Processor model construction method and processor formal verification method
By constructing a processor model based on an abstract syntax tree and using the principle of self-consistency for verification, the problem of difficulty in single instruction error detection in existing technologies is solved, and rapid automatic generation and efficient formal verification are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI ADVANCED RES INST CHINESE ACADEMY OF SCI
- Filing Date
- 2023-09-27
- Publication Date
- 2026-07-07
AI Technical Summary
Existing formal verification methods for processors cannot effectively verify single-instruction errors, and as the complexity of the design being verified increases, the complexity of the verification problem also increases, leading to a decrease in verification efficiency and effectiveness.
By generating multiple instruction models, a processor model is constructed based on an abstract syntax tree and preset instruction templates, and the self-consistency principle is used for verification. Syntax parsing tools and model checking tools are used to achieve rapid automatic generation and verification.
It enables rapid automatic generation and comprehensive description of the processor, effectively detects defects in instructions and multi-instruction processing, improves verification efficiency and accuracy, reduces human error and the workload of writing attribute sets, and shortens verification time.
Smart Images
Figure CN117172166B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of processor verification technology, and in particular to a processor model construction method and a processor formal verification method. Background Technology
[0002] Processor functional verification constitutes a significant portion of chip design work, and formal verification is a commonly used technique in functional verification. Existing formal verification techniques mainly include formal verification based on the ISA (Instruction Set Architecture) model and formal verification based on general properties. A major problem with existing formal verification work based on the ISA model is that it only produces specifications or models for single instructions, lacking program-level modeling.
[0003] Formal verification based on the ISA model: The instruction set architecture model in the ISA model can be generated manually or automatically. Manually generating the ISA model requires writing the model manually based on the instruction set architecture of the processor being verified; this method is very time-consuming and cannot guarantee correctness. Automatically generating single-instruction-level models requires using general properties (i.e., self-consistent properties) to achieve formal verification of the processor. For example, Symbolic Quick Error Detection (SQED) is a novel pre-silicon verification technique that verifies self-consistent properties. SQED has been proven to quickly and effectively generate error execution waveforms, shortening the processor verification cycle. However, this method cannot detect single-instruction errors; and when the implementation being verified is complex, this method may affect the verification efficiency.
[0004] S 2 QED is a formal verification technique for complex instruction pipelines, introducing symbolic start states and new consistency concepts based on SQED. Compared to the serial instruction sequence structure of SQED, SQED... 2 QED employs a parallel instruction sequence structure. However, this method also has some problems. Because errors can have the same effect on both CPUs, such as errors in the data path of the CPU's arithmetic unit, S... 2 QED technology also cannot effectively verify single-instruction errors during verification. Similar to SQED, S... 2 The QED method also utilizes the design being verified itself for verification. However, as the complexity of the design being verified increases, the complexity of the verification problem also increases, thereby reducing the efficiency and effectiveness of verification. Summary of the Invention
[0005] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a processor model construction method and a processor formal verification method to solve the problems in the existing processor formal verification process, such as the inability to effectively verify single instruction errors, and the fact that the complexity of the verification problem increases with the complexity of the verified design, leading to a reduction in verification efficiency and effectiveness.
[0006] Firstly, this application provides a processor model construction method, including:
[0007] Based on the ISA specification of the processor to be verified, multiple instruction models are generated through an instruction model generation method. The instruction models are used to describe the semantics and behavior of the instructions in the processor to be verified.
[0008] Multiple instruction models are connected in parallel to form a processor body, and the processor body, together with read multi-select logic, write multi-select logic, registers, and memory, forms a multi-instruction Verilog description to obtain the processor model.
[0009] In one embodiment of the present invention, the instruction model is generated as follows:
[0010] In the syntax parsing tool, preset language lexical rules and preset language grammar rules are created, and the preset language lexical rules and preset language grammar rules form a grammar rule file;
[0011] A language recognition tool is used to parse the ISA specification of the processor to be verified based on the syntax rule file to obtain the abstract syntax tree corresponding to the instruction in the instruction set of the processor to be verified. The instruction in the instruction set and the abstract syntax tree have a one-to-one correspondence, and the abstract syntax tree includes the necessary instruction information of the corresponding instruction.
[0012] The nodes in the abstract syntax tree are traversed to store the node information in the abstract syntax tree into the corresponding record file according to the type;
[0013] Based on a preset instruction template, the node information in the record file corresponding to the abstract syntax tree is written into the instruction model file to generate the instruction model of the instruction corresponding to the abstract syntax tree.
[0014] In one embodiment of the present invention, the syntax parsing tool is ANTLRv4, and the language recognition tool is formed by the lexical analyzer and parser in ANTLRv4.
[0015] In one embodiment of the present invention, the preset language is Sail, the preset language lexical rules are Sail lexical rules, and the preset language grammar rules are Sail grammar rules.
[0016] In one embodiment of the present invention, storing the node information in the abstract syntax tree into corresponding record files by class includes:
[0017] Determine whether the node is a decoding function. If so, add the decoding information of the corresponding node to the instruction decoding mode record file and record the instruction type to the instruction type record file; otherwise...
[0018] Determine whether the node is an executed function and whether its operands are identified. If so, add the decoding information of the corresponding node to the instruction operand record file; otherwise...
[0019] Determine whether the node is an execution function and whether the operator is recognized. If so, add the decoding information of the corresponding node to the instruction opcode record file; otherwise, add the decoding information of the corresponding node to the instruction other information record file.
[0020] In one embodiment of the present invention, the processor body is connected to the read multi-select logic, the write multi-select logic and the register respectively, and the read multi-select logic and the write multi-select logic are also connected to the register and the memory respectively.
[0021] In one embodiment of the present invention, the preset instruction template includes annotation interface rules, instruction decoding rules, and execution rules;
[0022] The annotation interface rules are used to set the standard inputs and outputs of the instruction model;
[0023] The instruction decoding rules are used to perform pattern matching on the instruction bit vector of node information to obtain the decoding function. The decoding function is then subjected to syntax analysis to extract the valid basic instruction format and decoding information. The valid basic instruction format and decoding information are written into the decoding record file, and a Verilog decoding description is output based on the decoding record file.
[0024] The execution rules are used to define the execution process of instructions through execution clauses.
[0025] Secondly, this application provides a processor formal verification method, including:
[0026] A processor model of the processor to be verified is constructed using a processor model construction method.
[0027] The Verilog file of the processor to be verified and the Verilog file of the processor model are read in by a preset synthesis tool. The Verilog file of the processor to be verified is expanded into a processor architecture in a preset word-level model format. The Verilog file of the processor model is expanded into a processor model architecture in a preset word-level model format.
[0028] The processor architecture to be verified and the processor model architecture are verified using a model checking tool based on the principle of self-consistency.
[0029] In one embodiment of the present invention, the output terminal of the instruction fetch module in the processor to be verified is connected to a test generation module to replace the instruction fetch module in outputting instruction signals;
[0030] The test generation module is also used to provide instruction signals to the processor model.
[0031] In one embodiment of the present invention, solving the problem using the self-consistency principle includes:
[0032] During the verification process of the processor architecture to be verified and the processor model architecture by the model testing tool, it is determined in real time whether the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are the same. If so, it is determined whether the data in the register of the processor architecture to be verified is consistent with the data in the register of the processor model architecture. If so, it is re-determined whether the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are the same. Otherwise, it indicates that there is a counterexample in the processor to be verified, the corresponding counterexample waveform is output, and the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are re-determined.
[0033] In one embodiment of the present invention, the preset synthesis tool is the yosys tool, and the model detection tool is an SMT-based model detection tool.
[0034] Compared with the prior art, one or more embodiments of the above solutions may have the following advantages or beneficial effects:
[0035] The processor model construction method provided in this invention represents the instructions in the processor to be verified through instruction model generation, and constructs a processor model based on the generated instruction model. This achieves a conversion from Sail to Verilog, further realizing RTL-level abstraction of the processor, enabling a more comprehensive description of processor behavior. The obtained processor model provides code execution support, achieving rapid and automatic generation of the processor model. Compared to existing verification methods that use the design itself as a reference model, this method provides an abstract and simplified comparison model that effectively detects processor instructions and defects in multi-instruction processing. The processor formal verification method of this invention adopts a design-independent, universal attribute self-consistency verification approach, eliminating the need to design complex attribute sets, significantly reducing the workload of attribute set writing during formal verification, and effectively avoiding errors caused by human error during processor model construction, thus improving verification efficiency. Furthermore, this verification method avoids the need for comparison of execution results between processor instances in traditional methods, simplifying the reference from a specific processor to an abstract model, thereby accelerating the speed of formal verification.
[0036] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description
[0037] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0038] Figure 1 The diagram shown is a flowchart illustrating the processor model construction method described in an embodiment of this application.
[0039] Figure 2 The diagram shown is an architectural schematic of the processor model in the processor model construction method described in this application embodiment.
[0040] Figure 3 The diagram shown is a flowchart of the processor formal verification method described in an embodiment of this application.
[0041] Figure 4 The diagram shows a process schematic of the processor formal verification method described in the embodiments of this application.
[0042] Figure 5 The diagram shows a modification to the processor to be verified in the processor formal verification method described in this application embodiment.
[0043] Figure 6 The diagram shows the coverage of different types of defects by the processor formal verification method described in the embodiments of this application and SQED.
[0044] Figure 7 The diagram shows the average runtime of the processor formal verification method described in this application embodiment and the SQED method for discovering different types of defects.
[0045] Figure 8 The diagram shows the average memory usage of the processor formal verification method described in this application embodiment and the SQED method for discovering different types of defects. Detailed Implementation
[0046] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples, so that the process of how the present invention uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly. It should be noted that, as long as there is no conflict, the various embodiments and features in the various embodiments of the present invention can be combined with each other, and the resulting technical solutions are all within the protection scope of the present invention.
[0047] In automatically generated single-instruction-level models, System Verilog / Verilog is used to specify the expected behavior of each instruction in the ISA; all instruction operands are defined symbolically, allowing bounded model checking tools to compute the properties of all possible operands. Representative works include end-to-end verification frameworks based on ARM architecture and the RISC-V-formal verification project based on RISC-V architecture. Formal verification can be performed through general properties, specifically self-consistency properties. These properties indicate that, given a design instruction set architecture, executing two sequences of instructions with the same input must always produce the same output. This property is general and implementation-independent.
[0048] S 2 QED is a formal verification technique for complex instruction pipelines. It introduces symbol initialization states and a new consistency concept based on SQED. During the symbol state initialization phase, S... 2 QED instantiates the CPU into two copies (CPU-1 and CPU-2) and assigns them symbol register states. During the symbolic execution phase, CPU-1 executes the verified instructions in a cleaned pipeline context; CPU-2 executes the verified instructions in any context, including the context in which defects are activated and propagated. Finally, the QED consistency of CPU-1 and CPU-2 is compared to catch logical errors in the CPU. 2QED also introduces a state comparison-based error detection method, which can detect state differences between CPU-1 and CPU-2 and provide more accurate error localization. Compared to the serial instruction sequence structure of SQED, S2QED adopts a parallel instruction sequence structure design. However, this method also has some problems. Because errors can have the same impact on both CPUs, such as errors in the data path of the CPU's arithmetic unit, S... 2 QED technology also cannot effectively verify single-instruction errors during verification. Similar to SQED, S... 2 The QED method also utilizes the design being verified itself for verification. However, as the complexity of the design being verified increases, the complexity of the verification problem also increases, thereby reducing the efficiency and effectiveness of verification.
[0049] Many commercial EDA (Electronic Design Automation) tools offer formal property verification functionality, using model checking methods to verify whether the RTL implementation satisfies the properties to be proven. Formal property verification helps verifiers discover and fix errors during the design phase, improving design quality and reliability; it can also be used to verify the completeness of properties, i.e., whether all possible design behaviors are covered. Its advantage is that it can handle large-scale and complex designs without needing to write test cases or build test platforms, but it requires writing correct and valid properties and constraints. Formal methods using property sets for verification require extensive experience to write meaningful property sets, which are not universally applicable.
[0050] ISA (Instruction Set Architecture) is an abstraction layer that translates application programs for circuit hardware. It defines many rules and constraints for the operating system, allowing programmers to write programs at this abstract, high-level, rule-defined layer without worrying about the specific circuit structure. Currently, processor instruction set architectures on the market include x86, ARM, RISC-V, and MIPS.
[0051] The following embodiments of this application provide a processor model construction method and a processor formal verification method, which solve the problems in the existing processor formal verification process that cannot effectively verify single instruction errors, and that the complexity of the verification problem increases with the complexity of the verified design, resulting in reduced verification efficiency and effectiveness.
[0052] like Figure 1 As shown, this embodiment provides a processor model construction method, including the following steps:
[0053] Step S101: Based on the ISA specification of the processor to be verified, generate multiple instruction models through instruction model generation.
[0054] Specifically, the ISA specification of the processor to be verified is analyzed to determine its instruction set architecture type. Then, based on the instruction set architecture type, instruction models are generated for each instruction in the processor's instruction set using an instruction model generation method. It should be noted that the instruction model is used to describe the semantics and behavior of the instructions in the processor to be verified.
[0055] The instruction model generation method includes: first, creating preset language lexical rules and preset language grammar rules in a syntax parsing tool, whereby the preset language lexical rules and preset language grammar rules form a grammar rule file; then, using a language recognition tool, parsing the ISA specification of the processor to be verified based on the grammar rule file to obtain the structured abstract syntax tree corresponding to each instruction in the instruction set of the processor to be verified, that is, there is a one-to-one correspondence between instructions in the instruction set and abstract syntax trees, and the abstract syntax tree includes the necessary instruction information for the corresponding instruction; the necessary instruction information includes instruction type and instruction content, etc. Next, a traversal operation is performed on each abstract syntax tree to store the node information in each abstract syntax tree according to its type in the corresponding record file; finally, based on a preset instruction template, the node information in the record file corresponding to each abstract syntax tree is written into an instruction model file to generate the instruction model for the instruction corresponding to each abstract syntax tree.
[0056] In the above instruction model generation process, assuming the instruction set architecture of the processor to be verified is Sail RISC-V, the default language is Sail. Sail is a domain-specific language used to describe the semantics of the processor's instruction set architecture. Therefore, the default lexical rules are Sail lexical rules, and the default grammatical rules are Sail grammatical rules. The grammatical rule file is further generated as follows: Sail lexical rules and Sail grammatical rules (e.g., variable declarations, function statements, etc.) are created based on Sail RISC-V using the ANTLRv4 syntax parsing tool. Then, the grammatical rule file Sail.g4 is generated based on the Sail lexical rules and Sail grammatical rules. The generated instruction model is based on Sail RISC-V, ensuring the reliability and correctness of the specification.
[0057] In the process of generating the aforementioned abstract syntax tree, the lexical analyzer and parser in the ANTLRv4 syntax parsing tool can be used to generate a language recognition tool for Sail. It should be noted that lexical analyzers and parsers from other suitable syntax parsing tools can also be used to generate a language recognition tool for Sail.
[0058] The above-mentioned storage of node information in a single node into its corresponding class record file according to node type specifically includes: First, determining whether the node is a decoding function. If so, the decoding information of the corresponding node is added to the instruction decoding mode record file Ins.decodeFormat, and the instruction type is recorded in the instruction type record file Ins.type. If the node is not a decoding function, determining whether the node is an execution function and whether the operand is recognized. If so, the decoding information of the corresponding node is added to the instruction operand record file Ins.operator1 or Ins.operator2. If the node is not an execution function and the operand is recognized, determining whether the node is an execution function and whether the operator is recognized. If so, the decoding information of the corresponding node is added to the instruction opcode record file Ins.op; otherwise, the decoding information of the corresponding node is added to the instruction other information record file.
[0059] The preset instruction template specifically includes annotation interface rules, instruction decoding rules, and execution rules. The annotation interface rules define the standard inputs and outputs of the instruction model; specifically, they include five parts: instruction signal standards input from external sources, signal standards output to the register file, signal standards input from the register file, signal standards input from memory, and signal standards output to memory. Designers can further design other non-essential input / output standards. The instruction decoding rules obtain the decoding function by performing pattern matching on the instruction bit vector of the node information, and extract the six valid basic instruction formats (R / I / S / B / U / J) and decoding information through syntax analysis of the decoding function. The valid basic instruction formats and decoding information are written to the decoding record file, and finally, a Verilog decoding description is output based on the decoding record file. The execution rules define the instruction execution process through execution clauses. Specifically, the instruction type can be obtained from the corresponding information obtained from decoding, different execution information can be extracted according to different types, and the corresponding Verilog description can be output.
[0060] Step S102: Connect multiple instruction models in parallel to form the processor body, and combine the processor body with read multi-select logic, write multi-select logic, registers and memory to form a multi-instruction Verilog description to obtain the processor model.
[0061] Specifically, after obtaining the instruction models corresponding to all instructions in the instruction set of the processor to be verified, the obtained instruction models can be concatenated in parallel to form the processor body. Then, combined with the processor body, an RTL-level processor model is generated semi-automatically. The processor model describes the processor's internal state, register files, memory, etc., and reconstructs the processor's instruction execution behavior. For example... Figure 2As shown, the processor model includes a processor body, read multi-select logic, write multi-select logic, registers, and memory. The processor body is further connected to the read multi-select logic, write multi-select logic, and registers, and the read multi-select logic and write multi-select logic are also connected to registers and memory, respectively.
[0062] Furthermore, the main input of the processor can be set to 32-bit binary instructions. All instruction models in the processor receive instructions from the input processor models, decode them, and determine whether the input instructions are valid. When a specific instruction model is decoded validly, the read multi-select logic inputs a valid read signal and read address to perform a valid read operation. The write multi-select logic outputs a valid write signal, write address, and write data to perform a valid write operation. In this way, the decoding, execution, and write-back operations can be realized according to different instructions.
[0063] The processor model construction method provided in this invention represents the instructions in the processor to be verified through instruction model generation, and constructs a processor model of the processor to be verified based on the generated instruction model. It realizes the conversion from Sail language to Verilog language, and further realizes the RTL-level abstract construction of the processor, which can more comprehensively describe the behavior of the processor. Moreover, the obtained processor model can provide code execution support and realize the rapid automatic generation of the processor model. Compared with the existing verification methods that use the design to be verified itself as a reference model, it provides an abstract and simplified comparison model that can effectively detect defects in the processor's instructions and multi-instruction processing.
[0064] like Figure 3 and Figure 4 As shown in the figure, this embodiment also provides a processor formal verification method, which includes the following steps.
[0065] Step S201: Construct a processor model of the processor to be verified using the processor model construction method described in the above embodiment.
[0066] It should be noted that the method in this embodiment relies on self-consistency to verify the processor model. Self-consistency is a general property, independent of specific microarchitecture implementations. In processor verification, the processor's behavior is expected to meet the specifications given by this general property: for each instruction, the value at its output location should be equal to the value defined in the specification, and the values at other locations should remain unchanged after instruction execution. Therefore, for a processor that meets the specification, executing the same instruction sequence under the same input will definitely produce the same output result. Thus, during processor verification, it is necessary to ensure that the processor to be verified and the corresponding processor model input the same instruction sequence. This general property can serve as the basis for verifying processor correctness and does not depend on specific design details.
[0067] like Figure 5As shown, before verifying the processor to be verified, this embodiment of the invention requires modification of the processor to achieve formal verification of the processor using the bounded model detection method. Further, a test generation module needs to be added to the processor to be verified. Specifically, the test generation module is connected to the output of the instruction fetch module in the processor to be verified, replacing the instruction signal output by the instruction fetch module. The test generation module is mainly responsible for generating instruction sequence tests, including specific restrictions on instructions, so that the processor can accept arbitrary instructions. It can ensure the generation of valid instruction sequences through instruction constraints. Specific instruction constraints are applied at the end of the instruction fetch stage, and the formed instruction sequence can be applied to both the processor to be verified and its corresponding processor model. Since the test generation module applies constraints after instruction fetching, the initialization of instruction storage is avoided, thereby simplifying the verification process. Furthermore, this module uses an assertion hypothesis mechanism to restrict the generated instruction sequence according to the instruction set range specified by the ISA of the processor to be verified.
[0068] Step S202: Read the Verilog file of the processor to be verified and the Verilog file of the processor model through the preset synthesis tool, and expand the Verilog file of the processor to be verified into the processor architecture to be verified in the preset word-level model format, and expand the Verilog file of the processor model into the processor model architecture in the preset word-level model format respectively.
[0069] Specifically, the yosys tool can be used to read the Verilog files of the processor to be verified and the processor model, and then expand the Verilog file of the processor to be verified into a BTOR2 format processor architecture, and expand the Verilog file of the processor model into a BTOR2 format processor model architecture. It should be noted that other appropriate preset synthesis tools and other appropriate preset word-level model formats can also be selected.
[0070] Step S203: Based on the model checking tool, the processor architecture to be verified and the processor model architecture are verified through the principle of self-consistency.
[0071] The SMT model checking tool can be selected to verify the processor architecture to be verified and the processor model architecture. Specifically, it is necessary to determine in real time whether the number of instructions executed by the processor architecture to be verified and the processor model architecture are the same. If they are, it is necessary to determine whether the data in the registers of the processor architecture to be verified is consistent with the data in the registers of the processor model architecture. If they are, it is necessary to re-determine whether the number of instructions executed by the processor architecture to be verified and the processor model architecture are the same. Otherwise, it indicates that there is a counterexample in the processor to be verified. At this time, the corresponding counterexample waveform should be output, and the number of instructions executed by the processor architecture to be verified and the processor model architecture are re-determined. The above consistency attribute determination is achieved by adding assertions in the attribute description section of the processor verification to determine whether the processor model and the processor being verified still maintain consistency attributes.
[0072] Furthermore, during this verification process, the counters `num_uvm_insts` and `num_impm_insts` are incremented by 1 for each instruction submitted, recording the number of instructions submitted by the processor architecture to be verified and the processor model architecture, respectively. When these two counters are equal, it indicates that the processor architecture to be verified and the processor model architecture have executed the same number of instructions, and a `consistency_ready` signal is issued to indicate that the condition that both the processor architecture to be verified and the processor model architecture are in a verification-ready state has been met. Next, the consistency of the architecture registers is checked through consistency attribute assertions.
[0073] By using the method of this invention, potential design flaws in instruction sequences can be discovered. Formal verification tools are used to verify the processor model to confirm whether it conforms to self-consistency properties. The formal verification tools automatically traverse all possible states and execution paths to verify whether the model conforms to all properties. If the model does not conform to the properties, a counterexample is returned, which can be used to further modify and verify the model.
[0074] To illustrate the verification effect of the processor formal verification method in the embodiments of the present invention, the present invention verifies the same processor using the processor formal verification method and the SQED method in the embodiments of the present invention, respectively.
[0075] The experimental environment was set up as a machine with an Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz (4 physical cores, 8 logical cores) and 11.7GB of RAM. The model checking tool used in the experiment was Pono, an open-source SMT-based tool from a Stanford University research team.
[0076] The experimental subject is RIDECORE, an open-source processor core based on RISC-V. A series of experimental schemes were designed and implemented on RIDECORE to verify the effectiveness and performance of the method of the present invention, and comparisons and discussions were made with other related works.
[0077] 1. Effectiveness assessment
[0078] For versions of RIDECORE with known defects, the method of this invention uses the Pono solver to obtain a counterexample waveform diagram, which contains the entire process of processor instruction execution and the error paths within it. By analyzing the waveform diagram, a shorter sequence of erroneous instructions can be obtained.
[0079] 2. Performance Evaluation
[0080] For a processor, its pipeline has multiple stages, and different stages may exhibit different types of defects. To comprehensively evaluate the effectiveness and performance of the verification method, defects are categorized according to the processor's pipeline stages, and different types of defects are injected. For a more comprehensive comparison, the injected defects are divided into five categories: Fetch, Decode, Dispatch, Select / Wakeup, and Execution, corresponding to specific components in the RIDECORE pipeline. Fetch defects are errors that affect the retrieval of instructions from memory, such as address errors and cache errors; Decode defects are errors that affect instruction decoding, such as opcode errors and register number errors; Dispatch defects are errors that affect the allocation of instructions to the corresponding functional units, such as rename table errors and prediction table errors; Select / Wakeup defects are errors that affect the selection of functional units and the waking of ready instructions, such as selection logic errors and ready bit errors; Execution defects are errors that affect the execution of instructions by functional units, such as Arithmetic Logic Unit (ALU) errors and Floating Point Unit (FPU) errors. These five categories of defects cover the main stages and components of the processor pipeline, and can effectively assess the impact of different types of defects on verification performance and coverage.
[0081] Analyzing the above experimental data, from... Figure 6As can be seen, neither of these two methods can detect defects injected in the Fetch category. Furthermore, the processor formal verification method of this invention has the same or higher coverage in all four categories, especially in the Decode and Execution categories, where the coverage is significantly higher than the SQED method; in the Dispatch category, the SQED method has similar coverage to the processor formal verification method of this invention. This indicates that the processor formal verification method of this invention can detect logical errors in the processor more comprehensively and accurately. For cases where both methods can detect defects, the processor formal verification method of this invention further compares the experimental results of defects injected in the Dispatch, Select / Wakeup, and Execution categories, and compares the average runtime and maximum memory consumption of the two methods.
[0082] like Figure 7 As shown, the runtime of the three types of component-injected defects was tested. Experimental results show that the processor formal verification method of this invention significantly reduces the time required to solve these defects. In the Dispatch and Select / Wakeup categories, the average time of the method of this invention is reduced by 49% and 48.32% compared to the SQED method, respectively. Only in the Execution category is the runtime of the method of this invention slightly increased compared to the SQED method, by less than 3%.
[0083] like Figure 8 As shown, the maximum memory consumption for these three types of component injection defects was tested. Experimental results show that the maximum memory consumption of the processor formal verification method of this invention for solving these three types of defects is significantly lower than that of the SQED method. In the Dispatch and Select / Wakeup categories, the processor formal verification method of this invention reduces the maximum memory consumption by approximately 68% compared to the SQED method; in the Dispatch and Select / Wakeup categories, the processor formal verification method of this invention reduces the maximum memory consumption by approximately 25% compared to the SQED method.
[0084] In summary, the processor formal verification method of this invention demonstrates superiority over the SQED method in terms of both runtime and memory consumption when solving defects.
[0085]
[0086] Table 1. Average runtime, memory consumption, and total coverage
[0087] Overall, as shown in Table 1, the processor formal verification method of this invention exhibits higher overall coverage, shorter average runtime, and lower average maximum memory consumption compared to the SQED method across all categories of injected defects. The overall coverage of the processor formal verification method of this invention reaches 72%, while the SQED method only achieves 28%; this means that the processor formal verification method of this invention can discover defects more effectively. Furthermore, the average time for defect discovery by the processor formal verification method of this invention is 18 seconds, while the SQED method reaches 70.95 seconds. This indicates that the processor formal verification method of this invention is faster in defect discovery, enabling it to help verification or developers resolve issues more quickly. Regarding memory consumption, the average memory consumption for defect discovery by the processor formal verification method of this invention is 108.07 MB, while the average memory consumption of the SQED method is 256.95 MB. This indicates that the processor formal verification method of this invention is superior in terms of memory consumption and can better support larger and more complex designs.
[0088] This invention's processor formal verification method employs a design-independent, universal attribute self-consistency verification approach. This eliminates the need to design complex attribute sets, significantly reducing the workload of attribute set writing during formal verification. It also effectively avoids errors caused by human negligence during processor model construction, thus improving verification efficiency. Furthermore, this verification method avoids the need for comparisons between processor instances, as required by traditional methods. By simplifying the reference point from a specific processor to an abstract model, it accelerates the formal verification process. This invention's processor formal verification method is applicable to processor verification based on different instruction set architectures.
[0089] While the embodiments disclosed in this invention are as described above, the content is merely for the purpose of facilitating understanding of the invention and is not intended to limit the invention. Any person skilled in the art to which this invention pertains may make any modifications and changes in form and detail of the implementation without departing from the spirit and scope disclosed herein; however, the scope of protection of this invention shall still be determined by the scope defined in the appended claims.
Claims
1. A processor model construction method, comprising: Based on the ISA specification of the processor to be verified, multiple instruction models are generated through an instruction model generation method. The instruction models are used to describe the semantics and behavior of the instructions in the processor to be verified. Multiple instruction models are connected in parallel to form a processor body, and the processor body, together with read multi-select logic, write multi-select logic, registers, and memory, forms a multi-instruction Verilog description to obtain the processor model; The instruction model is generated in the following way: In the syntax parsing tool, preset language lexical rules and preset language grammar rules are created, and the preset language lexical rules and preset language grammar rules form a grammar rule file; A language recognition tool is used to parse the ISA specification of the processor to be verified based on the syntax rule file to obtain the abstract syntax tree corresponding to the instruction in the instruction set of the processor to be verified. The instruction in the instruction set and the abstract syntax tree have a one-to-one correspondence, and the abstract syntax tree includes the necessary instruction information of the corresponding instruction. The nodes in the abstract syntax tree are traversed to store the node information in the abstract syntax tree into the corresponding record file according to the type; Based on a preset instruction template, the node information in the record file corresponding to the abstract syntax tree is written into the instruction model file to generate the instruction model of the instruction corresponding to the abstract syntax tree.
2. The method according to claim 1, characterized in that, The syntax parsing tool is ANTLRv4, and the language recognition tool is formed by the lexical analyzer and parser in ANTLRv4.
3. The method according to claim 1, characterized in that, The default language is Sail, the default language lexical rules are Sail lexical rules, and the default language grammar rules are Sail grammar rules.
4. The method according to claim 1, characterized in that, Storing node information in the abstract syntax tree into corresponding record files by class includes: Determine whether the node is a decoding function. If so, add the decoding information of the corresponding node to the instruction decoding mode record file and record the instruction type to the instruction type record file; otherwise... Determine whether the node is an executed function and whether its operands are identified. If so, add the decoding information of the corresponding node to the instruction operand record file; otherwise... Determine whether the node is an execution function and whether the operator is recognized. If so, add the decoding information of the corresponding node to the instruction opcode record file; otherwise, add the decoding information of the corresponding node to the instruction other information record file.
5. The method according to claim 1, characterized in that, The processor body is connected to the read multi-select logic, the write multi-select logic and the register respectively, and the read multi-select logic and the write multi-select logic are also connected to the register and the memory respectively.
6. The method according to claim 1, characterized in that, The preset instruction template includes annotation interface rules, instruction decoding rules, and execution rules; The annotation interface rules are used to set the standard inputs and outputs of the instruction model; The instruction decoding rules are used to perform pattern matching on the instruction bit vector of node information to obtain the decoding function. The decoding function is then subjected to syntax analysis to extract the valid basic instruction format and decoding information. The valid basic instruction format and decoding information are written into the decoding record file, and a Verilog decoding description is output based on the decoding record file. The execution rules are used to define the execution process of instructions through execution clauses.
7. A processor formal verification method, comprising: A processor model of the processor to be verified is constructed using the processor model construction method as described in any one of claims 1-6; The Verilog file of the processor to be verified and the Verilog file of the processor model are read in by a preset synthesis tool. The Verilog file of the processor to be verified is expanded into a processor architecture in a preset word-level model format. The Verilog file of the processor model is expanded into a processor model architecture in a preset word-level model format. The processor architecture to be verified and the processor model architecture are verified using a model checking tool based on the principle of self-consistency.
8. The verification method according to claim 7, characterized in that, The output terminal of the instruction fetch module in the processor to be verified is connected to a test generation module to replace the instruction fetch module in outputting instruction signals. The test generation module is also used to provide instruction signals to the processor model.
9. The verification method according to claim 7, characterized in that, Solving using the self-consistency principle includes: During the verification process of the processor architecture to be verified and the processor model architecture by the model testing tool, it is determined in real time whether the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are the same. If so, it is determined whether the data in the register of the processor architecture to be verified is consistent with the data in the register of the processor model architecture. If so, it is re-determined whether the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are the same. Otherwise, it indicates that there is a counterexample in the processor to be verified, the corresponding counterexample waveform is output, and the number of instructions currently executed by the processor architecture to be verified and the processor model architecture are re-determined.