## Automatic formal verification of fused-multiply-add FPUs (2005)

### Cached

### Download Links

- [domino.research.ibm.com]
- [de.geocities.com]
- DBLP

### Other Repositories/Bibliography

Venue: | in DATE |

Citations: | 13 - 5 self |

### BibTeX

@INPROCEEDINGS{Jacobi05automaticformal,

author = {Christian Jacobi and Kai Weber and Viresh Paruthi and Jason Baumgartner and Ibm Deutschland Entwicklung Gmbh Boeblingen},

title = {Automatic formal verification of fused-multiply-add FPUs},

booktitle = {in DATE},

year = {2005},

pages = {1298--1303}

}

### OpenURL

### Abstract

In this paper we describe a fully-automated methodology for formal verification of fused-multiply-add floating point units (FPUs). Our methodology verifies an implementation FPU against a simple reference model derived from the processor’s architectural specification, which may include all aspects of the IEEE specification including denormal operands and exceptions. Our strategy uses a combination of BDD- and SAT-based symbolic simulation. To make this verification task tractable, we use a combination of casesplitting, multiplier isolation, and automatic model reduction techniques. The case-splitting is defined only in terms of the reference model, which makes this approach easily portable to new designs. The methodology is directly applicable to multi-GHz industrial implementation models (e.g., HDL or gate-level circuit representations) that contain all details of the high-performance transistorlevel model, such as aggressive pipelining, clocking, etc. Experimental results are provided to demonstrate the computational efficiency of this approach. 1

### Citations

103 |
Verification of sequential machines using boolean functional vectors
- Coudert, Berthet, et al.
- 1989
(Show Context)
Citation Context ...rily consumes run-time without yielding a superior order. We also experimented with different BDD minimization algorithms (using the care-sets defined by the constraints). The BDD operation constrain =-=[17]-=- was overall the best choice: it is fast when the number of nodes is manageable. More aggressive minimization algorithms yielded greater reductions in the peak number of BDD nodes, but their overall r... |

93 | Verification of Arithmetic Circuits with Binary Moment Diagrarns
- Bryant, Chen
- 1995
(Show Context)
Citation Context ...iting bit-level redundancy removal), whereas that of [9] requires wordlevel PHDDs for computational efficiency. Various research has addressed the automatic verification of integer multipliers, e.g., =-=[10, 11]-=-. One promising future direction is to incorporate such techniques into our methodology to verify the multiplier along with the rest of the FPU, without isolation. 8 Summary We have presented a fully-... |

77 | Robust boolean reasoning for equivalence checking and functional property verification
- Kuehlmann, Paruthi, et al.
- 2002
(Show Context)
Citation Context ...ernal verification tool SixthSense. All designs are mapped into a netlist representation containing only 2-input AND gates, inverters, and registers, using straight-forward logic synthesis techniques =-=[15]-=-. As described, our real FPU comprises approximately 15,000 lines of VHDL. After compilation and phase abstraction [16], the netlist of the real FPU has approximately 4,800 registers and 55,000 AND ga... |

37 |
A mechanically checked proof of IEEE compliance of the floating point multiplication, division and square root algorithms of the AMD-K7 processor
- Russinoff
- 1998
(Show Context)
Citation Context ...mulation. For example, numerous industrial approaches have proposed the use of a combination of automatic methods and manual theorem-proving techniques to yield complete proofs of correctness of FPUs =-=[2, 3, 4]-=-. In this paper, we present an efficient, fully-automated methodology for the verification of fused-multiply-add (FMA) FPUs. This methodology targets exhaustive verification of the complex dataflow of... |

36 |
The formal verification of a pipelined double-precision IEEE floating-point multiplier
- Aagaard, Seger
- 1995
(Show Context)
Citation Context ...s not cover denormal results nor operands. The verification at AMD uses the theorem prover ACL2, which requires manually-guided proofs. Our approach is fully automatic and portable. Aagaard and Seger =-=[21]-=- verified a floating-point multiplier using a customized toolset combining STE and theorem proving. Their multiplier does not include a denormalization shifter for multiplication because it traps on d... |

30 |
Formally verifying ieee compliance of floating-point hardware
- O’Leary, Zhao, et al.
- 1999
(Show Context)
Citation Context ...mulation. For example, numerous industrial approaches have proposed the use of a combination of automatic methods and manual theorem-proving techniques to yield complete proofs of correctness of FPUs =-=[2, 3, 4]-=-. In this paper, we present an efficient, fully-automated methodology for the verification of fused-multiply-add (FMA) FPUs. This methodology targets exhaustive verification of the complex dataflow of... |

29 | Defining the IEEE-854 floating-point standard in PVS
- Miner
- 1995
(Show Context)
Citation Context ...uding the implicit bit of the operand A (similarly for B and C). We define sp = sa xor sb, ep = ea + eb, 2 Others have formalized the IEEE standard in a theorem prover as a mathematical specification =-=[12, 13]-=-; we use an HDL-based reference model for portability to simulation, emulation, semi-formal, and formal verification frameworks. 2* : bit addend #%$ intermediate result gap ! bit product sticky ) is ... |

21 | A case study in formal verification of RegisterTransfer logic with ACL2: the floating point adder
- Russinoff
(Show Context)
Citation Context .... However, we are not aware of any fullyautomated attempts to formally verify FMA datapaths, nor any which cover denormal operands or results for such operations. Researchers at Intel [3, 18] and AMD =-=[19, 4]-=- have also applied formal methods to the verification of FPUs. At Intel, FPUs are verified using a customized toolset combining STE and theoremproving, likely requiring implementation-specific manual ... |

19 | Verity - A formal verification program for custom CMOS circuits
- Kuehlmann, Srinivasan, et al.
- 1995
(Show Context)
Citation Context ...gned) transistor-level circuit, as is a common industrial design style [1]. Coupled with the use of a Boolean equivalence checker to correlate the HDL implementation against the fabricated schematics =-=[14]-=-, this overall approach enables a seamless proof of datapath correctness from the transistor schematics all the way up to the architecture-level specification. The novel contributions of this paper ar... |

16 |
et al, Functional verification of the POWER4 microprocessor and POWER4 multiprocessor systems,In
- Ludden
- 2002
(Show Context)
Citation Context ... efficiency of this approach. 1 Introduction Traditionally, industrial floating point units (FPUs) are validated by simulation, often using targeted techniques such as specialized testcase generators =-=[1]-=-. While such approaches are efficient at exposing many bugs, they are based on incomplete methods which cannot achieve full coverage, e.g. evaluation of all operand combinations over all rounding mode... |

12 | Formal verification of complex out-of-order pipelines by combining model-checking and theorem-proving
- Jacobi
- 2002
(Show Context)
Citation Context ...bugs in the inter-instruction control may often cause data errors. However, these are often considered a separate class of bugs which may be verified separately from the numerical computation, as per =-=[7, 8]-=-. Though we do not cover inter-instruction aspects, we do exhaustively verify the control logic specific to the execution of a single instruction, including opcode decoding and aspects of the clock ga... |

12 | Formal verification of the VAMP floating point unit
- Jacobi, Berg
(Show Context)
Citation Context ...uding the implicit bit of the operand A (similarly for B and C). We define sp = sa xor sb, ep = ea + eb, 2 Others have formalized the IEEE standard in a theorem prover as a mathematical specification =-=[12, 13]-=-; we use an HDL-based reference model for portability to simulation, emulation, semi-formal, and formal verification frameworks. 2* : bit addend #%$ intermediate result gap ! bit product sticky ) is ... |

8 | An Abstraction Algorithm for the Verification of Level-Sensitive Latch-Based Netlists. FMSD’03
- Baumgartner, Heyman, et al.
(Show Context)
Citation Context ...tes, inverters, and registers, using straight-forward logic synthesis techniques [15]. As described, our real FPU comprises approximately 15,000 lines of VHDL. After compilation and phase abstraction =-=[16]-=-, the netlist of the real FPU has approximately 4,800 registers and 55,000 AND gates. We employed automated redundancy removal algorithms [15] to reduce the size of the netlist prior to application of... |

7 |
Verification of floating point adders
- Chen, Bryant
- 1998
(Show Context)
Citation Context ...sub-problems as discussed in Section 4. Each sub-problem restricts the shift-amount for both shifters, causing them to “collapse” into simple wires, similar to the case-splitting strategy employed in =-=[9]-=- for verifying floatingpoint addition. We extend this approach to FMA instructions, and to handle denormal results and operands (refer to Section 6). To circumvent the difficulties posed by the multip... |

7 |
Verification of integer multipliers on the arithmetic bit level
- Stoffel, Kunz
- 2001
(Show Context)
Citation Context ...rameworks, we also validate the design without the multiplier overrides or case-splits using simulation and semi-formal methods. The multiplier may also be formally verified using existing techniques =-=[10, 11]-=- to ensure completeness of the overall process. 3 Reference FPU In this section we describe the reference FPU, against which we compare the real FPU. The reference FPU is written in VHDL 2 and, as wit... |

6 |
A Mechanically Checked Proof of the AMD5 K86 Floating Point Division Program
- Moore, Lynch, et al.
- 1998
(Show Context)
Citation Context ...mulation. For example, numerous industrial approaches have proposed the use of a combination of automatic methods and manual theorem-proving techniques to yield complete proofs of correctness of FPUs =-=[2, 3, 4]-=-. In this paper, we present an efficient, fully-automated methodology for the verification of fused-multiply-add (FMA) FPUs. This methodology targets exhaustive verification of the complex dataflow of... |

5 | Verification of pipeline circuits
- Kaufmann, Russinoff
- 2000
(Show Context)
Citation Context ...bugs in the inter-instruction control may often cause data errors. However, these are often considered a separate class of bugs which may be verified separately from the numerical computation, as per =-=[7, 8]-=-. Though we do not cover inter-instruction aspects, we do exhaustively verify the control logic specific to the execution of a single instruction, including opcode decoding and aspects of the clock ga... |

5 | Formal verification of the Pentium R○ 4 floatingpoint multiplier
- Kaivola, Narasimhan
- 2002
(Show Context)
Citation Context ...mia and industry. However, we are not aware of any fullyautomated attempts to formally verify FMA datapaths, nor any which cover denormal operands or results for such operations. Researchers at Intel =-=[3, 18]-=- and AMD [19, 4] have also applied formal methods to the verification of FPUs. At Intel, FPUs are verified using a customized toolset combining STE and theoremproving, likely requiring implementation-... |

2 |
Formal verification of floating point multiply add on Itanium processors
- Slobodova, Nagalla
- 2004
(Show Context)
Citation Context ...ving, likely requiring implementation-specific manual effort. Recently, a sketch of the application of this approach to the verification of Intel’s Itanium fused-multiply-add datapath was provided in =-=[20]-=-. In contrast to our work, their approach does not address details of the case-splits necessary for tractability, and does not cover denormal results nor operands. The verification at AMD uses the the... |