Analysis of a biphase mark protocol with U ppaal and PVS

Abstract

Abstract. The biphase mark protocol is a convention for representing both a string of bits and clock edges in a square wave. The protocol is frequently used for communication at the physical level of the ISO/OSI hierarchy, and is implemented on microcontrollers such as the Intel 82530 Serial Communications Controller. An important property of the protocol is that bit strings of arbitrary length can be transmitted reliably, despite differences in the clock rates of sender and receiver (drift), variations of the clock rates (jitter), and distortion of the signal after generation of an edge. In this article, we show how the protocol can be modelled naturally in terms of timed automata. We use the model checker Uppaal to derive the maximal tolerances on the clock rates, for different instances of the protocol, and to support the general parametric verification that we formalized using the proof assistant PVS. Based on the derived parameter constraints we propose instances of BMP that are correct (at least in our model) but have a faster bit rate than the instances that are commonly implemented in hardware.

Analyzing an embedded sensor with timed automata in uppaal

“…This approach [Vaandrager and de Groot 2006] is closer to physical reality where a signal may, after a change in level, oscillate unpredictably before stabilizing. In this situation a driver triggered by events, rather than one that samples the signal level, is impractical.…”

“…Rather than blend the different aspects of platform and program so implicitly, execution platforms could be modeled separately and composed with program models; the models are then not only individually reusable, but each is also likely more comprehensible, the intricacies of their interrelationships being left to the mechanics of the modeling language. In one approach [Vaandrager and de Groot 2006], the cycle clock is modeled as a separate automaton that emits a tick action at intervals. The disadvantage, compared to simply widening the invariants, is that synchronizing with tick on each instruction transition makes it awkward in Uppaal to also synchronize with other actions, as occurs for inputs and outputs in the program model.…”

Temporal Refinement Using SMT and Model Checking with an Application to Physical-Layer Protocols

“…Our verification required 5 invariants, whereas a published proof using the mechanical theorem prover PVS required 37 [14]. Using infinite-bmc induction, proofs of the 5 invariants were completely automated, whereas the PVS proof initially required some 4000 user-supplied proof directives in total.…”

Model checking for the practical verificationist

“…The verification of BMP presented herein results in an ordersof-magnitude reduction in effort as compared to the protocol's previous formal verifications using mechanical theorem proving. Our verification required 3 invariants, whereas a published proof using the mechanical theorem prover PVS required 37 [28]. Using infinite-bmc induction, proofs of the 3 invariants were completely automated, whereas the PVS proof initially required some 4000 user-supplied proof directives, in total.…”