SMV Model Research Articles

Model Checking Interactor Specifications

Recent accounts of accidents draw attention to “automation surprises” that arise in safety critical systems. An automation surprise can occur when a system behaves differently from the expectations of the operator. Interface mode changes are one class of such surprises that have significant impact on the safety of a dynamic interactive system. They may take place i>implicitly as a result of other system action. Formal specifications of interactive systems provide an opportunity to analyse problems that arise in such systems. In this paper we consider the role that an i>interactor based specification has as a partial model of an interactive system so that mode consequences can be checked early in the design process. We show how interactor specifications can be translated into the SMV model checker input language and how we can use such specifications in conjunction with the model checker to analyse potential for mode confusion in a realistic case. Our final aim is to develop a general purpose methodology for the automated analysis of interactive systems. This verification process can be useful in raising questions that have to be addressed in a broader context of analysis.

NUSMV: a new symbolic model checker

This paper describes a new symbolic model checker, called NuSMV, developed as part of a joint project between CMU and IRST. NuSMV is the result of the reengineering, reimplementation and, to a limited extent, extension of the CMU SMV model checker. The core of this paper consists of a detailed description of the NuSMV functionalities, architecture, and implementation.

The Formal Design of 1M-gate ASICs

Refinement of a directory based cache coherence protocol specification, to a pipelined hardware implementation is described. The hardware that is analyzed is the most complex part of a 1M-gate ASIC. The design consists of 30,000 lines of synthesizable register transfer-level verilog code, amounting to approximately 200,000 gates. The design contains a pipeline that is 5 levels deep and approximately 150 bits wide. It has a 16 entry, 150 bit wide, context addressable memory (CAM), and includes a 256 × 72 bit RAM. Refinement maps relate the behavior of the high-level protocol model to the hardware implementation. The Cadence Berkeley Labs SMV model checker was used to create the maps and to prove their correctness. There are approximately 1500 proof obligations. The formal model has been used for three tasks. First, to formally diagnose, and then fix broken features in a legacy version of the design. Second, to integrate the legacy sub-system design with a new system design. Finally, it has been used to formally design additional sub-system features required for the new system design. The same hardware designer enhanced the design, created the refinement maps, and formally proved the correctness of the refinements.

A case study in model checking software systems

Model checking is a proven successful technology for verifying hardware. It works, however, on only finite state machines, and most software systems have infinitely many states. Our approach to applying model checking to software hinges on identifying appropriate abstractions that exploit the nature of both the system, S, and the property, θ, to be verified. We check θ on an abstracted, but finite, model of S. Following this approach we verified three cache coherence protocols used in distributed file systems. These protocols have to satisfy this property: “If a client believes that a cached file is valid then the authorized server believes that the client's copy is valid.” In our finite model of the system, we need only represent the “beliefs” that a client and a server have about a cached file; we can abstract from the caches, the files' contents, and even the files themselves. Moreover, by successive application of the generalization rule from predicate logic, we need only consider a model with at most two clients, one server, and one file. We used McMillan's SMV model checker; on our most complicated protocol, SMV took less than 1 s to check over 43600 reachable states.