2. 1 Modeling Clock Synchronization in the Chess gMAC WSN Protocol Mathijs Schuts Feng Zhu Faranak Heidarian Julien Schmaltz Frits Vaandrager QFM’09 FM’09

3. 2 Plan Intro to WSN and Chess case study A first model + analysis A second model + counterexamples Conclusions & Future Work

4. 3 WSN – but with a twist! Main challenges: –Energy efficiency (battery operated or energy harvesting → lifetime) –Robustness (RF spectrum is extremely noisy, very busy and unreliable) –Scalability (10 1 – 10 2 – 10 3 – 10 4 – 10 5 nodes with a single protocol) –Self-adaptable (constantly changing network topology, density, mobility) –Limited resources (CPU processing speed, available memory, fysical size) There are many available WSN protocols, e.g.: –Wifi –Bluetooth –Zigbee –Z-wave –…–… Neither of these technologies addresses all challenges!

5. 4 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

6. 5 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

7. 6 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

8. 7 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

9. 8 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

10. 9 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

11. 10 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM) Page 10

12. 11 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM) Page 11

13. 12 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM) Page 12

14. 13 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM) Page 13

15. 14 WSN – but with a twist! Communication inspired on biology and human interaction Epidemic communication Analogy: spreading a rumor or a virus MYRIANED “GOSSIP” protocol RF broadcast (2.4 Ghz ISM)

16. 15 Properties of GOSSIP In a nutshell: Flooding provides robustness Local caching prevents overhead Absense of routing provides scalability Inherently self-configuring Supports node mobility Automatic adoption to network density But what about energy efficiency?

17. 16 RF ANTENNA RF TRANCEIVE R (NORDIC SEMI) CPU (ATMEL XMEGA128) I/O INTERFACES

18. 17 Case Study for EU Quasimodo Project Model and analyze Chess WSN, based on 1.informal specification in deliverable 2.discussions with experts

19. 18 Our Focus: Clock Synchronization TXRX idle Time is considered as a sequence of Time Frames. A time frame is composed of a fixed number (C) of Time Slots. In a time slot the hardware clock of the sensor node ticks a fixed number (k 0 ) of times. A Time Frame tsn

20. 19 Goal: Minimalize Energy Consumption RX Time Slot TX Time Slot Guard Time

21. 20 Uppaal Model FM’09 20

22. 21 Results FM’09 Paper Full parametric analysis for clique networks Parameter constraints found using Uppaal Proof fully checked using Isabelle/Hol (> 5000 lines) Correctness also studied for line topologies

23. 22 Results FM’09 Paper Full parametric analysis for clique networks Parameter constraints found using Uppaal Proof fully checked using Isabelle/Hol (> 5000 lines) Correctness also studied for line topologies Model does not correspond to Chess implementation!

24. 23 How Current Implementation Works Clocks only synchronized once per frame Implementation computes median of phase errors of all messages received in frame Offset = median * gain Radio switching time is relevant

25. 24 Structure of Uppaal Model

26. 25 Clock

27. 26 Sender

28. 27 Receiver

29. 28 Controller

30. 29 Synchronizer

31. 30 compute_phase_correction() if (number of received messages == 0) offset = 0; else if (number of received messages <= 2) offset = the phase error of the first received message * gain; else offset = the median of all phase errors * gain

32. 31 Invariants for Correctness “Whenever I send all my neighbors listen” INV1 : A[] forall (i: Nodes) forall (j : Nodes) SENDER(i).Sending && neighbor(i,j)imply RECEIVER(j).Receiving “My neighbors never send simultaneously” INV2 : A[] forall (i:Nodes) forall (j:Nodes) forall (k:Nodes) SENDER(i).Sending && neighbor(i,k) && SENDER(j).Sending && neighbor(j,k) imply i == j “There’s no deadlock” INV3 : A[] not deadlock

33. 32 Counterexample found by Uppaal

34. 33 Protocol fails for any network that contains 2 clans! Gateway Server Internet Sensor field Watershed Slow nodes Fast nodes

35. 34 Challenge: Fix the Problem Assegei (2008) proposed use of Kalman filter instead of median algorithm Our FM2009 algorithm, possibly with gain factor Algorithm of Lenzen, Lochen & Wattenhofer (2008) Adaptation of algorithm Pussente & Barbosa (2009) It should be easy to adapt our Uppaal model

36. 35 Challenge: Probabilities Probabilistic model of message loss Probabilistic algorithms for (dynamic) slot allocation Probabilistic leaving/joining of nodes/networks Probabilistic algorithms for gossiping … Key design issue: independence of layers?!?!!

37. 36 Conclusions Our contribution: Uppaal model of clock synchronization in Chess WSN; bug found Never trust your model! Close interaction between designers and modellers essential Model checking useful, even if one can only handle trivial instances Models are imperfect approximations of reality!! (“Physicists approach to modeling”) Simulation and testing also essential

38. 37 Questions?