how do i use all this?. how do i use all this, really?
Post on 22-Dec-2015
223 views
TRANSCRIPT
How do I use all this?
How do I use all this, really?
How do I use all this, really?– Detailed step-by-step description of a
pipeline verification example
Outline
1 Informal Introduction
2 Formal Definitions Reactive Systems
Witnessed Refinement Proofs
Slicing Reactive Systems
Decomposing Refinement Proofs
3 Formal Example: Three-Stage Pipeline
4 Informal Example: Dataflow Processor Array
isaRegFile
op
inp
src1src2dest outstall isaOut
isaAlu
Specification: ISA
isaRegFileop
inp
src1src2dst outstal
lisaOut
isaAlu
load r1 1
xnor r2 r1 r1
store r2
r1 := 1
r2 := 0
out := 0
Notes:
1. Store instruction results in an output
2. Memory hierarchy is not represented
3. Why do we need “stall” ?
regFile
op
inp
src1
src2
dst
alu
P1 P2
out out
FETCH EXECUTE WRITE-BACK
regFile
op
inp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaAlu
Goal: Establish Pipeline refines ISA
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaAlu
need for “stall” in ISA
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaAlu
witnessed refinement
isaRegFile isaAlu
Limitation: State explosion
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaAlu
Why not decompose
proof?
regFile
op
inp
src1
src2
dst
alu
P1 P2
out out
FETCH EXECUTE WRITE-BACK
regFile
P2
out out
WRITE-BACK
alu
P1 P2
EXECUTE
regFile
op
inp
src1
src2
dst
P1
FETCH
isaRegFileop
inp
src1src2dst outstal
lisaOut
outout
isaAlu
Why not decompose
proof?
opinp
src1
src2
dst
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
outout
isaAlu
Why not decompose
proof?
opinp
src1
src2
dst
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
res
stall
p2op
p2dst
out
stall
isaAlu
Why not decompose
proof?
isaRegFileop
inp
src1src2dst outstal
lisaOut
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
isaAlu
Decompositon does not work!
isaRegFile
op
inp
src1src2dest outstall isaOut
isaAlu
isaRegFile
opr1
op
inp
src1src2dest outstall isaOut
opr2
res
isaAlu
p2dst
opr1
opr2
res
isaRegFile
opr1
op
inp
src1src2dst outstal
lisaOut
opr2
resp2dst
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
opr1
opr2
res
“out” proof isaAlu
isaRegFileop
inp
src1src2dststal
l
outout
isaAlu
opinp
src1
src2
dst
res
“out” proof
isaRegFileop
inp
src1src2dststal
l
regFile
outout
isaAlu
opinp
src1
src2
dst
res
“out” proof
isaRegFileop
inp
src1src2dststal
l
regFile
opinp
src1
src2
dst
out
res
stall
p2op
p2dst
out
stall
isaAlu
res
“out” proof
isaRegFileop
inp
src1src2dststal
l
resp2dst
regFile
op
src1
src2
dst
out
stall
p1op
p1dst
p2op
p2dst
out
stall
“out” proof isaAlu
isaRegFileop
inp
src1src2dststal
l
resp2dst
regFile
op
src1
src2
dst
out
stall
p1op
p1dst
p2op
p2dst
out
stall
outisaOut
“out” proof isaAlu
regFile
P2
out out
WRITE-BACK
isaRegFile
opr1
op
inp
src1src2dst outstal
lisaOut
opr2
resp2dst
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
opr1
opr2
res
“res” proof isaAlu
isaRegFile
opr1
op
inp
src1src2dststal
l
opr2
opinp
dst
res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
stall
opr1
opr2
res
“res” proof isaAlu
isaRegFile
opr1
op
inp
src1src2dststal
l
opr2
opinp
dst
res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
stall
opr1
opr2
res
res resp2dst
“res” proof isaAlu
alu
P1 P2
EXECUTE
isaRegFile
opr1
op
inp
src1src2dst outstal
lisaOut
opr2
resp2dst
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
opr1
opr2
res
“opr1” proof isaAlu
isaRegFileop
inp
src1src2dststal
l
opr2
resp2dst
regFile
opinp
src1
src2
dst
opr1
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
stall
opr2
res
“opr1” proof isaAlu
isaRegFileop
inp
src1src2dststal
l
opr2
resp2dst
regFile
opinp
src1
src2
dst
opr1
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
stall
opr2
res
“opr1” proof
opr1opr1
isaAlu
regFile
op
inp
src1
src2
dst
P1
FETCH
FETCH
EXECUTE
WRITE-BACK
isaRegFile
opr1
op
inp
src1src2dst outstal
lisaOut
opr2
resp2dst
regFile
opinp
src1
src2
dst
out
opr1
opr2res
stall
p1inp
p1op
p1dst
p2op
p2dst
alu
out
stall
opr1
opr2
res
isaAlu
But..
But.. is this really practical?
But.. is this really practical?– Verification of VGI multiprocessor
Outline
1 Informal Introduction
2 Formal Definitions Reactive Systems
Witnessed Refinement Proofs
Slicing Reactive Systems
Decomposing Refinement Proofs
3 Formal Example: Three-Stage Pipeline
4 Informal Example: Dataflow Processor Array
VGI
• VGI = “Video-Graphics-Image”• Designed by Infopad group at
Berkeley • Purpose: web-based image
processing• Designed using
– VHDL (control) – Schematics (Data path)
VGI Architecture
• 16 clusters with 6 processors in each - 4 compute, 1 memory, 1 I/O
• ~30K logic gates per processor• ~800 latches per processor• Pipelined compute processors• Low latency data transfer between
processors - complex control
VGI Architecture
Complex handshakepipeline
pipeline pipeline
pipeline
pipeline
FIFO buffer
ISA
ISA
ISA ISA
ISA
Complex handshakepipeline
pipeline pipeline
pipeline
pipeline
Verification
• Different time scales• Implementation
– two-phase clock– level-sensitive latches – activity on both HI and LO phases of
clk
• Specification – no clk signal
S
I
Sample Operator
I’ = Sample I at
Runs of I’ = Runs of I sampled at instances where holds
pipeline
pipeline pipeline
pipeline
pipeline
clk
ISA
ISA
ISA ISA
ISA
Difficulty - Verification
• Size of the VGI chip – ~800 latches in each compute
processor– 64 compute processors
• Need “divide and conquer”
Step 1: Network of Processors to Single Processor
pipeline
pipeline pipeline
pipeline
pipeline
clk
ISA
ISA
ISA ISA
ISA
pipeline
clk
ISA
pipeline
pipeline pipeline
pipeline
pipeline
clk
ISA
ISA
ISA ISA
ISA
pipeline
clk
ISA
pipeline
pipeline pipeline
pipeline
pipeline
clk
ISA
ISA
ISA ISA
ISA
pipeline
pipeline
pipeline
ISA
ISA
ISAISA
ISA
pipeline
pipeline
clk
clk
clk
clkclk
Step 2: Single Processor
• Single processor still has ~800 latches• Need “divide-and-conquer” again
ISA
pipeline
clk
CommStage
PIPE
ALUGateLevel
REGFILE
ALUSpec
ISA REGFILE
FIFObuffer
OPGEN
Input from upstream processor
Input from upstream processor
clk
VGI Results
• All lemmas (exceptALU) checked by Mocha in a few minutes
• 3 bugs in communication control found and fixed
• Abstract definitions crucial - designer insight needed