Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of...
Transcript of Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of...
![Page 1: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/1.jpg)
Formal Validation and Verif ication of Networks-on-ChipsStatus and Perspect ive
Jul ien SchmaltzFreek VerbeekTom van den Broek
![Page 2: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/2.jpg)
Networks-on-Chips
• MPSoCs - Multi-Processors Systems-on-Chips• Trend: Networks replace buses
![Page 3: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/3.jpg)
MultiProcessor SoCs
• Intel’s 80-core Research Chip
• Teraflops, 62 Watts
• 100 millions transistors, 275 mm2
• 25% node area for router
• ASCI Red Supercomputer
• Teraflops (Dec. 1996)
• 10, 000 Pentium Pro
• 104 cabinets, 230 m2
![Page 4: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/4.jpg)
Motivation
• Networked based SoCs• Communication infrastructure crucial to system performance and
correctness• NoCs run under constrained environment
– limited heat budget– must work perfectly (e.g. no loss)
• Network architectures key to supercomputing• NoCs architectures key to on-chip supercomputing ?
![Page 5: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/5.jpg)
Global Objective
• Verified complex on-chip networks• General methodology to support the design of correct complex
on-chip network architectures
![Page 6: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/6.jpg)
In this talk
• Description of our target methodology• Recent results towards this target• Next steps towards our goal
![Page 7: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/7.jpg)
Part I
Our target
![Page 8: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/8.jpg)
Application domain
• Focus on the communication infrastructure / architecture• Highly parametric analysis
– size of the network– size of messages– topology– routing algorithm– switching policy– injection method– ...
• Prove global properties of networks– no message loss– no deadlock/livelock– evacuation– performance– ...
![Page 9: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/9.jpg)
Method elements
• Generic or meta-model– constituents– architectures– proof obligations and theorems
• Temporal abstractions– define maximum travel distance per time unit
![Page 10: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/10.jpg)
The GeNoC approach
GenericModel
Generic Theorems
ExecutableNoC Model
Instantiated Theorems
Deadlock freedom
Functional Correctness
Evacuation
specify
dischargeproof obligations
![Page 11: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/11.jpg)
The Generic Model: Constituents
Topology
Injection
Scheduler
Router
![Page 12: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/12.jpg)
The Generic Model: Proof obligations (or constraints)
Local constraints sufficient to prove global generic theorems.
Topology Router
InjectionScheduler
“R:PxPP”
“A message moves, unless it is stuck”
“All messages are injected at time slot 0”
“Sinks have no outgoing edges”
![Page 13: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/13.jpg)
The Generic Model: Generic theorems
Routing FunctionConstraints
Switching MethodConstraints
Injection PolicyConstraints
Generic Theorem
![Page 14: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/14.jpg)
The Generic Model: Generic theorems
Instantiated Theorem
Instantiated Constraints
Instantiated Constraints
Instantiated Constraints
Routing FunctionConstraints
Switching MethodConstraints
Injection PolicyConstraints
Generic Theorem
![Page 15: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/15.jpg)
The GeNoC Model: Architecture template
Let σ be a configuration containing a state and messagesLet M be a set of messages to be sent over the NoC
σ iff σ.M = ∅ // empty list of messages
σ iff deadlocked(Routing(Injection(σ)))
GeNoC(take-a-step(σ))
GeNoC (σ) =
![Page 16: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/16.jpg)
The Deadlock and Evacuation Theorems - DATE’10
• Deadlock Theorem– Routing function R is deadlock-free if and only if there is no
cycle in its port dependency graph
• Evacuation Theorem– All messages eventually leave the network if and only if
function GeNoC terminates
• New constraints– Ports dependency graph must be consistent with the routing
function (topology as well)– Scheduling policy must decrease the termination measure if
no deadlock – Injection methods injects all messages at time 0
• Application– Arbitrary large 2D-mesh with XY routing
![Page 17: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/17.jpg)
The Refinement Theorem - FMCAD’09
• Two architectures and a mapping between them– Source routing (route encoded in message)– Distributed routing (route computed step-by-step)– Function transform remove encoded route from messages
• The Refinement Theorem– For all states s and message lists m, we have– transform(GeNoC_S(s,m)) = GeNoC_D(s,m)
• New constraints– Encoded route matches step-by-step computation
• Application– Arbitrary large 2D-mesh with XY routing
• N.B.: use a different definition template !
![Page 18: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/18.jpg)
Method elements
• Generic or meta-model– constituents– architectures– proof obligations and theorems
• Temporal abstractions– define maximum travel distance per time unit
![Page 19: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/19.jpg)
The temporal abstractions (1): t ime = source to destination
Green chosen first and reaches its destination in one step
![Page 20: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/20.jpg)
The temporal abstractions (1): t ime = source to destination
Green chosen first and reaches its destination in one step
![Page 21: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/21.jpg)
The temporal abstractions (1): t ime = source to destination
Then blue reaches its destination in one step
![Page 22: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/22.jpg)
• Restrictions– No deadlock possible– Non minimal adaptive routing not possible
• Routes computed from source to destination• Scheduling decision from source to destination• Global Properties
– routes are valid– messages reach their expected destination
• Example– TDMA scheduling of AEthereal from NXP
The temporal abstractions (1)
![Page 23: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/23.jpg)
Messages advance of at most one hop in one step
The temporal abstractions (2): t ime = current to next
![Page 24: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/24.jpg)
Messages advance of at most one hop in one step
The temporal abstractions (2): t ime = current to next
![Page 25: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/25.jpg)
Messages advance of at most one hop in one step
The temporal abstractions (2): t ime = current to next
![Page 26: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/26.jpg)
Messages advance of at most one hop in one step
The temporal abstractions (2): t ime = current to next
![Page 27: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/27.jpg)
Messages advance of at most one hop in one step
The temporal abstractions (2): t ime = current to next
![Page 28: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/28.jpg)
• Deadlock possible• Routes computed from current to destination• Scheduling decisions from current to next• Global Properties (preserved)
– routes are valid– messages reach their expected destination
• Global properties (new)– no deadlock– no livelock– evacuation
• Still ...– Complete routes known at all times– Node reads neighbour to check available space
The temporal abstractions (2): t ime = current to next
![Page 29: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/29.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 30: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/30.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 31: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/31.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 32: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/32.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 33: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/33.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 34: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/34.jpg)
Messages cross at most one node in one step
The temporal abstractions (3): t ime = one router
![Page 35: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/35.jpg)
• Messages on links can be lost• Read signals to take decision• Routes computed from current to next• Scheduling decisions from current to next• Global properties (preserved)
– routes are valid– messages reach their expected destination– no deadlock– no livelock– evacuation
• Global properties (new)– no message lost– correctness of handshake protocol
The temporal abstractions (3): t ime = one router
![Page 36: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/36.jpg)
The temporal abstractions: Summary
s
d
s
d
s
d
in one step from source to destination
in one step from current to next
in one step from input to output
Routing: source to destination
Scheduling: source to destination
Routing: source to destination
Scheduling: current to next
Routing: current to next
Scheduling: current to next
![Page 37: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/37.jpg)
Find proof obligations sufficient to maintain stuttering (bi)simulations between the architecture templates of two abstraction levels
The temporal abstractions: objective
![Page 38: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/38.jpg)
Part I I
Temporal abstraction (2): t ime = one hop
![Page 39: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/39.jpg)
Architecture template at temporal abstraction (2)
Let σ be a configuration containing a state and messagesLet M be a set of messages to be sent over the NoC
σ iff σ.M = ∅ // empty list of messages
σ iff deadlocked(Routing(Injection(σ)))
GeNoC(Scheduling(Routing(Injection(σ))))
GeNoC (σ) =
inject messagesRoutesfrom current to destination
Advance ofone hop if possible
![Page 40: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/40.jpg)
Deadlock
![Page 41: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/41.jpg)
Deadlock
![Page 42: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/42.jpg)
Deadlock
![Page 43: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/43.jpg)
Deadlock
![Page 44: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/44.jpg)
Deadlock
Deadlock is an emerging property
![Page 45: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/45.jpg)
• There is no deadlock iff there is no configuration where all messages are blocked
• A message is blocked iff its next hop is full
• Deadlock-free theory:– there is no deadlock configuration iff the routing function has
an acyclic dependency graph
• New proof obligations about the dependency graph (G)1. Each dependency in the network is an edge in G2. All edges of G are dependencies3. Graph G is acyclic.
Deadlock generic theorem
![Page 46: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/46.jpg)
NoC example: 2D-mesh Hermes NoC
Routing:
XY Routing
Switching policy
Wormhole
Packet
Injection
Immediate
Topology
![Page 47: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/47.jpg)
• Specify XY routing algorithm
• Specify dependency graph
Specifying routing algorithm and dependency graph
Dependency: No dependency:
![Page 48: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/48.jpg)
• Prove graph acyclic– proof based on the concept of flows
Proving dependency graph acyclic (arbitrary large network)
North flow: • Increase the y-coordinate or• Stop
East flow: • Increase the x-coordinateor •Go into a vertical flowor• Stop
![Page 49: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/49.jpg)
Part I I I
Temporal abstractions (3) / Time = one router
![Page 50: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/50.jpg)
• Architecture template based on generic router• Source routing architecture• Distributed routing architecture• Refinement theorem
Temporal abstraction (3)
![Page 51: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/51.jpg)
Address
StatusFieldackRx
Rx
Data
Id PortName DirectionAddress
Port
Buffer
Data Output
StatusFieldackTx
Tx
Data
Id PortName Direction
Input Stage
Routing Control
Flow Control
Output Stage
Port
Buffer
Data Input
Architecture template at temporal abstraction (3): router model
![Page 52: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/52.jpg)
Architecture template at temporal abstraction (3) *
Let σ be a configuration containing a state and messagesLet M be a set of messages to be sent over the NoC
σ iff σ.M = ∅ // empty list of messages
σ iff deadlocked(Routing(Injection(σ)))
GeNoC(Apply-Router-All(σ))))
GeNoC (σ) =
Execute the router modelat all nodes
* We do not have exactly that model yet
![Page 53: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/53.jpg)
mlocal ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 10 1
E N L
Architecture (1): Source routing / route encoded in messages
![Page 54: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/54.jpg)
E N L
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 10 1
m
Architecture (1): routing decision read in messages
![Page 55: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/55.jpg)
N L
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 10 1
m
Architecture (1): new head of routes
![Page 56: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/56.jpg)
0 1
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 1
m
Architecture (2): Distributed routing
![Page 57: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/57.jpg)
0 1
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 1
m
Architecture (2): Distributed routing / local routing logic
![Page 58: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/58.jpg)
m
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
local ports
south
north
west east
0 0 1 0
1 10 1
Architecture (2): Distributed routing / local routing logic
![Page 59: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/59.jpg)
• Distributed routing architecture refinement of source routing one– Given the same inputs, produces same outputs– Messages use identical paths
• Function transform removes encoded route from messages
• Proved following diagram
Refinement theorem (1)
sr
dr
sr’
dr’
transform transform
source routing step
distributed routing step
![Page 60: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/60.jpg)
• Proof between generic models
• Main proof obligation – head of the pre-computed route = local calculation
Refinement theorem (2)
![Page 61: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/61.jpg)
Part IV
Next steps / current work
![Page 62: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/62.jpg)
• Deterministic routing– acyclic dependency graph iff no deadlock– Dally and Seitz (87’)
• Adaptive routing– exists subrouting function with acyclic extended dependency
graph iff no deadlock– adaptive routing function with cyclic dependencies are OK– Duato (93’)
• Formalized in ACL2 our own conditions– based on port dependency graphs– deterministic and adaptive routing– wormhole and store-and-forward networks– used temporal abstraction (2) / (S) = current to next
Formalizing theories for deadlock-free routing
![Page 63: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/63.jpg)
• Deterministic routing– acyclic dependency graph iff no deadlock– linear search for cycles is enough
• Adaptive routing in store-and-forward networks– exists routing subfunction with acyclic extended dependency
graph iff no deadlock (Duato)– all subgraphs have an escape iff no deadlock (our condition)– algorithm with time complexity in O(|E|)
• Adaptive routing in wormhole networks– algorithm for sufficient condition in O(|E|)– checking necessary and sufficient condition is NP-complete ?
• Implementations of algorithms still not efficient enough
Verif ied algorithm to prove these condit ions
![Page 64: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/64.jpg)
Part I I I
General Conclusion and Future Work
![Page 65: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/65.jpg)
Summary
• A meta-model– Local proof obligations imply global properties– Functional correctness, deadlock and evacuation– Generic constituents and concrete instances
• Expressed in math and in the logic of ACL2– Executable instances– Same models for proofs and simulations– Simulation traces comparable to RTL
• Wide range of applications– The HERMES NoC: academic design– Spidergon: industrial design– Nostrum (Grenoble VDS group): non minimal adaptive routing
![Page 66: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/66.jpg)
Future Work
• Unification of definition templates
• Link with RTL– Refine until RTL (cycle accurate)– Relate temporal layers (next hop full = handshake fails)
• Deadlock– Implement algorithms to automatic analysis of instances– These algorithms are verified and efficient– Weaken injection method’s proof obligation– Refine termination measure (bound on evacuation time)
![Page 67: Formal Validation and Verification of Networks-on-Chips · Formal Validation and Verification of Networks-on-Chips Status and Perspective Julien Schmaltz Freek Verbeek ... (Grenoble](https://reader033.fdocuments.us/reader033/viewer/2022042322/5f0bdbb57e708231d4328fb5/html5/thumbnails/67.jpg)
THANKS !!