General Terms

Presented is a method for formal verification of pipelined processors with long instruction queues. The execution engine and the fetch engine (where the instruction queue is) are formally verified separately, after abstracting the other engine with a nondeterministic FSM derived from the high-level specification of that engine. Without the presented method, the monolithic formal verification of 9-stage, 9-wide VLIW processors—implementing many realistic and speculative features inspired by the Intel Itanium—scaled for models with 5 instruction-queue entries, but ran out of memory if the instruction queue was longer. The presented method resulted in 2 orders of magnitude speedup for the processor with 5 instruction-queue entries, and enabled scaling for designs with 64 instruction-queue entries. Categories and Subject Descriptor

Collection of High-Level Microprocessor Bugs from Formal Verification of Pipelined and Superscalar Designs

The paper presents a collection of 93 different bugs, detected in formal verification of 65 student designs that include: 1) singleissue pipelined DLX processors; 2) extensions with exceptions and branch prediction; and 3) dual-issue superscalar implementations. The processors were described in a high-level HDL, and were formally verified with an automatic tool flow. The bugs are analyzed and classified, and can be used in research on microprocessor testing