Abstract. In this paper, we present an automata-theoretic approach to Hardware/ Software (HW/SW) co-verification. We designed a co-specification framework describing HW/SW systems; synthesized a hybrid Büchi Automaton Pushdown System model for co-verification, namely Büchi Pushdown System (BPDS), from the co-specification; and built a software tool for deciding reachability of BPDS models. Using our approach, we succeeded in co-verifying the Windows driver and the hardware model of the PIO-24 digital I/O card, finding a previously undiscovered software bug. In addition, our experiments have shown that our co-verification approach performs well in terms of time and memory usages.

Abstract. We present an efficient approach to reachability analysis of Büchi Pushdown System (BPDS) models for Hardware/Software (HW/SW) co-verification. This approach utilizes the asynchronous nature of the HW/SW interactions to reduce unnecessary HW/SW state transition orders being explored in co-verification. The reduction is applied when the verification model is constructed. We have realized this approach in our co-verification tool, CoVer, and applied it to the co-verification of two fully functional Windows device drivers with their device models respectively. Both of the drivers are open source and their original C code has been used. CoVer has proven seven safety properties and detected seven previously undiscovered software bugs. Evaluation shows that the reduction can significantly scale co-verification.

Hardware/Software (HW/SW) interfaces are pervasive in computer systems. However, many HW/SW interface implementations are unreliable due to their intrinsically complicated nature. In industrial settings, there are three major challenges to improving reliability. First, as there is no systematic framework for HW/SW interface specifications, interface protocols cannot be precisely conveyed to engineers. Second, as there is no unifying formal model for representing the implementation semantics of HW/SW interfaces accurately, some critical properties cannot be formally verified on HW/SW interface implementations. Finally, few automatic tools exist to help engineers in HW/SW interface development. In this dissertation, we present an automata-theoretic approach to HW/SW coverification that addresses these challenges. We designed a co-specification framework to formally specify HW/SW interface protocols; we synthesized a hybrid Büchi Automaton Pushdown System, namely Büchi Pushdown System (BPDS), as the unifying formal model for HW/SW interfaces; and we created a co-verification tool, CoVer that implements our model checking algorithms and realizes our reduction algorithms for BPDS. The application of our approach to the Windows device/driver framework has resulted in the detection of fifteen specification issues. Furthermore, utilizing CoVer, we discovered twelve real bugs in five drivers. These non-trivial findings have demonstrated the significance of our approach in industrial applications. ii DEDICATION To the memory of my father, Bochun Li To my mother, Jinping Cao To my wife, Xiaojing Liu iii ACKNOWLEDGMENTS This dissertation could not have been accomplished without the help and influence by many generous people. I am sincerely grateful and deeply in debt to them. First and foremost, thanks to my advisor, Prof. Fei Xie, who brought me on board to software engineering and formal methods. When I first met Fei, various wild ideas jumped out of my head, but I was never able to find the right track to approach the real problems. Fei always listened to my ideas with a patient smile and then pointed out the problems. While Ph.D. study is a long trip with enormous possible outcomes, I often plan for the worst. Fei has always encouraged me and cheered me up when I was frustrated. Fei taught me how to be a student, a researcher, and an educator. Dr. Thomas Ball and Dr. Vladimir Levin were very generous to share their visions and ideas with me. The key idea of this research comes from a discussion with them. They spent lots of time and effort in helping me with this research. Every discussion with them was fruitful with ideas. They also helped me edit my papers and critiqued my talks. Vladimir hosted me during my two internships at Microsoft. He also helped me in writing the very first prototype of CoVer in order to deal with bitunion operations of SLAM. Prof. Bryant W. York helped me in many different ways, from computer science to life philosophy. He has broad knowledge and always is ready to help me. He taught me the ide...

Abstract. In this paper, we present a comprehensive approach to model checking component-based systems (including software, hardware, and embedded systems) through abstraction and refinement. This approach is based on assumeguarantee compositional reasoning and features two synergistic techniques: (1) an automatic algorithm to component-based abstraction and (2) a mechanized assistant for abstraction refinement. The key insight to the abstraction algorithm is that a verified property is a natural abstraction of a component. The abstraction algorithm automatically determines which component properties can be included in the abstraction for verifying a system property by determining whether the assumptions of the component properties hold in the context of the system. If the abstraction fails to establish the system property, the refinement assistant determines the causes of the failure, e.g., why a component property is not included, and provides automatic remedies or requests manual remedies. This approach has been applied in component-based hardware/software co-verification of embedded systems. Case studies have shown that this approach is very effective in abstracting component-based embedded systems and guiding abstraction refinement.

In the state-of-the-art hardware/software (HW/SW) component-based co-design, cosimulation, co-verification, and system synthesis.

Abstract-Software drivers are usually developed after hardware devices become available. This dependency can induce a long product cycle. Although co-simulation and co-verification techniques have been utilized to facilitate the driver development, Hardware/Software (HW/SW) interface models, as the test harnesses, are often challenging to specify. Such interface models should have formal semantics, be efficient for testing, and cover all HW/SW behaviors described by HW/SW interface protocols. We present an approach to formalizing HW/SW interface specifications, where we propose a semantic model, relative atomicity, to capture the concurrency model in HW/SW interfaces; demonstrate our approach via a realistic example; elaborate on how we have utilized this approach in device/driver development process; and discuss criteria for evaluating our formal specifications. We have detected fifteen issues in four English specifications. Furthermore, our formal specifications are readily useful as the test harnesses for co-verification, which has discovered twelve real bugs in five industrial driver programs.

In the state-of-the-art hardware/software (HW/SW) component-based co-design, cosimulation, co-verification, and system synthesis.

In component-based hardware/software co-verification, properties of an embedded system are established from properties of its hardware and software components. A major challenge in component-based co-verification is the property formulation problem: (1) what are the system properties to verify, (2) what are the component properties needed for verifying the system properties, and (3) what are the environment assumptions for establishing these properties. We present a pattern-guided approach to the property formulation problem. We develop an embedded architecture description language (EADL). A key feature of EADL is its support to specification of architectural patterns for embedded systems. Such patterns capture recurring system structures and, furthermore, templates for properties to verify on systems following these patterns and strategies for decomposing system properties into component properties. We have applies EADL in co-verification of medical sensor systems , which shows that architectural patterns have major potential in facilitating component-based co-verification.