1. Memory Interface Analysis Using the Real-Time Model Checker UPPAAL Egle Sasnauskaite Marius Mikucionis Supervisor: Gerd Behrmann Co-cupervisor: Thomas Hune Aalborg University Computer science departement Software systems Engineering 31 May, 2002

2. Motivation Radar principles: 1. Frequency diversity 2. Sweep integration MI system: (adders, FIFO buffers,register, an arbiter, SDRAM):  Synchronize. Storing data in the memory module  Combine Sliding window sum calculation Sum d,i =e d,i +sum d-1,i - e d-m,i 2 1 1 2´´ 1´´ 2 e 0,3 e 1,3 e 2,3 e 3,3 e 0,4 e 1,4 e 2,4 e 4,4 e 1,2 e 0,2 e 2,2 e 3,2 e 4,2 e 3,4 2` 1`

3. The Main Goals  To analyse and to model the MI between input, output and the memory.  To verify the model within a reasonable amount of time and memory space.  To optimise the model in terms of buffer sizes and an arbiter algorithm.  To summarise the modelling methods for similar systems.

4. Modelling  Modelling tool – UPPAAL (a modelling toolbox of symbolic simulation and verification)  The model of the MI is a combination of timed automata with UPPAAL extensions

5. Verification  Model based techniques – Simulation and automated model checking  Verification method – Partial order reduction  Optimisation technique for full verification – Heuristical periodical approximation

6. Partial-order Reduction Method  Purpose – to avoid combinatorial explosion of states due to the modelling concurrency by interleaving.  Implementation – by introducing additional components.  Gain: Event serialization order and determinism  Problem: State space is still too big to verify the model  Disadvantage: Only particular ordering is examined

7. Heuristic Periodic Approximation  Purpose – to predict how many states should be explored to fully verify the model  Implementation:  find smaller subsystems in the compound system,  define periods of subsystems in a bigger system,  calculate the system period, which is expected to be the least common multiple of the subsystem periods.

8. Definitions in Heuristical Periodical Approximation a i – delay-transition a i ´ – action-transition A state of an automaton changes if changes: Valuation of clocks Valuation of data variables Location of the automaton. S=(l, v) SiSi aiai S i+1 A Path l 0,v 0 a0a0 a` 0 l 0,v 0 ´l 1,v 1 a1a1 l 1,v 1 ´ a1`a1` l i,v i aiai l i,v i ´ ai´ai´ … A compressed path a k+1 a` k+1 a` k+n-1 l 0,v 0 a0a0 a` 0 l 0,v 0 ´ l k,v k akak l k,v k ´ ak`ak` l k+1,v k+1 l k+1,v k+1 ´ … l k+n-1,v k+n-1 l k+n-1,v´ k+n-1 a k+n-1 … A state cycle A period of a state cycle:

9. Memory Interface Architecture Bus1Bus2Arbiter 10-100MHz100MHz2x100MHz Timer Starter 2x100MHz Adder2 Adder1 Buff1Reg1 Buff6Reg6 Buff8 Buff7 Buff5 Buff4 Buff2 Buff0 Reg8 Reg7 Reg5 Reg4 Reg2 Reg0 Buff3Reg3 Memory

10. Serialization Example starter:=Starter(); timer:=Timer(21, 5, 3); bus1:=Bus(1, 0, wireCount0, 1, bus0Wire, begSig, endSig); buf0:=inBuffer(2, 0, 1024, 0, 0, 0, 1, bus0Wire, bus1Wire, begSig, endSig, 8, begBuff, endBuff, 32); buf1:=inBuffer(3, 1, 1024, 0, 1, 1, 3, bus0Wire, bus1Wire, begSig, endSig, 8, begBuff, endBuff, 32); buf2:=outBuffer(4, 2, 512, 512, 2, 5, 2, bus1Wire, bus0Wire, begBuff, endBuff, 32, begSig, endSig, 8);... buf8:=inBuffer(10, 8, 2048, 0, 8, 8, 17, bus0Wire, bus1Wire, begSig, endSig, 16, begBuff, endBuff, 32); bus2:=Bus(11, 1, wireCount1, 1, bus1Wire, begBuff, endBuff); reg0:=Register(12, 0, 0, 0, 0, bus1Wire, begBuff, endBuff, begMem, endMem); reg1:=Register(13, 1, 2, 1, 0, bus1Wire, begBuff, endBuff, begMem, endMem);... reg8:=Register(20, 8, 16, 8, 0, bus1Wire, begBuff, endBuff, begMem, endMem); arbiter:=Arbiter(0, 2, begMem, endMem);

11. Periods in the Model Arbiter int counter; const unsafe 15625/5; const refreshCycle 100/5; const maxSafe unsafe-6; const maxUnsafe unsafe+refreshCycle;

12. Small vs. Complete MI (without refresh) Adder2 Adder1 Buff1Reg1 Buff6Reg6 Buff8 Buff7 Buff5 Buff4 Buff2 Buff0 Reg8 Reg7 Reg5 Reg4 Reg2 Reg0 Buff3Reg3 Memory Buff1Reg1 Buff0Reg0 Memory Period length: 640ns=2 7 ·5ns Cycle start: 80ns Cycle end: 720ns Period length: 5760ns=2 7 ·3 2 ·5ns Cycle start: 520ns Cycle end: 6280ns

13. Small MI with Memory Refresh Verification space is proportional to LCM(P MI, P R )

14. Complete MI with Memory Refresh The verification space can hardly be characterized by LCM(P MI, P R ) 4E+6

15. Arbiter Algorithm Synthesis (future) Round-robin Heuristic (fullest buffer) Optimal No halting problem for particular buffer sizes: If algorithm exists  it contains a finite cycle, since the number of states is finite If algorithm does not exist  buffer over/under-flow in all verification branches

16. Conclusions  The biggest challenge - state explosion problem.  Proposed a UPPAAL model of MI which is small enough to verify with an approximate memory refresh timing.  The model is flexible for various configurations.  We used eight times smaller buffer sizes.  We introduced ideas for optimisations in the future.

17. Questions?