Skip to content

SPIN verification (PoC)#4452

Draft
rw1nkler wants to merge 15 commits into
google:mainfrom
antmicro:97703-promela-generation
Draft

SPIN verification (PoC)#4452
rw1nkler wants to merge 15 commits into
google:mainfrom
antmicro:97703-promela-generation

Conversation

@rw1nkler

@rw1nkler rw1nkler commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

This PR adds experimental SPIN model checker integration for XLS DSLX designs.

The core of the implementation consists of:

  • promela_generator, which converts XLS IR into a Promela model,
  • spin_runner, which serves as the entry point for running SPIN verification from the interpreter_main
  • trace_compare, which compares execution traces produced by SPIN and the DSLX interpreter.

The integration supports two modes:

  • Guided simulation - where SPIN executes a single execution path and the resulting trace is compared against the DSLX interpreter trace.
  • Exhaustive simulation, where SPIN explores all possible interleavings of proc operations to detect issues such as deadlocks, livelocks, and ordering-dependent behavior.

This PR also includes Bazel rules for integrating and experimenting with SPIN verification directly in build targets.
More information about the general implementation can be found in the README.

There are also example designs in the examples/ directory, which include demonstration of SPIN integration and show how to enable and run both guided and exhaustive verification modes.

The last step before marking this as ready for review is updating the trace_compare mechanism to correctly handle hierarchical designs and to include trace dumping along channel instantiation paths, ensuring comparisons remain accurate in more complex module structures.

rw1nkler added 15 commits June 23, 2026 15:19
Applies a patch to SPIN adding JSON channel-event trace output (-Q flag).

Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
Adds TraceChannelProto to EvaluatorResultsProto; bytecode emitter and
interpreter record channel send/receive events. Adds --trace_channels
and --output_results_proto flags to interpreter_main.

Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
PromelaGenerator (DfsVisitorWithDefault) translates XLS IR to Promela.
TraceCompare verifies per-channel event sequences between SPIN and DSLX.
Includes public and private Bazel rules and testdata golden fixtures.

Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
promela_main: IR -> Promela
dslx_trace_filter: EvaluatorResultsProto -> JSON channel events
promela_trace_compare: SPIN vs DSLX trace diff

Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
Adds entry point for invoking spin for guided and exhaustive simulation

Guided simulation generates Promela, drives SPIN along the DSLX interpreter
trace and compares per-channel events.

Exhaustive simulation runs SPIN -search for exhausitve search of the
state space.

Adds --spin_guided/--spin_exhaustive to interpreter_main and xls_dslx_test.

Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
Signed-off-by: Robert Winkler <rwinkler@antmicro.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant