Analysis of the zeroconf protocol using UPPAAL

Abstract

We report on a case study in which the model checker Uppaal is used to formally model parts of Zeroconf, a protocol for dynamic configuration of IPv4 link-local addresses that has been defined in RFC 3927 of the IETF. Our goal has been to construct a model that (a) is easy to understand by engineers, (b) comes as close as possible to the informal text (for each transition in the model there should be a corresponding piece of text in the RFC), and (c) may serve as a basis for formal verification. Our conclusion is that Uppaal, which combines extended finite state machines, C-like syntax and concepts from timed automata theory, is able to model Zeroconf in a faithful and intuitive manner, using notations that are familiar to protocol engineers. Our modeling efforts revealed several errors (or at least ambiguities) in the RFC that no one else spotted before. We also identify a number of points where Uppaal still can be improved. After applying a number of abstractions, Uppaal is able to fully explore the state space of an instance of our model with three hosts.

Yet Another Autoconf Proposal (YAAP) for Mobile Ad Hoc NETworks

“…This model checker has previously and successfully been applied for other communication protocols (e.g. Zeroconf [15]).…”

Developing UPPAAL over 15 years

“…Its performance originally comes from zones 3 as a representation for states and the efficient implementation of operators on its canonical data‐structure known as difference‐bound matrix (DBM) 4. Since then the development has been fueled by scientific results on algorithms or new data structures 5–10, academic case‐studies 11–15, industrial case‐studies 16–20, and also teaching 21.…”

Parametric Analysis of an Improved Fault Tolerant System

“…As shown by our earlier work, the system falls into the case of the big state space problem [13,14].To make the testing and verification with fixed parameter values practically feasible, several abstraction techniques have been applied in the modeling previously. Still the same for the manual proof in our current paper, there is no interconnection between any two of the CPUs, and each voter can independently judge whether its corresponding CPU needs a restart.…”