Verification Using Uninterpreted Functions and Finite Instantiations

One approach to address the state explosion problem in verification of microprocessors with wide datapaths is to model variables as integers and datapath functions as uninterpreted ones. Verification then proceeds by either symbolically simulating this abstract model, or creating a small finite instantiation which contains all possible behaviors. In this paper, we first prove that the reachability problem for models with uninterpreted functions and predicates only of the form x=y, where both x and y are integer variables, is undecidable. However, such predicates are generally only needed in the property being checked and not in the model. For properties involving predicates of the forms x=term and x=y, we provide complete and partial verification techniques using finite instantiations respectively. Applications of these result to the verification of the control circuitry of superscalar microprocessors are provided, where one can verify various correctness properties using models with one or a few bit integers.