We present an approach to modeling and verifying machine-code programs that exhibit non-determinism. Specifically, we add support for system calls to our formal, executable model of the user-level x86 instruction-set architecture (ISA). The resulting model, implemented in the ACL2 theorem-proving system, allows both formal analysis and efficient simulation of x86 machine-code programs; the logical mode characterizes an external environment to support reasoning about programs that interact with an operating system, and the execution mode directly queries the underlying operating system to support simulation. The execution mode of our x86 model is validated against both its logical mode and the real machine, providing test-based assurance that our model faithfully represents the semantics of an actual x86 processor. Our framework is the first that enables mechanical proofs of functional correctness of user-level x86 machine-code programs that make system calls. We demonstrate the capabilities of our model with the mechanical verification of a machine-code program, produced by the GCC compiler, that computes the number of characters, lines, and words in an input stream. Such reasoning is facilitated by our libraries of ACL2 lemmas that allow automated proofs of a program's memory-related properties.

Abstract We describe a method that permits the user of a mechanized mathematical logic to write elegant logical definitions while allowing sound and efficient execution. In particular, the features supporting this method allow the user to install, in a logically sound way, alternative executable counterparts for logically defined functions. These alternatives are often much more efficient than the logically equivalent terms they replace. These features have been implemented in the ACL2 theorem prover, and we discuss several applications of the features in ACL2.

A link between the ACL2 and HOL4 proof assistants is described. This allows each system to be deployed smoothly within a single formal development. Several applications are being considered: using ACL2's execution environment for simulating HOL models; using ACL2's proof automation to discharge HOL proof obligations; and using HOL to specify and verify properties of ACL2 functions that cannot easily be stated in the first-order ACL2 logic. Care has been taken to ensure sound translations between the logics supported by HOL and ACL2. The initial ACL2 theory has been defined inside HOL, so that it is possible to prove mechanically that first-order ACL2 functions on S-expressions correspond to higher-order functions operating on a variety of types. The translation between the two systems operates at the level of S-expressions and is intended to handle large hardware and software models

We report on the successful application of a mechanical theorem prover to the problem of verifying the division microcode program used on the AMD5/sub K/86 microprocessor. The division algorithm is an iterative shift and subtract type. It was implemented using floating point microcode instructions. As a consequence, the floating quotient digits have data dependent precision. This breaks the constraints of conventional SRT division theory. Hence, an important question was whether the algorithm still provided perfectly rounded results at 24, 53, or 64 bits. The mechanically checked proof of this assertion is the central topic of the paper. The proof was constructed in three steps. First, the divide microcode was translated into a formal intermediate language. Then, a manually created proof was transliterated into a series of formal assertions in the ACL2 dialect. After many expansions and modifications to the original proof, the theorem prover certified the assertion that the quotient will always be correctly rounded to the target precision.

We present our experiences with the formal verification of an automotivechip used to control the safety features in a car. We useda BDD based model checker in our work. We describe our verificationmethodology for verifying a very complicated property on arelatively large design. We also describe the bugs that were foundand present our views on how to make model checking an effectiveintegrated part of the design flow for complex hardware systems.

We describe a project in which the IBM/Motorola 60/spl times/ bus protocol was incrementally modeled at an abstract level in Verilog and verified using Motorola's Verdict model checker. The primary purpose of the modeling activity was to acquaint verification personnel with details of the 60/spl times/ bus protocol and to document specific properties of the 60/spl times/ bus that are necessary to guarantee compliance with hand-written protocol documentation. Our Verilog 60/spl times/ bus model documents the 60/spl times/ bus protocol for other Motorola business units.

ACL2 is a reimplemented extended version of R.S. Boyer and J.S. Moore's (1979; 1988) Nqthm and M. Kaufmann's (1988) Pc-Nqthm, intended for large scale verification projects. The paper deals primarily with how we scaled up Nqthm's logic to an industrial strength" programming language-namely, a large applicative subset of Common Lisp-while preserving the use of total functions within the logic. This makes it possible to run formal models efficiently while keeping the logic simple. We enumerate many other important features of ACL2 and we briefly summarize two industrial applications: a model of the Motorola CAP digital signal processing chip and the proof of the correctness of the kernel of the floating point division algorithm on the AMD5/sub K/86 microprocessor by Advanced Micro Devices, Inc.

Commercial design verification is a complex activity involving many abstraction levels (such as architectural, register transfer, gate, switch, circuit, fabrication), many different aspects of design (such as timing, speed, functional, power, reliability and manufacturability) and many different design styles (such as ASIC, full custom, semi-custom, memory, cores, and asynchronous). We present a representative design flow and methodology that is common to many commercial integrated circuit design environments and that concentrates on functional validation using informal verification (e.g., simulation, emulation and ATPG) and formal verification (e.g., logic checking and sequential verification).

This paper is a sequel to our earlier paper [2] entitled Saturation and simple extensions of models of Peano arithmetic. Among other things, we will answer some of the questions that were left open there. In §1 we consider the question of whether there are lofty models of PA which have no recursively saturated, simple extensions. We are still unable to answer this question; but we do show in that section that these models are precisely the lofty models which are not recursively saturated and which are κ-like for some regular κ. In §2 we use diagonal methods to produce minimal models of PA in which the standard cut is recursively definable, and other minimal models in which the standard cut is not recursively definable. In §3 we answer two questions from [2] by exhibiting countable models of PA which, in the terminology of this paper, are uniformly ω-lofty but not continuously ω-lofty and others which are continuously ω-lofty but not recursively saturated. We also construct a model (assuming ◇) which is not recursively saturated but every proper, simple cofinal extension of which is ℵ1-saturated. Finally, in §4 we answer another question from [2] by proving that for regular κ ≥ ℵ1; every κ-saturated model of PA has a κ-saturated proper, simple extension which is not κ+-saturated. Our notation and terminology are quite standard. Anything unfamiliar to the reader and not adequately denned here is probably defined in §1 of [2]. All models considered are models of Peano arithmetic.

Abstract We consider extensions of Peano arithmetic suitable for doing some of nonstandard analysis, in which there is a predicate N(x) for an elementary initial segment, along with axiom schemes approximating ω1-saturation. We prove that such systems have the same proof-theoretic strength as their natural analogues in second order arithmetic. We close by presenting an even stronger extension of Peano arithmetic, which is equivalent to ZF for arithmetic statements.

Abstract Logics LF(M) are considered, in which M (“most”) is a new first-order quantifier whose interpretation depends on a given filter F of subsets of ω. It is proved that countable compactness and axiomatizability are each equivalent to the assertion that F is not of the form {(⋂F) ∪ X: ∣ω − X∣ < ω} with ∣ω − ⋂F∣ = ω. Moreover the set of validities of LF (M) and even of depends only on a few basic properties of F. Similar characterizations are given of the class of filters F for which LF (M) has the interpolation or Robinson properties. An omitting types theorem is also proved. These results sharpen the corresponding known theorems on weak models ( , where the collection q is allowed to vary. In addition they provide extensions of first-order logic which possess some nice properties, thus escaping from contradicting Lindström's Theorem [1969] only because satisfaction is not isomorphism-invariant (as it is tied to the filter F). However, Lindström's argument is applied to characterize the invariant sentences as just those of first-order logic.

The incompleteness of ZF set theory leads one to look for natural extensions of ZF in which one can prove statements independent of ZF which appear to be “true”. One approach has been to add large cardinal axioms. Or, one can investigate second-order expansions like Kelley-Morse class theory, KM. In this paper we look at a set theory ZF(aa), with an added quantifier aa which ranges over ordinals. The “aa” stands for “almost all”, and although we will consider interpretations in terms of the closed unbounded filter on a regular cardinal κ, we will consider other interpretations also. We start in §1 by giving the axioms for the theory ZF(aa) and presenting a completeness theorem which gives a model-theoretic definition of ZF(aa). In §2 we investigate set theory with a satisfaction predicate and interpret it in a fragment of ZF(aa). In §3 we generalize the methods of §2 to obtain a hierarchy of satisfaction predicates. We use these predicates to prove reflection theorems, as well as to prove the consistency of certain fragments of ZF(aa). Next, in §4 we discuss expandability of models of ZF to models of fragments of ZF(aa) and of Kelley-Morse. We conclude in §5 with a discussion of an extension ZF(aa) + DET of ZF(aa) in which the quantifier aa is self-dual.

Abstract Let be a well-founded model of ZFC whose class of ordinals has uncountable cofinality, such that has a Σn end extension for each n ∈ ω. It is shown in Theorem 1.1 that there is such a model which has no elementary end extension. In the process some interesting facts about topless end extensions (those with no least new ordinal) are uncovered, for example Theorem 2.1: If is a well-founded model of ZFC, such that has uncountable cofinality and has a topless Σ3 end extension, then has a topless elementary end extension and also a well-founded elementary end extension, and contains ordinals which are (in ) highly hyperinaccessible. In §3 related results are proved for κ-like models (κ any regular cardinal) which need not be well founded. As an application a soft proof is given of a theorem of Schmerl on the model-theoretic relation κ → λ. (The author has been informed that Silver had earlier, independently, found a similar unpublished proof of that theorem.) Also, a simpler proof is given of (a generalization of) a characterization by Keisler and Silver of the class of well-founded models which have a Σn end extension for each n ∈ ω. The case κ = ω1 is investigated more deeply in §4, where the problem solved by Theorem 1.1 is considered for non-well-founded models. In Theorems 4.1 and 4.4, ω1-like models of ZFC are constructed which have a Σn end extension for all n ∈ ω but have no elementary end extension. ω1-like models of ZFC which have no Σ3 end extension are produced in Theorem 4.2. The proof uses a notion of satisfaction class, which is also applied in the proof of Theorem 4.6: No model of ZFC has a definable end extension which satisfies ZFC. Finally, Theorem 5.1 generalizes results of Keisler and Morley, and Hutchinson, by asserting that every model of ZFC of countable cofinality has a topless elementary end extension. This contrasts with the rest of the paper, which shows that for well-founded models of uncountable cofinality and for κ-like models with κ regular, topless end extensions are much rarer than blunt end extensions.

For L a countable first-order language, let L(Q) be logic with the quantifier Qx which means “there exist uncountably many x”. We assume a little familiarity with Keisler's paper [8]. One finds there completeness and compactness theorems for L(Q), as well as an omitting types theorem: a syntactic condition is given for a consistent countable theory to have a model satisfying ∀x⋁Σ(x), where Σ is a countable set of formulas of L(Q). (See also Chang and Keisler [3] for the first-order omitting types theorem, due to Henkin and Orey.) An analogous theorem is proved in Barwise, Kaufmann, and Makkai [1] and in Kaufmann [6] for stationary logic. However, a more general theorem than just an anlaogue to Keisler's is proved there. Conditions are given which are sufficient for a theory T to have models satisfying sentences such as aas1aas2 … aasn⋁Σ(s1, … sn), ∀xaas ∨ Σ(x, s), and so forth. Bruce [2] had asked whether such a theorem can be proved for L(Q). with “aa” replaced by “Q*”, where Q* is ¬Q¬ (“for all but countably many”).