Warren A. Hunt's research while affiliated with University of Texas at Austin and other places

... Approaches based on satisfiability checking (SAT) do not scale [3]. Recently, progress has been made using theorem provers [39]. However, the multipliers have to be given as hierarchical SVL netlists, which rely on preservation of information of the circuits. ...

... Other formal techniques in the literature range from verification of hazardfreedom (e.g., [4]) and deadlock-freedom (e.g., [5]), to more general notions of equivalence between gate level implementations, handshaking-level specifications [6][7][8][9], and abstract asynchronous communication primitives [10]. Several researchers focus on verifying general properties of asynchronous designs using model checkers [11][12][13] and proof assistants, including ACL2 [14,15]. This paper makes several key contributions. ...

... We use ACL2 [1], [2], [3] to model self-timed circuits at the gate level and to verify that those models exhibit specified functional properties. We build on our previous work [4] that demonstrated a hierarchical approach to support efficient, scalable proof, including support for substitution of functionally equivalent submodules without the need to rework proofs. In this paper we extend that methodology to circuits that may be parameterized by data width, contain loops, and/or provide non-deterministic outputs. ...

... We have chosen the link-joint model as the basis for our ACL2 formalization of self-timed circuits and systems. That model, originally proposed by Roncken et al. [5], [6], is a universal generalization for a number of self-timed circuit models (e.g., Click [7], Mousetrap [8], Micropipeline [9], and GasP [10]). The link-joint model of self-timing manages communication locally via links on an individual joint-to-joint basis. ...

... Unrolling the circuit to capture its behavior, in this case, is not straightforward. Formal analysis of such fully asynchronous circuits is a topic of ongoing research [20] and outside the scope of this paper. ...

... There is a large body of work in software verification with ACL2, where Moore stresses the fact that even hardware verification is software verification in ACL2 as it reduces to the verification of Common Lisp functions [141]. Hunt et al emphasizes that the success of using ACL2 in verification comes from the fact that the user base is mostly industrial and cohesive, and the goal of the project is to make hardware/software verification practical [99]. In this paper, its weakness is reported as it is incovenient as a scripting language, some parts are inefficient, and that it does not have a GUI, but not the lack of strong typing or explicit quantifiers, partial or higher order functions. ...

... The associated DRAT format [55] combines clause addition based on RAT steps and clause deletion. Independent checking tools can validate proofs in the DRAT format; they have been used to check the results of the SAT competitions since 2014 [55] and in industry [20]. Enriching DRAT proofs with hints is the main technique for developing efficient verified proof checkers, e.g., existing verified checkers use the enriched proof formats LRAT [10] and GRAT [39]. ...

... Independent checking tools can validate proofs in the DRAT format; they have been used to check the results of the SAT competitions since 2014 [55] and in industry [20]. Enriching DRAT proofs with hints is the main technique for developing efficient verified proof checkers, e.g., existing verified checkers use the enriched proof formats LRAT [10] and GRAT [39]. ...

... Previous work has developed hand-written sequential semantics for some aspects of address translation in Arm [58,60,59,61,44,38,41] and x86 [34,35,29,63], but these are at best lightly validated formalisations, and there is no well-validated relaxed-memory concurrency semantics of virtual memory. In the absence of that (and of proof techniques above it), previous OS and hypervisor verification work, e.g. on seL4, CertiKOS, KCore, Hyper-V, the PROSPER hypervisor, and SeKVM [25,40,37,44,11,38,43,62] has had to make major simplifying assumptions, either assuming correctness of TLB management and a single-threaded setting (seL4), or assuming sequentially consistent concurrency with one of those hand-written sequential semantics, or assuming an extended notion of data-race-freedom (we return to the related work in §9). ...

... While formal verification of solvers is typically impractical, trust in a solver's output can be established by having it generate a proof trace that can be externally validated. This is already standard in SAT solving with the DRAT proof system [39], for which even formally verified checkers are available [15]. A key requirement for standard proof formats like DRAT is that they simulate all current and emerging proof techniques. ...