Sixth International Workshop on Designing Correct Circuits Vienna, 25–26 March 2006 A Satellite Event of the ETAPS 2006 group of conferences Participants’ Proceedings Edited by Mary Sheeran and Tom Melham Preface This volume contains material provided by the speakers to accompany their presentations at the Sixth International Workshop on Designing Correct Circuits, held on the 25th and 26th of March 2006 in Vienna. The workshop is a satellite event of the ETAPS group of conferences. Previous workshops in the informal DCC series were held in Oxford (1990), Lyngby (1992), Båstad (1996), Grenoble (2002), and Barcelona (2004). Each of these meetings provided a stimulating occasion for academic and industrial researchers to get together for discussions and technical presentations, and the series as a whole has made a significant contribution to supporting our research community. The 2006 DCC workshop again brings together researchers in formal methods for hardware design and verification. It will allow participants to learn about the current state of the art in formally based hardware verification and design and it is intended to further the debate about how more effective design and verification methods can be developed. For some time now, research in hardware verification is being done industrial laboratories, as well as in universities. Industry is commonly focussed on relatively immediate verification goals, but also keeps our work grounded in practical engineering problems. To make progress on the longer-term problems in our field, academic and industrial researchers must continue to work together on the problems facing microprocessor and ASIC designers now but also into the future. A major aim of the DCC series of workshops has been to provide a congenial and relaxed venue for communication among researchers in our community. DCC 2006 attracted a very strong field of submissions, and we hope the selection the Programme Committee has made will keep the debate stimulating and productive. We look forward to two great days of presentations and discussion. We wish to express our gratitude to the members of the Programme Committee for their work in selecting the presentations, and to all the speakers and participants for their contributions to Designing Correct Circuits. Mary Sheeran and Tom Melham March 2006 Programme Committee Dominique Borrione (TIMA, Grenoble University, France) Elena Dubrova (KTH, Sweden) Niklas Eén (Cadence Design Systems, USA) Warren Hunt (UT Austin, USA) Robert Jones (Intel Corporation, USA) Wolfgang Kunz (TU Kaiserslautern, Germany) Per Larsson-Edefors (Chalmers, Sweden) Andrew Martin (IBM Research, USA) Tom Melham (Oxford University, UK) Johan Mårtensson (Jasper Design Automation, Sweden) John O’Leary (Intel Corporation, USA) Carl Pixley (Synopsys, USA) Mary Sheeran (Chalmers, Sweden) Satnam Singh (Microsoft Corporation, USA) Joe Stoy (Bluespec, USA) Jean Vuillemin (École Normale Supérieure, France) DCC 2006 Microprocessor Verification Based on Datapath Abstraction and Refinement Zaher S. Andraus, Mark H. Liffiton, and Karem A. Sakallah Department of Electrical Engineering and Computer Science University of Michigan Ann Arbor, MI 48109-2122 {zandrawi,liffiton,karem}@eecs.umich.edu Counterexample Guided Abstraction Refinement (CEGAR for short) has been shown to be an effective paradigm in a variety of hardware and software verification scenarios. Originally pio- neered by Kurshan [7], it has since been adopted by several researchers as a powerful means for coping with verification complexity. The wide-spread use of such a paradigm hinges, however, on the automation of its abstraction and refinement phases. Without automation, CEGAR requires laborious user intervention to choose the right abstractions and refinements based on a detailed understanding of the intricate interactions among the components of the design being verified. Clarke et al. [3], Jain et al. [5], and Dill et al. [2] have successfully demonstrated the automation of abstraction and refinement in the context of model checking for safety properties of hardware and software systems. In particular, these approaches create a smaller abstract transition system from the underlying concrete transition system and iteratively refine it with the spurious coun- terexamples produced by the model checker. The approaches in [3] and [5] are additionally based on the extraction of unsatisfiability explanations derived from the infeasible counterexamples to provide stronger refinement of the abstract model and to significantly reduce the number of refinement iterations. All of these approaches are examples of predicate abstraction which essentially projects the concrete model onto a given set of relevant predicates to produce an abstraction suitable for model checking a given property. In contrast, we describe in [1] a methodology for datapath abstraction that is particularly suited for equivalence checking. In this approach, datapath com- ponents in behavioral Verilog models are automatically abstracted to uninterpreted functions and predicates while refinement is performed manually using the ACL2 theorem prover [6]. The use of (near)-minimal explanations of unsatisfiability forms the basis of another class of abstraction methods. These include the work of Gupta et al. [4] and McMillan et al. [8] who employ “proof analysis” techniques to create an abstraction from an unsatisfiable concrete bounded model checking (BMC) instance of a given depth. In this talk we explore the application of CEGAR in the context of microprocessor correspon- dence checking. The approach is based on automatic datapath abstraction as in [1] augmented with automatic refinement using minimal unsatisfiable subset (MUS) extraction. One of our main conclusions is the necessity of basing refinement on the extraction of MUSes from both the abstract and concrete models. Additionally, refinement tends to converge faster when multiple MUSes are extracted in each iteration. Finally, localization and generalization of spurious coun- terexamples are also shown to be crucial for refinement to converge quickly. We will describe our implementation of these ideas in the Reveal system and discuss the effectiveness of the various refinement options in the verification of a few benchmarks. 1 DCC 2006 REFERENCES [1] Z. S. Andraus and K. A. Sakallah, “Automatic Abstraction of Verilog Models”, In Proceed- ings of 41st Design Automation Conference 2004, pp. 218-223. [2] S. Das and D. Dill, “Successive Approximation of Abstract Transition Relations” in 16th Annual IEEE Symposium on Logic in Computer Science (LICS) 2001. [3] E. Clarke, O. Grumberg. S. Jha, Y. Lu and H. Veith, “Counterexample-Guided Abstraction Refinement,” In CAV 2000, pp. 154-169. [4] A. Gupta, M. Ganai, Z. Yang, and P. Ashar, “Iterative Abstraction Using SAT-based BMC with Proof Analysis.” In Proc. of the International Conference on CAD, pp. 416-423, Nov. 2003. [5] H. Jain, D. Kroening and E. Clarke, “Predicate Abstraction and Verification of Verilog,” Technical Report CMU-CS-04-139. [6] M. Kaufmann and J. Moore, “An Industrial Strength Theorem Prover for a Logic Based on Common Lisp.” IEEE Transactions on Software Engineering 23(4), April 1997, pp. 203-213. [7] R. Kurshan, “Computer-Aided Verification of Coordinating Processes: The Automata-Theo- ritic Approach,” Princeton University Press, 1999. [8] K. L. McMillan and N. Amla, “Automatic Abstraction without Counterexamples.” In Inter- national Conference on Tools and Algorithms for Construction and Analysis of Systems (TACAS’03), pp. 2-17, Warsaw, Poland, April, 2003, LNCS 2619. 2 An Implementation of Clock-Gating and Multi-Clocking in Esterel Laurent Arditi, G´erard Berry, Marc Perreaut Esterel Technologies {Laurent.Arditi,Gerard.Berry,Marc.Perreaut}@esterel-technologies.com Michael Kishinevsky Intel Strategic CAD Labs [email protected] Clock gating and multi-clocking are now common design techniques that are used for power reduction and for handling systems with different operational frequencies. They cannot be handled by Classic Esterel language and tools because the Classic Esterel is a single clock synchronous paradigm and Esterel compilers can generate single clock circuits only. To cover broader class of design needs, we propose to extend Esterel to other clocking schemes, including clock-gating and multi-clocking. This extension must satisfy three major needs: • enhance the scope of designs that can be modeled in Esterel, • allows to generate different implementations depending on the final target: a single clock circuit (e.g. for compiling a specification into a basic FPGA), a circuit with clock-gating or an equivalent circuit without clock-gating, and a multi- clock circuit (e.g. for compiling to an ASIC). The choice of the implementation should be possible at compilation time, without requiring any change in the source model. • provide support by all tools comprising the Esterel development framework: the graphical Esterel entry, software simulation and debug, embedded code genera- tion, formal verification, optimization. The core of the implementation for the clock-gating is based on a new Esterel in- struction called weak suspend. This instruction freezes the control and data registers, while letting the combinational part computing the values as functions of inputs and the state. The effect of this instruction is similar to an effect of clock-gating on a hard- ware block. We developed an Esterel compiler which can generate RTL code (VHDL and Verilog) with the