We describe a method to permit the user of a mathematical logic to write elegant logical definitions while allowing sound and efficient execution. We focus on the ACL2 logic and automated reasoning environment. ACL2 is used by industrial researchers to describe microprocessor designs and other complicated digital systems. Properties of the designs can be formally established with the theorem prover. But because ACL2 is also a functional programming language, the formal models can be executed as simulation engines. We implement features that afford these dual applications, namely formal proof and execution on industrial test suites. In particular, the features allow the user to install, in a logically sound way, alternative executable counterparts for logically-defined functions. These alternatives are often much more efficient than the logically equivalent terms they replace. We discuss several applications of these features.

No abstract

No abstract

Verification of modern microprocessors is a complex task that requires a substantial allocation of resources. Despite significant progress in formal verification, the goal of complete verification of an industrial design has not been achieved. In this paper, we describe a current contribution of formal methods to the validation of modern x86 microprocessors at Centaur Technology. We focus on proving correctness of instruction implementations, which includes the decoding of an instruction, its translation into a sequence of micro-operations, any subsequent execution of traps to microcode ROM, and the implementation of these micro-operations in execution units. All these tasks are performed within one verification framework, which includes a theorem prover, a verified symbolic simulator, and SAT solvers. We describe the work of defining the needed formal models for both the architecture and micro-architecture in this framework, as well as tools for decomposing the requisite properties into smaller lemmas which can be automatically checked. We additionally cover the advantages and limitations of our approach. To our knowledge, there are no similar results in the verification of implementations of an x86 microprocessor.

Advanced Micro Devices &DESPITE SIGNIFICANT ADVANCES in formal-verification techniques during the past decade, a large gap in complexity still exists between practical verification problems and those that state-of-the-art verification tools can handle. Consequently, there has been increasing interest in combining different verification techniques to synergistically leverage their strengths.In this article, we present a procedure for proving invariants of computing systems that uses a combination of theorem proving and model checking. Invariants are formulas (or predicates) defined on a system's state variables that hold for all the reachable states. Establishing invariants is a central activity in many formal-verification projects: Verifying safety properties is tantamount to proving an invariant, and proofs of liveness properties typically require auxiliary invariance conditions. On the other hand, invariant proving is difficult for theorem-proving and modelchecking techniques individually. Theorem proving involves manually strengthening the formula to an inductive invariant-that is, an invariant preserved by every system transition. This requires significant user expertise. 1,2 Model checking involves symbolic or explicit exploration of the reachable states; the state explosion problem limits its scope in practice.Our procedure automates invariant proofs while imposing no restriction on the expressiveness of the language used to define systems and their properties. The procedure includes lightweight theorem proving to generate a predicate abstraction, 3 which we then explore through model checking. Given system I and finite set P of predicates on the states of I, predicate abstraction constructs abstract system A, whose states correspond to valuations of predicates in P and whose transitions match the projected transitions of I. The reachable states of A define an inductive invariant of I. Our key observation is that we can mine set P from the definition of the transition relation of I by term simplification. Given the transition relation and a conjectured invariant formula W, we use term rewriting on their composition to determine the predicates relevant to the invariance of W. The rewrite rules specify relationships between the different functions used in the system definitions, and our procedure uses them to control rewriting. We collect such rules from the theorems proven by a theorem prover. The focused use of rewriting provides the primary connection between theorem proving and model checking, and we have developed methodologies and tools to exploit the connection.In our approach, theorem-proving and modelchecking techniques complement one another. We 132 Editor's note: Using theorem-based approaches to prove the invariants of infinite-state reactive systems often demands significant manual involvement. This article presents a new approach in which model checking complements theorem proving, reducing the manual effort involved by transferring user attention from defining inductive invariants to proving re...