Verifying Compiler Based Refinement of Bluespec^TM Specifications Using the SPIN Model Checker

Abstract

The underlying model of computation for PROMELA is based on interacting processes with asynchronous communication, and hence SPIN has been mainly used as a verification engine for concurrent software systems. On the other hand, hardware verification has mostly focused on clock synchronous register-transfer level (RTL) models. As a result, verification tools such as SMV which are based on synchronous state machine models have been used more frequently for hardware verification. However, as levels of abstractions are being raised in hardware design and as high-level synthesis is being promoted for synthesizing RTL, hardware design verification problems are changing in nature. In this paper, we consider a specific high-level hardware description langauge, namely, Bluespec System Verilog (BSV). The programming model of BSV is based on concurrent guarded actions, which we also call as Concurrent Action Oriented Specification (CAOS). High-level synthesis from BSV models has been shown to produce efficient RTL designs. Given the industry traction of BSV-based high-level synthesis and associated design flow, we consider the following formal verification problems: (i) Given a BSV specification ${\cal S}$ of a hardware design, does it satisfy certain temporal properties? (ii) Given a BSV specification ${\cal S}$, and an implementation R synthesized from ${\cal S}$ using a BSV-based synthesis tool, does R conform to the behaviors specified by ${\cal S}$; that is, is R a refinement of ${\cal S}$? (iii) Given a different implementation R ^′ synthesized from ${\cal S}$ using some other BSV-based synthesis tool, is R ^′ a refinement of R as well? In this paper, we show how SPIN Model Checker can be used to solve these three problems related to the verification of BSV-based designs. Using a sample design, we illustrate how our approach can be used for verifying whether the designer intent in the BSV specification is accurately matched by its synthesized hardware implementation.