DOCSLIB.ORG

Software Verification with ACL2

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Software Verification with ACL2 Software Verification with ACL2 Francisco Palomo Lozano [email protected] Software Verification and Validation Department of Computer Science Introduction Summary 1 Introduction 2 First Steps 3 Atoms and Lists 4 Sorted Lists 5 Sorting by Insertion 6 Sorting by Merging 7 Parallelism Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 3 / 39 Introduction What is ACL2? 1 AC omputational Logic for an Applicative Common Lisp 2 ACL2 is three things under the same name A pure functional programming language A computational logic formalizing this language An automated reasoning system for formal verification 3 ACL2 is regarded as an incarnation of McCarthy’s dream A dream came true Reasoning about Lisp functions 4 Landmarks Successor of NQTHM, the Boyer-Moore theorem prover Developed by Moore and Kaufmann for more than 20 years ACM Software System Award 2005 Annual conferences Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 4 / 39 Introduction Where has ACL2 been used?I 1996 Motorola CAP DSP 20-bit, used in radio, 1024-point complex FFT in 131 µs Verification of microcode DSP programs 1998 IBM 4758 PCI Cryptographic Coprocessor Used in ATMs Security model and formal analysis of bootstrapping code 2000 AMD Athlon Microprocessor Floating-point addition, subtraction, multiplication, and division Floating-point square root 2002 IBM Power4 Microprocessor Floating-point division and square-root algorithms 2005 Rockwell Collins AAMP7G Cryptoprocessor NSA MILS certified, used by the DoD in military avionics Verification of security policies implemented by microcode Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 5 / 39 Introduction Where has ACL2 been used?II 2008 Freescale Semiconductor Inc. Flash memory verification 2010 Centaur VIA Nano Microprocessor Low-power, used in netbooks, a direct competitor of Intel Atom Verification of instructions in the Media Unit Floating-point addition, subtraction and comparison Integer and floating-point conversions Integer multiplication 2011 AMD Llano Microprocessor Next-generation AMD mobile processor Integer division Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 6 / 39 Introduction Why so much interest in hardware verification? 1994 Intel Pentium FDIV error 4195835 1.33382044914 1.33373906890 buggy 3145727 ¼ 6Æ Î Dismissed as «not serious» when uncovered Defective chips had to be eventually recalled Intel recognised 475 000 000 USD in losses Moreover, the company’s prestige was damaged Intel Pentium jokes became famous Q: Know how the Republicans can cut taxes and pay the deficit at the same time? A: Their spreadsheet runs on a Pentium computer. Intel shares fell 5% in a week in December 1994 1997 Intel Pentium F00F error F00F C7C8 [lock cmpxchg8b eax] Processor hang! ¡! Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 7 / 39 Introduction Sure they learnt the lesson, didn’t they? 2007 Intel Core 2 Specification Update http://download.intel.com/design/processor/specupdt/313279.pdf Intel lists 129 design errors OpenBSD identified more than 20 of them as unfixable A few of them, for which no workaround exist, seem exploitable Reflections 1 These problems are not exclusive to Intel 2 It is likely that any complex hardware is buggy 3 As hardware gets more complex it resembles software 4 It has to do with the sheer complexity of new products 5 It has to do with processes and time-to-market pressure 6 It has to do with the status of our current tools and technology Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 8 / 39 Introduction What about software verification? 1 Nowadays the line between hardware and software is thinning Algorithm Microcode ! Algorithm HDL/RTL NDL Silicon ! ! ! 2 Real Lisp code can be verified and executed with ACL2 ACL2 code is directly executable in its host Lisp system ACL2 is a pure subset of Common Lisp with some extensions 3 Custom languages can be embedded or translated into ACL2 Java Bytecode ACL2 ! ! Several models of the JVM are available for ACL2 In general, this approach requires considerable effort The first silicon JVM was produced in 1997 by Rockwell Collins 4 Algorithms can be verified with ACL2 Complex algorithms are usually hard to test or validate Being able to execute algorithms modelled in ACL2 is a plus Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 9 / 39 First Steps Summary 1 Introduction 2 First Steps 3 Atoms and Lists 4 Sorted Lists 5 Sorting by Insertion 6 Sorting by Merging 7 Parallelism Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 10 / 39 First Steps ACL2 features 1 ACL2 is a pure functional language Reasoning is easier on pure functional languages Function execution only depends on its arguments 2 ACL2 is a logic of total recursive functions Function termination must be proven Even on inputs outside the intended domain 3 ACL2 functions can be annotated with guards 4 ACL2 functions may abort when executed like a program Guard violation Resource exhaustion, as stack overflow or memory full 5 ACL2 functions are Lisp functions 6 The reciprocal is not always true Lisp functions may not terminate Lisp functions can depend on state and even modify it Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 11 / 39 First Steps Your first steps in ACL2 1 Installing ACL2 Debian and Ubuntu sudo apt-get install acl2 Detailed instructions available for other systems http://www.cs.utexas.edu/users/moore/acl2 2 Executing ACL2 and running your first program acl2 ... ACL2 !> (defun f (n) (if (zp n) 1 (* n (f (- n 1))))) ... ACL2 !> (f 32) 263130836933693530167218012160000000 3 Finishing the ACL2 session ACL2 !> (exit) Also C-d, (quit) or (good-bye) Î Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 12 / 39 First Steps Development in ACL2 1 You do not usually work at the ACL2 prompt Typically you use an editor and save to .lisp files However the ACL2 command line is useful for other tasks 2 ACL2 .lisp files can be Fed into ACL2 acl2 < file.lisp Î Loaded inside ACL2 (ld "file.lisp") Î Converted in books and included (include-book "file") Î 3 Development environments Emacs with a shell buffer ACL2 Sedan http://acl2s.ccs.neu.edu Î DrACuLa http://www.ccs.neu.edu/home/cce/acl2 Î 4 Dual mode of operation It can be used as an interpreter for rapid development Code can be compiled for efficient execution when desired Compiled and interpreted code can be used together at will Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 13 / 39 First Steps The Lisp host system 1 ACL2 runs on top of a Lisp host system 2 CCL, SBCL, GCL, Allegro CL, CLISP, and CMUCL supported 3 The ACL2 command loop is a typical Lisp read-eval-print loop Exiting to the host Lisp system ACL2 !> :q Exiting the ACL2 read-eval-print loop. To re-enter, execute (LP). ACL2> Resuming from a correctable error or interruption ACL2 !> ^C User C-c interruption Î Correctable error: Console interrupt. ... ACL2[RAW LISP]>> :q ACL2 !> Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 14 / 39 First Steps Dissecting your first program 1 The mathematical factorial function f (0) 1 Æ f (n) nf (n 1) if n 0 Æ ¡ È 2 The ACL2 factorial function (defun f (n) function name and arguments Î (if (zp n) conditional expression Î 1 then branch value Î (* n (f (- n 1))))) else branch value Î A fundamental difference The mathematical function is implicitly defined on N The ACL2 function is defined on the universe of ACL2 objects Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 15 / 39 First Steps Expression evaluation 1 Lisp syntax ACL2!> (+ (* 5 (- 4 1)) 1) prefix notation 16 Î 2 Guards ACL2 !> (/ 1 0) ACL2 Error in TOP-LEVEL: The guard for the function call (UNARY-/ X), which is (AND (ACL2-NUMBERP X) (NOT (EQUAL X 0))), is violated by the arguments in the call (/ 0) ... ACL2 !> (set-guard-checking :none) ... ACL2 > (/ 1 0) all functions are total 0 Î Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 16 / 39 First Steps Guarded and unguarded evaluation 1 Some functions have attached a guard Guards warns about evaluations outside the intended domain Guards are checked during evaluation by default Guards are not used when proving properties 2 No guard was explicitly attached to f but . ACL2 !> (f -1) ACL2 Error in TOP-LEVEL: The guard for the function call (ZP X), which is (AND (INTEGERP X) (<= 0 X)), is violated by the arguments in the call (ZP -1) ... ACL2 !> (set-guard-checking :none) ... ACL2 > (f -1) (zp -1) is t 1 Î Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 17 / 39 First Steps Your first formal verification 1 Another function for computing factorials (defun g (n p) (if (zp n) p (g (- n 1) (* p n)))) (defun f* (n) (g n 1)) 2 Function g is just a certain generalisation of f (defthm g-generalises-f (implies (and (integerp n) (integerp p)) (equal (g n p) (* p (f n))))) 3 Functions f* and f are simply equivalent (defthm equivalence-of-f*-and-f (equal (f* n) (f n))) Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 18 / 39 Atoms and Lists Summary 1 Introduction 2 First Steps 3 Atoms and Lists 4 Sorted Lists 5 Sorting by Insertion 6 Sorting by Merging 7 Parallelism Francisco Palomo (UCA) Software Verification with ACL2 Version 1.1 19 / 39 Atoms and Lists Common data types 1 Atoms predicate atom Î Form the basic components of pairs and lists Include booleans, characters, strings, numbers and symbols 2 Pairs or conses predicate consp ACL2 !> (consÎ 1 2) (1 .
Load more

Recommended publications
  • Formal Verification of Eccs for Memories Using ACL2
    Journal of Electronic Testing (2020) 36:643–663 https://doi.org/10.1007/s10836-020-05904-2 Formal Verification of ECCs for Memories Using ACL2 Mahum Naseer1 · Waqar Ahmad1 · Osman Hasan1 Received: 12 April 2020 / Accepted: 2 September 2020 / Published online: 26 September 2020 © Springer Science+Business Media, LLC, part of Springer Nature 2020 Abstract Due to the ever-increasing toll of soft errors in memories, Error Correction Codes (ECCs) like Hamming and Reed-Solomon Codes have been used to protect data in memories, in applications ranging from space to terresterial work stations. In past seven decades, most of the research has focused on providing better ECC strategies for data integrity in memories, but the same pace research efforts have not been made to develop better verification methodologies for the newer ECCs. As the memory sizes keep increasing, exhaustive simulation-based testing of ECCs is no longer practical. Hence, formal verification, particularly theorem proving, provides an efficient, yet scarcely explored, alternative for ECC verification. We propose a framework, with extensible libraries, for the formal verification of ECCs using the ACL2 theorem prover. The framework is easy to use and particularly targets the needs of formally verified ECCs in memories. We also demonstrate the usefulness of the proposed framework by verifying two of the most commonly used ECCs, i.e., Hamming and Convolutional codes. To illustrate that the ECCs verified using our formal framework are practically reliable, we utilized a formal record- based memory model to formally verify that the inherent properties of the ECCs like hamming distance, codeword decoding, and error detection/correction remain consistent even when the ECC is implemented on the memory.
    [Show full text]
  • Creating Formally Verified Components for Layered
    Creating Formally Verified Components for Layered Assurance with an LLVM to ACL2 Translator∗ y z David S. Hardin Jedidiah R. McClurg Jennifer A. Davis Advanced Technology Center Department of Computer Advanced Technology Center Rockwell Collins Science Rockwell Collins Cedar Rapids, IA, USA University of Colorado Cedar Rapids, IA, USA [email protected] Boulder, CO, USA [email protected] [email protected] ABSTRACT Keywords In our current work, we need to create a library of formally Formal verification, Theorem proving, ACL2, LLVM verified software component models from code that has been compiled (or decompiled) using the Low-Level Virtual Ma- 1. INTRODUCTION chine (LLVM) intermediate form; these components, in turn, are to be assembled into subsystems whose top-level assur- ance relies on the assurance of the individual components. \Remember that all models are wrong; the Thus, we have undertaken a project to build a translator practical question is how wrong do they have to from LLVM to the applicative subset of Common Lisp ac- be to not be useful." [2] { George Box, British cepted by the ACL2 theorem prover. Our translator pro- Statistician duces executable ACL2 specifications featuring tail recur- sion, as well as in-place updates via ACL2's single-threaded Layered assurance for software often requires the creation object (stobj) mechanism. This allows us to efficiently sup- of a library of assured software component models, start- port validation of our models by executing production tests ing with code that lacks a formal pedigree. These assured for the original artifacts against those models. Unfortu- components can then be assembled into subsystems whose nately, features that make a formal model executable are of- top-level assurance relies on the assurance of the individual ten at odds with efficient reasoning.
    [Show full text]
  • Checking Nuprl Proofs in ACL2: a Progress Report
    Checking Nuprl Proofs in ACL2: A Progress Report James L. Caldwell? and John Cowles? Department of Computer Science, University of Wyoming, Laramie Wyoming {jlc,cowles}@cs.uwyo.edu Abstract. Stipulations on the correctness of proofs produced in a for- mal system include that the axioms and proof rules are the intended ones and that the proof has been properly constructed (i.e. it is a correct in- stantiation of the axioms and proof rules.) In software implementations of formal systems, correctness additionally depends both on the correct- ness of the program implementing the system and on the hardware it is executed on. Once we implement a system in software and execute it on a computer, we have moved from the abstract world of mathematics into the physical world; absolute correctness can never be achieved here. We can only strive to increase our confidence that the system is producing correct results. In the process of creating proofs, foundational systems like Nuprl construct formal proof objects. These proof objects can be independently checked to verify they are correct instantiations of the axioms and proof rules thereby increasing confidence that the putative proof object faithfully represents a proof in the formal system. Note that this kind of proof checking does not address issues related to the models of the proof system, it simply provides more evidence that a proof has been correctly constructed. The Nuprl implementation consists of more than 100K lines of LISP and tactic code implemented in ML. Although parts of the system consist of legacy codes going as far back as the late 1970’s (Edinburgh LCF), and even though the Nuprl system has been extensively used since 1986 in formalizing a significant body of mathe- matics, the chances that the implementation is correct are slim.
    [Show full text]
  • How Lisp Systems Look Different in Proceedings of European Conference on Software Maintenance and Reengineering (CSMR 2008)
    How Lisp Systems Look Different In Proceedings of European Conference on Software Maintenance and Reengineering (CSMR 2008) Adrian Dozsa Tudor Gˆırba Radu Marinescu Politehnica University of Timis¸oara University of Berne Politehnica University of Timis¸oara Romania Switzerland Romania [email protected] [email protected] [email protected] Abstract rently used in a variety of domains, like bio-informatics (BioBike), data mining (PEPITe), knowledge-based en- Many reverse engineering approaches have been devel- gineering (Cycorp or Genworks), video games (Naughty oped to analyze software systems written in different lan- Dog), flight scheduling (ITA Software), natural language guages like C/C++ or Java. These approaches typically processing (SRI International), CAD (ICAD or OneSpace), rely on a meta-model, that is either specific for the language financial applications (American Express), web program- at hand or language independent (e.g. UML). However, one ming (Yahoo! Store or reddit.com), telecom (AT&T, British language that was hardly addressed is Lisp. While at first Telecom Labs or France Telecom R&D), electronic design sight it can be accommodated by current language inde- automation (AMD or American Microsystems) or planning pendent meta-models, Lisp has some unique features (e.g. systems (NASA’s Mars Pathfinder spacecraft mission) [16]. macros, CLOS entities) that are crucial for reverse engi- neering Lisp systems. In this paper we propose a suite of Why Lisp is Different. In spite of its almost fifty-year new visualizations that reveal the special traits of the Lisp history, and of the fact that other programming languages language and thus help in understanding complex Lisp sys- borrowed concepts from it, Lisp still presents some unique tems.
    [Show full text]
  • Industrial Hardware and Software Verification with ACL2
    Industrial Hardware and Software Verification with rsta.royalsocietypublishing.org ACL2 1 1 Warren A. Hunt, Jr. , Matt Kaufmann , 1 2 Research J Strother Moore and Anna Slobodova 1 Department of Computer Science Article submitted to journal University of Texas at Austin e-mail: {hunt,kaufmann,moore}@cs.utexas.edu 2 Centaur Technology, Inc. Subject Areas: 7600-C N. Capital of Texas Hwy, Suite 300 xxxxx, xxxxx, xxxx Austin, TX 78731 Keywords: e-mail: [email protected] xxxx, xxxx, xxxx ACL2 has seen sustained industrial use since the mid 1990s. Companies that have used ACL2 Author for correspondence: regularly include AMD, Centaur Technology, IBM, J Strother Moore Intel, Kestrel Institute, Motorola/Freescale, Oracle, e-mail: [email protected] and Rockwell Collins. This paper focuses on how and why ACL2 is used in industry. ACL2 is well-suited to its industrial application to numerous software and hardware systems because it is an integrated programming/proof environment supporting a subset of the ANSI standard Common Lisp programming language. As a programming language ACL2 permits the coding of efficient and robust programs; as a prover ACL2 can be fully automatic but provides many features permitting domain-specific human- supplied guidance at various levels of abstraction. ACL2 specifications and models often serve as efficient execution engines for the modeled artifacts while permitting formal analysis and proof of properties. Crucially, ACL2 also provides support for the development and verification of other formal analysis tools. However, ACL2 did not find its way into industrial use merely because of its technical features. The core ACL2 user/development community has a shared vision of making mechanized verification routine when appropriate and has been committed to this vision for the quarter century since the Computational Logic, Inc., Verified Stack.
    [Show full text]
  • Accessible Formal Methods for Verified Parser Development
    2021 IEEE Symposium on Security and Privacy Workshops Accessible Formal Methods for Verified Parser Development Letitia W. Li, Greg Eakman Elias J. M. Garcia, Sam Atman FAST Labs, BAE Systems Special Circumstances Burlington, Massachusetts, USA Brussels, Belgium [email protected], [email protected] fejmg, [email protected] Abstract—Security flaws in Portable Document Format (PDF) in the field of another object may not have been yet parsed, readers may allow PDFs to conceal malware, exfiltrate in- and therefore we cannot check any of the attributes of the ref- formation, and execute malicious code. For a PDF reader to erenced object (such as its type, or even its existence). Instead, identify these flawed PDFs requires first parsing the document syntactically, and then analyzing the semantic properties or these semantic properties are checked after the first parsing of structure of the parse result. This paper presents a language- the document, whether within the parser or separately. theoretic and developer-accessible approach to PDF parsing and In the DARPA SafeDocs project, we address the insecurity validation using ACL2, a formal methods language and theorem of PDF readers/parsers with a Language-theoretic Security prover. We develop two related components, a PDF syntax parser approach by first defining a PDF grammar, and then de- and a semantic validator. The ACL2-based parser, verified using the theorem prover, supports verification of a high-performance veloping verified parsers to accept only well-formed input equivalent of itself or an existing PDF parser. The validator then according to that grammar [8]. In this paper, we propose an extends the existing parser by checking the semantic properties accessible formal methods approach in ACL2 for safe, secure, in the parse result.
    [Show full text]
  • Recent Enhancements to ACL2
    How Can I Do That with ACL2? Recent Enhancements to ACL2 Matt Kaufmann J Strother Moore Dept. of Computer Science, Dept. of Computer Science, University of Texas at Austin University of Texas at Austin [email protected] [email protected] The last several years have seen major enhancements to ACL2 functionality, largely driven by re- quests from its user community, including utilities now in common use such as make-event, mbe, and trust tags. In this paper we provide user-level summaries of some ACL2 enhancements intro- duced after the release of Version 3.5 (in May, 2009, at about the time of the 2009 ACL2 workshop) up through the release of Version 4.3 in July, 2011, roughly a couple of years later. Many of these features are not particularly well known yet, but most ACL2 users could take advantage of at least some of them. Some of the changes could affect existing proof efforts, such as a change that treats pairs of functions such as member and member-equal as the same function. 1 Introduction This paper discusses ACL2 enhancements made in ACL2 Versions 3.6 through 4.3, that is, during the 2+ years that have passed since Version 3.5 was released around the time of the preceding (2009) ACL2 workshop. These enhancements primarily concern programming, proof control, and system infrastruc- ture — as opposed to improved proof procedures, sophisticated logical extensions, and theoretical stud- ies. Readers from outside the ACL2 community — should there be any! — may find this pragmatic stance surprising. But ACL2’s total integration of programming, proof, and system issues is one of the reasons ACL2 finds industrial application and we believe that the research issues raised by our commit- ment to integration are at least as important as more conventional theorem proving work.
    [Show full text]
  • An ACL2 Tutorial
    An ACL2 Tutorial Matt Kaufmann and J Strother Moore Department of Computer Sciences, University of Texas at Austin, Taylor Hall 2.124, Austin, Texas 78712 {kaufmann,moore}@cs.utexas.edu Abstract. We describe a tutorial that demonstrates the use of the ACL2 theorem prover. We have three goals: to enable a motivated reader to start on a path towards effective use of ACL2; to provide ideas for other interactive theorem prover projects; and to elicit feedback on how we might incorporate features of other proof tools into ACL2. 1 Introduction The name “ACL2” [14] stands for “A Computational Logic for Applicative Com- mon Lisp” and refers to a functional programming language, a formal logic, and a mechanized proof system. It was developed by the authors of this paper, with early contributions by Bob Boyer, and is the latest in the line of “Boyer-Moore” theorem provers [2, 3] starting with the 1973 Edinburgh Pure Lisp Prover’ [1]. The ACL2 logic and programming language are first-order and admit total recursive function definitions, and are based on a non-trivial purely functional subset of the Common Lisp [20] programming language. Thus, ACL2 can be built on many Lisp platforms. We have extended this subset in some important ways, in no small part because ACL2 is written primarily in itself! Extensions include additional primitives; a program mode that avoids proof obligations; a state with applicative semantics supporting file I/O and global variables; and applicative property lists and arrays with efficient under-the-hood implementations. This extended abstract describes a one-hour tutorial, not presented here, but accessible from the “demos” link on the ACL2 home page [14].
    [Show full text]
  • ACL2 in Drscheme
    ACL2 in DrScheme Dale Vaillancourt Rex Page Matthias Felleisen Northeastern University School of Computer Science Northeastern University Boston, MA 02115 University of Oklahoma Boston, MA 02115 [email protected] 200 Felgar St, Room 119 [email protected] Norman, OK 73019-6151 [email protected] ABSTRACT 1. TEACHING FORMAL METHODS Teaching undergraduates to develop software in a formal Over the past four years, the second author has designed framework such as ACL2 poses two immediate challenges. and implemented a senior-level course sequence on the con- First, students typically do not know applicative program- struction of sound software at Oklahoma University [16]. The ming and are often unfamiliar with ACL2’s syntax. Second, courses employ ACL2 as a programming language and the- for motivational reasons, students prefer to work on projects orem prover. The first semester course teaches applicative that involve designing interactive, graphical applications. programming and the basics of theorem proving. The second In this paper, we present DRACULA, a pedagogic pro- course focuses on a single project, continuing the training in gramming environment that partially solves these problems. formal methods in this larger context and also developing The environment adds a subset of Applicative Common Lisp software management skills. to DRSCHEME, an integrated programming environment for Both students and external industry observers consider the Scheme. DRACULA thus inherits DRSCHEME’s pedagogic course a success. Students give the course high scores in capabilities, especially its treatment of syntax and run-time evaluations, and industrial observers praise how much stu- errors. Further, DRACULA also comes with a library for dents learn about managing a large project and producing programming interactive, graphical games.
    [Show full text]
  • Iteration in ACL2
    Iteration in ACL2 Matt Kaufmann and J Strother Moore Department of Computer Science The University of Texas at Austin, Austin, TX, USA {kaufmann,moore}@cs.utexas.edu Iterative algorithms are traditionally expressed in ACL2 using recursion. On the other hand, Common Lisp provides a construct, loop, which — like most programming languages — provides direct support for iteration. We describe an ACL2 analogue loop$ of loop that supports efficient ACL2 programming and reasoning with iteration. 1 Introduction Recursion is a natural way to define notions in an equational logic. But for programming, iteration is often more natural and concise than recursion. This paper introduces an ACL2 iteration construct, loop$. We give an overview of its usage in programming and reasoning, and we touch on some key aspects of its implementation. Those who want more complete user-level documentation are welcome to see :DOC loop$ 1, and those who want more implementation details may visit Lisp comments in the ACL2 sources, in particular the “Essay on Loop$” and the “Essay on Evaluation of Apply$ and Loop$ Calls During Proofs”. The rest of this introduction illustrates the basics of loop$ and then mentions some related prior work. Next, Section 2 outlines the syntax of loop$ expressions. Section 3 provides necessary back- ground on apply$ and especially warrants. Then Section 4 gives semantics to loop$ expressions by translating them into the logic, which provides background for the discussion of reasoning about loop$ in Section 5. Section 6 discusses evaluation of calls of loop$, including considerations involving guards. We conclude by considering possible future enhancements to loop$.
    [Show full text]
  • Formal Verification of Arithmetic
    Formal Verification of Arithmetic RTL: Translating Verilog to C++ to ACL2 David M. Russinoff [email protected] We present a methodology for formal verification of arithmetic RTL designs that combines sequential logic equivalence checking with interactive theorem proving. An intermediate model of a Verilog module is hand-coded in Restricted Algorithmic C (RAC), a primitive subset of C augmented by the integer and fixed-point register class templates of Algorithmic C. The model is designed to be as abstract and compact as possible, but sufficiently faithful to the RTL to allow efficient equivalence checking with a commercial tool. It is then automatically translated to the logic of ACL2, enabling a mechanically checked proof of correctness with respect to a formal architectural specification. In this paper, we describe the RAC language, the translation process, and some techniques that facilitate formal analysis of the resulting ACL2 code. 1 Introduction A prerequisite for applying interactive theorem proving to arithmetic circuit verification is a reliable means of converting an RTL design to a semantically equivalent representation in a formal logic. Within the ACL2 community, this has been achieved in at least two industrial settings by mechanical translation from Verilog directly to the ACL2 logic. At Advanced Micro Devices, our approach was to generate a large clique of mutually recursive executable ACL2 functions in correspondence with the signals of a Verilog module [9], a scheme commonly known as “shallow embedding”. The Centaur Technology verification team has followed a different path [3], converting an RTL design to a netlist of S-expressions to be executed by an interpreter coded in ACL2, i.e., a “deep embedding” of the design.
    [Show full text]
  • Formal Compiler Verification with ACL2
    Formal Compiler Verification with ACL2 BAKKALAUREATSARBEIT Angewandte Systemtheorie zur Erlangung des akademischen Grades Bakkalaureus/Bakkalaurea der technischen Wissenschaften in der Studienrichtung INFORMATIK Eingereicht von: Thomas Würthinger, 0256972 Angefertigt am: Institute for Formal Models and Verification Betreuung: Univ.-Prof. Dr. Armin Biere Dr. Carsten Sinz Linz, Juli 2006 1 Formal Compiler Verification with ACL2 Thomas Wurthinger¨ Abstract— This paper gives a short introduction to ACL2, a ACL2 uses a special syntax for function calls which is quite Lisp-like language used to make automatic proofs. ACL2 is used unfamiliar to C++ or Java programmers. After left parenthesis to prove the correctness of a compiler at source level. However the name of the function is written, followed by the arguments it is shown that source level verification is not enough to be sure to have a correct compiler. Even if a compiler is correct at separated by single space characters. At the end a closing right source level and passes the bootstrap test, it may be incorrect parenthesis is required. and produce wrong or even harmful output for a specific source Note that this function has no side effects. There exist no input. global variables and calling this function with a certain value Index Terms— Program compilers, Software verification and will always give the same result. validation, LISP, Functional programming, Theorem proving B. List datastructures I. INTRODUCTION One very special thing of Lisp is how data is stored. There OMPILERS are written very often without formally are only two types of data: C proving their correctness. For compilers of programming • Atoms: This is the smallest piece of data in Lisp.
    [Show full text]