Christian Müller
July 17, 2011
27

# Complete Formal Hardware Verification of Interfaces for a FlexRay-like Bus

July 17, 2011

## Transcript

1. ### The Problem Computational Model Proof Sketch Summary Complete Formal Hardware

Veriﬁcation of Interfaces for a FlexRay-like Bus CAV 2011 Christian M¨ uller and Wolfgang Paul Saarland University, Germany 17/07/2011 U N IV E R SIT A S S A R A V I E N S I S
2. ### The Problem Computational Model Proof Sketch Summary The (easy) Problem

CPU0 ECU0 RBi SBi RB¬i SB¬i . . . ECUsend(s) CPUsend(s) RBi SBi RB¬i SB¬i . . . ECUp−1 CPUp−1 RBi SBi RB¬i SB¬i Bus TDMA communication: rounds r, slots s ∈ [0 : ns − 1] buﬀer index i = s mod 2 (⇒ ns has to be even) sender schedule send : [0 : ns − 1] → [0 : p − 1] one slot lasts T cycles slot start: α(r, s) = (ns · r + s) · T
3. ### The Problem Computational Model Proof Sketch Summary The (easy) Problem

CPU0 ECU0 RBi SBi RB¬i SB¬i . . . ECUsend(s) CPUsend(s) RBi SBi RB¬i SB¬i . . . ECUp−1 CPUp−1 RBi SBi RB¬i SB¬i Bus TDMA communication: rounds r, slots s ∈ [0 : ns − 1] buﬀer index i = s mod 2 (⇒ ns has to be even) sender schedule send : [0 : ns − 1] → [0 : p − 1] one slot lasts T cycles slot start: α(r, s) = (ns · r + s) · T Theorem ∀u : ECUsend(s).SBαsend(s) (r,s) s mod 2 = ECUu.RBαu(r,s+1) (s+1) mod 2
4. ### The Problem Computational Model Proof Sketch Summary The (hard) Problem

The same theorem but for asynchronous system? one ECU ≡ one clock domain clock period τu of ECUu bounded clock drift: ∀u, v : τv · (1 − ∆) ≤ τu ≤ τv · (1 + ∆) clock synchronization inevitable αu (r, s) = αu (r, 0) + s · T · τu αu (r, 0) depends on a synchronization in round r Theorem ∀u : ECUsend(s).SBαsend(s) (r,s) s mod 2 = ECUu.RBαu(r,s+1) (s+1) mod 2
5. ### The Problem Computational Model Proof Sketch Summary Problems To Solve

The Problem Register Models cture 0. Computational model for asynchronous hardware 1. Correctness of Serial Interfaces: (a) Signal Transfer across Clock Domains; (b) Low-level Clock Synchronization. 2. Clock (Timer) Synchronization. 3. Bus Contention Control. 4. Sync Message Transfer Over the Bus 5. Payload Message Transfer Background The Problem Proof Structure Unavoidable cyclic argument: - timers roughly synchronized - enough to control bus for sync message - send sync message across domains resyn- chronize
6. ### The Problem Computational Model Proof Sketch Summary Problems To Solve

The Problem Register Models cture 0. Computational model for asynchronous hardware 1. Correctness of Serial Interfaces: (a) Signal Transfer across Clock Domains; (b) Low-level Clock Synchronization. 2. Clock (Timer) Synchronization. 3. Bus Contention Control. 4. Sync Message Transfer Over the Bus 5. Payload Message Transfer Background The Problem Proof Structure Unavoidable cyclic argument: - timers roughly synchronized - enough to control bus for sync message - send sync message across domains resyn- chronize The proof of isolated problems must break the cycle!
7. ### The Problem Computational Model Proof Sketch Summary Previous Results CDC

message transmission (Problems 1, 5) by Schmaltz (abstracting 2, 3, 4) S R clks clkr
8. ### The Problem Computational Model Proof Sketch Summary Previous Results CDC

message transmission (Problems 1, 5) by Schmaltz (abstracting 2, 3, 4) S R clks clkr scheduler correctness & synchronization (Problems 2, 4) by B¨ ohm (assuming 3) ECUm ECU0 ... ECUp−1
9. ### The Problem Computational Model Proof Sketch Summary Previous Results CDC

message transmission (Problems 1, 5) by Schmaltz (abstracting 2, 3, 4) S R clks clkr scheduler correctness & synchronization (Problems 2, 4) by B¨ ohm (assuming 3) ECUm ECU0 ... ECUp−1 similar situation in related work
10. ### The Problem Computational Model Proof Sketch Summary Digital Register Model

out ce in clk R (a) Register clk in x ce 1 out y x c c + 1 (b) An Update in the Digital Register Model
11. ### The Problem Computational Model Proof Sketch Summary Detailed Register Model

clk in x ce 0 1 0 out y Ω x eu (c) eu (c ) th ts tpmin tpmax ... in ce 0 1 0 x Ω x clock edge: eu (c) = c · τu + γu setup & hold times: ts, th min & max propagation delays: tpmin , tpmax undeﬁned value Ω (glitch) out : R → {0, 1, Ω}
12. ### The Problem Computational Model Proof Sketch Summary Bus Model out1

out2 outn bus bus(t) = out1(t) ∧ out2(t) ∧ · · · ∧ outn (t) bus : R → {0, 1, Ω} Ω ∧ x = x ∧ Ω = Ω
13. ### The Problem Computational Model Proof Sketch Summary Bus Model out1

out2 outn bus bus(t) = out1(t) ∧ out2(t) ∧ · · · ∧ outn (t) bus : R → {0, 1, Ω} Ω ∧ x = x ∧ Ω = Ω out1 out2 out3 bus Ω Ω Ω Ω
14. ### The Problem Computational Model Proof Sketch Summary Low-level Bit Transmission

Theorem (CDC Signal Transmission by Schmaltz) If the sender puts a bit b into its send register and keeps it constant for 8 cycles (FlexRay), then the receiver will sample the bit b during 7 + x cycles, with x ∈ {0, 1}. x depends on coupling of hardware cycles timing violated ⇒ x = 0 possible extended to multiple bits (bit-alignment!) direct connection assumed!
15. ### The Problem Computational Model Proof Sketch Summary Clock Synchronization &

Scheduler Simple Clock Synchronization: one master + many slaves Theorem (Synchronization Correctness by B¨ ohm) If all slaves are connected to the master directly, they will recognize the synchronization message and adjust their timers. Theorem (Transmission Window by B¨ ohm) If ECUs are synchronized, then their slots overlap enough to transmit a message. synchronization message transmission: by applying the Theorem of Schmaltz still direct connection assumed!
16. ### The Problem Computational Model Proof Sketch Summary Proof Sketch The

only assumptions: bounded clock drift meaningful conﬁguration Theorem (*) The analog output of an non-sending ECUu is idle and spike-free. interplay of scheduler & serial sending interface propagating of digital properties down to the analog outputs
17. ### The Problem Computational Model Proof Sketch Summary Overall Proof Theorem

(Bus Control) The synchronization happens at the beginning of every round r and the bus is collision-free during every slot. The proof sketch (induction on round r): Base case (r = 0): after start, all ECUs are waiting for the 1st synchronization by Theorem (*) & bus model abstract the bus apply Synchronization Correctness of B¨ ohm by Scheduler Correctness of B¨ ohm show that slots overlap by Theorem (*) and send function abstract the bus to a direct connection during every slot Induction step (r → r + 1): Synchronization for round r is given by IH after round schedule all ECUs are idle, then apply Theorem (*) proceed as in Base case of the proof

19. ### The Problem Computational Model Proof Sketch Summary Problems Discovered setup/hold

time violation at synchronization: Case 1: incorrectly sampled ⇒ 1 cycle delay Case 2: correctly sampled ⇒ no delay (was missing) not discovered because only 1 round treated αu (r, s) deﬁned by the automata state was veriﬁed: eu (αu (r, s)) ≤ esend(s) (αsend(s)(r,s) (r, s) + oﬀ ) needed: eu (αu (r, s) + 2) ≤ esend(s) (αsend(s)(r,s) (r, s) + oﬀ + 2) technical problem with substitution of inﬁnite sequences in Isabelle glitches at (inactive) send register out1 out2 out3 bus Ω Ω Ω Ω
20. ### The Problem Computational Model Proof Sketch Summary Summary complete bus

interface veriﬁcation at gate level correctness of bus control: simulation of direct connection not trivial in TDMA simultaneous induction over: timer synchronization bus control sync message transmission
21. ### The Problem Computational Model Proof Sketch Summary Summary complete bus

interface veriﬁcation at gate level correctness of bus control: simulation of direct connection not trivial in TDMA simultaneous induction over: timer synchronization bus control sync message transmission Murphy’s Law of Formal Veriﬁcation: every theorem, that is not formally applied, is not usable as is.