Modular Formal Analysis of the Central Guardian in the Time-Triggered Architecture

Abstract

AbstractWe present a modular formal analysis of the communication properties of the Time-Triggered Protocol TTP/C based on the guardian approach. The guardian is an independent component that employs static knowledge about the system to transform arbitrary node failures into failure modes that are covered by the rather optimistic fault hypothesis of TTP/C. Through a hierarchy of formal models, we give a precise description of the arguments that support the desired correctness properties of TTP/C. First, requirements for correct communication are expressed on an abstract level. By stepwise refinement we show that the abstract requirements are met under the optimistic fault hypothesis, and how the guardian model allows a broader class of failures be tolerated.KeywordsFrame StatusFaulty NodeCorrect CommunicationCorrect NodeNull FrameThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.