Correctness of Pipelined Machines
The correctness of pipelined machines is a subject that has been studied extensively. Most of the recent work has used variants of the Burch and Dill notion of correctness . As new features are modeled, e.g., interrupts, new notions of correctness are developed. Given the plethora of correctness conditions, the question arises: what is a reasonable notion of correctness? We discuss the issue at length and show, by mechanical proof, that variants of the Burch and Dill notion of correctness are flawed. We propose a notion of correctness based on WEBs (Well-founded Equivalence Bisimulations) [16, 19]. Briefly, our notion of correctness implies that the ISA (Instruction Set Architecture) and MA (Micro-Architecture) machines have the same observable in_nite paths, up to stuttering. This implies that the two machines satisfy the same CTL*X properties and the same safety and liveness properties (up to stuttering).
To test the utility of the idea, we use ACL2 to verify several variants of the simple pipelined machine described by Sawada in , . Our variants extend the basic machine by adding exceptions (to deal with overflows), interrupts, and fleshed-out 128-bit ALUs (one of which is described in a netlist language). In all cases, we prove the same final theorem. We develop a methodology with mechanical support that we used to verify Sawada’s machine. The resulting proof is substantially shorter than the original and does not require any intermediate abstractions; in fact, given the definitions and some general-purpose books (collections of theorems), the proof is automatic. A practical and noteworthy feature of WEBs is their compositionality. This allows us to prove the correctness of the more elaborate machines in manageable stages.
KeywordsProof Obligation Program Counter Interrupt Handler Mechanical Proof Uninterpreted Function
Unable to display preview. Download preview PDF.
- B. Brock, M. Kaufmann, and J. S. Moore. ACL2 theorems about commercial microprocessors. In M. Srivas and A. Camilleri, editors, Formal Methods in Computer-Aided Design (FMCAD’96), pages 275–293. Springer-Verlag, 1996.Google Scholar
- M. Browne, E. Clarke, and O. Grumberg. Characterizing finite Kripke structures in propositional temporal logic. Theoretical Computer Science, 59, 1988.Google Scholar
- J. R. Burch and D. L. Dill. Automatic veri_cation of pipelined microprocessor control. In Computer-Aided Verification (CAV’ 94), volume 818 of LNCS, pages pp68-80. Springer-Verlag, 1994.Google Scholar
- D. Cyrluk. Microprocessor verification in PVS: A methodology and simple example. Technical Report SRI-CSL-93-12, SRI, Dec. 1993.Google Scholar
- T. A. Henzinger, S. Qadeer, and S. K. Rajamani. Assume-guarantee refinement between different time scales. In N. Halbwachs and D. Peled, editors, Computer-Aided Verification CAV’ 99, volume 1633 of LNCS, pages 208–221. Springer-Verlag, 19Google Scholar
- R. Hosabettu, G. Gopalakrishnan, and M. Srivas. A proof of correctness of a processor implementing Tomasulo’s algorithm without a reorder buffer. In L. Pierre and T. Kropf, editors, Correct Hardware Design and Verification Methods, 10th IFIP WG10.5 Advanced Research Working Conference, (CHARME’ 99), volume 1703 of LNCS, pages 8–22. Springer-Verlag, 1999.Google Scholar
- R. Hosabettu, M. Srivas, and G. Gopalakrishnan. Decomposing the proof of correctness of a pileplined microprocessors. In A. J. Hu and M. Vardi, editors, Computer-Aided Verification CAV’ 98, volume 1427 of LNCS. Springer-Verlag, 19Google Scholar
- R. Hosabettu, M. Srivas, and G. Gopalakrishnan. Proof of correctness of a processor with reorder buffer using the completion functions approach. In N. Halbwachs and D. Peled, editors, Computer-Aided Verification CAV’ 99, volume 1633 of LNCS. Springer-Verlag, 19Google Scholar
- M. Kaufmann, P. Manolios, and J. S. Moore, editors. Computer-Aided Reasoning: ACL2 Case Studies. Kluwer Academic Press, June 2000.Google Scholar
- M. Kaufmann, P. Manolios, and J. S. Moore. Computer-Aided Reasoning: An Approach. Kluwer Academic Press, July 2000.Google Scholar
- M. Kaufmann and J. S. Moore. ACL2 homepage. See URL http://www.cs.utexas.edu/users/moore/acl2.
- M. Kaufmann and J. S. Moore. Structured theory development for a mechanized logic. Journal of Automated Reasoning, 2000. To appear, See URL http://www.cs.utexas.edu/users/moore/publications/acl2-papers.html#Foundations.
- P. Manolios. Homepage of Panagiotis Manolios, 2000. See URL http://www.cs.utexas.edu/users/pete.
- P. Manolios. Well-founded equivalence bisimulation. Technical report, Department of Computer Sciences, University of Texas at Austin, 2000. In preparation.Google Scholar
- P. Manolios, K. Namjoshi, and R. Sumners. Linking theorem proving and model-checking with well-founded bisimulation. In N. Halbwachs and D. Peled, editors, Computer-Aided Verification CAV’ 99, volume 1633 of LNCS, pages 369–379. Springer-Verlag, 19Google Scholar
- R. Milner. Communication and Concurrency. Prentice-Hall, 1990.Google Scholar
- K. S. Namjoshi. A simple characterization of stuttering bisimulation. In 17th Conference on Foundations of Software Technology and Theoretical Computer Science,volume 1346 of LNCS, pages 284–296, 1997.Google Scholar
- A. Pnueli, Y. Rodeh, O. Shtrichman, and M. Siegel. Deciding equality formulas by small domain instantiations. In N. Halbwachs and D. Peled, editors, Computer-Aided Verification CAV’ 99, volume 1633 of LNCS, pages 455–469. Springer-Verlag, 19Google Scholar
- J. Sawada. Formal Verification of an Advanced Pipelined Machine. PhD thesis, University of Texas at Austin, Dec. 1999. See URL http://www.cs.utexas.edu/users/sawada/dissertation/.
- J. Sawada. Verification of a simple pipelined machine model. In M. Kaufmann, P. Manolios, and J. S. Moore, editors, Computer-Aided Reasoning: ACL2 Case Studies, pages 137–150. Kluwer Academic Press, 2000.Google Scholar
- J. Sawada and W. A. Hunt, Jr. Trace table based approach for pipelined micro-processor verification. In Computer Aided Verification (CAV’ 97), volume 1254 of LNCS, pages 364–375. Springer-Verlag, 1997.Google Scholar
- M. Srivas and M. Bickford. Formal verification of a pipelined microprocessor. IEEE Software, pages 52–64, Sept. 1990.Google Scholar
- M. K. Srivas and S. P. Miller. Formal verification of an avionics microprocessor. Technical Report CSL-95-04, SRI International, 1995.Google Scholar
- P. J. Windley and M. L. Coe. A correctness model for pipelined microprocessors. In Theorem Provers in Circuit Design, volume 901 of LNCS, pages 33–52. Springer-Verlag, 1994.Google Scholar