Veriﬁcation of Interfaces for a FlexRay-like Bus CAV 2011 Christian M¨ uller and Wolfgang Paul Saarland University, Germany 17/07/2011 U N IV E R SIT A S S A R A V I E N S I S
The same theorem but for asynchronous system? one ECU ≡ one clock domain clock period τu of ECUu bounded clock drift: ∀u, v : τv · (1 − ∆) ≤ τu ≤ τv · (1 + ∆) clock synchronization inevitable αu (r, s) = αu (r, 0) + s · T · τu αu (r, 0) depends on a synchronization in round r Theorem ∀u : ECUsend(s).SBαsend(s) (r,s) s mod 2 = ECUu.RBαu(r,s+1) (s+1) mod 2
The Problem Register Models cture 0. Computational model for asynchronous hardware 1. Correctness of Serial Interfaces: (a) Signal Transfer across Clock Domains; (b) Low-level Clock Synchronization. 2. Clock (Timer) Synchronization. 3. Bus Contention Control. 4. Sync Message Transfer Over the Bus 5. Payload Message Transfer Background The Problem Proof Structure Unavoidable cyclic argument: - timers roughly synchronized - enough to control bus for sync message - send sync message across domains resyn- chronize
The Problem Register Models cture 0. Computational model for asynchronous hardware 1. Correctness of Serial Interfaces: (a) Signal Transfer across Clock Domains; (b) Low-level Clock Synchronization. 2. Clock (Timer) Synchronization. 3. Bus Contention Control. 4. Sync Message Transfer Over the Bus 5. Payload Message Transfer Background The Problem Proof Structure Unavoidable cyclic argument: - timers roughly synchronized - enough to control bus for sync message - send sync message across domains resyn- chronize The proof of isolated problems must break the cycle!
message transmission (Problems 1, 5) by Schmaltz (abstracting 2, 3, 4) S R clks clkr scheduler correctness & synchronization (Problems 2, 4) by B¨ ohm (assuming 3) ECUm ECU0 ... ECUp−1 similar situation in related work
clk in x ce 0 1 0 out y Ω x eu (c) eu (c ) th ts tpmin tpmax ... in ce 0 1 0 x Ω x clock edge: eu (c) = c · τu + γu setup & hold times: ts, th min & max propagation delays: tpmin , tpmax undeﬁned value Ω (glitch) out : R → {0, 1, Ω}
Theorem (CDC Signal Transmission by Schmaltz) If the sender puts a bit b into its send register and keeps it constant for 8 cycles (FlexRay), then the receiver will sample the bit b during 7 + x cycles, with x ∈ {0, 1}. x depends on coupling of hardware cycles timing violated ⇒ x = 0 possible extended to multiple bits (bit-alignment!) direct connection assumed!
Scheduler Simple Clock Synchronization: one master + many slaves Theorem (Synchronization Correctness by B¨ ohm) If all slaves are connected to the master directly, they will recognize the synchronization message and adjust their timers. Theorem (Transmission Window by B¨ ohm) If ECUs are synchronized, then their slots overlap enough to transmit a message. synchronization message transmission: by applying the Theorem of Schmaltz still direct connection assumed!
only assumptions: bounded clock drift meaningful conﬁguration Theorem (*) The analog output of an non-sending ECUu is idle and spike-free. interplay of scheduler & serial sending interface propagating of digital properties down to the analog outputs
(Bus Control) The synchronization happens at the beginning of every round r and the bus is collision-free during every slot. The proof sketch (induction on round r): Base case (r = 0): after start, all ECUs are waiting for the 1st synchronization by Theorem (*) & bus model abstract the bus apply Synchronization Correctness of B¨ ohm by Scheduler Correctness of B¨ ohm show that slots overlap by Theorem (*) and send function abstract the bus to a direct connection during every slot Induction step (r → r + 1): Synchronization for round r is given by IH after round schedule all ECUs are idle, then apply Theorem (*) proceed as in Base case of the proof
time violation at synchronization: Case 1: incorrectly sampled ⇒ 1 cycle delay Case 2: correctly sampled ⇒ no delay (was missing) not discovered because only 1 round treated αu (r, s) deﬁned by the automata state was veriﬁed: eu (αu (r, s)) ≤ esend(s) (αsend(s)(r,s) (r, s) + oﬀ ) needed: eu (αu (r, s) + 2) ≤ esend(s) (αsend(s)(r,s) (r, s) + oﬀ + 2) technical problem with substitution of inﬁnite sequences in Isabelle glitches at (inactive) send register out1 out2 out3 bus Ω Ω Ω Ω
interface veriﬁcation at gate level correctness of bus control: simulation of direct connection not trivial in TDMA simultaneous induction over: timer synchronization bus control sync message transmission
interface veriﬁcation at gate level correctness of bus control: simulation of direct connection not trivial in TDMA simultaneous induction over: timer synchronization bus control sync message transmission Murphy’s Law of Formal Veriﬁcation: every theorem, that is not formally applied, is not usable as is.