We offer a solution to the problem of verifying formal memory models of processors by combining the strengths of model-checking and a formal testing procedure for parallel machines. We characterize the formal basis for abstracting the tests into test automata and associated memory rule safety properties whose violations pinpoint the ordering rule being violated. Our experimental results on Verilog models of a commercial split transaction bus demonstrates the ability of our method to effectively debug design models during early stages of their development.

We investigate new techniques for reducing the memory requirements of an on-the-fly model checking tool that employs explicit einumeration. Two techniques are studied in depth: exploiting symmetries in the model, and exploiting sequential regions in the model. These techniques can result in a significant reduction in memory requirements, and often find progress violations at much lower stack depths. Both techniques have been implemented as part of the SPIN verifier, a widely used on-the-fly model-checking tool.

No abstract

We have developed a formal technique called test modelchecking for debugging claimed conformance to formal memory models by realistic memory systems and multiprocessor machines. Test model-checking is an embedding of a formal testing method called ARCHTEST in the model-checking framework.In this paper, we describe our technique and illustrate it on the problem of checking sequential consistency of (a model of) the HP PA8000 symmetric multiprocessing (SMP) bus called Runway. Our experiments show that test model-checking is an effective method for use in the typically iterative design cycle of complex memory systems to quickly detect ordering violations and pinpoint their cause.

This paper presents a new partial order reduction algorithm called Two phase that is implemented in a verification tool, PV (Protocol Verifier). Two phase significantly reduces space and time requirements on many practically important protocols on which the partial order reduction algorithms implemented in previous tools (Godefroid 1995, Holzmann et aZ. 1994, Peled 1996 yield very little savings. This is primarily attributable to their use of a run-time proviso deciding which processes to run in a given state. Two phase avoids this proviso and follows a much simpler execution strategy that dramatically reduces the number of executions examined on a significant number of examples. We describe the Two phase algorithm, prove its correctness, and provide evidence of its superior performance on a number of examples including the directory based protocols of a multiprocessor under development.