Formal verification Marco A. Peña Universitat Politècnica de Catalunya

Outline l Motivation l Simulation l Formal verification –Theorem proving –Model checking l State space exploration l Formal verification with relative timing l Conclusions

Motivation

Motivation: the problem l System’s complexity: continuous growth is scale and functionality l Probability to introduce design errors increases l System failures are unacceptable: –Software: cost of update, credibility, etc. –Embedded software: no update possible –Hardware: high cost of fabrication/replacement –Safety-critical systems: catastrophic consequences l Delay in time-to-market, loss of money and human lives!!

Motivation: examples l 1994: Floating point divider unit of Pentium microprocessor –Bug in the implementation of the division algorithm –475 million US $ l 1996: Launch failure of Ariane 5 rocket –Wrong data type conversion when computing altitude –Explosion 36 minutes after lunch l 1986: Challenger space shuttle –… l What else?

Motivation: where do bugs come from? l Incorrect specifications l Misinterpretation of specifications l Misunderstandings between designers l Missed cases l Protocol non-conformance l And a long etcetera.

Motivation: what to do? l Develop methods to ensure systems reliability l Detect and fix bugs at the early stages of the design flow l Verification: –General bug-finding techniques. –Usually simulation. l Formal verification: –Methods for 100% bug coverage. –Use mathematical formalisms (logics, automata, etc.) and techniques to reason about the correctness of a system.

Simulation

l Predominant verification method: intuitive idea l Construction of test-cases: manually, randomly, etc. l “Heisenbug” paradigm: when trying to reproduce a bug it never shows up l Example: (x+1) 2 = x 2 + 2x +1 ?

Simulation l Example: –Concurrent processes A and B –Events happen concurrently every operation cycles l Process A X := X l Process B X := X Precondition X = 0 Postcondition X = 1 (!)

Simulation: typical experience Time Functional testing PurgatoryProduct in the market Bugs found

Formal verification

l Ensures consistency with specification for all possible input patterns: exhaustive coverage l Requires: –Formal model of the system –Formal specification language: properties –Reasoning method l Main strategies: –Theorem proving –Model checking

Formal verification l Example: (x+1) 2 = x 2 + 2x +1 ?

Formal verification: theorem proving l Implementation and specification: formulas in some mathematical logic l Deep knowledge of the formalisms and proof techniques l The prover is often human l Useful for: arithmetic algorithms, etc.

Formal verification: theorem proving l Major drawbacks: no guarantee of a proof, complexity of the proof, no counterexample, … l Some impressive results: –AMD K7 floating point unit –Combined with model checking: Intel P4 instruction decoder l Few automatic tools exist l Not a general solution: –Too expert human interaction –Only for small problems or niche applications

Formal verification: model checking l The checker enumerates all the states of the system l Finite state space, but combinatorial explosion ! l Symbolic methods, partial orders, abstractions, etc. l Several automatic tools and success stories exist

Formal verification: model checking l Gaining acceptance but not yet widely used l Major drawbacks: state explosion problem and tools difficult to use for designers l Commercial tools start to appear: Abstract, Chrysalis, IBM, Lucent, Verysys, … l Companies have increasing interest: IBM, Intel, AT&T, etc.  Oportunity! l Not a general solution: –Combination with theorem proving –Combination with semi-formal strategies

State space exploration

l Combinatorial explosion l Symbolic representations: BDDs

State space exploration Some states do not exist, but …

State space exploration Time incorporates a new source of exponentiality !!

Formal verification with Relative Timing

Verification approach: main features l Model checking-like approach for timed systems l Iterative incremental refinement of the untimed state space by: –Off-line timing analysis on small acyclic graphs, and –Incorporation of Relative Timing constraints l Verification of temporal safety properties l BDD-based symbolic representation: large untimed state spaces l Backannotation: sufficient relative timing constraints for correctness are reported, or counterexample trace

Verification approach: system model l Timed Transition Systems: Transition System + delay bounds

Verification approach

Symbolic state space exploration and failure detection Verification approach

Failure states Failure trace Event structure x a b c g d Timing analysis Composition Verification approach [1,2] [3,4] [1,2]

Failure trace Event structure x a b c g d Timing analysis Composition Verification approach [1,2] [3,4] [1,2]

Verification approach: flow

Conclusions

Size of the system (state bits) Probability of verification Research Real systems %

Conclusions: research l Research in Spain: University –PhD programs, FI/FPI grants –Possible stages in foreign universities/companies l Verification teams in companies grow much faster than design teams: oportunity! l Companies and research centers: –USA and Europe –PhD required

Conclusions: collaboration, projects,… l Long list of open problems: –Real case studies: circuits, protocols, etc. –Implementations of other techniques for comparison –Parallel implementations: clusters, etc. –Combination of techniques: formal and semi-formal, etc. –…