Formal Design Verification Research Articles

Models, simulations, and applications of small satellite thermal analysis

Progress in satellite technology places higher expectations on the design period and reliability of thermal control systems, especially for small satellites with high intensification. Here, a thermal analysis is conducted throughout the satellite development process, with thermal modeling serving as the foundation for thermal analysis in the early and formal design and test verification stages. As a result, designers are required to appreciate, penetrate, and properly apply thermal models for the development of satellite thermal systems. Thus, in this article, we reviewed the research and development of thermal model techniques, as well as the preparation of crucial parameters and means of simplification for accurate and fast solutions. In addition, a summary of the relevant application and state-of-the-art technologies such as uncertainty and sensitivity analysis, intelligent optimization design, and parameter correlation, was dedicated to promoting the comprehensive development and innovation of thermal analysis of satellites.

Formal Verification of Fault-Tolerant Hardware Designs

Formal Verification of Fault-Tolerant Hardware Designs

Verification of Chisel Hardware Designs with ChiselVerify

With the current ever-increasing demand for performance, hardware developers find themselves turning ever-more towards the construction of application-specific accelerators to achieve higher performance and lower energy consumption. In order to meet the ever-shortening time constraints, both hardware development and verification tools need to be improved.Chisel, as a hardware construction language, tackles this problem by speeding up the development of digital designs. However, the Chisel infrastructure lacks tools for verification. This paper improves the efficiency of verification in Chisel by proposing methods to support both formal and dynamic verification of digital designs in Scala. It builds on top of ChiselTest, the official testing framework for Chisel. Our work supports functional coverage, constrained random verification, bus functional models, and transaction-level modeling in a verification library named ChiselVerify, while the formal methods are directly integrated into Chisel3.

Formal verification of IoT applications using rewriting logic: An MDE-based approach

Internet of Things (IoT) systems are complex assemblies of components that collaborate to achieve common goals. These components are based on heterogeneous technologies, and they communicate using various communication protocols. This heterogeneity makes the design and the development of IoT applications a challenging issue. Diverse approaches based on Model-Driven Engineering (MDE) have been proposed to overcome this major issue using suitable modeling languages. ThingML is a promising UML profile for modeling IoT applications that aims to address the challenges of heterogeneity. However, ThingML does not have rigorous semantics, making it unsuitable for formal verification and analysis of system designs. This paper proposes an MDE-based formal approach to define the formal semantics of the ThingML language using rewriting logic and its language Maude. The main advantage of our approach over other approaches lies in the universality and versatility of Maude's mathematical notation, which implements all ThingML concepts and their behavioral aspects in a unified formal logic. The existing Maude language verification tools provide powerful analysis techniques, including simulation and model checking, which enable rigorous analysis and verification of ThingML designs. The contributions of this work include the following: (i) we propose a semantics mapping between ThingML concepts and Maude constructs, (ii) we define and implement an operational semantics for the ThingML action language in the Maude language, and (iii) we develop a tool that enables the automatic transformation of ThingML specifications into Maude. Our approach is illustrated through a case study.

Formal Verification of Arithmetic RTL: Translating Verilog to C++ to ACL2

We present a methodology for formal verification of arithmetic RTL designs that combines sequential logic equivalence checking with interactive theorem proving. An intermediate model of a Verilog module is hand-coded in Restricted Algorithmic C (RAC), a primitive subset of C augmented by the integer and fixed-point register class templates of Algorithmic C. The model is designed to be as abstract and compact as possible, but sufficiently faithful to the RTL to allow efficient equivalence checking with a commercial tool. It is then automatically translated to the logic of ACL2, enabling a mechanically checked proof of correctness with respect to a formal architectural specification. In this paper, we describe the RAC language, the translation process, and some techniques that facilitate formal analysis of the resulting ACL2 code.

Verifying SystemC Using Intermediate Verification Language and Stateful Symbolic Simulation

Formal verification of high-level SystemC designs is an important and challenging problem. One has to deal with the full complexity of C++ to extract a suitable formal model (front-end problem) and then, with large cyclic state spaces defined by symbolic inputs and concurrent processes. This paper describes a scalable and efficient stateful symbolic simulation approach for SystemC that combines state subsumption reduction (SSR) with partial order reduction (POR) and symbolic execution (SymEx) under the SystemC simulation semantics. While the SymEx+POR combination provides basic capabilities to efficiently explore the state space, SSR prevents revisiting symbolic states and therefore makes the verification complete. The approach has been implemented on top of an intermediate verification language for SystemC to address the front-end problem. The scalability and efficiency of the implemented verifier is demonstrated using an extensive set of experiments.

Mining Missing Assumptions from Counter-Examples

During the formal functional verification of Register-Transfer Level designs, a false failure is often observed. Most of the time, this failure is caused by an underconstrained model. The analysis of the root cause for the verification error and the creation of missing assumptions are a significant time burden. In this article, we present a methodology to automatically mine these missing assumptions from counter-examples. First, multiple counter-examples are generated for the same property. Then, relevant behaviors are mined from the counter-examples. Finally, corresponding assumptions are filtered and a small amount is returned to the user for review.

Guest Editorial

This is a special issue of ACM TECS consisting of selected papers of the 15th ACM-IEEE International Conference on Formal Methods and Models for System Design (MEMOCODE 2017). MEMOCODE's general objective is to bring together researchers and practitioners interested in formal methods and models for system design and development to exchange ideas, research results, and lessons learned. System design covers the design and development of hardware, firmware, middleware, and application software for systems ranging from single embedded devices to highly networked CPS and systems in the internet of things (IoT). MEMOCODE emphasizes the importance of formal models and methods in correct system design in all aspects of computer system development. In particular, MEMOCODE focuses on research contributions and formal foundations, engineering methods, tools, and experimental case studies. MEMOCODE 2017 took place in Vienna (Austria) and was co-located with the conference on Formal Methods in Computer-Aided Design (FMCAD) as in some previous years. Among the 48 papers submitted to MEMOCODE 2017, we have selected the following six papers for inclusion in this special issue that show the broad spectrum of MEMOCODE's field of interest which covers all phases of system design:-Modeling: 'Stochastic Assume-Guarantee Contracts for Cyber-Physical System Design' Li presents an assume-guarantee contract framework for the design of cyber-physical systems under probabilistic requirements. System behaviors, assumptions, and guarantees are described by a stochastic signal temporal logic. For certain systems, the approach can check contract compatibility, consistency, and refinement, and can generate a controller to guarantee that a contract is satisfied.-Verification: 'Mining Missing Assumptions from Counter-Examples' by Guillaume Plassan, Katell Morin-Allory, and Dominique Borrione observed that in formal verification of register-transfer level hardware designs, one often experiences false failures due to under-constrained models. The approach extracts the missing assumptions from counterexamples to help the designers to correct their models.-Testing: 'Model-based, mutation-driven test case generation via heuristic-guided branching' by Andreas Fellner, Willibald Krenn, Thorsten Tarrach, Georg Weis-senbacher, and Rupert Schlick introduces an algorithmic framework for parallel heuristic-guided searches for test case generation of action systems. Since no single heuristic is able to find all the mutants that are found by the others, the best result is achieved by running multiple heuristics independently and combining their results.-Synthesis: 'Compositional Dataflow Circuits' by Stephen A. Edwards, Richard Townsend, and Martha A. Kim presents a technique for implementing dataflow networks as compositional hardware circuits. Based on a first abstract dataflow model with unbounded buffers that supports data-dependent blocks (mux, demux, and non-deterministic merge), it is shown how to faithfully implement such networks with bounded buffers and handshaking in a compositional synthesis procedure. Insert

A comprehensive study and analysis on SAT-solvers: advances, usages and achievements

Boolean satisfiability (SAT) has been studied for the last twenty years. Advances have been made allowing SAT solvers to be used in many applications including formal verification of digital designs. However, performance and capacity of SAT solvers are still limited. From the practical side, many of the existing applications based on SAT solvers use them as blackboxes in which the problem is translated into a monolithic conjunctive normal form instance and then throw it to the SAT solver with no interaction between the application and the SAT solver. This paper presents a comprehensive study and analysis of the latest developments in SAT-solver and new approaches that used in branching heuristics, Boolean constraint propagation and conflict analysis techniques during the last two decade. In addition, the paper provides the most effective techniques in using SAT solvers as verification techniques, mainly model checkers, to enhance the SAT solver performance, efficiency and productivity. Moreover, the paper presents the remarkable accomplishments and the main challenges facing SAT-solver techniques and contrasts between different techniques according to their efficiency, algorithms, usage and feasibility.

A Principled Approach to Secure Multi-core Processor Design with ReWire

There is no such thing as high assurance without high assurance hardware. High assurance hardware is essential because any and all high assurance systems ultimately depend on hardware that conforms to, and does not undermine, critical system properties and invariants. And yet, high assurance hardware development is stymied by the conceptual gap between formal methods and hardware description languages used by engineers. This article advocates a semantics-directed approach to bridge this conceptual gap. We present a case study in the design of secure processors, which are formally derived via principled techniques grounded in functional programming and equational reasoning. The case study comprises the development of secure single- and dual-core variants of a single processor, both based on a common semantic specification of the ISA. We demonstrate via formal equational reasoning that the dual-core processor respects a “no-write-down” information flow policy. The semantics-directed approach enables a modular and extensible style of system design and verification. The secure processors require only a very small amount of additional code to specify and implement, and their security verification arguments are concise and readable. Our approach rests critically on ReWire, a functional programming language providing a suitable foundation for formal verification of hardware designs. This case study demonstrates both ReWire’s expressiveness as a programming language and its power as a framework for formal, high-level reasoning about hardware systems.

Formal Verification of Automotive Design in Compliance With ISO 26262 Design Verification Guidelines

ISO 26262, an automotive functional safety standard, ensures the functional safety of automotive systems by providing requirements and processes to govern the software lifecycle. Each functional system must be classified in terms of safety goals, risks, and automotive safety integrity level (ASIL: A, B, C, and D), with ASIL D, denoting the most stringent safety level. As the risk of the system increases, the ASIL level increases, and the standard highly recommends more stringent methods to ensure safety. ISO 26262 highly recommends that ASIL C and D-classified systems utilize semiformal and formal verification among other techniques to verify software unit design and implementation. In this paper, we compare industrial design verification steps of WatchDog Manager in an effort to be ASIL B-compliant with a proposed nondisruptive methodology to semiformally verify WatchDog Manager UML design via an automated formal framework backbone. This semiformal verification framework will allow automotive software to comply with ASILs C and D formal and semiformal unit design and implementation verification recommended guidelines in ISO 26262. Semiformal UML finite-state machines are automatically compiled into formal notations based on the Symbolic Analysis Laboratory formal notation. We capture requirements in the UML design and compile them automatically into theorems. Model checkers are run against the compiled formal model and theorems to detect counterexamples that violate the requirements in the UML model. We show that semi-formal verification of the design allows us to uncover issues that were detected in testing and production stages of ASIL B-compliant Watchdog Manager existing implementation.

Semantics Driven Hardware Design, Implementation, and Verification with ReWire

There is no such thing as high assurance without high assurance hardware. High assurance hardware is essential, because any and all high assurance systems ultimately depend on hardware that conforms to, and does not undermine, critical system properties and invariants. And yet, high assurance hardware development is stymied by the conceptual gap between formal methods and hardware description languages used by engineers. This paper presents ReWire, a functional programming language providing a suitable foundation for formal verification of hardware designs, and a compiler for that language that translates high-level, semantics-driven designs directly into working hardware. ReWire's design and implementation are presented, along with a case study in the design of a secure multicore processor, demonstrating both ReWire's expressiveness as a programming language and its power as a framework for formal, high-level reasoning about hardware systems.

Sysfier

SystemC is a system-level modeling language that can be used effectively for hardware/software co-design. Since a major goal of SystemC is to enable verification at higher levels of abstraction, the tendency is now directing to introducing formal verification approaches for SystemC. In this article, we propose an approach for formal verification of SystemC designs, and provide the semantics of SystemC using Labeled Transition Systems (LTS) for this purpose. An actor-based language, Rebeca, is used as an intermediate language. SystemC designs are mapped to Rebeca models and then Rebeca verification toolset is used to verify LTL and CTL properties. To tackle the state-space explosion, Rebeca model checkers offer some reduction policies that make them appropriate for SystemC verification. The approach also benefits from the modular verification and program slicing techniques applied on Rebeca models. To show the applicability of our approach, we verified a single-cycle MIPS design and two hardware/software co-designs. The results show that our approach can effectively be used both in hardware and hardware/software co-verification.

Formal verification of high-level data-flow synthesis designs using relational modeling and symbolic computation

This paper presents a formal verification methodology of high-level data-flow synthesis process. Typically, given a data-flow description, the high-level data-flow synthesis tools perform high-level restructuring and data-flow transformations to produce an optimized architectural implementation. How to verify the correctness of the synthesis results is a key issue within the high-level data-flow synthesis process. Our approach adopts the relational modeling techniques from Kleene algebra with tests (KAT) and the symbolic computation methods from polynomial algebra to solve this verification problem. In this paper, we show how to extract target properties from the data-flow description by using KAT and how to construct the polynomial representation for the architectural implementation. Further, we demonstrate how a symbolic computation-based decision procedure is integrated into our framework to perform verification in a generalized bounded model checking (BMC) style. The experimental results on some public benchmark and practical designs demonstrate the efficiency of our approach and its applicability to large data-flow designs.

Integrating Abstraction Techniques for Formal Verification of Analog Designs

The verification of analog designs is a challenging and exhaustive task that requires deep understanding of physical behaviours. In this paper, we propose a qualitative based predicate abstraction method for the verification of a class of non-linear analog circuits. In the proposed method, system equations are automatically extracted from a circuit diagram by means of a bond graph. Verification is applied based on combining techniques from constraint solving and computer algebra along with symbolic model checking. Our methodology has the advantage of avoiding exhaustive simulation normally encountered in the verification of analog designs. To this end, we have used Dymola, Hsolver, SMV and Mathematica to implement the verification flow. We illustrate the methodology on several analog examples including Colpitts and tunnel diode oscillators.

Dosimetric measurements of a new electronic brachytherapy surface applicator

Dosimetric measurements of a new electronic brachytherapy surface applicator

Formal verification of component-based designs

Embedded systems are becoming increasingly common in our everyday lives. As technology progresses, these systems become more and more complex, and designers handle this increasing complexity by reusing existing components (Intellectual Property blocks). At the same time, the systems must fulfill strict requirements on reliability and correctness. This paper proposes a formal verification methodology which smoothly integrates with component-based system-level design using a divide and conquer approach. The methodology assumes that the system consists of several reusable components, each of them already formally verified by their designers. The components are considered correct given that the environment satisfies certain properties imposed by the component. The methodology verifies the correctness of the glue logic inserted between the components and the interaction of the components through the glue logic. Each such glue logic is verified one at a time using model checking techniques. Experimental results have shown the efficiency of the proposed methodology and demonstrated that it is feasible to apply such a verification methodology on real-life examples.

An approach for the formal verification of DSP designs using Theorem proving

This paper proposes a framework for the incorporation of formal methods in the design flow of digital signal processing (DSP) systems in a rigorous way. In the proposed approach, DSP descriptions were modeled and verified at different abstraction levels using higher order logic based on the higher order logic (HOL) theorem prover. This framework enables the formal verification of DSP designs that in the past could only be done partially using conventional simulation techniques. To this end, a shallow embedding of DSP descriptions in HOL at the floating-point (FP), fixed-point (FXP), behavioral, register transfer level (RTL), and netlist gate levels is provided. The paper made use of existing formalization of FP theory in HOL and a parallel one developed for FXP arithmetic. The high ability of abstraction in HOL allows a seamless hierarchical verification encompassing the whole DSP design path, starting from top-level FP and FXP algorithmic descriptions down to RTL, and gate level implementations. The paper illustrates the new verification framework on the fast Fourier transform (FFT) algorithm as a case study.

Formal Verification for Embedded System Designs

Embedded electronics today are becoming increasingly complex, which makes their design and analysis more and more difficult. In this paper, we focus on the formal verification of embedded system designs at multiple levels of abstraction, enabled by the Metropolis design environment. Based on the Metropolis framework and the model checker SPIN, a translation mechanism from a Metropolis design to a Promela description is presented and an automatic translator is developed accordingly. We discuss the challenges and solutions in semantically translating from an object-based system design language to a procedural verification language. To demonstrate the correctness and effectiveness of our approach for formal verification, we verify properties for both system level representations and refined representations, where the representations may contain system functions or abstract architectures.

Partial-Order Reduction in Symbolic State-Space Exploration

State-space explosion is a fundamental obstacle in the formal verification of designs and protocols. Several techniques for combating this problem have emerged in the past few years, among which two are significant: partial-order reduction and symbolic state-space search. In asynchronous systems, interleavings of independent concurrent events are equivalent, and only a representative interleaving needs to be explored to verify local properties. Partial-order methods exploit this redundancy and visit only a subset of the reachable states. Symbolic techniques, on the other hand, capture the transition relation of a system and the set of reachable states as boolean functions. In many cases, these functions can be represented compactly using binary decision diagrams (BDDs). Traditionally, the two techniques have been practiced by two different schools—partial-order methods with enumerative depth-first search for the analysis of asynchronous network protocols, and symbolic breadth-first search for the analysis of synchronous hardware designs. We combine both approaches and develop a method for using partial-order reduction techniques in symbolic BDD-based invariant checking. We present theoretical results to prove the correctness of the method, and experimental results to demonstrate its efficacy.