Formal Verification Methods Research Articles

Enhancing chip design verification through AI-powered bug detection in RTL code

This paper presents a novel AI-driven approach for enhancing chip design verification through automated bug detection in Register Transfer Level (RTL) code. The proposed method integrates advanced machine learning techniques with domain-specific knowledge of chip design to address the challenges of increasing complexity and time-to-market pressures in modern integrated circuit development. Our system employs a comprehensive data preprocessing pipeline that effectively captures syntactic and semantic features of RTL code, feeding into an innovative attention-based neural network model. The model demonstrates superior bug detection accuracy across diverse design categories and bug types compared to traditional methods and existing AI-assisted approaches. Extensive experimental evaluation on a large-scale dataset of RTL designs, including both open-source projects and industry collaborations, validates the effectiveness of our method. The proposed approach achieves a 95% accuracy in bug detection, with a 28-35% reduction in verification time when applied to real-world chip design projects. The paper addresses the interpretability of AI decisions in the context of chip design, presenting novel visualization techniques that enhance trust and facilitate adoption among RTL designers. While acknowledging current limitations, we discuss future research directions, including integration with formal verification methods and extension to system-level verification scenarios. This work contributes significantly to AI-assisted chip design, paving the way for more efficient and reliable development of complex integrated circuits.

A Formal Verification Approach for Linux Kernel Designing

Although the Linux kernel is widely used, its complexity makes errors common and potentially serious. Traditional formal verification methods often have high overhead and rely heavily on manual coding. They typically verify only specific functionalities of the kernel or target microkernels and do not support continuous verification of the entire kernel. To address these limitations, we introduce LMVM (Linux Kernel Modeling and Verification Method), a formal method based on type theory that ensures the correct design of the Linux architecture. In the model, the kernel is treated as a top-level type, subdivided into the following sublevels: subsystem, dentry, file, struct, function, and base. These types are defined in the structure and relationships. The verification process includes checking the design specifications for both type relationships and the presence of each type. Our contribution lies primarily in the following two points: 1. This is a lightweight verification. As long as the modeling is complete, architectural errors in the design phase can be identified promptly. 2. The designed “model refactor” module supports kernel updating, and the kernel can be continuously verified by extending the kernel model. To test its usefulness, we develop a set of security communication mechanisms in the kernel, which are verified using our method.

Evaluation of visual property specification languages based on practical model-checking experience

Formal verification methods like model checking can provide mathematical proofs of design correctness, so their use is justified in applications where safety or reliability requirements are high. A key challenge for the wider adoption of model checking is the effort and expertise needed in formalizing functional requirements into verifiable properties. A particular challenge in specifying formal properties for industrial instrumentation and control (I&C) logics is accounting for the sequencing and timing issues that arise from, e.g., the dynamic behavior of the plant being controlled. In this paper, we evaluate different visual property specification languages that are aimed at making formal methods more accessible. We have collected 3923 formal properties from practical model checking projects in the nuclear and rail traffic industries and identified the most commonly occurring types of properties. Based on the sample data, a real-world example logic, and our practical experience, we identify requirements for a user-friendly property specification language most suited for our specific domain of industrial I&C.

Formal modeling and verification method for Simulink-MDL requirement model

Abstract As complex safety-critical system software becomes more powerful, so does the complexity of its design requirements. Modeling and analyzing design requirements at an early stage has become an integral part of the entire development process for complex safety-critical system software. Simulink is a system modeling and simulation tool used in aviation and other fields. Its model is stored in the form of MDL files. ART (Avionics Requirement Tools) is a requirement modeling and analysis verification tool for the aviation field. It uses VRM (Variable Relation Model) as the theoretical model and can accept VRM and its extended subsets as input models and verify them in the tool. The work of this paper is oriented to the typical software requirements in the field of avionics systems and proposes a formal modeling and verification method for Simulink-MDL models. First, the composition form and structure of the MDL model are analyzed in the article. The functions and semantics of various elements in the model are given. Then a formal modeling method of the MDL model is given. Finally, a simplified version of the flight guidance control system is used for modeling and verification to demonstrate the usability and effectiveness of this method.

Efficient verification of neural networks based on neuron branching and LP abstraction

With the rapid development and wide application of neural networks in various domains including safety-critical systems, it is more and more important to investigate formal methods to provide strict guarantees on their behavior. As formal verification of a neural network has high computational complexity, caused by the nonlinear nature of activation functions such as ReLU, it is vital to improve the efficiency to solve verification problems. In this work, we propose a complete verification method for neural networks by means of neuron branching and linear programming (LP) abstraction. Specifically, the approach of branch and bound is adopted and a branching strategy is developed to divide a complex verification problem into sub-problems with smaller search space. And for each sub-problem, a part of ReLU neurons are abstracted with LP constraints and the others are accurately encoded with mixed integer linear programming (MILP) constraints, and an abstraction strategy is deployed to guide such mixed LP/MILP encoding so that the problem can be solved with reduced complexity. The method is implemented as a tool named BAVerify (Branching and Abstraction based Verification of neural networks), which is evaluated through experiments on benchmark network models and their verification problems. Experimental results show that BAVerify achieves a 43.13% advantage in verification efficiency compared with state-of-the-art complete methods for formal verification of neural networks.

Software Model Checking Distributed Applications: A Hybrid Approach

Developing reliable distributed systems poses many challenges such as concurrency, failure handling, and scalability. It is due to the non-deterministic execution of threads within processes, and communication means. Formal verification methods, such as model checking, have been used to ensure the reliability of safety-critical systems. This technique systematically explores the complete behavior of the system under test (SUT), investigating each reachable state with different thread schedules. Recent software model-checking tools, employing cache and centralization, have been applied to distributed systems. The caching technique can only check one process at a time, while the centralization technique verifies all processes simultaneously. In the centralization technique, two "ArrayByteQueue" buffers are utilized to store communication and process data byte-by-byte. However, during the backtracking process, the read and write operations, involving data insertion and removal from the queue, become resource-intensive. As a consequence, existing interprocess communication (IPC) models encounter computational limitations and experience a rapid state space explosion. To address these challenges, our work proposes the remodeling of IPC models by introducing a request and response tree structure to store communication data. Additionally, we employ pointers to navigate through the data during the backtracking process. Through experimental evaluations, the proposed implementation choices have demonstrated significantly improved performance across various metrics. By incorporating the request and response tree, we enhance the efficiency of storing communication data, while the use of pointers optimizes navigation during backtracking. This remodeling of IPC models shows promise in mitigating computational limitations and state space explosion, thereby enhancing the model-checking process in distributed systems. Our research contributes to advancing the field of model checking in distributed systems and offers potential solutions to the challenges associated with resource-intensive read and write operations during the model-checking process.

Generalized Formal Model-Verifier: A Formal Approach for Verifying Static Models

The field of software modeling has gained significant popularity in the last decades. By capturing the static aspects of the software requirements, model-driven engineering eases the development and maintenance of software. However, additional constraints, such as invariants on model elements, that the solution must conform to may be too complex to include in the structure of the model itself. External solutions are often used to describe static constraints on models, the most prevalent approach being the Object Constraint Language (OCL) and its formal variants. This paper proposes the Generalized Formal Model-Verifier (GFMV), which is a general approach for verifying static constraints on software models. GFMV employs different formal verification methods based on Kripke Structures. Kripke Structures are used to capture the static structure of the model, then the constraints are formalized using a first-order branching-time logic, the Computational Tree Logic (CTL). Finally, the NuSMV model checker is reused to verify whether the constraints formalized in CTL hold on the formal Kripke Structure. When compared to existing solutions, GFMV offers increased generality and formal proof that the constraints hold on the model. The expressive power and runtime-scalability of the approach are evaluated on a real-world example model and OCL invariants cited from literature.

Analysis of information flow security using software implementing business logic based on stored database program blocks

Objectives. Verification of software security is typically performed using dynamic and static analysis tools. The corresponding types of analysis do not usually consider the business logic of the software and do not rely on data access control policies. A modern approach to resolving this problem is to implement language-based information flow control. Despite a large amount of research, mechanisms for information flow control in software are not widely used in practice. This is because they are complex and impose increased demands on developers. The aim of the work is to transfer information flow control from the language level to the level of formal verification. This will enable the functions of controlling data integrity and confidentiality in software to be isolated into a separate task, which can be resolved by information security analysts.Methods. The research is based on general formal security methods for computer systems and formal verification methods. The algorithm developed by the author for checking security specifications and resolving security violations uses temporal logic of actions.Results. The technology is presented as a step-by-step approach to resolving specific tasks, including the following: designing a database (DB) for storing and processing sensitive information; analyzing dependencies and identifying relevant sets of program blocks in the DB; generating TLA+ specifications for the identified program blocks; labeling specifications according to global security policy rules and additional constraints; applying the specification verification algorithm, and resolving security violations while providing recommendations for software developers. The procedure also involves analyzing labeled data, in order to control the spread of verified program block output values in external software modules.Conclusions. The technology presented herein does not require developers to include redundant annotations describing security policy rules. The function of analyzing information flows with reference to predefined access restrictions is moved to a separate stage of the software development life cycle.

A type system for formal verification of cyber-physical systems C/C++ software

The subject: This study focuses on improving the quality of Cyber-Physical System (CPS) software by eliminating incorrect usage of units of measurement and orientation in C/C++ programs. Incorrect usage often leads to critical errors that conventional systems cannot effectively prevent. Manual examination of code using dimensional and orientation analysis can detect these errors in physical equations, but these methods become impractical when dealing with complex physical computations. Objectives: As suggested by Siano, the proposed approach uses physical quantities and prefixes defined by the International System of Units and orientation operations on physical objects. The elaborated system incorporates dimensional and orientation analysis and metaprogramming techniques. The methods used are dimensional & orientational analysis and metaprogramming. The following results were obtained: ensuring consistency of the units, incorporating orientation operations into the programming model for accurately handling physical object rotations and alignments, and using Siano’s work to precisely manipulate object orientation, thereby reducing the likelihood of orientation-related errors. Checking physical dimensions and orientations during the compilation stage identifies potential software defects before code execution, thereby reducing debugging time and lowering the cost of addressing issues later in development. The elaborated system represents a crucial step towards safer and more dependable Cyber-Physical System applications. This approach allows us to identify approximately 90% of incorrect usage of program variables; additionally, it detects over 50% of erroneous operations during compilation and execution of large-scale programs in real-world conditions. Conclusions. Scientific novelty: it proposed and developed a specialized C++-type library for formal compile-time software verification of Cyber-Physical Systems software. The proposed C++-type library leverages dimensional and orientational analysis to enhance software quality, reliability, and real-time formal verification. Although the proposed method for formal verification is not tailor-made for cyber-physical objects and systems, given its primary focus on software-level concerns, it does exhibit adaptability for verifying general-purpose software that incorporates various physical parameters. This versatility extends to diverse domains such as educational, gaming, and simulation software.

Computational Models in Systems and Synthetic Biology: Short Overview

Computational models used in specifying biological systems represent a complement and become an alternative to more widely used mathematical models. Amongst some of the advantages brought by these computational models, one can mention their executable semantics and mechanistic way of describing biological system phenomena. This short overview report enumerated some of the computational models utilised so far in systems and synthetic biology, the associated analysis and formal verification methods and tools, and a way of facilitating a broader use of this alternative approach.

Formal Verification Method of CTCS-2 Level Train Control Engineering Data Based on the Reduced Ordered Binary Decision Diagram

Formal Verification Method of CTCS-2 Level Train Control Engineering Data Based on the Reduced Ordered Binary Decision Diagram

Empowering Domain Experts With Formal Methods for Consistency Verification of Safety Requirements

Empowering Domain Experts With Formal Methods for Consistency Verification of Safety Requirements

Retracted: A Formal Verification Method of Compilation Based on C Safety Subset

Retracted: A Formal Verification Method of Compilation Based on C Safety Subset

Combining formal methods and Bayesian approach for inferring discrete-state stochastic models from steady-state data

Stochastic population models are widely used to model phenomena in different areas such as cyber-physical systems, chemical kinetics, collective animal behaviour, and beyond. Quantitative analysis of stochastic population models easily becomes challenging due to the combinatorial number of possible states of the population. Moreover, while the modeller easily hypothesises the mechanistic aspects of the model, the quantitative parameters associated to these mechanistic transitions are difficult or impossible to measure directly. In this paper, we investigate how formal verification methods can aid parameter inference for population discrete-time Markov chains in a scenario where only a limited sample of population-level data measurements—sample distributions among terminal states—are available. We first discuss the parameter identifiability and uncertainty quantification in this setup, as well as how the existing techniques of formal parameter synthesis and Bayesian inference apply. Then, we propose and implement four different methods, three of which incorporate formal parameter synthesis as a pre-computation step. We empirically evaluate the performance of the proposed methods over four representative case studies. We find that our proposed methods incorporating formal parameter synthesis as a pre-computation step allow us to significantly enhance the accuracy, precision, and scalability of inference. Specifically, in the case of unidentifiable parameters, we accurately capture the subspace of parameters which is data-compliant at a desired confidence level.

Certification of the proximal gradient method under fixed-point arithmetic for box-constrained QP problems

In safety-critical applications that rely on the solution of an optimization problem, the certification of the optimization algorithm is of vital importance. Certification and suboptimality results are available for a wide range of optimization algorithms. However, a typical underlying assumption is that the operations performed by the algorithm are exact, i.e., that there is no numerical error during the mathematical operations, which is hardly a valid assumption in a real hardware implementation. This is particularly true in the case of fixed-point hardware, where computational inaccuracies are not uncommon. This article presents a certification procedure for the proximal gradient method for box-constrained QP problems implemented in fixed-point arithmetic. The procedure provides a method to select the minimal fractional precision required to obtain a certain suboptimality bound, indicating the maximum number of iterations of the optimization method required to obtain it. The procedure makes use of formal verification methods to provide arbitrarily tight bounds on the suboptimality guarantee. We apply the proposed certification procedure on the implementation of a non-trivial model predictive controller on 32-bit fixed-point hardware.

Formal Specification, Verification and Repair of Contiki’s Scheduler

This article presents an approach for model extraction, formal specification, verification, and repair of the scheduler of Contiki, which is an event-driven lightweight operating system for the Internet of Things (IoT). We first derive a state machine–based abstraction of the scheduler’s modes of operation along with the control flow abstractions of the scheduler’s most important functions. We then use a set of transformation rules to formally specify the scheduler and all its internal functions in Promela. Additional contributions with respect to the conference version of this article include (1) modeling nested function calls in the Promela model of the scheduler using a novel technique amenable to model checking in SPIN; (2) modeling protothreads in Promela; (3) specifying and formally verifying 12 critical requirements of the scheduler; (4) detecting new design flaws in Contiki’s scheduler for the first time (to the best of our knowledge); (5) repairing the model and the source code of Contiki’s scheduler towards fixing the flaws detected through verification, as well as regression verification of the entire model of the scheduler; and (6) experimentally analyzing the time and space costs of verification before and after repair. The proposed formal model of Contiki’s scheduler along with novel modeling techniques enhance our knowledge regarding the most critical components of Contiki and provide reusable methods for formal specification and verification of other event-driven operating systems used in Cyber Physical Systems (CPSs) and the IoT.

A hybrid approach to system verification in early design for complex mechatronic systems based on formal functional semantics

Model-based systems engineering (MBSE) has been adopted as a mainstream design methodology for complex mechatronic systems. According to this paradigm, structured models, typically represented in SysML are used to describe the system of interest from various aspects. Among these models, the system behavior model is fundamental for the subsequent design and hence should be verified against system functions in the early design stage. However, due to the lack of formal semantics of the involved SysML models and software-physical hybrid characteristics of the mechatronic systems, it is not a trivial task to apply existing formal verification methods to solve this problem. In this study, a novel approach relying on hybrid functional semantics is proposed. First, this verification problem is formally defined based on an in-depth analysis of the architectures and traceability between the involved SysML models. Then, a graphical modeling language to represent the hybrid functional semantics in SysML is defined so that the function and behavior models can be enhanced and explicitly correlated by the formal semantics. Finally, based on the semantically enhanced models, the model verification problem is formally re-defined as a semantics verification problem and further divided into two sub-problems, i.e., continuous and discrete semantics verification problems, which are automatically solved by leveraging existing verification techniques including functional-effect compatibility check and symbolic model checking. A mobile robot is illustrated to show the effectiveness of the proposed approach.

Accelerate Safety Model Checking Based on Complementary Approximate Reachability

Model checking is an automatic formal verification method that is widely applied to hardware verification. Safety properties are the mainly verified properties in practice that can be falsified within finite steps if they do not hold for systems. However, state-of-the-art safety model checking algorithms cannot meet the performance requirement driven by the industry as the sizes of (hardware) systems to be verified increase rapidly. Therefore, more efficient techniques are still eagerly in demand. Recently, a new safety model checking technique Complementary Approximate Reachability (CAR) was presented and received considerable concerns from the community. CAR has shown its advantages in unsafe checking (bug finding), but cannot be as competitive as other state-of-the-art techniques, e.g., IC3/PDR, on safe checking (proving correctness). In this paper, we propose four kinds of heuristics, two inspired by IC3/PDR and another two dedicated to CAR, to improve the performance of CAR. We integrate the heuristics into the opensource model checker SimpleCAR and compare the performance to the original CAR and IC3/PDR on 748 instances from the hardware model-checking competitions. Our results show that by fixing the time and memory resources, CAR can solve 124 more instances with the four proposed heuristics, i.e., 53.4% more instances can be solved comparing to the original CAR. Furthermore, CAR in both forward and backward directions can solve 10 more instances than IC3/PDR in corresponding directions, and uniquely solve 44 more instances that IC3/PDR in corresponding directions cannot solve, which increases the capability of the current model-checking portfolio.

Research on Cache Coherence Protocol Verification Method Based on Model Checking

This paper analyzes the underlying logic of the processor’s behavior level code. It proposes an automatic model construction and formal verification method for the cache consistency protocol with the aim of ensuring data consistency in the processor and the correctness of the cache function. The main idea of this method is to analyze the register transfer level (RTL) code directly at the module level and variable level, and extract the key modules and key variables according to the code information. Then, based on key variables, conditional behavior statements are retrieved from the code, and unnecessary statements are deleted. The model construction and simplification of related core states are completed automatically, while also simultaneously generating the attribute library to be verified, using “white list” as the construction strategy. Finally, complete cache consistency protocol verification is implemented in the model detector UPPAAL. Ultimately, this mechanism reduces the 142 state-transition path-guided global states of the cache module to be verified into 4 core functional states driven by consistency protocol implementation, effectively reducing the complexity of the formal model, and extracting 32 verification attributes into 6 verification attributes, reducing the verification time cost by 76.19%.

Leveraging the power of formal methods in the realm of enterprise modeling—On the example of extending the (meta) model verification possibilities of ADOxx with Alloy

Verification in the realm of enterprise modeling (EM) ensures both the consistency of EM language specifications (i.e., meta models and additional well-formedness constraints), as well as of enterprise models. The consistency of enterprise models, which integrate different perspectives on an enterprise, ensures that they contain the necessary, in line with domain-specific rules, information for carrying out a variety of model-driven enterprise analyses. Meta modeling platforms are instrumental in carrying out such verification, especially when multiple languages are applied in tandem, as is inherent to enterprise modeling.This paper reports on our practical experiences of using formal methods for verification in the context of EM. Motivated by the required verification capabilities, we show for one example platform, ADOxx, how it can be chained together with Alloy, an example of lightweight formal method, to capitalize on complementary platform strengths. Namely, ADOxx for language specification and use, and Alloy for verification capabilities. We show the verification, both, on the meta model level, in terms of checking the consistency of language specifications, and on the model level, in terms of checking models against well-formedness constraints. We illustrate the chaining of ADOxx and Alloy on the basis of consistency checks of two languages applied in tandem, namely the value modeling language e3value and the IT infrastructure modeling language, ITML. We also carry out experiments with three further languages to reflect upon the performance of Alloy, and its capability to uncover inconsistencies.