Newtonian arbiters cannot be proven correct

Abstract

Abstract. Computing hardware is designed by refining an abstract specification through various lower levels of abstraction to arrive at a transistor layout implemented in a physical medium. Formalizing the refinements-one task of the mathematical semantics of computation-involves proving that the device described at each level of abstraction does indeed behave as prescribed by the description at the next higher level. One obstacle to this goal that has long been recognized is that certain classes of behaviors can be physically realized only approximately. The notorious problem of metastable operation precludes, for example, the realization on classical principles of flipflops that react in bounded time to arbitrary input signals.The literature suggests that the difficulty lies ultimately in the specification's requiring that the realizing device react properly in bounded time. We show, however, that a simple-time-unbounded synchronization problem, namely, mutual exclusion by means of an arbiter, cannot be solved with perfect reliability using continuous, i.e., Newtonian, physical phenomena. In particular, for any physical device operating on Newtonian principles that satisfies specific assumptions concerning an arbiter's input-output behavior, there always exist competing requests to which it reacts by granting them all.

Verifying an Arbiter Circuit

“…Our circuit parameters correspond to the TSMC 1.8V, 180nm bulk CMOS process. Our Brockett annuli for r 1 4 . This shows that g 1 starts to fall only when the discrete abstraction of r 1 is a logically low signal.…”

“…Obviously, it would be desirable if the arbiter were guaranteed to eventually issue a grant when contested requests occur; i.e., that state RR cannot be terminal. It is well known that a real arbiter cannot satisfy this requirement along with the safety requirements described above (see, for example, [1]). Thus, here we do not give a liveness requirement for traces with contested requests.…”

“…Mendler and Stroup [1] gave a formal specification for a continuous system to implement an arbiter. They used a dynamical systems theory argument to show that the specification is unsatisfiable by any continuous system.…”

Preventing glitches and short circuits in high-level self-timed chip specifications

“…The reason that there are two forms of branching, each inspired by Dijkstra's Guarded Command Language [6], is that the potentially erroneous one (known as deterministic choice) is extremely efficient to implement in hardware, whereas the error-free one (known as non-deterministic choice) is expensive and inevitably suffers from metastability issues [25].…”

Unfaithful Glitch Propagation in Existing Binary Circuit Models

“…Branicky [5] proved the impossibility of time-unbounded deterministic and time-invariant arbiters modeled as ordinary differential equations. Mendler and Stroup [18] considered the same problem in the context of continuous automata.…”