Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing...
Transcript of Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing...
![Page 1: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/1.jpg)
Formal Verification of Stack Manipulationin the SCIP Processor
J. Aaron Pendergrass
![Page 2: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/2.jpg)
High LevelI Challenges to developing capability
in formal methods:I Perceived high barrier to entry,I Specialized tools and jargon,I Need for a compelling but
attainable demonstration.
I Why we chose the SCIP processor:I Developed in house,I General purpose processor,I Simple design (∼5k lines VHDL),I No advanced processor features
(pipelining, out-of-orderexecution, etc.),
I For use in satellites ⇒ highreliability requirements.
September 24, 2010
![Page 3: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/3.jpg)
ScopeTrue Goal: To prove that the physical processor does what wewant,
Formal Specification
ACL2Model
EnglishDesign
DocumentVHDL Design Hardware
but . . .I proof tools work on an abstract model,I “what we want” is not formally defined.
Instead we prove that a model of the VHDL design meets certaincorrectness properties.
September 24, 2010
![Page 4: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/4.jpg)
ScopeTrue Goal: To prove that the physical processor does what wewant,
Formal Specification
ACL2Model
EnglishDesign
DocumentVHDL Design Hardware
but . . .I proof tools work on an abstract model,I “what we want” is not formally defined.
Instead we prove that a model of the VHDL design meets certaincorrectness properties.
September 24, 2010
![Page 5: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/5.jpg)
Approach
Embedding of VHDL in ACL2
I Focus on building a syntactic layer on ACL2 for easytranslation.
I Key Goals:I Incremental semantic refinements,I Direct manual translation of existing code,I Target for automated translation.
ACL2 Model of SCIP Design
I Test case for modeling framework.
I Translate VHDL code, then prove axiomatic summaries ofcomponents.
September 24, 2010
![Page 6: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/6.jpg)
VHDL Modeling Framework
Challenges
I Large semantic gap between VHDL and ACL2.I VHDL processes all execute at the same time.
I Human checkable translation.I Must match structure of original VHDL code.
SolutionI Use ACL2 (LISP) macros to wrap ACL2 implementation
behind VHDL like syntax.I Based primarily on Georgelin, et al., “A framework for VHDL
combining theorem proving and symbolic simulation.”
September 24, 2010
![Page 7: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/7.jpg)
Supported VHDL
EntitiesI Uses defstructure book to generate data type predicates,
accessors, updaters, etc.
I Nested components supported via copy-in/copy-out semantics.
ProcessesI Mapped to ACL2 functions.
I Generate theorems to guarantee some safety properties (e.g.,no writing to inputs).
September 24, 2010
![Page 8: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/8.jpg)
Supported VHDL
ArchitecturesI Generate a single function that is the composition of all
processes and subcomponent updates.
I Generate theorems to show processes are order independent.
But Wait. . .I Order independence isn’t sufficient to guarantee the
processes can be safely interleaved!
September 24, 2010
![Page 9: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/9.jpg)
Supported VHDL
ArchitecturesI Generate a single function that is the composition of all
processes and subcomponent updates.
I Generate theorems to show processes are order independent.
But Wait. . .I Order independence isn’t sufficient to guarantee the
processes can be safely interleaved!
September 24, 2010
![Page 10: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/10.jpg)
Supported VHDL
ArchitecturesI Generate a single function that is the composition of all
processes and subcomponent updates.
I Generate theorems to show processes are order independent.
But Wait. . .I Order independence isn’t sufficient to guarantee the
processes can be safely interleaved!
I Fine for combinatorial processes (all of SCIP).I Problem for sequential processes with shared state.
I But it is easy to change the macros to generate strongertheorems for guaranteeing determinism.
September 24, 2010
![Page 11: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/11.jpg)
Supported VHDL
Data Types
I Originally based on ACL2’s native integer type.I Easy for arithmetic, challenging for bit slicing operations
(concatenation, truncation, etc.).I Simplification of VHDL’s 9 valued logic:
U (uninitialized), X (undefined), 0 (strong drive, logic 0), 1,(strong drive, logic 1), Z (high impedance), W (weak drive,unknown value), L (weak drive, logic 0), H (weak drive, logic1), - (don’t care).
I Used a symbolic instruction representation to avoid complexbit operations.
I Became problematic as we added type checking because dataand instructions must traverse the same buses.
September 24, 2010
![Page 12: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/12.jpg)
Supported VHDL
Data Types
I Migrated to lists of logical symbolsI Operations such as truncation and concatenation become
structurally recursive.I Required very little modification to existing SCIP model
(mostly search and replace).
September 24, 2010
![Page 13: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/13.jpg)
SCIP Design
A Simple Forth Microprocessor
I Designed for managing scientific instruments on satellites.I Low power, light weight, low gate count.I 16 and 32 bit versions (16 is standard).
I No pipelining, No superscalar, No out-of-order.
I Stack based design inspired by the Forth language.
I Two stacks: parameter stack (P-stack) and return stack(R-stack).
I Instructions may specify multiple behaviors such as an ALUoperation, a P-stack modification, and a return.
September 24, 2010
![Page 14: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/14.jpg)
SCIP Instructions
Instructions Are Packed StructuresI Only 18 different kinds of instructions.
I ∼ 9356 different opcodes.
1011 1 01 010 0010
Basic ALU Instruction
Pop Return StackAfter Execution
Push Result On TopOf Operand Stack
Addition
00
Ignored
September 24, 2010
![Page 15: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/15.jpg)
SCIP Correctness Proofs
Parameter Stack Design
I Many instructions can include a stack operation (Push, Pop,Swap, or Nop).
I Processor stacks are represented by a set of data registers andtwo index registers.
I On 16 bit SCIP: 16 2byte data registers, 4bit index registers.
I If enabled,overflow/underflowmay triggerreading/writing mainmemory.
TOP
01
2
3
4
5
678
9
10
11
12
13
1415
OVERFLOW
September 24, 2010
![Page 16: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/16.jpg)
SCIP Correctness Proofs
Abstract Properties
I We’d like to show that the register ring actually implements astack.
I In particular we need to show that the instructions correspondto abstract stack manipulation operations.
I e.g., s −−−−→push(a)
(a . s)
I Model stacks using ACL2 lists (push ≡ cons).
I Focus on normal operation & detecting exception cases(overflow/underflow)
September 24, 2010
![Page 17: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/17.jpg)
Graphically
TOP
01
2
3
4
5
678
9
10
11
12
13
1415
OVERFLOW
4
3
2
1
0
15
14
13
12
September 24, 2010
![Page 18: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/18.jpg)
Actual TheoremParameter Stack Push ! Cons
(defthm scip push pstack cons(implies
(and (scip pstack inputs ready p st) (not (equal (scip reset st) 1))(not (rising edge (scip clk st))) (equal (scip stretch st) 0)(instr class stack (scip ir+ st))(equal (stack op (scip ir+ st)) *st push*)(std logic defined list p (scip ptopi+ st))(std logic defined list p (scip poveri+ st))(integerp n) (>= n 3))
(equal(scip get pstack regfile as list
(scip step (scip raise clock (scip step n n st))))(let ((p (scip ptopi+ st)) (o (scip poveri+ st)))
(cond((equal (std logic list to int p) (std logic list to int o))
(list (scip pnext+ st)))(t (cons (scip pnext+ st) (scip get pstack regfile as list st))))))))
September 22, 2010
September 24, 2010
![Page 19: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/19.jpg)
Actual TheoremParameter Stack Push ! Cons(defthm scip push pstack cons
(implies(and (scip pstack inputs ready p st) (not (equal (scip reset st) 1))
(not (rising edge (scip clk st))) (equal (scip stretch st) 0)(instr class stack (scip ir+ st))(equal (stack op (scip ir+ st)) *st push*)(std logic defined list p (scip ptopi+ st))(std logic defined list p (scip poveri+ st))(integerp n) (>= n 3))
(equal(scip get pstack regfile as list
(scip step (scip raise clock (scip step n n st))))(let ((p (scip ptopi+ st)) (o (scip poveri+ st)))
(cond((equal (std logic list to int p) (std logic list to int o))
(list (scip pnext+ st)))(t (cons (scip pnext+ st) (scip get pstack regfile as list st))))))))
September 22, 2010
If the SCIP is valid and in stable state,
September 24, 2010
![Page 20: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/20.jpg)
Actual TheoremParameter Stack Push ! Cons(defthm scip push pstack cons
(implies(and (scip pstack inputs ready p st) (not (equal (scip reset st) 1))
(not (rising edge (scip clk st))) (equal (scip stretch st) 0)(instr class stack (scip ir+ st))(equal (stack op (scip ir+ st)) *st push*)(std logic defined list p (scip ptopi+ st))(std logic defined list p (scip poveri+ st))(integerp n) (>= n 3))
(equal(scip get pstack regfile as list
(scip step (scip raise clock (scip step n n st))))(let ((p (scip ptopi+ st)) (o (scip poveri+ st)))
(cond((equal (std logic list to int p) (std logic list to int o))
(list (scip pnext+ st)))(t (cons (scip pnext+ st) (scip get pstack regfile as list st))))))))
September 22, 2010
If the SCIP is valid and in stable state,
then the P-stack at the next clock cycle, represented as a list...
September 24, 2010
![Page 21: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/21.jpg)
Actual TheoremParameter Stack Push ! Cons(defthm scip push pstack cons
(implies(and (scip pstack inputs ready p st) (not (equal (scip reset st) 1))
(not (rising edge (scip clk st))) (equal (scip stretch st) 0)(instr class stack (scip ir+ st))(equal (stack op (scip ir+ st)) *st push*)(std logic defined list p (scip ptopi+ st))(std logic defined list p (scip poveri+ st))(integerp n) (>= n 3))
(equal(scip get pstack regfile as list
(scip step (scip raise clock (scip step n n st))))(let ((p (scip ptopi+ st)) (o (scip poveri+ st)))
(cond((equal (std logic list to int p) (std logic list to int o))
(list (scip pnext+ st)))(t (cons (scip pnext+ st) (scip get pstack regfile as list st))))))))
September 22, 2010
If the SCIP is valid and in stable state,
then the P-stack at the next clock cycle, represented as a list...
... is equal to the original pnext register cons'ed onto the original
P-stack represented as a list
September 24, 2010
![Page 22: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/22.jpg)
Contributions
VHDL Modeling Framework
I Human readable/writable framework for modeling VHDL inACL2.
I Automates generation of basic sanity theorems.
I Supports incremental refinements of VHDL semantics withlittle damage to target system model.
SCIP Processor VerificationI Demonstration of framework viability.
I Models of nearly every functional entity of the SCIP processor.
I Significant correctness proof for key SCIP functionality (stackmanipulation).
September 24, 2010
![Page 23: Formal Verification of Stack Manipulation in the SCIP … Level I Challenges to developing capability in formal methods: I Perceived high barrier to entry, I Specialized tools and](https://reader031.fdocuments.us/reader031/viewer/2022030419/5aa642007f8b9ac8748e32ed/html5/thumbnails/23.jpg)
Future Work
Framework EnhancementI Improving auto-generated theorems (strength and proof
speed).
I Machine translation tool.
SCIP Specific Proofs
I Overflow and underflow behavior.I Proved correct detection of overflow/underflow condition.I Memory model and axiomatic definition of page relative
addressing begun.
I Return stack.
I End goal is full instruction set specification.
September 24, 2010