Towards A Formal Theory of On Chip Communications in the ACL2 Logic - PowerPoint PPT Presentation

Towards A Formal Theory of On Chip Communications in the ACL2 Logic Julien Schmaltz Saarland University - Computer Science Department Saarbr¨ ucken, Germany Dominique Borrione TIMA Laboratory - VDS Group Grenoble, France (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 1/37

A Motivation Example • eCall • Automatic emergency call system • A phone call is automatically emitted when car sensors detect an accident Navigation Phone Interface Interface FlexRay eCALL Bus Interface Sensors Interface (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 2/37

FlexRay Bus • Basic protocol • Idle units send 1, to start send 0 • “Sync edges” at each byte (from 1 to 0) • Deterministic scheduling • Time is divided into rounds • Each unit has one slot per round Navigation Phone Interface Interface FlexRay eCALL Bus Interface Sensors Interface (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 3/37

Verification • Proof of each component • Proof of their interconnection Navigation OK OK Phone Interface OK Interface FlexRay eCALL Bus OK Interface Sensors OK Interface (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 4/37

Global Objective One model for all architectures . . . ? (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 5/37

Contribution A functional formalism for communications: GeNoC (Generic Network on Chip) • Identifies the essential constituents and their properties • Formalizes the interactions between them • Correctness of the system is a consequence of the essential properties of the constituents • Mechanized support in ACL2 • Encapsulation allows abstraction • Functional instantiation generates proof obligations automatically (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 6/37

Outline • Communication Principles • GeNoC Definition and Correctness • ACL2 Theorem/Removing Quantifiers • Abstraction using Encapsulation • Applications of GeNoC (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 7/37

A Unifying Model Navigation Phone Interface Interface Communication eCALL Architecture Interface Sensors Interface (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 8/37

A Unifying Model Application messages Application Interface messages Interface frames frames Communication Application messages Architecture Interface Application messages frames Interface frames (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 8/37

Functional Modeling Application messages send Application recv messages Scheduling send frames recv Scheduling frames Application messages Routing send Application recv Routing messages send frames recv frames System = F ( Routing , Scheduling , recv , send ) (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 9/37

Proof Obligations Application PO s messages send Application recv messages Scheduling send PO i frames recv Scheduling PO i frames Application messages Routing send Application recv Routing messages PO i send frames recv frames PO r PO i (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 10/37

System Theorem Application PO s messages send Application recv messages Scheduling send PO i frames recv Scheduling PO i frames Application messages Routing send Application recv Routing messages PO i send frames recv frames PO r PO i Thm ∼ messages reach their destination (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 11/37

System Theorem Application PO s messages send Application recv messages Scheduling send PO i frames recv Scheduling PO i frames Application messages Routing send Application recv Routing messages PO i send frames recv frames PO r PO i Thm ∼ messages reach their destination (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 11/37

Outline • Communication Principles • GeNoC Definition and Correctness • ACL2 Theorem/Removing Quantifiers • Abstraction using Encapsulation • Applications of GeNoC (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 12/37

Overall Modeling Principles • Function GeNoC • takes the list of pending communications • returns the list of results and the list of aborted communications • Transactions • A transaction represents a pending communication, i.e. the intention of A of sending msg to B • It is a 4-tuple ( id A msg B ) (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 13/37

Function GeNoC Scheduling Interface B Interface A recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 1 A msg 1 B ) ( id 2 D msg 2 T ) Aborted Missives ( id 3 F msg 3 E ) ( id 4 R msg 4 Z ) Transactions Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 14/37

From transactions to missives Scheduling Interface B Interface A recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B ( id 1 A msg 1 B ) Routing ( id 1 A msg 1 B ) ( id 2 D msg 2 T ) Aborted Missives ( id 3 F msg 3 E ) ( id 4 R msg 4 Z ) Transactions Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 15/37

From transactions to missives Scheduling Interface B Interface A recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B ( id 1 A frm 1 B ) Routing ( id 1 A frm 1 B ) ( id 2 D frm 2 T ) Aborted Missives ( id 3 F frm 3 E ) ( id 4 R frm 4 Z ) Missives Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 15/37

Routing Algorithm Scheduling ( id 1 frm 1 Routes 1 ) Interface B Interface A recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 1 frm 1 Routes 1 ) ( id 2 frm 2 Routes 2 ) Aborted Missives ( id 3 frm 3 Routes 3 ) ( id 4 frm 4 Routes 4 ) Travels Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 16/37

Scheduling Policy Scheduling Scheduled ( id 1 frm 1 Routes 1 ) ( id 3 frm 3 Routes 3 ) Interface B Interface A recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 2 frm 2 Routes 2 ) ( id 4 frm 4 Routes 4 ) Aborted Missives Delayed Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 17/37

Results Scheduling Interface B Interface A recv recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 2 frm 2 Routes 2 ) ( id 1 B msg 1 ) ( id 4 frm 4 Routes 4 ) Aborted Missives ( id 3 E msg 3 ) Delayed Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 18/37

Aborted Missives Scheduling Interface B Interface A recv recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 2 D frm 2 T ) ( id 1 B msg 1 ) ( id 4 R frm 4 Z ) Aborted Missives ( id 3 E msg 3 ) Missives Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 19/37

Aborted Missives Scheduling Interface B Interface A recv recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 4 R frm 4 Z ) ( id 1 B msg 1 ) Aborted Missives ( id 3 E msg 3 ) ( id 2 T msg 2 ) Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 19/37

Correctness Criterion Scheduling Interface B Interface A recv recv recv Application Application Messages Messages Frames Frames B A send send Node A Node B Routing ( id 4 R frm 4 Z ) ( id 1 A msg 1 B ) ( id 2 D msg 2 T ) ( id 1 B msg 1 ) Aborted Missives ( id 3 F msg 3 E ) ( id 3 E msg 3 ) ( id 4 R msg 4 Z ) ( id 2 T msg 2 ) Transactions Results (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 20/37

Termination Function GeNoC is a recursive function and must be proved to terminate because: • it is a prerequisite for mechanized reasoning (here ACL2) • it is necessary to ensure liveness To ensure the termination, we associate to every node a finite number of attempts. At every recursive call of GeNoC , every node with a pending transaction consumes one attempt. (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 21/37

Formal Definition From a list of transactions, T , the set of nodes NodeSet and a list of attempt numbers att , function GeNoC produces: • The list R of results • The list A for aborted missives GeNoC : D T × GenNodeSet × AttLst → D R × D M ( T , NodeSet , att ) �→ ( R , A ) (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 22/37

Correctness Criterion ∀ res ∈ R , Id R ( res ) = Id T ( trans ) � ∃ ! trans ∈ T , ∧ Msg R ( res ) = Msg T ( trans ) ∧ Dest R ( res ) = Dest T ( trans ) For any result res , there exists a unique transaction trans such that trans and res have the same identifier, message, and destination. (c) Julien Schmaltz, ACL2 2006, San Jos´ e August 15-16 – p. 23/37