Formal Verification Methodology Research Articles

A Scalable Formal Verification Methodology for Data-Oblivious Hardware

A Scalable Formal Verification Methodology for Data-Oblivious Hardware

Deployment of Formal Verification Methodology for AXI based Protocol for a Memory Model Verification

Deployment of Formal Verification Methodology for AXI based Protocol for a Memory Model Verification

Generic Methodology for Formal Verification of UML Models

This paper discusses a Unified Modelling Language (UML) based formal verification methodology for early error detection in the model-based software development cycle. Our approach proposes a UML-based formal verification process utilising functional and behavioural modelling artifacts of UML. It reinforces these artifacts with formal model transition and property verification. The main contribution is a UML to Labelled Transition System (LTS) Translator application that automatically converts UML Statecharts to formal models. Property specifications are derived from system requirements and corresponding Computational Tree Logic (CTL)/Linear Temporal Logic (LTL) model checking procedure verifies property entailment in LTS. With its ability to verify CTL and LTL specifications, the methodology becomes generic for verifying all types of embedded system behaviours. The steep learning curve associated with formal methods is avoided through the automatic formal model generation and thus reduces the reluctance of using formal methods in software development projects. A case study of an embedded controller used in military applications validates the methodology. It establishes how the methodology finds its use in verifying the correctness and consistency of UML models before implementation.

A Refinement-Based Approach to Spectre Invulnerability Verification

Several mitigations to thwart Spectre attacks have been proposed. However, design errors or trojans can be exploited to circumvent these mitigations. We have developed a highly-automated formal verification methodology that can detect if modern microprocessor designs are vulnerable to Spectre and its variants or prove otherwise. The methodology comprises of a refinement-based formal Spectre invulnerability property, and refinement maps, abstractions and invariants required to efficiently check the property. The methodology was evaluated on 29 benchmarks based on the RSD, which is an open source RISC-V based out-of-order superscalar processor. The benchmarks incorporated two Spectre defenses including software-controlled speculation and data track. Also incorporated were various implementation errors and hardware Trojans such as internally-triggered, rare-circuit-state and time-bombs that induce Spectre. What was evaluated was if the methodology could efficiently prove that an implementation is not vulnerable to Spectre and provide a counterexample otherwise. The methodology provided accurate classification for all benchmarks. The verification times were very efficient, ranging from 30 seconds to 1,500 seconds.

A Formal Proof of PG Recurrence Equations of Parallel Adders

Parallel adders are extensively used in high-performance computer design and hardware acceleration for large-scale data processing. In the adder design theory, a key property of the group propagated carry and the group generated carry is based on the two recurrence equations. The property is fundamental to many parallel prefix adders. However, there is no proof of the property in the literature. This article presents a rigorous and complete proof for it. The proof can leverage a solid ground for a formal verification methodology for parallel adder-based chip design.

On Methodology for the Verification of Reconfigurable Timed Net Condition/Event Systems

This paper deals with the formal verification of reconfigurable discrete event control systems (RDECSs) using reconfigurable timed net condition/event systems (R-TNCESs) formalism. A reconfigurable system switches from a mode to another during its working process to adapt its behavior to the related environment. By including such a feature, RDECSs become complex and their verification is often expensive in terms of computation time and memory. In this paper, a new methodology for formal verification of RDECSs is proposed in order to ensure the correctness of these systems with a reduced cost (decreasing the verification time and memory occupation). The proposed contribution includes an improved modeling and verification of RDECSs. The modeling with R-TNCESs is enriched with all reconfiguration forms, and the verification involves an improvement method that avoids any redundancy and cancels unnecessary calculations. In addition, a visual tool called Rec-AG based on the proposed methodology is developed. The performance evaluation of this paper is achieved by measuring computation time and memory for several systems and different sizes of the problem. This paper’s contribution is applied to the benchmark production system FESTO.

Formal Verification of Arithmetic RTL: Translating Verilog to C++ to ACL2

We present a methodology for formal verification of arithmetic RTL designs that combines sequential logic equivalence checking with interactive theorem proving. An intermediate model of a Verilog module is hand-coded in Restricted Algorithmic C (RAC), a primitive subset of C augmented by the integer and fixed-point register class templates of Algorithmic C. The model is designed to be as abstract and compact as possible, but sufficiently faithful to the RTL to allow efficient equivalence checking with a commercial tool. It is then automatically translated to the logic of ACL2, enabling a mechanically checked proof of correctness with respect to a formal architectural specification. In this paper, we describe the RAC language, the translation process, and some techniques that facilitate formal analysis of the resulting ACL2 code.

Process mining approach to formal business process modelling and verification: a case study

Purpose The need for assuring correctness of business processes in enterprises is widely recognised in terms of business process re-engineering and improvement. Formal methods are a promising approach to this issue. The challenge in business process verification is to create a formal model that is well-aligned to the reality. Process mining is a well-known technique to discover a model of a process based on facts. However, no studies exist that apply it to formal verification. This study aims to propose a methodology for formal business process verification by means of process mining, and attempts to clarify the challenges and necessary technologies in this approach using a case study. Design/methodology/approach A trading company simulation model is used as a case study. A workflow model is discovered from an event log produced by a simulation tool and manually complemented to a formal model. Correctness requirements of both domain-dependent and domain-independent types of the model are checked by means of model-checking. Findings For business process verification with both domain-dependent and domain-independent correctness requirements, more advanced process mining techniques that discover data-related aspects of processes are desirable. The choice of a formal modelling language is also crucial. It depends on the correctness requirements and the characteristics of the business process. Originality/value Formal verification of business processes starting with creating its formal model is quite new. Furthermore, domain-dependent and domain-independent correctness properties are considered in the same framework, which is also new. This study revealed necessary technologies for this approach with process mining.

Forcing and Calculi for Hybrid Logics

The definition of institution formalizes the intuitive notion of logic in a category-based setting. Similarly, the concept of stratified institution provides an abstract approach to Kripke semantics. This includes hybrid logics, a type of modal logics expressive enough to allow references to the nodes/states/worlds of the models regarded as relational structures, or multi-graphs. Applications of hybrid logics involve many areas of research, such as computational linguistics, transition systems, knowledge representation, artificial intelligence, biomedical informatics, semantic networks, and ontologies. The present contribution sets a unified foundation for developing formal verification methodologies to reason about Kripke structures by defining proof calculi for a multitude of hybrid logics in the framework of stratified institutions . To prove completeness, the article introduces a forcing technique for stratified institutions with nominal and frame extraction and studies a forcing property based on syntactic consistency. The proof calculus is shown to be complete and the significance of the general results is exhibited on a couple of benchmark examples of hybrid logical systems.

Integrating runtime validation and hardware-in-the-loop (HiL) testing with V & V in complex hybrid systems

This study addresses the problem of assuring provably safe and correct behaviour of safety-critical complex hybrid systems (CHS) throughout their life-cycles when physical system dynamics tend to change due to natural causes. Model-based development methods are needed that integrate formal specification, verification, implementation level testing and runtime validation. Scalability limitations of available algorithms/methods dictate a modular approach, but this poses conflicting issues of compositionality, falsetransitivity, soundness and completeness. In this paper a compositional solution approach based on the decomposition and hybridisation of statechart models (into hybrid automata - HA) is demonstrated. Specifically, a compositional formal verification methodology developed earlier for discrete event dynamic systems (DEDS) was elevated to hybrid dynamics, successfully overcoming the risk of false transitivity common to direct abstraction methods of continuous state-space. It was then used to develop a scalable strategy to generate sound and complete (relative to coverage criteria) tests, and configure corresponding compositional HiL tests for different abstraction and functional levels. The same decomposition was used to derive compositional runtime validation tests based on discrete invariants and differential invariants. The study formally proves that (1) the proposed HA based formal verification method is compositional, sound and complete relative to first-order logic of differential equations, (2) the modular tests are compositional and (3) the HA based test generation method is compositional, sound and complete relative to first-order logic of differential equations. To reduce complexity compositionality is rendered parallel than sequential to perform the simpler tasks concurrently. The claims have been validated experimentally on a full scale experimental rig.

Formal Modeling and Verification of PCHB Asynchronous Circuits

Precharge half buffer (PCHB) is one of the major quasi-delay insensitive (QDI) asynchronous design paradigms, which has been utilized in several commercial applications due to its low power and inherent robustness. In industry, QDI circuits are often synthesized from a synchronous specification using custom synthesis tools. Design validation of the implemented QDI circuits mostly relies on extensive simulation, which may fail to detect corner-case bugs, especially in complex designs. Hence, a formal verification scheme for PCHB circuits is much needed. In this article, we present a formal verification methodology for PCHB circuits synthesized from a Boolean/synchronous specification, which is based on equivalence checking and can guarantee both safety (full functional correctness) and liveness (absence of deadlock). The approach is fast, scalable, and applicable to combinational as well as sequential PCHB circuits. We demonstrate the method using several multipliers, multiply and accumulate circuits (MACs), and IEEE International Symposium on Circuits and Systems (ISCAS) benchmarks.

Rapid Formal Verification as Requirements Stage Verification and Validation Technique

Early formal verification of a system during initial stages of development has the potential to improve the confidence in the system specifications, in addition to improving the formal verifiability throughout the software development cycle. A formal verification methodology is derived to achieve system modelling and verification during the requirements specification and system design phase. This is achieved by using Focus Stream theory for developing a formal system model derived from requirements analysis leading to a preliminary software design. This results into component architecture and it incorporates the development of component behaviour using Finite Sate Machines. The models developed for real time system encompass modelling of infinite state domains. After model development, formal property enumeration under various categories is done. An enhanced safety property verification is proposed and implemented using Linear Temporal Logic propositions, pattern based properties and system safety based property patterns. Properties verification on the model is done in order to validate and refine the specifications. Derived properties are verified using NuXMV Satisfiability Modulo Theories based algorithms. Tool verification as mandated in RTCA DO-330 is incorporated in the proposed methodology. The proposed approach is practical, implementable by system designers and scalable to handle industrial systems.

Methodology for Integrating Computational Tree Logic Model Checking in Unified Modelling Language Artefacts A Case Study of an Embedded Controller


 
 
 A unified modelling language (UML) based formal verification methodology that can be easily integrated into an embedded system software development life cycle is suggested. The approach augments UML diagrams with formal models through an interfacing domain and adds semantics to these diagrams. The suggested methodology; commences from functional specification and use case modelling, selects the most critical behaviour where formal verification can add value to the development cycle, analyses the selected behaviour using UML state transition diagram, derives a state chart matrix from the same, and a high level language software translates the state chart matrix to a labelled transition system. Safety properties are derived from system specifications and are expressed as computation tree logic (CTL) formulae. CTL model-checking algorithm from the literature is used for model- checking. The applicability of the suggested approach is established using a safety critical embedded controller used for deployment and recovery of sensor structures from an airborne platform.
 
 

Formal model of human erroneous behavior for safety analysis in collaborative robotics

Abstract Recent developments in manufacturing technologies, also known as Industry 4.0, seek to build Smart Factories where supply chains and production lines are equipped with a higher level of automation. However, this significant innovation does not entirely eliminate the need for the presence of human operators; on the contrary, it requires them to collaborate with robots and execute hybrid tasks. Thus, creating safe workspaces for human operators is crucial for the future of factories where humans and robots collaborate closely in common workspaces. The uncertainty of human behavior and, consequently, of the actual execution of workflows, pose significant challenges to the safety of collaborative applications. This paper extends our earlier work, a formal verification methodology to analyze the safety of collaborative robotics applications (Askarpour et al. 2017) [1], with a rich non-deterministic formal model of operator behaviors that captures the hazardous situations resulting from human errors. The model allows safety engineers to refine their designs until all plausible erroneous behaviors are considered and mitigated. The solidity of the proposed approach is evaluated on a pair of real-life case studies.

A Methodology for Automatic Formal Verification of Enterprise Architecture

For over a decade, IT-business alignment has been ranked as a top-priority management concern, but there is little research on practical ways to achieve the alignment. EA development is a continuous iterative process, which implicitly ensures the achievement of a specific IT-business alignment level. Therefore, it is necessary to formalize the requirements for architecture and be able to automatically verify them. The authors propose a new methodology for detecting logical contradictions in enterprise architecture models based on a model checking approach adopted in the context of business modeling. In such a methodology, they use ArchiMate standard for a conceptual enterprise architecture description language which is fully aligned with TOGAF. The authors also offer several important verification queries and demonstrate practical applicability of their approach using a software prototype of the modeling tool which exploits MIT Alloy Analyzer model checking framework integrated with AchiMate Archi workbench.

Prosega/CPN: расширение CPN Tools для автоматного анализа и верификации систем

The verification and analysis of distributed systems is a task of utmost importance, especially in today’s world where many critical services are completely supported by different computer systems. Among the solutions for system modelling and verification, it is particularly useful to combine the usage of different analysis techniques. This also allows the application of the best formalism or technique to different components of a system. The combination of Colored Petri Nets (CPNs) and Automata Theory has proved to be a successful formal technique in the modelling and verification of different distributed systems. In this context, this paper presents Prosega/CPN ( Protocol Sequence Generator and Analyzer ), an extension of CPN Tools for supporting automata-based analysis and verification. The tool implements several operations such as the generation of a minimized deterministic finite-state automaton (FSA) from a CPN’s occurrence graph, language generation, and FSA comparison. The solution is supported by the Simulator Extensions feature whose development has been driven by the need of integrating CPN with other formal methods. Prosega/CPN is intended to support a formal verification methodology of communication protocols; however, it may be used in the verification of other systems whose analysis involves the comparison of models at different levels of abstraction. For example, business strategy and business processes. An insightful use case is provided where Prosega/CPN has been used to analyze part of the IEEE 802.16 MAC connection management service specification.

Load Model Verification, Validation and Calibration Framework by Statistical Analysis on Field Data

AbstractAccurate load models are critical for power system analysis and operation. A large amount of research work has been done on load modeling. Most of the existing research focuses on developing load models, while little has been done on developing formal load model verification and validation (V&V) methodologies or procedures. Most of the existing load model validation is based on qualitative rather than quantitative analysis. In addition, not all aspects of model V&V problem have been addressed by the existing approaches. To complement the existing methods, this paper proposes a novel load model verification and validation framework that can systematically and more comprehensively examine load model’s effectiveness and accuracy. Statistical analysis, instead of visual check, quantifies the load model’s accuracy, and provides a confidence level of the developed load model for model users. The analysis results can also be used to calibrate load models. The proposed framework can be used as a guidance to systematically examine load models for utility engineers and researchers. The proposed method is demonstrated through analysis of field measurements collected from a utility system.

Formal verification methodology for real‐time Field Programmable Gate Array

A formal verification methodology for checking both functional and timing requirements of real-time digital controllers targeted at field programmable gate array technology is proposed. Timed transition systems (TTSs) are used to model both the digital controller circuit and the high-level specification requirements. Timed well-founded simulation (TWFS) refinement is used as the notion of correctness and defines what it means for an implementation TTS to satisfy a specification TTS. The primary contribution is a set of proof obligation templates (based on TWFS refinement) that account for both functional and timing requirements. The proof obligations generated using the templates can be checked using a decision procedure. One of the key ideas is the overloaded use of rank functions (that are typically used for liveness verification) for timing verification. The efficiency and scalability of the approach is demonstrated using three case studies.

Parametric formal verification: the robotic paint spraying case study

The design of robots in industrial automation is based on classical control theory approaches. Recently, formal verification methodologies have been introduced in the design flow, due to their ability of analyzing the model of the robot-environment system in a conservative way. In this paper we specifically explore the analysis of system parameters within a continuous space, by developing an extension of the tool Ariadne for reachability analysis of hybrid automata. Under this framework, the system takes the form of a composition of automata which model discrete control parts that operate in a continuous environment. In particular, the dynamics of the system includes parameters, i.e., unspecified constants for which we want to observe the effect on the dynamics, with the purpose of finding optimal design values. As a case study for this methodology, we consider a robotic paint sprayer, in which we use Ariadne to study the effect of choosing different values of a parameter that represents a point of observation for the system. Using the information gathered from this automated analysis, we provide an answer to the problem of optimizing the surface spraying speed while respecting a given measure of spraying quality.

Model Based Safety Analysis with smartIflow

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.