The formal verification of generic interpreters

Verification holds great promise for increasing the trustworthiness of computer systems. Before this promise is realized however, verification must become an engineering activity instead of a research activity. An engineering approach provides a methodology for specification and verification. This dissertation contains results that provide a methodological approach to microprocessor verification. We present a hierarchical decomposition strategy for specifying microprocessors. The decomposition follows traditional abstraction levels used by microprocessor designers. We show how the explicit representation of these abstraction levels in the specification can lead to an order of magnitude reduction in the number of long, difficult cases in a microprocessor verification. The dissertation also develops a theory of interpreters that can be used to model microprocessor behavior. The generic interpreter theory abstracts away the details of instruction functionality, leaving a general model of what an interpreter does. The interpreter theory has been formalized using generic theories in a verification system called HOL for use in specifying and verifying microprocessors. The use of generic theories for formalizing the model plays an important role in our methodological approach to microprocessor specification and verification. The generic interpreter theory formally defines an interpreter and proves a correctness theorem for the generic model stating what it means, in general, for an interpreter to be correctly implemented. The generic interpreter theory provides a methodology for verifying microprocessors: (1) The generic interpreter theory clearly states exactly what definitions need to be made to specify a microprocessor. (2) The generic interpreter theory also says exactly which lemmas must be proven to verify that the specification is correctly implemented. The dissertation provides a detailed example, the verification of correctness for a microprocessor called AVM-1. The architecture of AVM-1 provides a RISC-like instruction set operating on a register file with 32 registers. The implementation is microcoded. The example is used to illustrate the utility of hierarchical decomposition and the generic interpreter theory.