Verifying Tomasulo’s Algorithm by Refinement
T. Arons and A. Pnueli
Department of Applied Mathematics
Weizmann Institute of Science
Rehovot, 76100, Israel
f
tamarah, amir
g
@wisdom.weizmann.ac.il
Abstract
In this paper Tomasulo’s algorithm for out-of-order ex-
ecution is shown to be a refinement of the sequential in-
struction execution algorithm. Correctness of Tomasulo’s
algorithm is established by proving that the register files of
Tomasulo’s algorithm and the sequential algorithm agree
once all instructions have been completed.
1. Introduction
Modern out-of-order super-scalar microprocessors use
dynamic scheduling to increase the number of instructions
executed per cycle. These processors maintain a fixed-size
window into the instruction stream, analyzing the instruc-
tions in the window to determine which can be executed
out of order to improve performance. Branch prediction
and register renaming are employed in order to keep the
window full, while result-buffering techniques maintain the
in-order-execution model required by the architecture.
In this paper we propose a proof-method for proving cor-
rectness of such processor designs based on refinement,and
illustrate it by showing correctness of the Tomasulo algo-
rithm [3] for out-of-order execution. Our approach is based
closely on [2] and shares the advantages of this approach,
in particular, the ability to cope with generic designs, es-
tablishing correctness for an arbitrary number of functional
unitsperformingarbitraryarithmeticoperations. Arithmetic
operations are modeled as uninterpreted functions, allow-
ing us to verify instruction scheduling without performing
arithmetic verification. Our approach greatly simplifies the
proof by obviating the need for the intermediate abstrac-
tion used by Damm and Pnueli. Instead, we introduce a
predicted value field to allow us to directly compare sys-
tem TOMASULO to system SEQ. We believe that the use of
This research was supported in part by a gift from Intel, a grant from the
Minerva foundation, and an Infrastructure grant from the Israeli Ministry
of Science.
predicted values, as presented in this paper, provides an ef-
fective means of verifying refinement between two systems
which run at different rates. Our proof is intuitively simple
and has been verified using the PVS [5] theorem prover.
Recent papers [4, 6] proposenew techniques for verifying
out-of-order processing units. In [4] Tomasulo’s algorithm
is verified using the SMV verifier, and an impressive level
of automation is achieved. The proof, however, is depen-
dent on the configuration and arithmetic operators and any
modification requires that the new system be verified afresh.
A more complex model of out-of-order execution is ver-
ified in [6] using the Stanford Validity Checker. The im-
plementation machine is shown to refine an intermediate
abstraction. Incremental flushing is then used to show that
the intermediate abstraction is functionally equivalent to the
specification machine. In comparison, our refinement is to
the specification level, obviating the need for a second stage.
This paper is structured as follows: The next section
presents our definition of refinement. Ultimately, the im-
plementation has to be compatible with the sequential ref-
erence model developed in Section 3. Section 4 introduces
the Tomasulo algorithm. In section 5 we sketch the proof of
correctness.
2. Refinement
An abstract system
S
A
is designed to serve as a specifi-
cation capturing all the acceptable correct computations of
the concrete system
S
C
.WetakeSEQ and TOMASULO as the
abstract and concrete system respectively.
Observation functions
O
A
and
O
C
of
S
A
and
S
C
are
defined. These functions indicate the parts of the systems
which are compared by the refinement relation.
The transition relations
A
and
C
define how the system
movesfromonestateto another. For example, inone stepthe
sequential algorithm may execute an instruction, updating
the program counter and register file. Typically,
A
is non-
deterministic (e.g. SEQ may either execute an instruction or
idle). We define a transition relation
A
which can use any
