Model checking for the practical verificationist: a user's perspective on SAL
Proceedings of the second workshop on Automated formal methods
A formal approach to the verification of networks on chip
EURASIP Journal on Embedded Systems
Automated formal verification of the TTEthernet synchronization quality
NFM'11 Proceedings of the Third international conference on NASA Formal methods
Using integer clocks to verify clock-synchronization protocols
Innovations in Systems and Software Engineering
Complete formal hardware verification of interfaces for a FlexRay-like bus
CAV'11 Proceedings of the 23rd international conference on Computer aided verification
Formalization and correctness of the PALS architectural pattern for distributed real-time systems
Theoretical Computer Science
The TTEthernet synchronisation protocols and their formal verification
International Journal of Critical Computer-Based Systems
| Hi-index | 0.01 |
Time-triggered systems are distributed systems in which the nodes are independently-clocked but maintain synchrony with one another. Time-triggered protocols depend on the synchrony assumption the underlying system provides, and the protocols are often formally verified in an untimed or synchronous model based on this assumption. An untimed model is simpler than a real-time model, but it abstracts away timing assumptions that must hold for the model to be valid. In the first part of this paper, we extend previous work by Rushby [1] to prove, using mechanical theorem-proving, that for an arbitrary time-triggered protocol, its real-time implementation satisfies its untimed specification. The second part of this paper shows how the combination of a bounded model-checker and a satisfiability modulo theories (SMT) solver can be used to prove that the timing characteristics of a hardware realization of a protocol satisfy the assumptions of the time-triggered model. The upshot is a formally-verified connection between the untimed specification and the hardware realization of a time-triggered protocol with respect to its timing parameters.