## Automatic Verification of Safety and Liveness for XScale-Like Processor Models Using WEB-Refinements (2003)

### Cached

### Download Links

Venue: | In Design Automation and Test in Europe, DATE’04 |

Citations: | 21 - 10 self |

### BibTeX

@INPROCEEDINGS{Manolios03automaticverification,

author = {Panagiotis (Pete) Manolios and Sudarshan K. Srinivasan},

title = {Automatic Verification of Safety and Liveness for XScale-Like Processor Models Using WEB-Refinements},

booktitle = {In Design Automation and Test in Europe, DATE’04},

year = {2003},

pages = {168--175},

publisher = {IEEE Computer Society Press}

}

### Years of Citing Articles

### OpenURL

### Abstract

We show how to automatically verify that a complex XScale-like pipelined machine model is a WEB-refinement of an instruction set architecture model, which implies that the machines satisfy the same safety and liveness properties. Automation is achieved by reducing the WEB-refinement proof obligation to a formula in the logic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU). We use UCLID to transform the resulting CLU formula into a CNF formula, which is then checked with a SAT solver. We define several XScale-like models with out of order completion, including models with precise exceptions, branch prediction, and interrupts. We use two types of refinement maps. In one, flushing is used to map pipelined machine states to instruction set architecture states; in the other, we use the commitment approach, which is the dual of flushing, since partially completed instructions are invalidated. We present experimental results for all the machines modeled, including verification times. For our application, we found that the SAT solver Siege provides superior performance over Chaff and that the amount of time spent proving liveness when using the commitment approach is less than 1% of the overall verification time, whereas when flushing is employed, the liveness proof accounts for about 10% of the verification time.

### Citations

1114 | Chaff: Engineering an efficient SAT solver
- Moskewicz, Madigan, et al.
- 2001
(Show Context)
Citation Context ...e commitment approach. We compare the time taken to prove safety alone with the time taken to prove both safety and liveness and we compare the running times of the SAT 2 solvers Siege [18] and Chaff =-=[16]-=- on our problems. Everything required to reproduce our results, e.g., machine models, correctness statements, CNF formulas, etc., will be available on our Web pages. Related work is described in secti... |

262 |
Computer-Aided Reasoning: An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ...he use of WEB-refinement for proving the correctness of pipelined machines was introduced in [12], where some simple three stage pipelined machines were verified using the ACL2 theorem proving system =-=[9,10]-=-. The paper also showed that the variant of the Burch and Dill notion of correctness [3] used by Sawada [19,20] can be satisfied by machines that deadlock and an argument was given that such anomalies... |

259 | Automated verification of pipelined microprocessor control
- BURCH, L
- 1994
(Show Context)
Citation Context ...n [12], where some simple three stage pipelined machines were verified using the ACL2 theorem proving system [9,10]. The paper also showed that the variant of the Burch and Dill notion of correctness =-=[3]-=- used by Sawada [19,20] can be satisfied by machines that deadlock and an argument was given that such anomalies are not possible if WEB-refinement is used. Our main contribution is to show how one ca... |

146 |
Chaff: Engineering an Efficient
- Moskewicz, Madigan, et al.
- 2001
(Show Context)
Citation Context ...the commitment approach. We compare the time taken to prove safety alone with the time taken to prove both safety and liveness and we compare the running times of the SATssolvers Siege [18] and Chaff =-=[16]-=- on our problems. Everything required to reproduce our results, e.g., machine models, correctness statements, CNF formulas, etc., will be available on our Web pages. Related work is described in secti... |

140 | Modeling and Verifying Systems Using a Logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions
- Bryant, Lahiri, et al.
- 2002
(Show Context)
Citation Context ...proach in [22]. This paper directly depends on previous work on decision procedures for boolean logic with equality and uninterpreted function symbols [1]. The results in [1] were further extended in =-=[2]-=-, where a decision procedure for the logic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU) is given. The decision procedure is implemented in UCLID, which has been used... |

90 | Verification of an implementation of Tomasulo’s algorithm by compositional model checking
- MCMILLAN
- 1998
(Show Context)
Citation Context ...on the use of skewed abstraction functions [23]. Burch and Dill showed how to automatically compute the abstraction function using flushing [3]. There are approaches based on model-checking, e.g., in =-=[14]-=-, McMillan uses compositional model-checking in conjunction with symmetry reductions. Theorem proving approaches are also popular, e.g., in [19,20], Sawada uses an intermediate abstraction called MAET... |

56 |
Formal Verification of a pipelined microprocessor
- Srivas, Bickford
- 1990
(Show Context)
Citation Context ...vailable on our Web pages. 6. Related Work We now review previous work on pipelined machine verification. A very early approach by Srivas and Bick was based on the use of skewed abstraction functions =-=[23]-=-. Burch and Dill showed how to automatically compute the abstraction function using flushing [3]. There are approaches based on model-checking, e.g., in [14], McMillan uses compositional model-checkin... |

54 | M.N.: Exploiting Positive Equality in a Logic of Equality with Uninterpreted Functions
- Bryant, German, et al.
- 1999
(Show Context)
Citation Context ...rified using a variation of the Burch and Dill approach in [22]. This paper directly depends on previous work on decision procedures for boolean logic with equality and uninterpreted function symbols =-=[1]-=-. The results in [1] were further extended in [2], where a decision procedure for the logic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU) is given. The decision proce... |

46 | A hybrid SAT-based decision procedure for separation logic with uninterpreted functions
- Seshia, Lahiri, et al.
- 2003
(Show Context)
Citation Context ...ic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU) is given. The decision procedure is implemented in UCLID, which has been used to verify out-of-order microprocessors =-=[21]-=-. 7. Conclusions and Future Work We show how to automatically verify safety and liveness properties of complex XScale-like pipelined machine models with a slight performance penalty over verifying saf... |

43 | Formal Verification of Superscalar Microprocessors with Multicycle Functional Units
- Velev, Bryant
- 2000
(Show Context)
Citation Context ...pect to the ALU instructions. This base model is extended with branch prediction, ALU exceptions, and interrupts. The models are similar to those appearing in [20] (which use modeling techniques from =-=[22]-=-), except that our models are written in the CLU logic and we model interrupts. Modeling issues are not the point of this paper, nevertheless, a brief overview of CLU and the processor models we use i... |

42 | Modeling and Verification of Out-of-order Microprocessors using UCLID
- Lahiri, Seshia, et al.
(Show Context)
Citation Context ...the WEB-refinement proof to a statement expressible in the logic of Counter arithmetic with Lambda expressions and Uninterpreted functions (CLU), which is a decidable logic [2]. We use the tool UCLID =-=[9]-=- to transform the CLU formula into a CNF (Conjunctive Normal Form) formula, which we then check with a SAT solver. We provide experimental results for eight XScale-like [4] pipelined machine models of... |

39 |
Mechanical Verification of Reactive Systems
- Manolios
- 2001
(Show Context)
Citation Context ...pear in section 7. 2. Refinement In this section, we give a brief overview of refinement based on WEBs (Well-Founded Equivalence Bisimulations), the theory underlying our pipelined machine proofs. See=-=[12,13]-=- for a complete description. The point of a correctness proof is to establish a meaningful relationship between ISA, a machine modeled at the instruction set architecture level and MA, a machine model... |

35 | Proof of Correctness of a Processor with Reorder Buffer Using the Completion Functions Approach
- Hosabettu, Srivas, et al.
- 1999
(Show Context)
Citation Context ...ion called MAETT to verify some safety and liveness properties of complex pipelined machines. Another approach by Hosabettu et 5 al. uses the PVS theorem prover and the notion of completion functions =-=[5]-=-. Symbolic Trajectory Evaluation (STE) is used by Patankar et al. to verify a processor that is a hybrid between ARM7 and StrongARM [17]. SVC is used check the correct flow of instructions in a pipeli... |

26 | Correctness of Pipelined Machines
- Manolios
- 2000
(Show Context)
Citation Context ...ment proofs are only 4.3% longer than the verification times for the standard Burch and Dill type proofs. The use of WEB-refinement for proving the correctness of pipelined machines was introduced in =-=[12]-=-, where some simple three stage pipelined machines were verified using the ACL2 theorem proving system [9,10]. The paper also showed that the variant of the Burch and Dill notion of correctness [3] us... |

21 |
Formal Verification of an Advanced Pipelined Machine
- Sawada
- 1999
(Show Context)
Citation Context ...simple three stage pipelined machines were verified using the ACL2 theorem proving system [9,10]. The paper also showed that the variant of the Burch and Dill notion of correctness [3] used by Sawada =-=[19,20]-=- can be satisfied by machines that deadlock and an argument was given that such anomalies are not possible if WEB-refinement is used. Our main contribution is to show how one can prove WEB-refinement ... |

12 | Verification of a simple pipelined machine model
- Sawada
- 2000
(Show Context)
Citation Context ...on- the strongest junction invariant with symmetry and introducing reductions. branchTheorem mispredicts proving leads to approaches an irregularare set also of “good” popular, states. e.g., Since in =-=[19,20]-=-, exceptions Sawada and interrupts uses anare intermediate very similar abstraction to branchcalled mispredicts, MAETTintroduc to veringify these some features safetydoes andnot liveness affect verifi... |

11 |
Siege homepage. See URL http://www.cs.sfu.ca/ ∼loryan/personal
- Ryan
(Show Context)
Citation Context ... and some on the commitment approach. We compare the time taken to prove safety alone with the time taken to prove both safety and liveness and we compare the running times of the SAT 2 solvers Siege =-=[18]-=- and Chaff [16] on our problems. Everything required to reproduce our results, e.g., machine models, correctness statements, CNF formulas, etc., will be available on our Web pages. Related work is des... |

10 | A Compositional Theory of Refinement for Branching Time
- Manolios
- 2003
(Show Context)
Citation Context ...te under r. Now, condition 2 of the WEB definition clearly holds. Our ISA and MA machines are deterministic (actually they are nondeterministic, but we use oracle variables to make them deterministic =-=[12]-=-), thus, after some symbolic manipulation, we can strengthen condition 3 of the WEB definition to the following “core theorem”, where rank is a function thatsmaps states of MA into the natural numbers... |

9 | Formal verification of an ARM processor
- Patankar, Jain, et al.
- 1999
(Show Context)
Citation Context ...es the PVS theorem prover and the notion of completion functions [5]. Symbolic Trajectory Evaluation (STE) is used by Patankar et al. to verify a processor that is a hybrid between ARM7 and StrongARM =-=[17]-=-. SVC is used check the correct flow of instructions in a pipelined DLX model [15]. Abstract State Machines are used to prove the correctness of refinement steps that transform a non-pipelined ARM pro... |

9 |
Specification and verification of pipelining
- Huggins, Campenhout
- 1998
(Show Context)
Citation Context ...wed of refinement how to steps automatically that transform compute the a non-pipelined abstraction function ARM processor using flushing into a[3]. pipeThere lined are approaches implementation based=-=[6]-=-. on An model-checking, XScale processor e.g., model in [13], isMcMillan verified uses usingcompositional a variation model-checking of the Burch and symmeDill approach try reductions. in [22]. Theore... |

8 |
An embedded 32-bit microprocessor core for low-power and high-performance applications
- Clark, Hoffman, et al.
(Show Context)
Citation Context ... [2]. We use the tool UCLID [9] to transform the CLU formula into a CNF (Conjunctive Normal Form) formula, which we then check with a SAT solver. We provide experimental results for eight XScale-like =-=[4]-=- pipelined machine models of varying complexity and including features such as precise exceptions, branch prediction, and interrupts. Our results show that our approach is computationally efficient, a... |

6 | Formal Verification of an Intel XScale Processor Model with Scoreboarding, Specialized Execution Pipelines, and Imprecise Data-Memory Exceptions,” Formal Methods and Models for Codesign (MEMOCODE ’03
- Srinivasan, Velev
- 2003
(Show Context)
Citation Context ...ectness of refinement steps that transform a non-pipelined ARM processor into a pipelined implementation [6]. An XScale processor model is verified using a variation of the Burch and Dill approach in =-=[22]-=-. This paper directly depends on previous work on decision procedures for boolean logic with equality and uninterpreted function symbols [1]. The results in [1] were further extended in [2], where a d... |

4 |
Modeling and Verification of Pipelined Embedded
- Mishra, Dutt
- 2002
(Show Context)
Citation Context ...jectory Evaluation (STE) is used by Patankar et al. to verify a processor that is a hybrid between ARM7 and StrongARM [17]. SVC is used check the correct flow of instructions in a pipelined DLX model =-=[15]-=-. Abstract State Machines are used to prove the correctness of refinement steps that transform a non-pipelined ARM processor into a pipelined implementation [6]. An XScale processor model is verified ... |

3 | Specification and verification of pipelining in the ARM2 RISC microprocessor
- Huggins, Campenhout
- 1998
(Show Context)
Citation Context ... instructions in a pipelined DLX model [15]. Abstract State Machines are used to prove the correctness of refinement steps that transform a non-pipelined ARM processor into a pipelined implementation =-=[6]-=-. An XScale processor model is verified using a variation of the Burch and Dill approach in [22]. This paper directly depends on previous work on decision procedures for boolean logic with equality an... |

3 | Modeling and Verification of Pipelined Embedded Processors in the Presence of Hazards and Exceptions
- Mishra, Dutt
- 2002
(Show Context)
Citation Context ...jectory Evaluation (STE) is used by Patankar et al. to verify a processor that is a hybrid between ARM7 and StrongARM [17]. SVC is used check the correct flow of instructions in a pipelined DLX model =-=[15]-=-. Abstract State Machines are used to prove the correctness of refinement steps that transform a non-pipelined ARM processor into a pipelined implementation [6]. An XScale processor model is verified ... |

3 |
Chaff: Engineering an efficient SAT solver. DAC-01
- Moskewicz
- 2001
(Show Context)
Citation Context ...the commitment approach. We compare the time taken to prove safety alone with the time taken to prove both safety and liveness and we compare the running times of the SAT solvers Siege [17] and Chaff =-=[15]-=- on our problems. Everything required to reproduce our results, e.g., machine models, correctness statements, CNF formulas, etc., is available upon request. Related work is described in Section 6, whi... |

1 | M.Yarch, "An embedded 32-bit microprocessor core for low-power and high-performance applications - Clark, Miller, et al. - 2001 |

1 |
G.Gopalakrishnan, "Proof of correctness of a processor with reorder buffer using the completion functions approach
- Hosabettu
- 1999
(Show Context)
Citation Context ...ction called MAETT to verify some safety and liveness properties of complex pipelined machines. Another approach by Hosabettu et al. uses the PVS theorem prover and the notion of completion functions =-=[5]-=-. Symbolic Trajectory Evaluation (STE) is used by Patankar et al. to verify a processor that is a hybrid between ARM7 and StrongARM [17]. SVC is used check the correct flow of instructions in a pipeli... |

1 | editors. "Computer-Aided Reasoning: ACL2 Case Studies - Kaufmann, Moore - 2000 |

1 |
M.Bick, "Formal verification of a pipelined microprocessor
- Srivas
- 1990
(Show Context)
Citation Context ...vailable on our Web pages. 6. Related Work We now review previous work on pipelined machine verification. A very early approach by Srivas and Bick was based on the use of skewed abstraction functions =-=[23]-=-. Burch and Dill showed how to automatically compute the abstraction function using flushing [3]. There are approaches based on model-checking, e.g., in [14], McMillan uses compositional model-checkin... |

1 |
Siege v4 homepage. See URL http://www.cs.sfu.ca/~loryan/personal
- Ryan
(Show Context)
Citation Context ...ch and some on the commitment approach. We compare the time taken to prove safety alone with the time taken to prove both safety and liveness and we compare the running times of the SATssolvers Siege =-=[18]-=- and Chaff [16] on our problems. Everything required to reproduce our results, e.g., machine models, correctness statements, CNF formulas, etc., will be available on our Web pages. Related work is des... |