Hardware and software systems will inevitably grow in scale and functionality. Because of this increase in complexity, the likelihood of subtle errors is much greater. Moreover, some of these errors may cause catastrophic loss of money, time, or even human life. A major goal of software engineering is to enable developers to construct systems that operate reliably despite this complexity. One way of achieving this goal is by using formal methods, which are mathematically based languages, techniques, and tools for specifying and verifying such systems. Use of formal methods does not a priori guarantee correctness. However, they can greatly increase our understanding of a system by revealing inconsistencies, ambiguities, and incompleteness that might otherwise go undetected. The first part of this report assesses the state of the art in specification and verification. For verification, we highlight advances in model checking and theorem proving. In the three sections on specification, model checking, and theorem proving, we explain what we mean by the general technique and briefly describe some successful case studies and well-known tools. The second part of this report outlines future directions in fundamental concepts, new methods and tools, integration of methods, and education and technology transfer. We close with summary remarks and pointers to resources for more information.

/pdf/formal-methods-state-of-the-art-and-future-directions-10ye4ieh6c.pdf

Formal methods: state of the art and future directions

IEEE transactions on computer-aided design of integrated circuits and systems : a publication of the IEEE Circuits and Systems Society

Embeddedsystemsareofgrowingimportanceinindustry. Forexample,inatoday'svehicleahugenumberofembeddedandcommunicating systems can be found. Exhaustive testing of such systems is a requirement, because changes after deliveryand use are expensive and sometimes even impossible. In this paper we propose the use of qualitative models, which are anabstraction of quantitative physical models, for test case generation and test execution. In particular, we show how Simulinkmodels from which control programs are automatically extracted can be tested with respect to qualitative models. SinceSimulink models are heavily used in industry, the approach is of practical interest.Keywords: conformance testing, hybrid systems, qualitative reasoning, qrioconf, Garp3 1 Introduction In industry and especially in the automotive industry Simulink is often used to implementcontrol programs for various purposes. One reason is that those models can be directlyconverted into C code, which runs on the vehicle's electronic control units (ECUs). As aconsequence Simulink models have to be tested thoroughly. This holds in particular forsafety critical systems. In order to meet the safety and quality criteria of such modelsautomated test case generation and more specically model-based testing is of specicinterest but has hardly been explored. In order to ll this gap we present an approach thatmakes use of qualitative models for model-based test cases generation.Qualitative models represent basically cause-effect relationships and constraints onmodel variables. They can be seen as an abstraction of the usually implemented quan-titative differential equation models when using Simulink or other modeling languages.Hence, Simulink models are a renement of qualitative models. This is in contrast to theuse of other means for representing models in this domain like hybrid automata, whichshares basically the same abstraction level with Simulink models.Inordertoallowforusingqualitativemodelsformodel-basedtestingwehavetospecifythe equality relation between the specication and the implementation. For this purpose

Electronic Notes in Theoretical Computer Science

ion and Compositional Techniques From Asymmetry to Full Symmetry: New Techniques for Symmetry Reduction in Model Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 E.Allen Emerson, Richard J. Trefler Automatic Error Correction of Large Circuits Using Boolean Decomposition and Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Dirk W. Hoffmann, Thomas Kropf Abstract BDDs: A Technique for Using Abstraction in Model Checking . . . 172 Edmund Clarke, Somesh Jha, Yuan Lu, Dong WangBDDs: A Technique for Using Abstraction in Model Checking . . . 172 Edmund Clarke, Somesh Jha, Yuan Lu, Dong Wang Theorem Proving Related Approaches Formal Synthesis at the Algorithmic Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Christian Blumenröhr, Viktor Sabelfeld Xs Are for Trajectory Evaluation, Booleans Are for Theorem Proving . . . . . 202 Mark Aagaard, Thomas Melham, John O’Leary Verification of Infinite State Systems by Compositional Model Checking . . 219 K.L.McMillan Symbolic Simulation/Symbolic Traversal Formal Verification of Designs with Complex Control by Symbolic Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Gerd Ritter, Hans Eveking, Holger Hinrichsen Hints to Accelerate Symbolic Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Kavita Ravi, Fabio Somenzi Specification Languages and Methodologies Modeling and Checking Networks of Communicating Real-Time Processes . 265 Jürgen Ruf, Thomas Kropf ”Have I Written Enough Properties?” A Method of Comparison between Specification and Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Sagi Katz, Orna Grumberg, Danny Geist Program Slicing of Hardware Description Languages . . . . . . . . . . . . . . . . . . . . 298 E.Clarke, M.Fujita, S.P.Rajan, T.Reps, S.Shankar, T.Teitelbaum Table of

/pdf/correct-hardware-design-and-verification-methods-1ukbancx0m.pdf

Correct Hardware Design and Verification Methods

http://www.cas.mcmaster.ca/~sancheg/EE_UCU2006_thesis/biblio/Methods%20for%20Evaluating%20and%20Covering%20the%20Design%20Space%20during%20Early%20Design%20Development%20%28ucb-erl_m03-32_DSE_survey%29.pdf

Methods for evaluating and covering the design space during early design development

We developed an original method to synthesize monitors from declarative specifications written in the PSL standard. Monitors observe sequences of values on their input signals, and check their conformance to a specified temporal expression. Our method implements both the weak and strong versions of PSL FL operators, and has been proven correct using the PVS theorem prover. This paper discusses the salient aspects of the proof of our prototype implementation for on-line design verification

/pdf/proven-correct-monitors-from-psl-specifications-7b9solsw2n.pdf

Proven correct monitors from PSL specifications

Prevail, a formal verification environment for proving the equivalence of two very-high-speed integrated circuit hardware description language (VHDL) design architectures, is described. For simple bit-level combinational descriptions, the environment calls upon a tautology checker. For parameterized repetitive structures and for more abstract sequential designs, the program translates descriptions into recursive functions according to predefined templates and generates a theorem acceptable to the Bover-Moore theorem prover. The specification, implementation, and functional representation of a sequential example are presented. >

Formal verification of VHDL descriptions in the Prevail environment

The current technology allows the integration on a single die of complex systems-on-chip (SoCs) that are composed of manufactured blocks (IPs), interconnected through specialized networks on chip (NoCs). IPs have usually been validated by diverse techniques (simulation, test, formal verification) and the key problem remains the validation of the communication infrastructure. This paper addresses the formal verification of NoCs by means of a mechanized proof tool, the ACL2 theorem prover. A metamodel for NoCs has been developed and implemented in ACL2. This metamodel satisfies a generic correctness statement. Its verification for a particular NoC instance is reduced to discharging a set of proof obligations for each one of the NoC constituents. The methodology is demonstrated on a realistic and state-of-the-art design, the Spidergon network from STMicroelectronics.

/pdf/a-formal-approach-to-the-verification-of-networks-on-chip-2ly1wtaatu.pdf

A formal approach to the verification of networks on chip

We present a new diagnostic algorithm for localising design errors in sequential circuits. The specification and the implementation may have different number of state variables, and different state encoding. The algorithm is based on the new concept of possible next states describing the possible states of the circuit due to the existence of the error. Results obtained on benchmark circuits show that the error is always found, with an execution time proportional to the product of the circuit size, and the length of the test sequences used.

/pdf/design-error-diagnosis-in-sequential-circuits-34knla2gmg.pdf

Design error diagnosis in sequential circuits

Networks on chip are emerging as a promising solution for the design of complex systems on a chip, to interconnect manufactured IP cores, and the need to formally guarantee their correctness is crucial. In a NoC centered design, the individual IP's are considered already validated. This paper addresses the validation of the communication infrastructure. A generic formal model for NoC's has been developed and implemented in the ACL2 theorem prover. As an application, the HERMES network has been formalized in this model, and we show that both formal proofs and simulation experiments can be performed in ACL2

Dominique Borrione

Papers

Proven correct monitors from PSL specifications

Formal verification of VHDL descriptions in the Prevail environment

A formal approach to the verification of networks on chip

Design error diagnosis in sequential circuits

A Generic Model for Formally Verifying NoC Communication Architectures: A Case Study