Automatic verification of safety and liveness for XScale-like processor models using WEB refinements

In this paper, we present the logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions (CLU). CLU generalizes the logic of equality with uninterpreted functions (EUF) with constrained lambda expressions, ordering, and successor and predecessor functions. In addition to modeling pipelined processors that EUF has proved useful for, CLU can be used to model many infinite-state systems including those with infinite memories, finite and infinite queues including lossy channels, and networks of identical processes. Even with this richer expressive power, the validity of a CLU formula can be efficiently decided by translating it to a propositional formula, and then using Boolean methods to check validity. We give theoretical and empirical evidence for the efficiency of our decision procedure. We also describe verification techniques that we have used on a variety of systems, including an out-of-order execution unit and the load-store unit of an industrial microprocessor.

In this paper we present a new progressive cooperating simplifier for deciding the satisfiability of a quantifier-free formula in the first-order theory of integers involving combinations of sublogics, referred to as Satisfiability Modulo Theories (SMT). Our approach, given an SMT problem, replaces each non-propositional theory atom with a Boolean indicator variable yielding a purely propositional formula to be decided by a SAT solver. Starting with the most abstract representation (the Boolean formula), the solver gradually integrates more complex theory solvers into the working decision procedure. Additionally, we propose a method to simplify “expensive” atoms into suitable conjunctions of “cheaper” theory atoms when conflicts occur. This process considerably increases the efficiency of the overall procedure by reducing the number of calls to the slower theory solvers. This is made possible by adopting our novel inter-logic implication framework, as proposed in this paper. We have implemented these methods in our Ario SMT solver by combining three different theory solvers within a DPLL-style SAT solver: a Unit-Two-Variable-Per-Inequality (UTVPI) solver, an integer linear programming (ILP) solver, and a solver for systems of equalities with uninterpreted functions. The efficiencies of our proposed algorithms are demonstrated and exhaustively investigated on a wide range of benchmarks in hardware and software verification domain. Empirical results are also presented showing the advantages/limitations of our methods over other modern techniques for solving these SMT problems.

The correctness of pipelined machines is a subject that has been studied extensively. Most of the recent work has used variants of the Burch and Dill notion of correctness [4]. As new features are modeled, e.g., interrupts, new notions of correctness are developed. Given the plethora of correctness conditions, the question arises: what is a reasonable notion of correctness? We discuss the issue at length and show, by mechanical proof, that variants of the Burch and Dill notion of correctness are flawed. We propose a notion of correctness based on WEBs (Well-founded Equivalence Bisimulations) [16, 19]. Briefly, our notion of correctness implies that the ISA (Instruction Set Architecture) and MA (Micro-Architecture) machines have the same observable in_nite paths, up to stuttering. This implies that the two machines satisfy the same CTL*X properties and the same safety and liveness properties (up to stuttering).To test the utility of the idea, we use ACL2 to verify several variants of the simple pipelined machine described by Sawada in [22], [23]. Our variants extend the basic machine by adding exceptions (to deal with overflows), interrupts, and fleshed-out 128-bit ALUs (one of which is described in a netlist language). In all cases, we prove the same final theorem. We develop a methodology with mechanical support that we used to verify Sawada’s machine. The resulting proof is substantially shorter than the original and does not require any intermediate abstractions; in fact, given the definitions and some general-purpose books (collections of theorems), the proof is automatic. A practical and noteworthy feature of WEBs is their compositionality. This allows us to prove the correctness of the more elaborate machines in manageable stages.KeywordsProof ObligationProgram CounterInterrupt HandlerMechanical ProofUninterpreted FunctionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This dissertation is to illustrate the current state of the art of DNA computing achievements, especially of new approaches to solve theoretical 3-SAT problems and the hitting-set problem. Beginning with Adleman’s breakthrough which is an molecular algorithm for the solution of a NP-complete, combinatorial problem, the directed Hamiltonian path problem (HPP). Today, many researchers all over the world concentrate on proposing new methods to solve engineering or application problems with a DNA computing approach. Satisfiability problem is given a Boolean formula, and decide if a satisfying truth assignment exists. ( ) ( ) … ( ) ( ) is an example of Boolean formula. k-SAT problem means that each clause has exactly k literals. Not-All-Equal (NAE) 3-SAT problem and One-In-Three (1IN3) 3-SAT problem are both NP-complete problems. In this dissertation, we present molecular solutions to find all true assignments (3-SAT problem) and furthermore find Not-All-Equal (NAE) solutions and One-In-Three (1IN3) solutions in DNA-based Supercomputing. Hitting-set problem assume that there exists a collection C of subsets of a finite set S, and a positive integer K  |S|, and we need to know if there is a subset  S with | |  K such that contains at least one element of each subset in C. In other words, is the subset that intersects every subset in C and is called the hitting-set. In this dissertation, a DNA-based algorithm is proposed to solve the small hitting-set problem. A small hitting-set is a hitting-set with the smallest K value, i.e., the hitting-set with the smallest number of elements. Furthermore, an algorithm is introduced to find the number of ones from 2n combinations and minimum numbers of ones represents the small hitting-set since K is expected to be as small as possible. The complexity of all the presented DNA-based algorithms is also discussed. We describe time complexity and volume complexity of three Algorithms, numbers of test tube used and the longest library strand in solution space of all three Algorithms. Finally, the simulated experiment is applied to verify correctness of the proposed DNA-based algorithm for solving the One-In-Three (1IN3) 3-SAT problem, and simulation of Not-All-Equal (NAE) 3-SAT problem is similar. Also, another simulated experiment is applied to our proposed DNA-based algorithm 6-2, in order to solve the well-known hitting-set problem. This research has been motivated by the benefit and the application of DNA computing and gives new methods to solve two 3-SAT problems and the hitting-set problem which are NP-complete.

Given a Boolean formula $\phi$ over $n$ variables, the problem of model counting is to compute the number of solutions of $\phi$. Model counting is a fundamental problem in computer science with wide-ranging applications. Owing to the \#P-hardness of the problems, Stockmeyer initiated the study of the complexity of approximate counting. Stockmeyer showed that $\log n$ calls to an NP oracle are necessary and sufficient to achieve $(\varepsilon,\delta)$ guarantees. The hashing-based framework proposed by Stockmeyer has been very influential in designing practical counters over the past decade, wherein the SAT solver substitutes the NP oracle calls in practice. It is well known that an NP oracle does not fully capture the behavior of SAT solvers, as SAT solvers are also designed to provide satisfying assignments when a formula is satisfiable, without additional overhead. Accordingly, the notion of SAT oracle has been proposed to capture the behavior of SAT solver wherein given a Boolean formula, an SAT oracle returns a satisfying assignment if the formula is satisfiable or returns unsatisfiable otherwise. Since the practical state-of-the-art approximate counting techniques use SAT solvers, a natural question is whether an SAT oracle is more powerful than an NP oracle in the context of approximate model counting. The primary contribution of this work is to study the relative power of the NP oracle and SAT oracle in the context of approximate model counting. The previous techniques proposed in the context of an NP oracle are weak to provide strong bounds in the context of SAT oracle since, in contrast to an NP oracle that provides only one bit of information, a SAT oracle can provide $n$ bits of information. We therefore develop a new methodology to achieve the main result: a SAT oracle is no more powerful than an NP oracle in the context of approximate model counting.

This paper demonstrates the modeling and deductive verification of out-of-order microprocessors of varying complexities using a logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions (CLU). The microprocessors support combinations of out-of-order instruction execution, superscalar operation, branch prediction, execute and memory exceptions, and load-store buffering. We illustrate that the logic is expressive enough to model components found in modern processors. The paper describes the challenges in modeling and verification with the addition of different design features. The paper demonstrates the effective use of automatic decision procedure to reduce the amount of manual guidance required in discharging most proof obligations in the verification. Unlike previous methods, the verification scales well for superscalar processors with wide dispatch and retirement widths.

We present an algebraic fault attack (AFA) solver for recovering secret bits from hardware implementations of the SHA family of hash functions. The crucial insight in our method is the use of SHA-based propagation and conflict-analysis methods in the inner-loop of a Boolean conflict-driven clause-learning SAT solver, a la the DPLL(T) paradigm. In our method the fault-injected part of the hash function is translated into a Boolean formula (which is then fed as input to the SAT solver), while the rest is encoded via a programmatic interface as part of the SAT solver’s propagation and conflict analysis routines. Such an approach enables the addition of learnt clauses to the SAT solver in an on-demand and lazy fashion. We evaluated our tool under a variety of fault models, and showed that we can recover the secret bits faster and with far fewer number of injected faults compared to previous best work. AFA is a powerful way of empirically verifying the strength of a cryptographic function’s implementation.

It was investigated the Boolean satisfiability (SAT) problem defined as follows: given a Boolean formula, check whether an assignment of Boolean values to the propositional variables in the formula exists, such that the formula evaluates to true. If such an assignment exists, the formula is said to be satisfiable; otherwise, it is unsatisfiable. With using of analytical expressions of multi-valued logic 2SAT boolean satisfiability was formulated as linear programming optimization problem. The same linear programming formulation was extended to find 3SAT and kSAT boolean satisfiability for k greater than 3. So, using new analytic multi-valued logic expressions and linear programming formulation of boolean satisfiability proposition that kSAT is in P and could be solved in linear time was proved.KeywordsBoolean satisfiabilityConjunctive normal formConvex functionLinear programmingMulti-valued logicNP problemTime complexity.

The logic of Counters, Lambdas, and Uninterpreted functions (CLU) is a subset of first-order logic satisfying the twin properties that 1) the validity of a CLU formula can be decided by generating a Boolean formula and using a Boolean satisfiability (SAT) checker to show the formula is unsatisfiable, and 2) it has sufficient expressive power to construct models of a variety of interesting software and hardware systems. We describe this logic and show its modeling capabilities.

The Isabelle/HOL proof assistant provides quite advanced and reliable support for discharging proof goals with external SMT solvers by reconstructing the resulting proof tree within the Isabelle/Pure inference kernel. In particular, currently Isabelle fully and efficiently supports proof reconstruction for the quantifier-free fragments of the theories of equality and uninterpreted functions (QF_UF) and linear integer arithmetic (QF_LIA). Yet there are a number of practically relevant theories that can be decided using relatively efficient algorithms, but are not supported either by the Isabelle proof reconstruction procedure or by the SMT solvers themselves. Meanwhile, if the decision procedure for an extended logical theory can be expressed as a complete quantifier instantiation strategy that reduces the given decision problem into the supported logical fragment (QF_UFLIA), the theory can be fully supported within the existing Isabelle/HOL infrastructure with relatively little additional effort. The goal of our work was to develop a fully formal completeness proof for an efficient quantifier instantiation strategy that translates a satisfiability problem in the logic of bounded linear integer arithmetic (we call it QF_BLIA) into the equisatisfiable problem in the logic of linear integer arithmetic and uninterpreted functions (QF_UFLIA). In this paper we first give the initial informal presentation of the proof, then discuss the most relevant issues of our resulting corresponding formal development of the completeness proof within Isabelle/HOL. The resulting formal proofs tightly follow the provided informal presentation, but at the same time they also contain quite significant amount of auxiliary developments that can potentially be generalized for other similar proof formalizations and automated using theory generation facilities of Isabelle/ML.

We describe a novel architectural framework that allows software applications written for a given Complex Instruction Set Computer (CISC) to migrate to a different, higher performance architecture, without a significant investment on the part of the application user or developer. The framework provides a hardware mechanism for seamless switching between two instruction sets, resulting in a machine that enhances application performance while keeping the same program behavior (from a user perspective). High execution speed on migrated applications is achieved through automated translation of the object code of one machine to that of the other, using advanced global optimization and scheduling techniques. Issues affecting application behavior, such as precise exceptions, as well as self-modifying code, are addressed. Relaxation of full compatibility on these issues lead to further possible performance gains, encouraging applications to adopt the newer architecture.The proposed framework offers a path for moving from complex instruction set computers (CISCs) to newer architectures, such as reduced instruction set computers (RISCs), superscalars, or very long instruction word (VLIW) machines, while protecting the extensive economic investment represented by existing software. To illustrate our approach, we show how system code written (and compiled) for the IBM System/390 can yield fine-grain parallelism, as it is targeted for execution by a VLIW machine, with encouraging performance results.

We present our extension of ACL2 with Satisfiability Modulo Theories (SMT) solvers using ACL2's trusted clause processor mechanism. We are particularly interested in the verification of physical systems including Analog and Mixed-Signal (AMS) designs. ACL2 offers strong induction abilities for reasoning about sequences and SMT complements deduction methods like ACL2 with fast nonlinear arithmetic solving procedures. While SAT solvers have been integrated into ACL2 in previous work, SMT methods raise new issues because of their support for a broader range of domains including real numbers and uninterpreted functions. This paper presents Smtlink, our clause processor for integrating SMT solvers into ACL2. We describe key design and implementation issues and describe our experience with its use.

As fields like AI and robotics continue to expand, the demand for processors that are both powerful and energy-efficient is growing. This imposes the need for the development of such processors at a large scale and at a faster rate, which is possible through open-source development. While the current computing industry is dominated by proprietary technologies and licensed architectures, open-source hardware is rapidly gaining popularity across all industry segments, from high-performance computing to edge-IoT applications.This paper presents the design and FPGA implementation of a 32-bit five-stage pipelined processor core based on the RISC-V open-source Instruction Set Architecture (ISA). The proposed design presents a simple implementation of the RISC-V core, incorporating a 2-bit branch predictor. This makes it easier for beginners to understand the fundamental architecture of a pipelined RISC processor and branch predictors. Additionally, the design has considerable potential for future upgrades. The core is developed using SystemVerilog and has been tested through simulations in Verilator and Xsim, as well as by deploying it on a Basys3 FPGA board.

This tutorial offers a pedagogical guide to hybrid quantum processors that integrate discrete-variable (DV) qubits and continuous-variable (CV) oscillators. Aimed at computer scientists, engineers, and physicists, it provides an overview of the experimental, algorithmic, and architectural aspects of this novel and rapidly developing hardware model. Experimental realizations of this model include superconducting, trapped-ion, and neutral-atom platforms. By combining DV and CV components, hybrid oscillator-qubit processors enable a powerful new paradigm that offers complementary strengths for quantum control, error correction, computation, and simulation. Working toward the goal of a full-stack system connecting applications to CV-DV hardware, we define and formulate abstract machine models and instruction set architectures. These essential abstractions enable codesign of hardware and software, and resource estimation for exploring the potential of current and future hardware for computational and simulation tasks. Using these abstractions, we present both new and existing examples that illustrate the benefits of hybrid CV-DV processors relative to traditional DV-only hardware in computation as well as quantum simulation of physical models. Examples include algorithms for transferring states between DV and CV systems, performing the quantum Fourier transform, and simulation of lattice gauge theories. Relative to qubit-only hardware, the bosonic degrees of freedom natively available in hybrid architectures can substantially reduce the circuit complexity of simulations for physical models containing bosons. A key technique is the extension of quantum signal processing ideas to CV-DV systems. This work is intended to serve as a timely and comprehensive guide to this relatively unexplored yet promising approach to quantum computation and to provide a road map to guide future development.

We present techniques for design and formal verification of both safety and liveness of pipelined/superscalar/VLIW processors with built-in mechanisms for soft-error tolerance. The formal verification is done with the highly automatic method of Correspondence Checking by exploiting the property of Positive Equality and efficient translations of the correctness conditions to equivalent Boolean formulas that are evaluated with SAT solvers. Soft errors are caused by radiation and cross talk between devices or wires on the chip, and will become increasingly frequent with the decreasing transistor sizes in future technologies. Soft errors can cause catastrophic failures in safety-critical applications, such as space, avionics, weapons systems, automotive, and medical devices. Thus, the need to design and efficiently formally verify pipelined microprocessors with mechanisms for soft-error tolerance.