Input/output specification

output Spec(input)

Data invariant

Control specification

RTL Circuit

Three Major Verification Tasks

Input/output specification

init

Data invariant

Control specification

ctrl

main

fini

RTL Circuit

Three Major Verification Tasks

Input/output specification

init

Data invariant

Control specification

ctrl

main

fini

RTL Circuit

Three Major Verification Tasks

Input/output specification

init

Data invariant

Control specification

ctrl

main

fini

RTL Circuit

Three Different Types of Verification

Input/output specification

theorem proving

init

Data invariant

Control specification

ctrl

main

datapath model checking

fini

control model checking

RTL Circuit

Forte

- Forte formal verification system
- Evolved from Voss
- Developed by Seger at Univ of British Columbia
- Datapath model checker
- Symbolic trajectory evaluation (STE)
- Based on symbolic simulation
- Control circuitry model checker
- Standard reachability analysis (e.g. SMV)
- Theorem Prover
- Seamless connection to model checking
- Environment
- General-purpose functional programming language
- Extensive graphical interfaces

Case Studies In the Paper

- Floating-point square root
- Verification of datapath invariants
- Floating-point divider and remainder
- Theorem proving for iterative algorithms
- Instruction boundary marker
- Verification and the design cycle

Case Studies In the Paper

- Floating-point square root
- Verification of datapath invariants
- Floating-point divider and remainder
- Theorem proving for iterative algorithms
- Instruction boundary marker
- Verification and the design cycle

Floating Point Square Root

N

internal state Z partial root R partial

remainder i iteration count

Zout

Square Root Invariant

N

invariant N Z?Z 2-i?R

Zout

Z partial root R partial remainder i

iteration count

Square Root Invariant

init Z0, RN, i0 N Z?Z 2-i?N

N

invariant N Z?Z 2-i?R

Zout

Z partial root R partial remainder i

iteration count

Square Root Invariant

init Z0, RN, i0 N 0?0 2-0?N N N

N

invariant N Z?Z 2-i?R

Zout

Z partial root R partial remainder i

iteration count

Square Root Invariant

init Z0, RN, i0 N 0?0 2-0?N N N

N

invariant N Z?Z 2-i?R

final iMax N Z?Z 2-Max?R N Z?Z ?

Zout

Z partial root R partial remainder i

iteration count

Verifying Floating Point Square Root

Input/output specification

Data invariant

Control specification

N Z?Z 2-i?R

RTL Circuit

Challenge Model Checking Capacity

Input/output specification

natural invariant uses multiplication, which

causes BDD blow up in model checking

Data invariant

Control specification

N Z?Z 2-i?R

RTL Circuit

Decomposing Invariant Verification 1

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

decompose invariant into base and inductive cases

RTL Circuit

Decomposing Invariant Verification 1

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

invariant holds in initial state

if the invariant holds in the current

state, then it will hold in the next state

RTL Circuit

Decomposing Invariant Verification 2

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqns Z ...Z...R...

RemEqns R ...Z...R...

verify inductive case with recurrence equations

RTL Circuit

Recurrence Equations

- Recall problems in high-level invariant
- (High-level invariant N Z?Z 2-iR)
- Z ? Z exponential in width of Z
- Mentions all of N, Z, R
- Choose recurrence equations for model checking

efficiency - Get rid of multiplication
- Find separate equations for Z and R
- Z par_root_fn(Z, R)
- R remainder_fn(Z, R)

Recurrence Equations

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqns Z ...Z...R...

RemEqns R ...Z...R...

verify inductive case with recurrence equations

RTL Circuit

Gap From Bit Vectors to Arithmetic

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqns Z ...Z...R...

RemEqns R ...Z...R...

unbounded arithmetic Z ... Z ...

fixed length bit-vectors

RTL Circuit

Solution BitVec Arith Library

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

unbounded arithmetic Z ... Z ...

RootEqnsBv

RemEqnsBv

bit vector arithmetic library with overflow

detection Z630 ... bvadd(... Z630) ...

RTL Circuit

Bit Vector Arithmetic Library

- Background
- In Forte, specifications are written in

FL (functional language with built-in BDDS) - bit-vector addition implemented as recursive

functions over lists of BDDs - Goal
- Prove that if a property holds over fixed-length

bit-vectors, then it will hold over unbounded

integers - Solution
- Write an enhanced bit-vector library that

automatically detects overflow

Bit Vector Arithmetic Library

- Implement bit-vectors as a pair
- accurate flag TRUE iff bit-vector has not

overflowed - BDD list bit vector value

Bit Vector Arithmetic Library

- Implement bit-vectors as a pair
- accurate flag TRUE iff bit-vector has not

overflowed - BDD list bit vector value
- Example bit vector addition
- bvadd(bv1, bv2) data_out bvadd_raw(Fdata(bv1

), Fdata(bv2)) ok_out accurate(bv1) and

accurate(bv2) and msb(data_out)

..... return(ok_out, data_out)

Bit Vector Arithmetic Library

- Implement bit-vectors as a pair
- accurate flag TRUE iff bit-vector has not

overflowed - BDD list bit vector value
- Example bit vector addition
- bvadd(bv1, bv2) data_out bvadd_raw(Fdata(bv1

), Fdata(bv2)) ok_out accurate(bv1) and

accurate(bv2) and msb(data_out)

..... return(ok_out, data_out) - Theorem (res bvadd(bv1, bv2)) AND

accurate(res) ? bv2nat(data(res))

bv2nat(bv1) bv2nat(bv2)

BitVec Arith Library

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

unbounded arithmetic Z ... Z ...

RootEqnsBv

RemEqnsBv

bit vector arithmetic library with overflow

detection Z630 ... bvadd(... Z630) ...

RTL Circuit

Verify Init State and Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RTL Circuit

Verify Init State and Recurrence Eqns

- To verify base case of invariant, need to

compute initial state of circuit - To verify recurrence equations, need to compute

next-state functions of circuit - We use symbolic simulation to get initial state

and next-state functions from circuit - Advantages
- Provides common semantic basis for STE and

reachability based model checking - Built-in support for constant propagation and

environmental constraints

Next-State Funs with Symbolic Sim

datapath

Next-State Funs with Symbolic Sim

f

d

- Compute d f(d)

Next-State Funs with Symbolic Sim

clock

f

d

- Compute d f(d)
- Put BDD variables on latches

Next-State Funs with Symbolic Sim

clock

f

d

- Compute d f(d)
- Put BDD variables on latches
- Clock circuit for one clock cycle

Next-State Funs with Symbolic Sim

clock

f

d

- Compute d f(d)
- Put BDD variables on latches
- Clock circuit for one clock cycle
- Sample inputs to latches

A Problem

- Problem
- Designers want to optimize circuit
- Retiming is a common optimization

A Problem

- Problem
- Designers want to optimize circuit
- Retiming is a common optimization
- After retiming, Z and R are no longer latches
- Conventional calculation of transition function

via symbolic simulation is latch-to-latch

A Problem and A Solution

- Problem
- Designers want to optimize circuit
- Retiming is a common optimization
- After retiming, Z and R are no longer latches
- Conventional calculation of transition function

via symbolic simulation is latch-to-latch

- Solution
- Symbolic Trajectory Evaluation (STE) removes

latch-to-latch restriction

Next-State Functions with STE

clock

- Pick cut points for clean recurrence functions

Next-State Functions with STE

clock

- Pick cut points with clean recurrence functions
- Put BDD variables on cutpoints

Next-State Functions with STE

clock

- Pick cut points with clean recurrence functions
- Put BDD variables on cutpoints
- Simulate circuit for one clock cycle

Next-State Functions with STE

clock

- Pick cut points with clean recurrence functions
- Put BDD variables on cutpoints
- Simulate circuit for one clock cycle

Next-State Functions with STE

clock

- Pick cut points with clean recurrence functions
- Put BDD variables on cutpoints
- Simulate circuit for one clock cycle
- Sample cutpoints

Verify Init State and Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RTL Circuit

Verify Init State and Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

Next state

Initial state

RTL Circuit

Verify Init State and Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

Next state

Initial state

RTL Circuit

Verify Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

Next state

Initial state

RTL Circuit

Verify Recurrence Eqns

- Recurrence equations for Z and R
- Z par_root_fn(Z, R)
- R remainder_fn(Z, R)
- But, were not yet done...
- Problem recurrence equations dont hold for all

combinations of Z and R - Need to compute reachable state, or find

additional invariants that are strong enough to

verify recurrence equations

Verify Recurrence Eqns

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

Next state

Initial state

RTL Circuit

Additional Invariants

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Yet Another Set of Invariants...

- Conventional techniques failed to find invariants

needed to verify recurrence equations - Optimizations greatly complicated the circuit
- Automated reachability model checking still

hopeless (approx 1000 latches in datapath alone) - Several months of manual efforts unsuccessful
- too strong (couldnt verify against circuit)
- too weak (couldnt verify against high-level

invariant)

Circuit Optimizations

Z

R

Z par_root_fn(Z, R) R remainder_fn(Z, R)

Z

R

Circuit Optimizations

Z

R

Z par_root_fn(Z, R) R remainder_fn(Z, R)

f

g

Z

R

Circuit Optimizations

Z par_root_fn(Z, R) R remainder_fn(Z, R)

Z

R

X

h

need an invariant for relationship between Z, R,

X

f

g

Z

R

Overapproximating Reachable States

- Solution overapproximate reachable states
- create multiple invariants one for Z,X one for

R,X - dont look at all of the bits of Z, R, X

R

X

Z

Z par_root_fn(Z, R) R remainder_fn(Z, R)

Z

R

X

Overapproximating Reachable States

- Solution overapproximate reachable states
- create multiple invariants one for Z,X one for

R,X - dont look at all of the bits of Z, R, X
- RootInv(Z, X) relates partial root and redundant

state

R

X

Z

Z par_root_fn(Z, R) R remainder_fn(Z, R)

Z

R

X

Overapproximating Reachable States

- Solution overapproximate reachable states
- create multiple invariants
- look at just some of the bits of Z, R, X
- RootInv(Z, X) relates partial root and redundant

state - RemInv(R, X) relates remainder and redundant state

R

X

Z

Z par_root_fn(Z, R) R remainder_fn(Z, R)

Z

R

X

Additional Invariants

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Additional Invariants

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of Verification Strategy

Specification

N Z?Z 2-i?R

Data Invariant

Base

Induct

Control specification

RootEqnsInt

RemEqnsInt

RootEqnsBv

RemEqnsBv

RootInv

RemInv

Next state

Initial state

RTL Circuit

Summary of STE Properties

- Initial state satisfies
- datapath invariant
- partial root invariant
- partial remainder invariant
- Inductive step of partial root invariant
- Inductive step of partial remainder invariant
- Next-state function for partial root satisfies

recurrence equation - Next-state function for partial remainder

satisfies recurrence equation

Case Studies In the Paper

- Floating-point square root
- Over approximation of reachable state
- Using STE to extract next-state functions
- BDD bashing for propositional reasoning
- Floating-point divider and remainder
- Manually deduced invariant
- Application-specific theorem proving environment

for weakest precondition reasoning - Instruction boundary marker
- Porting verification script to new design
- Maintaining verification script on live RTL

Summary

- Used novel combinations of existing verification

techniques to verify highly optimized circuitry

that implements complex iterative algorithm

against natural input/output specification - Forte environment allows for such flexibility and

is key to success - Functional language interface
- STE as primary engine
- Verification on constantly changing RTL is much

harder than on static designs. - Getting the first verification to go through is

harder - Must maintain verification script as design

evolves.

Conclusions

- Optimistic about continued growth of FV
- Formal verification on floating-point is a clear

win - Still many challenges out there, but reusable

methodologies improve probability of success and

productivity - Need for combined model checking and theorem

proving is clear

Formal Verification of Iterative Algorithms in

Microprocessors

- Mark Aagaard Robert Jones
- Roope Kaivola Katherine Kohatsu
- Carl Seger
- Intel Corporation

(No Transcript)