Ilan Beer

FoCs: Automatic Generation of Simulation Checkers from Formal Specifications

For the foreseeable future, industrial hardware design will continue to use both simulation and model checking in the design verification process. To date, these techniques are applied in isolation using different tools and methodologies, and different formulations of the problem. This results in cumulative high cost and little (if any) cross-leverage of the individual advantages of simulation and formal verification.

The Temporal Logic Sugar

Since the introduction of temporal logic for the specification of computer programs [5], usability has been an issue, because a difficult-to-use formalism is a barrier to the wide adoption of formal methods. Our solution is Sugar, the temporal logic used by the RuleBase formal verification tool [2]. Sugar adds the power of regular expressions to CTL [4], as well as an extensive set of operators which provide syntactic sugar. That is, while these operators do not add expressive power, they allow properties to be expressed more succinctly than in the basic language. Experience shows that Sugar allows hardware engineers to easily and intuitively specify their designs. The full language is used for model checking, and a significant portion can be model checked on-the-fly [3]. The automatic generation of simulation checkers from the same portion of Sugar is described in [1]. While previous papers have described various features of the language, this paper presents the first complete description of Sugar.

RuleBase: an industry-oriented formal verification tool

RuleBase is a formal verification tool, developed by the IBM Haifa Research Laboratory. It is the result of three years of experience in practical formal verification of hardware which, we believe, has been a key factor in bringing the tool to its current level of maturity. We present the tool, including several unique features, and summarize our usage experience.

Efficient Detection of Vacuity in ACTL Formulas

Prepositional logic formulas containing implications can suffer from antecedent failure, in which the formula is true trivially because the pre-condition of the implication is not satisfiable. In other words, the post-condition of the implication does not affect the truth value of the formula. We call this a vacuous pass, and extend the definition of vacuity to cover other kinds of trivial passes in temporal logic. We define w-ACTL, a subset of CTL and show by construction that for every w-ACTL formula ϕ there is a formula w(ϕ), such that: both ϕ and w(ϕ) are true in some model M iff ϕ passes vacuously. A useful side-effect of w(ϕ) is that if false, any counter-example is also a non-trivial witness of the original formula ϕ.

Efficient Detection of Vacuity in Temporal Model Checking

The ability to generate a counter-example is an important feature of model checking tools, because a counter-example provides information to the user in the case that the formula being checked is found to be non-valid. In this paper, we turn our attention to providing similar feedback to the user in the case that the formula is found to be valid, because valid formulas can hide real problems in the model. For instance, propositional logic formulas containing implications can suffer from antecedent failure, in which the formula is trivially valid because the pre-condition of the implication is not satisfiable. We call this vacuity, and extend the definition to cover other kinds of trivial validity. For non-vacuously valid formulas, we define an interesting witness as a non-trivial example of the validity of the formula. We formalize the notions of vacuity and interesting witness, and show how to detect vacuity and generate interesting witnesses in temporal model checking. Finally, we provide a practical solution for a useful subset of ACTL formulas.

Efficient Model Checking by Automated Ordering of Transition Relation Partitions

In symbolic model checking, the behavior of a model to be verified is captured by the transition relation of the state space implied by the model. Unfortunately, the size of the transition relation grows rapidly with the number of states even for small models, rendering them impossible to verify. A recent work

On-the-Fly Model Checking of RCTL Formulas

The specification language RCTL, an extension of CTL, is defined by adding the power of regular expressions to CTL. In addition to being a more expressive and natural hardware specification language than CTL, a large family of RCTL formulas can be verified on-the-fly (during symbolic reachability analysis). On-the-fly model checking, as a powerful verification paradigm, is especially efficient when the specification is false and extremely efficient when the computation needed to get to a failing state is short. It is suitable for the inherently gradual design process since it detects a multitude of bugs at the early verification stages, and paves the way towards finding the more complex errors as the design matures. It is shown that for every erroneous finite computation, there is an RCTL formula that detects it and can be verified on-the-fly. On-the-fly verification of RCTL formulas has moved model checking in IBM into a different class of designs inaccessible by prior techniques.

The Turnover Kinetics of Major Histocompatibility Complex Peptides of Human Cancer Cells

Peptides presented by the major histocompatibility complex (MHC) are derived from the degradation of cellular proteins. Thus, the repertoire of these peptides (the MHC peptidome) should correlate better with the cellular protein degradation scheme (the degradome) than with the cellular proteome. To test the validity of this statement and to determine whether the majority of MHC peptides are derived from short lived proteins, from defective ribosome products, or from regular long lived cellular proteins we analyzed in parallel the turnover kinetics of both MHC peptides and cellular proteins in the same cancer cells. The analysis was performed by pulse-chase experiments based on stable isotope labeling in tissue culture followed by capillary chromatography and tandem mass spectrometry. Indeed only a limited correlation was observed between the proteome and the MHC peptidome observed in the same cells. Moreover a detailed analysis of the turnover kinetics of the MHC peptides helped to assign their origin to normal, to short lived or long lived proteins, or to the defective ribosome products. Furthermore the analysis of the MHC peptides turnover kinetics helped to direct attention to abnormalities in the degradation schemes of their source proteins. These observations can be extended to search for cancer-related abnormalities in protein degradation, including those that lead to loss of tumor suppressors and cell cycle regulatory proteins.

Analysis of endogenous peptides bound by soluble MHC class I molecules: a novel approach for identifying tumor‐specific antigens

The Human MHC Project aims at comprehensive cataloging of peptides presented within the context of different human leukocyte antigens (HLA) expressed by cells of various tissue origins, both in health and in disease. Of major interest are peptides presented on cancer cells, which include peptides derived from tumor antigens that are of interest for immunotherapy. Here, HLA‐restricted tumor‐specific antigens were identified by transfecting human breast, ovarian and prostate tumor cell lines with truncated genes of HLA‐A2 and HLA‐B7. Soluble HLA secreted by these cell lines were purified by affinity chromatography and analyzed by nano‐capillary electrospray ionization‐tandem mass spectrometry. Typically, a large peptide pool was recovered and sequenced including peptides derived from MAGE‐B2 and mucin and other new tumor‐derived antigens that may serve as potential candidates for immunotherapy.

Soluble plasma HLA peptidome as a potential source for cancer biomarkers

The HLA molecules are membrane-bound transporters that carry peptides from the cytoplasm to the cell surface for surveillance by circulating T lymphocytes. Although low levels of soluble HLA molecules (sHLA) are normally released into the blood, many types of tumor cells release larger amounts of these sHLA molecules, presumably to counter immune surveillance by T cells. Here we demonstrate that these sHLA molecules are still bound with their authentic peptide repertoires, similar to those of the membranal HLA molecules (mHLA). Therefore, a single immunoaffinity purification of the plasma sHLA molecules, starting with a few milliliters of patients’ blood, allows for identification of very large sHLA peptidomes by mass spectrometry, forming a foundation for development of a simple and universal blood-based cancer diagnosis. The new methodology was validated using plasma and tumor cells of multiple-myeloma and leukemia patients, plasma of healthy controls, and with cultured cancer cells. The analyses identified thousands of sHLA peptides, including some cancer-related peptides, present among the sHLA peptidomes of the cancer patients. Furthermore, because the HLA peptides are the degradation products of the cellular proteins, this sHLA peptidomics approach opens the way for investigation of the patterns of protein synthesis and degradation within the tumor cells.