1. Formal Methods (i.e. mathematical, algorithmic) for Software and Hardware Designs and, more generally, Design Tools and Technologies

3. Concurrency bug in Boxwood cache Caught using a tool that Tayfun Elmas (PhD Student) developed
Write(AB) starts
Flush() starts
handle
T Z
Chunk Manager
X Y
Cache
handle
X Z
Chunk Manager
A Y
Cache
handle
A Y
Chunk Manager
Cache
Write(AB) ends
Flush() ends
handle
A Y
Chunk Manager
A B
Cache
handle
A Y
Chunk Manager
A B
Cache
Corrupted data in persistent storage
Very tricky bug
Developers had not caught it after several years
PLDI 2005, June 12-15, Chicago, U.S.

5. Don Knuth says ...
What were the lessons I learned from so many years of intensive work on the practical problem of setting type by computer?
One of the most important lessons, perhaps, is the fact that SOFTWARE IS HARD.
From now on I shall have significantly greater respect for every successful software tool that I encounter.
During the past decade I was surprised to learn that the writing of programs for TeX and Metafont proved to be much more difficult than all the other things I had done (like proving theorems or writing books).
The creation of good software demands a significantly higher standard of accuracy than those other things do, and it requires a longer attention span than other intellectual tasks.
—Donald Knuth, Keynote address to 11th World Computer Congress (IFIP Congress 89).

6. Bill Gates says ...
"Things like even software verification, this has been the Holy Grail of computer science for many decades but now in some very key areas, for example, driver verification we’re building tools that can do actual proof about the software and how it works in order to guarantee the reliability." Bill Gates, April 18, Keynote address at WinHec 2002

7. French Guyana, June 4, 1996
$800 million software failure

8. Mars, July 4, 1997
Lost contact due to real-time priority inversion bug

9. Faulty division algorithm (Intel Pentium)
$475 million replacement cost
Faulty floppy disk controller (Toshiba)
$2.1 billion court settlement

10. $4 billion development effort
> 50% system integration & validation cost

11. 400 horses
100 microprocessors

12. Cost of Finding Flaws Late
Feb. 17, 2003
Comp 302, Spring 2003

13. SCIENCE
Natural Systems
ENGINEERING
Artificial Systems
ANALYSIS
PURE
Abstract Systems
THEORY
Veri/Falsification
APPLIED
Concrete Systems
EXPERIMENT
DESIGN

14. DESIGN VERI/FALSIFICATION
by simulation
by test
INFORMAL (ad hoc)
Poor coverage High recovery cost
by proof
by algorithm
FORMAL (systematic)

15. Design Process Design : specify and enter the design intent Verify:
verify the correctness of design and implementation
Implement: refine the design through all phases

16. Flavors of Verification
System (Behavioral) Level
Design Verification: Does the design make sense? If I
implemented it as designed,
would it satisfy the design
requirements?
Register Transfer Level (RTL)
Gate Level
Implementation Verification: Is the implementation at the lower layer of abstraction consistent with the higher level?
Transistor Level
Layout Level

17. Systems Design and Verification Challenges
Heterogeneity (analog, digital, HW/SW)
Complexity (~billion transistors, ~millions of lines of code)
Time-to-market

18. Role of Computer-Aided Design and Verification Tools: Helping humans cope
Intelligence
Quotient
Transistors
PPC603
10M
Pentium 50 80
120
140
160
180
100
80486
Pentium Pro 1M
80386
PPC601
68020
68040
MIPS R4000
68000
100K
8086
10K
4004
8080 1K
100 10 1
1975
1980
1985
1990
1995
Processor Complexity
Avg. Human IQ

19. Simulation/Testing vs. Formal Verification
Not complete
Need to generate expected behavior
Difficult to cover corner cases
CPU intensive
have to run billions of cycles
Can handle large systems
Formal Verification
Complete wrt specification
No need to generate expected behavior
Corner cases are automatically taken care of
Most of the state-of-the-art methods are memory intensive
Memory usage is strongly related with the size of systems to be verified

20. Exploring the State Space of an FSM
Implicit methods: Represent sets of states with decision
diagrams
Representation size not
proportional to number of states
But still memory limited

21. 11
10 stars 7
10 transistors
100,000
states