SMV Example: Bus Protocol

Ed Clarke
Daniel Kroening
Carnegie Mellon University
Overview

Node
Node11 Node
Node22 Node
Node33 Node
Node44

Preliminaries:
Preliminaries: Design
Designgoals:
goals:
 Single,
Single,shared
sharedbus
bus 
 Collision
Collisionfree
freeoperation
operation

 Every
Everynode
nodecan
canbroadcast
broadcast 
 Priorities
Prioritiesfor
forthe
thenodes
nodes
on
onthis
thisbus
bus

Similar
Similarbusses
bussesare
areused
usedin
inthe
theautomotive
automotiveindustry
industry
 CAN
CAN

 Byteflight
Byteflight
Basic Idea
Operation
OperationPrinciple
Principle

 Round
Roundbased
basedalgorithm
algorithm

 First
Firstperson
personto
tostart
start
sending
sendinggets
getsthe
thebus
bus

Achieve
Achievedesign
designgoals
goalsby:
by:

 Assign
Assignunique
uniquetime
timetotoeach
each
node
node

 
 Guarantees
GuaranteesCollision
operation
operation
Collisionfree
free


 The
Thenode
nodewith
withthe
thelower
lowertime
time
gets priority
gets priority
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Hm,
Hm,II
won’t
won’t
send
send

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

I will send!

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Bus

time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

RESET
CLOCK!

Bus

Start of
new Cycle
time
 Example
   
Node
Node11 Node
Node22 Node
Node33 Node
Node44

Hm,
Hm,II
won’t
won’t
send
send

Bus

time
SMV Model
Design:
Design:

 AAstate
statemachine
machinecontrols
controlseach
eachnode
node

 Counter
Counterkeeps
keepstrack
trackof
ofclock
clock

Counter:
Counter:

 Reset
Resetififsomeone
someonesends
sends MODULE
MODULEnode(bus_active)
node(bus_active)

 Increment VAR
VARcounter:
counter:00....99;
Incrementotherwise
otherwise 99;
ASSIGN
ASSIGN
next(counter):=
next(counter):=
case
case bus_active
bus_active::0;
0;
counter
counter<<99:
99:counter
counter++1;
1;
1:
1:99;
99;
esac;
esac;
SMV Model
Design:
Design:

 AAstate
statemachine
machinecontrols
controlseach
eachnode
node

 Counter
Counterkeeps
keepstrack
trackof
ofthe
theclock
clock

beginning Bus beginning

Skip
Skip bus_active Wait
Wait

Sending
Sending counter=priority
SMV Model
MODULE node(priority, bus_active)
VAR
counter: 0 .. 99;
state: { busy, skip, waiting, sending };

ASSIGN
init(state):=busy;

next(state):= case
state=busy & beginning : { skip, waiting };
state=busy : busy;
state=skip & bus_active : busy;
state=skip : skip;
state=waiting & bus_active : waiting;
state=waiting & counter=priority: sending;
state=waiting: waiting;
state=sending: { busy, sending }; esac;
SMV Model
MODULE main
VAR
node1: node(1, bus_active);
node2: node(2, bus_active);
node3: node(3, bus_active);
node4: node(4, bus_active);

DEFINE
bus_active:=node1.is_sending | node2.is_sending |
node3.is_sending | node4.is_sending;
 Properties
Desired
Desired Properties
Properties

Safety:
Safety: Only
Only one
one node
node uses
uses the
the bus
bus at
at aa
given
given time
time

SPEC
SPECAG
AG(node1.is_sending
(node1.is_sending->
->(!node2.is_sending
(!node2.is_sending&&!node3.is_sending
!node3.is_sending&&!node4.is_sending))
!node4.is_sending))
SPEC
SPECAG
AG(node2.is_sending
(node2.is_sending->
->(!node1.is_sending
(!node1.is_sending&&!node3.is_sending
!node3.is_sending&&!node4.is_sending))
!node4.is_sending))
SPEC
SPECAG
AG(node3.is_sending
(node3.is_sending->
->(!node1.is_sending
(!node1.is_sending&&!node2.is_sending
!node2.is_sending&&!node4.is_sending))
!node4.is_sending))
SPEC
SPECAG
AG(node4.is_sending
(node4.is_sending->
->(!node1.is_sending
(!node1.is_sending&&!node2.is_sending
!node2.is_sending&&!node3.is_sending))
!node3.is_sending))
 Properties
Desired
Desired Properties
Properties

Liveness:
Liveness: aa node
node that
that isis waiting
waiting forfor the
the bus
bus
will
will eventually
eventually get
get it,
it, given
given that
that the
the nodes
nodes
with
with higher
higher priority
priority are
are fair
fair
FAIRNESS
FAIRNESSnode1.is_skipping
node1.is_skipping
FAIRNESS
FAIRNESSnode1.is_skipping
node1.is_skipping&&node2.is_skipping
node2.is_skipping
FAIRNESS
FAIRNESSnode1.is_skipping
node1.is_skipping&&node2.is_skipping
node2.is_skipping&&node3.is_skipping
node3.is_skipping

SPEC
SPECAG
AGAF
AFbus_active
bus_active
SPEC
SPECAG(node1.is_waiting
AG(node1.is_waiting->
->AF
AFnode1.is_sending)
node1.is_sending)
SPEC
SPECAG(node2.is_waiting
AG(node2.is_waiting->
->AF
AFnode2.is_sending)
node2.is_sending)
SPEC
SPECAG(node3.is_waiting
AG(node3.is_waiting->
->AF
AFnode3.is_sending)
node3.is_sending)
SPEC
SPECAG(node4.is_waiting
AG(node4.is_waiting->
->AF
AFnode4.is_sending)
node4.is_sending)