A Formalised Framework for Incremental Modelling of On-Chip Communication Peter B¨ ohm University of Oxford Computing Laboratory Designing Correct Circuits, March 2010
Introduction Motivation Goal ◮ Design of verified high-performance, on-chip communication protocols Problem ◮ Communication protocols traditionally hard to verify ◮ On-chip: increasing complexity (many-core architectures, System-on-Chips) ◮ High-performance: hard, advanced features to meet performance demands ◮ Fundamental: correct execution relies on correct data exchange Need for functional verification A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 2/33
Introduction Traditional Approach Traditional verification approach usually infeasible ◮ Complex, monolithic model ◮ High-performance features ◮ Distributed, concurrent communication system ◮ Hard post-hoc verification process ◮ large state space ◮ complex correctness property (features) monolithic monolithic model model (infeasible) proof spec spec work correctness correctness statement statement A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 3/33
Introduction Incremental Modelling and Verification Idea: use sequence of incremental modelling steps to replace monolithic model ◮ Basic model with core functionality ◮ Incrementally add features in a structured, well defined way ◮ Features modelled independently using transformations ◮ Complexity encapsulated model with basic model basic features + feature f 1 model { f 1 ,...,f n } A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 4/33
Introduction Incremental Modelling and Verification Idea: spread verification over modelling process ◮ Basic model verified using traditional approach (feasible due to model size) ◮ Show correctness of every modelling step ◮ Leverage previous correctness properties ◮ Reuse previously proven properties (lemmas) model with basic model basic features + feature f 1 model { f 1 ,...,f n } feasible feasible feasible proof proof proof work work work correctness correctness correctness statement statement statement A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 5/33
Introduction This Talk How to create a sequence of incremental models? ◮ Mathematical framework for incremental modelling ◮ Modelling approach ◮ Generic composition operators ◮ Specific transformations ◮ Formalisation in Isabelle/HOL How to apply the methodology? ◮ Overview of case study: PCI Express Transaction Layer ◮ Basic model ◮ Specific transformations A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 6/33
Mathematical Framework - Modelling Approach General Idea Model communications system components as state machines ◮ Mealy machines ◮ Define a generic structure for state space, input and output sets Extend state machines with model of communication and composition ◮ Introduce an interface standard for the inputs and outputs ◮ Provides basis for the model of composition Define generic transformations using composition operators A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 7/33
Mathematical Framework - Modelling Approach Mealy Machines Definition (Mealy Machine) A state machine is given by a 6-tuple ( S , I , O , s 0 , δ, ω ) where the components are given by ◮ S , I , O are the sets for state space, the inputs, and the outputs, respectively. ◮ s0 ∈ S is the initial state. ◮ δ : S × I → S is the step function of the automaton, thus δ ( s, i ) is the next configuration of the automaton with the configuration s and the input assignment i . ◮ ω : S × I → O is the output function of the automaton, thus ω ( s, i ) is the assignment of the output values if the state machine is in configuration s and the input assignment is i . A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 8/33
Mathematical Framework - Modelling Approach Records Sets of labelled tuples: structure the sets of a state machine ◮ Sets are collections of tuples ◮ Provide names for tuple components to access specific components Example (Record) Assume R = ( | a ∈ B , b ∈ B | ) with B = { T , F } . Then, ◮ R = B 2 ◮ a : B 2 → B with a (( x, y )) = x ◮ b : B 2 → B with b (( x, y )) = y ◮ Given r = ( | a = F , b = T | ) ∈ R , then r.a = a ((F , T)) = F A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 9/33
Mathematical Framework - Modelling Approach Records Definition (Record) A record set R = ( | l 0 ∈ S 0 , . . . , l i ∈ S i , . . . , l n ∈ S n | ) of ( n + 1) -tuples is a set R with R = { ( s 0 , . . . , s i , . . . , s n ) | ∀ j ∈ [0 , n ] . s j ∈ S j } = S 0 × . . . × S i × . . . × S n together with labelling functions l i : R → S i for each tuple component: l i (( s 0 , . . . , s i , . . . , s n )) = s i Notation: ◮ A record instance r ∈ R is given by ( | l 0 = s 0 , . . . , l i = s i , . . . , l n = s n | ) with s j ∈ S j for j ∈ [0 , n ] . ◮ Given a record instance r ∈ R , we write r.l i ∈ S i for l i ( r ) . A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 10/33
Mathematical Framework - Modelling Approach Communicating State Machines Goal ◮ Model communication between network components via channels. ◮ Specify operators for composing state machines . Uni-directional communication source destination out s .x inp d .y Ms Md inp d .y = out s .x = ( ω s ( s s , inp s )) .x ◮ Define communication as a global function over a set of state machines ◮ Component aggregates of input and output records A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 11/33
Mathematical Framework - Modelling Approach Component Aggregates of Records Example Assume RS = { R 0 , . . . , R n } with R i = ( | a ∈ B , b ∈ B | ) and n = 2 , then Agg ( RS ) = { r 0 .a, r 0 .b, r 1 .a, r 1 .b, r 2 .a, r 2 .b } Definition (Component Aggregate of Records) Given a set of records RS = { R 0 , . . . , R n } , we define the component aggregate of RS as Agg ( RS ) with Agg ( RS ) = { r i .x | r i ∈ R i ∧ ( ∃ j. x = l j ) } A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 12/33
Mathematical Framework - Modelling Approach Global Communication Function Communication among a set of state machines ◮ Global function mapping inputs to outputs. ◮ Semantics: every data element produced by the output is communicated to the input given by the function. ◮ An external input of a state machine gets defined by the output function of another state machine. Definition Given a set of state machines M = { M 0 , . . . , M n } with input records I i and output records O i . We define the communication as a partial function com M : Agg ( { I i | i ∈ [0 , n ] } ) → Agg ( { O i | i ∈ [0 , n ] } ) such that � out j .x : output x of M j is send to M i using input y com M ( inp i .y ) = undefined : otherwise A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 13/33
Mathematical Framework - Modelling Approach Global Communication Function: Example Example ◮ M = { M 0 , M 1 , M 2 } , M i = ( S i , I i , O i , s 0 i , δ i , ω i ) ◮ com M = { ( inp 1 .y, out 0 .x ) , ( inp 2 .p, out 0 .y ) , ( inp 2 .q, out 1 .z ) } M0 M1 inp 0 .z out 0 .x inp 1 .y inp 1 .u out 0 .y out 1 .z out 1 .v inp 2 .p inp 2 .q M2 A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 14/33
Mathematical Framework - Modelling Approach Interface Convention Simple handshake ◮ Introduce standard interface specification between components as basis for composition operators ◮ busy ∈ B , valid ∈ B , data ∈ D where D is the set of data elements to be communicated. busy busy s busy r valid sender valid s valid r receiver data data s data r Semantics ◮ If sender wants to send data element x : valid s = T and data s = x ◮ If busy r = F : receiver samples data in the same time step. ◮ If busy r = T : receiver is busy and cannot sample data. Sender has to provide data until busy r = F , or data is not communicated. A Formalised Framework for Incremental Modelling of On-Chip Communication, Peter B¨ ohm DCC 2010 15/33
Recommend
More recommend
