A Framework for Asynchronous Circuit Modeling and Verification in - - PowerPoint PPT Presentation

▶
a framework for asynchronous circuit modeling and
SMART_READER_LITE
LIVE PREVIEW

A Framework for Asynchronous Circuit Modeling and Verification in - - PowerPoint PPT Presentation

Feb 02, 2023 248 likes •767 views

A Framework for Asynchronous Circuit Modeling and Verification in ACL2 Cuong Chau 1 , Warren A. Hunt, Jr. 1 , Marly Roncken 2 , and Ivan Sutherland 2 { ckcuong,hunt } @cs.utexas.edu, marly.roncken@gmail.com, ivans@cecs.pdx.edu 1 The University of

slide-1
SLIDE 1

A Framework for Asynchronous Circuit Modeling and Verification in ACL2

Cuong Chau1, Warren A. Hunt, Jr.1, Marly Roncken2, and Ivan Sutherland2

{ckcuong,hunt}@cs.utexas.edu, marly.roncken@gmail.com, ivans@cecs.pdx.edu

1 The University of Texas at Austin 2 Portland State University

November 16, 2017

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 1 / 26

slide-2
SLIDE 2

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 2 / 26

slide-3
SLIDE 3

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 3 / 26

slide-4
SLIDE 4

Introduction

Synchronous circuits (or clocked circuits): changes in the state of storage elements are synchronized by a global clock signal. Asynchronous circuits (or self-timed circuits): no global clock signal. The communications between storage elements are performed via local communication protocols.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 4 / 26

slide-5
SLIDE 5

Introduction

Synchronous circuits (or clocked circuits): changes in the state of storage elements are synchronized by a global clock signal. Asynchronous circuits (or self-timed circuits): no global clock signal. The communications between storage elements are performed via local communication protocols. Why asynchronous?

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 4 / 26

slide-6
SLIDE 6

Introduction

Synchronous circuits (or clocked circuits): changes in the state of storage elements are synchronized by a global clock signal. Asynchronous circuits (or self-timed circuits): no global clock signal. The communications between storage elements are performed via local communication protocols. Why asynchronous? Low power consumption, High operating speed, Elimination of clock skew problems, Better composability and modularity for large systems, ...

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 4 / 26

slide-7
SLIDE 7

Introduction

Our goal: developing scalable methods for reasoning about the functional correctness of self-timed systems using ACL2.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 5 / 26

slide-8
SLIDE 8

Introduction

Our goal: developing scalable methods for reasoning about the functional correctness of self-timed systems using ACL2. Using the DE system [Hunt:2000], which is built in ACL2, to specify and verify self-timed circuit designs.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 5 / 26

slide-9
SLIDE 9

Introduction

Our goal: developing scalable methods for reasoning about the functional correctness of self-timed systems using ACL2. Using the DE system [Hunt:2000], which is built in ACL2, to specify and verify self-timed circuit designs. Developing a hierarchical verification approach to support scalability.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 5 / 26

slide-10
SLIDE 10

Introduction

Our goal: developing scalable methods for reasoning about the functional correctness of self-timed systems using ACL2. Using the DE system [Hunt:2000], which is built in ACL2, to specify and verify self-timed circuit designs. Developing a hierarchical verification approach to support scalability. Exploring strategies for reasoning with non-deterministic circuit behavior.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 5 / 26

slide-11
SLIDE 11

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 6 / 26

slide-12
SLIDE 12

The DE System

DE is a formal occurrence-oriented hardware description language developed in ACL2 for describing Mealy machines [Hunt:2000].

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 7 / 26

slide-13
SLIDE 13

The DE System

DE is a formal occurrence-oriented hardware description language developed in ACL2 for describing Mealy machines [Hunt:2000]. The DE system supports hierarchical verification: Prove the following two lemmas hierarchically for each module: a value lemma specifying the module’s outputs and a state lemma specifying the module’s next state.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 7 / 26

slide-14
SLIDE 14

The DE System

DE is a formal occurrence-oriented hardware description language developed in ACL2 for describing Mealy machines [Hunt:2000]. The DE system supports hierarchical verification: Prove the following two lemmas hierarchically for each module: a value lemma specifying the module’s outputs and a state lemma specifying the module’s next state. If a module doesn’t have an internal state (purely combinational),

  • nly the value lemma need be proven.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 7 / 26

slide-15
SLIDE 15

The DE System

DE is a formal occurrence-oriented hardware description language developed in ACL2 for describing Mealy machines [Hunt:2000]. The DE system supports hierarchical verification: Prove the following two lemmas hierarchically for each module: a value lemma specifying the module’s outputs and a state lemma specifying the module’s next state. If a module doesn’t have an internal state (purely combinational),

  • nly the value lemma need be proven.

These lemmas are used to prove the correctness of yet larger modules containing these submodules, without the need to dig into any details about the submodules.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 7 / 26

slide-16
SLIDE 16

The DE System

DE is a formal occurrence-oriented hardware description language developed in ACL2 for describing Mealy machines [Hunt:2000]. The DE system supports hierarchical verification: Prove the following two lemmas hierarchically for each module: a value lemma specifying the module’s outputs and a state lemma specifying the module’s next state. If a module doesn’t have an internal state (purely combinational),

  • nly the value lemma need be proven.

These lemmas are used to prove the correctness of yet larger modules containing these submodules, without the need to dig into any details about the submodules. This approach has been demonstrated its scalability to large systems, as shown on contemporary x86 designs at Centaur Technology [Slobodova et al.:2011].

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 7 / 26

slide-17
SLIDE 17

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 8 / 26

slide-18
SLIDE 18

Modeling

No global clock signal Local communication protocols Non-deterministic behavior due to variable delays in wires and gates

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 9 / 26

slide-19
SLIDE 19

Modeling

No global clock signal ⇒ Adding local signaling to state-holding devices Local communication protocols Non-deterministic behavior due to variable delays in wires and gates

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 9 / 26

slide-20
SLIDE 20

Modeling

No global clock signal ⇒ Adding local signaling to state-holding devices Local communication protocols ⇒ Modeling the link-joint model introduced by Roncken et al., a universal communication model for various self-timed circuit families [Roncken et al.:2015] Non-deterministic behavior due to variable delays in wires and gates

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 9 / 26

slide-21
SLIDE 21

Modeling

No global clock signal ⇒ Adding local signaling to state-holding devices Local communication protocols ⇒ Modeling the link-joint model introduced by Roncken et al., a universal communication model for various self-timed circuit families [Roncken et al.:2015] Non-deterministic behavior due to variable delays in wires and gates ⇒ Employing an oracle, which we call a collection of go signals. These signals are part of the input.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 9 / 26

slide-22
SLIDE 22

The Link-Joint Model

We model self-timed systems as finite state machines (FSMs) representing networks of communication links. Links communicate with each other locally via handshake components, which are called joints, using the link-joint model.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 10 / 26

slide-23
SLIDE 23

The Link-Joint Model

We model self-timed systems as finite state machines (FSMs) representing networks of communication links. Links communicate with each other locally via handshake components, which are called joints, using the link-joint model. Links are communication channels in which data and full/empty states are stored. Joints are handshake components that implement flow control and data operations.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 10 / 26

slide-24
SLIDE 24

The Link-Joint Model

We model self-timed systems as finite state machines (FSMs) representing networks of communication links. Links communicate with each other locally via handshake components, which are called joints, using the link-joint model. Links are communication channels in which data and full/empty states are stored. Joints are handshake components that implement flow control and data operations. Joints are the meeting points for links to coordinate states and exchange data.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 10 / 26

slide-25
SLIDE 25

The Link-Joint Model

D0 S0

⊲ F D ⊳

fullin

  • Comb. Logic

fire drain D1 S1

⊲ F D ⊳

fill fullout Joint Link Link L0 L1

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 11 / 26

slide-26
SLIDE 26

The Link-Joint Model

D0 S0

⊲ F D ⊳

fullin

  • Comb. Logic

fire drain D1 S1

⊲ F D ⊳

fill fullout Joint Link Link L0 L1 A joint can have several input and output links connected to it. A joint can have multiple (guarded) mutually exclusive actions. Necessary conditions for a joint-action to fire: all input and output links

  • f that action are full and empty, respectively.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 11 / 26

slide-27
SLIDE 27

The Link-Joint Model

D0 S0

⊲ F D ⊳

fullin

  • Comb. Logic

fire drain D1 S1

⊲ F D ⊳

fill fullout Joint Link Link L0 L1 GO A joint can have several input and output links connected to it. A joint can have multiple (guarded) mutually exclusive actions. Necessary conditions for a joint-action to fire: all input and output links

  • f that action are full and empty, respectively.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 11 / 26

slide-28
SLIDE 28

The Link-Joint Model

fullin0 . . . fullinm ... GO fullout0 . . . fulloutn ... drain0 . . . drainm fill0 . . . filln

  • Comb. Logic

Din0 . . . Dinm Dout0 . . . Doutn

When a joint-action fires, three tasks will be executed in parallel: transfer data computed from the input links to the output links, fill the output links, make them full, drain the input links, make them empty.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 12 / 26

slide-29
SLIDE 29

Verification

Hierarchical reasoning: The output and next state of a module are formalized using the formalized outputs and next states of submodules, without delving into details about the submodules. Self-timed modules can be abstracted as “complex” links or “complex” joints.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 13 / 26

slide-30
SLIDE 30

Self-Timed Modules

Ci A B + Co S

A complex link: an adder

L0 L1

A complex joint: a queue of two links

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 14 / 26

slide-31
SLIDE 31

Verification

Multi-step decomposition reasoning: Functional properties of self-timed systems may involve multi-step executions that are quite burdensome to establish directly.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 15 / 26

slide-32
SLIDE 32

Verification

Multi-step decomposition reasoning: Functional properties of self-timed systems may involve multi-step executions that are quite burdensome to establish directly. Decompose the executions into sub-steps in such a way that sub-properties after executing each of these sub-steps can be carried

  • ut much easier.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 15 / 26

slide-33
SLIDE 33

Verification

Multi-step decomposition reasoning: Functional properties of self-timed systems may involve multi-step executions that are quite burdensome to establish directly. Decompose the executions into sub-steps in such a way that sub-properties after executing each of these sub-steps can be carried

  • ut much easier.

The desired properties are then established by simply composing these sub-properties.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 15 / 26

slide-34
SLIDE 34

Verification

Multi-step decomposition reasoning: Functional properties of self-timed systems may involve multi-step executions that are quite burdensome to establish directly. Decompose the executions into sub-steps in such a way that sub-properties after executing each of these sub-steps can be carried

  • ut much easier.

The desired properties are then established by simply composing these sub-properties. Induction: We apply induction to establishing loop invariants of iterative circuits, i.e., circuits with feedback loops in their dataflows.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 15 / 26

slide-35
SLIDE 35

Verification

Reasoning with highly non-deterministic behavior in iterative self-timed systems is very challenging. Computing loop invariants in these systems becomes much more complicated than in synchronous systems.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 16 / 26

slide-36
SLIDE 36

Verification

Reasoning with highly non-deterministic behavior in iterative self-timed systems is very challenging. Computing loop invariants in these systems becomes much more complicated than in synchronous systems. We impose design restrictions on iterative circuits to reduce non-determinism, and consequently reduce the complexity of the set of execution paths: These restrictions enable our framework to verify loop invariants efficiently via induction and subsequently verify the functional correctness of self-timed circuit designs.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 16 / 26

slide-37
SLIDE 37

Verification

Reasoning with highly non-deterministic behavior in iterative self-timed systems is very challenging. Computing loop invariants in these systems becomes much more complicated than in synchronous systems. We impose design restrictions on iterative circuits to reduce non-determinism, and consequently reduce the complexity of the set of execution paths: These restrictions enable our framework to verify loop invariants efficiently via induction and subsequently verify the functional correctness of self-timed circuit designs. Design restrictions: A module is ready to communicate with other modules

  • nly when it finishes all of its internal operations and becomes quiescent.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 16 / 26

slide-38
SLIDE 38

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 17 / 26

slide-39
SLIDE 39

We demonstrate our framework by modeling and verifying the functional correctness of a 32-bit self-timed serial adder. We prove that the self-timed serial adder indeed performs the addition under an appropriate initial condition. When the adder finishes its execution, the result is proven to be the sum of the two 32-bit input operands and the carry-in.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 18 / 26

slide-40
SLIDE 40

We demonstrate our framework by modeling and verifying the functional correctness of a 32-bit self-timed serial adder. We prove that the self-timed serial adder indeed performs the addition under an appropriate initial condition. When the adder finishes its execution, the result is proven to be the sum of the two 32-bit input operands and the carry-in. Multi-step decomposition reasoning: Divide the adder’s execution into two parts: the loop part and the exit part (the execution after exiting the loop), Formalize a loop invariant for the loop part and the adder behavior during the exit part, Prove the functional correctness of the adder by glueing these two parts together.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 18 / 26

slide-41
SLIDE 41

Dataflow of a 32-Bit Self-Timed Serial Adder

Shift-Reg0

1

  • 1
  • Shift-Reg1

1

  • 1
  • Ci

1

  • A

1

  • B

1

  • +

Co

1

  • S

1

  • 1
  • 1
  • 1
  • 1
  • 1
  • Shift-Reg2

32

  • App

33

  • Result

+1

5 1

  • 1
  • Cntl-State

5

  • Cntl-State’

5

  • Done-

1

5

  • go-a

go-b go-buf-cntl go-cntl go-add go-carry go-s go-result M1 M2 Full Full Full Full Full

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 19 / 26

slide-42
SLIDE 42

Correctness Theorems

Theorem 1 (Partial correctness). async serial adder(netlist) ∧ (1) init state(st) ∧ (2) (operand size = 32) ∧ (3) interleavings spec(input-list, operand size) ∧ (4) (st′ = run(netlist, input-list, st, n)) ∧ (5) full(st′.result.status) (6) ⇒ st′.result.data = st.shift reg 0.data + st.shift reg 1.data + st.ci.data

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 20 / 26

slide-43
SLIDE 43

Correctness Theorems

Theorem 2 (Termination). async serial adder(netlist) ∧ (1) init state(st) ∧ (2) (operand size = 32) ∧ (3) interleavings spec(input-list, operand size) ∧ (4) (st′ = run(netlist, input-list, st, n)) ∧ (5) (n ≥ num steps(input-list, operand size)) (6′) ⇒ full(st′.result.status)

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 21 / 26

slide-44
SLIDE 44

Outline

1

Introduction

2

The DE System

3

Modeling and Verification Approach

4

32-Bit Self-Timed Serial Adder Verification

5

Future Work and Conclusions

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 22 / 26

slide-45
SLIDE 45

Future Work

We are developing new proof techniques for partial correctness of self-timed circuit designs that DO NOT have any conditions on the values

  • f go signals.

Our new method does not impose the aforementioned design restrictions on loop-free circuits.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 23 / 26

slide-46
SLIDE 46

Future Work

We are developing new proof techniques for partial correctness of self-timed circuit designs that DO NOT have any conditions on the values

  • f go signals.

Our new method does not impose the aforementioned design restrictions on loop-free circuits. For termination proofs, we need a constraint on go signals guaranteeing that delays are bounded.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 23 / 26

slide-47
SLIDE 47

Future Work

We are developing new proof techniques for partial correctness of self-timed circuit designs that DO NOT have any conditions on the values

  • f go signals.

Our new method does not impose the aforementioned design restrictions on loop-free circuits. For termination proofs, we need a constraint on go signals guaranteeing that delays are bounded. We intend to follow a hierarchical approach to prove module-level properties of iterative circuits of the following form: Given an initial state of the module, the module’s final state meets its specification after that module completes execution.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 23 / 26

slide-48
SLIDE 48

Conclusions

We have presented a framework for modeling and verifying self-timed circuits using the DE system. Our goal is to develop a methodology that is capable of verifying the functional correctness of self-timed circuit designs at large scale. This work also provides a library for analyzing self-timed systems in ACL2. We model self-timed systems as networks of links communicating with each other locally via joints, using the link-joint model introduced by Roncken et al. We model the non-determinism of event-ordering in self-timed circuits by associating each joint with an external go signal. Our key proof techniques are hierarchical reasoning, multi-step decomposition reasoning, and induction.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 24 / 26

slide-49
SLIDE 49

References

  • W. Hunt (2000)

The DE Language Computer-Aided Reasoning: ACL2 Case Studies, Kluwer Academic Publishers Norwell, MA, USA, 151 – 166.

  • M. Roncken, S. Gilla, H. Park, N. Jamadagni, C. Cowan, I. Sutherland (2015)

Naturalized Communication and Testing ASYNC 2015, 77 – 84.

  • A. Slobodova, J. Davis, S. Swords, and W. Hunt (2011)

A Flexible Formal Verification Framework for Industrial Scale Validation MEMOCODE 2011, 89 – 97.

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 25 / 26

slide-50
SLIDE 50

Questions?

Chau et al. (UT Austin, PSU) Asynchronous Circuit Verification November 16, 2017 26 / 26