Specification and Analysis of the AER/NCA Active Network Protocol Suite in Real-Time Maude

Abstract

Abstract. This paper describes the application of the Real-Time Maude tool and the Maude formal methodology to the specification and analysis of the AER/NCA suite of active network multicast protocol components. Because of the time-sensitive and resource-sensitive behavior and the composability of its components, AER/NCA poses challenging new problems for its formal specification and analysis. Real-Time Maude is a natural extension of the Maude rewriting logic language and tool for the specification and analysis of real-time object-based distributed systems. It supports a wide spectrum of formal methods, including: executable specification; symbolic simulation; and infinite-state model checking of temporal logic formulas. These methods complement those offered by finite-state model checkers and general-purpose theorem provers. RealTime Maude has proved to be well-suited to meet the AER/NCA modeling challenges, and its methods have been effective in uncovering subtle and important errors in the informal use case specification.

Semantics and pragmatics of Real-Time Maude

“…Real-Time Maude does not come with built-in communication primitives; instead, the user can define her own form(s) of communication at the desired level of abstraction, without having to encode them using a given set of basic primitives. This has allowed us to model unicast message passing with different transmission times (see, e.g., Section 6.2) and more advanced communication forms such as multicast (with appropriate transmission times) through links [29] and geographically bounded broadcast in wireless sensor network systems [30]. In terms of expressiveness, Real-Time Maude stands in stark contrast not only to the timed and hybrid automata, but also to other formalisms and tools, such as the real-time models mentioned above, network simulation tools, and the IF toolset [6].…”

“…The tool has been used in a number of substantial applications, a subset of which is listed in Section 6.4. Real-Time Maude is based on earlier theoretical work on the rewriting logic specification of real-time and hybrid systems [23,28], and has benefited from the extensive experience gained with an earlier tool prototype [27,23], which was applied to specify and analyze a sophisticated multicast protocol suite [23,26]. As mentioned above, the current tool has simpler foundations based on more recent theoretical advances.…”

Formal Modeling and Analysis of the OGDC Wireless Sensor Network Algorithm in Real-Time Maude

“…Due to the large states involved, we restrict such analyses to systems with 5 to 6 nodes (in a 25m × 25m area), which is much fewer nodes than in a real WSN. Nevertheless, exhaustive analysis with 3 to 4 nodes has uncovered subtle bugs in cryptographic protocols [9] and other kinds of network protocols (e.g., [18]). …”

“…The high-performance Real-Time Maude tool provides a range of analysis techniques, including: timed rewriting for simulation purposes; timed search for reachability analysis; and time-bounded linear temporal logic model checking. Real-Time Maude has been used to model and analyze a set of advanced real-time systems, such as large communication protocols [18,8] and scheduling algorithms [13]. Such analysis has found subtle design errors not uncovered during traditional simulation and testing.…”

Distributed Applications Implemented in Maude with Parameterized Skeletons

“…It can be used to specify in a natural way a wide range of software models and systems, and since (most of) the specifications are directly executable, Maude can also be used to prototype those systems. It has already been used to specify and analyze distributed applications and protocols [4,12]. The recently incorporated support in Maude for communication with external objects makes many other application areas (such as mobile computing and distributed agents) ripe for system development in Maude.…”