Verification using uninterpreted functions and finite instantiations

Abstract

One approach to address the state explosion problem in verification of microprocessors with wide datapaths is to model variables as integers and datapath functions as uninterpreted ones. Verification then proceeds by either symbolically simulating this abstract model, or creating a small finite instantiation which contains all possible behaviors. In this paper, we first prove that the reachability problem for models with uninterpreted functions and predicates only of the form x = y, where both x and y are integer variables, is undecidable. However, such predicates are generally only needed in the property being checked and not in the model. For properties involving predicates of the forms x = term and x = y, we provide complete and partial verification techniques using finite instantiations respectively. Applications of these result to the verification of the control circuitry of superscalar microprocessors are provided, where one can verify various correctness properties using models with one or a few bit integers.

What’s Decidable About Program Verification Modulo Axioms?

“…The theory of equality with uninterpreted functions (EUF) is a widely used theory in many verification applications as it has decidable quantifier free fragment. EUF has been central to advances in verification of microprocessor control [6,4] and hardware verification [1,19] and property directed model checking [18]. EUF has been used as a popular abstraction in software verification [2,3].…”

Approximate Invariant Property Checking Using Term-Height Reduction for a Subset of First-Order Logic

“…Isles, et al 5) show a state enumeration procedure for transition systems using EUF terms extended with memories. They use some state reduction techniques 4) , which utilize replaceability of sub-terms that comprise two states. Corella, et al 8) show a procedure using Multiway Decision Graphs, which can represent characteristic functions for state sets.…”

“…In the EUF-based model checking, for example, arithmetic operations are abstracted as function symbols, and the algorithm treats them simply as symbols without considering their semantics. Model checking using EUF is, however, known to be undecidable 4) . In fact, straightforward state exploration for transition functions defined with EUF terms does not terminate, because the number of terms which possibly occur in state variables can be infinite.…”

Verification of Infinite State Systems by Compositional Model Checking

“…The present method is not a decision procedure for such a logic, but rather a user-guided reduction to the propositional case that is necessarily incomplete. Note, an earlier semi-decision procedure for such a logic [8], is sound only in a very restricted case; for most problems of practical interest, the procedure is not sound, and can only be used to find counterexamples. Of the various non-temporal techniques using uninterpreted functions, the present method is most similar to [17], since it is also based on finite instantiation.…”