[Paper Review] Re-verification of a Lip Synchronization Protocol using Robust Reachability

Piotr Kordy, Rom Langerak+1 more|arXiv (Cornell University)|Mar 1, 2010

Formal Methods in Verification3 citations

TL;DR

This paper re-verifies a lip synchronization protocol using robust reachability in timed automata to assess resilience against clock drift. It reveals that even with ideal clocks, the protocol cannot guarantee long-term synchronization due to accumulating timing drift, especially in video stream handling, and identifies limitations in current robust verification tools, such as inability to detect deadlocks and support for strict guards.

ABSTRACT

The timed automata formalism is an important model for specifying and analysing real-time systems. Robustness is the correctness of the model in the presence of small drifts on clocks or imprecision in testing guards. A symbolic algorithm for the analysis of the robustness of timed automata has been implemented. In this paper, we re-analyse an industrial case lip synchronization protocol using the new robust reachability algorithm. This lip synchronization protocol is an interesting case because timing aspects are crucial for the correctness of the protocol. Several versions of the model are considered: with an ideal video stream, with anchored jitter, and with non-anchored jitter.

Motivation & Objective

• To assess the robustness of a lip synchronization protocol under small clock drifts using robust reachability.
• To evaluate the performance and limitations of the robust reachability algorithm in practice.
• To identify whether the protocol remains correct under realistic timing imperfections, especially in video stream handling.
• To investigate the gap between standard and robust semantics in real-time protocol verification.
• To highlight tool limitations, such as inability to detect deadlocks and support for strict guards, in robust verification.

Proposed method

• The paper models the lip synchronization protocol using timed automata with clocks, guards, and synchronization signals.
• It applies a symbolic robust reachability algorithm that computes reachable states under arbitrary small clock drifts.
• The analysis compares standard semantics (ideal clocks) with robust semantics (clock drifts allowed) across multiple variants: ideal video stream, anchored jitter, and non-anchored jitter.
• The algorithm tracks stable zones to efficiently represent sets of reachable configurations under perturbations.
• Verification is performed using an extended version of the UPPAAL tool, with focus on reachability and error state detection.
• Manual analysis supplements automated results to detect potential deadlocks and edge cases not captured by the tool.

Experimental results

Research questions

• RQ1 Does the lip synchronization protocol remain correct under small clock drifts, as per robust semantics?
• RQ2 How does the robust reachability algorithm perform in terms of scalability and precision on an industrial case study?
• RQ3 What are the key differences between verification results under standard and robust semantics for this protocol?
• RQ4 Why does the protocol fail to maintain synchronization over long playback durations despite precise clocks?
• RQ5 What are the limitations of current robust reachability tools in detecting deadlocks and handling strict guards?

Key findings

• The protocol cannot guarantee long-term lip synchronization under any clock precision due to unbounded drift accumulation in the video stream's vmins variable.
• Even with ideal video streams and no initial delay, the protocol eventually reaches a video synchronization error state due to clock drift, making it non-robust.
• The robust reachability algorithm detects that video-related error states are reachable under drift, while audio-related states remain stable due to synchronized resets.
• Verification under robust semantics takes significantly longer than under standard semantics due to the need to track many stable zones.
• The tool cannot detect deadlocks robustly because it does not support strict guards, which are needed to complement guards for deadlock detection.
• Manual analysis reveals potential deadlocks not detected by the tool, suggesting that robust deadlock detection remains an open challenge.