Implementing high integrity systems: the VIPER microprocessor

The author describes the development of VIPER and points out some of the practical problems encountered over the four years of the project. Informal proofs of correctness, carried out in the early stages of the project, are outlined. A peer review group criticized the lack of multiplication and division instructions in VIPER 1. This deficiency is corrected in VIPER 2, and the performance is increased to 3 MIPs.<
>