Formal proof of a polychronous protocol for loosely time-triggered architectures

Mickael Kerboeuf (1) , David Nowak (2) , Jean-Pierre Talpin (1)

1 ESPRESSO - Synchronous programming for the trusted component-based engineering of embedded systems and mission-critical systems
2 LSV - Laboratoire Spécification et Vérification [Cachan]

The verification of safety-critical systems has become an area of increasing importance in computer science. The notion of reactive system has emerged to concentrate on problems related to the control of interaction and response-time in mission-critical systems. Synchronous languages have proved to be well-adapted to the verification of reactive systems. It is nonetheless commonly argued that real-life systems often do not satisfy the strong hypotheses assumed by the synchronous approach: they are not synchronous. Protocols have however been proposed (e.g. in [1]) to provide an abstract synchronous specification on top of real-time architectures (e.g. loosely time-triggered architectures or LTTA). This abstract model is designed so as to satisfy the synchronous hypotheses and meet the implementation architecture constraints. It makes it possible to design, specify and verify reactive systems in the context of the synchronous approach. In this aim, the present article formalizes the LTTA protocol in the theorem prover Coq and proves its correctness.

Domaines: Systèmes embarqués

Mickael Kerboeuf, David Nowak, Jean-Pierre Talpin. Formal proof of a polychronous protocol for loosely time-triggered architectures. 5th International Conference on Formal Engineering Methods (ICFEM 2003), Nov 2003, Singapore, Singapore. pp.359-374, ⟨10.1007/978-3-540-39893-6_21⟩. ⟨hal-00544516⟩