Causality Check

Concept

A causality check is a class of formal-verification assertions used to confirm that the observed retirement order of instructions preserves data-dependency causality. In the RISC-V Formal framework three such checks — `causal`, `causal_mem`, and `causal_io` — verify causality with respect to registers, memory, and I/O memory respectively, and are managed by the `genchecks.py` tool while consuming RVFI signals.

First seen 6/7/2026

Last seen 6/7/2026

Evidence 1 chunks

Wiki v1

WIKI

Causality Check

Definition

A causality check is a formal-verification assertion that validates whether the order in which a processor core retires instructions preserves the data-dependency causality between them. The core rule is: a write must be retired before any read that depends on it, even when instructions are otherwise allowed to be retired out of order.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

genchecks.py ← introduces 95% 1e

genchecks.py manages causality checks as part of the standard checks

RVFI uses → 93% 1e

Causality checks operate on the RVFI instruction stream

LINKED ENTITIES

2 links

genchecks.py INTRODUCES Extracted graph relationship

RVFI USES Extracted graph relationship

CITATIONS

9 sources

9 citations — click to expand

[1] There are three causality checks: causal, causal_mem and causal_io. Verification procedure - RISC-V Formal documentation

[2] The core may retire instructions out-of-order as long as causality is preserved: a write must be retired before the reads that depend on it. Verification procedure - RISC-V Formal documentation

[3] The causal check tests if the instruction stream is causal with respect to registers; causal_mem tests causality with respect to memory. Verification procedure - RISC-V Formal documentation

[4] The causal_io check tests causality with respect to I/O memory, where every I/O memory access is assumed to depend on all earlier I/O memory accesses. Verification procedure - RISC-V Formal documentation

[5] Which areas of the address space are considered I/O memory can be configured using the RISCV_FORMAL_IOADDR(addr) macro. Verification procedure - RISC-V Formal documentation

[6] Each causality check has a [depth] section expecting two values: the number of reset cycles and the execution depth. Verification procedure - RISC-V Formal documentation

[7] The standard checks (including the standard bus checks) are managed by genchecks.py. Verification procedure - RISC-V Formal documentation

[8] Causality checking is an application area of HyperLTL model checking, alongside information-flow control, robustness, mutation testing, and path planning. AutoHyper: Explicit-State Model Checking for HyperLTL

[9] The jMT tool constructs valid multi-execution semantics for concurrent Java programs via causality checking over single-execution graphs. jMT: Testing Correctness of Java Memory Models (Extended Version)