In this paper we present HySAT, a bounded model checker for linear hybrid systems, incorporating a tight integration of a DPLL---based pseudo---Boolean SAT solver and a linear programming routine as core engine. In contrast to related tools like MathSAT, ICS, or CVC, our tool exploits the various optimizations that arise naturally in the bounded model checking context, e.g.isomorphic replication of learned conflict clauses or tailored decision strategies, and extends them to the hybrid domain. We demonstrate that those optimizations are crucial to the performance of the tool.

Embedded systems are electronic devices that function in the context of a real environment, by sensing and reacting to a set of stimuli. Because of their close interaction with the environment, and to simplify their design, different parts of an embedded system are best described using different notations and different techniques. In this case, we say that the system is heterogeneous. We informally refer to the notation and the rules that are used to specify and verify the elements of heterogeneous systems and their collective behavior as a model of computation. In this paper, we consider different classes of relationships between models of computation and discuss their preservation properties with respect to the model's refinement relation and composition operator. In particular, we focus on abstraction and refinement relationships in the form of abstract interpretations and introduce the notion of conservative approximation. We show that, unlike abstract interpretations, conservative approximations preserve refinement verification results from an abstract to a concrete model while avoiding false positives. We also characterize the relationship between abstract interpretations and conservative approximations, and derive necessary and sufficient conditions to obtain a conservative approximation from a pair of abstract interpretations. In addition, we use the inverse of a conservative approximation to identify components that can be used indifferently in several models, thus enabling reuse across models of computation. The concepts described in this paper are illustrated with examples from continuous time and discrete time models of computation.

Bounded model checking (BMC) is an attractive alternative to symbolic model checking, since it often allows a more efficient verification. The idea of BMC is to reduce the model checking problem to a satisfiability problem of the underlying base logic, so that sophisticated decision procedures can be utilized to check the resulting formula. We present a new approach to BMC that extends current methods in three ways: First, instead of a reduction to propositional logic which restricts BMC to finite state systems, we focus on infinite state systems and therefore consider more powerful, yet decidable base logics. Second, instead of directly unwinding temporal logic formulas, we use special translations to ?-automata that take into account the temporal logic hierarchy and maintain safety and liveness properties. Third, we employ both global and local model checking procedures to take advantage of the different types of specifications that can be handled by these techniques. Based on three-valued logic, our bounded model checking procedures may either prove or disprove a specification, or they may explicitly state that no information has been obtained due to insufficient bounds.

A Promela specification and a set of temporal properties are developed for a basic call service with a number of features. The properties are expressed in the logic LTL.Interactions between features are detected by pairwise analysis of features and properties. The analysis quickly results in both state-space and property case explosion. To overcome this state-spaces are minimised, model checking results generalised through symmetry and bisimulation, and analysis performed automatically using scripts. The result is a more extensive feature interaction analysis than others in the field.

Reductions that aggregate fine-grained transitions into coarser transitions can significantly reduce the cost of automated verification, by reducing the size of the state space. We propose a reduction that can exploit common synchronization disciplines, such as the use of mutual exclusion for accesses to shared data structures. Exploiting them using traditional reduction theorems requires checking that the discipline is followed in the original (i.e., unreduced) system. That check can be prohibitively expensive. This paper presents a reduction that instead requires checking whether the discipline is followed in the reduced system. This check may be much cheaper, because the reachable state space is smaller.

In this presentation, we will deal with verification of custom designed embedded memories. Using our paradigm, one can abstract the behavior of a memory block by a couple of artifacts--one representing its contents, and another representing its interface. We make use of the well known behavioral model known as the Efficient Memory Model (EMM) [29, 30] to represent contents of memories. We provide a methodology using which the behavior of a switch (or equivalently, transistor) level device can be specified using parameterized regular expressions. These entities can be used to abstractly describe the behavior of a bunch of switches that represent the interface of a memory. An automaton that we construct out of an abstract memory interface definition represents an abstraction of the memory interface itself. We show that such an automaton also forms a transducer that is a simulation model in a symbolic simulation environment. An EMM representing a memory core in conjunction with a transducer representing its interface is used as an abstraction of a complete memory during our automatic verification process.We also present a language formalism using which we show that the outputs from the transducers that are generated from the abstract specifications are weaker than or equal to the outputs defined by the regular expressions, in a partially ordered output space. We show that although the regular expressions are defined over exact and legal input strings, the transducers computed from them can provide outputs even when provided with weak or illegal input strings. This is an absolute necessity in order to have the capability to produce outputs when treated as a reactive system embedded in a symbolic simulation environment. Thus, we show that the simulation model generated by our technique is an conservative approximation of the corresponding abstract specification.We present a simple theory of composition that can be used to compose different simulation models used in our technique. Memories consisting of several ports result into several user-provided abstract specifications, which in turn result into several transducers that can be composed into a single transducer. That transducer in turn can be composed to a simulation model of an EMM. Our simple theory of composition also enables one to compose the abstract state space a memory core along with its ports with the concrete state space of the circuitry surrounding the memory core. We have shown that the composite simulation model representing the complete circuit has a partially ordered state space that (a) forms a complete lattice, and (b) that has a monotonic state transition function, that makes it suitable for being used in a symbolic simulation environment making use of Symbolic Trajectory Evaluation (STE) [27].The verification paradigm used is STE. For Motorola high performance microprocessors, switch level models are hand designed assuming that corresponding RTLs are golden models. Therefore, checking of equivalence between the two models is of absolute necessity as the RTL needs to be predictive of silicon behavior. We have developed a tool based on the proposed technique and used it to check that RTL descriptions of custom memories have been correctly implemented by transistor level descriptions of the same, augmented with abstract specifications of their cores. Our example circuits were taken from the state of the art Motorola MPC7450 microprocessor, a Motorola PowerPC. Experimental evidence testify to the effectiveness of the technique in catching subtle bugs in data path circuitry.

We explore the features of rewriting logic and, in particular, of the rewriting logic language Maude as a logical and semantic framework for representing and executing inference systems. In order to illustrate the general ideas we consider two substantial case studies. In the first one, we represent both the semantics of Milner's CCS and a modal logic for describing local capabilities of CCS processes. Although a rewriting logic representation of the CCS semantics is already known, it cannot be directly executed in the default interpreter of Maude. Moreover, it cannot be used to answer questions such as which are the successors of a process after performing an action, which is used to define the semantics of Hennessy-Milner modal logic. Basically, the problems are the existence of new variables in the righthand side of the rewrite rules and the nondeterministic application of the semantic rules, inherent to CCS. We show how these problems can be solved in a general, not CCS dependent way by controlling the rewriting process by means of reflection. This executable specification plus the reflective control of rewriting can be used to analyze CCS processes. The same techniques are also used to implement a symbolic semantics for LOTOS in our second case study. The good properties of Maude as a metalanguage allow us to implement a whole formal tool where LOTOS specifications without restrictions in their data types (given as ACT ONE specifications) can be executed. In summary, we present Maude as an executable semantic framework by providing easy-tool-building techniques for a language given its operational semantics.

In this paper we investigate the object-oriented notion of subtyping in the context of behavioral formalisms. Behavioral formalisms are used to describe the dynamic behavior of active objects, viz. the protocols of interaction that active objects have to obey. Subtyping in OO-formalisms is closely related to the concept of inheritance. The central issue in the choice of subtyping relations among classes is the principle of substitutability: an instance of the subtype should be usable wherever an instance of the supertype was expected. Depending on the interpretation of “usable”, we obtain a variety of subtyping relations: stronger relations, allowing sharing of subtype instances among different clients, and weaker relations, restricting the possibilities of interference of different clients on the subtype instance. The subtyping relations are taxonomically ordered in a hierarchy. Substitutability is formalized via testing scenarios, which provide alternative characterizations for the subtyping relations.

High-performance hardware designs often intersperse combinational logic freely between level-sensitive latch layers (wherein each layer is transparent during only one clock phase), rather than utilizing master-slave latch pairs with no combinational logic between. While such designs may generally achieve much faster clock speeds, this design style poses a challenge to verification. In particular, unless the k-phase netlist N is abstracted to a full-cycle register-based netlist N′, verification of N requires k times (or greater) as many state variables as would be necessary to obtain equivalent verification of N′. We present algorithms to automatically identify and abstract k-phase netlists—i.e., to perform phase abstraction—by selectively eliminating latches. The abstraction is valid for model checking CTL* formulae which reason solely about latches of a single phase. This algorithm has been implemented in the model checker RuleBase, and used to enhance the model checking of IBM's Gigahertz Processor, which would not have been feasible otherwise due to computational constraints. This abstraction has furthermore allowed verification engineers to write properties and environments more efficiently.