"... In PAGE 5: ... The software GetAveImps to find AveImps is available at [18]. From Table2 , it can be inferred that SAT instances from Formal Verification of Microprocessors have very high AveImps value. SAT instances from other formal verification methods like ... ..."

"... In PAGE 6: ...tag14 1071 ip38 83 cache.inv14 1940 ip50 83 Table3 , shows the effect of NiVER and HypBinRes preprocessing on SAT instances from microprocessor verification and industrial model checking. As predicted Hyp- BinRes performs well in instances with low AveImps value, while NiVER perform-... ..."

"... In PAGE 7: ... If we stay within the logic ALCOU f , only very sim- ple abstraction predicates are expressible; more interesting predicates (in particular, for reachability) require more ex- pressive logics. Table3 shows which common abstraction predicates can be constructed in which logic. Note that the transitive closure operators on roles are abbreviations here, which can be eliminated in favor of fixpoints since 9R :C Z:(C t 9R:Z) and 9R+:C 9R:(9R :C).... ..."

"... In PAGE 52: ...ere performed on a dual 1.5GHz Athlon machine with 3GB of RAM running Linux. The experiments were performed on two sets of benchmarks. The rst set of bench- marks in Table1 are industrial benchmarks obtained from various sources. The bench- marks IU-p1 and IU-p2 refer to the same circuit, IU, but di erent properties are checked in each case.... In PAGE 52: ... It is interesting to note that all benchmarks but IU-p1 and IU-p2 have a valid counterexample. In Table1 , we compare our methods against the BDD based model checker Ca- dence SMV. We enabled cone of in uence reduction and dynamic variable reordering in Cadence SMV.... In PAGE 53: ...e nement sets. A \- quot; in a cell indicates that the model checker ran out of memory. circuit # regs ctrex CSMV Heuristic Score Dependency length time time iters # regs time iters # regs D2 105 15 152 105 10 51 79 11 39 D5 350 32 1,192 29 3 16 38.2 8 10 D6 177 20 45,596 784 24 121 833 48 90 D18 745 28 gt;4 hrs 12,086 69 346 9,995 142 253 D20 562 14 gt;7 hrs 1,493 56 281 1,947 74 265 D24 270 10 7,850 14 1 6 8 1 4 IU-p1 4855 true - 9,138 22 107 3,350 13 19 IU-p2 4855 true - 2,820 7 36 712 6 13 Table1 . Comparison between Candence SMV (CSMV), heuristic score based re nement and dependency analysis based re nement for larger circuits.... In PAGE 62: ... All properties verified were simple AG properties. For all the properties shown in the first column of Table1 , we have performed cone-of-influence reduction before the verification. The resulting number of registers and gates are shown in the second and third columns.... In PAGE 62: ... We compare three ab- straction refinement systems, including the BDD based aSMV [5], the SAT based localization reduction [2] (SLOCAL), and the SAT based predicate abstraction (SPRED) described in this paper. The detailed results obtained using aSMV are not listed in Table1 because aSMV can not solve any of the properties within the 24hr time limit. This is not surprising because aSMV uses BDD based image computation and it can handle only circuits with hundreds of state variables, provided that good initial variable orderings are given.... In PAGE 72: ... We have two sets of benchmarks: one is the integer unit (IU) of the picoJava microprocessor from Sun; the other is a programmable FIR filter (PFIR) which is a component of a system-on-chip design. The size of the benchmarks is shown in Table1 . The first column is the name of the prop- erty.... In PAGE 72: ... The lengths of the counterexam- ples are shown in the fourth column. circuit # regs # gates ctrex IUscr1 4855 149143 true IUscr3 4855 149143 true IUscr6 4855 149143 true PFIRscr1 243 2295 16 PFIRprop5 250 2342 17 PFIRprop8 244 2304 true PFIRprop9 244 2304 true PFIRprop10 244 2304 true PFIRprop12 247 2317 true Table1 . The benchmarks used in the experi- ments All these properties are difficult for the state-of-art BDD- based model checker, Cadence SMV.... ..."

"... In PAGE 3: ... The consequence of this is that programs cannot write into reserved and callee-save registers (according to the standard C calling convention for the DEC Alpha ar- chitecture), and are thus trivially safe with respect to these registers. To de ne how programs are executed, we de ne an abstract machine as a state-transition function, the es- sential core of which is shown in Table2 . In this speci- cation, the DEC Alpha program is a vector of instruc- tions, , and the current instruction is pc, where pc is the program counter.... In PAGE 3: ...1 The expression [rd rd 1] denotes the new state obtained from state by incrementing the value of register rd. So, for example, the Alpha \ADDQ rs; op; rd quot; instruction is de ned by Table2 to have the following semantics: ( [rd rs op]; pc + 1) where is the current register and memory state. This speci cation states that the ADDQ instruction updates register rd with the sum of rs and op, and also incre- ments the program counter.... In PAGE 4: ... In the de nition of the load and store instructions, there is a crucial di erence between the DEC Alpha pro- cessor and our abstract machine. The di erence is that our abstract machine performs the safety checks that are shown in boxes in Table2 . For example, consider the de nition of the \LDQ rd; n(rs) quot; instruction: ( [rd sel(rm; rs n)]; pc + 1); if rd(rs n) The predicate rd(a) is true when the memory address a is aligned on an 8-byte boundary and it is safe to read the word at that address.... ..."

"... In PAGE 15: ...identical, from one specification to another, though they shared much circuitry. Table5 gives the results of tautology and inductive invariance checking for each p from each AG p specifica- tion. These runs were done with bounded COI enabled.... ..."