Verification

Formal-Based Design
and Verification of SoC
Arbitration Protocols: A
Comparative Analysis of
TDMA and Round-Robin
Maroua Ben Slimane Riadh Robbana
University of Carthage, Tunisia Polytechnic School University of Carthage, INSAT

Imene Ben Hafaiedh

University of Tunis El Manar, ISI

SoC design. The TDMA scheduling pol-

Editor’s note: icies have several advantages and they
The article showcases formal modeling and verification of two SoC are particularly suitable for safety-crit-
arbitration protocols. ical architectures because they facili-
—Wen Chen, NXP tate clock synchronization without any
message overhead and support timely
fault detection. The TDMA scheme is
 As System-on-Chips (SoCs) are increasing based on the fixed allocation of a time slot to each
in size and complexity, their validation and verifica- master. Unfortunately, high priority communica-
tion have become important and more difficult to tions in TDMA-based strategies may lead to impor-
achieve. Currently, the most widely used SoC design tant latencies as a time slot may be allocated to a
is typically bus based and consists of shared commu- master which did not ask for it. Such a disadvantage
nication resources managed by dedicated arbiters is encompassed by a well-known arbitration proto-
that are in charge of serializing access requests. That col, namely, the round-robin scheme. In this paper,
is why the communication architecture as well as we propose a formal specification for the design
arbiters design are the backbone of the SoC design and verification of SoC bus arbitration protocols.
and have a large effect on its quality both in terms In particular, we focus on the verification, analysis,
of performance and reliability. Assuming bus-based and comparison of TDMA and round-robin arbiters.
communication architecture, several well-known These design models are traditionally described
arbitration policies have been proposed, such as with hardware tools and environments like Ver-
TDMA [1] and round-robin [2] which are consid- ilog, VHDL, and validation results which are mainly
based only on simulations and test sequences [3],
ered as the most widely used scheduling policies in
[4] and not on f­ormal verification. Indeed, there
Digital Object Identifier 10.1109/MDAT.2017.2713352 exist few published results addressing a thorough
Date of publication: 7 June 2017; date of current version: formal verification of the design of round-robin
13 September 2017. arbiters in an automated way. In [5] and [6], formal

54 2168-2356/17 © 2017 IEEE Copublished by the IEEE CEDA, IEEE CASS, IEEE SSCS, and TTTC IEEE Design&Test
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
 v­ erification of the hardware architecture of round- In practice, an atomic component can be
robin arbiters have been verified using the HOL extended with variables which are used to store local
tool based on the method of Theorem-Proving. data. Moreover, each component transition can be
However, the use of this tool is interactive and the associated with a Boolean condition specifying for
process of verification has to be done manually by which values of the local variables it is enabled, and an
experts. Moreover, the proofs were not scalable, (internal) update function triggered along with transi-
which means that, the proofs and validation results tion execution which modifies values of variables.
are only valid for the arbiter with 4 × 4 configura- A BIP model is built from a set of n atomic com-
tion size and, thus, not useful for configurations with ponents {Bi = (Li, Pi, Ci, Ti, tpci)}i∈[1,n], such that their
more complex architectures. In [7] and [8], formal respective sets of ports and clocks to be pairwise
models for the description of TDMA protocols have disjoint.
been proposed. However, the proposed models are
not scalable and cannot be easily adapted to other Definition 2 (Interaction). An interaction between
TDMA policies nor extended to a larger number atomic components ​​​{​Bi​  ​​}​​  ni=1 ​​​is a subset of ports a ⊆ P,
of masters. such that it contains at most one port of every com-
This paper provides a high-level formal model ponent, that is, │a ∩ Pi│ ≤ 1 for all i ∈ {1, …, n}.
for the specification of arbitration protocols in a SoC Since an interaction a uses at most one port of every
architecture. The model is specified in particular, for component, we simply denote a = {pi}i∈I , where
TDMA and round-robin protocols. However, it can I ⊆ {1, …, n} and pi ∈ Pi for all i ∈ I. A component Bi
be easily adapted to different arbitration policies. is participating in a if i ∈ I.
Formal verification such as for deadlock freedom is
achieved through model-checking. The implemen- Definition 3 (BIP Model). We denote by B =
tation is then automatically generated and different γ(B1, …, Bn), the BIP model obtained by applying
analysis experiments have been performed. a set of interactions γ to the set of atomic compo-
nents { ​​​ ​Bi​  ​​  = ​(​Li​  ​​ , ​Pi​  ​​ , ​Ci​  ​​ , ​Ti​  ​​ , tp​c​ i​​)​}​​  n ​​.​ It is defined
i=1
Preliminaries by the atomic component B = (L, γ, C, Tγ, tpc),
In this section, we present a high-level mod- where L = L1 × … × Ln, C = ​​∪​  ni=1 ​​​ Ci, tpc(l ) = ⋀i∈n ​tp​c​ ​li​  ​​​.​​
eling formalism for the description of the TDMA A ­transition τ = (l, a, tc, r, l′) from l = (11, …, ln) to
and round-robin arbitration protocols. We choose l = (1′1, …, l′n) is in Tγ iff (1) a = {pi}i∈I ∈ γ, (2) for all i ∉ I
to specify our model using the real-time BIP com- l′i = li and (3) and there exists transitions τi =(li, pi, tci,
ponent framework [9]. BIP is a component-based ri, l′i) of Bi, i ∈ I, such that tc = ⋀i∈I tci, r = ⋃i∈I ri.
framework for building real-time systems based on a In BIP, interactions are structured by connectors.
rigorous formal semantics that relies on rich interac- A connector is a macro notation for representing
tion models between components [10]. An atomic sets of related interactions in a compact manner. To
component is essentially a timed automation labe- specify the set of interactions of a connector, two
led by ports used for communication among differ- types of synchronizations are defined:
ent components.
• strong synchronization or rendezvous, when the
only interaction of a connector is the maximal one,
Definition 1 (Atomic component). An atomic com- that is, it contains all the ports of the connector.
ponent B is defined by the tuple B = (L, P, C, T, tpc), • weak synchronization or broadcast, when inter-
where L is a finite set of locations, P is a finite set of actions are all those containing any port initiat-
ports, C is a set of clocks, and T ⊆ L × (P × G(C) × 2C ) ing the broadcast.
× L is a set of transitions labeled with a port, and a
timing constraint and a subset of clocks to be reset. To build our model, we use a key notion offered
tpc: L → G(C ) assigns to each location l ∈ L, a time by the BIP framework, namely, priorities. Priorities
progress condition tpcl ∈ G(C). G(C) is the set of can be defined between interactions to restrict non-
timing constraints that are defined according to the determinism. They allow straightforward modeling
following grammar: tc := true ∣ false ∣ c ∼ k ∣ tc ∧ tc, of urgency and scheduling policies for distributed
with c ∈ C, k ∈ Z ≥ 0 and ∼∈ {≤, =, ≥}. systems.

September/October 2017

Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
55
 Verification

Interactions + Priorities

Figure 1. A formal model of SoC architecture.

Definition 4 (Priority in BIP). A priority order interactions. Arbitration protocols can be easily
denoted by < is a strict partial order on the set of achieved by means of BIP interactions between
interactions γ. We denote that an interaction a has local arbiters and priority between the correspond-
lower priority than b by a < b which means that ing interactions.
whenever a and b are possible at the same global Note that the model presented in Figure 1 rep-
state, then the one with the highest priority (b) will resents the basis of the formal specification of any
be executed. SoC arbitration protocol. Indeed, for any arbitration
strategy, processors are modeled by the same BIP
Formal Model for the Specification of components because what define the arbitration
TDMA and Round-Robin Protocols schemes is not processors but arbiters and interac-
Based on the notions of BIP already described in tions between them.
Preliminaries, we first provide a formal specification Note that, in our model, all connectors relat-
of a shared bus topology in SoC. For this purpose, we ing an arbiter to its corresponding processor are
define the set of SoC processors as a set of timed BIP rendezvous connectors, which means that the
atomic components {P1, P2, … , PN}. As usually, we only feasible interactions of such connectors are
do not explicitly model the bus device as it is a pas- the one requiring synchronization between con-
sive device controlled by a bus arbiter. In the case of nected ports.
a centralized arbitration, a unique arbiter manages In our model, when a processor requests the bus
conflicts between processors. As we are intending a access, it informs its corresponding arbiter by acti-
distributed arbitration, a set of local arbiters is mod- vating a req port.
eled, each one associated to a processor and ensur- Then, the processor is still waiting until its
ing arbitration by interacting with its peers. It gives its ­arbiter fires the transition labeled by the port go.
processor access to the bus when the set of arbiters Firing the transition go means that the processor is
agree on that. Similarly, these local arbiters are also given the bus access and goes to the state access.
modeled by BIP components {A1, A2, … , AN}. This transition is fired by the arbiter with respect
Any arbitration protocol is then ensured by to the arbitration policy achieved through interac-
communication between these arbiter compo- tions between the different arbiters. In state access,
nents. Such communications are modeled by BIP a processor starts performing its task, however, as it

56 IEEE Design&Test
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
 Figure 2. A formal model of TDMA protocol.

is controlled by its arbiter, two scenarios could be Formal Model of the TDMA Protocol
possible: The TDMA access scheme is based on the fixed
allocation of a time-slot for each processor. In an
• The arbiter can ask the processor to release architecture of three processors, the bus bandwidth
the bus when the task is not yet accomplished. is divided into three equal time slots. In each cycle,
This means that the transition suspend will take a fixed time-slot is allocated to a processor in turn
place. The processor will go into the state wait- whether it asks for the bus or not.
ing, where it waits for the next round to continue As already explained, the protocol strategy is per-
the task. formed via arbiters, which are modeled by the set of
• The arbiter can ask the processor to release the BIP components {A1, A2, A3}. Figure 2 depicts how
bus when the task is already accomplished. In these arbiters are related through BIP connectors
this case, the transition release is fired and the and it gives the detailed behavior of an arbiter.
processor goes back to start state. The behavior Note that all connectors in our model are ren-
of arbiters and their interactions will be defined dezvous connectors, which means that their unique
according to the protocol under study. In this feasible interaction is the one involving all con-
­
paper, we focus in particular, on the TDMA and nected ports. That is why, in the coming description,
round-robin protocols. For each protocol, we we only use the notion of interaction as it is com-
give the behavior of the corresponding arbiters pletely equivalent to its corresponding connector.
and their interactions performed through BIP For each Ai, we define two clocks y and x and a
connectors. Note that, the behavior of arbiters set of variables {Rndi, Pdi, Tfi} where:
and processors is the same for a given protocol,
thus, our model can be easily extended to N com- • Rndi is initially set to i − 1 and it is updated in
ponents. For the sake of readability, we describe each cycle to (Rndi + 1)mod3. When this varia-
our protocols for the case of only three proces- ble reaches the maximum value of 2, the corre-
sors and their local arbiters. However, experi- sponding arbiter gets the bus access.
ments and verification results of the section on • Pdi defines the period of time required by Pi to
formal verification and analysis are performed finish its task. Initially, Pdi is set to 0.
on a larger number of components automatically • Tfi: is a boolean variable defining if a task is
generated. ­accomplished or not.

September/October 2017
57
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
 Verification

The set of ports of each component defines how the bus to achieve its task, which means that Ai
the corresponding local arbiter interacts with the will suspend Pi by firing the transition suspend.
rest of components. The behavior of an arbiter Ai is • Case 2: the period Pdi is less or equal to the
described as follows: allocated time slot. In such case, the arbiter
Initially in state start, three scenarios could be ­possible: as well as the processor will synchronize on
the release transition and go back to the ini-
• Ai can fire the transition r​ e​q​ ​Ai​  ​​​.​​ This scenario takes tial state.
place when its corresponding processor has a
task to accomplish and thus both Ai and Pi fire Note that, releasing the bus even though Pi does
the interaction {​re​q​ ​Pi​  ​​​​​, r​ e​q​ ​Ai​  ​​​​​}. not finish its task, is ensured by the notion of invari-
• Ai can fire the transition g ​ ran​t​ ​Ai​  ​​​.​​ This scenario ant defined by BIP framework. Indeed, in state access
means that the arbiter gets a bus access, how- of Ai, an invariant Inv = x ≤ TS is defined where TS
ever, its corresponding processor does not have is the value of the allocated time slot, which guaran-
a task to perform. In TDMA policy, even though tees that Ai cannot stay in this state more than a TS
a processor does not ask for the bus, it will be period of time.
given a time slot and no other processor could TDMA arbitration is considered fair in the sense that
access the bus during this period of time. For this it performs the equal division of time among proces-
reason, Ai will go to an idle state, where it waits sors. However, the main problem of this strategy is the
the time slot to expire. Note that each ​gran​t​ ​Ai​  ​​​​​ port wasted-slots. This is the case when a time-slot is reserved
is connected to the ports {updatej}j≠i of the other for a component, which has no pending request.
arbiters. This interaction allows the rest of arbi- The round-robin is an arbitration mechanism
ters to update the value of their corresponding which alleviates the drawback of wasted-slots in the
Rndj variables even though they do not have a TDMA strategy. It can reallocate the available slot to
bus access. Moreover, as in TDMA strategy, arbi- another requesting device.
ters and processors have to synchronize their
clocks, such interaction allows clocks synchroni- Formal Model of Round-Robin Protocol
zation in each cycle. The round-robin arbitration protocol guarantees
• Ai can fire the transition ​updat​e​ ​Ai​  ​​​​​. This transition fairness among components and allows any unused
is fired in each cycle through the set of interac- slot to be reallocated to a component whose round-
{ }
tions ​​{​G​j​  j​  ≠i​​​​}​ = ​ updat​e​ ​Ai​  ​​​​ , ​{ gran​t​ ​Aj​  ​​​​  }​  j∈{1,
​ 2, 3}​ ​​ (see robin turn is later but who is ready now. The round-
j≠i
Figure 2). These interactions allow to update robin protocol works as follows. In each cycle, one
the variable Rnbi of each arbiter according to of the processor Pi (in round-robin order) has the
the formula: Rndi ← (Rndi + 1) mod 3 in each highest priority round of bus access. If a processor
cycle. In waiting state, the arbiter has already Pi does not need the bus in this cycle, the processor​​
performed ​re​q​ ​Ai​  ​​​​​ transition, which means that its P​ ​ji​  ≠j​​​​​ who has a request can be granted the bus and so
corresponding processor asks for the bus. The the time slot reserved to Pi will be reallocated to Pj
arbiter is then waiting for its time-slot allocation. in a round robin fashion. Based on the TDMA formal
When its variable Rndi has the highest value (in model already described, we now propose a formal
this case 2), it will get the bus access and thus model for the round-robin protocol (see Figure 3).
it fires the transition ​gran​t​ ​Ai​  ​​​​​, after which it syn- As already explained, BIP components defining
chronizes with its processor on go transition. If, the set of processors {P1, P2, P3} are kept the same.
however, the value of Rndi is not yet the high- However, the set of modifications affects only the
est round, it fires ​updat​e​ ​Ai​  ​​ ​​​ until it reaches the behavior of arbiters and their interactions. Note that,
desired value. minor changes have been performed, which means
In access state, Ai gets the bus access, means that the proposed model can be easily adapted to
that a time slot is allocated for Pi. Then two cases different arbitration schemes.
must be considered: In the round-robin protocol, there are no wasted
• Case 1: the period Pdi, required by Pi to time-slots. Indeed, when an arbiter Ai gets a bus access
achieve its task, is bigger than the time slot with no pending request, it will give the access to the
allocated. So, it will need multiple access to next arbiter in a round-robin order, which means that

58
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
IEEE Design&Test
 Priority Rule :

Figure 3. A formal model of round-robin protocol.

an arbiter Ai which does not have the highest prior- In particular, we use model-checking, which
ity round can access the bus if it requests for it only allows the verification of the correctness of a sys-
when the one with the highest priority does not ask tem by checking whether the desired properties
for the bus. To ensure such a scenario, in our round- are satisfied in every reachable state of that system.
robin model, we use the notion of priority offered by Moreover, our verification is based on what is called
BIP by defining the following priority rule: compositional model-checking which encompasses
the state space explosion problem inherent to mod-
GN < … < G2 < G1 iff Rnd1 > Rnd2 > … > RndN
with Gi = {​gran​t​ ​Ai​  ​​​,​​ {
​​​ updat​e​ ​Aj​  ​​} el-checking of timed systems with a large number of
​​ ​​  i≠j}
​​​
components. To this end, we apply the RTD-Finder
This rule means that the condition to fire ​gran​t​ ​Ai​  ​​​​​ is Model-Checker tool of BIP [11] on our models to
not that Ai has the maximum value of Rndi (which verify the correctness of the following properties:
is the case of the TDMA scheme) but that it has the deadlock-freedom, invariant, and mutual-exclusion
maximal value among arbiters asking for the bus. (see Figure 4).
Another advantage of the round-robin protocol is
that when a processor Pi achieves its task, it releases Deadlock-Freedom Verification: By applying
the bus even though its allocated time-slot is not yet the RTD-Finder to our models, we have proven their
expired, which means that the use of the bus in this deadlock-freedom at a high abstract level with no
case is more efficient than the TDMA policy. need for code generation. Figure 5 gives the time taken
by the model-checker to verify deadlock-freedom for
Formal Verification and Analysis different set of components. Indeed, our models are
In the previous section, we have described our easily extendable to any number of components as all
models for both the TDMA and the round-robin pro- processors and arbiters have the same behavior.
tocols. In this section, we perform the formal verifi- Extending our models to a large number of com-
cation of these models to prove their satisfaction of a ponents provides a way to study at a high-level how
set of relevant properties required to guarantee their protocols may react in the context of more complex
correctness. architectures.

September/October 2017

Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
59
 Verification

TABLE 1 Verification time (seconds) for invariant and mutual-exclusion properties for TDMA and
round-robin protocols.

considerably by increasing the number of compo-

nents. Figure 5 shows that the verification of dead-
lock-freedom for the TDMA requires more time than
the round-robin model.
This is due to the additional state idle in TDMA
model and the clock constraint defined in this state
which increases the verification time needed by
RTD-Finder to compute enable states, the clocks
constraints, and the interactions invariant.

Invariant verification: We have also checked a

set of invariant properties on our models. Such prop-
erties are very interesting when it comes to real-time
systems. Indeed, they guarantee the respect of a set
of timed-constraints associated with system states. In
the TDMA model, for example, an invariant guaran-
tees that Ai cannot stay in access or idle states more
Figure 4. BIP model from formal verification than a time-slot duration. Similarly, in the round-
to code generation. robin model, the same invariant is defined for the
access state.
Figure 5(a) depicts the number of clocks Clk and These invariant properties are formally described
inter-actions Intr for both TDMA and round-robin using Temporal-Logic as follows:
models for a large number of components. As both
AG (​acces​s​ ​Ai​  ​​​​​ ⇒ (​​x​ ​Ai​  ​​​​​ ≤ TS))
models (TDMA and round-robin) have the same
AG (​​idle​ ​Ai​  ​​​​​ ⇒ (​​x​ ​Ai​  ​​​​​ ≤ TS))
structure, the number of defined clocks and inter-
actions are the same for both models. As expected, The verification time for the set of invariant prop-
the number of clocks and interactions increases erties is given in Table 1.

(a) (b)

Figure 5. (a) The number of clocks Clk and interactions Intr when increasing the number of
components. (b) Deadlock-freedom time verification for the TDMA and round-robin models.

60 IEEE Design&Test
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
 (a) (b)

Figure 6. Performance evaluation of TDMA and round-robin within 30 minutes of real-time executions:
(a) Number of access per processor. (b) Number of accomplished tasks per procesor.

Mutual-Exclusion Verification: We have for- could be easily parameterized. Figure 6 depicts the
mally verified the mutual-exclusion property on number of bus access and accomplished tasks for
bus access. Such a property guarantees that a given each processor within 30 minutes of real-time exe-
protocol cannot assert more than one access at one cutions for both TDMA and round-robin models.
moment and it is formally described as follows: Figure 6(a) shows that the number of access of each
processor to the bus within 30 minutes for the round-
∀ i, j ∈ {1, N}i≠j, AG (acces​​s​ ​Pi​  ​​​​​ ⇒ ¬acces​​s​ ​Pj​  ​​​)​​
robin model is bigger than that of the TDMA case.
This property is proven to be satisfied by our Consequently, and as depicted in Figure 6(b), the
models, for different number of components, and number of accomplished tasks of each processor
the time taken for its verification is given in Table 1. within the same real-time execution of the round-
Once, we have proven formally the correct- robin protocol is bigger than that of the TDMA, which
ness of our models with respect to the set of the proves, as expected, that the round-robin protocol
already given properties using the RTD-Finder mod- is more efficient as it is faster and provides higher
el-checker, more experiments and analysis could be bandwidth than TDMA protocol. This is due to wast-
easily performed using the automatically generated ed-slots (unused-slots) allocated to processors with
codes of our formal models as described in Figure 4. no pending requests in TDMA protocol.
Note that this generated code is proven to be seman- Indeed, as shown in Figure 7, the number of time
tically equivalent to initial models, which means slots which are not used by processors P2 and P3 is
that any properties already checked on the model
still hold on its generated code. Using the executa-
ble code generated by the Real-Time BIP frame-work
[12], real-time executions are run and different set of
experiments are then observed. In particular, we run
a set of real-time executions to compare and evalu-
ate the performance of the TDMA and round-robin
arbitration protocols.
These executions have been run for an archi-
tecture of four processors where the correspond-
ing period Pdi for each processors Pi, is defined as
follows: Pd1 = 30ms, Pd2 = 50ms, Pd3 = 10ms, and
Pd4 = 70ms. We also consider a configuration with
a time slot TS = 25ms and where P1 and P4 always
ask for the bus access unlike P2 and P3 which ask Figure 7. Number of used and wasted-slots per
for it periodically. Note that, any other configuration ­processor of TDMA protocol.

September/October 2017
61
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.
 Verification

bigger than the rest of processors. This is due to the [7] P. P. Henrik Lnn, “Formal verification of a TDMA
fact that P2 and P3 do not always ask for a bus access. protocol start-up mechanism,” in Proc. Pacific Rim Int.
However, in the TDMA policy, they are always given Symp. Fault-Tolerant Syst., pp. 235–235.
a time slot whenever their round comes even if they [8] V. F. Rosset, P. Souto, and F. Vasques, “Model-checking
do not ask for it. However, the round-robin protocol a group membership protocol for TDMA-based
allows any unused slot to be reallocated to a proces- networks with both static and dynamic scheduling,” in
sor whose round-robin turn is later but who is asking Proc. the European Dependable Comput. Conf., 2006.
for the bus now. [9] A. Basu, M. Bozga, and J. Sifakis, “Modeling
heterogeneous real-time components in BIP,” in
To the present day, much research has been done
SEFM, 2006, pp. 3–12.
to alleviate the TDMA problem and to propose an
[10] S. Bliudze and J. Sifakis, “The algebra of connectors—
optimal time slot value, while considering many fac-
Structuring interaction in BIP,” IEEE Trans. Comput.,
tors. In addition, the weighted and Deficit round-robin vol. 57, no. 10, 2008.
protocols have been proposed to compute a dynamic [11] L. Astefanoaei et al., “Compositional verification for timed
time-slot. The main advantages of our proposed formal systems based on automatic invariant generation,”
model are that it can be easily adapted to new versions Logical Methods Comput. Sci., vol. 11, 2015.
of arbitration protocols. So, we are intending to build [12] S. B. Rayana et al., “RTD-Finder: A tool for
upon our model and to propose formal models for compositional verification of real-time component-based
new variants of TDMA and round-robin or new proto- systems,” in Tools and Algorithms for the Construction
cols by only modifying the arbitration strategy which and Analysis of Systems, 2016, pp. 394–406.
means the behavior of arbiters and the set of interac-
tions between them. Then, one could formally analyze Maroua Ben Slimane is a PhD student at Tunisia
performance, verify properties, and compare protocols Polytechnic School (EPT), Tunisia. She received an
easily at a high level of abstraction. Moreover, based MSc in Computer Science from the Higher Institute of
on these formal models, designers could automatically Computer Science of Tunisia. Her research interests
obtain correct implementation and several experi- include formal verification of distributed systems.
ments could be performed, in particular, for systems Contact her at [email protected].
with a large number of components. 
Imene Ben Hafaiedh is an Assistant Professor
at the Higher Institute of Computer Science of
 References
Tunisia. Hafaiedh received a PhD degree in Computer
[1] H. Lonn and R. Snedsbol, “Efficient synchronization,
Science from Grenoble University–Verimag Laboratory,
atomic broadcast, and membership agreement in France, in 2011. Her research interests include
TDMR protocol,” in Proc. Int. Conf. Parallel Distributed distributed and parallel systems, component-based
Syst., 1996, pp. 405–412. design and implementation, model-checking, and
[2] M. O. Gharan and G. N. Khan, “Index-based round- formal verification. Contact her at ben.hafaiedh.imen@
robin arbiter for NoC routers,” in IEEE Comput. Soc. gmail.com.
Ann. Symp. VLSI, ISVLSI, 2015, pp. 62–67.
[3] J. Jou and Y. Lee, “An optimal round-robin arbiter Riadh Robbana is a Professor at the National
design for NoC,” J. Inf. Sci. Eng., vol. 26, no. 6, Institute of Applied Sciences and Technologies,
pp. 2047–2058, 2010. Tunisia. He is the Leader of the Master Group
(Modeling and Analysis of Real-time Systems) at the
[4] J. Ge, “Round-robin arbiter design,” in Proc. Int. Conf.
LIP2 Laboratory, El Manar University. His research
Comput. Design Conf. Comput. Nanotechnol., 2006,
interests include formal verification and verification
pp. 24–28.
of security protocols. Contact him at riadh.robbana@
[5] P. Curzon, “The formal verification of an ATM network,” gmail.com.
in Proc. Thirteenth Ann. ACM Symp. Principles
Distributed Comput., 1994.  Direct questions and comments about this article
[6] V. K. Pisini et al., “Formal hardware verification by to Imene Ben Hafaiedh, Higher Institute of Computer
integrating HOL and MDG,” in Proc.Great Lakes Science of Ariana, Ariana 2080, Tunisia; e-mail: ben.
Symp. VLSI, 2000, pp. 23–28. [email protected].

62 IEEE Design&Test
Authorized licensed use limited to: PSG COLLEGE OF TECHNOLOGY. Downloaded on January 03,2024 at 16:59:24 UTC from IEEE Xplore. Restrictions apply.