1. Transaction Based Modeling and Verification of Hardware Protocols Xiaofang Chen, Steven M. German and Ganesh Gopalakrishnan Supported in part by Intel SRC Customization Award 2005-TJ-1318

2. 2 Modeling and Verification of HW Protocols  High-level modeling –Model checking –Murphi, TLA+  Low-level: RTL or VHDL –Simulation –SixthSense, RuleBase

3. 3 Problem Addressed  Global properties cannot be verified at RTL level  Specifications can be verified; but do they correctly represent the implementations  Our goal – Bridge the gap between specifications and implementations

4. 4 Modeling 1 1.1 1.2 1.3 home client buf local cache One step in high-level Multiple steps in low-level 1.4 1.5

5. 5 Differences in Execution 1 1.1 1.2 1.3 23 2.1 2.23.1 3.2 3.3 We introduce “transactions” for the mapping Interleaving in HL Concurrency in LL

6. 6 Hardware Murphi  Murphi extension by S. German and G. Janssen  A concurrent shared variable language –On each cycle Multiple transitions execute concurrently Exclusive write to a variable Shared reads to variables Write immediately visible within the same transition Write visible to other transitions on the next cycle  Support signals, transactions, etc

7. 7 A Few Notations  Variables in both spec and impl – Interface variables: V I – Transactional variables: V H  Variable v inactive at a state s –If all transactions that can write to v are not active at s

8. 8 Formal Notion of Refinement  For every concurrent execution of impl, exists an interleaving execution of spec that variables – V I always match – V H match for inactive(l i ) … l0l0 l1l1 l2l2 … h0h0 h1h1 h2h2 h3h3 LL HL l3l3

9. 9 Refinement Check Hardware Murphi Impl model Product model in Hardware Murphi Product model in VHDL Murphi Spec model Property check Muv Check high-level correctly implements low-level

10. 10 Property Check in Refinement Spec( s ) s Spec( s ’) 1-transition 1-transaction: multi concurrent transitions s’ Guard for spec transition must hold s: reachable state where the commit transition of transaction is enabled Observable vars changed by spec or impl must match

11. 11 Model Checking Approaches  Monolithic –Straightforward property check  Compositional –Divide and conquer

12. 12 Compositional Refinement Check  Reduce the verification complexity  Basic Techniques –Abstraction Removing details to make verification easier –Assume guarantee A simple form of induction which introduces assumptions and justifies them

13. 13 Abstraction  View design as concurrent processes  Perform simplifications –Change a read to access a fresh input variable, or –If in a process, two steps are executed 1 st step writes to a variable 2 nd step read it then no need to consider other sources of the read Change to free inputs

14. 14 Assume Guarantee Reasoning  Assume certain values for any read of a variable  Guarantee certain values for all writes to the variable  Example –In the beginning of a transaction Assume spec and impl have same values on joint variables to be read –At the end of the transaction Guarantee spec and impl have same values on joint variables being written

15. 15 Driving Benchmark Buf Remote DirCache Mem Router Buf Local Home Remote DirCache Mem S. German and G. Janssen, IBM Research Tech Report 2006 Local Home

16. 16 Bugs Found with Refinement Check  Benchmark satisfies cache coherence already  Bugs still found –Bug 1: router unit loses messages –Bug 2: home unit replies twice for one request –Bug 3: cache unit gets updated twice from one reply  Refinement check is an automatic way of constructing checks

17. 17 Experimental Results Verification Time 1-bit 10-bit 1-day Datapath Thanks: SixthSense, VHDL compiler and RuleBase groups  Configurations –2 nodes, 2 addresses, SixthSense “xpt” engine 30 min Monolithic approach Compositional approach

18. 18 Conclusion  Introduced transactions to map spec and impl  Developed formal theory of refinement check  Developed compositional approach –Abstraction –Assume guarantee  Encouraging experimental results

19. 19 Related Work  Arvind et. al. –Bluespec  Park and Dill –Aggregation of distributed actions  McMillan –Compositional approach

20. 20 Thanks! “ Transaction based modeling and verification of hardware protocols”, To be appeared in FMCAD 2007