Formal Verification Techniques Research Articles

Formal Specification and Verification of Complex Systems

The application of formal methods in the rigorous definition and analysis of the functionality and the behaviour of a system, promises the ability of showing that the system is correct. Given such a promise, that is already out since several years, it is astonishing to see how little formal methods are actually used in the safety critical system industry, though the use of formal methods is increasingly required by the international standards and guidelines for the development of complex systems. Industrial acceptance of formal methods is strictly related to the investment needed to introduce them, to the maturity of tool support available, and to the easiness of use of formal methods and tools. Nowadays, the industrial trend is directed to the adoption of formal verification techniques to validate the design, integrating them within the existing development process. Industries are more keen to accept formal verification techniques assessing the quality attributes of their products, obtained by a traditional life cycle, rather than a fully formal life cycle development, due to the lower training and innovation costs of the former. Several approaches to the application of formal methods in the development process have been proposed, differing for the degree of involvement of the method within it. Starting from rigorous specifications, formal methods can be used for the derivation of test cases, or as a validation technique aimed at proving that the specification satisfies the requirements, or as an auxiliary technique in the automated generation of code. The Formal Methods &&Tools Group of ISTI-CNR is active in the fields of development and application of formal notations, methods and software support tools for the specification, design and verification of complex computer systems. These systems often share important features like concur-

Formal verification and validation for e-commerce: theory and best practices

In this paper, we describe a formal, model-driven, CORBA-based approach to developing and testing e-commerce systems. We indicate advantages and limitations of formal verification techniques using the Specification and Description Language (SDL), and relate the CORBA-based distributed object architecture to standard test methods and TTCN, the international standard test language. Finally, we enumerate industrial challenges and best practices at one of the electronic commerce software test organizations in IBM, and suggest a strategy for adapting formal test methods to the evolving industrial e-commerce test process.

Formal verification: an imperative step in the design of security protocols

Traditionally, security protocols have been designed and verified using informal techniques. However, the absence of formal verification can lead to security errors remaining undetected. Formal verification techniques, on the other hand, provide a systematic way of discovering protocol flaws. This paper discusses the process of formal verification using modal logics. The verification process is demonstrated by way of case studies on three security protocols, which are designed for use in mobile communications. Our formal analysis discovers all known flaws in the three chosen protocols. Further, a hitherto unknown flaw is identified in these protocols. This flaw causes a protocol failure, which can be exploited in an attack where an adversary impersonates a legitimate protocol participant. A new protocol, resistant to this attack, is proposed and formally verified, giving confidence in the correctness of the protocol. The result of these case studies, where formal verification successfully discovers all these flaws, demonstrates that using formal verification techniques is an imperative step in the design of security protocols.

Support for Reasoning about Interactive Systems through Human-Computer Interaction Designers' Representations

In this paper we present and discuss the integration of tools for the development and analysis of human–computer interaction models with formal verification techniques. We explain the method that we have developed and the tools that we have integrated for this purpose, and discuss how the resulting environment is more effective for designers of interactive applications than using current formal verification techniques alone. The main result is that designers can take advantage of the functionality of model-checking tools while still working with representations of the relevant models that they are familiar with in their practice. Thus, we show how tools can support such an approach and what design choices have been made to improve the usability of such an environment, allowing even people with little background in formal methods to use it.

Industrial strength exception freedom

Ada is unique amongst modern high-level languages in the degree to which it allows programming errors to be trapped at the compilation stage. Using a tool like the SPARK Examiner amplifies this effect and can provide a high degree of confidence that a program is well formed before we try and verify that its behaviour is correct. Despite this progress a less tractable class of errors remain: run-time exceptions. For safety-related systems a run-time error may be just as hazardous as any other logical error. For secure systems, guarding against the deliberate generation of such errors-through buffer overflow attacks for example-is vital. The paper explains how automated techniques based on formal verification or proof techniques have now matured and provide an industrial strength solution.

Automating software feature verification

A significant part of the call processing software for Lucent's new PathStar™ Access Server was checked with formal verification techniques. The verification system we built for this purpose, named FeaVer, is accessed via a standard Web browser. The system maintains a database of feature requirements, together with the results of the most recently performed verifications. Via the browser the user can invoke new verification runs, which are performed in the background with the help of a logic model checking tool. Requirement violations are reported either as high-level message sequence charts or as detailed execution traces of the system source. A main strength of the system is its capability to detect potential feature interaction problems at an early stage of systems design. This type of problem is difficult to detect with traditional testing techniques. Error reports are typically generated by the system within minutes after a comprehensive check is initiated, allowing near-interactive probing of feature requirements and quick confirmation (or rejection) of the validity of tentative software fixes.

STRUCTURED HYBRID ABSTRACTIONS OF CONTINUOUS SYSTEMS.

Abstracting a continuous dynamical system by a hybrid linear automaton allows to use formal verification techniques to check properties of hybrid systems. In order to build the abstract model, the state space is partitioned and the rate of each state variable is approximated. When the system is linear the properties of the continuous system can be used to split the state space in order to get a tighter abstraction with an automaton that remains simple, so that the reachability calculus is more accurate. Moreover the accuracy of the approximation can be used to aid the design of the partition.

6.5.4 SafeAir ‐ An Integrated Development Environment and Methodology

AbstractSafeAir (http://www.safeair.org) is a European Commission project that has been submitted under the 5th framework program. Within the framework of SafeAir an Avionic System Development Environment (ASDE) will be developed and evaluated. ASDE will implement technologies, methods and tools that meet the high dependability needs of real time embedded systems. Once natural language requirements are in place, ASDE will support system and software property specifications on the basis of formal, readable, graphical notations. Notation will be based on block‐diagrams, activity‐charts and state‐charts, both at the analysis and design phase. ASDE will integrate defacto standard modelling tools (Statemate, MATLAB, Sildex, and SCADE) for complex embedded system applications. Thus, ASDE will provide a seamless process path from system‐level modelling tools to an automatic code generation tool in compliance with the DO‐178B certification standard [1] for critical airborne embedded systems. ASDE will significantly raise the degree of early error detection and reduce the validation effort during system integration time utilizing formal verification techniques for the verification of system critical properties.The key concepts for these improvements are a model based design process, formal verification, automatic code generation and automatic code validation.

Application of BDDs in Boolean matching techniques for formal logic combinational verification

Verifying that an implementation of a combinational circuit meets its golden specification is an important step in the design process. As inputs and outputs can be swapped by synthesis tools or by interaction of the designer, the correspondence between the inputs and the outputs of the synthesized circuit and the inputs and the outputs of the golden specification has to be restored before checking equivalence. In this paper, we review the main approaches to this isomorphism problem and show how to apply OBDDs in order to obtain efficient methods.

Guest editor's introduction to special section on high-level design validation and test

ALIDATION and verification are becoming bottlenecks in designing multimillion-gate systems. Simulation-based and formal-verification-based approaches are being pursued for design validation of such hardware-based systems. Simulation-based approaches such as generation and application of high-level tests, generation and execution of test programs for microprocessors. and hardware-accelerated emulation are finding good use in the industry. Formal-verification techniques such as model-checking and theorem-proving have been used to verify the correctness of small designs. Limited success has been achieved in deploying formal techniques in the context of protocol verification, verification of control logic in (pipelined) microprocessors, and verification of small application-specific systems. Scalability to large-scale industrial designs remains a concern for many verification-based approaches. Recognizing that neither simulation- nor verification-based approaches by themselves can solve the emerging validation problems, the High-Level Design Validation and Test (HLDVT) Workshop was started in 1996 to bring together these two communities. The HLDVT Workshop has successfully focused on addressing practical validation issues, methodologies, and techniques for validation of complex processors and heterogeneous system-on-chips (SoCs) and validation at higher levels of design

A realistic involvement of formal methods

In this article, we report a real-life application of so-called ‘Formal Methods’. The part of the project we were involved in was to verify that an embedded circuit satisfies a safety property. We describe the circuit as well as the mathematical and computer tools we used. We discuss methodological issues and we present some of the various experiments we performed. Finally, we draw some general conclusions about the practicability of formal verification techniques. Copyright © 2001 John Wiley & Sons, Ltd.

Optimizing symbolic model checking for statecharts

Symbolic model checking based on binary decision diagrams is a powerful formal verification technique for reactive systems. In this paper, we present various optimizations for improving the time and space efficiency of symbolic modal checking for systems specified as statecharts. We used these techniques in our analyses of the models of a collision avoidance system and a fault-tolerant electrical power distribution (EPD) system, both used on commercial aircraft. The techniques together reduce the time and space requirements by orders of magnitude, making feasible some analysis that was previously intractable. We also elaborate on the results of verifying the EPD model. The analysis disclosed subtle modeling and logical flaws not found by simulation.

A comparative study of formal verification techniques for software architecture specifications

With the rapid growth of network computing, the demand for largedscale and complex software systems has increased dramatically. However, the development of largedscale and complex software systems is much more difficult and error prone. This is due to the fact that techniques and tools for assuring the correctness and reliability of software systems lag far behind the increasing growth in size and complexity of software systems. The concept of software architecture has recently emerged as a new way to improve our ability to effectively construct and maintain largedscale complex software systems. The architecture based development of software systems focuses on the architectural elements and their overall interconnection structure. Several Architectural Definition Languages (ADLs) have been proposed for specifying domain specific or general purpose architectures. On the other hand, formal verification is rapidly becoming a promising and automated method to ensure the accuracy and correctness of software systems. In this paper, we survey several architecture description languages and formal verification methods. We present an environment to conduct experiments to study the performance of five different verification tools on software architecture specifications. Based on these experiments, we are able to compare the efficiency of these verification tools in verifying certain software property.

Testing for Function and Performance: Towards anIntegrated Processor Validation Methodology

Microprocessor design teams use a combination of simulation-based and formal verification techniques to validate the pre-silicon models prior to “tape-out” and chip fabrication. Pseudo-random test case generation to “cover” the architectural space is still relied upon as the principal means to identify design bugs. However, such methods are limited to functional bugs only. Detection and diagnosis of timing (performance) bugs at the architectural level is largely an expert job. Architects guide the performance team to run manually generated test cases to validate the design from a performance viewpoint. In this paper, we will review some of the new approaches being tried out to automate the generation of performance test cases. We will show how this can be done within the basic framework of current functional validation and testing of pre-silicon processor models. Three categories of “reference” specifications are used in determining the defect-free pipeline timing behavior associated with generated test cases: (a) axiomatic specifications of intrinsic machine latencies and bandwidthss (b) proven analytical models for simple basic block and loop test casess and, (c) a stable reference behavioral/functional (pre-RTL) model of the processor under development. We report experimental results obtained in performance validation studies applied to real PowerPC™ processor development projects.

Verifying Temporal Properties of Reactive Systems: A STeP Tutorial

We review a number of formal verification techniques supported by STeP, the Stanford Temporal Prover, describing how the tool can be used to verify properties of several versions of the Bakery Mutual exclusion algorithm for mutual exclusion. We verify the classic two-process algorithm and simple variants, as well as an atomic parameterized version. The methods used include deductive verification rules, verification diagrams, automatic invariant generation, and finite-state model checking and abstraction.

Modeling and formal verification of the Fairisle ATM switch fabric using MDGs

In this paper, we present several techniques for modeling and formal verification of the Fairisle asynchronous transfer mode (ATM) switch fabric using multiway decision graphs (MDGs). MDGs represent a new class of decision graphs which subsumes Bryant's reduced ordered binary decision diagrams (ROBDDs) while accommodating abstract sorts and uninterpreted function symbols. The ATM device we investigated is in use for real applications in the Cambridge University Fairisle network. We modeled and verified the switch fabric at three levels of abstraction: behavior, and register transfer level (RTL) and gate levels. In a first stage, we validated the high-level specification by checking specific safety properties that reflect the behavior of the fabric in its real operating environment. Using the intermediate abstract RTL model, we hierarchically completed the verification of the original gate-level implementation of the switch fabric against the behavioral specification. Since MDGs avoid model explosion induced by data values, this work demonstrates the effectiveness of MDG based verification as an extension of ROBDD-based approaches. All the verifications were carried out automatically in a reasonable amount of CPU time.

Integrated architectural modeling and analysis for high-assurance command and control system design

A RealdTime Architectural Specification (RAS) approach and its application to command and control (C2) systems are presented. Our objective is to establish a formal foundation that will enable us to integrate existing rich but fragmented formal techniques for system specification and verification into a practical and scaleable formal engineering method to support the design and development of highly reliable realdtime distributed systems. The contribution of RAS is twofold: First, it provides a formal system that integrates system’s timing requirements and requirements propagation into the process of architectural modeling and design in such a way that allows us to systematically enforce that the requirements are met in every step of the design process. Second, it offers an incremental and more scaleable approach for design modeling. These two features together make RAS a suitable model for the design of C2 systems. We further present an incremental method for verifying timing properties of an RAS model that helps to reduce the complexity of analysis both at a given design level and across different design levels.

On Design Validation Using Verification Technology

Despite great advances in the area of Formal Verification during the last ten years, simulation is currently the primary means for performing design verification. The definition of an accurate and pragmatic measure for the coverage achieved by a suite of simulation vectors and the related problem of coverage directed automatic test generation are of great importance. In this paper we introduce a new set of metrics, called the Event Sequence Coverage Metrics (ESCMs). Our approach is based on a simple and automatic method to extract the control flow of a circuit so that the resulting state space can be explored for validation coverage analysis and automatic test generation. During simulation we monitor, in addition to state and transition coverage, whether certain control event sequences take place or not. We then combine formal verification techniques, using BDDs as the underlying representation, with traditional ATPG and behavioral test generation techniques to automatically generate additional sequences which traverse uncovered parts of the control state graph, or exercise an uninstantiated control event sequence.

Formalizing space shuttle software requirements

This article describes four case studies in which requirements for new flight software subsystems on NASA's Space Shuttle were analyzed using mechanically supported formal methods. Three of the studies used standard formal specification and verification techniques, and the fourth used state exploration. These applications illustrate two thesis: (1) formal methods complement conventional requirements analysis processes effectively and (2) formal methods confer benefits even when only selectively adopted and applied. The studies also illustrate the interplay of application maturity level and formal methods strategy, especially in areas such as technology transfer, legacy applications, and rapid formalization, and they raise interesting issues in problem domain modeling and in tailoring formal techniques to applications.

Abstraction techniques for validation coverage analysis and test generation

The enormous state spaces which must be searched when verifying the correctness of, or generating tests for, complex circuits precludes the use of traditional approaches. Hard-to-find abstractions are often required to simplify the circuits and make the problems tractable. This paper presents a simple and automatic method to extract the control flow of a circuit so that the resulting state space can be explored for validation coverage analysis and automatic test generation. This control flow, capturing the essential "behavior" of the circuit, is represented as a finite state machine called the ECFM (Extracted Control Flow Machine). Simulation is currently the primary means of verifying large circuits, but the definition of a coverage measure for simulation vectors is an open problem. We define functional coverage as the amount of control behavior covered by the test suite. We then combine formal verification techniques, using BDDs as the underlying representation, with traditional ATPG techniques to automatically generate additional sequences which traverse uncovered parts of the control state graph. We also demonstrate how the same abstraction techniques can complement ATPG techniques when attacking hard-to-detect faults in the control part of the design for which conventional ATPG alone proves to be inadequate or inefficient at best. Results on large designs show significant improvement over conventional algorithms.