Formal Methods (i.e. mathematical, algorithmic) for Software and Hardware Designs and, more generally, Design Tools and Technologies Research @KU http://designtech.ku.edu.tr

Concurrency bug in Boxwood cache Caught using a tool that Tayfun Elmas (PhD Student) developed Write(AB) starts Flush() starts handle T Z Chunk Manager X Y Cache handle X Z Chunk Manager A Y Cache handle A Y Chunk Manager Cache Write(AB) ends Flush() ends handle A Y Chunk Manager A B Cache handle A Y Chunk Manager A B Cache Corrupted data in persistent storage Very tricky bug Developers had not caught it after several years PLDI 2005, June 12-15, Chicago, U.S.

Don Knuth says ... What were the lessons I learned from so many years of intensive work on the practical problem of setting type by computer? One of the most important lessons, perhaps, is the fact that SOFTWARE IS HARD. From now on I shall have significantly greater respect for every successful software tool that I encounter. During the past decade I was surprised to learn that the writing of programs for TeX and Metafont proved to be much more difficult than all the other things I had done (like proving theorems or writing books). The creation of good software demands a significantly higher standard of accuracy than those other things do, and it requires a longer attention span than other intellectual tasks. —Donald Knuth, Keynote address to 11th World Computer Congress (IFIP Congress 89).

Bill Gates says ... "Things like even software verification, this has been the Holy Grail of computer science for many decades but now in some very key areas, for example, driver verification we’re building tools that can do actual proof about the software and how it works in order to guarantee the reliability." Bill Gates, April 18, 2002. Keynote address at WinHec 2002

French Guyana, June 4, 1996 $800 million software failure

Mars, July 4, 1997 Lost contact due to real-time priority inversion bug

Faulty division algorithm (Intel Pentium) $475 million replacement cost Faulty floppy disk controller (Toshiba) $2.1 billion court settlement

$4 billion development effort > 50% system integration & validation cost

400 horses 100 microprocessors

Cost of Finding Flaws Late Feb. 17, 2003 Comp 302, Spring 2003

SCIENCE Natural Systems ENGINEERING Artificial Systems ANALYSIS PURE Abstract Systems THEORY Veri/Falsification APPLIED Concrete Systems EXPERIMENT DESIGN

DESIGN VERI/FALSIFICATION by simulation by test INFORMAL (ad hoc) Poor coverage High recovery cost by proof by algorithm FORMAL (systematic)

Design Process Design : specify and enter the design intent Verify: verify the correctness of design and implementation Implement: refine the design through all phases

Flavors of Verification System (Behavioral) Level Design Verification: Does the design make sense? If I implemented it as designed, would it satisfy the design requirements? Register Transfer Level (RTL) Gate Level Implementation Verification: Is the implementation at the lower layer of abstraction consistent with the higher level? Transistor Level Layout Level

Systems Design and Verification Challenges Heterogeneity (analog, digital, HW/SW) Complexity (~billion transistors, ~millions of lines of code) Time-to-market

Role of Computer-Aided Design and Verification Tools: Helping humans cope Intelligence Quotient Transistors PPC603 10M Pentium 50 80 120 140 160 180 100 80486 Pentium Pro 1M 80386 PPC601 68020 68040 MIPS R4000 68000 100K 8086 10K 4004 8080 1K 100 10 1 1975 1980 1985 1990 1995 Processor Complexity Avg. Human IQ

Simulation/Testing vs. Formal Verification Not complete Need to generate expected behavior Difficult to cover corner cases CPU intensive have to run billions of cycles Can handle large systems Formal Verification Complete wrt specification No need to generate expected behavior Corner cases are automatically taken care of Most of the state-of-the-art methods are memory intensive Memory usage is strongly related with the size of systems to be verified

Exploring the State Space of an FSM Implicit methods: Represent sets of states with decision diagrams Representation size not proportional to number of states But still memory limited

11 10 stars 7 10 transistors 100,000 10 states