Correctness of a Fault-Tolerant Real-Time Scheduler and its Hardware Implementation

We formalize the correctness of a fault-tolerant scheduler in a time-triggered architecture. Where previous research elaborated on real-time protocol correctness, we extend this work to gate-level hardware. This requires a sophisticated analysis of analog bit-level synchronization and transmission. Our case-study is a concrete automotive bus controller (ABC), inspired by the FlexRay standard. For a set of interconnected ABCs, vulnerable to sudden failure, we prove at gate-level, that all operating ABCs are synchronized tightly enough such that messages are broadcast correctly. This includes formal arguments for startup, failures, and reintegration of nodes at arbitrary times. To the best of our knowledge, this is the first effort tackling fault-tolerant scheduling correctness at gate-level.

[1]  G. Berry,et al.  System level design and verification using a synchronous language , 2003, ICCAD-2003. International Conference on Computer Aided Design (IEEE Cat. No.03CH37486).

[2]  Sergey Tverdyshev,et al.  Efficient Bit-Level Model Reductions for Automated Hardware Verification , 2008, 2008 15th International Symposium on Temporal Representation and Reasoning.

[3]  John M. Rushby,et al.  An Overview of Formal Verification for the Time-Triggered Architecture , 2002, FTRTFT.

[4]  H. Lonn,et al.  Formal verification of a TDMA protocol start-up mechanism , 1997, Proceedings Pacific Rim International Symposium on Fault-Tolerant Systems.

[5]  Maria Sorea,et al.  Model checking a fault-tolerant startup algorithm: from design exploration to exhaustive fault simulation , 2004, International Conference on Dependable Systems and Networks, 2004.

[6]  Tobias Nipkow,et al.  A Proof Assistant for Higher-Order Logic , 2002 .

[7]  Steven D. Johnson,et al.  The formal verification of a reintegration protocol , 2005, EMSOFT.

[8]  John M. Rushby,et al.  Systematic Formal Verification for Fault-Tolerant Time-Triggered Algorithms , 1999, IEEE Trans. Software Eng..

[9]  Tobias Nipkow,et al.  Isabelle/HOL , 2002, Lecture Notes in Computer Science.

[10]  Bo Zhang.  On the Formal Verification of the FlexRay Communication Protocol , 2006 .

[11]  Satnam Singh,et al.  System Level Design and Verification Using a Synchronous Language , 2003, ICCAD 2003.

[12]  Julien Schmaltz.  A Formal Model of Clock Domain Crossing and Automated Verification of Time-Triggered Hardware , 2007 .

[13]  Lee Pike.  Modeling Time-Triggered Protocols and Verifying Their Real-Time Schedules , 2007 .

[14]  P. M. Melliar-Smith,et al.  Synchronizing clocks in the presence of faults , 1985, JACM.

[15]  Mark A. Hillebrand,et al.  Dealing with I/O devices in the context of pervasive system verification , 2005, 2005 International Conference on Computer Design.

[16]  Mark A. Hillebrand,et al.  Towards the formal verification of lower system layers in automotive systems , 2005, 2005 International Conference on Computer Design.

[17]  Wolfgang J. Paul,et al.  Realistic Worst-Case Execution Time Analysis in the Context of Pervasive System Verification , 2006, Program Analysis and Compilation.

[18]  Reinhard Wilhelm,et al.  Cache Behavior Prediction by Abstract Interpretation , 1996, Sci. Comput. Program..

[19]  Lee Pike,et al.  Easy Parameterized Verification of Biphase Mark and 8N1 Protocols , 2006, TACAS.

[20]  Marco Pistore,et al.  NuSMV 2: An OpenSource Tool for Symbolic Model Checking , 2002, CAV.

[21]  William R. Bevier,et al.  The Proof of Correctness of a Fault-Tolerant Circuit Design , 1992 .

[22]  H. Pfeifer,et al.  Formal verification for time-triggered clock synchronization , 1999, Dependable Computing for Critical Applications 7.

[23]  Natarajan Shankar.  Mechanical Verification of a Generalized Protocol for Byzantine Fault Tolerant Clock Synchronization , 1992, FTRTFT.

[24]  Lee Pike,et al.  Modeling Time-Triggered Protocols and Verifying Their Real-Time Schedules , 2007, Formal Methods in Computer Aided Design (FMCAD'07).