Formal verification

We use math to check tools. We want to make sure they work right. This helps computers stay safe. It helps them do what they should. We can check code this way. It is a smart way to work.

Math can prove if a tool is correct. People use it for computer parts. They also use it for code. This helps fix mistakes. It can even check how networks work.

Some tools are very safe because of math. One special system is called seL4. Another is called CompCert. These use math to stay right. It is a very strong way to build things. We can use math to build better tools.

How do we know a computer system is perfect? We use formal verification. This is a way to prove a system works correctly. We use math to do this. Instead of just testing, we use math to show the system follows rules. These rules are called a formal specification.

There are two main ways to do this. The first is called model checking. This way looks at every possible state of a system. It is often automatic. The second way is deductive verification. This way uses mathematical proofs to check the system. It can be harder because people must help the math.

This work helps make very safe tools. For example, people use it for computer chips. It is also used for software. Some systems are very high quality. One is called seL4. It is a special part of an operating system. Another is CompCert. It is a tool that turns code into machine language. Using math helps these tools stay safe and correct.

How can we be sure a computer system is perfect? We use a method called formal verification to find out. This process uses math to prove if a system is correct. It checks the system against a formal specification. A specification is a set of rules that a system must follow. This is more than just testing. Testing only checks some things. Formal verification uses math to check everything. This helps make hardware and software very safe. It is even used to reach the highest security level, called EAL7.

There are two main ways this work happens. The first way is called model checking. This method explores every possible state in a mathematical model. It can be fully automatic, which is a big advantage. However, it can be hard to use on very large systems. The second way is called deductive verification. This method creates mathematical proof obligations. People use proof assistants like Isabelle or Rocq to finish these proofs. This way can be harder because a person must understand the system well. They must explain how it works to the math tools.

Scientists and engineers have used these ideas for a long time. For example, a paper from 1983 discussed verifying hardware designs. Today, many big hardware companies use these math tools. This is because errors in hardware can cost a lot of money. In the software world, things are moving a bit slower. But some very important software is already finished. The CompCert C compiler is a great example of verified software. It is a tool that follows most ISO C rules perfectly. This makes the code it creates very reliable.

Many real systems use these special math proofs. One famous example is the seL4 operating system kernel. This is a high-assurance system that people can trust. Another example is CertiKOS, which a team at Yale made in 2016. The team was led by a scientist named Zhong Shao. There are also systems like PikeOS and the ORIENTAIS operating system. Even large computer networks use math models now. Companies like Cisco use these tools for network software. These numbers and names show how serious this work is.

You can think of this like a very strict rulebook. Imagine you build a bridge. Testing is like driving one heavy truck across it to see if it holds. Formal verification is like using math to prove the bridge can never break. It looks at every possible way the bridge could be used. It checks every bolt and every beam using logic. This makes sure the bridge follows the rules of physics. In the same way, formal verification makes sure computers follow the rules of math. This keeps our digital world working exactly as it should.

Formal verification is a rigorous mathematical process used to prove or disprove a system's correctness. It is applied to both hardware and software systems to ensure they meet a formal specification. A specification is a precise set of properties or rules that a system must follow. Unlike standard testing, which only checks specific scenarios, formal verification uses mathematical methods to analyze the entire system. This process is a core part of formal methods and is vital in electronic design automation. By using these methods, engineers can reach the highest Evaluation Assurance Level (EAL7) for computer security certification.

To perform this work, engineers create a mathematical model of the system. They use various mathematical objects to represent how the system behaves. These objects include finite-state machines, which track different stages of a process, and Petri nets. They might also use timed automata or hybrid automata to model systems that involve time. Other methods include using process algebra or the formal semantics of programming languages. By checking a mathematical model, engineers can ensure a formal proof exists for the system's design. This allows them to verify complex things like cryptographic protocols and digital circuits with internal memory.

There are two primary approaches to this verification: model checking and deductive verification. Model checking involves a systematic and exhaustive exploration of the mathematical model. This method explores all possible states and transitions to ensure no errors exist. It can be fully automatic, which is a major advantage for engineers. However, model checking often struggles to scale to very large systems. Symbolic models are typically limited to a few hundred bits of state. Properties in model checking are often described using temporal logics, such as linear temporal logic (LTL) or computational tree logic (CTL).

Deductive verification is a different, more manual approach. This method generates mathematical proof obligations from the system and its specifications. These obligations must be "discharged," or proven true, to show the system conforms to its rules. Engineers use proof assistants, also known as interactive theorem provers, to do this. Examples of these tools include HOL, ACL2, Isabelle, PVS, and Rocq, which was previously known as Coq. They may also use automatic theorem provers, specifically satisfiability modulo theories (SMT) solvers. This approach is harder because the user must deeply understand the system to convey its logic to the computer.

In the world of software, formal verification takes several specific forms. One subarea is abstract interpretation, which helps analyze code behavior. Another is dependently typed programming, where the types of functions include their own specifications. In this method, checking the code's types also establishes its correctness. There is also program derivation, where code is produced from functional specifications through correctness-preserving steps. This is a form of program synthesis. Some techniques are considered "sound," meaning they provide a logical guarantee by covering the entire space of possibilities. Others are "unsound," meaning they only cover a subset of possibilities to provide a "good-enough" result.

History shows that the importance of these techniques grows as designs become more complex. A paper from June 27, 1983, discussed the formal verification of real-time hardware design. Today, most leading hardware companies use formal verification because hardware errors have high commercial significance. While hardware adoption is high, software industry use has been slower. However, several high-assurance operating systems have been successfully verified. These include the seL4 microkernel and the CompCert C compiler. CompCert is a verified C compiler that implements most of the ISO C standard. Other examples include the Integrity operating system and the PikeOS system.

Significant breakthroughs continue to happen in this field. In 2016, a team led by Zhong Shao at Yale University developed CertiKOS, a formally verified operating system kernel. By 2017, formal verification began to be applied to large computer networks through mathematical models. This is part of a new category called intent-based networking. Companies like Cisco use tools from vendors like Forward Networks and Veriflow Systems to manage these networks. Even automated program repair uses these ideas. It combines formal verification with program synthesis to find and fix bugs. This field remains a critical way to ensure the digital systems we rely on are truly correct.