Proving the Completeness of the Composition of Two Dynamic Verification Techniques

There has been a significant amount of recent research in low-cost mechanisms for detecting errors in computer execution that are due to hardware faults. One exciting, low-cost approach to error detection is dynamic verification (sometimes also called online testing or runtime invariant checking). The idea is for the hardware to dynamically (i.e., at runtime) check whether certain necessary invariants are being maintained. In this paper, we prove that a combination of two previously developed dynamic verification schemes—the Argus scheme for processor cores and the dynamic verification of memory consistency (DVMC) scheme for the memory system—provides complete error detection for a multicore processor chip. Both Argus and DVMC have been proved to be complete for their respective portions of the chip, but it is not obvious that the composition of these two DV schemes is complete. We show that the composition of these two DV schemes detects all possible errors, and thus we show that the interface between Argus and DVMC does not have any gaps through which errors could slip undetected. This proof provides chip designers with a formal guarantee of error detection capability, and such guarantees are often required if a chip is to meet a desired reliability or availability goal.