How do I use all this?

1

• How do I use all this?

2

• How do I use all this, really?

3

• How do I use all this, really?
• Detailed step-by-step description of a pipeline
  verification example

4
Outline
1 Informal Introduction 2 Formal Definitions
Reactive Systems Witnessed Refinement Proofs
Slicing Reactive Systems Decomposing
Refinement Proofs 3 Formal Example Three-Stage
Pipeline 4 Informal Example Dataflow Processor
Array
5
isaRegFile
op
isaAlu
inp
src1
src2
dest
isaOut
out
stall
Specification ISA
6
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
load r1 1 xnor r2 r1 r1 store r2
r1 1 r2 0 out 0
Notes 1. Store instruction results in an
output 2. Memory hierarchy is not represented 3.
Why do we need stall ?
7
regFile
out
out
alu
src1
P1
P2
src2
inp
op
dst
FETCH
EXECUTE
WRITE-BACK
8
regFile
out
out
opr1
alu
src1
opr2
src2
res
inp
p1inp
op
p2op
p1op
dst
stall
p2dst
p1dst
stall
9
Goal Establish Pipeline refines ISA
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
10
need for stall in ISA
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
11
witnessed refinement
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
Limitation State explosion
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
12
Why not decompose proof?
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
13
regFile
out
out
alu
src1
P1
P2
src2
inp
op
dst
FETCH
EXECUTE
WRITE-BACK
14
regFile
out
out
P2
WRITE-BACK
15
alu
P1
P2
EXECUTE
16
regFile
src1
P1
src2
inp
op
dst
FETCH
17
Why not decompose proof?
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
out
out
src1
src2
inp
op
dst
18
Why not decompose proof?
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
src1
src2
inp
op
dst
19
Why not decompose proof?
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
src1
res
src2
inp
p2op
op
p2dst
dst
stall
stall
20
Decompositon does not work!
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
21
isaRegFile
op
isaAlu
inp
src1
src2
dest
isaOut
out
stall
22
isaRegFile
op
isaAlu
inp
src1
src2
dest
isaOut
out
stall
opr1
opr1
opr2
opr2
p2dst
res
res
23
out proof
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
opr1
opr1
opr2
opr2
res
p2dst
res
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
24
out proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
res
out
out
src1
src2
inp
op
dst
25
out proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
res
regFile
out
out
src1
src2
inp
op
dst
26
out proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
res
regFile
out
out
src1
res
src2
inp
p2op
op
p2dst
dst
stall
stall
27
out proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
res
p2dst
regFile
out
out
src1
src2
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
28
out proof
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
res
p2dst
regFile
out
out
src1
src2
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
29
regFile
out
out
P2
WRITE-BACK
30
res proof
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
opr1
opr1
opr2
opr2
res
p2dst
res
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
31
res proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
opr1
opr1
opr2
opr2
alu
res
res
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
32
res proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
opr1
opr1
opr2
opr2
res
p2dst
res
alu
res
res
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
33
alu
P1
P2
EXECUTE
34
opr1 proof
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
opr1
opr1
opr2
opr2
res
p2dst
res
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
35
opr1 proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
opr2
opr2
res
p2dst
res
regFile
opr1
alu
src1
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
36
opr1 proof
isaRegFile
isaAlu
op
inp
src1
src2
dst
stall
opr1
opr1
opr2
opr2
res
p2dst
res
regFile
opr1
alu
src1
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
37
regFile
src1
P1
src2
inp
op
dst
FETCH
38
FETCH
39
isaRegFile
isaAlu
op
inp
src1
isaOut
src2
dst
out
stall
opr1
opr1
opr2
opr2
res
p2dst
res
regFile
out
out
opr1
alu
src1
opr2
res
src2
p1inp
inp
p2op
p1op
op
p2dst
p1dst
dst
stall
stall
40

• But..

41

• But.. is this really practical?

42

• But.. is this really practical?
• Verification of VGI multiprocessor

43
Outline
1 Informal Introduction 2 Formal Definitions
Reactive Systems Witnessed Refinement Proofs
Slicing Reactive Systems Decomposing
Refinement Proofs 3 Formal Example Three-Stage
Pipeline 4 Informal Example Dataflow Processor
Array
44
VGI

• VGI Video-Graphics-Image
• Designed by Infopad group at Berkeley
• Purpose web-based image processing
• Designed using
• VHDL (control)
• Schematics (Data path)

45
VGI Architecture

• 16 clusters with 6 processors in each - 4
  compute, 1 memory, 1 I/O
• 30K logic gates per processor
• 800 latches per processor
• Pipelined compute processors
• Low latency data transfer between processors -
  complex control

46
VGI Architecture
47
FIFO buffer
ISA
ISA
ISA
ISA
ISA
pipeline
pipeline
Complex handshake
pipeline
pipeline
pipeline
48
Verification

• Different time scales
• Implementation
• two-phase clock
• level-sensitive latches
• activity on both HI and LO phases of clk
• Specification
• no clk signal

49
Sample Operator
S
?
I
?
I Sample I at ? Runs of I Runs of I
sampled at instances where ? holds
50
ISA
ISA
ISA
ISA
ISA
?
pipeline
pipeline
pipeline
pipeline
pipeline
clk
51
Difficulty - Verification

• Size of the VGI chip
• 800 latches in each compute processor
• 64 compute processors
• Need divide and conquer

52
Step 1 Network of Processors to Single Processor
53
ISA
ISA
ISA
ISA
ISA
?
pipeline
pipeline
pipeline
pipeline
pipeline
clk
54
ISA
?
pipeline
clk
55
ISA
ISA
ISA
ISA
ISA
?
pipeline
pipeline
pipeline
pipeline
pipeline
clk
56
ISA
?
pipeline
clk
57
ISA
ISA
ISA
ISA
ISA
?
pipeline
pipeline
pipeline
pipeline
pipeline
clk
58
pipeline
?
ISA
?
ISA
pipeline
clk
clk
pipeline
ISA
?
?
ISA
pipeline
clk
clk
?
ISA
pipeline
clk
59
Step 2 Single Processor
pipeline
ISA
?
clk

• Single processor still has 800 latches
• Need divide-and-conquer again

60
Input from upstream processor
OP GEN
ALU Spec
FIFO buffer
ISA REGFILE
?
Input from upstream processor
P I P E
Comm Stage
ALU Gate Level
REGFILE
clk
61
VGI Results

• All lemmas (exceptALU) checked by Mocha in a few
  minutes
• 3 bugs in communication control found and fixed
• Abstract definitions crucial - designer insight
  needed