Past exam of the year 1 of the computer science course of the University of Oxford / 2019 / Digital systems, linear algebra, introduction to formal proof / 1

Write the bit vector as $a=(a_{n-1},\dots ,a_0)$, with $a_0$ the least significant bit. Its unsigned interpretation of a bit string is $\mathrm{bin}(a)={\sum }_{i=0}^{n-1}{a}_i{2}^i$, where each $a_i\in \{0,1\}$. The range is the integers from $0$ through $2^n-1$; a leading one contributes positive weight $2^{n-1}$, not a sign.

Put $M=2^n$ for an $n$-bit processor register. The carry flag for addition satisfies $\mathrm{bin}(x)+\mathrm{bin}(y)=\mathrm{bin}(z)+MC$: the result retains the low $n$ bits and $C=1$ records an arithmetic carry beyond them.

For the ARM architecture family subtraction convention, $\mathrm{bin}(x)-\mathrm{bin}(y)=\mathrm{bin}(z)-M(1-C)$. Thus $C=1$ means no borrow, equivalently the unsigned minuend is at least the subtrahend. This flag is different from signed overflow: an arithmetic carry decision is not a test of the signed result.

Let r1:r0 hold the first operand, high limb first, and r3:r2 the second. In assembly language the addition can be written:

adds r0, r0, r2
adcs r1, r1, r3

The first instruction produces the low result and its arithmetic carry; the second immediately consumes that arithmetic carry while adding the high limbs. No intervening flag-setting instruction is permitted.

For a proof, put $M=2^{32}$ and denote the input limbs by $X_1,X_0,Y_1,Y_0$. If the low addition gives $Z_0$ and arithmetic carry $c$, then $X_0+Y_0=Z_0+Mc$. The high addition gives $Z_1$ and final arithmetic carry $d$, so $X_1+Y_1+c=Z_1+Md$. Multiplying the second identity by $M$ and combining yieldsThe processor register pair is the correct result modulo $2^{64}$, and the final arithmetic carry records overflow beyond that unsigned width. If the mathematical sum fits in 64 bits, no reduction changes it.

A subtract with carry instruction consumes the no-borrow carry flag. Its arithmetic is $Z=X-Y-(1-C_{\mathrm{in}})(\mathrm{mod}{2}^{32})$. Hence a low-limb subs followed immediately by a high-limb sbcs propagates exactly the low subtraction's borrow.

For example, with the same limb assignment as in (c):

subs r0, r0, r2
sbcs r1, r1, r3

It uses an ordinary 32-bit adder by complementing every bit of the subtrahend and adding the incoming arithmetic carry. For $M=2^{32}$, the unreduced adder sum isIf this is $Z+M{C}_{\mathrm{out}}$, rearrangement gives $X-Y-(1-C_{\mathrm{in}})=Z-M(1-C_{\mathrm{out}})$. Thus both the result and outgoing no-borrow flag have the required meanings. With incoming arithmetic carry one this becomes ordinary subtraction.^[ref]

Use four working processor registers by packing the growing quotient into the vacated low bits of the shifting dividend. The following is A32 assembly language with conditional execution, an allowed instance of the question's general 32-bit Reduced instruction set computer. It is not restricted to the sixteen-bit encodings in the supplied Thumb instruction set table. On entry r0 is the dividend and r1 the positive divisor; r2 becomes the high remainder machine word and r3 counts iterations. The quotient is returned in r0 and the ordinary remainder remains in r2.

mov   r2, #0
mov   r3, #32
loop:
adds  r0, r0, r0
adcs  r2, r2, r2
cmp   r2, r1
subcs r2, r2, r1
adc   r0, r0, #0
subs  r3, r3, #1
bne   loop
bx    lr

Here subcs means conditional sub when arithmetic carry is set, without the flag-setting suffix. adc also preserves flags. Consequently the arithmetic carry from cmp survives until it is inserted as the next quotient bit. The loop has seven instructions, one of them conditional, and no data-dependent branch. Its sole branch is the backwards loop branch, taken 31 times. It uses no separate quotient processor register, zero processor register, temporary comparison processor register or saved arithmetic carry processor register. A Thumb instruction set rendering using conditional execution would need an explicit conditional-execution encoding such as it cs; that is an additional encoded instruction, not an unexplained free operation.

The packed restoring division loop invariant relates it to the displayed algorithm. Specifically, let $M=2^{32}$, let $a$ retain its original mathematical value, and let $k$ be the number of completed iterations. Define the processed prefix $p_k=\lfloor a/2^{32-k}\rfloor$, its quotient $Q_k=\lfloor p_k/b\rfloor$ and remainder $R_k=p_k-b{Q}_k$. The processor register loop invariant isThe two terms in the low machine word occupy disjoint bit positions. Its next outgoing arithmetic carry is therefore the next original dividend bit, not a quotient bit. adds shifts the low machine word; adcs doubles the high remainder and incorporates that dividend bit. cmp decides whether this trial remainder is at least the divisor; subcs performs the conditional subtraction, and adc appends its decision to the shifted quotient. This is exactly the doubling, compare/subtract and quotient-bit update, with the counter maintained separately. Before processing bit $k\le 32$, the trial remainder is at most $p_k<2^k\le M$, so the high-word addition does not require a hidden 33rd remainder bit for this 32-bit dividend problem. After 32 iterations the residual dividend portion is zero, giving the stated outputs.

There is a printed source error in the auxiliary bound. At the initial state, choosing valid inputs $a=b=1$ makes the printed strict inequality $r{2}^j<b{2}^{32}$ false. The algorithm instead preserves $0\le r<b{2}^{32}$ for its unpacked 64-bit variable, together with its printed equality loop invariant. Doubling and subtracting $b{2}^{32}$ when necessary preserves that corrected bound. At termination the equality becomes $a{2}^{32}=qb{2}^{32}+r$; since $r$ is then divisible by $2^{32}$, it gives $0\le a-qb<b$. This source error does not invalidate the algorithm or the packed implementation. The figure is mathematical pseudocode: its 2^32 denotes exponentiation, rather than C's XOR operator.

The displayed A32 routine assembled successfully with Clang and was disassembled to check the conditional and non-flag-setting forms. Its carry flag model was checked exhaustively at an eight-bit machine word size and against boundary and randomized 32-bit divisions. No native ARM architecture family execution is claimed.