Fighting Livelock in the i-Protocol: A Comparative Study of Verification Tools

Abstract

The i-protocol, an optimized sliding-window protocol for GNU UUCP, came to our attention two years ago when we used the Concurrency Factory's local model checker to detect, locate, and correct a non-trivial livelock in version 1.04 of the protocol. Since then, we have repeated this verification effort with five widely used model checkers, namely, COSPAN, Murϕ, SMV, Spin, and XMC. It is our contention that the i-protocol makes for a particularly compelling case study in protocol verification and for a formidable benchmark of verification-tool performance, for the following reasons: 1) The i-protocol can be used to gauge a tool's ability to detect and diagnose livelock errors. 2) The size of the i-protocol's state space grows exponentially in the window size, and the entirety of this state space must be searched to verify that the protocol, with the livelock error eliminated, is deadlock-or livelock-free. 3) The i-protocol is an asynchronous, low-level software system equipped with a number of optimizations aimed at minimizing control-message and retransmission overhead. It lacks the regular structure that is often present in hardware designs. In this sense, it provides any verification tool with a vigorous test of its analysis capabilities.

The Engineering of a Model Checker: the Gnu i-Protocol Case Study Revisited.

“…Eight versions of this iprotocol model were obtained by varying window size, assumptions about the transmission channel, and the presence or absence of a patch for a known livelock error. The results as published in [1] show the XMC system to outperform the other model checking systems on most of the tests. It also contains a challenge to the builders of the other model checkers to match the results.…”

“…The details of the i-protocol, and the various versions of the model that were built to verify it, are given in [1] and need not be repeated here. We focus on the tests as reported in [1], specifically as they relate to Spin.…”

“…We focus on the tests as reported in [1], specifically as they relate to Spin. The three main parameters that were modified to obtain the eight testcases for the i-protocol model are as follows: 1.…”

Improving Non-Progress Cycle Checks

“…NPC checks are often performed in formal verifications of protocols, where livelocks frequently occur. Using SPIN, livelocks were found, for instance, in the i-protocol from UUCP (see [3]) and GIOP from CORBA (see [10]), whereas DHCP was proved to be free of livelocks (see [9]). To be able to check for NPCs, desired activities of the system are marked in PROMELA by labeling the corresponding location in the process specification with a progress label: "statementi; progress: statementj;".…”

“…Since many livelocks in practice occur after very little progress -e.g., for the i-protocol (cf. [3]) after 2 sends and 1 acknowledge -DFS FIFO comprises an efficient search heuristic. Additionally, shortest (w.r.t.…”