Automatic Formal Proof of Liveness for Pipelined Microprocessors

The paper presents an indirect method to automatically prove liveness for pipelined microprocessors. This is done by first proving safety—correctness for one step, starting from an arbitrary initial state that is possibly restricted by invariant constraints. By induction, the implementation will be correct for any number of steps; we need to prove that for some fixed number of steps, n, the implementation will fetch at least one instruction that will be completed. This was proved efficiently by using the property of Positive Equality. Modeling restrictions made the method applicable to designs with exceptions and branch prediction. The indirect method and the modeling restrictions resulted in 4 orders of magnitude speedup, enabling the automatic liveness proof for dual-issue superscalar and VLIW designs.