1 / 41

Machine-Assisted Parameter Synthesis of the Biphase Mark Protocol Using Event Order Abstraction

Machine-Assisted Parameter Synthesis of the Biphase Mark Protocol Using Event Order Abstraction. FORMATS 2009. The 7th International Conference on Formal Modelling and Analysis of Timed Systems. FACTS:. Mostly theory papers (decidability, recognizability, etc).

miyo
Télécharger la présentation

Machine-Assisted Parameter Synthesis of the Biphase Mark Protocol Using Event Order Abstraction

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Machine-Assisted Parameter Synthesis of the Biphase Mark Protocol Using Event Order Abstraction

  2. FORMATS 2009 The 7th International Conference on Formal Modelling and Analysis of Timed Systems FACTS: Mostly theory papers (decidability, recognizability, etc). Some application papers (using Alur-Dill automata and UPPAAL). No parametric approach paper, except for mine.

  3. Keywords of The Talk Real-time System Analysis (Formal Methods) Time-Parametric Verification Timing Parameter Constraint Synthesis Event-Order-Based Abstraction of Timed Systems Case Study Using an “Industrial” Example

  4. Outline Biphase Mark Protocol (BMP) Timing Constraints for Correctness Case Studies by Several Approaches Our Approach: Event Order Abstraction Human Guidance + Automatic Synthesis (Umeno, EMSOFT 2008) Case Study Result Bad Event Orders of BMP Parameter Constraints for Bad EOs

  5. Biphase Mark Protocol (BMP) - is a lower-layer communication protocol for consumer and industrial electronics. - uses timing constraints on system’s behavior to encode and decode bits. - used in a digital audio protocol, S/PDIF (Sony Philips Digital InterFace)

  6. Biphase Mark Protocol (BMP) 1 0 1 1 Bits to be sent: Time Cell: Sub-Cell: (Mark) Signal Represents 1 by Toggling, and 0 by Flat signal

  7. Biphase Mark Protocol (BMP) 1 0 1 1 Bits to be sent: Time Cell: Sub-Cell: (Mark) Signal: Detection: Detects a signal level change

  8. Biphase Mark Protocol (BMP) 1 0 1 1 Bits to be sent: Time Cell: Sub-Cell: (Mark) Signal: Detection: Check a signal level change Detects a signal level change

  9. Biphase Mark Protocol (BMP) 1 0 1 1 Bits to be sent: Time Cell: Sub-Cell: (Mark) Signal: Detection: Decoded Bits: 1 0 1 1 Toggling is detected Flat is detected

  10. Biphase Mark Protocol (BMP) 1 0 1 1 Bits to be sent: Time Cell: Sub-Cell: (Mark) Signal: Detection: Decoded Bits: 1 0 1 1 Timing Parameters: C, M1, D, T (and Metastability H)

  11. Why Parametric Approach? A parametric approach gives the user more information than a fixed-parameter approach (such as the Alur-Dill timed automata approach). • Does the system satisfy a desirable property irrespective to parameter settings? (Undecidable; Alur et al.) • If a parameter setting affects system correctness, then what are parameter setsthat satisfy the correctness? Optimization under parameter constraints

  12. Our Goal for BMP Case Study Correctness: 1. Sent bits = Decoded bits 2. No decoding overflow/underflow - Special module for tracking the information Sender Receiver Signal Toggling Sending Bits Decoded Bits Monitor Goal: Synthesize parameter constraints under which the correctness is guaranteed.

  13. Why is BMP Parametric Verification Challenging? Due to repetitions with timing constraints! Timed execution: s0(DetectF, Δ) s1(DetectF, 2Δ) s2 (DetectF, 3Δ) s3 … All of si’s are different! Reachable state (fixed point) computation will not terminate. (TReX extrapolation technique takes care of this.) Untimed execution: s0DetectFs1DetectFs2 DetectFs3 … All of si’s are same (DetectF is just a stuttering transition).

  14. Modeling: Time-Interval Automata A time-interval automaton (A,b) is an I/O automaton A with an interval boundmapb. An I/O automaton: • Is a classical state transition machine with distinguished input/output/internal actions. • Is typically described using a guarded-command style language. Suitable for concurrent/distributed systems.

  15. Interval Boundmap b (p, P) = [L , U ] An action of A A set of actions that follow p A lower bound L and an upper bound U for the duration between p and any action in P Example from BMP: b (DetectF, {DetectF, DetectT}) = [d, D] (Repeated checks) b (DetectT, {Decode} ) = [t, T] (Sampling distance)

  16. TIA Code of the Encoder Automaton Declaration Transition signatures State variables Precondition (transition guard) Effects (transition commands) Time bounds

  17. Overview of Our Approach (Event Order Abstraction, EOA) We split timed verification into two parts: 1. Verification of Untimed Model + Event Order Constraints Untimed Model Event Order Constraints Model-Checking Event Order Generalization Bad Event Order (Subclass of Regular Expression) 2. Automatic Synthesis of Timing Parameter Constraints from Event Order Constraints Performed by our tool METEORS

  18. Identifying Bad Event Orders • The user first identifies a candidate set of bad event orders (which may be empty). • Monitors are constucted by a support tool from the given orders (for model-checking). A monitor raises a flag if a bad event order is detected in the current model execution. • He/she then model-checks: Untimed Model not Monitor.raiseFlag not SafetyPropertyViolated.

  19. Bad Scenario Example of BMP Edge0 New Edge (0 or 1) Flat Decode 1 !!

  20. Bad Scenario Example of BMP Edge0 New Edge (0 or 1) Flat Decode 1 !! DetectF-DetectF-DetectF-Edge0-DetectT-Edge0-Decode • This event order specifies the order of consecutive actions in an automaton execution.

  21. Bad Scenario Example of BMP Edge0 New Edge (0 or 1) Flat Decode 1 !! > c

  22. Bad Scenario Example of BMP Edge0 New Edge (0 or 1) Flat Decode 1 !! > c < D < T

  23. Bad Scenario Example of BMP Edge0 New Edge (0 or 1) Flat Decode 1 !! > c c >D +T < D < T

  24. Bad Scenario Example of BMP Edge0 New Edge (Edge0) Metastability Flat signal for 0 is completely missed!

  25. Bad Scenario Example of BMP Edge0 New Edge (Edge0) Edge0-(DetectF)*- DetectT- Settle-Edge0

  26. Bad Scenario Example of BMP Edge0 New Edge (Edge0) Edge0-(DetectF)*- DetectT- Settle-Edge0 < T

  27. Bad Scenario Example of BMP Edge0 New Edge (Edge0) Edge0-(DetectF)*- DetectT- Settle-Edge0 > c < H < T

  28. Bad Scenario Example of BMP Edge0 New Edge (Edge0) Edge0-(DetectF)*- DetectT- Settle-Edge0 > c c >H+T < H < T

  29. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T

  30. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T

  31. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T

  32. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T > m1

  33. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T > m1 < H

  34. Bad Scenario Example of BMP Edge1S Edge1T Decode- (DetectF)*- Edge1S-(DetectF)*-Settle-Edge1T > m1 < H < D ??

  35. Bad Scenario Example of BMP Edge1S Edge1T Unwinding! Decode- (DetectF)*- Edge1S-(DF)*- DF -Settle-Edge1T > m1 < H m1>H+D < D !

  36. Our Tool: METEORS One event order: Disjunction of linear inequalities - All derivable bounds - Automatic decomposition Multiple event orders: Conjunction of disjunction of linear inequalities Simplification of resulting constraint

  37. Bad Scenarios of BMP From page 269 of the proceedings:

  38. Sufficient Parameter Constraints METEORS reported: m1> H +D It is sufficient to satisfy three constraints for correctness of BMP. t> M1+ H c > H + D + T

  39. Related Work (BMP Verification) Verification Vaandrager, F.W., de Groot, A.: Analysis of a biphase mark protocol with UPPAAL and PVS. 2006 UPPAAL and PVS: - Bad event order are found using UUPAAL - Constraints are manually derived from bad orders. - Correctness under the derived constraints is proved using PVS. Brown, G.M., Pike, L.: Easy parameterized verification of biphase mark and 8N1 protocols. 2006 Calendar Automata: - BMP is modeled using Calendar Automata framework for SAL - Correctness under the derived constraints is proved using SAL (inductive invariants must be used though proof is automatic.) Synthesis Henzinger, T., Preussig, J., Wong-Toi, H.: Some lessons from the HYTECH experience. 2001 HyTech: - Some parameters are fixed. - Model is modified: no repetitive checks with time bounds

  40. Other Case Studies of EOA • IEEE 1394 (FireWire / i-Link), Root Contention Protocol (Randomness is abstracted) • Train-Gate Toy Problem • Fischer’s Mutual Exclusion Algorithm

  41. Summary and Future Work We synthesized parameter constraints of BMP using Event Order Abstraction (METEORS and SAL are used). Future work: Automatic bad event order identification - List of counter examples from model-checking - Automatic “chopping” and generalization??

More Related