Formal specification and verification of a dataflow processor array

We describe the formal specification and verification of the VGI parallel DSP chip [1], which contains 64 compute processors with ∼30K gates in each processor. Our effort coincided in time with the “informal ” verification stage of the chip. By interacting with the designers, we produced an abstract but executable spec-ification of the design which embodies the programmer’s view of the system. Given the size of the design, an automatic check that even one of the 64 processors satisfies its specification is well beyond the scope of current verification tools. However, the check can be decomposed using assume-guarantee reason-ing. For VGI, the implementation and specification operate at different time scales: several steps of the implementation corre-spond to a single step in the specification. We generalized both the assume-guarantee method and our model checker MOCHA to allow compositional verification for such applications. We used our proof rule to decompose the verification problem of the VGI chip into smaller proof obligations that were discharged auto-matically by MOCHA. Using our formal approach, we uncovered and fixed subtle bugs that were unknown to the designers.