Transcription

1 VericationofAsynchronousCircuits usingtimedautomata MariusBozga,HouJianmin,OdedMalerandSergioYovine InthisworkweapplythetimingvericationtoolOpenKronos,whichis Abstract basedontimedautomata,toverifycorrectnessofnumerousasynchronouscircuits. Thedesiredbehaviorofthesecircuitsisspeciedintermsofsignal correctlyundertheassumptionthattheinputssatisfythestgconventions transitiongraphs(stg)andwecheckwhetherthesynthesizedcircuitsbehave andthatthegatedelaysareboundedbetweentwogivennumbers.ourresults demonstratetheviabilityofthetimedautomatonapproachfortiminganalysis ofcertainclassesofcircuits. 1 Introduction Todaymostofcircuitvericationandanalysisisdonewhilemaintainingaseparationbetweenthelogicalfunctionalitiesofacircuitandthedelaypropertiesofits components.forclockedsynchronouscircuits,thesizeoftheclockcyclecanbedeterminedbycomputingtheaccumulateddelaysalongthelongestpathfrominputs tolatches.assumingthatthecycletimeissucientlylarge,thefunctionalvericationofthecircuitcanproceedbyignoringgateandwiredelaysandbytreatingthe divisionoflabormakescircuitdesignandvericationamoretractableprocess,it wholecircuitattheabstractionlevelofanuntimedsequentialmachine.whilethis Thereasonisthatinrealitylogicandtiminghavecomplexmutualinteractions, makesitmorediculttosatisfytheever-growingdemandsformoreperformance. pathlengthcandiersignicantlyintheirmaximalstabilizationtimes.thepath andtwodierentrealizationsofthesamecombinationalfunction,havingthesame lengthonlygivesanupper-approximationofthepropagationdelay,takingintoaccountworst-caseswhichare,moreoftenthannot,impossiblewhenlogicistaken intoaccount(\falsepaths"). thespeed-independentparadigm.thedesiredbehaviorofacircuitisspeciedasa Alotofasynchronouscircuits[U69,KKTV93,BS94]designhasbeendonewithin kindof\protocol"betweenthecircuitanditsenvironment. notassumetwodistinctphasesineveryoperationcycle(arrivalofinputsandcomputationofnext-stateandoutput)andhencethecircuitspecicationcannotbe decomposednaturallyintoacombinationalfunctionandamemory.1 Verimag,CentreEquation,2,av.deVignate,38610Gieres,France,@imag.fr Themajor Thisprotocoldoes 1Thisisnotthecaseinburst-modecircuitswhichareoutofthescopeofthispaper. 1

2 burdeninasynchronousdesignistodetectoccurrencesofcertainsubsetsofevents inthecircuit.thisapproachrequiresalargesiliconinvestmentinevent-detection (whichmayappearinvariousorders)whicharesucientfortriggeringfurtherevents mechanismsandithasbeenobserved[ckk+98]thatbytakingdelayinformation actuallyhappenandthesizeofthecircuitcanbereducedsignicantlybyputting intoaccount,manybehaviorsanticipatedbythespeed-independentdesigncannot suchbehaviorsinthe\don't-care"category. betweenlogicanddelayscanbeexpressednaturally,andwhichcanserveasabasis Theseandotherobservationscallforaformalmodelinwhichtheinteraction fordesignandvalidationtoolsthattakeadvantageofthisexpressivepower.timed automata[ad94]constitutesuchamodel.theseareautomataaugmentedwithctitiousclockvariableswhoseroleinthemodelistomeasurethetimeelapsedsince theoccurrenceofcertainevents.usingtheseclocks,thephenomenonofuncertain manner.ofcourse,timedautomata(henceforthta)inheritfromautomatathecapabilitytomodelanycomplexdiscretedynamicsandhencetheyaremoreexpressive thanmodelsbasedontimedmarkedgraphsandthemax-plusalgebra.indeed,it wasshown[d89,l89,mp95]thatcircuitswithbi-boundedgateorwiredelayscan betransformedintonetworksoftimedautomatawhichcanserveasabasisforsimu- butboundeddelaybetweentwoormoreeventscanbeexpressedinaverynatural implemented[lpy97,doty96]andappliedtovariousproblems,includingtiming lation,vericationandautomaticdesign.severaltoolsfortavericationhavebeen tivemodelswhichareusedtoaddressthesameclassofproblemarebasedonsome analysisofcircuits[my96,bmpy97,tb97,tkb97,tky+98,bmt99].alterna- variantsoftimedpetrinets[bd91,hb95,bm98,sy95,yr99,kb99,zm00]and itwillbeinterestingtocomparethemwiththeta-basedapproachbothinterms ofmodelingandexpressivityandintermsofunderlyingcomputationaldiculty. andthetoolopenkronos[bdm+98]tothevericationofasynchronouscircuits.we ThisworkdescribestheapplicationoftheTA-basedvericationmethodology taketwodozensoftypicalasynchronouscircuitsrealizedbygateshavingbi-bounded circuitsbehaveaccordingtotheirspecications.ourperformanceresultsindicate delays. UsingstandardTAreachabilitymethodsweattempttoverifythatthese wereabletoverifycircuitswithupto17gates)andfromwhereyouneedtoaugment howfaronecangobyapplyingbrute-forcevericationtotherichtamodel(we takeadvantageofthespecialstructureofthesub-classoftathatcorrespondto vericationwithacompositionalmethodologyandwithspecializedtechniquesthat circuits. wemodelbi-boundeddelaysusingtimedautomataandhowtimingvericationis Therestofthepaperisorganizedasfollows: insection2wedescribehow appliedtothesemodels. jointbehaviorofthecircuitandofitsstgspecicationareconvertedintoatimed InSection3weillustrate,usinganexample,howthe automataandanalyzedbyopenkronos. benchmarkexamplesarereportedinsection4. Finally,thevericationresultsforthe 2

3 f1 f2 f3 [l1;u1] y1 x1 [l2;u2] y2 x2 [l3;u3] y3 x3 Figure1:Acircuitwithdelays. 2 ModelingDelayswithTimeAutomata boundeddelaysusingtimedautomata[mp95,my96,bmt99].weviewacircuit Inthissectionwesketchinformallyourapproachformodelingcircuitswithbi- asanetworkconsistingofbooleangatesand(non-deterministic)delayelementsas tosignals. infigure1.abooleangatecanbeviewedasamemorylessfunctionfromsignals upper-boundsonthepropagationtimesofeventsfromtheinputtotheoutput(wire Eachdelayelementischaracterizedbyaninterval[l;u]oflower-and Weassumethatthedelaysareinertial:changesthatdonotpersistforltimeare delayscanbemodeledasaspecialcasewherethebooleanfunctionistheidentity). lteredaway.morereneddelaymodelscanbedenedatthepriceofmorecomplex analysis. uncountably-manydierentoutputsignals,asdemonstratedinfigure2,andhence Duetouncertaintyadelayelementcantransformaninputsignalinto thecorrespondingoperatord[l;u]isnon-deterministic,i.e.set-valued.thesemantics ofthecircuitisthesetofallsolutionsofasystemofequationsandinclusionson signalsoftheform: Wetranslateeveryequationintoatimedautomatonwhosesetofbehaviors yi=fi(x1;:::;xn) xi2d[li;ui](yi) automatageneratesexactlyallthepossiblebehaviorsofthecircuitunderallpossible coincideswiththesetofsolutionsoftheequationandthecompositionofallthese aone-stateautomatonwhichgeneratesallthetuplessatisfyingtheequation.each choicesofdelays.theautomatonforabooleangateyi=fi(x1;:::;xn)issimply delayelementoftheformx2d[l;u](y)ismodeledbyonetimedautomatonwith theinputyandtheoutputxareboth0. 4statesandoneclockasdepictedinFigure3.State(0;0)isastablestatewhere atransitiontotheexcitedstate(1;0)ismadeandaclockcisresettozeroand Assoonastheinputychangesto1, signiesa\regret"oftheinputbeforethepropagationoftheeventtotheoutput. startsmeasuringthetimesincetheevent.thetransitionfrom(1;0)backto(0;0) inputbehavesaccordingtosomeprotocol,orbereplacedbyan\error"transition Suchregrettransitionscanbeavoidedincertainmodelswhichassumethatthe ifthedesignmethodologydisallowssuchphenomena.whenatstate(1;0),ifthe clockvaluecrossesthelowerboundl,theoutputcanchangeto1andtheautomaton movestothestablestate(1;1).however,aslongastheupperbounduhasnotbeen reached,theautomatonmaystayin(1;0).theabilitytoexpressandanalyzethis 3

4 Figure2:Aninputsignalandasamplef1;:::;7gofthesetD[1;3]()ofits delayedoutputs. temporaluncertaintyisthemainfeatureofta.unlikedeterministicmodelsused inspicesimulation,acircuitmodeledusingsuchbi-boundeddelayelementsand theircorrespondingtawillhavemanybehaviors,eveninthepresenceofasingle basedonthepossiblerangesofthevaluesofclockvariables.thegeneratorsofinput inputsignal.howeverallthesebehaviorscanbecapturedusinggeometricmethods inputssuchastimingboundsontheirfrequencyorsomeprotocolsofinteraction signalscanalsobemodeledastimedautomata,expressingvariousrestrictionsonthe withthecircuitthattheyfollow. modelthecircuit,itispossible,inprinciple,tosimulateallthepossiblebehaviorsof Bycombiningtheseautomatawiththosethat thecircuit,inthepresenceofalladmissibleinputsandchoicesofdelaysandhence liftformalvericationmethodologyfromuntimedtotimedcircuitmodels. Figure4.Supposethatinitiallytheyarebothinstate0andhencethereachability Asanillustrativeexampleconsiderthetwoindependentoscillatorsappearingin maystayat(0;0)aslongasnoneoftheclockshascrosseditscorrespondingupperbound.inthisexample,whereu1<u2,thesetofclockvaluesreachableviatime analysisstartsatglobalstate(0;0)withclocksat(0;0).theproductautomaton passageatstate(0;0)isf(x1;x2):x1=x2u1g.byintersectingthissetwith whichdenotesalltheclockvaluationsinwhichthetransitionfrom(0;0)to(1;0)is thetransitionguardc1l1weobtainthesetf(x1;x2):l1x1=x2u1g enabled.sincethistransitionresetsc1wemayreach(1;0)atanypointintheclock reachthesetf(x1;x2):l1x2u2^l1x2?x1u1g,andthisset,inturn,can spacebelongingtof(0;x2):l1x2u1g.fromthere,bytimepassage,wemay beintersectedwiththeconditionc2l2formovingto(1;1)etc.thereadercan ndformaldenitionsoftareachabilityanalysisin[a99,y98]. FromatheoreticalstandpointalltheinterestingproblemsconcerningTA(and 4

5 y=0 (0;0) y=1=c:=0 y=0^c<u C<u y=1^ (1;0) Cu lc^ y=1^ Cu lc^ y=0^ y=0^ y=1^c<u C<u (0;1) y=0=c:=0 y=1 (1;1) Figure3:Thetimedautomatonforadelayelement.Therunsoftheautomatonare exactlythosesatisfyingy2d[l;u](x). C1<u1 0 C1l1=C1:=0 C1<u1 1 C1l1=C1:=0 C2<u2 0 C 2l2=C2:=0 C 2<u2 1 C2l2=C2:=0 u2 l2 u2 l2 (0;0) l1(0;1) u1 u2 (1;0) l2 l1 u1 u2 (1;1) l2 l1 u1 l1 u1 Figure4:(a)TwoTArepresentingtwoindependentoscillators.(b)Therststeps (a) (b) incomputingalltheirpossiblebehaviors.dashedlinesindicatediscretetransitions. 5

6 circuitsmodeledbythem)canbesolvedalgorithmically.theseproblemsinclude absenceofhazards,boundedresponseproperties,absenceofshortcutsintransistor rentlyclassiedunderdierentsub-topicsincircuitdesign.otherproblemswhich models,conformancewithcommunicationprotocolsandmanyotherpropertiescur- automaticderivationofdelayparametersandtransitionconditionsinordertoguaranteesatisfactionofcertainproperties)andthetime-optimalcontrollersynthesis canbeformulatedandtheoreticallysolvedarethecontrollersynthesisproblem(the problem(choosingparametersandconditionsthatwillleadtheautomatonintoa tionalcircuit).however,duetothecomplexityoftaanalysis,manyresearchers setofstatesassoonaspossible,e.g.intothesetofstablestatesinacombina- inthelongrunitisbettertoseparateconsiderationsofmodelingadequacyfrom andpractitionerspreferlessexpressivebutmoretractablemodels.webelievethat morepragmaticconsiderationsrelatedtotoolperformance. bettertohaverstageneralmodelwhichdescribesthephenomenoninquestionin Inotherwords,itis vericationcomplexity.ourstrategyisthustousethefulltamodelandseewhat afaithfulmannerandonlylatertodevisevarioustechniquesinordertoovercome isthelargestchunkofcircuitrythatcanbewhollyanalyzedusingtatechnology, beforeresortingtoabstractionandapproximationtechniques. 3 ModelingandVericationofAsynchronousCircuits WehaveappliedOpenKronostoseveralbenchmarkexamplesofasynchronouscircuitstakenfrom[PCKP00].Theintendedbehaviorsofthesecircuitswerespecied usingsignaltransitiongraphs(stgs),whichareakindofpetrinetlabeledbyevents correspondingtorisingandfallingofsignals.anstgrepresentsa\protocol"of interactionbetweenacomponentanditsenvironment. thecircuithalfwhichrealizesahalfhandshakebetweentwoadjacentstagesina Asanexample,consider andao.thebehaviorisspeciedbythestgoffigure5-(b).thisspecication pipeline. ThecircuithastwoinputsignalsRiandAiandtwooutputsignalsRo denesonlyapartial-orderamongeventsandisindierent,forexample,totheorder Figure5-(c)whichacceptsallthelinearizationsofthepartial-order.Itisassumed betweenao+andai+.themarkinggraphofthisspecicationistheautomatonof up).wewanttoverifywhetherthecircuitimplementationbehavesproperly,that thattheenvironmentrespectsthespecication(e.g.aiwillnotrisebeforerogoes is,theaoandroeventstakeplacewhentheyareallowedbythestg. thestgswherefedintothesynthesistoolpetrify[ckk+97]whichproducesspeed- Thecircuitsrealizingthespecicationsweresynthesizedasfollows. Initially independentcircuitsusinggateswitharbitraryfan-in.whilesuchcircuitsarespeed- independentbyconstruction(andhencedonotneedverication)theirrealizations, usinggatestakenfromastandardcelllibrary,isnot. specicationisdepictedinfigure5-(d)andithasveinternalvariablesinaddition Thecircuitforthehalf toinputsandoutputs.thegatedelaysareassumedtobeintheinterval[27;33]. eledasaproductoftimedautomatawithaclockforeachgate{inthiscase7clocks. Accordingtotheprinciplesdescribedintheprevioussectionthecircuitismod- Thistimedautomatondescriptionisgeneratedautomaticallyfromthecircuits.The 6

7 Ri Ao Ro Ai INPUTS: Ai,Ri OUTPUTS: Ao,Ro Ro+ Ao+ Ai+ Ri- Ro- Ao- Ri+ Ai- (a) (b) 0 1 Ro+ 2 Ao+ 3 Ai+ 4 Ri- 5 Ai+ Ao+ 6 Ai+ Ri- 7 Ro- 8 Ro- Ri- 9 Ai- 10 Ao- 11 Ai- Ri- 12 Ri+ 13 Ai- Ao- Ai- Ri+ Ai Ro Ao Ri (c) (d) Figure5:Thehalfcircuit:(a)Theblockdiagram. (b)thestgspecication circuit.theboxesarepntransitionslabeledbyrisingandfallingofsignals.all thepnplaces,exceptthosewithtokensattheinitialcongurations,areomitted. (c)theequivalentautomatonforthespecication.(d)thesynthesizedcircuit. 7

8 STGspecicationistranslatedautomaticallyintoanuntimedautomatonisomorphictothemarkinggraph,witherrortransitionsaddedforeveryoutputeventand state3intheautomatonoffigure5-(c)). astateinwhichitisnotenabled(e.g.eventr0-inducesanerrortransitionfrom inter-arrivaltimesoftheinputeventsaremodeledusinganadditionalautomaton Additionaltimingconstraintsonthe andaclockforeachinputsignal. behaviorsofthecircuitcontainsabehaviornotincludedinthesemanticsofthestg. Thevericationproblemthatweposeiswhetherthesetofallthetime-constrained Technicallythisquestionisequivalenttowhetheranerrortransitionisreachable inthecompositionofalltheabovementionedautomata.forthehalfcircuit,ifwe assumenotimingrestrictionsontheinputs,wendthefollowingerrortrace: Ro-Ai Ao-Ri+Ro+Ai+2+27Ro- 27Ro+Ai Ao+Ri risingofai.thenaftermore27timetheoutputofgate3fallsandthatofgate2 Inthistrace,Rogoesupafter27timeunitsandthisisfollowedimmediatelyby rises,andsoon,untilnallyro-occursbeforebeingenabledbya0+.ontheother sometimein[900;1111],thecircuitisprovedcorrect(similarresultsunderthislast hand,ifweassumethattheanytwochangesofaninputvariableareseparatedby assumptionwereobtainedin[pckp00]). 4 ExperimentalResults Wehaveappliedtheproceduredescribedaboveto21asynchronouscircuitswhose withnvariableshasnclocksandupto2ndiscretestates(notallwhichmightbe sizesrangebetween6to24gates.atimedautomatoncorrespondingtoacircuit reachable).theanalysisisperformedontheproductofthistawiththeautomata forthestgspecicationandtheautomatathatmodelthetime-constrainedinputs tocomputethe\simulationgraph"(see[y98])whosestatesarepairsoftheform (OpenKronosgeneratestheproduct\on-the-y").Foreachcircuitwehavetried Dependingonthetemporalcomplexityoftheautomaton,thesizeofthisgraphmight (q;f)whereqisadiscretestateandfisapolyhedralsubsetoftheclockspace. besignicantlylargerthanthenumberofdiscretestates.computingthesimulation graphamountstocomputingallthereachablestatesoftheta,andthiscomputation isneededtoprovethatthecircuitiscorrect.forincorrectcircuitsbugscanusually befoundmuchbeforethecompletionofthiscomputation.astable1shows,wewere 6,wewereabletocomputearound500000symbolicstatesinabout10minutes abletoperformthisexhaustiveanalysisto15circuitsoutof21.fortheremaining withtheavailablememory(alltheresultswereobtainedonasunultrasparc10 with2gbofmemory).amongthesewefound,nevertheless,bugsintwo,namely analysisalgorithmfortimedautomata,unliketheapproachof[pckp00],which tsend-bmandmr1. Theseresultswereobtainedusingthestandardreachability untimedanalysisisapplied. inspiredourwork,whereaspecialheuristicwhichalternatesbetweentimedand asynchronouscircuitsisasourceofoptimismconcerningthefutureapplicability TheabilityofOpenKronostotreatsuchnon-trivial 8

9 no. 1 name allocoutbound gates 11 states 313 transitions 366 time(sec) 0.09 correct 2 chu converta d N 56 ebergen half mpforwardpkt nowick rcvsetup rpdft sbuframwrite sbufreadctl sbufsendctl sbufsendpkt vme mr Y tsendbm mmu N 19 mr ramreadsbuf Table1:Theperformanceresultsforthebenchmarkasynchronouscircuits. 21 trimossend ? numberofstatesandtransitionarethoseofthesimulationgraphandthetime The gurescorrespondtothedurationofcomputingthisgraph. oftaanalysistotimingverication. achievedwithoutanyheuristic,muchlargercircuitscouldbeveriedbycombining Webelievethatiftheseresultscouldbe thevericationengineofopenkronoswithgeneralandcircuit-specicabstraction andapproximationtechniques[b96,aiky95,wd94,takb96,zm00],combination ordermethods[bm98]andothertechniquesreportedintheliterature. oftimedanduntimedverication[pckp00],relativetiming[sgr99,kb99],partial- Acknowledgment: uswiththebenchmarksandformanyrelateddiscussions. WethankJordiCortadellaandMarcoPenaforproviding KishinevskiandLucianoLavagnoansweredvariousquestionsconcerningasynchronous KenStevens,Mike circuits. References [A99] R.Alur,TimedAutomata,Proc.CAV'99LNCS1633,8-22,Springer, [AD94] R.AlurandD.L.Dill,ATheoryofTimedAutomata,TheoreticalComputerScience126,183{235,

10 [AIKY95] SuccessiveApproximation,InformationandComputation118, , R.Alur,A.Itai,R.P.KurshanandM.Yanakakis,TimingVericationby [AMP98] E.Asarin,O.MalerandA.Pnueli,OntheDiscretizationofDelaysin TimedAutomataandDigitalCircuits,inR.deSimoneandD.Sangiorgi [B96] F.Balarin,ApproximateReachabilityAnalysisofTimedAutomata, (Eds),Proc.Concur'98,LNCS1466, ,Springer,1998. [BD91] Proc.RTSS'96,52-61,IEEE,1996. B.BerthomieuandM.Diaz,ModelingandVericationofTimeDependentSystemsusingTimePetriNets,IEEETrans.onSoftwareEngineering17, ,1991. [BM98] W.BelluominiandC.J.Myers,VericationofTimedSystemsUsing POSETs,inA.J.HuandM.Y.Vardi(Eds.),Proc.CAV'98, , [BDM+98] M.Bozga,C.Daws,O.Maler,A.Olivero,S.Tripakis,andS.Yovine, LNCS1427,Springer,1997. LNCS1427,Springer,1998. Kronos:aModel-CheckingToolforReal-TimeSystems,Proc.CAV'98, [BMPY97] M.Bozga,O.Maler,A.Pnueli,S.Yovine,SomeProgressintheSymbolicVericationofTimedAutomata,inO.Grumberg(Ed.)Proc. [BMT99] CAV'97, ,LNCS1254,Springer,1997. AutomatausingDenseandDiscreteTimeSemantics,inL.Pierreand M.Bozga,O.MalerandS.Tripakis,EcientVericationofTimed T.Kropf(Eds.),Proc.CHARME'99, ,LNCS1703,Springer, [BS94] J.A.BrzozowskiandC-J.H.Seger,AsynchronousCircuits,Springer, [CKK+97] J. A.Yakovlev,Petrify:atoolformanipulatingconcurrentspecications Cortadella, M. Kishinevsky, Kondratyev, L. Lavagno and andsynthesisofasynchronouscontrollers,ieicetransactionsoninformationandsystems,vol.e80-d,no.3,march1997,pages [CKK+98] J.Cortadella,M.Kishinevsky,A.Kondratyev,L.Lavagno,A.Taubin timizationofasynchronouscircuits,inproc.iccad'98, ,1998. anda.yakovlev,lazytransitionsystems:applicationtotimingop- [D89] D.L.Dill,TimingAssumptionsandVericationofFinite-StateConcurrentSystems,inJ.Sifakis(Ed.),AutomaticVericationMethodsfor [DOTY96] FiniteStateSystems,LNCS407, ,Springer,1989. "HybridSystemsIII,VericationandControl",LNCS1066,Springer, C.Daws,A.Olivero,S.Tripakis,andS.Yovine,ThetoolKronos,in

11 [HB95] H.HulgaardandS.M.Burns,EcientTimingAnalysisofaClassof [KB99] H.KimandP.A.Beerel,RelativeTimingBasedVericationofTimed PetriNets,Proc.CAV'95,1995. [KKTV93] CircuitsandSystems,Proc.IWLS'99,June1999. M.Kishinevsky,A.Kondratyev,A.TaubinandV.Varshavsky,ConcurrentHardware:TheTheoryandPracticeofSelf-TimedDesign,Wiley, [LPY97] K.G.Larsen,P.PetterssonandW.Yi,UPPAALinaNutshell,Software [L89] H.R. ToolsforTechnologyTransfer1/2,1997. BoundedTemporalUncertainty,TR15-89,HarvardUniversity,1989. Lewis, Finite-state Analysis of Asynchronous Circuits with [MP95] O.MalerandA.Pnueli,TimingAnalysisofAsynchronousCircuits CHARME'95,LNCS987, ,Springer,1995. usingtimedautomata,inp.e.camurati,h.eveking(eds.),proc. [MY96] O.MalerandS.Yovine,HardwareTimingVericationusingKRONOS, InProc.7thIsraeliConferenceonComputerSystemsandSoftwareEngineering,Herzliya,Israel,June1996. [PCKP00] M.A.Pena,J.Cortadella,A.KondratyevandE.Pastor,FormalVericationofSafetyPropertiesinTimedCircuits,Proc.Async'00,2-11, IEEEPress,2000. [RM94] T.G.RokickiandC.J.Myers,AutomaticVericationofTimedCircuits, [SY95] A.SemenovandA.Yakovlev,VericationofAsynchronousCircuits Proc.CAV'94,June,1994. [SGR99] basedontimedpetrinetunfolding,proc.tau'95, ,1995. Async'99,1999. K.S.Stevens, R.Ginosar, ands.rotem, RelativeTiming, Proc. [TAKB96] tionsoftimedsystems,inproc.concur'96, ,springer,1996. S.TasiranR.Alur,R.P.KurshanandR.Brayton,VerifyingAbstrac- [TB97] tionalandhierarchicaltimingverication,ino.grumberg(ed.)proc. S.TasiranandR.K.Brayton, STARI:ACaseStudyinComposi- [TKB97] S.Tasiran,Y.KukimotoandR.K.Brayton,ComputingDelaywith CAV'97, ,LNCS1254,Springer,1997. [TKY+98] CouplingusingTimedAutomata,Proc.TAU'97,1997. S.Tasiran,S.P.Khatri,S.Yovine,R.K.BraytonandA.SangiovannitationofCircuitDelayinthePresenceofCross-Talk,FMCAD'98,1998. Vincentelli,ATimedAutomaton-BasedMethodforAccurateCompu- 11

12 [WD94] [U69] H.Wong-ToiandD.L.Dill,ApproximationsforVerifyingTimingProperties,inT.RusandC.Rattray(Eds.),TheoriesandExperiencesfor S.H.Unger,AsynchronousSequentialSwitchingCircuits,Wiley,1969. [YR99] T.YonedaandH.Ryu,TimedTraceTheoreticVericationusingPartial Real-TimeSystemDevelopment,WorldScienticPublishing,1994. [Y98] S.Yovine, OrderReduction,Proc.Async'99, ,1999. F.Vaandrager(Eds.),LecturesonEmbeddedSystems,LNCS1494, Model-checkingtimedautomata, ing.rozenbergand [ZM00] Springer,1998. H.ZhengandC.J.Myers,AutomaticAbstractionforSynthesisandVericationofDeterministicTimedSystems,Proc.TAU'2000,December,