2015 IEEE 33rd VLSI Test Symposium (VTS)
!
UPF-based Formal Verification of Low Power
!
Techniques in Modern Processors
Reza Sharafinejad1, Bijan Alizadeh1,2 and Masahiro Fujita3
1
School of Electrical and Computer Engineering, College of Engineering, University of Tehran, P.o.Box 14395-515, Tehran, Iran
2
School of Computer Science, Institute for Research in Fundamental Sciences (IPM), P.o.Box 19395-5746, Tehran, Iran
3
VLSI Design and Education Center, The University of Tokyo, P.o.Box 113-8654, Tokyo, Japan
E-mails: r.sharafi@ut.ac.ir, b.alizadeh@ut.ac.ir, fujita@ee.t.u-tokyo.ac.jp
Abstract— Ensuring from the correctness of system on a chip (SoC)
designs after the insertion of high level power management strategies
that are disconnected from low level controlling signals, is a serious
challenge to be addressed. This paper proposes a methodology for
formally verifying dynamic power management strategies on
implementations in modern processors. The proposed methodology is
based on correspondence checking between a golden model without
power features as a specification and a pipelined implementation with
various power management strategies. Our main contributions in this
paper are: 1) extracting Power Management Unit (PMU) from
Unified Power Format (UPF) and Global Power Management (GPM),
2) automatically integrating PMU into the implementation and 3)
checking the correspondence between two models with efficient
symbolic simulation. The experimental results show that our method
enables the designers to verify the designs with different power
management strategies up to several thousands of lines of Register
Transfer Level (RTL) code in minutes. In comparison with existing
methods such as [7], our method reduces the number of state
variables, the number of clauses, the number of symbolic simulation
steps, and the CPU time by 11.04×, 17.57×, 2.08× and 13.71×,
respectively.
Keywords—Formal verification; global power management (GPM);
unified power format (UPF); power management unit (PMU)
I. INTRODUCTION
High demand of portable devices such as laptops, mobile
phones, personal digital assistance, smart cards, including Internet
of Things (IoT), utilize intensively low-power design strategies and
techniques such as clock gating, multi-supply multi voltage
(MSMV), and power gating with state retention [1]. On the other
hand, such low power strategies should not be adopted in real
processor designs unless their correctness on the target processor
has been fully verified. Hence, power-aware verification techniques
especially, formal ones are highly desirable. Such techniques must
ensure that not only the power intents have been completely and
correctly implemented, but also the design continues correct
operations after the insertion of power management strategies [2].
In this regard, efforts have been spent to establish a standard
that represents the power features of a system. The first version of
the standard was presented by Accellera organization in 2007, and
finally IEEE institute published the IEEE 1801 standard as Unified
Power Format (UPF) in 2013 [3]. This standard enables the
defining and verifying of the power intent that represents the
power-management architecture (including set of power domains,
power switches, supply networks, etc.) and strategy specifications
(legal system power modes and power transitions). By providing
this standard many Electronic Design Automation (EDA) tools try
to support this power format in different phases of digital system
design flow (from simulation and synthesis to physical design) [4].
978-1-4799-7597-6/15/$31.00 ©2015 IEEE
Works have been performed to use this standard for verifying
power aware designs at different levels of abstraction such as
Register Transfer Level (RTL) and Transaction Level Modeling
(TLM). Authors of [5] proposed assertion based structure for
power management in TLM that presents a generic framework to
abstract relevant power concepts specified by UPF. The authors of
[6] presented a method to extract assertions from Unified Power
Format (UPF) and then verify them with high level global power
intent, including power down and power up states.
The authors of [7] proposed a method to verify power gating
strategy in processors. In this method, first of all, the processor is
abstracted in such a way that its components just work in a single
power domain. In contrast to it, our proposed method works in
multiple power domains. Moreover, it manually performs the
power management control process while in our proposed method;
the power management controller has been integrated into the
implementation that automatically controls the power domains.
Finally, using UCLID 1.0 [8], they have tried to check the
correspondence between the abstracted processor, including some
power aware features with its specification. Although the authors of
[7] have tried to formally verify a power gating strategy in
processors, the proposed verification technique may not be scalable
enough to handle more complex power management strategies
which are usually used in modern processors due to the large
number of symbolic simulation steps. It should be noted that using
UCLID 1.0 to verify modern processors is a well-known approach
utilized by [14] to verify interrupts in modern processors.
In this paper, we propose a verification methodology for low-
power modern processors in two different viewpoints: 1) make sure
that processor's functionality doesn’t change after the insertion of
low power strategies and 2) check to see whether each power
domain of given processor performs its function properly as
defined in UPF. The proposed methodology is based on
correspondence checking between a specification without power
features and a pipelined implementation with various power
management strategies. Hence, our main contributions in this paper
are as follows:
 Automatic extraction of Power Management Unit (PMU)
from UPF and Global Power Management (GPM) which
makes our verification technique efficient in terms of the
number of symbolic simulation steps and CPU time.
 Integrating the PMU into the implementation so that low-
level controlling signals for each domain can be
automatically adjusted.
The rest of the paper is organized as follows. In Section II, a
brief review on power management protocol is presented. In
Section III, the main idea of our proposed modeling of low power
processors using UCLID and our verification methodology are
 !
explained in details. Section IV shows the experimental results, and
Section V concludes the paper.
II. POWER MANAGEMENT PROTOCOL
!
Before describing our proposed power-aware verification
methodology, we first explain power management protocol used in
this work. There are four fundamental blocks in power
management protocol: 1) RTL design, 2) UPF block, 3) Local
Power Management (LPM) and 4) Global Power Management
(GPM) that will be explained in the following subsections.
A. UPF block and its power control circuitries
Unified Power Format (UPF) is a low-power specification
standard [3]. This standard defines the low-power intent in the
portable form so that power management components can be
implemented in different stages of the design from RTL to physical
design. Since the Hardware Description Language (HDL) code is
not adequate to specify the power information in the design, UPF
provides a consistent format without impacting the existing HDL
code. The UPF code is a side file separated from the HDL file, and
therefore, changes to the HDL code do not require to rewriting the
UPF code. The UPF block consists of several components such as
power domains, supply networks, retention registers, isolation cells
and level shifter cells that are explained in the following
subsections.
a) Power domain
A basic and fundamental unit in the UPF is the power domain,
and chips today have 20 to 50 power domains and hundreds of
power modes. In the power management terminology, power
domain means a collection of instances in the design that share
power supply set and have the same power strategy. A power
domain may be composed of some other power domains called
subdomain. In order to create a power domain in the UPF
create_power_domain command is used.
b) Supply networks
Supply networks consist of supply ports, supply nets, and
power switches. The UPF supply network defines how supply nets
are distributed to the instances or power domains and how that
distribution is controlled. Supply nets provide a connection
between supply ports and power domains whereas power switches
control these connections with their input signals. The UPF
provides the connect_supply_net command for creating a
restored. To ensure this, always-on cells called retention cells are
used to retain internal states and values of design components even
when primary power supplies are turned off. There are two types of
retention cells: retention flips flop and retention latches.
B. Local power management (LPM)
Power domains contain different power modes such as IDLE,
ON (Active) and OFF. In each power mode, power domains have
specific voltage and frequency. For example, the ON mode is
characterized using highest voltage and frequency pairs, while the
OFF mode is characterized using ground voltage. The Local Power
Management (LPM) adjusts power control circuitries (i.e., isolation
cell, level shifter, etc.) of each power domain based on its power
mode. For example, if a power domain wants to be OFF, then by
adjusting the inputs of power switch, isolation cell, and in some
cases with enabling of retention register (RR), LPM prepares the
domain circuitries in such a way that the power domain is turned
off. An important point to be noted here is that the LPM controls
power domains independently.
C. Global power management (GPM)
Low power applications and tasks (receiving, processing,
storing and transmitting of data) have several power states. In each
power state, the status of each power domain mode is defined.
Global Power Management (GPM) specifies the legal and illegal
power states and also identifies how the transition between power
states can occur. In other words, GPM controls LPMs to implement
the power management scenario according to the target
applications.
In order to have a better understanding, let us consider the
design shown in Fig. 1. Suppose we are given a RTL design which
has three modules, namely Module1, Module2 and Module3. Each
of these modules is in an individual power domain PD1, PD2 and
PD3. We also assume that power networks of PD2 and PD3 are a
subset of PD1, which means that if PD1 is in OFF mode, then PD2
and PD3 have to be in OFF mode. However, power domains PD2
and PD3 can be independently ON or OFF. Obviously, in the
power management protocol, the UPF bridges the gaps between the
RTL design and low level power control circuitries (PCC).
External Multi Voltage Power Supply
VDD1 VDD2 VDD3
2-UPF
ISO
ISO
1-RTL design
Module1
Power

connection between a supply port and supply net [3]. 3-LPM

Save
PD1 ISO PD2 ISO PD3
LS LS

c) Isolation Restoration RR
LS
Module2 Module3

Isolation is a cell to protect active power domains from off Level shifter

power domains that have floating values in their outputs. These

floating inputs might cause high current consumption or improper PD1 PD2 PD3
logic behavior in active power domains. In order to solve these S0
S0 OFF OFF OFF
problems, isolation cell is placed between power domains that S1 ON OFF OFF
S3 S1
AND, OR, NOR, and NAND gates are good choices of isolation S2 ON ON OFF

cells. For creating an isolation cell between two power domains, S3 ON OFF ON
S2 Power State Table (PST)
set_isolation command is used [3].
Power controller
d) Level shifter
4 - GPM
Between domains with different supply nets, a level shifter
Fig. 1. An Example of power management protocol
translates signal values from an input voltage swing to a different
output voltage swing. Typically, level shifters convert the high
UPF contains lower level circuits such as power switches, rails,
voltage signal in the transmitter domain to the low voltage signal in
supply ports, supply nets, retention, level shifters and isolation
the receiver domain. The UPF provides the set_level_shifter
cells. Supply nets in UPF are connected to external power supply
command for creating a level shifter between two power domains
or ground voltage according to the logical state of control inputs in
with different supply nets.
power switches. The output of domain PD2 is clamped from inputs
e) Retention cell of PD3 using isolation cells, when the domain PD2 is not in normal
When volatile memories or sequential elements are power off, mode operation. On the other hand, GPM includes power controller
their states are lost and when power is on again, their states must be and power state table as shown in Fig. 1. The GPM specifies the
 !
legal system power modes and power transitions. In Fig. 1, the type be load or store, then the GPM drives a transition from S0 to
GPM consists of four power states called S0 (initial state), S1, S2 S1 else the next state be S0 (lines 10-14 of Fig. 3). Moreover, IU
and S3. In each state, the status of power domains is defined using and CACHE domains will be OFF and the MEM domain will
Power State! Table (PST). For example, in S2, PD1 and PD2 are in return to ON mode.
ON mode while PD3 is OFF. Note that in the power controller,
1: enum STATE { S0, //IU-ON, DIV-OFF MUL-OFF, CACHE-ON
there is no state in which PD2 and PD3 can be ON, simultaneously. 2: S1, //IU-OFF, MEM-ON, DIV-OFF, MUL-OFF
Therefore, this state would be illegal. Furthermore, there is not a 3: S2, //IU-OFF, MEM-OFF, DIV-ON, MUL-OFF
direct transition between S1 and S3 and for going to S3 from S1 we 4: S3 }; //IU-OFF, MUL-ON, DIV-OFF, MEM-OFF
must travel to S0 or S2. Another interesting point in the power 5: SC_MODULE (GPI-LEON3){

management protocol is the existence of an interface, i.e. LPM, 6: const enum STATE Pstate ;
7: while(1){
between high level GPM and lower level UPF. The inputs of LPM 8: switch (Pstate){
module that comes from GPM are power states; however its 9: case (S0) :
outputs are low level power control signals such as the isolation, 10: if (instr.read ( ) == load | instr.read ( ) == store )
the power supply switch, the restoration and the level shifter. These 11: Pstate = S1 ; MEM-ON = 1;
12: else
low-level signals control the operation of PCC defined in the UPF.
13: Pstate = S0;
In other words, the LPM is defined as a power controller for each 14: CACHE-ON = 1; IU-ON = 1; … };
domain of RTL design.
Fig. 3. A part of LEON3 processor's GPM described by SystemC
III. PROPOSED METHODOLOGY FOR LOW POWER PROCSESSOR
VERIFICATION Step 2: Power control signals extraction from UPF
Most of today's processors provide at least one power From UPF a set of useful information, including power
management strategy with multi power domains, built-in privileged domains and power control signals such as the isolation, save and
data isolation and state retention. These features make the modern restoration ones, are extracted. In order to clarify it, let us consider
processors complicated so that their verification is not a UPF of LEON3 processor. A part of such a UPF is shown in Fig.
straightforward at all. In this section, we discuss how to verify low 4. This file contains power domains (lines 3-4), supply networks
power processors with UCLID 3.0 [9] where correspondence (lines 6-9), power switches (lines 11-13), isolation cells (lines 15-
checking has been implemented as a formal verification technique. 18) and retention cells (lines 20-23).
Fig. 2 shows our proposed verification methodology consisting of 1: set_scope top
2: ## Creating Power Domains ##
four steps that are explained in the following subsections. 3: create_power_domain TOP -include_scope top
4: create_power_domain IU -elements {/top/iu}
power domains
Step 1 Step 2 5: ## Creat Supply Port ##
RTL Design 6: create_supply_port VCC -domain TOP
Power
7: create_supply_port GND -domain TOP
GPM characteristics
power control
UPF 8: ## Connect Supply Ports to Supply nets##
signal extraction
extraction 9: connect_supply_net VCC -ports { VCC }
10: ## Power Switch Creation ##
11: create_power_switch IU_power_switch supply networks
Step 3 12: -domain MULT
Abstracted low 13: -input supply port {IU_input_port1 /top/VDD_high_top}
power model 14: ## Isolation Definition ##
15: set_isolation IU_isolation_0 -domain IU
16: -isolation_power_net /top/VDD_low_top isolation cells
Step 4 Formal User inputs 17: -isolation_ground_net VSS_top
Specification 18: -clamp value 0
verification
model Action performed 19: ## Retention Definition ##
engine
in our method 20: set_retention IU_retention_strategy -domain IU retention cells
21: -retention_power_net VDD_low_top
Formal verification 22: -retention_ground_net VSS_top
engine
Failed or passed
23: -save_signal {save_IU_posedge} -restore_signal {restore_IU_negedge}
verification report Output of proposed
method Fig. 4. A part of LEON3 processor's UPF

Fig. 2. Proposed power verification methodology
A. Step1: Power characteristics extraction from GPM
The Global power management (GPM) which expresses
general strategies for low-power circuits is taken into account as
one of inputs of our methodology that is provided by designers as
shown in Fig. 2. These strategies that define the relationship among
power domains are usually expressed using system-level languages
such as SystemC. Power characteristics extracted from the GPM
specify the number of power states, the status of each power
domain, those power domains that are not allowed to be active
simultaneously, and the transition conditions from a power state to
another one. For example, consider LEON3 processor [10], [11]
which has six power domains: integer unit (IU), instruction & data
cache (CACHE), multiplication unit (MUL), division unit (DIV),
storage element unit (STORAGE) and cache and memory
controller (MEM). A part of GPM for LEON3 is shown in Fig. 3
where the power states are defined in lines 1-4. In each state, the
power mode of each domain should be specified. Based on the
instructions of the processor, transition conditions from one state to
another are defined. For example, in the state S0, if the instruction
Fig. 5 shows how to extract power control signals from UPF.
First of all, different power domains (i.e., MULT, IU, STORAGE,
CACHE, MEM and DIV) are determined. After that, we specify
power modes in which power domains work. For example, the IU
domain works in three modes, IDLE, ON and OFF, while the DIV
domain operates in two modes, ON and OFF. Finally, the status of
all power control signals is defined. For example, when the DIV
domain is in ON mode, ISO, PWR and RES should be 0, 1, and 0,
respectively.
One important point to be noted here is the fact that by
transitioning from a power mode to another one, a specific
sequence of power signals must occur. Otherwise, it results in
functional errors. For example, let us consider the DIV domain of
the LEON3 processor. Fig. 6(a) shows the related power signal
sequence to transition from OFF mode to ON mode (i.e., power on
state). In the first step, the PWR signal becomes 1 and then, RES
signal becomes 0. Finally, the isolation signal ISO is set to 0. In the
transition from ON mode to OFF mode (i.e., power off state), the
DIV domain has been isolated by ISO = 1, then the state of the DIV
domain has been saved in the retention register (SAVE = 1) and in
the last step, the PWR signal is disabled (PWR = 0). As another
 !
example, let us consider the CACHE domain of the LEON3
processor. Fig. 6(b) shows its state machine to transition from
FULL_ON mode to PARTIAL_ON mode and vice versa. As
shown in ! this figure, in transition from FULL_ON mode to
PARTIAL_ON mode (power down state), the PWR_LOW signal is
set to 1 whereas in power up state (transition from PARTIAL_ON
mode to FULL_ON mode), the PWR_HIGH signal is enabled.
which can be automatically enabled or disabled by PMU based on
the signal sequences extracted from UPF and the instructions to be
executed. For example, suppose a multiplication should be
performed by the processor while the MULT domain is in the OFF
mode. When the MUL instruction is decoded in the DE-RA stage,
the PMU actives the PWR signal in the MULT domain. After that,
when MUL instruction is in the RA-EX stage, the PMU restores
the state of the MULT domain from the external memory by
RES=0. Finally, the PMU removes the isolation cell of the MULT
domain by ISO = 0, thereby the MULT domain can transfer its
result to another component, e.g. the Register File, with a different
power domain.
Memory
1- Abstracted data path

Instr. data MP IRQ

Cache ReFile Multipl.
cache Ctrl

FE DE RA EX MA XC WB

ALU/Shift
1
3 trap

imm rfa
2 0 address
Zero 1
0
result

Fig. 5. Extraction of power control signals from UPF of LEON3 processor Power domain 1
rd

rd
Power domain 2
Power off state inst inst
Power domain 3
pc pc pc Power domain 4
ISO SAVE PWR branch
address Power domain 5

newPC
ON OFF (a) Power domain 6
Integer Unit

Division
ISO RES PWR

Power_xx Isolation_xx restore_xx save_xx

PWR_LOW
FULL_ON PART_ON (b) Power-on

restore
PWR_HIGH 2- PMU External Memory
isolation
save
Fig. 6. Power state machine for: (a) DIV domain (b) CACHE domain
Power-UP Power-Down

B. Step 3: Abstracted low power implementation model
In order to reduce the complexity of processor verification, we
have abstracted the RTL implementation of the processor in such a
way that it contains a detailed controller plus an abstracted data
path. Abstraction of the data path's components is processed in
such a way that the details of their operations are modeled as un-
interpreted or predicate functions, and also their operands are
abstracted to word level (TERM) and bit level (TRUTH) symbolic
values. An un-interpreted function is a black box of the exact
function which only satisfies functional consistency. Fig. 7 shows
the abstracted low-power pipelined model of the LEON3 processor
that consists of two main parts: 1) abstracted data path, and 2)
Power Management Unit (PMU).
In the abstracted data path, nine types of instructions are
existed: the division instruction (DIV), the multiplication
instruction (MUL), store word instructions (ST), load word
instructions (LD), conditional branch instructions (BR), trapping
and interrupt instructions (TR), ALU register instructions (RR),
ALU immediate instructions (RI) and the null control instruction
(NULL). While its pipeline stages are: fetch (FE), decode (DE),
access to register file (RA), execution of instruction (EX), memory
and data cache access (MA), traps and interrupts resolving (XC)
and write-back to register file (WR). As shown in Fig. 7, each
power domain, before going to its power off mode, saves its values
and states in the external memory and when its power is on, it
restores its values and states from the external memory.
The PMU is a part of the abstracted low power model of the
LEON3 processor which controls the processor operations
according to power strategies defined by the GPM (explained in
subsection III.A) and UPF (explained in subsection III.B). Each
power domain (such as IU, MULT, DIV, etc.) can contain power
control signals including PWR, ISO, RES, and SAVE (RET),
Fig. 7. Abstracted low power model of LEON3
C. Step 4: Formal verification
A flushing-based technique is used to check whether the state
of a pipelined processor with low-power strategies is equivalent to
its Instruction Set Architecture (ISA) by completing the partially
executed instructions in the pipeline [12]. The abstracted low-
power processor described in the previous subsection and the ISA
without power features are taken into account as pipelined
implementation model and golden model of the processor,
respectively. As shown in Fig. 8(a), based on our proposed
methodology with PMU, the abstracted model of low-power
processor is symbolically simulated with arbitrary input
combinations for one cycle. Then the pipeline is flushed for N
cycles until all partially executed instructions can be completed,
and the programmer-visible parts of the design, i.e. Program
Counter (QNimpl.PC), Register File (QNimpl.RF), Data Cache
(QNimpl.dCache), and Data Memory (QNimpl.dMem), are saved. It
should be noted that N is the number of pipeline stages (for LEON3
is seven). In order to have a corresponding state of the
implementation in the specification, first the state of the
implementation after one cycle simulation, i.e. Q1impl, is projected
into that of the specification (Q1impl→Qspec). Then the non-pipelined
specification is symbolically simulated with the same instructions
and the programmer visible components are saved as Q1spec.PC,
Q1spec.RF, QNspec.dCache and Q1ispec.dMem. Finally, the
correspondence property in (1) is checked to see whether QNimpl ==
Q1spec or not. All of these have been implemented with UCLID 3.0
[9].
(Qimp
N
.PC  Qspec
1
.PC ) & (Qimp
N
.RF  Qspec
1
.RF ) & (1)
(Qimp .dCache  Qspec .dCache) & (Qimp .dMem  Qspec .dMem)
N 1 N 1

In order to see why our proposed method reduces the number
of symbolic simulation steps, let us explain how UCLID based
correspondence checking without PMU works. Fig. 8(b) shows the
steps in correspondence
! checking when power control signals
should be manually adjusted where N, PS, and M are the number
of pipeline stages, the average number of power control signals in
different domains, and the number of power domains,
respectively. For example, let us consider the functionality of the
MEM domain in the LEON3 processor. Suppose this power
domain is in ON mode (Q1impl in Fig. 8(b)). Therefore, in the initial
step, the power signals including the power supply (PWR_MEM),
the isolation (ISO_MEM), and the retention (RET_MEM) are
manually set to 1, 0, and 0, respectively. In the next step (i.e.,
Qiimpl), ISO_MEM is manually set to 1 in order to clamp MEM
domain from other domains. Then, RET_MEM is manually set to
1 in order to make MEM domain save its value and state in the
external memory before going to power off mode (Qi+1impl). At the
final step (Qi+2impl), the power supply is disconnected by enabling
inputs of the power switch, i.e., PWR_MEM = 0. In addition, to
return from OFF mode to ON mode, the four other steps should be
performed. Finally, it is checked whether the implementation
(QFimpl) is equivalent to the specification (Q1spec) or not. Moreover,
in the case of multiple power domains, this process must be
repeated for each power domain according to its low-power
strategy. Hence, the number of symbolic simulation steps would
be 4× (PS×M) + 2×N + 3.
IV.
In order to show the effectiveness of the proposed verification
methodology, three experiments with two processors, the 5-stage
MIPS [13] and the 7-stage LEON3 [11] have been conducted. The
number of lines of MIPS and LEON3 RTL codes are 8750 and
10809, respectively. All experiments were carried out on a 2.4 GHz
Intel core i7 Haswell with 6GB main memory running VMware
Linux, where MiniSAT has been used as the SAT solver within
UCLID 3.0 [9]. In the first experiment, the necessity of using PMU
to adjust power control signals will be discussed. The second
experiment shows the effect of power domains on the performance
of the proposed method. In the third experiment, we compare the
results of the proposed method with those of the method explained
in [7].
projection
Q2imp
1 Step
Flush N step
Qimpl
Simulation
Q1imp
1 Step
projection
Q2imp
6*M Step
Flush N step
PWR = 1 RES = 1
Qimpl Simulation 1
Q imp Qiimpl
1 Step
Fig. 8. UCLID based correspondence checking: (a) with PMU (b) without PMU
!
A. Experiment 1: advantage of generating PMU
As explained before, one of our contributions in this work is to
automatically generate PMU by extracting power characteristics
and power control signals from GPM and UPF, respectively. In
order to clarify the advantage of generating PMU, we have
performed this experiment on the LEON3 processor which has six
power domains, including MULT, IU, STORAGE, CACHE,
MEM, and DIV. Each power domain may have its own power
strategy and usually contains power control signals such as PWR,
ISO, RES, and SAVE (RET).
One way to verify LEON3 processor with six power domains is
to manually control and check each power domain independently.
For doing so, power signals should be manually set and then check
the correspondence between the specification and implementation.
We refer to such a verification technique as manual power
management (without PMU) in the rest of the paper. For example,
let us consider the MEM domain in the LEON3 processor. First, it
is assumed that this domain is ON. Therefore, in the initial step,
power signals including the power supply (PWR_MEM), isolation
(ISO_MEM), and retention (RET_MEM) are manually set to 1, 0,
and 0, respectively. In the next step, ISO_MEM is manually set to
1 in order to clamp MEM domain from other domains. Then,
RET_MEM is set to 1 in order to make MEM domain save it value
and state in the external memory before going to power off mode.
In the final step, power supply is disconnected by enabling the
inputs of power switches, i.e. PWR_MEM=0. Finally, it is checked
whether the implementation is equivalent to the specification or
not. The main problem of such a verification technique is the fact
EXPERIMENTAL RESULTS
that the number of symbolic simulation cycles exponentially
increases with respect to the number of power domains and power
control signals. This results in increasing in the size of the model
and therefore the verification time also increases exponentially. In
the case of multiple power domains, this process should be
performed in each domain according to the related strategy.
In order to alleviate this issue, we have generated the PMU to
automatically control power control signals of each domain
according to the instruction types in pipeline stages and the power
strategy defined in the GPM. Hence, such an automatic control
process reduces the complexity of the verification by reducing the
number of symbolic simulation steps. TABLE I shows the results
of LEON3 processor verification for two cases: 1) manual power
management (without PMU) and 2) automatic power management
Simulation
(with PMU). In this table, columns #Domain, #Step, #Var,
Qspec Q1spec #Clause and CPU Time (in seconds) give the number of power
1 Step
domains, the number of symbolic simulation steps, the number of
variables, the number of CNF variables, the number of clauses, and
Equivalence
Flush N step checking
the verification time in seconds, respectively. As you can see in this
table, the verification technique based on PMU could reduce the
symbolic simulation steps by 5.23× and the verification time by
Qiimpl QNimpl 31.95× in comparison with the manual power management
technique, i.e. without PMU. Since the PMU block has been in
implementation model and manages the power domains
(a)
automatically, therefore the number of symbolic simulations in the
Qspec
Simulation
1 Step
Q1spec verification methodology based on PMU is less than without
PMU.
TABLE I. FORMAL VERIFICATION RESULTS OF THE 7-STAGE LEON3
Equivalence
checking
CPU Time
Method #Domain #Step #Var #Clause
(seconds)
2*M step Flush N step
ISO = 0 without PMU 6 89 1659668 4597174 16874
Qi+1impl Qi+2impl Qjimpl QNimpl
with PMU 6 17 104978 309691 528
(b) Improvement with PMU 5.23× 15.8× 14.85× 31.95×
 !
B. Experiment 2: effect of the number of power domains
In this experiment, we show the effect of increasing the number
of power domains on the performance of the proposed verification
methodology ! in two cases: 1) without PMU, and 2) with PMU. Fig.
9 shows how the number of CNF clauses and verification time
increase when the number of power domains in LEON3 processor
increases.
V. CONCLUSION AND FUTURE WORK
We have proposed a verification methodology to effectively
formally verify dynamic power management techniques in modern
processors in two aspects of functionality and automatically
controlling of the power management in the verification process.
For doing so, the PMU is extracted from UPF and the GPM and
integrated into the implementation so that low-level controlling
signals for each power domain can be automatically adjusted. The
results show that the verification time is reduced by 13.71× in
comparison with the existing methods such as [7]. As a future
work, we are going to extend our methodology to verify multicore
processors.
TABLE II. FORMAL VERIFICATION RESULTS OF THE 5-STAGE MIPS
CPU Time
Method #Domain #Step #Var #Clause
(seconds)

(a) 1 25 277108 823441 132

without PMU
3 49 276841 902241 1452

1 25 434837 1292158 924

Method in [7]
3 29 606104 1802971 1804

1 13 25964 75898 67
with PMU
3 13 34178 100249 132

Improvement in comparison
2.08× 11.04× 17.57× 13.71×
with the method in [7]

(b)
Fig. 9. The effect of increasing the number of power domains on: (a) the number
of clauses and (b) the verification time in two cases (without PMU and with PMU)
C. Experiment 3: comparison with existing method
In the final experiment, in order to show the effectiveness of the
proposed verification methodology, we have compared our results
with those of the method proposed in [7]. In this paper, the authors
tried to verify power gating strategy in a MIPS processor which
only has a single power domain while in our proposed
methodology, the processor can be empowered by various power
management techniques such as power gating and clock gating in
multiple domains. The power gating technique makes the processor
go to the power off state immediately after saving the internal
values in the external memory and when the processor is going
back to the power on mode, first internal values contents are loaded
from the external memory. When the processor is going to power
on mode, the execution starts from the fetch state. It is verified that
the processor successfully goes to power down and returns to
power up, and all the instructions before and after the power gating
are finished their executions correctly.
In the method of [7], power off and power on processes are
performed manually by using external signals that indicate start and
end of power gating for the processor. These signals are manually
activated at cycle i and deactivated at cycle i+1. In our method, in
contrast to [7], these signals are automatically activated based on
the PMU integrated into the abstracted RTL implementation.
TABLE II shows the results of our proposed verification
methodology for two cases (with and without PMU) in comparison
with those of the method in [7]. It is obvious that the proposed
verification methodology is scalable enough to handle complex
power management strategies, which are usually used in modern
processors. Moreover, adding PMU to the abstracted
implementation results in fewer symbolic simulation steps, in
comparison with [7], which reduce the number of clause and the
verification time by 17.57× and 13.71×, respectively.
REFRENCES
[1] S. Ahuja, A. Lakshminarayana, and S. Kumar Shukla, “Low power design
with high level power estimation and power aware synthesis,” Springer, 1st
edition, pp. 1-170, 2012.
[2] S. Baily, G. Chidolue, Allan Crone, and Mentor Graphics, “Low power
design and verification techniques,” Mentor graphics’s white paper.
[3] IEEE Std 1801-2013: IEEE Standard for Design and Verification of Low-
Power Integrated Circuits, IEEE Press, 2013.
[4] http://www.mentor.com/products/fv/questa-power-aware-simulator.
[5] O. Mbarek, A. Pegatoquet, and M. Auguin, “Using unified power format
standard concepts for power-aware design and verification of systems-onchip
at transaction level,” IET Circuits, Devices & Systems., vol. 6, no. 5, pp. 287–
296, 2012.
[6] A. Hazra, R. Mukherjee, P. Dasgupta, A. Pal, K. M. Harer, A. Banerjee, and
S. Mukherjee, “POWER-TRUCTOR: An integrated tool flow for formal
verification and coverage of architectural power intent,” in IEEE
Transactions On Computer-Aided Design Of Integrated Circuits And Systems
(TCAD), vol. 32, no. 11, pp. 1801-1813, 2013.
[7] A. M. Gharehbaghi, M. Fujita, “Specification and formal verification of
power gating in processors,” in 15th International Symposium on Quality
Electronic Design (ISQED), pp. 604 - 610, 2014.
[8] Uclid ver. 1.0. [online]: http://www.cs.cmu.edu/ uclid.
[9] Uclid ver. 3.0. [online]: http://uclid.eecs.berkeley.edu/downloads.html.
[10] M. Danˇek, L. Kafka, L. Kohout, J. S´ykora, R. Bartosi´nski, “UTLEON3:
Exploring fine-grain multi-threading in FPGAs,” Springer, 1st edition, pp. 1-
216, 2013.
[11] GRLIB IP Core User’s Manual, Version 1.3.7-B4144, 2014. [online]:
http://www. gaisler.com/
[12] J. Burch and D. Dill, “Automatic verification of pipelined microprocessor
control,” in proceedings of the International Conference on Computer-Aided
Verification (CAV’94), pp. 68–80, 1994.
[13] MIPS32 architecture. [online]: http://www.imgtec.com/mips/mips32-
architecture.asp.
[14] B. Alizadeh, “Formal verification and debugging of precise interrupts on high
performance microprocessors,” in ACM Transactions on Design Automation
of Electronic Systems, vol. 17, no. 4, pp. 371-378, 2012.