Design and Validation of Computer Protocols
Total Page：16
File Type：pdf, Size：1020Kb
DESIGN AND VALIDATION OF COMPUTER PROTOCOLS Gerard J. Holzmann Bell Laboratories Murray Hill, New Jersey 07974 PRENTICE-HALL Englewood Cliffs, New Jersey 07632 Prentice Hall Software Series Brian W. Kernighan, Advisor Copyright 1991 by Lucent Technologies, Bell Laboratories, Incorporated. This book is typeset in Times Roman by the author, using an Linotronic 200P phototypesetter and a DEC VAX 8550 running the 10th Edition of the UNIX operating system. DEC and VAX are trademarks of Digital Equipment Corporation. UNIX is a registered trademark of AT&T. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 Prentice-Hall International (UK) Limited, London Prentice-Hall of Australia Pty. Limited, Sydney Prentice-Hall Canada Inc., Toronto Prentice-Hall Hispanoamericana, S.A., Mexico Prentice-Hall of India Private Limited, New Delhi Prentice-Hall of Japan, Inc., Tokyo Simon & Schuster Asia Pte. Ltd., Singapore Editora Prentice-Hall do Brasil, Ltda., Rio de Janeiro CONTENTS Foreword ix Preface xi Part I Ð Basics 1. Introduction 1.1 Early Beginnings 1 1.2 The First Networks 9 1.3 Protocols as Languages 12 1.4 Protocol Standardization 13 1.5 Summary 15 Exercises 16 Bibliographic Notes 16 2. Protocol Structure 2.1 Introduction 19 2.2 The Five Elements of a Protocol 21 2.3 An Example 22 2.4 Service and Environment 26 2.5 Vocabulary and Format 32 2.6 Procedure Rules 35 2.7 Structured Protocol Design 35 2.8 Ten Rules of Design 38 2.9 Summary 39 Exercises 39 Bibliographic Notes 40 3. Error Control 3.1 Introduction 43 3.2 Error Model 44 3.3 Types of Transmission Errors 46 3.4 Redundancy 46 3.5 Types of Codes 47 3.6 Parity Check 48 3.7 Error Correction 48 3.8 A Linear Block Code 52 3.9 Cyclic Redundancy Checks 56 3.10 Arithmetic Checksum 63 3.11 Summary 64 Exercises 64 Bibliographic Notes 65 4. Flow Control 4.1 Introduction 66 4.2 Window Protocols 70 4.3 Sequence Numbers 74 4.4 Negative Acknowledgments 80 4.5 Congestion Avoidance 83 4.6 Summary 86 Exercises 87 Bibliographic Notes 88 Part II Ð Specification and Modeling 5. Validation Models 5.1 Introduction 90 5.2 Processes, Channels, Variables 91 5.3 Executability of Statements 91 5.4 Variables and Data Types 92 5.5 Process Types 93 5.6 Message Channels 96 5.7 Control Flow 100 5.8 Examples 102 5.9 Modeling Procedures and Recursion 104 5.10 Message Type Definitions 104 5.11 Modeling Timeouts 105 5.12 Lynch's Protocol Revisited 106 5.13 Summary 107 Exercises 108 Bibliographic Notes 109 6. Correctness Requirements 6.1 Introduction 111 6.2 Reasoning about Behavior 112 6.3 Assertions 114 6.4 System Invariants 115 6.5 Deadlocks 117 6.6 Bad Cycles 118 6.7 Temporal Claims 119 6.8 Summary 125 Exercises 126 Bibliographic Notes 127 7. Protocol Design 7.1 Introduction 128 7.2 Service Specification 129 7.3 Assumptions about the Channel 130 7.4 Protocol Vocabulary 131 7.5 Messsage Format 133 7.6 Procedure Rules 140 7.7 Summary 160 Exercises 160 Bibliographic Notes 161 8. Finite State Machines 8.1 Introduction 162 8.2 Informal Description 162 8.3 Formal Description 169 8.4 Execution of Machines 170 8.5 Minimization of Machines 171 8.6 The Conformance Testing Problem 174 8.7 Combining Machines 175 8.8 Extended Finite State Machines 176 8.9 Generalization of Machines 178 8.10 Restricted Models 181 8.11 Summary 184 Exercises 185 Bibliographic Notes 185 Part III Ð Conformance Testing, Synthesis and Validation 9. Conformance Testing 9.1 Introduction 187 9.2 Functional Testing 188 9.3 Structural Testing 189 9.4 Deriving UIO Sequences 195 9.5 Modified Transition Tours 196 9.6 An Alternative Method 197 9.7 Summary 199 Exercises 200 Bibliographic Notes 200 10. Protocol Synthesis 10.1 Introduction 203 10.2 Protocol Derivation 203 10.3 Derivation Algorithm 208 10.4 Incremental Design 210 10.5 Place Synchronization 210 10.6 Summary 211 Exercises 212 Bibliographic Notes 212 11. Protocol Validation 11.1 Introduction 214 11.2 Manual Proof Method 214 11.3 Automated Validation Methods 218 11.4 The Supertrace Algorithm 226 11.5 Detecting Non-Progress Cycles 231 11.6 Detecting Acceptance Cycles 234 11.7 Checking Temporal Claims 235 11.8 Complexity Management 235 11.9 Boundedness of PROMELA Models 237 11.10 Summary 238 Exercises 239 Bibliographic Notes 240 Part IV Ð Design Tools 12. A Protocol Simulator 12.1 Introduction 243 12.2 SPIN Ð Overview 244 12.3 Expressions 245 12.4 Variables 255 12.5 Statements 265 12.6 Control Flow 275 12.7 Process and Message Types 282 12.8 Macro Expansion 292 12.9 SPIN Options 293 12.10 Summary 294 Exercises 295 Bibliographic Notes 296 13. A Protocol Validator 13.1 Introduction 297 13.2 Structure of the Validator 298 13.3 The Validation Kernel 299 13.4 The Transition Matrix 302 13.5 The Validator-Generator Code 303 13.6 Overview of the Code 306 13.7 Guided Simulation 308 13.8 Some Applications 310 13.9 Coverage in Supertrace Mode 315 13.10 Summary 316 Exercises 316 Bibliographic Notes 317 14. Using the Validator 14.1 Introduction 318 14.2 An Optical Telegraph Protocol 318 14.3 Dekker's Algorithm 320 14.4 A Larger Validation 322 14.5 Flow Control Validation 325 14.6 Session Layer Validation 336 14.7 Summary 349 Exercises 349 Bibliographic Notes 349 Conclusion 351 References 352 Appendices A. Data Transmission 367 B. Flow Chart Language 380 C. PROMELA Language Report 383 D. SPIN Simulator Source 393 E. SPIN Validator Source 436 F. PROMELA File Transfer Protocol 528 Name Index 537 Subject Index 539 PREFACE Protocols are sets of rules that govern the interaction of concurrent processes in distri- buted systems. Protocol design is therefore closely related to a number of established fields, such as operating systems, computer networks, data transmission, and data communications. It is rarely singled out and studied as a discipline in its own right. Designing a logically consistent protocol that can be proven correct, however, is a challenging and often frustrating task. It can already be hard to convince ourselves of the validity of a sequentially executed program. In distributed systems we must rea- son about concurrently executed, interacting programs. Books about distributed systems, computer networks, or data communications often do no better than describe a set of standard solutions that have been accepted as correct by, for instance, large international organizations. They do not tell us why the solutions work, what problems they solve, or what pitfalls they avoid. This text is intended as a guide to protocol design and analysis, rather than as a guide to standards and formats. It discusses design issues instead of applications. Two issues, therefore, are beyond the scope of this text: network control (including routing, addressing, and congestion control) and implementation. There is, however, no shor- tage of texts on both topics. The design problem is addressed here as a fundamental and challenging issue, rather than as an irritating practical obstacle to the development of reliable communication systems. The aim of the book is to make you familiar with all the issues of protocol validation and protocol design. The first part of the book covers the basics. Chapter 1 gives a flavor of the types of problems that are discussed. Chapter 2 deals with protocol structure and general design issues. Chapters 3 and 4 discuss the basics of error control and flow control. The next four chapters cover formal protocol modeling and specification techniques, beginning in Chapters 5 and 6 with the introduction of the concept of a protocol vali- dation model, that serves as an abstraction of a design and a prototype of its imple- mentation. In Chapter 5 a terse new language called PROMELA is introduced for the i PREFACE xi description of protocol validation models, and in Chapter 6 it is extended for the specification of protocol correctness requirements. In Chapter 7 we use PROMELA to discuss a number of standard design problems in the development of a sample file transfer protocol. Part II closes with a discussion, in Chapter 8, of the extended finite state machine, a basic notion in many formal modeling techniques. The third part of the book focuses on protocol synthesis, testing, and validation tech- niques that can be used to battle a protocol's complexity. Both the capabilities and the limitations of the formal design techniques are covered. The fourth and last part of the book gives a detailed description of the design of two protocol design tools based on PROMELA: an interpreter and an automated validator. Based on these tools, an implementation generator is simple to add. Source code for the tools is provided in Appendices D and E. The source is also available in elec- tronic form. Ordering information can be found in Appendix E. LECTURE PLAN The core of this book is contained in Chapters 2, 5, 6, 7, and 11. These chapters explore a design discipline that is supported by the tools discussed in Chapters 12 to 14. The remaining text is meant to make the book relatively self-contained. Chapter 3 on error control, Chapter 4 on flow control, and Chapter 8 on finite state machines give background information that should be part of the working knowledge of every protocol designer.