A Framework for Microprocessor Correctness Statements

Aagaard, Mark; Cook, Byron; Day, Nancy A.; Jones, Robert B.

doi:10.1007/3-540-44798-9_33

Cited by 26 publications

(13 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Early work in this area is by Burch and Dill, who introduced a notion of correctness based on commuting diagrams that we call the BD correctness criterion [Burch and Dill 1994]. Aagaard et al [2003Aagaard et al [ , 2001 have provided a survey of the various notions of correctness for pipelined machines, most of which are variations of the BD correctness criterion.…”

Section: Related Workmentioning

confidence: 99%

Automatic verification of safety and liveness for pipelined machines using WEB refinement

Manolios

Srinivasan

2008

ACM Trans. Des. Autom. Electron. Syst.

View full text Add to dashboard Cite

We show how to automatically verify that complex pipelined machine models satisfy the same safety and liveness properties as their instruction-set architecture (ISA) models by using well-founded equivalence bisimulation (WEB) refinement. We show how to reduce WEB-refinement proof obligations to formulas expressible in the decidable logic of counter arithmetic with lambda expressions and uninterpreted functions (CLU). This allows us to automate the verification of the pipelined machine models by using the UCLID decision procedure to transform CLU formulas to Boolean satisfiability problems. To relate pipelined machine states to ISA states, we use the commitment and flushing refinement maps. We evaluate our work using 17 pipelined machine models that contain various features, including deep pipelines, precise exceptions, branch prediction, interrupts, and instruction queues. Our experimental results show that the overhead of proving liveness, obtained by comparing the cost of proving both safety and liveness with the cost of only proving safety, is about 17%, but depends on the refinement map used; for example, the liveness overhead is 23% when flushing is used and is negligible when commitment is used.

show abstract

Section: Related Workmentioning

confidence: 99%

Automatic verification of safety and liveness for pipelined machines using WEB refinement

Manolios

Srinivasan

2008

ACM Trans. Des. Autom. Electron. Syst.

View full text Add to dashboard Cite

show abstract

“…McMillan [6] proposes a compositional rule for hardware verification based on local refinements which can be efficiently model checked. Aagaard et al [7] present a framework for microprocessor correctness statements based on simulation relations.…”

Section: A Related Workmentioning

confidence: 99%

A Refinement Approach to Design and Verification of On-Chip Communication Protocols

Böhm

Melham

2008

2008 Formal Methods in Computer-Aided Design

View full text Add to dashboard Cite

Abstract-Modern computer systems rely more and more on on-chip communication protocols to exchange data. To meet performance requirements these protocols have become highly complex, which usually makes their formal verification infeasible with reasonable time and effort.We present a new refinement approach to on-chip communication protocols that combines design and verification together, interleaving them hand-in-hand. Our modeling framework consists of design steps and design transformations formalized as finite state machines. Given a verified design step, transformations are used to extend the system with advanced features. A design transformation ensures that the extended design is correct if the previous system is correct. This approach is illustrated by an arbiter-based master-slave communication system inspired by the AMBA High-performance Bus architecture. Starting with a sequential protocol design, it is extended with pipelining and burst transfers. Transformations are generated from design constraints providing a basis for correctness-by-design of the derived system.

show abstract

“…A framework for categorising correctness statements, as used in the verification of pipelined processors, is presented in [1]. Most of the correctness statements are expressed in the form of a commuting diagram, although property-oriented approaches -in which the formal processor model is shown to imply the abstract architecture specification -are an alternative [23].…”

Section: Correctnessmentioning

confidence: 99%

“…1 The temporal abstraction is used to explicitly identify the times at which the execute stage begins, thus skipping over states in which instruction execution is not complete. One of the advantages of this approach is that our correctness model is strong and generic, and the abstractions are intuitive.…”

Section: Correctnessmentioning

confidence: 99%

Formal Specification and Verification of ARM6

Fox

2003

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This paper gives an overview of progress made on the formal specification and verification of the ARM6 micro-architecture using the HOL proof system. The ARM6 is a commercial processor design prevalent in mobile and embedded systems -it features a 3-stage pipeline with a multi-cycle execute stage, six operating modes and a rich 32-bit RISC instruction set. This paper describes some of the difficulties encountered when working with a full blown instruction set architecture that has not been designed with verification in mind.

show abstract

A Framework for Microprocessor Correctness Statements

Cited by 26 publications

References 32 publications

Automatic verification of safety and liveness for pipelined machines using WEB refinement

Automatic verification of safety and liveness for pipelined machines using WEB refinement

A Refinement Approach to Design and Verification of On-Chip Communication Protocols

Formal Specification and Verification of ARM6

Contact Info

Product

Resources

About