Token‐Aware Completion Functions for Elastic Processor Verification

The correctness of pipelined machines is a subject that has been studied extensively. Most of the recent work has used variants of the Burch and Dill notion of correctness [4]. As new features are modeled, e.g., interrupts, new notions of correctness are developed. Given the plethora of correctness conditions, the question arises: what is a reasonable notion of correctness? We discuss the issue at length and show, by mechanical proof, that variants of the Burch and Dill notion of correctness are flawed. We propose a notion of correctness based on WEBs (Well-founded Equivalence Bisimulations) [16, 19]. Briefly, our notion of correctness implies that the ISA (Instruction Set Architecture) and MA (Micro-Architecture) machines have the same observable in_nite paths, up to stuttering. This implies that the two machines satisfy the same CTL*X properties and the same safety and liveness properties (up to stuttering).To test the utility of the idea, we use ACL2 to verify several variants of the simple pipelined machine described by Sawada in [22], [23]. Our variants extend the basic machine by adding exceptions (to deal with overflows), interrupts, and fleshed-out 128-bit ALUs (one of which is described in a netlist language). In all cases, we prove the same final theorem. We develop a methodology with mechanical support that we used to verify Sawada’s machine. The resulting proof is substantially shorter than the original and does not require any intermediate abstractions; in fact, given the definitions and some general-purpose books (collections of theorems), the proof is automatic. A practical and noteworthy feature of WEBs is their compositionality. This allows us to prove the correctness of the more elaborate machines in manageable stages.KeywordsProof ObligationProgram CounterInterrupt HandlerMechanical ProofUninterpreted FunctionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

We combine compositional reasoning and reachability analysis to formally verify the safety of a recent cache coherence protocol. The protocol is a detailed implementation of token coherence, an approach that decouples correctness and performance. First, we present a formal and abstract specification that captures the safety substrate of token coherence, and highlights the symmetry in states of the cache controllers and contents of the messages they exchange. Then, we prove that this abstract specification is coherent, and check whether the implementation proposed by the protocol designers is a refinement of the abstract specification. Our refinement proof is parametric in the number of cache controllers, and is compositional as it reduces the refinement checks to individual controllers using a specialized form of assume-guarantee reasoning. The individual refinement obligations are discharged using refinement maps and reachability analysis. While the formal proof justifies the intuitive claim by the designers about the ease of verifiability of token coherence, we report on several bugs in the implementation, and accompanying modifications, that were missed by extensive prior simulations.KeywordsModel CheckerLabel Transition SystemReachability AnalysisMemory ControllerCache CoherenceThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Architecture specifications such as Armv8-A and RISC-V are the ultimate foundation for software verification and the correctness criteria for hardware verification. They should define the allowed sequential and relaxed-memory concurrency behaviour of programs, but hitherto there has been no integration of full-scale instruction-set architecture (ISA) semantics with axiomatic concurrency models, either in mathematics or in tools. These ISA semantics can be surprisingly large and intricate, e.g. 100k+\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$+$$\\end{document} lines for Armv8-A. In this paper we present a tool, Isla, for computing the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions, in the Sail language, and arbitrary axiomatic relaxed-memory concurrency models, in the Cat language. It is based on a generic symbolic engine for Sail ISA specifications. We equip the tool with a web interface to make it widely accessible, and illustrate and evaluate it for Armv8-A and RISC-V. The symbolic execution engine is valuable also for other verification tasks: it has been used in automated ISA test generation for the Arm Morello prototype architecture, extending Armv8-A with CHERI capabilities, and for Iris program-logic reasoning about binary code above the Armv8-A and RISC-V ISA specifications. By using full-scale and authoritative ISA semantics, Isla lets one evaluate litmus tests using arbitrary user instructions with high confidence. Moreover, because these ISA specifications give detailed and validated definitions of the sequential aspects of systems functionality, as used by hypervisors and operating systems, e.g. instruction fetch, exceptions, and address translation, our tool provides a basis for developing concurrency semantics for these. We demonstrate this for the Armv8-A instruction-fetch and virtual-memory models and examples of Simner et al.

An embedded single media processor named MediaDSP3200 core fabricated in a six-layer metal 0.18um CMOS process which implemented the RISC instruction set, DSP data processing instruction set and single-instruction-multiple-data (SIMD) multimedia-enhanced instruction set is described. MediaDSP3200 fuses RISC architecture and DSP computation capability thoroughly, which achieves RISC fundamental, DSP extended and single instruction multiple data (SIMD) instruction set with various addressing modes in a unified pipeline stage architecture. These characteristics enhance system digital signal processing performance greatly. The test processor can achieve 32x32-bit multiply-accumulate (MAC) of 320 MOPS, with 16x16-bit MAC of 1280MOPS. The test processor dissipates 600mW at 1.8v, 320MHz. Also, the implementation was primarily standard cell logic design style. MediaDSP3200 targets diverse embedded application systems, which need both powerful processing/control capability and low-cost budget, e.g. set-top-boxes, video conferencing, DTV, etc. MediaDSP3200 instruction set architecture, addressing mode, pipeline design, SIMD feature, split-ALU and MAC are described in this paper. Finally, the performance benchmark based on H.264 and MPEG decoder algorithm are given in this paper.

We show how to automatically verify that complex XScale-like pipelined machine models satisfy the same safety and liveness properties as their corresponding instruction set architecture models, by using the notion of well-founded equivalence bisimulation (WEB) refinement. Automation is achieved by reducing the WEB-refinement proof obligation to a formula in the logic of counter arithmetic with lambda expressions and uninterpreted functions (CLU). We use the tool UCLID to transform the resulting CLU formula into a Boolean formula, which is then checked with a SAT solver. The models we verify include features such as out of order completion, precise exceptions, branch prediction, and interrupts. We use two types of refinement maps. In one, flushing is used to map pipelined machine states to instruction set architecture states; in the other, we use the commitment approach, which is the dual of flushing, since partially completed instructions are invalidated. We present experimental results for all the machines modelled, including verification times. For our application, we found that the time spent proving liveness accounts for about 5% of the over-all verification time.

This paper describes a novel video specific instruction set architecture for ASIP design. With SIMD (Single Instruction Multiple Data) instructions, and video specific instructions, an instruction set architecture is introduced to enhance the performance for video applications. Furthermore, we quantify the improvement on H.263 encoding. In this paper, we evaluate and compare the performance of VS ISA (Video Specific Instruction Set Architecture), other DSPs (digital signal processors) and conventional SIMD media extensions in the context of video coding. Our evaluation results show that VS ISA improves the processors performance by approximate 5x on H.263 encoding, and VS ISA outperforms other architectures by 1.6x to 8.57x in computing IDCT.

Presented on 28 May 2025: Session 12 Primary cementing is a crucial aspect of petroleum well construction, ensuring long-term well integrity, preventing fluid migration, and protecting groundwater. In Queensland, Resources Safety & Health Queensland (RSHQ) Petroleum and Gas Inspectorate enforces the Code of Practice for the construction and abandonment of petroleum wells and associated bores in Queensland, which outlines engineering and technical requirements for well construction and abandonment. Between January 2020 and December 2023, industry operators drilled 2541 wells and reported 43 failures to meet primary cementing objectives (FTMCOs), prompting the Inspectorate to conduct industry-wide audits. The audits focussed on compliance with cementing practices, formal safety assessments, slurry design, laboratory testing, verification procedures, and factors contributing to slumping and failure to reach the designed top of cement (TOC). Key findings highlighted gaps in formal safety assessments, a tendency to delegate cement slurry design to contractors without rigorous technical oversight, and inconsistencies in laboratory testing documentation. Additionally, verification procedures were not always aligned with regulatory requirements, and cement losses presented significant challenges towards the slumping and TOC deficiencies. To enhance primary cementing practices, the paper recommends strengthening oversight of cementing contractors’ technical capabilities, improving verification procedures, and ensuring consistent comprehensive risk assessments. Aligning cement verification procedures with regulatory requirements and adopting best practices for mitigating cement losses will improve well integrity and regulatory compliance. To access the Oral Presentation click the link on the right. To read the full paper click here

This paper presents BURAQ, a DSP development framework, which aims at optimizing cost, efficiency and turn around time of system-on-chip development. BURAQ accepts an instruction and architecture description (IAD) file that represents the DSP and its instruction set at a higher level of abstraction, in a proprietary language. The system then synthesizes a complete hardware description of the processor core, along with accompanying tools i.e. ILP assembler, linker and instruction set simulator. The synthesized processor core is composed of a processor kernel, registers, addressing units and functional units. A user friendly IDE for the above mentioned framework has also been developed and it allows easy specification and detailed analysis of the target architecture. Hence BURAQ allows a platform for hardware/software co-simulation of a DSP. co-simulation is a very powerful tool for early design space exploration and thus reducing production cost and development time of SOC architectures. The effectiveness of BURAQ was verified with a successful modeling of Texas Instruments' TMS320C6x and StarCore's SC140.

The size of the embedded software is increasing at a rapid pace. Often, the task of designing hardware that meets a lot of functionality needed in software became a challenging process and it needs more time for projecting. Then, the compression code is a way to reduce this problem. This paper presents an innovative and efficient approach to code compression. Our method reduces code size by up to 31% (including all extra costs). We performed simulations and analyzes, using the applications from benchmark MiBench and use two embedded processors (ARM and MIPS). Our method is orthogonal to approaches that take into account the particularities of a given instruction set architecture, becoming an independent method for any specific architecture. We have implemented the decompressor using VHDL and FPGA and we obtained only one clock from decompression process.

This work proposes a system level design of a special purpose RISC architecture for the implementation of Knowledge Based Systems (KBS). The processor implements an Instruction Set Architecture (ISA) derived from the description of the Rete algorithm given in Forgy (1982) - the paper that proposes the algorithm - alongside some general purpose instructions (not described here). It is part of a System-on-a-Chip (SoC) for the execution of cognitive agents. The computational architecture of this SoC will be presented using the cognitive model of the Concurrent Autonomous Agent (CAA) as a reference, since it has been successfully applied in numerous intelligent robotics applications. The cognitive model of the CAA comprises three levels that run concurrently: the reactive level, which executes the perception-action cycle, the instinctive level, that manages plan execution, and the cognitive level, which performs planning. In the method here proposed, the KBS knowledge base is compiled into a program composed by the application speci c instructions and the matching procedure is executed by the processor using this program. To validate the architecture of this processor, some experiments using an example knowledge base will then be presented. The experiments - performed using a system-level simulator written in the Scala language - shown that the simulated architecture reported the expected matches for additions and exclusions of facts from the Rete memories.

We present a formal tool for verification of multivariate nonlinear inequalities. Our verification method is based on interval arithmetic with Taylor approximations. Our tool is implemented in the HOL Light proof assistant and it is capable to verify multivariate nonlinear polynomial and non-polynomial inequalities on rectangular domains. One of the main features of our work is an efficient implementation of the verification procedure which can prove non-trivial high-dimensional inequalities in several seconds. We developed the verification tool as a part of the Flyspeck project (a formal proof of the Kepler conjecture). The Flyspeck project includes about 1000 nonlinear inequalities. We successfully tested our method on more than 100 Flyspeck inequalities and estimated that the formal verification procedure is about 3000 times slower than an informal verification method implemented in C++. We also describe future work and prospective optimizations for our method.

Integrity assessment of supercritical CO2 transport pipelines

In this paper, we present two novel synchronization approaches to support data flow in clockless designs using single-rail encoding. Both approaches are based on self-resetting stage logic in which a pipeline stage resets itself before starting the next execution cycle. As such, a stage goes through a reset and an evaluate phase to complete a single period. While in the first approach synchronization is controlled between neighboring stages, the last stage of the pipeline in the second approach controls the synchronization of all the stages in the pipeline. Concept designs of both pipelines are presented to illustrate the inner workings of self-resetting stage logic and its data-flow synchronization mechanism. Implementation results show that both pipelines can reach throughputs up to 1.4 Giga outputs per second.

In this paper, we present a novel synchronization approach to support data flow in clockless designs using single-rail encoding. This approach is based on self-resetting stage logic in which a pipeline stage resets itself before starting the next execution cycle. As such, a stage goes through a reset phase when its output is null, and an evaluate phase when its output is the result of the evaluation of its inputs. To insure proper operation, a latch-based synchronization mechanism is proposed which yields an efficient and a simple uni-directional handshaking scheme emanating from the last stage in the pipeline back towards the remaining stages of the pipeline. A concept design of a four-bit 16-stage pipeline is presented to illustrate the inner workings of self-resetting stage logic and its data-flow synchronization mechanism controlled at pipeline level. The overall pipeline's performance is elucidated through a detailed signal timing analysis to bring to light how the duration of the evaluate phase, reset phase, and the latch enable of a given stage depends on its location within the pipeline.

We present a description of the design and usage of a new synoptic pipeline and database model for time series photometry in the VISTA Data Flow System (VDFS). All UKIRT-WFCAM data and most of the VISTA main survey data will be processed and archived by the VDFS. Much of these data are multi-epoch, useful for finding moving and variable objects. Our new database design allows the users to easily find rare objects of these types amongst the huge volume of data being produced by modern survey telescopes. Its effectiveness is demonstrated through examples using Data Release 5 of the UKIDSS Deep Extragalactic Survey (DXS) and the WFCAM standard star data. The synoptic pipeline provides additional quality control and calibration to these data in the process of generating accurate light-curves. We find that 0.6+-0.1% of stars and 2.3+-0.6% of galaxies in the UKIDSS-DXS with K<15 mag are variable with amplitudes \Delta K>0.015 mag