14971359
PVS Strategies for Proving Abstraction Properties of Automata
Abstractions are important in specifying and proving properties of complex systems. To prove that a given automaton implements an abstract specification automaton, one must first find the correct abstraction relation between the states of the automata, and then show that this relation is preserved by all corresponding action sequences of the two automata. This paper describes tool support based on the PVS theorem prover that can help users accomplish the second task, in other words, in proving a candidate abstraction relation correct. This tool support relies on a clean and uniform technique for defining abstraction properties relating automata that uses library theories for defining abstraction relations and templates for specifying automata and abstraction theorems. The paper then describes how the templates and theories allow development of generic, high level PVS strategies that aid in the mechanization of abstraction proofs. These strategies first set up the standard subgoals for the abstraction proofs and then execute the standard initial proof steps for these subgoals, thus making the process of proving abstraction properties in PVS more automated. With suitable supplementary strategies to implement the “natural” proof steps needed to complete the proofs of any of the standard subgoals remaining to be proved, the abstraction proof strategies can form part of a set of mechanized proof steps that can be used interactively to translate high level proof sketches into PVS proofs. Using timed I/O automata examples taken from the literature, this paper illustrates use of the templates, theories, and strategies described to specify and prove two types of abstraction property: refinement and forward simulation.
1899140
Learning Cycle-Linear Hybrid Automata for Excitable Cells
We show how to automatically learn the class of Hybrid Automata called Cycle-Linear Hybrid Automata (CLHA) in order to model the behavior of excitable cells. Such cells, whose main purpose is to amplify and propagate an electrical signal known as the action potential (AP), serve as the "biologic transistors" of living organisms. The learning algorithm we propose comprises the following three phases: (1) Geometric analysis of the APs in the training set is used to identify, for each AP, the modes and switching logic of the corresponding Linear Hybrid Automata. (2) For each mode, the modified Prony's method is used to learn the coefficients of the associated linear flows. (3) The modified Prony's method is used again to learn the functions that adjust, on a per-cycle basis, the mode dynamics and switching logic of the Linear Hybrid Automata obtained in the first two phases. Our results show that the learned CLHA is able to successfully capture AP morphology and other important excitable-cell properties, such as refractoriness and restitution, up to a prescribed approximation error. Our approach is fully implemented in MATLAB and, to the best of our knowledge, provides the most accurate approximation model for ECs to date.
29308229
Safety Verification of Model Helicopter Controller Using Hybrid Input/Output Automata
This paper presents an application of the Hybrid I/O Automaton (HIOA) framework [12] in verifying a realistic hybrid system. A supervisory pitch controller for a model helicopter system is designed and then verified. The design of the supervisor is limited by the actuator bandwidth, the sensor inaccuracies, and the sampling rates. Verification is carried out by induction over the length of an execution of the composed system automaton. The HIOA model makes the inductive proofs tractable by decomposing them into independent discrete and continuous parts. The paper also presents a set of language constructs for specifying hybrid I/O automata.
3106881
Path vector face routing: geographic routing with local face information
Existing geographic routing algorithms depend on the planarization of the network connectivity graph for correctness, and the planarization process gives rise to a well-defined notion of "faces". In this paper, we demonstrate that we can improve routing performance by storing a small amount of local face information at each node. We present a protocol, path vector exchange (PVEX), that maintains local face information at each node efficiently, and a new geographic routing algorithm, greedy path vector face routing (GPVFR), that achieves better routing performance in terms of both path stretch and hop stretch than existing geographic routing algorithms by exploiting available local face information. Our simulations demonstrate that GPVFR/PVEX achieves significantly reduced path and hop stretch than greedy perimeter stateless routing (GPSR) and somewhat better performance than greedy other adaptive face routing (GOAFR+) over a wide range of network topologies. The cost of this improved performance is a small amount of additional storage, and the bandwidth required for our algorithm is comparable to GPSR and GOAFR+ in quasi-static networks.
1158736
Specifying and proving properties of timed I/O automata in the TIOA toolkit
Timed I/O Automata (TIOA) is a mathematical framework for modeling and verification of distributed systems that involve discrete and continuous dynamics. TIOA can be used for example, to model a real-time software component controlling a physical process. The TIOA model is sufficiently general to subsume other models in use for timed systems. The TIOA toolkit, currently under development, is aimed at supporting system development based on TIOA specifications. The TIOA toolkit is an extension of the IOA toolkit, which provides a specification simulator, a code generator, and both model checking and theorem proving support for analyzing specifications. This paper focuses on modeling of timed systems with TIOA and the TAME-based theorem proving support provided in the toolkit, for proving system properties, including timing properties. Several examples are provided by way of illustration
2481844
Proving Atomicity: An Assertional Approach
Atomicity (or linearizability) is a commonly used consistency criterion for distributed services and objects. Although atomic object implementations are abundant, proving that algorithms achieve atomicity has turned out to be a challenging problem. In this paper, we initiate the study of systematic ways of verifying distributed implementations of atomic objects, beginning with read/write objects (registers). Our general approach is to replace the existing operational reasoning about events and partial orders with assertional reasoning about invariants and simulation relations. To this end, we define an abstract state machine that captures the atomicity property and prove correctness of the object implementations by establishing a simulation mapping between the implementation and the specification automata. We demonstrate the generality of our specification by showing that it is implemented by three different read/write register constructions: the message-passing register emulation of Attiya, Bar-Noy and Dolev, its optimized version based on real time, and the shared memory register construction of Vitanyi and Awerbuch. In addition, we show that a simplified version of our specification is implemented by a general atomic object construction based on the Lamport’s replicated state machine algorithm.
2734062
A design diversity metric and reliability analysis for redundant systems
Design diversity has long been used to protect redundant systems against common-mode failures. The conventional notion of diversity relies on "independent" generation of "different" implementations. This concept is qualitative and does not provide a basis to compare the reliabilities of two diverse systems. In this paper, for the first time, we present a metric to quantify diversity among several designs. Based on this metric, we derive analytical reliability models that show a simple relationship between design diversity, system failure rate, and mission time. In addition, we present simulation results to demonstrate the effectiveness of design diversity in Duplex and Triple Modular Redundant (TMR) systems. For independent multiple-module failures, we show that, mere use of different implementations does not always guarantee higher reliability compared to redundant systems with identical implementations-it is important to analyze the reliability of redundant systems using our metric. For common-mode failures and design faults, there is a significant gain in using different implementations-however, as our analysis shows, the gain diminishes as the mission time increases. Our simulation results also demonstrate the usefulness of diversity for enhancing the self-testing properties of redundant systems.
41028818
DFT assisted built-in soft error resilience
In this talk, we describe a new paradigm to design in soft error resilience by reusing already existent on-chip DFT resources. For example, scan systems that are required for manufacturing test and debug involve significant circuitry that are used only during post-silicon debug and production testing. These resources are then left unused throughout the entire lifetime of the product as they are not required for normal system operation. These structures continue to occupy additional silicon area and draw additional leakage power. We demonstrate how to reuse these scan resources to enable a built-in soft error resilience (BISER) design paradigm. These circuits result in more than 20 times reduction in soft error rate while incurring a system-level power overhead of 3-5%. Additional power-saving techniques are possible. The BISER techniques produce the best results in terms of power, performance and area overheads (when all 3 attributes are considered) compared to traditional major redundancy techniques. These techniques are also suitable for adaptive applications targeting a wide range of applications (e.g., networking ASICs, microprocessors) with various power, performance and soft error rate trade-offs.
13125035
Automated Design of Misaligned-Carbon-Nanotube-Immune Circuits
Carbon nanotube field-effect transistors (CNFETs) are promising candidates as extensions to silicon CMOS due to excellent CV/I device performance. An ideal CNFET inverter fabricated using a perfect CNFET technology can have 5.1 times faster FO4 delay and 2.6 times lower energy per cycle compared to a 32 nm silicon CMOS inverter. Two fundamental challenges prevent us from creating CNFET-based logic designs with the advantages quoted above: 1. misaligned carbon nanotubes (CNTs), and 2. Metallic CNTs. Misaligned CNTs can result in incorrect logic function implementations. This paper presents a technique for designing CNFET-based arbitrary logic functions that are guaranteed to be correct even in the presence of a large number of misaligned CNTs.
36794837
Dependable reconfigurable computing design diversity and self repair
Summary form only given, as follows. We demonstrate the power of reconfigurable computing in enabling cost-effective implementations of dependable systems. New concurrent error detection techniques based on practical implementations of design diversity are presented Field reconfigurability of reconfigurable hardware is utilized to design self-healing systems capable of autonomous recovery and repair from temporary errors and permanent faults. The applicability of these techniques are demonstrated through implementations on commercial reconfigurable hardware platforms. An error detection scheme based on diverse duplication compares the outputs of two "different" implementations of the same function and indicates error when a mismatch occurs. The idea of such a technique is derived from the general concept of design diversity. The conventional notion of design diversity is qualitative and relies on "independent" generation of "different" implementations. A metric to quantify design diversity is presented along with synthesis algorithms to efficiently design systems with error detection based on diverse duplication. In traditional dependable systems using hardware redundancy, fault tolerance is realized by detecting errors and locating the faulty chip or faulty board (Field Replaceable Unit or FRU) to be replaced by field service engineers. For systems designed using reconfigurable hardware, the FRU is very fined-grained such as a logic block or a routing resources (e.g., a pass-transistor based switch or a logic lookup table in Field Programmable Gate Arrays). Thus, in the case of a permanent fault, a cost-effective repair scheme is obtained using an alternative configuration in which the faulty parts are replaced with originally unused resources. A new self-repairing reconfigurable computing architecture based on dual FPGAs with embedded "soft" micro-controllers is presented This architecture allows the implemented system to recover from temporary errors and repair itself from permanent faults with minimum impact on system performance while ensuring very high data integrity and availability without external intervention. These capabilities make this architecture useful for a variety of dependable applications including unmanned remote applications such as deep space exploration.
3477203
Fault escapes in duplex systems
Hardware duplication techniques are widely used for concurrent error detection in dependable systems to ensure high availability and data integrity. These techniques are vulnerable to common-mode failures (CMFs). Use of duplex systems with diverse implementations of the two modules has been proposed in the past for protection against CMFs. In this paper, we define a category of faults, called non-self-testable faults that undermine the data integrity of dependable systems. These faults produce identical errors at the outputs of the two modules of a duplex system and can potentially be caused by CMFs. The main contributions of this paper are: (1) techniques that identify non-self-testable faults in duplex systems, and (2) design methods that reduce the number of non-self-testable faults by test point insertion. We show that our algorithm for identifying non-self-testable faults runs orders of magnitude faster than exact techniques with minimal loss of accuracy. Also, there is a significant reduction in the number of test points required for duplex systems with diverse implementations compared to duplex systems with identical implementations. Thus, we can detect common-mode failures in diverse duplex systems using very few test points. These results are especially useful for systems with user-programmable logic elements that enhance the practicality of using diverse designs in duplex systems.