A Verification Method for Radix-4 SRT Square Root Algorithm Based on Formal Verification

Abstract

The application discloses a Radix-4 SRT square root algorithm verification method based on formal verification and concretely relates to the technical field of computer hardware verification, and comprises the following steps: RTL design of an SRU square root module to be verified is acquired, input floating point operation is constrained to make it comply with IEEE 754 floating point format and cover all coding spaces of normalized numbers, non-normalized numbers and abnormal values, and internal registers of the SRU square root module are initialized. The application breaks through the limitation of the maximum redundancy by deducing a general constraint suitable for the value selection of a lookup table of various redundancies; the end-to-end verification framework is uniformly adopted for abnormal processing, normalized conversion, iterative calculation and post-rounding processing by hierarchical formal modeling; the error level and the iteration number are accurately positioned by RTL direct connection and hierarchical assertion architecture without manual model conversion, the hardware debugging period is significantly shortened, and the application has high industrial practical value.

Description

Technical Field

[0001] This invention relates to the field of computer hardware verification technology, and more specifically, to a verification method based on the Radix-4 SRT square root algorithm using formal verification. Background Technology

[0002] The Radix-4 SRT algorithm, which can produce 2-bit results per iteration cycle, achieves a good balance between computational speed and hardware complexity and has become one of the mainstream implementation schemes for floating-point square root operations. Formal verification can provide more rigorous functional correctness guarantees than simulation through mathematical proof. The closest existing technology to this invention is the SRT square root formal verification method based on the ACL2 theorem prover proposed by Russinoff et al.

[0003] The method's formulas for deriving upper and lower bounds of lookup table values ​​are based on the maximum redundancy assumption, which is not applicable to the square root implementation of Radix-4 SRT with non-maximum redundancy. Its iterative invariant derivation, lookup table acceptability determination, and proof of equivalence between RTL and specification all require manual provision of assertion and proof strategies, which cannot be automated. Its exception handling, denormalized number conversion, multi-mode rounding, and post-processing are not included in a unified end-to-end formal verification chain, resulting in semantic gaps and coverage blind spots. It requires manual conversion of Verilog RTL into ACL2 functional models and cannot be directly connected to industrial-grade hardware formal verification processes. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, this invention provides a Radix-4 SRT square root algorithm verification method based on formal verification, in order to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for verifying Radix-4SRT floating-point square root operations based on formal verification, comprising the following steps: S1: Obtain the RTL design of the SRU square root module to be verified, constrain the input floating-point operands to conform to the IEEE 754 floating-point format and cover the entire encoding space of normalized numbers, denormalized numbers and outliers, and initialize the internal registers of the SRU square root module. S2: The algorithm characteristics of the SRU square root module are formally described. The various rounding modes specified by IEEE 754 are transformed into mathematical constraints on the final iteration remainder. The judgment conditions of outliers are encoded into formal assertions. The fixed-point encoding format and the true physical value of the truncated remainder approximation and the partial result approximation during the iteration process are defined. S3: Establish a hierarchical formal model for the SRU square root module, including an anomaly handling model, a normalization expression model, a lookup table numerical model, and a post-normalization processing model; wherein, the lookup table numerical model is based on a redundancy parameter. Cardinal number and the largest number Derive the upper and lower bound constraints for iterative value selection, wherein the upper and lower bound constraints satisfy... This ensures that the remainder remains within the convergence interval throughout the iteration process; S4: Based on the hierarchical formal model established in step S3, perform hierarchical verification, including rounding rule constraint verification, outlier determination and verification, normalization determination and transformation verification, iterative calculation correctness verification, and iterative invariant verification. S5: Input the formal model and verification assertions established in S2 to S4 into the theorem prover, perform bounded model checks and consistency checks, verify that the output of the SRU module meets the specifications under all valid inputs, and parse the verification results.

[0006] Preferably, the numerical model of the lookup table in step S3 includes: Square root selection value Remainder Partial Results The mathematical relationship between them, where the recursive formula for part of the Radix-4SRT square root operation is as follows: The remainder recursive formula is: ; Select value Upper and lower bound constraints:

[0007]

[0008] in The upper and lower bound constraints are applicable to redundancy parameters. Non-maximum redundancy configuration; and the upper bound of the remainder lower bound of remainder .

[0009] Preferably, the hierarchical formal model in step S3 further includes the establishment of a golden reference model and hierarchical consistency mapping: A mathematical reference model is constructed that is functionally equivalent to RTL but has an independent implementation method. The golden reference model is described and implemented using a high-precision floating-point arithmetic library or bit-precise algorithm, covering IEEE 754 floating-point input decoding, preprocessing of denormalized number normalization, Radix-4 SRT square root core iteration, rounding postprocessing, and outlier pass-through logic. Establish signal mapping relationships between the DUT and the golden reference model at three key interface points: the input layer, the preprocessing layer, and the output layer. The input layer maps the raw floating-point input of the DUT to the input of the golden reference model in a one-to-one correspondence. The preprocessing layer maps the normalized preprocessed output of the DUT to the normalized result of the golden reference model. The output layer maps the final output of the DUT to the result of the high-precision calculation of the golden reference model after being processed by the same rounding mode.

[0010] Preferably, the hierarchical verification in step S4 further includes a denormalized number consistency check and an end-to-end consistency verification of the golden reference model: The denormalized number consistency check verifies the mathematical equivalence between the transformation result of the normalization module on denormalized numbers and the golden reference model in denormalized number processing. It verifies that the mantissa and exponent output by the normalization module are completely consistent with the output of the reference model under the same input, ensuring that the normalization transformation does not introduce additional accuracy loss. The end-to-end consistency verification of the golden reference model involves applying the same input to both the DUT and the golden reference model in parallel across all valid input spaces, verifying that the final output of the DUT is digit-by-digit equivalent to the result of the golden reference model after being processed by the same rounding rules.

[0011] Preferably, the iterative calculation correctness verification in step S4 is as follows: for the j-th iteration, based on the current partial results... and remainder Verify the square root number output by the lookup table. satisfy When using truncated approximations and In the hardware implementation, the above constraints are converted into sufficient conditions applicable to the truncated signal. By performing integer field operations on the truncated remainder signal and the truncated result signal, sufficient condition constraints that guarantee the original inequality hold are derived.

[0012] Preferably, the sufficient condition constraint applicable to the truncated signal is obtained in the following way: Let the approximate value of the truncated remainder be... Using t-bit signed fixed-point two's complement encoding, the actual physical value is Approximate value of truncated part of the result Using u-bit unsigned fixed-point sign-magnitude encoding, the actual physical value is ;in and These are scaling constants, representing the decimal places of the remainder and the fixed-point format of the partial results, respectively. They are determined during the design phase by the algorithm's accuracy requirements and hardware implementation constraints, and remain unchanged during iteration. Specifically, and These are the smallest precision units (LSB weights) for the corresponding fixed-point numbers.

[0013] Substitute the true value into the redundancy-based... The derived upper and lower bound inequalities are multiplied by their common divisors to eliminate fractions, and a ULP correction term for the truncation error is introduced to obtain sufficient condition constraints in the form of integer field assertions.

[0014] Preferably, the formal description of the algorithmic characteristics of the SRU square root module in step S2 further includes: A systematic conversion rule is established between the remainder approximation signal of signed two's complement encoding and the partial result approximation signal of unsigned original code encoding. When the remainder signal is negative, it is converted to a two's complement value minus... Unsigned expressions are adapted to the operational rules of the theorem prover; Define the iterative counting signal and the iterative index in the formula. Establish the correspondence between the iteration steps and the values ​​stored in the registers.

[0015] Preferably, the outliers in step S1 include NaN, Inf, and Zero; the outlier determination conditions in step S2 include: if the input is negative and not NaN, output NaN; if the input is +∞, output +∞; if the input is ±0, output ±0; if the input is NaN, output NaN; the outlier determination and verification in step S4 take precedence over iterative calculation assertions on the outlier path.

[0016] Preferably, step S5, which involves inputting the formal model and verification assertions into the theorem prover, specifically includes: The RTL design, clock signal, reset condition, and assertion set generated in step S4 of the SRU module are input into the solver. Input assumptions are established in the solver to constrain the input to be a valid floating-point number that meets the standard. The solver engine is then called to perform bounded model checks. The solution analyzes the output of the solver. If it returns PASS, the verification is successful. If it returns FAIL, the counterexample waveform is extracted and the iteration step and signal value that violate the constraint are located according to the assertion hierarchical architecture.

[0017] Preferably, the layered verification process adopts a layered assertion architecture, which separates and loads the abnormal path passthrough assertion, normalization consistency assertion, lookup table value selection upper and lower bound constraint assertion, iterative invariant assertion, and final output equivalence assertion. When verification fails, the error source level is located based on the assertion layered architecture. The layers include an exception handling layer, a normalization transformation layer, an iterative calculation layer, a lookup table value selection layer, and a post-processing layer, thereby achieving accurate error location and modular verification.

[0018] The technical effects and advantages of this invention are as follows: By using an iterative value selection upper and lower bound constraint model and a general upper and lower bound constraint formula, the limitation of maximum redundancy is broken, enabling the correctness of the lookup table value selection to be rigorously proven mathematically under various redundancy parameter configurations. This significantly expands the applicability of formal verification methods, achieves rigorous mathematical verification of non-maximum redundancy SRT square root lookup tables, and solves the technical problem of lacking rigorous mathematical verification methods for non-maximum redundancy SRT square root hardware. By using hierarchical formal modeling in S3, and a three-layer consistency mapping of the anomaly handling model, normalized expression model, lookup table numerical model, normalized post-processing model, and golden reference model, anomaly handling, denormalized number transformation, iterative calculation, multi-mode rounding, and post-processing are uniformly incorporated into the formal verification framework. Combined with denormalized number consistency checks and end-to-end bit-by-bit equivalence verification, as well as an anomaly path priority assertion mechanism, the SRU module is fully compliant with the IEEE 754 floating-point standard, eliminating the semantic gaps and coverage blind spots caused by traditional independent module verification. By directly inputting the Verilog RTL code, clock signal, and reset condition of the SRU module into the solver, manual model conversion is eliminated. Combined with the derivation of sufficient conditions for the integer field of truncated signals and systematic conversion rules for mixed-coded signals, the problem of unified expression of signed two's complement remainder signals and unsigned original code partial result signals in formal constraints is solved. Through a layered assertion architecture, precise error localization is achieved, allowing verification failures to be directly located to the exception handling layer, normalization conversion layer, iterative calculation layer, lookup table selection layer, or post-processing layer based on the assertion type. This significantly shortens the hardware debugging cycle and possesses significant industrial practical value. In summary, through the synergy and influence of the above-mentioned general redundancy constraint derivation, end-to-end formal modeling, direct industrial-grade RTL interface, and precise hierarchical assertion positioning, this invention constructs a complete formal verification system for Radix-4 SRT floating-point square root operations: the non-maximum redundancy upper and lower bound constraint formulas break through the applicability limitations of existing verification methods, providing strict mathematical guarantees for lookup table value selection; end-to-end hierarchical formal modeling integrates anomaly handling, normalization conversion, iterative calculation, and rounding post-processing into the verification framework, eliminating semantic gaps and coverage blind spots caused by traditional independent module verification; direct industrial-grade RTL interface and hybrid coded signal conversion rules significantly reduce verification deployment costs, enabling formal verification to be seamlessly embedded into existing hardware design processes; the hierarchical assertion architecture achieves precise positioning of error level and iteration steps when verification fails, significantly shortening the debugging cycle, and collectively solving the technical bottlenecks of existing SRT square root formal verification in terms of redundancy coverage, end-to-end semantic consistency, industrial implementation, and error positioning. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the method flow structure of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] This embodiment selects a commercial hardware formal theorem proof tool for data path optimization as the verification execution carrier, which can directly parse Verilog RTL design, load hierarchical formal assertions and perform bounded model check (BMC).

[0022] like Figure 1 As shown, this embodiment provides a Radix-4 SRT square root algorithm verification method based on formal verification, which is executed in the following steps: S1: Input space constraints and initialization. Obtain the complete Verilog RTL code of the SRU module. In the theorem prover, apply global constraints to the input 32-bit IEEE 754 single-precision floating-point operands through constraint statements. The constraints cover the complete encoding space of all normalized numbers, all denormalized numbers, NaN, positive infinity, negative infinity, positive and negative zero, and other outliers. Initialize the SRU internal iteration counter. Partial Result Register Remainder Register , set the initial value for iteration , Configured as standard initial parameters for the Radix-4 SRT square root algorithm.

[0023] S2: Formal description of the SRU square root module algorithm characteristics. Following the IEEE 754 standard, the four rounding modes (RNE, RZ, RU, RD) are transformed into mathematical constraints on the upper and lower bounds of the final iterative remainder. The allowable error interval for each rounding mode is calculated based on the output mantissa bit width. The input space is divided into four categories according to Boolean predicates: negative non-NaN, positive infinity, ±0, and NaN. Based on the classification results, the corresponding output rules are encoded into bit vector formal assertions. The fixed-point encoding format for the truncated remainder approximation and the truncated partial result approximation, and their conversion relationship with the actual physical values ​​are defined.

[0024] S3: Construct a hierarchical formal model of SRU, successively building an exception handling model, a normalized representation model, a lookup table numerical model, and a post-normalization processing model; the lookup table numerical model is based on cardinality. Maximum number Redundancy parameters Derive the upper and lower bound constraints for iterative value selection; the constraints satisfy... This ensures that the iteration remainder falls within the convergence interval throughout the process; simultaneously, a golden reference model mathematical reference model independent of RTL is constructed, and signal mapping of the input layer, preprocessing layer, and output layer is completed.

[0025] S4: Based on the hierarchical formal model, hierarchical verification is performed in sequence, including rounding rule constraint verification, outlier judgment and verification, normalization judgment and transformation verification, iterative calculation correctness verification, and iterative invariant verification. Simultaneously, non-normalized number consistency checks and end-to-end bit-by-bit equivalence verification of the golden reference model are added. The entire verification adopts a hierarchical assertion architecture, with various assertions loaded separately, and fault levels can be located hierarchically.

[0026] S5: Theorem Proofer Integration and End-to-End Verification. It imports the algorithm constraints defined in S2, the hierarchical model in S3, all verification assertions in S4, the RTL code of SRU, clock signals, and reset timing conditions into the theorem proof solver. It limits the validity of floating-point inputs by input assumptions, starts the bounded model check to complete the property consistency verification, and performs a consistency check between the RTL output signal and the golden reference model output. It analyzes the solution output results. PASS means that all verifications have passed, while FAIL extracts the counterexample waveforms and uses the hierarchical assertions to locate the number of illegal iteration steps and hardware signal values.

[0027] In this embodiment, the formal description of the algorithm characteristics in step S2 is as follows: This embodiment formally implements multi-mode rounding, establishing remainder constraints for four types of IEEE 754 rounding rules: RNE rounds to the nearest even number: if the absolute value of the final iteration remainder is less than 1. k is the output mantissa width, and the result does not require carry; the remainder equals The least significant bit of the mantissa is forced to be even; otherwise, it is rounded to the nearest value. All constraints are encoded as timing assertions and appended to the final output of the iteration.

[0028] RZ rounding to zero: Regardless of whether the remainder is positive or negative, the last digit is truncated. For positive numbers, the lower limit of the error range is... The upper limit is 0.

[0029] RU rounding up: The output result is always greater than or equal to the true mathematical square root value, with an upper limit constraint on the remainder.

[0030] RD rounding down: The output result is always less than or equal to the true mathematical square root value, with a lower limit constraint on the remainder.

[0031] The formal assertion implementation for exception handling is performed. Timing assertions are written in the theorem prover to strictly enforce the following decision logic: When the input is negative and not NaN, the output should be NaN encoded. When the input is positive infinity, the output should be a positive infinity code; When the input is zero, the output should be a zero code; When the input is NaN, the output should be a NaN encoding.

[0032] During verification, abnormal path assertions have higher priority than all iterative computation assertions. The abnormal input pass-through logic is verified first, and the normal iterative computation path is separated from the abnormal pass-through path.

[0033] This embodiment includes the formal definition and hardware parameter configuration for the hybrid coded signal: truncated remainder approximation. It is a 7-bit signed two's complement fixed-point signal, t=7, with a fractional bit width. The actual physical value is Approximate value of truncated portion It is a 4-bit unsigned fixed-point signal, u=4, with a fractional bit width. The actual physical value is .

[0034] Process the two's complement remainder of a negative number according to the conversion rules: the highest bit of the 7-bit two's complement signal is the sign bit, and the true integer expression for a negative number is: The integers are uniformly converted to unsigned integers for solving upper and lower bound inequalities, adapting to the underlying rule that the theorem prover only supports unsigned integer operations; a hardware iterative counting signal is established. With iterative index One-to-one mapping Corresponding to the first iteration, corresponding , , value selection .

[0035] The specific implementation of step S3, the hierarchical formal model building, is as follows: The lookup table numerical model and recursive and upper / lower bound formulas are implemented. The core recursive formula for square root extraction in Radix-4 SRT is adopted simultaneously in both hardware and formal models. Partial result recursion: Remainder recursion: Lookup table to select value range ,make Based on redundancy Derivation of general upper and lower bound constraints:

[0036]

[0037] Global remainder convergence upper and lower bounds:

[0038]

[0039] The entire set of constraints is no longer limited to the maximum redundancy configuration and can be adapted to Radix-4 SRT hardware with various redundancy parameters, enabling mandatory verification in the formal model. Ensure iterative convergence.

[0040] The Golden Reference Model is developed using a high-precision floating-point arithmetic library, with functions implemented completely independently of RTL, fully covering: IEEE 754 floating-point input decoding, left shift normalization of denormalized numbers, Radix-4 SRT multi-round iteration, four types of mantissa rounding, exponent overflow / underflow handling, and NaN / infinity / zero exception pass-through logic.

[0041] Implementation of three-layer consistency mapping: Input layer: The original 32-bit floating-point input of the DUT corresponds one-to-one with the input bit width and encoding of the golden reference model; Preprocessing layer: Compares the mantissa and exponent output of the DUT normalization module with the output of the normalize(x) function of the golden reference model; Output layer: The final floating-point output of the DUT and the calculation results of the golden reference model are compared bit by bit after being processed using the same rounding mode.

[0042] Normalized representation model: The judgment rule is that the input floating-point exponent field is all 0 and the mantissa is non-zero, which means it is a non-normalized number. The model describes the conversion logic of left shift of mantissa and synchronous decrease of exponent, establishes the bit width mapping before and after conversion, and constrains the conversion process to have no additional precision loss. Exception handling model: Fully reuses the exception Boolean assertions defined in S2, encapsulates them as independent model branches, and isolates the normal iterative calculation path; Post-normalization processing model: Read the original mantissa and exponent after iteration, perform mantissa truncation / carry according to the current rounding mode, determine exponent overflow and output Inf, exponent underflow and output zero or denormalized number, and output in IEEE 754 complete floating-point code.

[0043] Denormalization consistency check timing assertion: When the input is a denormalized floating-point number, the mantissa and exponent output by the SRU hardware normalization module are equal bit by bit with the normalization conversion result of the golden reference model, and there is no additional precision loss.

[0044] End-to-end verification of the golden reference model: All valid floating-point codes are input into the DUT and the golden reference model in parallel. The judgment standard is set as 32-bit bit-by-bit equivalence of floating-point codes, covering normalized, denormalized and all abnormal input scenarios.

[0045] Each iteration performs constraint verification: based on the current... , Verify the lookup table output It falls within the upper and lower bounds; for hardware-truncation approximations , Generate sufficient conditions for the integer field according to the following process: Will , Substitute into the floating-point inequality and calculate the common denominator. Multiplying both sides of the inequality by the common denominator eliminates the fractions, and superimposing the ULP truncation error correction term yields a constraint assertion containing only integer operations, which is then directly imported into the theorem prover for solution.

[0046] Example of integer field constraints generated when k=2 in this embodiment:

[0047] The verification process adopts a layered assertion architecture, with all assertions loaded independently and divided into five categories: Straight-through assertion for abnormal paths; Standardization consistency assertion; Lookup table value selection upper and lower bound constraint assertions; Iterative invariant assertions; The final output is a bitwise equivalent assertion.

[0048] If the solver returns FAIL and there are counterexamples, the fault level can be directly located based on the trigger assertion type: exception handling layer, normalization transformation layer, iterative calculation layer, lookup table value selection layer, and post-processing layer. The iterative index in the counterexample can be extracted simultaneously. The values ​​of the two's complement remainder signal and the original code result signal are significantly shortened, greatly reducing the hardware debugging cycle.

[0049] The remainder is checked in each iteration. Always fall and Within the convergence interval, some results are simultaneously verified. The iteratively updated values ​​satisfy the SRT square root convergence condition and are used as iterative invariants for continuous verification.

[0050] Project Import and Constraint Configuration: Import the SRU Verilog RTL code, the Golden Reference Model source code, and the test platform encapsulation files into the theorem prover project; constrain the input to be only valid IEEE 754 floating-point numbers using formal statements, and limit the iteration counter. The range of values ​​covers the entire square root iteration cycle.

[0051] Verification engine configuration: Configure the solver to use bounded model checking (BMC) mode, and set the boundary depth to cover all iteration pipeline cycles of the SRU module to ensure that all iteration steps are traversed. .

[0052] Result Analysis and Counterexample Handling: Analyzing the output status after executing the verification task: Status 1: Returns unsat / PASS, indicating that all valid inputs meet the IEEE 754 standard and the SRU module has passed verification; Status 2: Returns sat / FAIL, automatically exports counterexample waveform files, and extracts the number of violation iterations based on the hierarchical assertion architecture. , Hardware signal encoding value; convert the extracted value into the actual fixed-point physical value, substitute it into the upper and lower bound theoretical formulas for manual verification, and if the constraint is caused by truncation error.

[0053] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A verification method for the Radix-4 SRT square root algorithm based on formal verification includes the following steps: S1: Obtain the RTL design of the SRU square root module to be verified, constrain the input floating-point operands to conform to the IEEE 754 floating-point format and cover the entire encoding space of normalized numbers, denormalized numbers and outliers, and initialize the internal registers of the SRU square root module. S2: The algorithm characteristics of the SRU square root module are formally described. The various rounding modes specified by IEEE 754 are transformed into mathematical constraints on the final iteration remainder. The judgment conditions of outliers are encoded into formal assertions. The fixed-point encoding format and the true physical value of the truncated remainder approximation and the partial result approximation during the iteration process are defined. S3: Establish a hierarchical formal model for the SRU square root module, including an anomaly handling model, a normalization expression model, a lookup table numerical model, and a post-normalization processing model; wherein, the lookup table numerical model is based on a redundancy parameter. Cardinal number and the largest number Derive the upper and lower bound constraints for iterative value selection, wherein the upper and lower bound constraints satisfy... This ensures that the remainder remains within the convergence interval throughout the iteration process; S4: Based on the hierarchical formal model established in S3, perform hierarchical verification, including rounding rule constraint verification, outlier determination and verification, normalization determination and transformation verification, iterative calculation correctness verification, and iterative invariant verification. S5: Input the formal model and verification assertions established in S2 to S4 into the theorem prover, perform bounded model checks and consistency checks, verify that the output of the SRU module meets the specifications under all valid inputs, and parse the verification results.

2. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 1, characterized in that: The numerical model for the lookup table mentioned in step S3 includes: Square root selection value Remainder Partial Results The mathematical relationship between them, where the recursive formula for part of the Radix-4SRT square root operation is as follows: The remainder recursive formula is: ; Select value Upper and lower bound constraints: in The upper and lower bound constraints are applicable to redundancy parameters. Non-maximum redundancy configuration; and the upper bound of the remainder lower bound of remainder .

3. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 1, characterized in that: The hierarchical formal model described in step S3 also includes the establishment of the golden reference model and the hierarchical consistency mapping: A mathematical reference model is constructed that is functionally equivalent to RTL but implemented independently. The golden reference model is described and implemented using a high-precision floating-point arithmetic library or bit-precise algorithm, covering IEEE 754 floating-point input decoding, preprocessing of denormalized number normalization, Radix-4SRT square root core iteration, rounding postprocessing, and outlier pass-through logic. Establish signal mapping relationships between the DUT and the golden reference model at three key interface points: the input layer, the preprocessing layer, and the output layer. The input layer maps the raw floating-point input of the DUT to the input of the golden reference model in a one-to-one correspondence. The preprocessing layer maps the normalized preprocessed output of the DUT to the normalized result of the golden reference model. The output layer maps the final output of the DUT to the result of the high-precision calculation of the golden reference model after being processed by the same rounding mode.

4. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 1, characterized in that: The hierarchical verification described in step S4 also includes denormalized number consistency checks and end-to-end consistency verification of the golden reference model: The denormalized number consistency check verifies the mathematical equivalence between the transformation result of the normalization module on denormalized numbers and the golden reference model in denormalized number processing. It verifies that the mantissa and exponent output by the normalization module are completely consistent with the output of the reference model under the same input, ensuring that the normalization transformation does not introduce additional accuracy loss. The end-to-end consistency verification of the golden reference model involves applying the same input to both the DUT and the golden reference model in parallel across all valid input spaces, verifying that the final output of the DUT is digit-by-digit equivalent to the result of the golden reference model after being processed by the same rounding rules.

5. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 1, characterized in that: The correctness verification of the iterative calculation in step S4 is as follows: For the j-th iteration, based on the current partial results... and remainder Verify the square root number output by the lookup table. satisfy When using truncated approximations and In the hardware implementation, the above constraints are converted into sufficient conditions applicable to the truncated signal. By performing integer field operations on the truncated remainder signal and the truncated result signal, sufficient condition constraints that guarantee the original inequality hold are derived.

6. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 5, characterized in that: The sufficient condition constraints applicable to truncated signals are obtained in the following manner: Let the approximate value of the truncated remainder be... Using t-bit signed fixed-point two's complement encoding, the actual physical value is Approximate value of truncated part of the result Using u-bit unsigned fixed-point sign-magnitude encoding, the actual physical value is ;in and Here, are scaling constants, representing the decimal places of the remainder and the fixed-point format of the partial results, respectively. These are determined during the design phase by the algorithm's accuracy requirements and hardware implementation constraints, and remain unchanged during the iteration process. Substitute the true value into the redundancy-based... The derived upper and lower bound inequalities are multiplied by their common divisors to eliminate fractions, and a ULP correction term for the truncation error is introduced to obtain sufficient condition constraints in the form of integer field assertions.

7. The Radix-4 SRT square root algorithm verification method based on formal verification according to claim 1, characterized in that: The formal description of the algorithmic characteristics of the SRU square root module in step S2 also includes: A systematic conversion rule is established between the remainder approximation signal of signed two's complement encoding and the partial result approximation signal of unsigned original code encoding. When the remainder signal is negative, it is converted to a two's complement value minus... Unsigned expressions are adapted to the operational rules of the theorem prover; Define the iterative counting signal and the iterative index in the formula. Establish the correspondence between the iteration steps and the values ​​stored in the registers.

8. The verification method for the Radix-4 SRT square root algorithm based on formal verification according to claim 1, characterized in that: The outliers mentioned in step S1 include NaN, Inf, and Zero; the outlier determination conditions mentioned in step S2 include: if the input is negative and not NaN, output NaN; if the input is +∞, output +∞; if the input is ±0, output ±0; if the input is NaN, output NaN; the outlier determination and verification mentioned in step S4 take precedence over iterative calculation assertions on the outlier path.

9. The verification method for the Radix-4 SRT square root algorithm based on formal verification according to claim 1, characterized in that: Step S5, which involves inputting the formal model and verification assertions into the theorem prover, specifically includes: The RTL design, clock signal, reset condition, and assertion set generated in step S4 of the SRU module are input into the solver. Input assumptions are established in the solver to constrain the input to be a valid floating-point number that meets the standard. The solver engine is then called to perform bounded model checks. The solution analyzes the output of the solver. If it returns PASS, the verification is successful. If it returns FAIL, the counterexample waveform is extracted and the iteration step and signal value that violate the constraint are located according to the assertion hierarchical architecture.

10. The verification method for the Radix-4 SRT square root algorithm based on formal verification according to claim 1, characterized in that: The layered verification process adopts a layered assertion architecture, which separates and loads the abnormal path passthrough assertion, normalization consistency assertion, lookup table value selection upper and lower bound constraint assertion, iterative invariant assertion, and final output equivalence assertion. When verification fails, the error source level is located based on the assertion layered architecture. The layers include an exception handling layer, a normalization transformation layer, an iterative calculation layer, a lookup table value selection layer, and a post-processing layer, thereby achieving accurate error location and modular verification.

Images