An Overview of the Formal Specification and Verification of the FM9001 Microprocessor

The use of mathematical logic for modeling and reasoning about hardware designs promises assurance of circuit correctness beyond what is available from current state-of-practice techniques. The development and use of formal tech-approach to circuit validation is known generally as hardware veriication. Circuits with the complexity of microprocessors 5, 30, 35, 46] have been given mathematical speciications, and their designs have been proved to implement their speciications. Yet, the transfer of hardware veriication techniques to commercial engineering practice has been hampered by such factors as the use of non-standard notations, inaccessibility of the tools, and the signiicant mathematical sophistication required to use these approaches. In addition, formal techniques have been directed at only selected aspects of the design process. Important hardware characteristics such as testability and I/O behavior have been largely neglected by the formal hardware modeling and veriication community. We have attempted to address some of these issues by considering the formal speciication, veriication, and physical implementation of the FM9001 microprocessor. The FM9001 is a general-purpose 32-bit microprocessor whose gate-level netlist design implementation was developed using a theorem-proving environment in conjunction with a traditional CAD system. The behavioral speciica-tion for the FM9001, the deenition of the hardware description language (HDL) used to represent the design of the FM9001, the simulator for the HDL, and the veriication of the FM9001 were all carried out using the Boyer-Moore theorem-proving system Nqthm 9]. The FM9001 netlist was mechanically translated to LSI Logic's Netlist Description Language and implemented by LSI Logic, Inc., as a CMOS gate-array. Rigorous testing has not uncovered any situation where the manufactured device fails to meet its speciication. The FM9001 also serves as the target for the veriied assembler, Piton 42], which in turn serves as the target of the veriied-Gypsy compiler 49]. This document presents the details of the FM9001 development, its speciication, and its veriication.