EVC: A Validity Checker for the Logic of Equality with Uninterpreted Functions and Memories, Exploiting Positive Equality, and Conservative Transformations

Abstract

The property of Positive Equality [2] dramatically speeds up validity checking of formulas in the logic of Equality with Uninterpreted Functions and Memories (EUFM) [4]. The logic expresses correctness of high-level microprocessors. We present EVC (Equality Validity Checker)-a tool that exploits Positive Equality and other optimizations when translating a formula in EUFM to a propositional formula, which can then be evaluated by any Boolean satisfiability (SAT) procedure. EVC has been used for the automatic formal verification of pipelined, superscalar, and VLIW microprocessors. 2 Hardware Description Language In order to be verified with EVC, a high-level implementation processor and its specification must be defined in our Hardware Description Language (HDL).

TLSim and EVC: a term-level symbolic simulator and an efficient decision procedure for the logic of equality with uninterpreted functions and memories

“…To reduce the above two hurdles when translating to CNF, we can preserve the ITE-tree structure of equation arguments, instead of replacing each equation with a disjunction of conjunctions of formulas, as done in , Velev and Bryant (1999b), Velev and Bryant (2001). For example, the equation Velev (2004d).…”

Using positive equality to prove liveness for pipelined microprocessors

“…It can be proved that if EqualTargets(Op, PredictedTarget, Target) is replaced with the original equation (PredictedTarget = Target), then nextPC = nextPC_old, i.e., the behavior will be the same as in the original specification. This equivalence proof requires a positive equality comparison, and can be done with the decision procedure EVC [32]. The resulting Boolean correctness formula had 5 variables, its negation had 16 CNF variables and 40 clauses, and was proved unsatisfiable in 0.001 seconds by the SAT-checker Siege [23].…”

“…The e ij Boolean variables [8] encode g-equations, with some of those variables added in order to enforce the property of transitivity of equality. This property was enforced in EVC [32] by triangulating the e ijcomparison graph [5]-where each edge represents an equality comparison between a pair of g-term variablesadding extra e ij variables in a greedy manner, and imposing transitivity constraints for each triangle. Transitivity of equality constraints were included in all CNF formulas generated by EVC, although only needed for processors having branch prediction, and designed without modeling restrictions.…”

“…In the current paper, the implementation and specification are described in the high-level hardware description language AbsHDL [32], based on the logic of Equality with Uninterpreted Functions and Memories (EUFM) [6]. In EUFM, word-level values are abstracted with terms (see Section IV) whose only relevant property is that of equality with other terms.…”

“…The formal verification is done with an automatic tool flow, consisting of: 1) the term-level symbolic simulator TLSim [32], used to symbolically simulate the implementation and specification, and produce an EUFM correctness formula; 2) the decision procedure EVC [32] that exploits Positive Equality and other optimizations to translate the EUFM correctness formula to an equivalent Boolean formula, which has to be a tautology in order for the implementation to be correct; and 3) an efficient SATchecker. This tool flow was used at Motorola [14] to formally verify a model of the M•CORE processor, and detected bugs.…”