We present an approach to modeling and verifying machine-code programs that exhibit non-determinism. Specifically, we add support for system calls to our formal, executable model of the user-level x86 instruction-set architecture (ISA). The resulting model, implemented in the ACL2 theorem-proving system, allows both formal analysis and efficient simulation of x86 machine-code programs; the logical mode characterizes an external environment to support reasoning about programs that interact with an operating system, and the execution mode directly queries the underlying operating system to support simulation. The execution mode of our x86 model is validated against both its logical mode and the real machine, providing test-based assurance that our model faithfully represents the semantics of an actual x86 processor. Our framework is the first that enables mechanical proofs of functional correctness of user-level x86 machine-code programs that make system calls. We demonstrate the capabilities of our model with the mechanical verification of a machinecode program, produced by the GCC compiler, that computes the number of characters, lines, and words in an input stream. Such reasoning is facilitated by our libraries of ACL2 lemmas that allow automated proofs of a program's memory-related properties.

No abstract

We introduce a new ACL2 feature, the abstract stobj, and show how to apply it to modeling the instruction set architecture of a microprocessor. Benefits of abstract stobjs over traditional ("concrete'') stobjs can include faster execution, support for symbolic simulation, more efficient reasoning, and resilience of proof developments under modeling optimization

Verification of modern microprocessors is a complex task that requires a substantial allocation of resources. Despite significant progress in formal verification, the goal of complete verification of an industrial design has not been achieved. In this paper, we describe a current contribution of formal methods to the validation of modern x86 microprocessors at Centaur Technology. We focus on proving correctness of instruction implementations, which includes the decoding of an instruction, its translation into a sequence of micro-operations, any subsequent execution of traps to microcode ROM, and the implementation of these micro-operations in execution units. All these tasks are performed within one verification framework, which includes a theorem prover, a verified symbolic simulator, and SAT solvers. We describe the work of defining the needed formal models for both the architecture and micro-architecture in this framework, as well as tools for decomposing the requisite properties into smaller lemmas which can be automatically checked. We additionally cover the advantages and limitations of our approach. To our knowledge, there are no similar results in the verification of implementations of an x86 microprocessor.

ObjectiveTo describe national patterns of National Health Service (NHS) analysis of mismatch repair (MMR) genes in England using individual-level data submitted to the National Disease Registration Service (NDRS) by the NHS regional molecular genetics laboratories.DesignLaboratories submitted individual-level patient data to NDRS against a prescribed data model, including (1) patient identifiers, (2) test episode data, (3) per-gene results and (4) detected sequence variants. Individualised per-laboratory algorithms were designed and applied in NDRS to extract and map the data to the common data model. Laboratory-level MMR activity audit data from the Clinical Molecular Genetics Society/Association of Clinical Genomic Science were used to assess early years’ missing data.ResultsIndividual-level data from patients undergoing NHS MMR germline genetic testing were submitted from all 13 English laboratories performing MMR analyses, comprising in total 16 722 patients (9649 full-gene, 7073 targeted), with the earliest submission from 2000. The NDRS dataset is estimated to comprise >60% of NHS MMR analyses performed since inception of NHS MMR analysis, with complete national data for full-gene analyses for 2016 onwards. Out of 9649 full-gene tests, 2724 had an abnormal result, approximately 70% of which were (likely) pathogenic. Data linkage to the National Cancer Registry demonstrated colorectal cancer was the most frequent cancer type in which full-gene analysis was performed.ConclusionThe NDRS MMR dataset is a unique national pan-laboratory amalgamation of individual-level clinical and genomic patient data with pseudonymised identifiers enabling linkage to other national datasets. This growing resource will enable longitudinal research and can form the basis of a live national genomic disease registry.