Reliable Restricted Process Theory

Abstract

Malfunctions of a mobile ad hoc network (MANET) protocol caused by a conceptual mistake in the protocol design, rather than unreliable communication, can often be detected only by considering communication among the nodes in the network to be reliable. In Restricted Broadcast Process Theory, which was developed for the specification and verification of MANET protocols, the communication operator is lossy. Replacing unreliable with reliable communication invalidates existing results for this process theory. We examine the effects of this adaptation on the semantics of the framework with regard to the non-blocking property of communication in MANETs, the notion of behavioral equivalence relation and its axiomatization. We illustrate the applicability of our framework through a simple routing protocol. To prove its correctness, we introduce a novel proof process, based on a precongruence relation.Keywords: Mobile ad hoc network, restricted broadcast, process algebra, behavioral congruence, refinement.F. Ghassemi, W. Fokkink / Reliable Restricted Process TheoryThe set Loc is extended with the unknown address ? to represent the address of a node which is still not known or concealed from an external observer. For instance, the leader address of a node can be initialized to this value. Furthermore, to define the semantics of communicating nodes in terms of restrictions over the topology in a compositional way, the semantics of receive actions can be defined through an unknown sender, which will be replaced by a known address when the receive actions are composed with the corresponding send action at a specific node (see Section 4).A network constraint C is said to be well-formed if ∀ℓ, ℓ ′ ∈ Loc (ℓ ℓ ′ ∈ C ∨ ℓ ℓ ′ ∈ C). Let C v (Loc) denote the set of well-formed network constraints that can be defined over the network addresses in Loc. We define an ordering on network constraints. We say that C 1denotes the substitution of d 1 for d 2 in d; this can be extended to process terms. For instance, {B A} {? A} and {B A, B C} {B A}. Each well-formed network constraint C represents the set of network topologies that satisfy the (dis)connectivity pairs in C} extracts all one-hop (dis)connectivity information from γ. So the empty network constraint {} still denotes all possible topologies over Loc. The negation ¬ C of network constraint C is obtained by negating all its (dis)connectivity pairs. Clearly, if C is well-formed then so is ¬ C.Constrained labeled transition systems (CLTSs) provide a semantic model for the operational behavior of MANETs. Let Msg denote a set of messages communicated over a network and ranged over by m. Let Act be the network send and receive actions with signatures nsnd : Msg × Loc and nrcv : Msg, respectively. The send action nsnd (m, ℓ) denotes that the message m is transmitted from a node with the address ℓ, while the receive action nrcv (m) denotes that the message m is ready to be received. Let Act τ = Act ∪ {τ }, ranged over by η.Generally speaking, the transition s (C,η) − −−− → s ′ expresse...