A New Formal Verification Approach for Hardware-dependent Embedded System Software

Abstract

This paper describes a method to generate a computational model for formal verification of hardwaredependent software in embedded systems. The computational model of the combined HW/SW system is a program netlist (PN) consisting of instruction cells connected in a directed acyclic graph that compactly represents all execution paths of the software. The model can be easily integrated into SAT-based verification environments such as those based on Bounded Model Checking (BMC). The proposed construction of the model allows for an efficient reasoning of the SAT solver over entire execution paths. Program netlists are compositional. The paper presents how they can be combined to model interrupt-driven systems. We demonstrate the efficiency of our approach by presenting experimental results from the formal verification of an industrial LIN (Local Interconnect Network) bus node, implemented as a software driver on a 32-bit RISC machine.

A HW-dependent software model for cross-layer fault analysis in embedded systems

“…This is done by interleaving the unrolling process with a SAT-based analysis to fill in the missing information. The interleaved analysis also supports a compaction of the model [12]. An example of an instruction cell template is shown in Fig.…”

“…The underlying model of the proposed fault analysis method is called program netlist (PN) [12]. A PN formally models the behavior of a processor with respect to a specific software program.…”

“…As will be elaborated below, this can be achieved by adding additional constants, registers and ports to the fault description of an instruction cell. (In our modeling of PNs, ports represent the memory interface of I/O instructions [12].) The example shown in Fig.…”

“…Adding both the temporal activation conditions and the descriptions of the logical fault behaviors to the instruction cells has the advantage that during the model generation process no complex fault injection is required. As described in [12], the PN model generation steps are interleaved with a SAT-based analysis to prune the control space of the program. This analysis is now extended to the instruction cells with their fault descriptions so that all possible fault scenarios are also included into the generated model.…”

SMASHUP: a toolchain for unified verification of hardware/software co-designs

“…Some academic works [20,23,26,27,28,30,31] have tried to achieve unified verification of hardware and software for specific designs. For instance, in [23], Kroening et al propose a methodology for formally verifying a mixed hardware/software design implemented in SystemC.…”