SMV Example: Bus Protocol

1
SMV Example Bus Protocol

• Ed Clarke
• Daniel Kroening
• Carnegie Mellon University

2
Overview
Node 1
Node 2
Node 3
Node 4

• Design goals
• Collision free operation
• Priorities for the nodes

• Preliminaries
• Single, shared bus
• Every node can broadcast on this bus

• Similar busses are used in the automotive
  industry
• CAN
• Byteflight

3
Basic Idea

• Operation Principle
• Round based algorithm
• First person to start sending gets the bus

• Achieve design goals by
• Assign unique time to each node
• Guarantees Collision free operation
• The node with the lower time gets priority

Ü
4
Example


¹
º
Node 1
Node 2
Node 3
Node 4
Â
Bus
time
5
Example


¹
º
Node 1
Node 2
Node 3
Node 4
Hm, I wont send

Bus
time
6
Example


¹
º
Node 1
Node 2
Node 3
Node 4
I will send!

Bus
time
7
Example


¹
º
Node 1
Node 2
Node 3
Node 4
¹
Bus
time
8
Example


¹
º
Node 1
Node 2
Node 3
Node 4
º
Bus
time
9
Example


¹
º
Node 1
Node 2
Node 3
Node 4

Bus
time
10
Example


¹
º
Node 1
Node 2
Node 3
Node 4
RESET CLOCK!
Â
Bus
Start of new Cycle
time
11
Example


¹
º
Node 1
Node 2
Node 3
Node 4
Hm, I wont send

Bus
time
12
SMV Model

• Design
• A state machine controls each node
• Counter keeps track of clock

• Counter
• Reset if someone sends
• Increment otherwise

MODULE node(bus_active)VAR counter 0 ..
99ASSIGN  next(counter)    case
bus_active 0      counter lt 99 counter
1       1 99 esac
13
SMV Model

• Design
• A state machine controls each node
• Counter keeps track of the clock

Busbusy
beginning
beginning
Skip
Wait
bus_active
Sending
counterpriority
14
SMV Model
MODULE node(priority, bus_active)VAR  counter
0 .. 99  state busy, skip, waiting, sending
ASSIGN  init(state)busy  next(state)
case    statebusy beginning         
skip, waiting     statebusy                   
   busy    stateskip bus_active        
busy    stateskip                     
skip    statewaiting bus_active     
waiting    statewaiting counterpriority
sending    statewaiting waiting   
statesending busy, sending esac
15
SMV Model
MODULE main VAR node1 node(1, bus_active)
node2 node(2, bus_active) node3 node(3,
bus_active) node4 node(4, bus_active) DEFINE
bus_activenode1.is_sending
node2.is_sending node3.is_sending
node4.is_sending
16
Properties

• Desired Properties
• Safety Only one node uses the bus at a given time

SPEC AG (node1.is_sending -gt (!node2.is_sending
!node3.is_sending !node4.is_sending)) SPEC AG
(node2.is_sending -gt (!node1.is_sending
!node3.is_sending !node4.is_sending)) SPEC AG
(node3.is_sending -gt (!node1.is_sending
!node2.is_sending !node4.is_sending)) SPEC AG
(node4.is_sending -gt (!node1.is_sending
!node2.is_sending !node3.is_sending))
17
Properties

• Desired Properties
• Liveness a node that is waiting for the bus will
  eventually get it, given that the nodes with
  higher priority are fair

FAIRNESS node1.is_skipping FAIRNESS
node1.is_skipping node2.is_skipping FAIRNESS
node1.is_skipping node2.is_skipping
node3.is_skipping SPEC AG AF bus_active SPEC
AG(node1.is_waiting -gt AF node1.is_sending) SPEC
AG(node2.is_waiting -gt AF node2.is_sending) SPEC
AG(node3.is_waiting -gt AF node3.is_sending) SPEC
AG(node4.is_waiting -gt AF node4.is_sending)