Overview
ALU abstraction modeling is the selection of a precision level for modeling arithmetic-logic-unit behavior in a formal processor model. In the UCLID5 verification study of pipelined Y86-64 microprocessors, ALU operations were modeled at several abstraction levels, from an uninterpreted function to precise arithmetic and bit-vector operations. These ALU choices were combined with different word representations: uninterpreted terms, integers, or bit vectors. [C1]
The abstraction choices form a partial order: a model is more abstract when it permits a wider range of behaviors. Uninterpreted data types are more abstract than concrete data types, and uninterpreted functions are more abstract than precise mathematical functions. The evidence also treats integer and bit-vector word models as incomparable: some arithmetic behavior can be related by modulo mapping, but equality, ordering, and bit-wise logical operations are not preserved in the same way. [C2]
ALU abstraction levels
The cited work considered the following ALU models. [C3]
Uninterpreted ALU
The most abstract ALU model defines the ALU as an uninterpreted function of an operation code and two word operands. In UCLID5-style pseudocode, the result is delegated to a base uninterpreted ALU function:
val = common.base_alufun(op, valA, valB);
This level was sufficient for verifying the STD, FULL, STALL, and LF pipeline variants. [C4]
ALU Add zero
The ALU Add zero model partially interprets addition only for the identity case x + 0 = x; otherwise, ALU behavior remains uninterpreted. The model is expressed by returning valA when the operation is ALUADD and the second operand is zero, and otherwise calling the uninterpreted base ALU function. [C5]
This abstraction was required for the NT and BTFNT pipeline variants, where the ALU is used to pass the branch target through the execute stage when a branch is taken. [C5]
ALU Increment/Decrement
The ALU Increment/Decrement model attempts to capture the multi-application property (x + 8) + -8 = x. Because this property concerns multiple applications of the ALU function, the cited work expresses it as a UCLID5 axiom over the otherwise uninterpreted ALU function rather than as a direct procedure definition. [C6]
This property was required for the SW pipeline variant because of how that variant manipulates the stack pointer for the popq instruction. However, the SMT solver could not make effective use of the axiom, and verification at this abstraction level was unsuccessful. [C6]
ALU Add
The ALU Add model fully interprets ALU behavior for addition and leaves other operations uninterpreted. It can be used only when words are modeled as integers or bit vectors. This abstraction sufficed for verifying all pipeline variants in the cited study. [C7]
Precise ALU
The Precise model represents the ALU as precisely as UCLID5 permits. Addition and subtraction are modeled precisely; bit-wise logical operations are modeled precisely when bit-vector words are used. The model also precisely represents program-counter incrementing and the comparison operation used in the BTFNT variant to compare the branch target with the current program counter. [C8]
The precise model was used to test UCLID5 behavior when supplied with more precision than was required for the verification task. [C8]
Interaction with data representation
The ALU abstraction is combined with the representation of data words. The cited work considers three word representations:
- U: uninterpreted terms;
- I: integers;
- B: bit vectors. [C1]
In the abstraction diagram described by the evidence, each vertical chain corresponds to ALU precision, ranging from uninterpreted functions at the most abstract level to precise ALU modeling at the least abstract level. The two most precise ALU models apply only to integer and bit-vector data. [C9]
Although uninterpreted data was theoretically sufficient for all variants, the SW variant required integer or bit-vector data with precise addition in practice, because the SMT solver could not effectively use the increment/decrement axiom. [C10]
Role in the execute stage
In the pipeline model, the execute-stage procedure computes ALU operands and the ALU function, calls alu_operate, and then conditionally updates condition codes using cc_fun. The cited UCLID5 execute-stage sketch includes:
aluA = gen_aluA();
aluB = gen_aluB();
alufun = gen_alufun();
call (e_valE) = alu_operate(alufun, aluA, aluB);
set_cc = gen_set_cc();
if (set_cc) {
cc = common.cc_fun(alufun, aluA, aluB);
}
This shows that the chosen ALU abstraction directly affects the modeled execute-stage result e_valE, and, when condition codes are set, the inputs to condition-code computation. [C11]
Modeling implication
The central modeling tradeoff is between abstraction and required semantic precision. More abstract ALU models can simplify verification by allowing fewer concrete arithmetic commitments, but some pipeline behaviors require specific arithmetic facts such as addition identity, stack-pointer increment/decrement cancellation, or fully interpreted addition. When solver support for an axiom is ineffective, a less abstract model using integer or bit-vector arithmetic may be necessary. [C2] [C6] [C10]