## Verification of an Audio Control Protocol (1994)

Venue: | FORMAL TECHNIQUES IN REAL-TIME AND FAULT-TOLERANT SYSTEMS |

Citations: | 49 - 7 self |

### BibTeX

@INPROCEEDINGS{Bosscher94verificationof,

author = {Doeko Bosscher and Indra Polak and Frits Vaandrager},

title = {Verification of an Audio Control Protocol},

booktitle = {FORMAL TECHNIQUES IN REAL-TIME AND FAULT-TOLERANT SYSTEMS},

year = {1994},

pages = {170--192},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

We analyze a simple version of a protocol developed by Philips for the physical layer of an interface bus that connects the various devices of some stereo equipment (tuner, CD player,...). The protocol, which uses Manchester encoding, has to deal with a significant uncertainty in the timing of events, due to both hardware and software constraints. We present a formal specification of the protocol, and a proof of correctness for the case where the tolerance of the clocks used within the system is less than 1/17 . A counterexample shows that the protocol fails for tolerances greater than or equal to this value. The verification is carried out using a model of linear hybrid systems, which is similar to the phase transition system model of Manna and Pnueli, and the model of linear hybrid automata of Alur, Henzinger and Ho. The semantics of linear hybrid systems is defined via a translation to the timed I/O automata model of Lynch and Vaandrager.

### Citations

806 | The temporal logic of actions
- Lamport
- 1994
(Show Context)
Citation Context ...ew class of systems required inventing new semantics, along with proof rules, languages, and tools. [1, page 1] Following this philosophy, they show in [1] how real-time systems can be handled in TLA =-=[12]-=-, a Temporal Logic of Actions that was originally proposed in the context of untimed systems. In subsequent work Lamport demonstrates how TLA can deal with hybrid systems [13]. We agree with Abadi and... |

406 |
Automata for Modeling Real-Time Systems
- Alur, Dill
- 1990
(Show Context)
Citation Context ... this paper concerns a real-time verification problem because instead of our model of linear hybrid systems we could have used (for instance) the more restricted timed automata model of Alur and Dill =-=[3]-=-. In this model there are continuous entities, called clocks, but these all change with exactly the same rate. The main reason why we use linear hybrid systems in this paper is that they allow for a m... |

366 | Hierarchical correctness proofs for distributed algorithms
- Lynch, Tuttle
- 1987
(Show Context)
Citation Context ...bsequent work Lamport demonstrates how TLA can deal with hybrid systems [13]. We agree with Abadi and Lamport, and would like to carry out their program for the I/O automata model of Lynch and Tuttle =-=[16]-=-. This model has been highly successful in the area of distributed systems (for some examples of recent applications see [14, 15, 10]), and so it seems interesting to investigate whether it can handle... |

361 | Hybrid Automata: An Algorithmic Approach to the Specification and Verification of Hybrid Systems
- Alur, Courcoubetis, et al.
- 1993
(Show Context)
Citation Context ...ictions that we impose on the action predicate for time, and concepts that play a role in the phase transition systems of Manna and Pnueli, and in the linear hybrid automata of Alur, Henzinger and Ho =-=[4, 2]-=-. One could argue that the case study presented in this paper is not dealing with hybrid systems in the proper sense. All real-time systems are hybrid systems, and this paper concerns a real-time veri... |

313 |
An axiomatic proof technique for parallel programs
- Owicki, Gries
- 1976
(Show Context)
Citation Context ...ause :error to the initialization condition of Impl , and a clause if R:list 6=ffl then error := true to the effect of IN in Impl . All the other actions, including TIME , leave error unchanged. With =-=[23, 18]-=- we know that this is a harmless extension by which, as one can easily verify, the set of timed traces of Impl is not changed. We start with a few invariants about the state space of the sender. The f... |

266 | Automatic symbolic verification of embedded systems
- Alur, Henzinger, et al.
- 1993
(Show Context)
Citation Context ...ictions that we impose on the action predicate for time, and concepts that play a role in the phase transition systems of Manna and Pnueli, and in the linear hybrid automata of Alur, Henzinger and Ho =-=[4, 2]-=-. One could argue that the case study presented in this paper is not dealing with hybrid systems in the proper sense. All real-time systems are hybrid systems, and this paper concerns a real-time veri... |

205 | L.: An old-fashioned recipe for real time
- Abadi, Lamport
- 1994
(Show Context)
Citation Context ...ess is to find the maximal allowable tolerance on the timing for which a specific decoding algorithm developed by Philips is still correct in this setting. 1.2 Linear Hybrid Systems Abadi and Lamport =-=[1] plead for-=- the use of "old-fashioned recipes" when developing methods for specifying and reasoning about computer systems: A new class of systems is often viewed as an opportunity to invent a new sema... |

166 |
Atomic Transactions
- Lynch, Merrit, et al.
- 1993
(Show Context)
Citation Context ... to carry out their program for the I/O automata model of Lynch and Tuttle [16]. This model has been highly successful in the area of distributed systems (for some examples of recent applications see =-=[14, 15, 10]-=-), and so it seems interesting to investigate whether it can handle hybrid systems as well. The I/O automata model is based on labeled transition systems. In the untimed case the transition labels can... |

147 | From timed to hybrid systems
- Maler, Manna, et al.
- 1992
(Show Context)
Citation Context ... control protocol that we have analyzed in this paper is a rather nice example that can play a role as a benchmark for other researchers to test their methods on, just as the Cat and Mouse example of =-=[19]-=- and the Gas Burner example of [24]. In particular it would be interesting to see whether automatic verification methods such as [4] can handle this protocol. Another challenge is to redo the verifica... |

140 | An overview and synthesis on timed process algebras
- Nicollin, Sifakis
- 1992
(Show Context)
Citation Context ...riables are contained in a convex polyhedron over R n , and (4) time steps preserve a number of properties. Part 1 is obvious. Part 2 says that our model adopts the two-phase functioning principle of =-=[22]-=-: a phase where instantaneous (input, output and internal) actions cause discrete changes of the state space, is followed by a phase in which the discrete part of the state remains unchanged and the c... |

133 | Forward and backward simulations part I: Untimed systems
- Lynch, Vaandrager
- 1995
(Show Context)
Citation Context ...ature, a whole menagerie of so-called simulation techniques has been proposed to prove that the set of (finite, fair, timed,: : : ) traces of one automaton is included in that of another. We refer to =-=[17, 18]-=- for an overview and further references. In this paper we only need one simple type of simulation, which is the weak timed forward simulation of [18]. Suppose A and B are timed I/O automata. A weak ti... |

87 |
Specifying Systems
- Lamport
- 2002
(Show Context)
Citation Context ...ms can be handled in TLA [12], a Temporal Logic of Actions that was originally proposed in the context of untimed systems. In subsequent work Lamport demonstrates how TLA can deal with hybrid systems =-=[13]-=-. We agree with Abadi and Lamport, and would like to carry out their program for the I/O automata model of Lynch and Tuttle [16]. This model has been highly successful in the area of distributed syste... |

82 | Liveness in timed and untimed systems
- Gawlick, Segala, et al.
- 1998
(Show Context)
Citation Context ...spect of the I/O automata model is the view on correctness: both a system and its specification are described as I/O automata and correctness amounts to inclusion of traces between these automata. In =-=[26, 18, 7], it is ar-=-gued that inclusion of timed traces provides the "right" notion of implementation for timed I/O automata, and it is shown that the simulation proof techniques that have been developed for th... |

79 | Forward and backward simulations - part II: Timing-based systems
- Lynch, Vaandrager
- 1996
(Show Context)
Citation Context ... the untimed case the transition labels can be input and output actions, which model the interaction of a system with its environment, and internal actions, which model internal computation steps. In =-=[26, 18]-=- it is shown how real-time systems can be represented as labeled transition systems by adding, as additional labels, time-passage actions. In the resulting model of timed I/O automata, the continuous ... |

77 |
Specifying and Verifying Requirements of Real-Time Systems
- Ravn, Hansen
- 1993
(Show Context)
Citation Context ...yzed in this paper is a rather nice example that can play a role as a benchmark for other researchers to test their methods on, just as the Cat and Mouse example of [19] and the Gas Burner example of =-=[24]-=-. In particular it would be interesting to see whether automatic verification methods such as [4] can handle this protocol. Another challenge is to redo the verification of this paper within a process... |

73 | Development of hybrid systems
- Pnueli
- 1994
(Show Context)
Citation Context ... that are also related by time steps. In a linear hybrid system the state variables are partitioned in discrete and continuous variables, just like in the phase transition systems of Manna and Pnueli =-=[20, 19]-=-. But whereas phase transition systems and other models that have been proposed for hybrid systems contain several additional components (activities, important events, invariants, rate intervals, inte... |

61 |
Real-time behaviour of asynchronous agents
- Yi
- 1990
(Show Context)
Citation Context ...tion methods such as [4] can handle this protocol. Another challenge is to redo the verification of this paper within a process algebraic setting such as [26]. It is worthwhile to note that Wang Yi's =-=[27]-=- axiom of time determinism, which says that if time passes with an amount d the resulting state is uniquely determined, is not valid for linear hybrid systems: due to the timing uncertainty, time nond... |

56 | Proof-checking a data link protocol
- Helmink, Sellink, et al.
- 1993
(Show Context)
Citation Context ... to carry out their program for the I/O automata model of Lynch and Tuttle [16]. This model has been highly successful in the area of distributed systems (for some examples of recent applications see =-=[14, 15, 10]-=-), and so it seems interesting to investigate whether it can handle hybrid systems as well. The I/O automata model is based on labeled transition systems. In the untimed case the transition labels can... |

50 |
The Coq proof assistant user's guide. Version 5.8
- Dowek, Felty, et al.
- 1993
(Show Context)
Citation Context ... description of the protocol requires an operator that adds timing uncertainty to a system. The second author has checked most of the verification of this paper using the Coq proof development system =-=[6]-=-. We believe that computer support will become very important or References 21 even indispensable when dealing with larger protocols. David Griffioen [8] has analyzed an extension of the protocol with... |

40 | Action transducers and timed automata
- Lynch, Vaandrager
- 1992
(Show Context)
Citation Context ... the untimed case the transition labels can be input and output actions, which model the interaction of a system with its environment, and internal actions, which model internal computation steps. In =-=[26, 18]-=- it is shown how real-time systems can be represented as labeled transition systems by adding, as additional labels, time-passage actions. In the resulting model of timed I/O automata, the continuous ... |

36 | A formal model of asynchronous communication and its use in mechanically verifying a biphase mark protocol
- Moore
- 1994
(Show Context)
Citation Context ...re surprising that, as far as we know, there is almost no work on the rigorous analysis of the tolerance of asynchrony within this or related protocols. A notable exception is a recent paper by Moore =-=[21]-=-, who mechanically verifies a biphase mark protocol. The protocol and model of Moore are slightly different from ours (for instance, clock jitter is ignored in the model) but despite these differences... |

11 | Correctness of at-most-once message delivery protocols
- Segaard-Andersen, Lynch, et al.
(Show Context)
Citation Context ... to carry out their program for the I/O automata model of Lynch and Tuttle [16]. This model has been highly successful in the area of distributed systems (for some examples of recent applications see =-=[14, 15, 10]-=-), and so it seems interesting to investigate whether it can handle hybrid systems as well. The I/O automata model is based on labeled transition systems. In the untimed case the transition labels can... |

9 | A comparison of additivity axioms in timed transition systems
- Jeffrey, Schneider, et al.
- 1993
(Show Context)
Citation Context ...m A3 says that if time can pass with an amount d, then it is possible to associate states with all times in the interval [0; d] in a consistent way. For a further discussion of this axiom we refer to =-=[18, 11]-=-. 2.3 Composition and Hiding Intuitively, the composition of two timed I/O automata is their Cartesian product, with the added requirement that automata synchronize on shared actions and on passage of... |

5 |
editors. Hybrid systems
- Grossman, Nerode, et al.
- 1993
(Show Context)
Citation Context ...to consumer electronics, in which software interacts with physical processes. Consequently, the specification, design and verification of hybrid systems has recently become an active area of research =-=[9]-=-. We have the opinion that the development of formal methods should go hand in hand with the application on realistic case studies. Following this philosophy, we report in this paper on the analysis o... |

5 |
Digital Communication Systems Design
- Roden
- 1988
(Show Context)
Citation Context ...s value is larger than the maximum tolerance of \Sigma5% that is allowed by Philips. Communication protocols based on Manchester encoding are widely used in applications, for instance in the Ethernet =-=[25]-=-. It is therefore surprising that, as far as we know, there is almost no work on the rigorous analysis of the tolerance of asynchrony within this or related protocols. A notable exception is a recent ... |

4 | Analysis of an Audio Control Protocol with Bus Collision
- Griffioen
- 1994
(Show Context)
Citation Context ...s paper using the Coq proof development system [6]. We believe that computer support will become very important or References 21 even indispensable when dealing with larger protocols. David Griffioen =-=[8]-=- has analyzed an extension of the protocol with multiple senders that has to deal with bus collisions. As a next step we also want to take the message delay on the bus into account. Our analysis has a... |