Architectural envelope model
ConceptAn architectural envelope model is a mathematically rigorous specification of a processor architecture that defines the full set of programmer-observable behaviours permitted by the architecture, independent of any particular microarchitectural implementation. It integrates a concurrency model with an instruction-set architecture (ISA) model to serve as a precise, executable reference and test oracle for hardware and software development, particularly for weakly consistent multiprocessors such as IBM POWER and ARM.
First seen 8/11/2026
Last seen 8/11/2026
Evidence 5 chunks
Wiki v1
WIKI
Architectural envelope model
Definition
An architectural envelope model is a formal specification of a processor architecture that precisely defines the entire range of programmer-observable behaviours allowed by that architecture, for arbitrary code, without committing to any particular microarchitectural implementation choices [1][2].
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
1 connections An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors ← introduces 100% 2e
The paper introduces a precise architectural envelope model integrating concurrency and ISA.
CITATIONS
9 sources9 citations — click to expand
[1] An architectural envelope model is a precise formal specification that defines the full range of programmer-observable behaviours allowed by an architecture for arbitrary code, without committing to particular microarchitectural choices. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[2] A well-formed architectural envelope model should be mathematically rigorous, readable, clearly structured, sound with respect to vendor intent, sound with respect to existing implementations, microarchitecturally abstract, and executable as a test oracle. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[3] The model integrates a concurrency model with an ISA model, and the central design question is the interface between concurrency semantics and ISA semantics to permit all required weakly consistent behaviour while remaining microarchitecturally abstract. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[4] Naive instruction modelling as atomic updates to global state is insufficient for weakly consistent multiprocessors because it would not admit all observable behaviour such as out-of-order and speculative execution. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[5] Models are typically expressed in Lem, a specification language providing types and pure functions that serve as both mathematical definitions and executable programs, with export to OCaml, Coq, HOL4, Isabelle/HOL, and LaTeX. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[6] The ISA model for POWER was expressed in a new instruction description language called Sail, with Sail definitions generated from an XML export of the vendor's Framemaker documentation. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[7] The model is validated by comparing model predictions against experimentally observable hardware behaviour for a range of sequential and concurrent tests, with soundness allowing all experimentally observable behaviour modulo errata. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[8] Such tools are best suited as references for small-but-intricate test programs (hardware testing, OS synchronisation primitives, concurrent data structures) rather than production-scale emulation, and may have scope limitations such as omitting floating point, exceptions, interrupts, instruction-cache effects, and supervisor features. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors
[9] Architectural envelope models have been used to discover errata in POWER and ARM implementations, verify compilation of C/C++11 concurrency to POWER, and support Linux-kernel concurrency primitive development. An integrated concurrency and core-ISA architectural envelope definition, and test oracle, for IBM POWER multiprocessors