Decomp osing Re nemen Pro ofs using AssumeGuaran tee Reasoning Thomas A
62K - views

Decomp osing Re nemen Pro ofs using AssumeGuaran tee Reasoning Thomas A

Henzinger Shaz Qadeer SriramK Rajamani Univ ersit yofCaliforniaBerk eley CompaqSystemsResearc hCen ter MicrosoftResearc taheecsberkele ye du qadeerpadeccom srirammicrosoft co Abstract Mo delc hec king algorithms can be used to erify formally and aut

Download Pdf

Decomp osing Re nemen Pro ofs using AssumeGuaran tee Reasoning Thomas A




Download Pdf - The PPT/PDF document "Decomp osing Re nemen Pro ofs using Assu..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.



Presentation on theme: "Decomp osing Re nemen Pro ofs using AssumeGuaran tee Reasoning Thomas A"— Presentation transcript:


Page 1
Decomp osing Re nemen Pro ofs using Assume-Guaran tee Reasoning Thomas A. Henzinger Shaz Qadeer SriramK. Rajamani Univ ersit yofCalifornia,Berk eley CompaqSystemsResearc hCen ter MicrosoftResearc tah@eecs.berkele y.e du qadeer@pa.dec.com sriram@microsoft. co Abstract. Mo del-c hec king algorithms can be used to erify formally and automati- cally , ifalo w-lev el description of a design conforms with a high-lev el description. Ho w- ev er, for designs with ery large state spaces, prior to the application of an algorithm, the re nemen t-c hec king task needs to b e decomp osed

in to subtasks of manageable com- plexit It is natural to decomp ose the task follo wing the comp onen structure of the design. Ho ev er, an individual comp onen often do es not satisfy its requiremen ts un- less the comp onen is put in to the righ con text, whic constrains the inputs to the comp onen t. Th us, in order to v erify eac h comp onen t individually ,w eneedto mak e as- sumptions ab out its inputs, whic h are pro vided b y the other comp onen ts of the design. This reasoning is circular: comp onen is v eri ed under the assumption that con text b eha es correctly and symmetrically

is eri ed assuming the correctness of The assume-guaran tee paradigm pro vides a systematic theory and metho dology for en- suring the soundness of the circular st yle of p ostulating and disc harging assumptions in comp onen t-based reasoning. egiv e a tutorial in tro duction to the assume-guaran tee paradigm for decomp osing re nemen t-c hec king tasks. illustrate the metho d, step in detail through the formal eri cation of pro cessor pip eline against an instruction set arc hitecture. In this example, the v eri cation of a three-stage pip eline is brok en up in to three subtasks, one for

eac h stage of the pip eline. In troduction In re nemen hec king wish to erify that lo w-lev el description of design conforms with high-lev el description. The assume-guaran tee paradigm pro vides metho d for decomp osing re nemen t-c hec king task in to subtasks of manageable complexit whic can then be disc harged automatically b y mo del-c hec king algorithms. egiv e a tutorial in tro duction to the assume-guaran tee paradigm for decomp osing re nemen pro ofs. In Section 2, presen the assume-guaran tee principle within the formalism of reactiv A preliminary v ersion of this pap er app eared

in the Pr dingsoftheIEEE/A CMInternationalConfer enc eon Computer-aide dDesign (ICCAD 00), IEEE Computer So ciet y Press, 2000, pp. 245{252. Supp orted in part b yD ARP A Information T ec hnology Oce, b y the MAR CO Gigascale Silicon Researc h Cen ter, and b y the National Science F oundation.
Page 2
systems. system is function from input signals to output signals. call system reactiv if the input-output function is de ned b y induction o er time using sync hronous gates and latc hes without com binational cycles. In this mo del, all nondeterminism is con ned to the input signals.

In Section 3, outline systematic metho dology for using the assume-guaran tee principle in re nemen pro ofs. In Section 4, apply the metho dology to erify pro cessor pip eline against an instruction set arc hitecture. are are of mo del hec ers that pro vide explicit to ol supp ort for re nemen hec k- ing using assume-guaran tee reasoning | Mocha [AHM 98] and SMV [McM97 , McM98 , McM99 ]. Assume-guaran tee re nemen hec king has been used successfully for erifying the correctness of algorithms, suc has T omasulo's algorithm [McM98 ]. It has also b een used successfully for v erifying real-w orld

hardw are designs against abstract sp eci cations. Tw suc examples are (1) the eri- cation of pip elined implemen tation of directory-based coherence proto col that is an in tegral part of the Origin 2000 serv ers from Silicon Graphics, using SMV [Eir98 ], and (2) the eri cation of GI data o pro cessor arra that as designed the Infopad pro ject at the Univ ersit of California, Berk eley using Mocha [HLQR99 ]. The ormalism 2.1 Signals and systems signal is function from time domain to alue set Giv en time instan write for the alue of the signal at time The signal is discr ete if the time domain

is the set of nonnegativ ein tegers. The signal is ole an if the v alue set is the set of b o oleans. Let be set of yp ed p orts. The typ of port consists of time domain and a alue set snapshot at is a function that maps eac p ort to a v alue ehavior at is function that maps eac port to signal If all ports in agree on the time domain , then the b eha vior at can b e view ed as a function that maps eac h time instan to a snapshot )at Giv en a second set of p orts, the pr oje ction onto of the snapshot at , denoted , is the snapshot at whic h restricts the function to the domain Similarly , the

pro jection of the b eha vior at is the b eha vior at whic h restricts to the domain Giv en t o disjoin tsets and of p orts, a snapshot at and a snapshot at the join is the snapshot at suc that and Similarly ,thejoin x. /y of a b eha vior at and a b eha vior at is the b eha vior at for whic h( x. /y and ( x. /y system ]consistsof(1)aset of t yp ed input p orts, (2) a set of t yp ed output p orts disjoin tfrom , and (3) an input-output function whic h maps eac h b eha vior at to a b eha vior at e call an input b eha vior, the corresp onding output b eha vior, and x. /y the resulting

input-output b eha vior. If compare systems, then compare the signals at the common ports. The system e nes the system ] if for eac h input b eha vior at there is an input b eha vior at suc h that the input-output b eha viors x. /S and /S ) agree on the common p orts |that is, ( x. /S )) =( /S )) or non trivial v alue sets, this implies that the set of input p orts is disjoin t from the set of output p orts. The re nemen t relation on systems is a preorder (i.e., re exiv e and transitiv e).
Page 3
2.2 Reactiv systems restrict our atten tion to discrete signals. system is discr ete if

the time domain of all input and output ports in is are in terested in discrete systems whose input-output function is de ned b induction on the time domain From no on assume that Consider discrete system with output ports and consider an input b eha vior at The corresp onding output beha vior is uniquely determined if (a) de ne the initial output snapshot (0) from the inital input snapshot (0), and (b) w de ne, for all , the output snapshot +1) at time + 1 from the preceding output snapshot )and the concurren t input snapshot + 1). This is called Mo or e induction The follo wing, more general

y of de ning the t oin terdep enden t output signals and is referred to as active induction The output b eha vior is uniquely determined if (a1) de ne (0) from (0), (a2) de ne (0) from (0) and (0), (b1) de ne +1) from and +1), and (b2) de ne +1) from and +1) and + 1). In this case sa that the output port ombinational ly dep ends on the output p ort 1. Alternativ ely output p ort 1 could com binationally dep end on output port 2. Reactiv induction is restricted form of Me aly induction Ho ev er, general Mealy induction, where b oth output p orts 1 and 2 dep end com binationally on eac h other,

ma not determine unique output beha vior. or example, for b o olean alues, the equations (b1) +1) = + 1) and (b2) +1) +1) ha e no solution; the equations (b1) +1) = + 1) and (b2) +1) = +1) ha em ultiple solutions. Reactiv induction can be generalized to more than output p orts as follo ws. discrete system ]is active if there is an acyclic binary relation bet een the set of output p orts and the set of all ports suc that for all (a) there is function First that, giv en the input alues (0) and and the output alues (0) and returns the output alue (0), and (b) there is function Next that, for all

giv en an output snapshot ), the input alues +1) and and the output alues +1) and returns the output alue +1). The relation is called the ombinational dep endency elation of ]. The acyclicit of (i.e., the transitiv closure of is irre exiv e) ensures that for eac input b eha vior at there is unique output b eha vior at whic conforms with the functions First and Next or eac output p ort the function First is called the initialization function of ,and Next is the tr ansition function of The pair First Next )iscalledthe active de nition of , and denoted If ] is a reactiv e system, then assume that

the input-output function is giv en reactiv de nitions for the output p orts; that is, with sligh t abuse of notation, from no wonw e assume that Consider reactiv system ]. Giv en an output p ort write for the set of ports suc that Giv en an input snapshot in at write First in for the output snapshot out at suc that out First in out for all Giv en an output snapshot prvout at and an input snapshot in at write Next prvout in for the output snapshot out at suc hthat out Next prvout in out ) for all 2.3 Solving witnessed re nemen Consider reactiv systems and ]. Then is set of reactiv de nitions

for the p orts in and is set of reactiv de nitions for the ports in or eac h p ort , the t o reactiv de nitions and ma y b e di eren t. ew an to kno if re nes ]. In this con text, call the implementation system, and ] is the sp ci c ation system.
Page 4
Algorithm Synchr onize Se ar ch Input: o reactiv systems ] and ] with and Output: do es ] re ne ]? Done := for eac h snapshot in at do out := First in ); if out First (( in out ) then return No ; do := do [f out od; while do do ho ose prvout from do for eac snapshot in at do out := Next prvout in ); if out Next prvout in out ) then

return No ; if out 62 Done then do := do [f out od; Done := Done [f prvout do := do nf prvout od; return Yes Figure 1: Chec king witnessed re nemen Of particular in terest is the case in whic all sp eci cation ports are implemen tation ports; sp eci cally and If furthermore, in implies in for all ports and then sa that the sp eci cation is ful ly witnesse the implemen tation, and refer to the re nemen question as fully witnessed. ully witnessed re nemen questions can be solv ed more ecien tly than general re nemen questions for reactiv systems. In particular, the algorithm Synchr onize Se ar

ch of Figure 1 answ ers the fully witnessed re nemen t questions. The algorithm searc hes through the snapshots at whic h o ccur along some output beha vior of ], and hec ks if all implemen tation successors of these snapshots agree with the corresp onding sp eci cation successors. During the searc h, the v ariable Done con tains the set of snapshots at whose successors ha been explored, and the ariable do con tains the set of snapshots at whose successors need to be explored. The algorithm Synchr onize Se ar ch can be implemen ted using either depth- rst searc (represen do as stac k) or

breadth- rst searc h (represen do as a queue). or b o olean systems, binary decision diagrams ma ybeusedin breadth- rst implemen tations. If all p orts are b o olean, then the time complexit of the algorithm Synchr onize Se ar ch is and the space complexit is (2 ). Hence, the main source of complexit y is the um ber of output ports of the implemen tation. will reduce this um ber b decomp osing the re nemen tc hec kin to subproblems.
Page 5
2.4 Decomp osing reactiv systems de ne op erations on reactiv systems: comp osition and slicing. Comp osition tak es the union of the output p

orts of t o systems; slicing remo es some output p orts from a system. Consider reactiv systems and with the com binational dep endency relations and resp ectiv ely The systems and are omp osable if (1) the output p orts are disjoin |that is, and (2) the union of the com binational dep endency relations is acyclic. If ] and ] are comp osable, then )[( 2) 1); 2] is again a reactiv e system. e call ]the omp osition of ]and ]. If ] is a reactiv system and , then ); is again a reactiv system. call the slic of ]. The slice ma y di er from ] in the output signals at the p orts in , b ecause the

slice treats the p orts in , whose signals ma y in uence the signals at , as unconstrained input p orts. Comp osition and slicing are in erses: for all , the reactiv e system ] results from comp osing the slice of with the slice of ]. 2.5 Decomp osing witnessed re nemen In the follo wing, consider t o reactiv systems ]and ] with ;:::;q First eak decomp ositio n rule. If fully witnesses ], then in order to pro that re nes ], it suces to pro for all that the slice of ] is re ned b ]. This rule do es not slice the implemen tation, and th us giv es no sa vings in the complexit y of re ne- men tc

hec king. Second w eak decomp osition rule. If ] fully witnesses ], then in order to pro that re nes ], it suces to pro for all that the slice of ] is re ned b ythe slice of ]. This rule slices the implemen tation to o uc h: the premises usually do not hold ev en in cases where the conclusion is true. This is b ecause the implemen tation signal at ma agree with the sp eci cation signal at only if the implemen tation signals on whic dep ends are tak en in to accoun t. In other ords, the slice of the sp eci cation ma be re ned b y the slice of the implemen tation only if its input p orts nf are

constrained. The follo wing rule p ermits an y set of constrain ts on nf to b e tak en from the implemen tation. Third eak decomp ositio n rule. If ] fully witnesses ], then in order to pro that re nes ], it suces to pro for all that the slice of ] is re ned b ysome slice of ] with This rule generalizes the rst eak decomp osition rules; it pro vides greater exibit as the slice can be c hosen freely Still, more general rule is p ossible: in order to sho that the slice of the sp eci cation is re ned the slice of the implemen tation ma constrain its input p orts nf not only with implemen tation

signals but also with sp eci cation signals.
Page 6
Strong (assume-guaran tee) decomp osition rule. If ] fully witnesses ], then in order to pro ethat ]re nes ], it suces to pro e for all 1 that the slice of ] is re ned b y the comp osition of (1) some slice of with , and (2) some slice of ] with 62 This rule o ers greater exibilit than the eak decomp osition rules, as both slices and can be hosen freely Unlik the eak decomp osition rules, the assume-guaran tee rule app ears to be circular in the sense that, sa the slice of the sp eci cation ma be re ned b an slice of the sp eci

cation with , while indep enden tly the slice of the sp eci cation ma y b e re ned b an slice of the sp eci cation with In other w ords, \w ma y assume that the sp eci cation holds at to guaran tee it holds also at and indep enden tly assume that the sp eci cation holds at to guaran tee it holds also at ." The apparen t circularit y is resolv ed y induction o er time follo wing the reactiv de nitions of the output signals. Apparen tly circular pro of rules whose soundness relies on induction er time can be traced bac kto[MC81]. A strong decomp osition rule for async hronous systems w as giv en

in [AL93 , AL95], and for sync hronous reactiv systems, in [AH95 , AH96 ]. Pro of metho dologies for applying strong decomp osition rules w ere dev elop ed in [McM97 ] and [HQR98 ]. The strong decomp osition rules and pro of metho dologies ere recen tly generalized in man ys, for example, to accomo date ulti- ple constrain ts on single output port [McM98 ], branc hing-time re nemen [HQR T98 ], di eren implemen tation and sp eci cation time scales [HQR99 ], and liv eness constrain ts [McM99 ]. 2.6 Witnessing re nemen The algorithm from Section 2.3 for re nemen hec king, as ell as the decomp

osition rules from Section 2.5, require that the re nemen question to be solv ed is fully witnessed. Based on the follo wing rule, this can b e ac hiev ed b y adding sp eci cation p orts to the implemen tation. Implemen tation strengthening (witnessing) rule. Let ], ], and be three reactiv systems. If then in order to pro that ] re nes ], it suces to pro e that ]isre nedb y the comp osition of ]and ]. If the premise of the implemen tation strengthening rule is witnessed and true, then call the reactiv system witness to the question if re nes ]. Note that witness is not p ermitted to constrain

the input p orts of the implemen tation, but it ma y constrain the input p orts of the sp eci cation. The construction of witness sometimes requires creativit but often is suggested b y the re nemen t question at hand. In particular, for output p orts of the sp eci cation, it is usually appropriate to ho ose witness with and that is, the reactiv de nition of in the witness is iden tical to the reactiv de nition of in the sp eci cation. Input p orts ) of the sp eci cation sometimes can b e left unconstrained in the witness (then ), and sometimes need to be de ned in terms of the implemen tation

p orts (then ) in order for the premise of the witnessing rule to hold. It is the construction of in the latter case whic hma y require creativ insigh t. The Methodology Recall the strong decomp osition rule from Section 2.5 for pro ving that re nes ]. The p o er of the rule stems from the fact that in order to re ne the slice of the sp eci cation, w
Page 7
can constrain the input p orts of the slice of the implemen tation with sp eci cation signals (the slice ) |rather than implemen tation signals (the slice ), as in w eak decomp osition. Sp eci cation signals are generally

preferable to implemen tation signals, b ecause they tend to b e more abstract and dep end on few er other signals. therefore wish to eep the slice as small as p ossible (preferably ), usually at the cost of enlarging Ho ev er, in practice, the exibilit o ered the strong decomp osition rule is often irrelev an simply b ecause man output p orts of the implemen tation do not o ccur in the sp eci cation, and th us w eha e no abstract de nitions of the signals at these p orts to c ho ose for Based on the follo wing rule, w e can add to the sp eci cation abstract de nitions for the signals at Sp

eci cation strengthening (abstraction) rule. Let ], ], and b e three reactiv e systems. In order to pro e that ] re nes ], it suces to pro e that ] re nes the comp osition of ] and ]. In practice, the construction of suitable abstract de nitions for implemen tation output ports is the activit ywhic h consumes the most creativ e energy during an assume-guaran tee pro of. see this, w e illustrate ho wat ypical assume-guaran tee pro of ma y pro ceed. In the follo wing, write to denote that re nes ], and w write [ short for ]toa oid the rep eated en umeration of Supp ose that w ew an ttosho (1) [

a;b ;S ;S ;S ;S g) a;c ;S ;S Since this re nemen t question is not fully witnessed, w em ust add the p orts and to the imple- men tation. Supp ose w e can giv e a reactiv e de nition of the signal at in terms of implemen tation signals. Then our pro of obligation b ecomes (2) [ a;b ;S ;S ;S ;S ;S ;S g) a;c ;S ;S If the algorithm Synchr onize dSe ar ch succeeds in answ ering this fully witnessed re nemen t question with 7 implemen tation output p orts, then w e are done. If not, then w e can apply w eak re nemen decomp osition and attempt to sho w the three pro of obligations (4) [ a;b;y;u;v;w

;S ;S g) a;c;y;z (5) [ a;b;x;u;v;w ;S ;S g) a;c;x;z (6) [ a;b;c;x;y;u;v;w g) a;c;x;y Obligation (6) holds trivially Ho ev er, supp ose that (4) and (5) do not hold, b ecause dep ends on and dep ends on and In this case, ust apply strong re nemen decomp osition to (2), and replace (4) and (5) b (7) [ a;b;u;v;w ;S ;S ;S g) a;c;y;z (8) [ a;b;v;w ;S ;S ;S ;S g) a;c;x;z Note that ha hosen the sp eci cation signal to constrain because unlik the sp ec- i cation signal ma not dep end on in whic case (7) holds. Ho ev er, supp ose that (8) do es not hold, b ecause in turn dep ends on , and furthermore,

dep ends on Hence e need to replace (8) b (9) [ a;b ;S ;S ;S ;S ;S ;S g) a;c;x;z
Page 8
(13) (12) y strong decomp (11) y witnessing (10) y abstraction (9) (7) trivially (6) y strong decomp (2) y witnessing (1) Figure 2: Sample assume-guaran tee pro of and ha eth us arriv ed again at 7 implemen tation output p orts, whic h represen ts no sa vings o er (2). The problem is that w eha no sp eci cation signal at whic h is more abstract than and do es not dep end on Ho ev er, the abstraction rule allo ws us to add reactiv de nition to the sp eci cation. This step usually requires a deep

understanding of the implemen tation. Supp ose that the abstract de nition is nondeterministic and dep ends on an additional input p ort No w (9) follo ws from (10) a;b ;S ;S ;S ;S ;S ;S g) a;c;d;x;z ;S o fully witness (10), w e add a reactiv e de nition of the signal at to the implemen tation. Then it suces to sho (11) a;b ;S ;S ;S ;S ;S ;S ;S g) a;c;d;x;z ;S whic h can b e assume-guaran tee decomp osed to (12) a;b;v;w ;S ;S ;S ;S ;S g) a;c;d;x;z;u (13) a;b;x;y ;S ;S ;S ;S ;S g) a;c;d;x;y;z Obligation (12) remo es the dep endencies on and y using the abstract de nition instead of Obligation

(13) v eri es that is indeed an abstract de nition of Both (12) and (13) ha few er implemen tation output p orts than (9), and th us stand b etter hance of b eing disc harged automatically The pro of is summarized in Figure 2. ha decomp osed the original pro of task (2) in to three subtasks, namely subtask (7) corresp onding to the implemen tation p ort subtask (12) corresp onding to the implemen tation p ort , and subtask (13) corresp onding to the implemen tation ports and While the sa vings in this example are minimal, the three subtasks could refer to implemen tation parts of arbitrary

size, in whic h case the reduction w ould b e substan tial. The Example 4.1 The system descriptions Consider the simple instruction set arc hitecture describ ed b y the reactiv system ISA of Figure 4, and simple three-stage pip eline describ ed the reactiv system PIPELINE of Figure 5. de ne initialization and transition functions using if-then-else syn tax. In the de nition of transition functions, w eusetheprimedv ersion of a p ort to denote the v alue of the signal at at time +1, and w e use the unprimed v ersion to denote the v alue of the signal at at time In the de nition of

initialization functions, use the primed v ersion of port to denote the alue of the signal
Page 9
yp e opT yp AND OR STORE NOP yp e gT yp bitv ector WORDLENGTH yp e gIndexT yp (0.. NUMREGS -1) yp e gFileT yp arra gIndexT yp of gT yp yp e pip e1T yp record of op opT yp dest gIndexT yp inp gT yp opr1 gT yp opr2 gT yp yp e pip e2T yp record of op opT yp dest gIndexT yp es gT yp Figure 3: Data t yp es used in ISA and PIPELINE at at time 0. It follo ws that the left-hand-sides of all de nitions are primed v ersions of output ports; the righ t-hand-sides of all de nitions ma ycon tain

unprimed and primed v ersions of output ports, and primed ersions of input p orts. The yp es of the input and output p orts used in this example are de ned in Figure 3. e use arra ys for mo deling register les, and records for mo deling pip eline stages. The reactiv e system ISA has six input p orts |the op eration op , the immediate op erand inp , the source registers sr c1 and sr c2 , the destination register dest , and the signal stal l ,whic h indicates if the curren t inputs should b e pro cessed. If the v alue of stal l is true , then no instruction is pro cessed, and the en vironmen is

exp ected to pro duce the same instruction again at the next time instan t. There are t o output p orts |the v alue out of a STORE instruction, and the register le isaR gFile The reactiv e system PIPELINE is a piplelined implemen tation of the describ ed instruction set arc hitecture. In the rst stage of the pip eline, the op erands are fetc hed; in the second stage, the op erations are p erformed; in the third stage, the result is written in to the register le. All input ports of the ISA system with the exception of stal l are input ports of the PIPELINE system as ell, and stal l is an output

p ort of PIPELINE The PIPELINE system has v other output p orts |the register le gFile , the result pip e1 of the rst stage of the pip eline, the ALU output aluOut , the result pip e2 of the second stage of the pip eline, and out The output pip e1 is a record op dest inp opr1 opr2 In the rst stage of the pip eline, the op dest and inp elds of pip e1 store the corresp onding inputs; the opr1 and opr2 elds store the generated op erands. orw arding logic ensures that correct op erand v alues are generated ev en if the v alues ha e not y et b een written in to the register le. The output aluOut

eeps the result of ALU op eration in the second stage. The output pip e2 is a record op dest es The op and dest elds are copied from pip e1 , and the eld es stores the alue to be written bac in to the register pip e2 dest The third stage copies pip e2 es in to the register pip e2 dest The signal out outputs register alue in resp onse to STORE instruction. The signal stal l is true whenev er STORE instruction cannot be accepted due to data dep endencies. eusethek eyw ord nondet as an abbreviation denoting an unnamed input p ort of the appro- priate yp e (dep ending on the con text). or example,

the de nition of the transition function for
Page 10
reactiv system ISA input op opT yp inp gT yp stal l bool sr c1 sr c2 dest gIndexT yp output out gT yp isaR gFile gFileT yp initialization forall do isaR gFile ]:= 0 transition isaR gFile dest ]:= if stal l then isaR gFile dest elsif op LO AD then inp elsif op AND then isaR gFile sr c1 isaR gFile sr c2 elsif op OR then isaR gFile sr c1 isaR gFile sr c2 else isaR gFile dest out := if stal l op STORE then isaR gFile dest else nondet Figure 4: Instruction set arc hitecture the signal out of ISA mak es use of the k eyw ord nondet This

is equiv alen ttoha ving an input p ort outchoic of t yp e gT yp and stating the transition function as out := if stal l op STORE then isaR gFile dest else outchoic Since there is no other purp ose for the p ort outchoic ,w e prefer to use the syn tactic sugar nondet in suc h situations. If nondet is used in the sp eci cation, then the corresp onding input p ort has to b e witnessed in the implemen tation. This can b e ac hiev ed simply b outchoic := out When w e mak em ultiple uses of nondet , then eac h use refers to a di eren t unnamed input p ort of the appropriate t yp e. 4.2 The re nemen

pro of Our goal is to sho wthat PIPELINE is a correct implemen tation of the instruction set arc hitecture ISA This is the case if ev ery sequence of instructions giv en to PIPELINE pro duces a sequence of outputs (and stalls) that is p ermitted b ISA ormally ,w ew ould lik to pro ethat PIPELINE ISA The rst step is to satisfy the requiremen t that the input and output p orts of ISA are also presen in PIPELINE Except for isaR gFile and the unnamed input p orts that corresp ond to nonde- terministic hoices (whic are witnessed as describ ed ab o e), this already holds. simply add the p ort isaR

gFile and its reactiv de nition from ISA to PIPELINE ,th us obtaining the system PIPELINE and the fully witnessed re nemen t question PIPELINE ISA Note that stal l whic is an input p ort of ISA is witnessed an output port of PIPELINE this poin could mak use of the algorithm from Figure to hec the desired re nemen t. 10
Page 11
reactiv system PIPELINE input op opT yp inp gT yp sr c1 sr c2 dest gIndexT yp output out aluOut gT yp pip e1 pip e1T yp pip e2 pip e2T yp gFile gFileT yp stal l bool initialization pip e1 op := NOP pip e2 op := NOP forall do gFile ]:=0 transition pip e1 opr1 :=

if stal l then pip e1 opr1 elsif sr c1 pip e1 dest pip e1 op NOP pip e1 op STORE then if pip e1 op LO AD then pip e1 inp else aluOut elsif sr c1 pip e2 dest pip e2 op NOP pip e2 op STORE then pip e2 es else gFile sr c1 pip e1 opr2 := if stal l then pip e1 opr2 elsif sr c2 pip e1 dest pip e1 op NOP pip e1 op STORE then if pip e1 op LO AD then pip e1 inp else aluOut elsif sr c2 pip e2 dest pip e2 op NOP pip e2 op STORE then pip e2 es else gFile sr c2 pip e1 op := if stal l then NOP else op pip e1 dest := dest pip e1 inp := inp aluOut := if pip e1 op AND then opr1 opr2 elsif pip e1 op OR then

opr1 opr2 else nondet pip e2 op := pip e1 op pip e2 dest := pip e1 dest pip e2 es := if pip e1 op AND pip e1 op OR then aluOut elsif pip e1 op LO AD then pip e1 inp else pip e2 es regFile pip e2 dest ]:= if pip e2 op AND pip e2 op OR pip e2 op LO AD then pip e2 es else gFile pip e2 dest out := gFile dest stal l := op STORE pip e1 op NOP pip e1 op STORE dest pip e1 dest op STORE pip e2 op NOP pip e2 op STORE dest pip e2 dest Figure 5: Three-stage pip eline 11
Page 12
transition pip e1 opr1 := if stal l then isaR gFile sr c1 else nondet pip e1 opr2 := if stal l then isaR gFile sr c2

else nondet pip e2 es := if pip e2 op 2f AND OR LO AD then isaR gFile pip e2 dest else nondet Figure 6: Abstract de nitions of pip eline signals Ho ev er, w eare in terested in a oiding state explosion b y decomp osing the re nemen t question in to questions of less complexit y using the assume-guaran tee rule. In the follo wing, for set of ports, denote the slice of reactiv system ], and write for the comp osition of reactiv systems. Since out is the output port in common bet een PIPELINE and ISA ,w e attempt to pro the correctness of the slice ISA out ]. e use the second w eak decomp osition

rule and attempt to sho w that PIPELINE out ISA out ]. Ho ev er, the pro of fails b ecause out dep ends on gFile in PIPELINE and on isaR gFile in ISA Both gFile and isaR gFile are inputs to the slice PIPELINE out ], and therefore ary indep enden tly in nondeterministic add the de nition of gFile and isaR gFile to the left-hand-side using the third w eak decomp osition rule, but in v ain, b ecause the c hec PIPELINE out gFile isaR gFile ISA out also fails. The reason no is that gFile dep ends on the ariables of the second pip eline stage, whic h are not constrained. e add the de nition of pip

e2 for this purp ose, but pip e2 dep ends on pip e1 and aluOut and pip e1 in turn dep ends on stal l Therefore, end up ha ving to add the whole implemen tation and pro e that PIPELINE out gFile isaR gFile pip e1 pip e2 aluOut stal l ISA out ]. Hence, this approac h still explores the en tire state space of the PIPELINE system and do es not yield an yadv an tage. So let us return to the ISA system with the in ten t of constructing abstract de nitions of some of its outputs, and using these to break up the pro of according to the strong decomp osition rule. strengthen the system ISA using the

abstraction rule, and add abstract de nitions for three outputs of PIPELINE pip e1 opr1 pip e1 opr2 ,and pip e2 es The transition functions for these de nitions are sho wn in Figure 6. The corresp onding initialization functions are nondeterministic; they do not constrain the de ned signals. Let ISA be the resulting sp eci cation, and as usual, add witnesses for the new unnamed input p orts to the implemen tation. The in tuition b ehind the abstract de nitions is as follo ws. Both pip e1 and pip e2 con tain con trol elds that include relev an parts of the instruction to be pro cessed, and data

elds that con tain data on whic the instruction op erates. e write reactiv de nitions for the data elds in terms of the con trol elds and the instruction register le isaR gFile or example, if the instruction in the third stage of the pip eline is going to up date the register le, then the up date ust already ha happ ened in the ISA when this instruction w as in the rst stage of the pip eline. Therefore, the v alue to b e written bac kin to pip e2 es can b e obtained directly from isaR gFile Similar in tuitions guide the abstract de nitions of pip e1 opr1 and pip e1 opr2 Note the incomplete

nature of the abstract de nitions. 12
Page 13
ISA pip e2 es PIPELINE out stall gFile isaR gFile pip e1 op pip e1 dest pip e1 inp pip e2 op pip e2 dest ISA out (b y mo del c hec king) ISA pip e1 opr1 pip e1 opr2 PIPELINE stall pip e1 op pip e1 dest pip e1 inp pip e2 op pip e2 dest pip e2 es aluOut isaR gFile ISA pip e2 es (b y mo del c hec king) ISA pip e1 opr2 pip e2 es PIPELINE stall gFile pip e1 op pip e1 dest isaR gFile pip e1 inp pip e1 opr1 pip e2 op pip e2 dest aluOut ISA pip e1 opr1 (b y mo del c hec king) ISA pip e1 opr1 pip e2 es PIPELINE stall gFile pip e1 op pip e1 dest

isaR gFile pip e1 inp pip e1 opr2 pip e2 op pip e2 dest aluOut ISA pip e1 opr2 (b y mo del c hec king) PIPELINE ISA (b y strong decomp osition) PIPELINE ISA (b y abstractio n) PIPELINE ISA (b y witnessing) Figure 7: Assume-guaran tee pro of that PIPELINE re nes ISA or example, the abstract de nition for pip e1 opr1 lea es the signal unsp eci ed when stal l is true The implemen tation of the signal, on the other hand, sp eci es a v alue at all times. The abstract de nitions describ ed ab o e allo w us to decomp ose the pro of of the whole pip eline, using the assume-guaran tee rule, in to the

three stages. The rst pro of obligation of Figure 7 sho ws the pro of of out in whic the abstract de nition of pip e2 es is used to constrain the input of the implemen tation register le. By using the abstract de nition of pip e2 es oid including aluOut pip e1 opr1 ,and pip e1 opr2 in the pro of of out The implemen tation of pip e2 es dep ends on the signals pip e1 opr1 and pip e1 opr2 The second pro of obligation of Figure sho ws ho the abstract de n tions of pip e1 opr1 and pip e1 opr2 are used to pro the abstract de nition of pip e2 es The abstract de nition of pip e1 opr1 is pro ed using

the abstract de nitions of pip e1 opr2 and pip e2 es The pro of of pip e1 opr2 is symmetric. This is sho wn in the third and fourth pro of obligations of Figure 7. Note the circularit in the last three pro of obligations, where eac signal on the righ t is used on the left to pro e the other t signals. All four pro of obligations in olv only p ortions of the PIPELINE system. Th us oid exploring the state space of the whole pip eline implemen tation. Creativ energy as required to come up with the abstract de nitions in Figure 6. Once these de nitions are written, the mec hanics of decomp osing

the pro of using the assume-guaran tee rule can b e automated. In particular, giv en the abstract de nitions, the to ol Mocha [AHM 98 ] is able to automatically pro duce and pro the four pro of obligations of Figure 7. or eac subpro of Mocha ho oses the slices on the left- hand-side using heuristics. Mocha also pro vides facilities for man ually erriding the automatic hoices. Ho ev er, no man ual o errides are necessary in this example. 13
Page 14
References [AH95] R. Alur and T.A. Henzinger. Lo cal liv eness for comp ositional mo deling of fair reactiv systems. In P .W olp er,

editor, CA V95: Computer-aide dV eri c ation , Lecture Notes in Computer Science 939, pages 166{179. Springer-V erlag, 1995. [AH96] R. Alur and T.A. Henzinger. Reactiv mo dules. In Pr dings of the 11th nnual Sym- osium on gic in Computer Scienc , pages 207{218. IEEE Computer So ciet y Press, 1996. [AHM 98] R. Alur, T.A. Henzinger, F.Y.C. Mang, S. Qadeer, S.K. Ra jamani, and S. asiran. Mocha mo dularit in mo del hec king. In A. Hu and M. ardi, editors, CA 98: Computer- aide eri c ation Lecture Notes in Computer Science, pages 521{525. Springer-V erlag, 1998. [AL93] M. Abadi and L. Lamp ort.

Comp osing sp eci cations. CM T ansactions on Pr gr amming anguages and Systems , 15(1):73{132, 1993. [AL95] M. Abadi and L. Lamp ort. Conjoining sp eci cations. CM T ansactions on Pr gr amming anguages and Systems , 17(3):507{534, 1995. [Eir98] A.T. Eiriksson. The formal design of 1M-gate ASICs. In G. Gopalakrishnan and P . Windley editors, FMCAD 98: ormal Metho ds in Computer-aide Design Lecture Notes in Computer Science 1522, pages 49{63. Springer-V erlag, 1998. [HLQR99] T.A. Henzinger, X. Liu, S. Qadeer, and S.K. Ra jamani. ormal sp eci cation and v eri - cation of a data o w pro cessor

arra .In Pr dings of the International Confer enc e on Computer- aide Design , pages 494{499. IEEE Computer So ciet y Press, 1999. [HQR98] T.A. Henzinger, S. Qadeer, and S.K. Ra jamani. Y ou assume, w e guaran tee: metho dology and case studies. In A. Hu and M. V ardi, editors, CA V98: Computer-aide dV eri c ation , Lecture Notes in Computer Science, pages 440{451. Springer-V erlag, 1998. [HQR99] T.A. Henzinger, S. Qadeer, and S.K. Ra jamani. Assume-guaran tee re nemen bet een di eren t time scales. In N. Halb ac hs and D. P eled, editors, CA V99: Computer-aide eri c a- tion , Lecture Notes in

Computer Science 1633, pages 208{221. Springer-V erlag, 1999. [HQR T98] T.A. Henzinger, S. Qadeer, S.K. Ra jamani, and S. T asiran. An assume-guaran tee rule for hec king sim ulation. In G. Gopalakrishnan and Windley editors, FMCAD 98: ormal Metho ds in Computer-aide Design Lecture Notes in Computer Science 1522, pages 421{432. Springer-V erlag, 1998. [MC81] J. Misra and K.M. Chandy . Pro ofs of net orks of pro cesses. IEEE T ansactions on Softwar Engine ering SE-7(4):417{426, 1981. [McM97] K.L. McMillan. A comp ositional rule for hardw are design re nemen t. In O. Grum b erg, editor, CA 97:

Computer-aide eri c ation Lecture Notes in Computer Science 1254, pages 24{35. Springer-V erlag, 1997. [McM98] K.L. McMillan. eri cation of an implemen tation of omasulo's algorithm y comp osi- tional mo del c hec king. In A. Hu and M. ardi, editors, CA 98: Computer-aide eri c ation Lecture Notes in Computer Science 1427. pages 110{121. Springer-V erlag, 1998. 14
Page 15
[McM99] K.L. McMillan. Circular comp ositional reasoning ab out liv eness. In L. Pierre and T. Kropf, editors, CHARME 99: Corr ct Har dwar Design and eri c ation Lecture Notes in Computer Science 1703, pages 342{345.

Springer-V erlag, 1999. 15