Towards a Formal Verification of a Floating Point Coprocessor and its Composition with a Central Processing Unit

Abstract

In previous work (using HOL and other theorem provers) on the verification of microprocessors, the design is typically represented as a single level (e.g., an electronic block model) or as a linear hierarchy of interpreters (Joyce and Windley). There has been no attempt to verify designs that are in reality a central processor composed with various coprocessors, the typical organization of modern microprocessors. Our work is a step towards the verification (ultimately down to the microcode level) of a microprocessor that consists of a central processing unit that is the master of a floating point coprocessor; the design is drawn from the MC68881 floating point coprocessor slaved to the MC68000, but greatly simplified. The coprocessor in isolation will be verified with respect to a specification that captures the IEEE floating point standard. In our system, CPU and floating point instructions are allowed to execute concurrently, but the appearance to the programmer of the composed system is that of a sequentially executing instruction stream. The CPU and floating point coprocessor communicate through the four-phase handshaking protocol. The verification involves reasoning about a form of behavioral abstraction wherein concurrently executing instruction steams are mapped to a sequential stream.