Formal methods for analyzing the completeness of an assertion suite against a high-level fault model

One of the emerging challenges in formal property verification (FPV) technology is the problem of deciding whether sufficient properties have been written to cover the design intent. Existing literature on FPV coverage does not solve this problem adequately, since they primarily analyze the coverage of a specification against a given implementation. On the other hand, we consider the task of determining the coverage of a formal specification against a high-level fault model that is independent of any specific implementation. We show that such a coverage analysis discovers behavioral gaps in the specification and prompts the design architect to add more properties to close the behavioral gaps. Our results establish that the coverage analysis task at this level is computationally complex, but it is possible to obtain a conservative estimate of the coverage at low cost.

[1]  Amir Pnueli,et al.  On the synthesis of a reactive module , 1989, POPL '89.

[2]  Stephan Merz,et al.  Model Checking , 2000 .

[3]  Timothy Kam,et al.  Coverage estimation for symbolic model checking , 1999, DAC '99.

[4]  Robert P. Kurshan,et al.  A Practical Approach to Coverage in Model Checking , 2001, CAV.

[5]  Franco Fummi,et al.  On the use of a high-level fault model to check properties incompleteness , 2003, First ACM and IEEE International Conference on Formal Methods and Models for Co-Design, 2003. MEMOCODE '03. Proceedings..