ISOIEC 15909 A Simple Example of Protocol Specification

ISO/IEC 15909: A Simple Example of Protocol Specification and Verification Jonathan Billington Computer Systems Engineering Centre School of Electrical and Information Engineering University of South Australia 16 September 2003 04/09/2003 SC 7/WG 19 Geneva 2003

J. Billington How ISO/IEC 15909: Simple SWP Example Goal n n n To illustrate the use of ISO/IEC 15909 Use a simple stop and wait protocol Illustrate specification and verification Use concrete syntax of Coloured Petri Nets Use Design/CPN for graphical representation CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 2

J. Billington How ISO/IEC 15909: Simple SWP Example High-level Nets n Standard: ISO/IEC 15909 n Part 1: Concepts, Definitions and Graphical Notation (FDIS) n n n Part 2: Transfer Format (PNML) n n n XML based First draft (Ekkart Kindler) Part 3: Extensions (Future) n n CSEC EIE CPN semantics Algebraic graphical form (signatures) Modularity (eg hierarchical models) Time SC 7/WG 19 Geneva 2003 16/9/2003 3

J. Billington How ISO/IEC 15909: Simple SWP Example High-level Net Semantics HLPN = (P, T, D; Type, Pre, Post, M 0) n P is a finite set of Places n T is a finite set Transitions disjoint from P n D is a non-empty finite set of non-empty domains (sets) where each element of D is called a type n Type: PUT D is a function used to assign types to places and to determine transition modes n Pre, Post: TRANS μPLACE are the pre and post mappings n n TRANS = {(t, m) | t Є T, m Є Type(t)} PLACE = {(p, g) | p Є P, g Є Type(p)} M 0 Є μPLACE is a multiset, the initial marking of the net μPLACE is the set of multisets over the set, PLACE CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 4

J. Billington How ISO/IEC 15909: Simple SWP Example Stop and Wait Protocols (SWP) n n Send a message and wait for ack before sending the next message (flow control) Recover from loss by retransmissions (ARQ) n n n Sequence Number included to detect duplicates n n Receiver discarding messages with bit errors Router discarding messages due to congestion Finite maximum sequence number: Max. Seq. No Modulo arithmetic Max. Seq. No + 1 Maximum Retransmission Counter: Max. Retrans Medium n n CSEC EIE Initially order preserving channels (DLL Protocol) However, part of TCP (window size of one) FORTE 2003 01/10/2003 5

J. Billington How ISO/IEC 15909: Simple SWP Example Motivation n n n TCP is the dominant transport protocol in the Internet TCP uses ARQ with 32 bit sequence numbers Original designers were concerned about duplicates n message is delayed in reordering medium n sequence numbers wrap n then duplicate can be accepted as a new message Proposed n 3 way handshake (old connections) plus n large sequence numbers (same connection) n time to live in IP (but implemented as hop count) Networks are getting faster – Gbit/s and beyond How does the simplest ARQ (SWP) fail? CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 6

J. Billington How ISO/IEC 15909: Simple SWP Example Approach n n Use graphical models that allow for visualisation Coloured Petri net models of the SWP n n n Properties n n n n Lossy FIFO channel Lossy reordering channel Boundedness of channels Stop and Wait Service – alternating sends and receives Duplicate acceptance Message Loss Hand proofs for boundedness (general) Reachability analysis, automata reduction and language equivalence for the other 3 properties (limited parameter values) Use Design/CPN (Aarhus) and FSM (ATT) CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 7

J. Billington How ISO/IEC 15909: Simple SWP Example Modelling Assumptions n n n n Stop and Wait ARQ Protocol Recovery from loss by retransmissions Retransmission counter with limit: Max. Retrans Transmission is aborted when limit reached – not modelled Bounded sequence numbers: Max. Seq. No Message represented by sequence number only – data independence assumption Channels n n n CSEC EIE Lossy/lossless unbounded FIFO Lossy/lossless, re-ordering and unbounded Lossy/lossless, re-ordering and bounded SC 7/WG 19 Geneva 2003 16/9/2003 8

CPN Model 1 SWP over Lossy FIFO Channels J. Billington How ISO/IEC 15909: Simple SWP Example n n n Sender: n Send message as sequence number (sn) n Retransmission on timeout to limit (Max. Retrans) n Receive acks and duplicate acks n Increment sn modulo Max. Seq. No + 1 Receiver: n Receive messages (sn=rn) and discard duplicates n Send ack of next expected message (rn) FIFO Channel: n CSEC EIE Message loss (or not) SC 7/WG 19 Geneva 2003 16/9/2003 9

J. Billington How ISO/IEC 15909: Simple SWP Example SWP over Lossy FIFO: Results n Boundedness n n n arbitrary Max. Seq. No and Max. Retrans bound on FIFO length of both mess_channel and ack_channel given by 2 Max. Retrans + 1 Alternating sends and receives (sn=rn) No duplication No loss (except for possibly the last message if the transmission is aborted, i. e. Max. Retrans limit is reached) CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 10

CPN Model 2 SWP over Lossy Reordering Channels J. Billington How ISO/IEC 15909: Simple SWP Example n n Same as CPN Model 1 except for the message and ack channels Each channel is represented by a place, where a token is a message (rather than a list of messages) Loss of any message or ack at anytime Can switch loss off readily by use of the guard false on the loss transitions CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 11

J. Billington How ISO/IEC 15909: Simple SWP Example SWP over Lossy non-FIFO: Results 1 n n Theorem 1 For the SWP of CPN 2 (lossy non-FIFO channels), with Max. Retrans and Max. Seq. No > 0, the message channel is unbounded. Proof sketch: n n n CSEC EIE find transition sequence (cycle) that on each repetition will increase the number of tokens in mess_channel by 1 consider: send_mess, receive_mess (sn=rn), send_ack, timeout_retrans, receive_ack from the initial marking, a new marking with send_mess enabled and duplicate in mess_channel is obtained repeat transition sequence every repetition of the sequence increases the number of tokens in mess_channel by one sequence can be repeated indefinitely => unbounded. SC 7/WG 19 Geneva 2003 16/9/2003 12

J. Billington How ISO/IEC 15909: Simple SWP Example SWP over Lossy non-FIFO: Results 2 n n Theorem 2 For the SWP of CPN 2 with Max. Retrans and Max. Seq. No > 0, the ack channel is unbounded. Proof: n n CSEC EIE consider transition sequence: send_mess, receive_mess(sn=rn), send_ack, timeout_retrans, receive_ack, receive_mess, send_ack same arguments as for the proof of Theorem 1 SC 7/WG 19 Geneva 2003 16/9/2003 13

J. Billington How ISO/IEC 15909: Simple SWP Example SWP over Lossy non-FIFO: Results 3 n n n Theorem 3 The SWP of CPN 2 with Max. Retrans and Max. Seq. No > 0, does not satisfy the Stop and Wait service. Theorem 4 For the SWP of CPN 2 with Max. Retrans and Max. Seq. No > 0, duplicates may be received as new messages. Theorem 5 For the SWP of CPN 2 with Max. Retrans and Max. Seq. No > 0, messages can be lost without being detected. CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 14

J. Billington How ISO/IEC 15909: Simple SWP Example Proof of Theorems 3 -5 n n n Use language analysis to consider sequences of sends and receives: desired service is (send receive)* send is send_mess; receive is receive_mess(sn=rn) Restricted to bounded channels (capacity = 2), but if there are failures in this case, they will also occur for capacities > 2 (conjecture) Set Max. Retrans = 1 = Max. Seq. No. Any incorrect behaviour also present when Max. Retrans, Max. Seq. No > 1 (conjecture) Two cases: n n CSEC EIE No message loss With message loss SC 7/WG 19 Geneva 2003 16/9/2003 15

J. Billington How ISO/IEC 15909: Simple SWP Example FSA for Lossless Channel n n n OG: 410 nodes and 848 arcs Minimised FSA: 14 states and 21 transitions Stop and Wait Service not satisfied as n n Duplicate acceptance cycles: n n n (srr)* : 5 s 8 r 11 r 13 s 6 r 4 r 5 (srsrrr)* : 7 s 10 r 13 s 6 r 4 r 5 r 7 Loss Cycles: n n n Alternating sequences of sends and receives is violated (s=send, r=receive) (sssr)* : 13 s 6 s 9 s 12 r 13 Messages lost even though channel not lossy ! Problems do not occur till SNs wrap CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 16

J. Billington How ISO/IEC 15909: Simple SWP Example FSA for Lossy Channel n n n n OG: 624 nodes and 2484 arcs Minimised FSA: 29 states and 47 transitions All states are acceptance states Stop and Wait Service not satisfied Duplicate acceptance cycles Loss Cycles Problems do not occur till SNs wrap CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 17

J. Billington How ISO/IEC 15909: Simple SWP Example Relevance to TCP n n n n TCP uses a sliding window mechanism with dynamic changes to window size and 32 bit SN Reduces to a stop and wait protocol if window size is set to one Conjecture that similar modes of loss and duplication will occur with TCP if n Sequence numbers wrap; and n Duplicates still exist in the Internet Time-to-live field in IP packets (hop count!) RFC 793 (TCP) suggests Max Seg Lifetime of 2 minutes At 1 Gbit/s effective throughput, SN wrap in 34 secs, allowing duplicates to still be present, but need 4 GB of data to send! RFC 1323 recommends the use of 32 bit time-stamps to overcome this problem (PAWS) 64 bit SN? - at 10 Gbit/s would take 470 years to wrap CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 18

J. Billington How ISO/IEC 15909: Simple SWP Example Relevance to TCP - II n Unbounded channels n n n Will potentially unbounded growth of messages lead to congestion? Due to retransmissions, which will occur Most duplicates will be deleted by the receiver Remaining duplicates will be killed off after time to live limit is reached (if implemented) Congestion control procedures already in place Conclusion: No problem for TCP CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 19

J. Billington How ISO/IEC 15909: Simple SWP Example Conclusions n Shown that Stop and Wait Protocols do not work over reordering channels in the following ways: n n n The channels are unbounded (for any Max. Retrans, Max. Seq. No) The SWP does not satisfy its service of (sr)* Cyclic behaviour exists where: n n n Congestion n n Duplicates can be accepted as new messages Messages can be lost (unknowingly) Lossy FIFO channels, congestion contained (2 Max. Retrans + 1) Reordering channels, other mechanisms required The last 3 problems depend on SNs wrapping For Gbit/s networks, duplicates and loss can be a problem => implement PAWS as per RFC 1323 CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 20

J. Billington How ISO/IEC 15909: Simple SWP Example Future Work n n Extend work to TCP mechanisms, including PAWS Incorporate mechanisms into CPN model for deleting old messages Formally extend results for loss and duplication to arbitrary values of Max. Retrans, Max. Seq. No and channel capacity Investigate duplication and loss even when (sr)* is not violated CSEC EIE SC 7/WG 19 Geneva 2003 16/9/2003 21