ProgramVerificationandHardwareSynthesis 1 ProgramVerication HardwareSynthesis and Acommonapproachtohardwaredesignisto writeaprograminahardwaredescription languageandthencompileittoastatemachine usingasynthesissystem.somecorrectness programminglevelandestablishedbyprogram propertiesarenaturallyexpressedatthe intermsofthestatetransitionsofthesynthesised vericationmethods,butothersarebestspecied properties,andthendiscusshowtheycanbecan machine.iwillgiveexamplesofbothkindsof beveriedusingatheorem-prover. Thistalkisintendedforageneralaudience. MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 2 (FromKurtKeutzer'spaperinFMCAD'96) SynthesisDesignFlow MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 3 RegisterTransferLevel CurrentlyRTListhe`workhorse'level {lowerlevelsforeeexperts TwoviewsofRTL: {higherlevelsstillexperimental {programming(hdl) Specicationandvericationneededwith {statemachine(structure) respecttobothviews {programvericationforsomeproperties {statespaceanalysisforothers MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 4 Verication Traditionalvericationusessimulation {eventsimulation Formalvericationusesautomatedproof {cyclesimulation {booleanequivalencechecking usesobddsetc {modelchecking nowstandard checkspropertiesofstatemachines {theoremproving currentlyusedbyintel,ti,hpetc usespowerfulundecidablelogics longtermpromise Reasonsforformalverication stillaresearcharea {commercial:betterdebugging {safetycritical:savelives {securitycritical:ensureprivacy/secrecy MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 5 RestofTalk MainlyRTLVerication Combine: {ideasrelevanttobehaviouralleveltoo {programverication HDLsemantics {statemachineanalysis Discussionofneededtheoremproversupport {basedonsimplehardwaresynthesis SomerelatedcurrentresearchatCambridge {methodology,notdetails MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 6 ProgramSpecication Hoaretriples: fpreconditiongprogramfpostconditiong Semantics(totalcorrectness): {ifthepreconditionholds {thentheprogramterminates Example:asimpledivisionprogram {inastateinwhichthepostconditionholds (XdividedbyYgivesquotientQ&remainderR) fy>0g beginr=x;q=0; while(y<r) (precondition) begin end Q=Q+1; R=R-Y; fx=r+yq^r<yg end (postcondition) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 7 ProgramLogic MuchknowledgeaboutverifyingHoaretriples {establishinginvariants {terminationvia`variants' Standard {weakestpreconditions {taughttoundergraduates Nicetomechanise {textbooks {vericationconditions MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 8 HardwareversusProgram Continuouslyrunning Calculationsmayspreadoverseveralcycles { always<statement> Needinput/outputprotocol, { @CLOCK<statement> variouspossibilities: {tri-statebus {handshake,e.g: tostartassertstart=1 deviceavailablewhenbusy=0 resultsonqandrwhennextbusy=0 MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 9 DivisionProgram+I/O always@clock if(start) begin R=X;Q=0; BUSY=1; X=In1;Y=In2; while(y<r) begin R=R-Y; Q=Q+1; @CLOCK end BUSY=0; end Start,Inp1,Inp2controlledbyenvironment X,Y,Q,R,BUSYcontrolledbyprogram deviceavailablewhenbusy=0 (initially0) tostartcomputationassertstart=1 resultsonqandrwhennextbusy=0 MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 10 Control+Data HDLprogramspeciesamachine: MDIV def =always@clock if(start) begin BUSY=1; X=In1;Y=In2; SDIV end BUSY=0; thatcontainsanembeddedprogram: SDIV def = while(y<r) R=X;Q=0; begin @CLOCK end R=R-Y; Q=Q+1; MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 11 SpecifyingPropertiesofMachines Machinesdeterminesequencesofstates EnvironmentprovidesvaluesforIn1,In2 {oneforeachcycle Readinputs&updatestateeveryclocktick Variablesrangeoversequencesofvalues (RTLbehaviour) propertiesofsequences Temporaloperatorsspecify 2(Y>0) 3(X=R+(YQ)) valueofyalwaysgreaterthan0 sometimexwillequalr+(yq) ifbusy=1thensometimelaterbusy=0 2(BUSY=1) 3(BUSY=0)) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 12 CorrectnessofHDLDivider Needtoshow: IfStartisassertedwhenBUSY=0then: {Inp1andInp2readduringthatcycle {eventuallybusybecomes0again Cansplittheseinto: { X=R+YQ^R<YwhennextBUSY=0 { programcorrectness(hoarelogic) fy>0g fx=r+yq^r<yg SDIV {controlcorrectness(temporallogic): BUSY=1,controlinsideSDIV and 2(BUSY=1) 3(BUSY=0)) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 13 MakingCyclesExplicit WithrespecttoanHDLprogram: always@clock if(start) begin BUSY=1; X=In1;Y=In2; SDIV end BUSY=0; HowdoweinterpretHoaretriples: fy>0gsdivfx=r+yq^r<yg andtemporalformulas 2(BUSY=1) BUSY=1,controlinsideSDIV 3(BUSY=0)) Answer: converthdltoastatemachine MikeGordon theninterpretw.r.t.input/statesequences www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 14 SynthesisSemantics HDLsemantics=translationtomachine Denitionalsynthesis {notoptimisedimplementation! {c.f.denitionalinterpretersfor Doesn'trevealIPofproprietarytools programminglanguages {approachbeingusedtodenesemanticsof {i.e.`synopsyssubset' synthesisableverilog Engineerfriendly (Synopsysarehelping) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 15 CompilingtoStateMachines Introducea`programcounter'pc {intialisedto0 {encodescontrolstate Symbolicallyexecute {onestateforeach@clock {fromeach@clock Example {tonext@clock always@clock begin X=Inp; (State0) end @CLOCK X=X+1; (State1) compilesto(usingverilog-likenotation) case(pc) endcase 0: 1: pc=1kx=inp pc=0kx=x+1(parallelassignment) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 16 AnotherSequencingExample always@clock begin X=Inp1;Y=X+Inp2; (State0) end @CLOCK OUT=X+Y; (State1) compilesto case(pc) 0: X =1 1: Y OUT=OUT pc =Inp1+Inp2 X =X =0 endcase k OUT=X+Y Y =Y MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 17 ConditionalExample always@clock begin if(choose)x=in1;elsex=in2; (State0) end OUT=X+1; @CLOCK (State1) compilesto case(pc) 0: =Choose?In1:In2 =1 1: X OUT=OUT pc =0 endcase k OUT=X+1 MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 18 WhileExample:divider always@clock if(start) beginx=in1;y=in2;busy=1; (State0) while(y<r) R=X;Q=0; begin @CLOCK R=R-Y;Q=Q+1; (State1) end compilesto end BUSY=0; case(pc) 0: pc=start?in2<in1?1:0:0 X=Start?In1:X Y=Start?In2:Y R=Start?In1:R 1: pc=y<(r-y)?1:0 BUSY=Start?In2<In1?1:0:BUSY Q=Start?0:Q X=X Y=Y R=R-Y endcase k Q=Q+1 BUSY=Y<(R-Y)?BUSY:0 BUSY=1,controlinsideSDIV cannowbeinterpretedas MikeGordon 2(BUSY=1, pc=1) www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 19 Divider+morestates always@clock if(start) beginx=in1;y=in2; (State0) BUSY=1; @CLOCK R=X;Q=0; (State1) while(y<r) begin (State2) @CLOCK R=R-Y; (State3) end Q=Q+1; (State4) end BUSY=0; Allocatingoperationstostatesis Functionalspecicationunchangedby behaviouralsynthesis additionalstates MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 20 CorrespondingMachine case(pc) 0: X=Start?In1:X Y=Start?In2:Y pc=start?1:0 1: R=RkQ=Q pc=2 X=XkY=Y BUSY=Start?1:BUSY R=X 2: Q=0 X=XkY=YkR=RkQ=Q pc=y<r?3:0 BUSY=BUSY 3: BUSY=Y<R?BUSY:0 pc=4 X=XkY=Y R=R-Y 4: Q=Q X=XkY=YkR=R pc=y<r?3:0 BUSY=BUSY endcase k Q=Q+1 BUSY=Y<R?BUSY:0 BUSY=1,controlinsideSDIV cannowbeinterpretedas 2(BUSY=1, pc2f1;2;3;4g) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 21 ProgramProof+StateExploration Dataprocessingvericationvia ordinaryprogramlogic {mayrequirehumanguidedreasoning Controlcorrectnessviastatespaceof (e.g.guessinginvariants) synthesisedmachine {oftenautomatic(c.f.modelchecking) verication design = verication program + analysis machine MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 22 HoareLogicasTemporalLogic Hoaretriplescanbeinterpretedonmachine behaviours {roughly fpgsfqg is: Hoare-stylereasoningprinciplesderivable 2(P^pc2S)pc2SUntilQ^:pc2S) {forideas(appliedtoreal-time)see: M.J.C.Gordon,AmechanizedHoare Mind,FestschriftforProfessorC.A.R. logicofstatetransitions,inaclassical HoareeditedbyRoscoe,W., {forrtlhardwareseelecturenotesonweb Prentice-Hall,1994,pp.143-159. http://www.cl.cam.ac.uk/users/mjcg/ MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 23 TowerofSemanticAbstraction Everythingcanbereducedtopurelogic HoareTriple fpgsfqg 2(P^pc2S)pc2SUntilQ^:pc2S) TemporalLogic 8t:P(t)^pc(t)2S) RawLogic 9t0:t0>t^Q(t0)^:pc(t0)2S^ (8t00:t<t00^t00<t0)pc(t00)2S) PUntilQ meansqwilleventuallyholdtrue anduntilitdoespholds MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 24 HandlingMultipleDescriptions Needtorepresent {Hoaretriples {temporalformulas&statemachines {vericationconditions (couldinvolvecomplexarithmetic Needageneralpurposeformalism orevenrealanalysis{e.g.fp,dsp) {suitablefor`arbitrarymathematics' Severalgeneralsystemsexist {mechanizable {settheory {classicalhigherorderlogic (Isabelle/ZF,HOL-ST) {constructivetypetheory (PVS,HOL,Isabelle/HOL,IMPS) (Nuprl,Lego,Coq,Alf) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 25 PragmaticRequirements Combinegeneralframeworkwith`best Manydecisionproceduresknown practice'specialisedtools (hotresearcharea:cavetc.) {tautologies {lineararithmetic Partialdecisionprocedurescanoftenhandle {temporalproperties simplevericationconditions(cade) {inductiveproofs(boyer-moore,clam) {tableaumethods MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 26 ExistingApproachestoIntegration Add`trusted'externaloraclestogeneral proofsystem {OBDDandmodelcheckersforPVS {arithmeticdecisionprocedurestoisabelle Features: {LTLinHOL(Karlsruhe) {getstate-of-the-arteciency {onlyassoundastheoracle Ecientderivedrules {lowintegrationwithothertools {tableauproversinisabelle&hol Features: {lineararithmeticinhol {guaranteedsound {inecient(notasbadassomesay) {highintegrationwithothertools MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 27 (PROSPER) NewProject Attempttohaveourcakeandeatit {generalpurposesystem {cleanintegrationwithexternaloracles {supportforspecicapplications Approach {theoremprovenancetracking {startby`deconstructing'hol98 theorydatabase rewritingengine {deviseprotocolforexternaltools decisionproceduresandprovers interactiveshell Experiments: (maybeusexmltospecifydataformats) {linktosmvmodelchecker {linktonpprovertautologychecker Vapourware! {supportverilogandvhdl {butstrongteam::: (Cambridge,Glasgow,Karlsruhe,IFAD,NP) MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 28 GrandLong-TermGoals Useindustry-standardsyntax Developdierentsemanticviews {Verilog,VHDL,::: {familiartoengineers {compatiblewithstandarddesign& {mutuallyconsistent vericationows Providesemanticallycompatibletools {compilers,simulators,veriersetc. MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 29 OngoingResearchatCambridge SemanticsofsynthesisableVerilog (withabhijitghoshofsynopsys) {industrialstrengthsubset {simulation(event)semantics {state-machine(cycle)semantics {analysisofsyntacticconditionsfor {semanticsbasedtools eventandcyclesemanticstoagree SimulationcoreforVHDLandVerilog {commonsimulationcycle {rigorouslyspeciedandanalysed {applicationtoomi Hardwarecompilationworkbench {juststarted(darylstewart'sphd) {basedaroundianpage'shandellanguage {implementdesignmanipulationtools {comparehandel,verilogdesignows {postdoc:myravaninwegen MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 30 Conclusion Needdiversekindsofspecications Needdiversevericationtools {fordierentabstractionlevels {specialisedalgorithms Canembedspecicationsinpowerfullogics {generaltheorem-proving {givesuniedframework Softwarevericationmethodsusefulfor {buthardtopreserveeciency hardware {hardwareandsoftwaretheoriesmerging MikeGordon www.cl.cam.ac.uk/users/mjcg

ProgramVerificationandHardwareSynthesis 31 THE END MikeGordon www.cl.cam.ac.uk/users/mjcg