Our growing dependence on increasingly complex computer and software systems necessitates the development of formalisms, techniques, and tools for assessing functional properties of these systems. One such technique that has emerged in the last twenty years is model checking, which systematically (and automatically) checks whether a model of a given system satisfies a desired property such as deadlock freedom, invariants, and request-response properties. This automated technique for verification and debugging has developed into a mature and widely used approach with many applications. Principles of Model Checking offers a comprehensive introduction to model checking that is not only a text suitable for classroom use but also a valuable reference for researchers and practitioners in the field. The book begins with the basic principles for modeling concurrent and communicating systems, introduces different classes of properties (including safety and liveness), presents the notion of fairness, and provides automata-based algorithms for these properties. It introduces the temporal logics LTL and CTL, compares them, and covers algorithms for verifying these logics, discussing real-time systems as well as systems subject to random phenomena. Separate chapters treat such efficiency-improving techniques as abstraction and symbolic manipulation. The book includes an extensive set of examples (most of which run through several chapters) and a complete set of basic results accompanied by detailed proofs. Each chapter concludes with a summary, bibliographic notes, and an extensive list of exercises of both practical and theoretical nature.

/pdf/principles-of-model-checking-249iimickz.pdf

Principles of Model Checking

Hardware and software systems will inevitably grow in scale and functionality. Because of this increase in complexity, the likelihood of subtle errors is much greater. Moreover, some of these errors may cause catastrophic loss of money, time, or even human life. A major goal of software engineering is to enable developers to construct systems that operate reliably despite this complexity. One way of achieving this goal is by using formal methods, which are mathematically based languages, techniques, and tools for specifying and verifying such systems. Use of formal methods does not a priori guarantee correctness. However, they can greatly increase our understanding of a system by revealing inconsistencies, ambiguities, and incompleteness that might otherwise go undetected. The first part of this report assesses the state of the art in specification and verification. For verification, we highlight advances in model checking and theorem proving. In the three sections on specification, model checking, and theorem proving, we explain what we mean by the general technique and briefly describe some successful case studies and well-known tools. The second part of this report outlines future directions in fundamental concepts, new methods and tools, integration of methods, and education and technology transfer. We close with summary remarks and pointers to resources for more information.

/pdf/formal-methods-state-of-the-art-and-future-directions-10ye4ieh6c.pdf

Formal methods: state of the art and future directions

This paper describes a new symbolic model checker, called NuSMV, developed as part of a joint project between CMU and IRST. NuSMV is the result of the reengineering, reimplementation and, to a limited extent, extension of the CMU SMV model checker. The core of this paper consists of a detailed description of the NuSMV functionalities, architecture, and implementation.

/pdf/nusmv-a-new-symbolic-model-checker-10i04hxity.pdf

NUSMV: a new symbolic model checker

This paper describes NUSMV, a new symbolic model checker developed as a joint project between Carnegie Mellon University (CMU) and Istituto per la Ricerca Scientifica e Tecnolgica (IRST) NUSMV is designed to be a well structured, open, flexible and documented platform for model checking In order to make NUSMV applicable in technology transfer projects, it was designed to be very robust, close to the standards required by industry, and to allow for expressive specification languages NUSMV is the result of the reengineering, reimplementation and extension of SMV [6], version 244 (SMV from now on) With respect to SMV, NUSMV has been extended and upgraded along three dimensions First, from the point of view of the system functionalities, NUSMV features a textual interaction shell and a graphical interface, extended model partitioning techniques, and allows for LTL model checking Second, the system architecture of NUSMV has been designed to be highly modular and open The interdependencies between different modules have been separated, and an external, state of the art BDD package [8] has been integrated in the system kernel Third, the quality of the implementation has been strongly enhanced This makes of NUSMV a robust, maintainable and well documented system, with a relatively easy to modify source code NUSMV is available at http://nusmvirstitcit/

/pdf/nusmv-a-new-symbolic-model-verifier-4lmghkdrsu.pdf

NUSMV: A New Symbolic Model Verifier

ABC is a public-domain system for logic synthesis and formal verification of binary logic circuits appearing in synchronous hardware designs ABC combines scalable logic transformations based on And-Inverter Graphs (AIGs), with a variety of innovative algorithms A focus on the synergy of sequential synthesis and sequential verification leads to improvements in both domains This paper introduces ABC, motivates its development, and illustrates its use in formal verification.

/pdf/abc-an-academic-industrial-strength-verification-tool-1fsbek5kfl.pdf

ABC: an academic industrial-strength verification tool

ion Manual abstraction can be performed by giving a file containing the names of variables to abstract. For each variable appearing in the file, a new primary input node is created to drive all the nodes that were previously driven by the variable. Abstracting a net effectively allows it to take any value in its range, at every clock cycle. Fair CTL model checking and language emptiness check VIS performs fair CTL model checking under Buchi fairness constraints. In addition, VIS can perform language emptiness checking by model checking the formula EG true. The language of a design is given by sequences over the set of reachable states that do not violate the fairness constraint. The language emptiness check can be used to perform language containment by expressing the set of bad behaviors as another component of the system. If model checking or language emptiness fail, VIS reports the failure with a counterexample, (i.e., behavior seen in the system that does not satisfy the property for model checking, or valid behavior seen in the system for language emptiness). This is called the “debug” trace. Debug traces list a set of states that are on a path to a fair cycle and fail the CTL formula. Equivalence checking VIS provides the capability to check the combinational equivalence of two designs. An important usage of combinational equivalence is to provide a sanity check when re-synthesizing portions of a network. VIS also provides the capability to test the sequential equivalence of two designs. Sequential verification is done by building the product finite state machine, and checking whether a state where the values of two corresponding outputs differ, can be reached from the set of initial states of the product machine. If this happens, a debug trace is provided. Both combinational and sequential verification are implemented using BDD-based routines. Simulation VIS also provides traditionaldesign verification in the form of a cycle-based simulator that uses BDD techniques. Since VIS performs both formal verification and simulation using the same data structures, consistency between them is ensured. VIS can generate random input patterns or accept user-specified input patterns. Any subtree of the specified hierarchy may be simulated.

/pdf/vis-a-system-for-verification-and-synthesis-3avqy7vpsc.pdf

VIS: A System for Verification and Synthesis

Functional and timing verification are currently the bottlenecks in many design efforts. Simulation and emulation are extensively used for verification. Formal verification is now gaining acceptance in advanced design groups. This has been facilitated by the use of binary decision diagrams (BDDs). This paper describes the essential features of HSIS, a BDD-based environment for formal verification: 1. Open language design, made possible by using a compact and expressive intermediate format known as BLIF-MV. Currently, a synthesis subset of Verilog is supported. 2. Support for both model checking and language containment in a single unified environment, using expressivefairness constraints. 3. Efficient BDD-based algorithms. 4. Debugging environment for both language containment and model checking. 5. Automatic algorithms for the early quantification problem. 6. Support for state minimization using bisimulation and similar techniques. HSIS allows us to experiment with formal verification techniques on a variety of design problems. It also provides an environment for further research in formal verification.

/pdf/hsis-a-bdd-based-environment-for-formal-verification-3jhlq31ofz.pdf

HSIS: A BDD-Based Environment for Formal Verification

Compiling Verilog into timed finite state machines

Synthesizing multi-phase HDL programs

With the advent of advanced CAD tools, people are now able to design multi-million gate chips. Generally, each of these tools has its speciic view and model of the world. To represent designs in such a way that tools can understand and manipulate them, one needs to use certain languages. Hardware Description Languages (HDLs) like Verilog or VHDL are developed as description languages or simulator programming languages to describe the behavior of circuits at various abstraction levels. However, they suuer from the fact that they are based on the event-driven model, which does not match well with the Finite State Machine (FSM) model which is used by lots of synthesis, cycle-simulation, or veriication engines. Therefore, one needs to maintain multiple \views" of a design in order to use diierent tools. This is ineecient and error-prone. On the other hand, there are languages that are based on FSMs or extensions of FSMs (sometimes these languages are also referred to as synchronous languages). Nonetheless, due to the causality (or combinational loops) problem that is intrinsic to these languages, one often needs to perform causality analysis (a global analysis, which is sometimes quite expensive for large designs) before feeding designs to the synthesis, veriication, or simulation engines because lots of the core algorithms in these engines cannot take designs with combinational loops. Therefore, they do not scale well for large designs. In this dissertation, we introduce a new hardware design language { V++. The heart of V++ is a new concept in hardware design languages: an automatically designed and implemented communications protocol, embedded by a compiler in the design itself. 2 This protocol plays a role in hardware design exactly equivalent to the role of the program stack in software: it permits transparent, automatic communication between modules in a hardware design, exactly as the program stack permits automatic, transparent communication between subprograms. This protocol is eecient, generalizes current design practice, and introduces little overhead in terms of the cycle time or the area of a typical system. Incorporating this protocol in the language itself eliminates a number of communication bugs, frees the designer from the task of writing communications code, and ensures that two communicating modules follow the same low-level protocol. V++ is targeted at the general problem of hardware design: speciically, at the problem of representing and manipulating a design which is an assembly of a collection of predesigned components. V++ is …

Szu-Tsung Cheng

Papers

VIS: A System for Verification and Synthesis

HSIS: A BDD-Based Environment for Formal Verification

Compiling Verilog into timed finite state machines

Synthesizing multi-phase HDL programs

Compilation, synthesis, and simulation of hardware description languages: the compositional models of hdl's