Balancing Formal and Dynamic Techniques in Validation of

Balancing Formal and Dynamic Techniques in Validation of Industrial Arithmetic Designs Roope Kaivola Intel DEG/EMG

Inside Intel

Moore’s Law - 1965 3 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Source: Intel Museum

Moore’s Law - 40 Years Later Process Name P 854 P 856 P 858 Px 60 P 1262 P 1264 P 1266 1 st Production 1995 1997 1999 2001 2003 2005 2007 65 nm 45 nm Lithography 0. 35 mm 0. 25 mm 0. 18 mm 0. 13 mm 90 nm Gate Length 0. 35 mm 0. 20 mm 0. 13 mm <70 nm <50 nm <35 nm <25 nm Wafer Size (mm) 200 200/300 A new process every two years 4 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Source: Intel 300

Moore’s Law - Implications • Each new process generation doubles the number of transistors available to architects and designers • Some of this increase is consumed by larger structures (caches, TLB, etc. ) • The rest goes to increased complexity: • Out-of-order, speculative execution machines • Deeper pipelines • New technologies (Hyper-Threading, 64 -bit extensions, virtualization, security, … ) • Multi-core designs 5 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

300 mm Semiconductor Economics Fab $3 billion Pilot line $1 -2 billion R&D process team $0. 5 -1 billion $5 billion investment requires high volume to achieve reasonable unit cost 6 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Source: Intel

The Validation Challenge • Validation driven by the economics of Moore’s Law • High initial investment requires high volume • Increased complexity increased validation effort and risk High volumes magnify the cost of a validation escape 7 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Design

Microprocessor Design Scope Typical lead CPU design requires: • 500+ person design team: – – logic and circuit design physical design validation and verification design automation • 2 -2½ years from start of RTL coding to A 0 tapeout • 9 -12 months from A 0 tapeout to production qual (may take longer for workstation/server products) One design cycle = 2 process generations 9 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Pentium® 4 RTL Development RTL Coding Complete 250 K lines changed in one week 3000 files, 1. 3 M lines total (including comments, white space) A 0 tapeout First Full-Chip RTL Model Functionality Focused 10 Timing Focused 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Design Hierarchy System Bus Unit Level 2 Cache Memory Subsystem Fetch/ Decode Unit Trace Cache Microcode ROM BTB/Branch Prediction Front End Level 1 Data Cache Execution Units Integer and FP Execution Units Out-of-order execution logic Retirement Branch History Update Out-of-order Engine Pentium® 4 Basic Block Diagram 11 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Cluster

Design Hierarchy 10000 k Full chip 1000 k Cluster 100 k Unit 10 k 1 k gate elements 12 Fub Sub-fub Design level 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Design Hierarchy 10000 k Full chip 1000 k Cluster 100 k Unit 10 k 1 k gate elements 13 Fub Sub-fub Design level 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Design Hierarchy 10000 k 1000 k Well-defined interfaces “What” functionality Cluster 100 k Unit 10 k 1 k gate elements 14 Full chip Fub Sub-fub Design level 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Design Hierarchy 10000 k 1000 k Well-defined interfaces “What” functionality Full chip Cluster 100 k Unit 10 k 1 k gate elements 15 Fub Ad hoc interfaces “How” functionality Sub-fub Design level 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Validation

Validation • Pre-silicon • Tape out a healthy product • Stages – Exercise – Stress – Coverage • Post-silicon • Identify functional issues pre-silicon validation missed • Physical reality check 17 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

RTL Simulation • Pre-silicon RTL simulation has advantages: • Fine-grained (cycle-by-cycle) checking • Complete visibility of internal state • APIs to allow event injection • BUT simulation is MUCH slower than real silicon • A full-chip simulation with checkers runs at ~20 Hz on a Pentium 4 class machine • A compute farm with ~6 K CPUs running 24/7 • The sum total of Pentium 4 RTL simulation cycles run prior to A 0 tapeout < 1 minute on a single 2 GHz system 18 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

RTL Simulation – Coverage • Ideology • List all interesting cases you can think of • Hit these by random stimulus • You will then likely also hit most interesting cases you did not think of • THE mainstream validation technology • Very powerful in practice – as long as interesting scenarios carefully identified 19 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

RTL Simulation – Granularity • Cluster Test Environment • Simulate each cluster in isolation • Better visibility and controllability • Faster • Full-Chip Test Environment • Do all the pieces fit together? • Have we implemented IA-32? 20 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

RTL Simulation – Limits • No amount of dynamic validation provides certainty: • A single dyadic extended-precision (80 -bit) FP instruction has ~10**50 possible combinations • Exhaustive testing is impossible, even on real silicon • Getting coverage from 0% to 80% is easy, getting from 95% to 98% painful • Were all interesting scenarios considered when defining coverage targets? 21 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Pentium® 4 Formal Verification

Pentium® 4 Formal Verification • First large-scale effort at Intel (~60 person years) to apply formal verification techniques to CPU design • Objective: • Complement other validation activities • Correctness, not bug hunting • Tools: • (SMV-like) Model checking • Symbolic simulation • Theorem proving to connect FP proofs to IEEE 754 23 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Formal Verification – Organization • An independent team within design/pre-silicon validation • Benefits: – Impartial design scrutiny – Expertise - reusable proof frameworks • Detractions: – Designs not created for verification – Reverse engineering 24 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Pentium® 4 Formal Verification • More than 14, 000 properties in key areas: • FP Execution units • Instruction decode • Out-of-order control mechanisms • Primarily safety properties or conformance to a specification reference model • Found ~20 “high quality” bugs that would have been hard to detect by dynamic testing • No silicon bugs found to date in areas proved by FV 25 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

FPV Abstract Model 26 HLM RTL FEV Checker Functional Validation Domain of FV (FPV) Netlist 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Formal Specifications

Design from FV Perspective • RTL written by circuit design engineers • Optimized using expected constraints: often “almost wrong” • In general, FV has little influence over designs • FV models are automatically compiled from RTL source code (gate level) 27 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Pentium® 4 - Unit-Level FV

Unit-Level Verification • Our primary approach for Pentium 4 verification • Bottom-up strategy • First prove unit properties, then multiple-unit protocols and assumptions • Maintain properties on evolving design and proliferation reuse. • Leverage results on subsequent designs • Tools & technologies: • SMV-like “traditional” model checker • LTL-inspired property description languages (e. g. For. Spec) 29 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

“Traditional” Model-Checking • Check that all reachable states are OK • Rule of thumb: feasible when at most 100 significant state elements 30 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

“Traditional” Model-Checking • Check that all reachable states are OK • Rule of thumb: feasible when at most 100 significant state elements 31 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

“Traditional” Model-Checking • Check that all reachable states are OK • Rule of thumb: feasible when at most 100 significant state elements • Decompositions move properties to a lower level • Reductions and abstractions squeeze irrelevant information out of a model • Models with higher abstraction level miss the low-level bugs 32 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

FSM Interactions Example PE Unit B Machine 1 Machine 2 WB Unit A RP FSM (~17 states each) B 1 Sequential logic B 2 B 3 Unit C 33 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Property Example • Top level property (real objective) • A request from Unit A to Unit C always gets acknowledged • Low level specs proved (downsized/”traditional” objectives) • • Both machines cannot be in their fault states at the same time When one of the machines sends a request, the PE eventually acks the request, unless it is cancelled. In the presence of a clear during action a, the action is continued, but z is dropped when action a completes. An fault during action b should not result in action a. After the PE acknowledges a write request, it always initiates a read. The state machines never livelock. A cancel results in the state machines going idle eventually. When the state machine reaches state i, ii, or iii, it eventually receives an ack from X. • No notion of completeness if only prove low level specs 34 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Observations • The approach allowed us to verify a large collection of critical local properties on the Pentium 4 design • Capacity limitations require significant property decomposition: • Reasoning at the bottom of the hierarchy • Low-level decompositions break when design changes • Local “flaws” corrected in the broader scheme of things • Designs often work more “just because” than due to sound reasoning 35 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Formal Verification vs. Simulation

FV vs. Simulation • yields partial results quickly, • progresses in a linear fashion, • but reaching full coverage is very hard, and • completeness is unattainable. Formal Verification • is woefully capacity-constrained • slow to produce results, • but has the promise of completeness. 37 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

The Synergy Problem • Coverage-based validation requires one to identify the sets of interesting cases for all aspects of the design, • Even if some aspects of the design are formally verified, we still need coverage for them, to make sure we are hitting the other design aspects we failed to identify when defining our coverage targets • Therefore, formal verification gives little or no reduction in simulation effort Two ways forward: • FV as an “extra” • FV replacing coverage 38 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Replacing Simulation by Formal Verification • First design exercise testing is unlikely to be replaced by formal verification • Coverage-based validation can be replaced by FV, IF • FV works at the same level of granularity as simulation, and • FV addresses all the aspects of the design simulation does. Can we do this? 39 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Formal Verification – Execution Cluster

EXEC System Bus Unit Level 2 Cache Memory Subsystem Fetch/ Decode Trace Cache Microcode ROM BTB/Branch Prediction Front End Level 1 Data Cache Execution Units Integer and FP Execution Units Out-of-order execution logic Retirement Branch History Update Out-of-order Engine Pentium® 4 Basic Block Diagram 41 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC • Execution Cluster – all micro-operations executed here • Validation task: functional correctness • Huge state spaces (exceeding 2160 ) • Floating-point, integer arithmetic etc 42 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC – FMUL Data-Path Generate Partial Products … ADD ROUND 43 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC – FMUL Data-Path … GRSS……………. . …S Sticky bits – only care whether any is high or none is 44 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC – FMUL Data-Path Optimization … C CS GRS……. . SS 45 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Compress lower sticky bits to a single sticky and some carry bits

EXEC – FMUL Data-Path Optimization Bug … C 0 S ADD GRS……. . SS ROUND 46 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Drop low carry in addition!

EXEC – FMUL Data-Path Optimization Bug … C 0 S ADD GRS……. . SS ROUND 47 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Bug observable only when: -Low carry = 1 -All higher sticky bits 1’s

EXEC – FMUL Data-Path Optimization Bug … C 0 S ADD GRS……. . SS Bug observable only when: -Low carry = 1 -All higher sticky bits 1’s ROUND Some natural data-path bugs are very hard to hit 48 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC – a FV Success Story! We can formally verify all micro-operations! • Abstract specifications: clean, precise (IEEE for FP) • Proofs from low-level RTL to IEEE specification • Found many high quality bugs on many CPU designs • Verification highly repeatable 49 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC – a FV Success Story! Techniques: • Direct symbolic simulation (STE) • Theorem-proved decompositions for most complex micro-ops (div, sqrt, mul) • Binary Decision Diagrams (BDD’s) • Parametric representations • State constraints by inductive invariants 50 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Symbolic Trajectory Evaluation • Our primary approach for data-path dominated property model checking • High capacity (n*10 k state elements) 51 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Symbolic Trajectory Evaluation • Our primary approach for data-path dominated property model checking • High capacity (n*10 k state elements) 52 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Symbolic Trajectory Evaluation • Our primary approach for data-path dominated property model checking • High capacity (n*10 k state elements) • Low temporal expressiveness: • universal fixed time-window properties • No notion of reachable state space, completely unconstrained initial state • Excels in verification of straight-line pipelined designs 53 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Symbolic Trajectory Evaluation • STE is a built-in function in the re. FLect functional programming environment. • Implemented as a symbolic 4 valued event driven simulator. • Supports usage paradigms that significantly improve capacity: • • • 54 Symbolic indexing Parametric substitutions User-defined and/or dynamic weakening 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

re. FLect An open functional programming environment • Supports development of libraries, scripting, rapid prototyping and development of formal tools, customization. • BDDs are first class objects. • Reflection gives programmatic access to source level syntax. • Theorem prover to reason about re. FLect programs: provides automation for first order and linear arithmetic goals. • Hooks to SAT solvers, automated reasoning engines. 55 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

EXEC Verification Framework • Methodology and tools built in re. FLect. • Support structure • IEEE compliant floating-point library • Customized verification strategies • Interface level proof design environment • Infrastructure designed with proliferation in mind. • Theorems relating model checking to abstract specifications 56 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Case: FP Accumulator • Verification of most micro-operations handled directly by symbolic simulation: for example, floating point accumulator. IEEE spec Theorem proving Environment API Executable Reference Model STE model checking API adds design-specific information about signal names, timing, . . . 57 Accumulator RTL design 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Case: FP Accumulator • Effort involves verifying logic at the Execution cluster boundary • Direct STE with case splitting and parametric representations for cases • Verify data-path correctness • all FP uops, all flavors, all modes, flags, faults • ACC does x 87/SSE 2 ADD, SUB, COM, … • Verify control correctness • ACC takes an arbitrary sequence of uops • interference between uops of different latency 58 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Case: FP Multiplier • Very low-level RTL S 2 • Highly optimized • Supports different operation flavours • Shared control logic • Little symmetry • Direct STE not feasible S 1 Booth Encoder C O N T R O L Exponent datapath Partial Products generator … Wallace Tree Adder Network Rounder logic 59 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice. Mantissa datapath

Case: FP Multiplier • Algorithmic decomposition to enable verification • Verify partial product generation and addition separately • Employ STE to verify sub-proofs individually • Use the deductive engines in re. FLect to tie the results and verify the I/O correctness claim • Decomposition reusable on subsequent designs • Verification with decompositions easier than with a specialized, potentially fully-automated approach (e. g. Binary Moment Diagrams) 60 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Formal Verification vs. Simulation Revisited

Observations from EXEC FV • Symbolic simulation • Gives us sufficient capacity • Can be learnt without a degree in FV (although it helps) • Is easy to communicate to designers • Allows us to work at the same level of granularity (cluster) as simulation • Approach is robust and maintainable 62 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Observations from EXEC FV • For any large FV task targeting complete coverage, the verifier needs to understand in detail • • • How the design works How the verification algorithm works The role of each computation step in the overall verification task in order to solve the inevitable complexity problems. 63 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Industrial Applicability of FV – Intel • Simulation is the default validation approach • In a project setting, FV competes with simulation • FV is competitive in the target areas where verifiers have sufficient prior expertise and collateral • In Intel, FV is an established technology used in most recent CPU development projects 64 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Industrial Application of FV – Bad News • “Lack of capacity” • Many FV approaches lack scalability in two fronts • up in design size • down in result quality • Barriers • Technology • Expertise 65 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Industrial Application of FV – Bad News • “Lack of capacity” • Many FV approaches lack scalability in two fronts • up in design size • down in result quality • Barriers • Technology • Expertise Application of FV is an open research problem! 66 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Industrial Application of FV – Good News • In areas where a verifier can concentrate on verification, instead of solving verification research problems, the effort to carry out FV is comparable to thorough coverage-based validation • Current Intel projects are replacing coverage-based validation by FV in select areas – stay tuned … • Simulation cannot answer questions like: is a design change guaranteed not to break anything? 67 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Opinions

Position Statements • The greatest advantage of FV is complete coverage! • For certain areas of design, we have FV methods with a strong practical track record. Then, the choice to do or not to do FV is a risk tolerance question. • In general, the question of robust, scalable FV methods is an open research problem • I believe that much FV research attempts to fully automate a problem that is too hard to be automated. We have been more successful with simpler methods which the verifiers can help with their insight. 69 11/16/2006 Copyright © Intel Corporation, 2006. All rights reserved. Third-party marks and brands are the property of their respective owners. All products, dates, and figures are preliminary and subject to change without notice.

Questions