Formal methods use mathematical models for analysis and verification at any part of the program life-cycle. We describe the state of the art in the industrial use of formal methods, concentrating on their increasing use at the earlier stages of specification and design. We do this by reporting on a new survey of industrial use, comparing the situation in 2009 with the most significant surveys carried out over the last 20 years. We describe some of the highlights of our survey by presenting a series of industrial projects, and we draw some observations from these surveys and records of experience. Based on this, we discuss the issues surrounding the industrial adoption of formal methods. Finally, we look to the future and describe the development of a Verified Software Repository, part of the worldwide Verified Software Initiative. We introduce the initial projects being used to populate the repository, and describe the challenges they address.

/pdf/formal-methods-practice-and-experience-2ooioh81ba.pdf

Formal methods: Practice and experience

ion and Compositional Techniques From Asymmetry to Full Symmetry: New Techniques for Symmetry Reduction in Model Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 E.Allen Emerson, Richard J. Trefler Automatic Error Correction of Large Circuits Using Boolean Decomposition and Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Dirk W. Hoffmann, Thomas Kropf Abstract BDDs: A Technique for Using Abstraction in Model Checking . . . 172 Edmund Clarke, Somesh Jha, Yuan Lu, Dong WangBDDs: A Technique for Using Abstraction in Model Checking . . . 172 Edmund Clarke, Somesh Jha, Yuan Lu, Dong Wang Theorem Proving Related Approaches Formal Synthesis at the Algorithmic Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Christian Blumenröhr, Viktor Sabelfeld Xs Are for Trajectory Evaluation, Booleans Are for Theorem Proving . . . . . 202 Mark Aagaard, Thomas Melham, John O’Leary Verification of Infinite State Systems by Compositional Model Checking . . 219 K.L.McMillan Symbolic Simulation/Symbolic Traversal Formal Verification of Designs with Complex Control by Symbolic Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Gerd Ritter, Hans Eveking, Holger Hinrichsen Hints to Accelerate Symbolic Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Kavita Ravi, Fabio Somenzi Specification Languages and Methodologies Modeling and Checking Networks of Communicating Real-Time Processes . 265 Jürgen Ruf, Thomas Kropf ”Have I Written Enough Properties?” A Method of Comparison between Specification and Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Sagi Katz, Orna Grumberg, Danny Geist Program Slicing of Hardware Description Languages . . . . . . . . . . . . . . . . . . . . 298 E.Clarke, M.Fujita, S.P.Rajan, T.Reps, S.Shankar, T.Teitelbaum Table of

/pdf/correct-hardware-design-and-verification-methods-1ukbancx0m.pdf

Correct Hardware Design and Verification Methods

We report on the successful application of a mechanical theorem prover to the problem of verifying the division microcode program used on the AMD5/sub K/86 microprocessor. The division algorithm is an iterative shift and subtract type. It was implemented using floating point microcode instructions. As a consequence, the floating quotient digits have data dependent precision. This breaks the constraints of conventional SRT division theory. Hence, an important question was whether the algorithm still provided perfectly rounded results at 24, 53, or 64 bits. The mechanically checked proof of this assertion is the central topic of the paper. The proof was constructed in three steps. First, the divide microcode was translated into a formal intermediate language. Then, a manually created proof was transliterated into a series of formal assertions in the ACL2 dialect. After many expansions and modifications to the original proof, the theorem prover certified the assertion that the quotient will always be correctly rounded to the target precision.

A mechanically checked proof of the AMD5/sub K/86/sup TM/ floating-point division program

J.R. Burch and D.L. Dill (1994) described an automatic method for verifying a pipelined processor against its instruction set architecture (ISA). We describe three techniques for improving this method. We show how the combination of these techniques allows for the automatic verification of the control logic of a pipelined, superscalar implementation of a subset of the DLX architecture.

/pdf/techniques-for-verifying-superscalar-microprocessors-3sowqdfsyd.pdf

Techniques for verifying superscalar microprocessors

We describe a framework for verifying a pipelined microprocessor whose implementation contains precise exceptions, external interrupts, and speculative execution. We present our correctness criterion which compares the state transitions of pipelined and non-pipelined machines in presence of external interrupts. To perform the verification, we created a table-based model of pipeline execution. This model records committed and in-flight instructions as performed by the micro-architecture. Given that certain requirements are met by this table-based model, we have mechanically verified our correctness criterion using the ACL2 theorem prover.

Processor verification with precise exceptions and speculative execution

Formal verification using interactive proof-checkers has been used successfully to verify a wide variety of moderate-sized hardware designs. The industry is beginning to look at formal verification as an alternative to simulation for obtaining higher assurance than is currently possible. However, many questions remain regarding its use in practice: Can these techniques scale up to industrial systems, where are they likely to be useful, and how should industry go about incorporating them into practice? This paper describes a project recently undertaken by SRI International and Collins Commercial Avionics, a division of Rockwell International to explore some of these questions. The project formally specified in SRI's PVS language a Rockwell proprietary pipelined microprocessor (the AAMP5, built using almost half a million transistors) at both the instruction-set and register-transfer levels and used the PVS theorem prover to show the microcode correctly implemented the instruction-level specification for a representative subset of instructions. The key results of the project were the development of a practical methodology for microprocessor verification in industrial settings and the discovery of both actual and seeded errors.

M.K. Srivas

Papers

Applying formal verification to a commercial microprocessor