2168156
Combining theorem proving and trajectory evaluation in an industrial environment
We describe the verification of the IM: a large, complex (12000 gates and 1100 latches) circuit that detects and marks the boundaries between Intel architecture (IA-32) instructions. We verified a gate-level model of the IM against an implementation-independent specification of IA-32 instruction lengths. We used theorem proving to to derive 56 model-checking runs and to verify that the model-checking runs imply that the IM meets the specification for all possible sequences of IA-32 instructions. Our verification discovered eight previously unknown bugs.
5421455
Self-Consistency Checking
We introduce the notion of self-consistency checking, a new methodology for applying formal methods in the debugging process. Intuitively, self-consistency checks functional consistency of a circuit in two different modes or environments. Self-consistency can (1) simplify property verification and (2) enable the use of symbolic simulation in the absence of a concrete specification. We present a correctness model for property verification with self-consistency checking and the formal framework for the technique. Finally, we provide illustrative examples and partial verification results using self-consistency checking on circuits with many thousands of latches.
85258
Reducing Manual Abstraction in Formal Verification of Out-of-Order Execution
Several methods have recently been proposed for verifying processors with out-of-order execution. These methods use intermediate abstractions to decompose the verification process into smaller steps. Unfortunately, the process of manually creating intermediate abstractions is very laborious. We present an approach that dramatically reduces the need for an intermediate abstraction, so that only the scheduling logic of the implementation is abstracted. After the abstraction, we apply an enhanced incremental-flushing approach to verify the remaining circuitry by comparing the processor description against itself in a slightly simpler configuration. By induction, we demonstrate that any reachable configuration is equivalent to the simplest possible configuration. Finally, we prove correctness on the simplest configuration. The approach is illustrated with a simple example of an out-of-order execution core.
16718437
Practical Formal Verification in Microprocessor Design
Practical application of formal methods requires more than advanced technology and tools; it requires an appropriate methodology. A verification methodology for data-path-dominated hardware combines model checking and theorem proving in a customizable framework. This methodology has been effective in large-scale industrial trials, including verification of an IEEE-compliant floating-point adder.
16794414
A Framework for Microprocessor Correctness Statements
Most verifications of out-of-order microprocessors compare state-machine-based implementations and specifications, where the specification is based on the instruction-set architecture. The different efforts use a variety of correctness statements, implementations, and verification approaches. We present a framework for classifying correctness statements about safety that is independent of implementation representation and verification approach. We characterize the relationships between the different statements and illustrate how existing and classical approaches fit within this framework.
14277112
A Methodology for Large-Scale Hardware Verification
We present a formal verification methodology for datapath-dominated hardware. This provides a systematic but flexible framework within which to organize the activities undertaken in large-scale verification efforts and to structure the associated code and proof-script artifacts. The methodology deploys a combination of model checking and lightweight theorem proving in higher-order logic, tightly integrated within a general-purpose functional programming language that allows the framework to be easily customized and also serves as a specification language. We illustrate the methodology--which has has proved highly effective in large-scale industrial trials--with the verification of an IEEE-compliant, extended precision floating-point adder.
17471934
Designing a trace format for heap allocation events
Dynamic storage allocation continues to play an important role in the performance and correctness of systems ranging from user productivity software to high-performance servers. While algorithms for dynamic storage allocation have been studied for decades, much of the literature is based on measuring the performance of benchmark programs unrepresentative of many important allocation-intensive workloads. Furthermore, to date no standard has emerged or been proposed for publishing and exchanging representative allocation workloads. In this paper, we describe a preliminary design of a trace format for such workloads and investigate its effectiveness at representing large allocation traces. Our proposal allows for a flexible encoding of information in the trace to achieve greater compression. We evaluate our preliminary design in two dimensions. First, we measure how effective these encodings are at reducing trace size. Second we consider how a meta-level specification language could be used to describe such formats and to generate trace readers and writers automatically.
15205488
Query word deletion prediction
Web search query logs contain traces of users' search modifications. One strategy users employ is deleting terms, presumably to obtain greater coverage. It is useful to model and automate term deletion when arbitrary searches are conjunctively matched against a small hand constructed collection, such as a hand-built hierarchy, or collection of high-quality pages matched with key phrases. Queries with no matches can have words deleted till a match is obtained. We provide algorithms which perform substantially better than the baseline in predicting which word should be deleted from a reformulated query, for increasing query coverage in the context of web search on small high-quality collections.
31257323
Partitioning the edges of a graph
Abstract For any integer m (≥2), it is known that there are simple graphs of maximum valence m whose edges cannot be coloured with m colours in such a way that adjacent edges shall have different colours. We find those values of m and k for which it is true that every simple graph whose maximum valence does not exceed mk can be coloured with m colours in such a way that no colour appears more than k times at any vertex.
6883273
The Workshop Program at the Nineteenth National Conference on Artificial Intelligence
AAAI presented the AAAI-04 workshop program on July 25-26, 2004 in San Jose, California. This program included twelve workshops covering a wide range of topics in artificial intelligence. The titles of the workshops were as follows: (1) Adaptive Text Extraction and Mining; (2) Agent Organizations: Theory and Practice; (3) Anchoring Symbols to Sensor Data; (4) Challenges in Game AI; (5) Fielding Applications of Artificial Intelligence; (6) Forming and Maintaining Coalitions in Adaptive Multiagent Systems; (7) Intelligent Agent Architectures: Combining the Strengths of Software Engineering and Cognitive Systems; (8) Learning and Planning in Markov Processes--Advances and Challenges; (9) Semantic Web Personalization; (10) Sensor Networks; (11) Spatial and Temporal Reasoning; and (12) Supervisory Control of Learning and Adaptive Systems.
8968901
Birrell's distributed reference listing revisited
The Java RMI collector is arguably the most widely used distributed garbage collector. Its distributed reference listing algorithm was introduced by Birrell et al. in the context of Network Objects, where the description was informal and heavily biased toward implementation. In this article, we formalize this algorithm in an implementation-independent manner, which allows us to clarify weaknesses of the initial presentation. In particular, we discover cases critical to the correctness of the algorithm that were not accounted for by Birrell. We use our formalization to derive an invariant-based proof of correctness of the algorithm that avoids notoriously difficult temporal reasoning. Furthermore, we offer a novel graphical representation of the state transition diagram, which we use to provide intuitive explanations of the algorithm and to investigate its tolerance to faults in a systematic manner. Finally, we examine how the algorithm may be optimized, either by placing constraints on message channels or by tightening the coupling between the application program and distributed garbage collector.