Verifikation reaktiver Systeme - Universität Kaiserslautern

218
Using Theorem Proving
to Verify Arithmetic Hardware
Jens Brandt
Fachbereich Informatik
Technische Universität Kaiserslautern
brandt@informatik.uni-kl.de
Abstract. Computer systems are becoming more and more complex,
and the task of making sure that they work correctly is getting increasingly
difficult. In the past, solely simulation was used to expose bugs.
Today’s hardware development processes usually include formal verification
to complement testing. But some problems are too complex for
traditional formal techniques in hardware verification – equivalence and
model checking – especially those with large regular structures found in
arithmetic circuits. Theorem provers are an alternative to reason about
arithmetic components by exploiting structure and hierarchy. After an
introduction to the HOL therom proving environment, some examples
are presented that illustrate the advantages of this method.
1 Introduction
As computer systems are becoming more and more complex, the task of making
sure that they work correctly is getting increasingly difficult. Besides that, the
consequences of failure are becoming more serious, too. Meanwhile, computer
systems are used in many safety-critical areas where errors cannot be tolerated.
Even in non safety-critical areas, e.g. the home user PC, hardware errors can
cause an expensive recall process: Intel lost approximately 450 million dollars
ten years ago in 1994 due to the well-known Pentium bug (causing potentially
wrong results of floating-point division).
In the past, solely simulation and testing were used to expose bugs. Today’s
hardware development processes usually includes formal verification to complement
testing. Various methods have been researched and applied in industry,
including equivalence checking, model checking and theorem proving. Equivalence
and model checking have already proven to be adequate for automatically
verifying a variety of large-style industrial designs. But, for equivalence or model
checking, some problems are too complex, especially those related to arithmetic
circuits. The methods can hardly exploit the regular structures of most arithmetic
components. Even worse, BDD representations of some components like
multipliers have got an exponential size, making it (almost) impossible to verify
real-world problems. Theorem provers can be used in these cases, because they
(or their users) are aware of the structure and hierarchy, making it possible to
decompose the proof obligations. Moreover, correctness proofs may depend on