Automatic Modeling and Validation of Pipeline Specifications driven by an Architecture Description Language z y y y y Prabhat Mishray Hiroyuki Tomiyama Ashok Halambi Peter Grun Nikil Dutt Alex Nicolau y Center for Embedded Computer Systems z Inst. of Systems & Information Tech. University of California, Irvine, CA 92697 Fukuoka 814-0001, Japan g fpmishra, ahalambi, pgrun, dutt, nicolau @cecs.uci.edu [email protected] Abstract controlled token nets from a logic design to perform efficient model checking. Our verification technique is complimentary Verification is one of the most complex and expensive tasks to these bottom-up approaches. We leverage the system ar- in the current Systems-on-Chip (SOC) design process. Many chitect’s knowledge about the behavior of the pipelined ar- existing approaches employ a bottom-up approach to pipeline chitecture through ADL constructs, which allows a powerful validation, where the functionality of an existing pipelined top-down approach to pipeline verification using behavioral processor is, in essence, reverse-engineered from its RT-level knowledge of the pipelined architecture. The ADL descrip- implementation. Our approach leverages the system archi- tion also serves as a golden reference model. Furthermore, tect’s knowledge about the behavior of the pipelined archi- ADL driven verification is a natural choice during rapid de- tecture, through Architecture Description Language (ADL) sign space exploration(DSE) of System-on-Chip(SOC) archi- constructs, and thus allows a powerful top-down approach tectures. to pipeline validation. This paper addresses automatic vali- In this paper, we present an automatic validation frame- dation of processor, memory, and co-processor pipelines de- work, driven by an ADL. A novel feature of our approach is scribed in an ADL. We present a graph-based modeling of the ability to model the pipeline structure and behavior for architectures which captures both structure and behavior of the processor, co-processor, as well as the memory subsystem the architecture. Based on this model, we present formal using a graph-based model. Based on this model we present approaches for automatic validation of the architecture de- formal approaches for automatic validation of the architecture scribed in the ADL. We applied our methodology to verify described in an ADL. We applied our methodology to verify several realistic architectures from different architectural do- several realistic architectures from different architectural do- mains to demonstrate the usefulness of our approach. mains (RISC, DSP, VLIW, and Superscalar) to demonstrate 1 Introduction the usefulness of our approach. The rest of the paper is organized as follows. Section 2 Verification is one of the most complex and expensive tasks presents related work addressing ADL-driven validation ap- in the current System-On-Chip design process. In current proaches. Section 3 outlines our approach and the overall flow state-of-the-art verification methodology, the architect pre- of our environment. Section 4 presents a graph-based model- pares an informal specification in the form of an English docu- ing of processor, memory, and co-processor pipelines. Sec- ment. The logic designer implements the modules and verifies tion 5 proposes several properties that must be satisfied for them in an ad-hoc manner using simulation test vectors since valid pipeline specification. Section 6 illustrates validation of there is no golden reference model for validation. A key chal- pipeline specifications for several realistic architectures. Fi- lenge in today’s design verification is to extract the informa- nally, Section 7 concludes the paper. tion from the RT level description and to perform equivalence checking with the model extracted from the given specifica- 2 Related Work tion (written in English language). Many existing approaches Recent work on language-driven Design Space Exploration ([5], [8]) employ a bottom-up approach to pipeline validation, (DSE) ([1], [2], [4], [12]), uses Architectural Description Lan- where the functionality of an existing pipelined processor is, guages (ADL) to capture the processor and memory archi- in essence, reverse-engineered from its RT-level implementa- tecture, generate automatically a software toolkit (including tion. Hauke et al. [5] compare extracted ISA level description compiler, simulator, assembler) for that architecture, and pro- with the given ISA level specification. Ho et al. [3] extract vide feedback to the designer on the quality of the architec- This work was partially supported by grants from NSF (MIP-9708067), ture. It is necessary to verify that the ADL description of DARPA (F33615-00-C-1632), Motorola Inc. and Hitachi Ltd. the architecture is well-formed prior to generating software toolkits. The process of any specification is error-prone and ADL e.g., EXPRESSION [1]. This graph model can cap- validation techniques can be used to check for correctness of ture processor, memory, and co-processor pipelines for wide the specification. Moreover, changes made to the architecture variety of architectures viz., RISC, DSP, VLIW, Superscalar, during design space exploration may result in incorrect exe- and Hybrid architectures. Note that it is important to capture cution of the system and validation techniques can be used to the memory pipeline along with processor pipeline, since any ensure correctness of the architecture. memory operation exercises both the processor and memory The work of Tomiyama et al. [9, 10] is a step in this di- pipeline structures [13]. In this section we briefly describe rection. They defined certain properties that need to be veri- how we model the structure, behavior and the mapping func- fied to ensure that the architecture description is well-formed. tions between them. The detailed description of the modeling However, the properties they proposed are applicable to sim- can be found in [7]. ple processor models. Moreover, they do not demonstrate how 4.1 Structure these properties can be applied in SOC verification during de- sign space exploration. Mishra et al. [11] presented a graph The structure of an architecture pipeline is modeled as a G based validation of processor cores and is closest to our ap- graph S G =V ;E : S S S (1) proach. Our work extends this technique to validate pipeline V V S specifications of coprocessors and memory subsystem along S denotes a set of components in the architecture. con- with processor cores. sists of four types of components V = V [ V [ V [ V unit stor e por t conn 3 Our Approach S (2) V V stor e where unit is a set of units (e.g., ALUs), asetof Figure 1 shows the flow in our approach. In our ADL V driven design space exploration scenario, the designer starts storages (e.g., register files, caches), por t asetofports,and V E S by describing the programmable architecture in an ADL. The conn asetofconnections (e.g., buses). consists of two graph model of the architecture can be generated automati- types of edges E = E [ E data tr ans pipeline cally from this ADL description. Several properties are ap- S (3) plied automatically to ensure that the architecture is well- E E tr ans pipeline where data is a set of data-transfer edges and formed. To enable rapid DSE the software toolkit can be gen- is a set of pipeline edges. erated from this golden reference model and the feedback can E V V [ V V tr ans unit por t stor e por t be used to modify the ADL description of the architecture. data [ V V [ V V conn conn por t This golden reference model can also be used to verify the por t implementation by performing equivalence checking with the [ V V [ V V unit por t stor e por t (4) reverse-engineered description of the implementation.. E V V unit unit pipeline (5) SPECIFICATION ADL v ;v 2 E tr ans 2 data A data-transfer edge 1 indicates connec- English Document SPECIFICATION Automatic tivity of the two components. Through data-transfer edges, Feedback Manual Property data is transfered from components to components. A pipeline Verification Checking edge specifies the ordering of units comprising the pipeline stages (or simply pipe-stages). Intuitively, operations flow High Level from pipe-stages to pipe-stages through pipeline edges. Both Graph Model Description Eqivalence pipeline edges and data-transfer edges are uni-directional. Bi- Checking Property Feedback directional data-transfers are modeled using two edges of dif- Checking ferent directions. Reverse For illustration, we use a simple multi-issue architecture Engineering containing one co-processor and a memory subsystem. Fig- ure 2 shows the graph-based model of this architecture that can issue up to three operations (an ALU operation, a mem- RT Design Compiler Simulator ory access operation and one coprocessor operation) per cy- Appl Obj cle. In the figure, normal boxes denote units, dotted boxes Figure 1. ADL-driven validation flow are storages, small circles are ports, shaded boxes are con- 4 Architecture Pipeline Modeling nections, bold edges are pipeline edges, and dotted edges are data-transfer edges. For ease of illustration, we have shown We develop a graph-based modeling of architecture only few ports and connections. Each component has several pipelines which captures both the structure and the behav- attributes. The figure shows only two of them viz., capac- ior. The graph model presented here can be derived from ity and timing for some of the nodes. The capacity denotes a pipeline specification of the architecture described in an the maximum number of operations which the component can 3,1 L1 3,2 Fetch OO p5 p6 Inst. ADD ADD_SRC1 ADD_SRC2 ADD_DST c3 c1 4,1 3,1 LD LD_SRC1 LD_SRC_MEM LD_DST O Decode p4 Operation edge Execution edge 1,1 CP_1 ALU1 AddrCalc 1,1 EMIF_1 Figure 3. A fragment of the behavior graph 1,1 1,1 p3 Local O 1,10 CoProc DMA Memory Register V are of two types: opc is a set of opcode nodes that represent File 1,1 CP_2 V O p2 the opcode (i.e.