MDG-BASED VERIFICATION OF THE LOOK-ASIDE INTERFACE

Donglin LiDepartment ofElectrical and

Computer Engineering,Concordia University

Montreal, QC, H3G IM8, Canadaemail: ii don@ece.concordia.ca

Abstract

In this paper a formal verification of the Look-AsideInterface using MDG-based model checking technique ispresented. MDGs (Multiway Decision Graphs) are anextension of BDD-like data structures with a distinction ofconcrete sorts and abstract sorts. The Look-Aside Interface is amemory-mapped interface, targeted at devices that offloadcertain tasks from a network processing unit. A synthesizableRTL model in Verilog has been developed from the standardspecification of the Look-Aside Interface with the designproperties specified in a CTL-like specification languagecalled LMDG. An MDG model was also built in MDG-HDLlanguage, a Prolog-style hardware description language, fromthe RTL model. Finally LMDG properties were checked againstthe MDG-HDL model in the MDG model checker. Through ourexperiments, we showed a practical example of a full formalverification using MDGs.

Keywords. AIDG; model checking; Look-Aside Interface.

1. Introduction

Model checking is a formal method for automaticallyverifying correctness of finite state transition systems, whichhas been studied since early 1980's and several importantresults of which have been established [1] [2]. These earlymodel checking techniques were attractive because of theirhigh automation and little requirement for human effort toguide the proof process, whereas they usually suffered from thestate explosion problem and the size of the transition systemsthat could be verified were very limited. The introduction ofBryant's Binary Decision Diagrams (BDD's) [3] into theoriginal model checking algorithms led to a breakthrough inthe size of transition systems that could be handled. A numberof researchers have explored this BDD-based symbolictechnique in the field of model checking and have publishedresults of separated studies [4][5][6]. These symbolic modelchecking techniques provided exhaustive verification of asystem by implicitly representing a state space through the useof a symbolic representation [7] and could deal with largerdesigns than traditional model checking techniques but werestill not powerful enough for many real systems, when their

1-4244-0038-4 2006IEEE CCECE/CCGEI, Ottawa, May 2006

Otmane Ait MohamedDepartment ofElectrical and

Computer Engineering,Concordia University

Montreal, QC, H3G IM8, Canadaemail: ait@ece.concordia.ca

models were larger than 100000 states [8], due to the stateexplosion problem.

To deal with the state explosion problem of traditionalBDD-based symbolic model checking methods, a new MDG-based model checking approach is proposed by Corella et al.[9]. An MDG, standing for Multiway Decision Graph, is anextended BDD-like data structure with arbitrary number ofchildren for each node and with much more powerful labelingcapability for both the nodes and the edges. BDDs can beviewed as a special case of MDGs. In MDG-based approach,data signals are denoted by abstract variables instead ofBoolean variables, and data operators are represented byuninterpreted or partially interpreted function symbols insteadof Boolean functions. Thus, the verification based on abstractimplicit state enumeration can be carried out independently ofdata path width, which therefore can effectively alleviate thestate explosion problem.

The Look-Aside Interface (LA-1) [10], developed by theNetwork Processor Forum, is a memory-mapped interfacebased on QDR (Quad Data Rate) SRAM, targeted at devices(memories or coprocessors) that offload certain tasks from anetwork processing unit (NPU). The LA-1 Interface was firstverified by A.Habibi et al. [11] at both the behavioral level andthe RTL level, where the verification of the Verilog RTL LA-1design was performed using the RuleBase tool to model checkPSL properties. Later Donglin Li et al. [12] also formallyverified the LA-1 Interface at the RTL level using SymbolicTrajectory Evaluation, a model checking technique based on aform of quatemary symbolic simulation.

In this paper a formal verification of the LA-1 Interfaceusing MDG model checker is presented. A synthesizable RTLmodel in Verilog was first developed from the standardspecification of the LA-1 Interface. Based on the RTL model,an MDG model was also built in MDG-HDL language. Somesafety properties were extracted from the design specificationand captured later by properties in LMDG. Finally, in the MDGmodel checker, the MDG-HDL model was compiled into anabstract description of state machine (ASM) encoded internallyby MDGs and LMDG properties were then checked against theASM model.

The rest of the paper is organized as follows: Section 2describes MDG-based model checking technique. Section 3introduces the design specification and the RTL design of the

1064

Look-Aside Interface (LA-1 Standard). Section 4 explains theverification procedure of LA-1 Interface using MDG modelchecker. Section 5 contains the experimental results. Finally,we conclude our paper in Section 6.

2. MDG-based Model Checking

In MDG-based model checking, digital systems underverification are modeled by abstract descriptions of statemachines (ASMs), where both sets of states and relations are

encoded by MDGs. A CTL-like specification language calledLMDG is used to express the properties to be verified.

2.1. Logic

Whereas Boolean propositional logic is used in BDD-basedmodel checking approaches to model circuits at the bit level, a

more expressive logic is needed in the MDG-based method inorder to represent the circuits at higher level of abstraction.

The logic used in the MDG-based verification is a many-

sorted first-order logic [13] which separates the set of sorts intoclasses: the set of concrete (also called enumerated) sorts andthe set of abstract sorts, which makes possible the distinctionbetween data path and control path in hardware verification.

Concrete sorts have enumerations, while abstract ones donot. The enumeration of a concrete sort is a list of constants,called individual constants. The constants that do not show inany enumeration are generic constants of abstract sorts.Constants or variables may be of concrete sort or abstract sort.As a special case, the Boolean logic may be included in thislogic as a concrete sort with an enumeration over {O, 1 }.

Function symbols are classified into three types: concretefunction symbols (with a concrete result and concretearguments), abstract function symbols (with an abstract result),or cross-operators (with a concrete result and at least one

abstract argument). Both abstract function symbols and cross-

operators are uninterpreted, used to model data path operationsand feedback from data path to control, respectively. Concretefunction symbols are used to denote control path operations.

An interpretation, A, is an assignment of denotations to eachabstract sort. A concrete sort or a constant is itself a denotation.The truth semantics of a formula is defined relatively to an

interpretation and an assignment compatible to it.

2.2. From BDDs to MDGs

Reduced ordered BDDs (ROBDDs) offer canonicalrepresentations of Boolean formulas. Graph D in Figure 1

depicts the BDD for the Boolean formula (-,x A FO) v (x AF1),where Fo and F1 are the Boolean formulas represented by the

sub-graphs Do and D1 respectively.Alternatively, graph D can be viewed as representing a

formula ((x = 0) A FO) v ((x = 1) A Fl) in many-sorted first-order

logic. More generally, node a can range over a larger set ofvalues than {0, 1 } and can even range over abstract terms. It is

also possible that a cross operator can be a decision node in a

generalized decision graph. Three possible generalizations ofBDD D are shown in Figure 1 and the representing formula forgraph D' is shown below as an example, where Fo, F1 and F2are first-order formulas represented by the sub-graphs DO, D1and D2 respectively:

((X = 0) AFO) v (x = 2) AF1) V (X = 3) AF2).The above generalized decision graph D, D' and D"' are

examples of Multiway Decision Graphs (MDGs).A well-formed (reduced and ordered) MDG [9] is a

canonical graph representation of a quantifier-free andnegation-free many-sorted first-order formula, called DirectedFormula (DF) [14].

2.3. Modeling

In MDG-based model checking, digital systems underverification are modeled by abstract descriptions of statemachines (ASMs), where both sets of states and relations are

encoded by MDGs.ASMs describe state machines at a higher level of

abstraction. An abstract description of a finite state machine Mis a structure A = (VI, VS, VO, SI,RT, RO ), where VI, Vs and VOare sets of variables of input, state and output respectively, andSI, RT and RO are the abstract descriptions of the set of initial

states, the transition relation and the output relationrespectively.

For each interpretation A, one and only one state machine Mcan be obtained by applying Sto the abstract description A.

2.4. Specification Language

A specification language called LMDG is used to express theproperties to be verified in the MDG-based model checkingapproach. LMDG [15] is a CTL-like specification languagebased on many-sorted first-order logic, which is used todescribe properties for ASMs. ASMs extend the systemmodeling in BDD-based approaches from the propositionallevel to the first-order level. Similarly, LMDG extends CTL (aspecification language used in BDD-based approaches) fromthe propositional level to the first-order level.

Figure 1. From BDDs to MDGs

1065

N 5rt a{[% a3Aea ~ ~~ ~ ~ ~ ~ ~ ~ ~~~3rt{ 8

Ba:d aa I X a fr

~~eXt > X .f

Da i D D

3i3d Ahhtb2_Myral nVd36DI 3uortir ~aj

Ab*ajct tXf dfW ,f

D6 DI 06 D D

A Next let formula is the basic building block of a LMDGproperty. Given an ASM and a set of ordinary variables (notoccurring in the ASM), the recursive definition of aNext_let formula is as follows:

* An equation u1 = U2 is a Next_let_formula, if u1 is

an ASM variable and u2 is an ASM variable, anordinary variable, or a constant.

* f(notj),f& g (fand g),fI g (for g) andf->g (fimplies g) are Next let_formulas, if both f and g areNext let formulas.

* LET (V = U) IN f is a Next let formula, if v is anordinary variable, u is an ASM variable, and f is aNext_let_formula. We call this type of formulas LET-IN formulas.

* X f is a Next let formula, if f is a Next_let_formulaand X is the next-time operator.

Let p and q be Next let_formulas. A LMDG property isdefined of either of the following forms: A(p), AG(p), AF(p),A(p) U (q), AG( (p) > (F(q)) ), and AG( (p) > ((p) U (q))).

2.5. Verification Methodology

In general, the MDG-based model checking approach isbased on abstract implicit state enumeration (a reachabilityanalysis algorithm) [14]. Different property checkingalgorithms [16] are developed for LMDG formulas of variousforms. The basic idea is to use an automatic tool to buildadditional ASMs for the LMDG property to be verified, connectthe additional ASMs to the ASM model M representing thedesign under verification to make a new composite ASMmodel M', and then set an invariant condition to be checkedagainst M' during the reachability analysis of M'. If theinvariant holds in all the reachable states of M', we then provethat modelM satisfies the LMDG property.

3. Look-Aside Interface

3.1. Specifications

The LA-1 Interface transfers data between an NPU andmemory or coprocessors. Figure 2 shows the LA-1 Interfacebus signals. One LA-1 port consists of two input clocks (K andK#), which are rising-edge active and should be ideally 180degrees out of phase with each other, one active-low writeselect input W#, one active-low read select input R#, 2-bitactive-low byte-write inputs BW#[1:0], single address bus A,16-bit synchronous data inputs D[15:0] plus 2-bit synchronousdata parity inputs DP[1:0] for write operations, and 16-bitsynchronous data outputs DO[15:0] plus 2-bit synchronousdata parity outputs DPO[1:0] for reads.A write cycle is initiated by asserting W# low at the rising

edge of clock K. The write address should be ready at thefollowing rising edge of K# and data is captured at the risingedge ofK and K# in the same cycle.

KK#A[n:2]D[1 5:C]

NetworkDP[1:C] , Memory!Network DP[1:G] CoprocessorProcessor R#

BWV[1 :0]DO[15:C]DPO[1 :0]

Figure 2. LA-1 Interface buses

A read cycle is initiated by asserting R# low at the risingedge of K and the read address is captured at the same edge.Output data is delivered after the next rising edge of K.

3.2. LA-1 Interface RTL Design

A synthesizable RTL design shown in Figure 3 isimplemented in Verilog following the specification of the LA-1 Interface. As seen from the above diagram, The LA-1Interface RTL model consists of two parts: the Write PortController and the Read Port controller.

Note that, in this design, we use a Clock FrequencyDoubler to take the clock input K (clk k) and generate aninternal double-frequency clock clk 2x which is used as theonly clock for the LA-1 Interface circuit and a control signalpflag denoting the positive edge and the negative edge of clockclk_k. The rising edge of K and K# can be obtained bycombing clk 2x and pflag, in which case K is viewed as acontrol input. Thus, we can avoid using multiply clocks whichare not supported by the verification tools. The timing for theWrite Port, for example, is shown in Figure 4.

Based on the design specification we draw out thefollowing properties for the LA-I Interface RTL design:

Property 1 (Write Port): by asserting ws (W#) low atthe rising edge of clk 2x when pflag is high, if thebyte-write control inputs bwe[].O] (BW#[1:0]) are setto low, the full input data din[]5.O] will be capturedat the current and the next rising edges of clk 2x andsent to the memory through d2m[35.O] (data tomemory) at the next rising edge of clk 2x.

* Property 2 (Write Port): by asserting ws (W#) low atthe rising edge of clk 2x when pflag is high, theactive-low memory enable signal me will be set to lowat the next rising edge of clk 2x.

* Property 3 (Read port): by asserting rs (R#) low atthe rising edge of clk 2x when pflag is high, the datafrom the memory d m[35.O] will be sent out throughdout[]5.O] (DO[15:0]) after the next rising edge ofclk 2x.

1066

Figure 3. LA-1 Interface RTL design

Figure 4. Timing diagram for Write Port Controller

4. LA-1 Interface Verification using MDGModel Checker

In this section, we present the verification of the LA-1Interface using the MDG Model Checker [17], which istargeted to the verification of systems modeled by ASMs.

The LA-1 Interface RTL model is described, at a higherlevel of abstraction, in MDG-HDL [17], a Prolog-style HDLwhich allows the use of abstract variables and uninterpretedfunction symbols. The MDG-HDL code is then sent to theMDG Model Checker, where the design description iscomplied into an ASM encoded internally by MDGs. Designproperties specified in LMDG are also put into the MDG ModelChecker, where those LMDG properties can be used to checkthe ASM model. After each running the verification process,

MDG model checker returns Boolean value T if the property isverified, and returns Boolean value F otherwise.

4.1. Model

The MDG-HDL model for the Write Port Controller isillustrated in Figure 5, where signal din, bwe, addrin, d2m,addr_w, d, dp and d n are of abstract sort "wordn", the othersignals are of sort bool, and components make word, parity],parity2, parity3 andparity4 are uninterpreted function symbols.

The function of make word is to merge two input data intoone output data. The function of parity], parity2, parity3 orparity4 is to compute the parity of the input data.

A similar MDG_HDL model for the Read Port is also built.

4.2. LMDG Properties

The properties of the design are captured in form of LMDGproperties. The LMDG formulations of the three propertieswhich were described previously are given below:

* LMDG Property 1 for Propertyl:AG( (pflag= & ws=O & bwel= & bweO=O)->

(LET (vI =din) IN (X(LET (v2=din) IN(X(d2m = fmake_word(vl ,v2)))))));

* LMDG Property 2 for Property2:AG( (pflag= I & ws=O) -> ( XX(me = 1)));

* LMDG Property 3 for Property3:AG( ((pflag=l)&(rs=0))->

(XX (LET (vl=d_m) IN(X((dout=fmsw(v I)) & X(dout=flsw(v I)))))));

5. Experimental Results

All the three LMDG properties described above were verifiedusing MDG Model Checker. Note that MDG-based verificationfor the LA-1 Interface is independent of address width sincethe address input is of abstract sort.

Table I shows the memory usage, runtime and the numberof MDG nodes used for verifying each of the five LMDGproperties. As can be seen, the memory usages were very smalland the time complexity is not an issue since all the runs forthe three properties took less than two seconds.

6. Conclusions

This paper has shown a practical example of a full formalverification using MDG-based model checking technique.From the experiments, we can see that the presented MDG-based verification approach is memory efficient. It offers analternative to traditional symbolic model checking methodsthat may suffer from the state explosion problem where thedata path operations of the design under verification can beabstracted.

As future work, we consider performing equivalencechecking between the RTL level and the gate level MDG-HDLmodels of the LA-1 Interface.

1067

pflag

clk_2x

ws

addrin a

din

addr_w al

d2m dO&dl

me

Figure 5. MDG-HDL model for Write Port Controller

Table I. Model Checking results for LA-I Interface

Property Memory Runtime Number ofProperty (MB) (s) - Nodes1 1.7 0.8 23002 1.0 0.5 10193 3.0 1.7 5210

References

[1] 0. Lichtenstein and A. Pnueli. Checking that finite stateconcurrent programs satisfy their linear specification. InProceedings of the Twelfth Annual ACM Symposium on

Principles of Programming Languages, pages 97-107.Association for Computing Machinery, January 1985.

[2] E. M. Clarke, E. A. Emerson and A. P. Sistla. AutomaticVerification of Finite-State Concurrent Systems UsingTemporal Logic Specifications. In ACM Transactions on

Programming Languages and Systems, pages 244-263,April, 1986

[3] R. E. Bryant. Graph-based algorithms for boolean functionmanipulation. In IEEE Transactions on Computers, pages

677-691, August 1986.[4] 0. Coudert, C. Berthet, and J. C. Madre. Verification of

synchronous sequential machines based on symbolicexecution. In Automatic Verification Methods for FiniteState Systems, International Workshop, Grenoble, France,Springer-Verlag, June 1989.

[5] S. Bose and A. Fisher. Automatic verification ofsynchronous circuits using symbolic logic simulation andtemporal logic. In IMEC-IFIP International Workshop onApplied Formal Methods FOT Correct VLSI Design, 1989.

[6] J. R. Burch, E. M. Clarke, K. L. McMillan, and D. L. Dill.Sequential circuit verification using symbolic modelchecking. In Proceedings of the 27th ACM/IEEE DesignAutomation Conference, pages 46-51. IEEE ComputerSociety Press, June 1990.

[7] J. M. Scott. Efficient Verification of Multi-Processor Real-Time Systems Using Symbolic Methods. PhD thesis,Vanderbilt University, Nashville, Tennessee, 2003.

[8] S. Gnesi. Model checking of embedded systems.http://www.ercim.org, 2003.

[9] F. Corella, Z. Zhou, X. Song, M. Langevin, E. Cerny.Multiway Decision Graphs for Automated HardwareVerification. In Formal Methods in System Design, pages7-46, February 1997.

[10] Network Processing Forum. Look-Aside (LA- 1) Interface,Implementation Agreement, Revision 1.1. KluwerAcademic Publishers, April 15, 2004.

[11] A. Habibi, A.I. Ahmed, 0. Ait-Mohamed, S. Tahar. Onthe Design and Verification of the Look-Aside Interface.In Proc. IEEE/ACM Design Automation and Test inEurope (DATE'05), pages 649-654, Munich, March 2005.

[12] D. Li, A.I. Ahmed, O.A. Mohamed. STE basedverification of the look-aside interface. In CanadianConference on Electrical and Computer Engineering,pages 669-672, May 2005.

[13] Z. Zhou. Multiway decision graphs and their applicationsin automatic formal verification ofRTL designs. Ph.D.Thesis, Universite de Montreal, 1997; AAT NQ26757.

[14] E. Cerny, F. Corella, M. Langevin, X. Song, S. Tahar, Z.Zhou. Automated Verification with Abstract StateMachines using Multiway Decision Graphs. In FormalHardware Verification: Methods and Systems inComparison, pages 79-113, Springer Verlag, 1997.

[15] Y. Xu, E. Cerny, X. Song, F. Corella, 0. Ait-Mohamed.Model checking for a first-order temporal logic usingmultiway decision graphs. In Proc. of the InternationalConference on Computer-Aided Verification (CAV'98),Lecture Notes in Computer Science 1427, 219-231, 1998.

[16] Ying Xu. Model checking for a first-order temporal logicusing multiway decision graphs. Ph.D. Thesis, Universitede Montreal, 1999; AAT NQ52197.

[17] Y. Xu. MDG Model Checker User's Manual, Dept. ofInformation and Operational Research, University ofMontreal, Montreal, Canada, September 1999.

1068

ws E

clk_2x E

pflag E

dpinO

bwe1

bweO

correct parityy