Assertions Targeting A Diverse Set of Verification Tools

All formal hardware verification tools in the market today interpret hardware description languages (HDLs) based on their synthesis semantics. This limits formal verification to synthesizable designs. The result, either a proof or a counterexample, produced by a formal tool can be inconsistent with simulation due to synthesis and simulation mismatches. And finally, conversion from a synthesized gate-level circuit to a formal model such as a Kripke structure or a Mealy machine is complex for designs containing gated clocks or latches. Existing solutions are often based on heuristics rather than language semantics. In this paper, we propose a new approach that constructs formal models based on simulation semantics. We symbolically simulate HDL designs using non-canonical word-level expressions to represent the values of design signals. We show that the formal model is consistent with simulation at specified sample points, which can be chosen to represent a clock cycle or a transaction. Our approach has been implemented in a tool called Simon. Experimental results show that Simon can efficiently construct formal models for large industrial designs.

Designing the automatic transformation of visual languages

Formal program verification tools check that a program correctly implements its specification. Existing specification languages for well-known programming languages (Ada, C, Java, C#) have been developed independently from the programming language to which they apply. As a result, specifications are expressed separately from the code, typically as stylized comments, and the verification tools often bear no direct relation to the production compiler. We argue that this approach is problematic, and that the compiler and the verification tools should be integrated seamlessly. Based on our current work on the Hi-Lite project to develop a formal verification tool for Ada2012, we show that in an integrated setting, the compiler becomes the centerpiece of the verification architecture, and supports both static proofs and run-time assertion checking. Such an environment does much to simplify software certification.

The area of formal verification of protocols has gained substantial importance in the recent years. The research results and subsequent applications have amply demonstrated that the formal verification tools have indeed helped correct the protocols even after being standardized. However, the standard protocol verification tools and techniques do not verify the security properties of a cryptographic protocol. This has resulted in the emergence of the security protocol verifiers to fill the need. In this paper, taking the two popular security verification tools namely Scyther and ProVerif as the basis, we identify a few security protocols and implement them in both Scyther and ProVerif, to aptly evaluate the tools, in terms of the security properties of the selected protocols. In the process, we not only characteristically present a comparative evaluation of the two tools, but also reveal interesting security properties of the protocols selected, showing their strengths and weaknesses. To the best of our knowledge, this is a unique attempt to juxtapose and evaluate the two verification tools using the selected security protocols.

The Accellera EDA standards body has recently approved the PSL a standard property specification language for use in assertion-based verification via simulation and formal verification tools. This language, which is based on the Sugar language from IBM, is now supported by many EDA vendors. More than 40 individuals representing over 20 companies participated in the efforts to form the PSL standard from its Sugar basis.The tutorial comprises 2 parts. In the first part, we describe the basic principles of PSL/Sugar, focusing on the ease with which complex design behaviors may be described with concise, readable PSL/Sugar assertions that crisply capture design intent. We summarize the temporal constructs of the language, including parameterized sequences and properties, directives, and modeling capabilities. We cover the general timing model of PSL/Sugar, which transparently supports both (single- or multi-clock) synchronous and asynchronous design, and, time permitting, we explain how PSL/Sugar has been defined to ensure consistent semantics for both simulation and formal verification applications.In the second part of the tutorial, we present several applications of PSL/Sugar, ranging from simple to advanced assertion-based verification solutions. These include use of PSL/Sugar for dynamic assertion checking and formal model checking, including support for environment modeling and assume/guarantee reasoning. Examples of commercial verification tools which support the PSL/Sugar languages will also be presented.Participants in the tutorial will have an excellent opportunity to learn about both the language and its applications directly from the speaker, Dr. Danny Geist, who heads a research group in the IBM Haifa lab where Sugar was conceived.

The complexity of designing concurrent and highly-evolving interactive systems has grown to a point where system verification has become a hurdle. Fortunately, formal verification methods have arrived at the right time. They detect errors, inconsistencies and incompleteness at early development stages of a system formally modeled using a formal specification language. -calculus (Milner, 1999) is one such formal language which provides strong mathematical base that can be used for verifying system specifications. But manually verifying the specifications of concurrent systems is a very tedious and error-prone work, especially if the specifications are large. Consequently, an automated verification tool would be essential for efficient system design and development. In addition, formal verification tools are vital ingredient to fully harness the potential of component-based software composition. The authors developed such an automated verification tool which is highly portable and seamlessly integrates with the visualization, reduction and performance evaluation tools introduced (Ahmad & Rahimi, 2008; Rahimi, 2006; Rahimi et al., 2001, 2008) to provide a comprehensive tool for designing and analyzing multi process/agent systems. Open-Bisimulation (Sangiorgi, 1996) concept is utilized as the theoretical base for the design and implementation of the tool which incorporates an expert system implemented in Java Expert System Shell (JESS) (Friedman-Hill, 2003).

Software engineers working in industry seldom try to apply formal methods to solve problems. There are various reasons for this. Sometimes these reasons are understandable---the cost of using formal methods does not make economic sense in many contexts. However, formal methods are also often greeted with scepticism. Formal methods are assumed to take too much time, require tools that are too academic, or to be too mathematical to be understood by practice-oriented software engineers. We tested these assumptions by designing a small course around a framework for program verification, aimed at regular computer science students enrolled in a Master's programme. After four lectures and associated exercises, students were given a small verification task where they had to model and verify a real, non-trivial, C function in Why3. A significant majority of students managed to prove a non-trivial functional specification of this C function in the time allotted, and many also pointed out inherent flaws of this function discovered during formalization. Participants reported no major difficulties or mental hurdles in learning Why3, and considered its approach to be appropriate for selected components of safety-critical software. While formal verification tools such as Why3 still have lots of room for improvement, this experience shows that in a short amount of time, software engineers can be taught to use a program verification tool, and obtain usable results without being fully proficient in it. We further recommend that courses on formal methods should also let students explore these as techniques to be applied, instead of only focusing on the theory behind them, as we expect this to gradually lower the barrier to wider acceptance.

Compilers are fundamental to software development, formal verification tools are well established for building trust in hardware designs, and formal verification is increasingly gaining traction in the world of software. The importance of compilers and verifiers mean that bugs in these tools are potentially very serious. I will give an overview of the state-of-the-art in techniques for using randomized testing - also known as “fuzzing” - for finding bugs in compilers and verifiers automatically, focusing on three case studies arising from work my research group and collaborators: automated testing of graphics shader compilers (which led to the formation of a startup company, GraphicsFuzz, that was acquired by Google), automated testing of a verifying compiler for the Dafny programming language, and automated testing of equivalence checking tools for hardware designs.

Traditional modeling languages and simulators are still separated from formal verification languages and tools. The main reason for this is that formal verification algorithms require a formal model of a system to verify its behavior. However, the automatic generation of such model requires a separate, dedicated compiler. This paper shows an approach how to use the existing simulator to generate a formal model of a system without using yet another compiler, intermediate language or tool. The approach is based on generation of AADD and BDD for symbolic simulation and it is integrated in SystemC AMS modeling language and simulator.

With the development of the nuclear technology, the instrumentation and control (I&C) systems have evolved from the analog systems to the current state-of-the-art digital systems. It has been reported that China has recently developed the digital systems based on Field Programmable Gate Array (FPGA) in CAP1400 nuclear power plant. And the lack of methods in the verification and validation work of the FPGA systems has become an important issue. This thesis describes the basic principles of FPGA, and the development process of FPGA. And then, the thesis proposes an effective improved method—formal verification, describing three methods of formal verification in detail, namely theorem proof, model checking, and equivalence proof. Describing the FPGA verification methodology and pointing out the shortcomings of traditional simulation, comparing the formal verification and traditional simulation verification in terms of complexity, timing, and applications. We also discussed the importance of formal verification method in FPGA. We selected the temperature and power control chip based on FPGA as an example, using System Verilog Assertions (SVA) method of model checking, and verifying the SRAM controller module and the internal calculation module. Through the analysis of the results, this paper proved the feasibility of formal verification methods in the instrumentation and control system of nuclear power plants, and provided some references of verification work for other system chips in instrumentation and control of nuclear power plant in the future work. The thesis showed that verification engineers can use the formal verification method based on SVA to verify the robustness of the system quickly and accurately. This method improves the controllability and observability which are the main drawbacks of the traditional simulation verification. It also avoids several issues in the debug process of traditional simulation verification, improving the accuracy and completeness of the chip verification.

With the advent of multiprocessor embedded platforms, application partitioning and mapping have gained primacy as a design step. The output of this design step is a multithreaded partitioned application where each thread is mapped to a processing element (processor or ASIC) in the multiprocessor platform. This partitioned application must be verified to be consistent with the native unpartitioned application. This verification task is called application (or task) partitioning verification. This work proposes a code-block-level containment-checking -based methodology for application partitioning verification. We use a UML-based code-block-level modeling language which is rich enough to model most designs. We formulate the application partitioning verification problem as a special case of the containment checking problem, which we call the complete containment checking problem . We propose a state space reduction technique specific to the containment checking, reachability analysis, and deadlock detection problems. We propose novel data structures and token propagation methodologies which enhance the efficiency of containment checking. We present an efficient containment checking algorithm for the application partitioning verification problem. We develop a containment checking tool called TraceMatch and present experimental results. We present a comparison of the state space reduction achieved by TraceMatch with that achieved by formal analysis and verification tools like Spin, PEP, PROD, and LoLA.

We describe a hybrid tool for hardware formal verification that links the HOL theorem prover and the MDG (multiway decision graphs) model checker. Our tool supports abstract datatypes and uninterpreted function symbols available in MDG, allowing the verification of high level specifications. The hybrid tool, HOL-MDG, is based on an embedding in HOL of the grammar of the hardware modeling language, MDG-HDL, as well as an embedding of the first-order temporal logic L/sub mdg/ used to express properties for the MDG model checker. Verification with the hybrid tool is faster and more tractable than using either tools separately. We hence obtain the advantages of both verification paradigms.

Chisel is an open-source hardware description language embedded in Scala to facilitate parameterized and reusable digital circuit design. Chisel is becoming increasingly popular and has been used to design RISC-V CPUs, e.g. RocketChip and XiangShan. While Chisel features high-level hardware designs, its verification is still low-level: Low-level (e.g. Verilog) programs are first generated from Chisel programs, then the verification tools are applied to these low-level programs. In this work, we focus on formal verification of arithmetic units. Efficient low-level formal verification of arithmetic units has always been a challenge and remains an active research area, attributed to the state explosion problem brought on by bit widths. To circumvent this problem for arithmetic Chisel designs, we propose an approach to their high-level formal verification so that their correctness is verified for all bit widths at once, instead of for each bit width separately. The key idea is to transform arithmetic Chisel designs into Scala software programs that simulate their behaviors, where the high-level features are preserved, then resort to Stainless, a deductive formal verification tool for Scala. We validate the effectiveness of this approach by formally verifying the correctness of dividers and multipliers in two representative open source RISC-V processors, namely, RocketChip and XiangShan. Compared to the existing proof-assistant-based parameterized verification approaches for arithmetic designs (e.g. Kami), the verification cost in our approach is much lower on average.

Projected control graph for computing relevant program behaviors

Functional verification is a key bottleneck in the cost-effective design of integrated circuits. It is estimated that verification in its entirety accounts for up to 60% of design resources, including duration, computer resources and total personnel. The three primary methods used in logic and functional verification of commercial integrated circuits are simulation, emulation and formal verification. While it is not possible to comprehensively survey the field in a short space, current practice in isolated aspects of all three types of verification are discussed. All design and verification tools work on a model of a design, for example, transaction. register transfer (RT), gate, switch and transistor models. These models are defined by the semantics of the languages that describe the models. But it is not the purpose of this paper to discuss language, but more to discuss technologies, methodologies and applications. In the last five years the verification landscape has changed somewhat. We will emphasize these changes. For example, the rise of testbench languages, the use of assertions and constraints-rather than golden models-and various improvements to formal verification tools have emerged.