The Consensus ALU as a SystemC hardware model: bit-exact with the browser original, and three bugs the port found
The Consensus ALU is a small programmable machine: three 16-bit ALU tracks, each running its own four-instruction firmware bank, write every result into four memory domains using either linear or hash-scattered addresses, alongside a 384×216 composite display. It is meant as a general tool, a programmable 16-bit datapath for any job a keyed, repeatable transform suits, and until now it existed only as a page running in a browser.
It now runs as a SystemC model, built with the C++ library hardware designers use to model a chip before building it. The pipeline is a TLM-2.0 initiator that executes one step per clock; each memory domain and the display are TLM-2.0 targets; the peripheral bus and the format control are separate interfaces. The memories hold the 16-bit values themselves rather than colours, so their contents can be hashed and compared.
What the port found
Three bugs in the browser original. Each now has a test that shows it in the original and its absence in the model:
| in the original | in the model | how it is tested |
|---|---|---|
| The key mask exposed the master key. With the default settings, the shift meant to mix the key works out to zero, so the mask is the key XORed with its position, and the default key reads straight back out of it. The same happens in 32.5% of the settings checked. | The mask is derived with PBKDF2-HMAC-SHA256 (600,000 iterations), salted with the four mask settings. | The same attack recovers not even a six-character fragment of the key; the key and each of the four settings still change the mask. |
| The same program gave different output on different runs. Two inputs, CMOS and COM1, were read from the computer's clock. | Both run on simulated time. | Two runs of the original 5 ms apart differ; repeated runs of the model are identical, step for step. |
| Format did not reset everything. The shared buffer behind the ENT and DET instructions survived it. | Format clears it. | A formatted model is indistinguishable from a fresh one; a formatted original is not. |
The 32.5% covers lucky numbers 1–9,999, key lengths 1–32 and shift moduli 1–8. The firmware loader also failed silently: an unknown instruction ran as a no-op, an unknown operand became zero, and a fifth instruction was dropped. Each is now an error naming the bank and the line.
How exact it is
| check | result |
|---|---|
| the model, using the original's mask derivation, against the original JavaScript: 17 programs (5 written by hand, 12 random), up to 300,000 steps | identical at every step (all three outputs, all three addresses and the shared buffer) and in every byte of all five memory regions |
| the model against the fixed JavaScript: 11 programs, including the original's start-up state and programs that read CMOS and COM1 | identical, by the same measures |
| deliberate one-line bugs planted in the model | each one fails the test suite |
| test suite | 22 of 22 pass |
The first check leaves out one thing: programs that read CMOS or COM1. The original takes those from the computer's clock, so no run can reproduce them, not even another run of the original. On the laptop the model runs 3.19 million steps per second (median of five runs of 1,000,000 steps; range 3.13–3.24), with ordinary background load.
What this does not show:
- It is not a cipher. The pipeline mixes values with a key-derived mask, but nothing here claims its outputs are secret. The fix stops the key leaking through the mask; it does not make the machine cryptographic.
- It has no timing of its own. One step per clock and memories that answer at once, because the original has no timing to reproduce.
- It has been tested on one machine, the x86 laptop. Runs longer than 2³² steps have not been tested: past that point the browser's 32-bit bit operations and its exact step counter part ways, and the model is written to follow both, but that has not been checked.
Get it
Source: calu-1.0.tar.gz, 45 KB, SHA-256 fb5b3f7f918f7af97ea1671c1505f2f126e156c4bafd22f65d16e05dda8dcf21. make builds it and make test checks it (SystemC 3.0, OpenSSL, Node and Python 3). Both JavaScript references are inside, the original kernel and the fixed one, so the fixes can be carried back into the browser version line for line.
Licence: free for individuals and for companies under the revenue threshold, free for educational use by anyone, and a capped royalty above the threshold. The terms are in the archive's LICENSE.md and COMMERCIAL.md.
Measured on a Dell 15 laptop (Intel Core 3 100U, 8 threads, no GPU), 2026-10-17, with SystemC 3.0.2, g++ 15.3 and Node 22; exactness by per-step trace and SHA-256 of every memory region.
← Back to the library