1. SC7/WG19 Geneva 2003 ISO/IEC 15909: A Simple Example of Protocol Specification and Verification Jonathan Billington Computer Systems Engineering Centre School of Electrical and Information Engineering University of South Australia 16 September 2003

2. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20032 Goal To illustrate the use of ISO/IEC 15909 Use a simple stop and wait protocol Illustrate specification and verification Use concrete syntax of Coloured Petri Nets Use Design/CPN for graphical representation

3. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20033 High-level Nets Standard: ISO/IEC 15909 Part 1: Concepts, Definitions and Graphical Notation (FDIS) CPN semantics Algebraic graphical form (signatures) Part 2: Transfer Format (PNML) XML based First draft (Ekkart Kindler) Part 3: Extensions (Future) Modularity (eg hierarchical models) Time

4. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20034 High-level Net Semantics HLPN = (P,T,D;Type,Pre,Post,M 0 ) P is a finite set of Places T is a finite set Transitions disjoint from P D is a non-empty finite set of non-empty domains (sets) where each element of D is called a type Type:PUT D is a function used to assign types to places and to determine transition modes Pre,Post:TRANS μPLACE are the pre and post mappings TRANS = {(t,m) | t Є T, m Є Type(t)} PLACE = {(p,g) | p Є P, g Є Type(p)} M 0 Є μPLACE is a multiset, the initial marking of the net μPLACE is the set of multisets over the set, PLACE

5. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20035 Stop and Wait Protocols (SWP) Send a message and wait for ack before sending the next message (flow control) Recover from loss by retransmissions (ARQ) Receiver discarding messages with bit errors Router discarding messages due to congestion Sequence Number included to detect duplicates Finite maximum sequence number: MaxSeqNo Modulo arithmetic MaxSeqNo + 1 Maximum Retransmission Counter: MaxRetrans Medium Initially order preserving channels (DLL Protocol) However, part of TCP (window size of one)

6. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20036 Motivation TCP is the dominant transport protocol in the Internet TCP uses ARQ with 32 bit sequence numbers Original designers were concerned about duplicates message is delayed in reordering medium sequence numbers wrap then duplicate can be accepted as a new message Proposed 3 way handshake (old connections) plus large sequence numbers (same connection) time to live in IP (but implemented as hop count) Networks are getting faster – Gbit/s and beyond How does the simplest ARQ (SWP) fail?

7. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20037 Approach Use graphical models that allow for visualisation Coloured Petri net models of the SWP Lossy FIFO channel Lossy reordering channel Properties Boundedness of channels Stop and Wait Service – alternating sends and receives Duplicate acceptance Message Loss Hand proofs for boundedness (general) Reachability analysis, automata reduction and language equivalence for the other 3 properties (limited parameter values) Use Design/CPN (Aarhus) and FSM (ATT)

8. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20038 Modelling Assumptions Stop and Wait ARQ Protocol Recovery from loss by retransmissions Retransmission counter with limit: MaxRetrans Transmission is aborted when limit reached – not modelled Bounded sequence numbers: MaxSeqNo Message represented by sequence number only – data independence assumption Channels Lossy/lossless unbounded FIFO Lossy/lossless, re-ordering and unbounded Lossy/lossless, re-ordering and bounded

9. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 20039 CPN Model 1 SWP over Lossy FIFO Channels Sender: Send message as sequence number (sn) Retransmission on timeout to limit (MaxRetrans) Receive acks and duplicate acks Increment sn modulo MaxSeqNo + 1 Receiver: Receive messages (sn=rn) and discard duplicates Send ack of next expected message (rn) FIFO Channel: Message loss (or not)

10. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200310 SWP over Lossy FIFO: Results Boundedness arbitrary MaxSeqNo and MaxRetrans bound on FIFO length of both mess_channel and ack_channel given by 2MaxRetrans + 1 Alternating sends and receives (sn=rn) No duplication No loss (except for possibly the last message if the transmission is aborted, i.e. MaxRetrans limit is reached)

11. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200311 CPN Model 2 SWP over Lossy Reordering Channels Same as CPN Model 1 except for the message and ack channels Each channel is represented by a place, where a token is a message (rather than a list of messages) Loss of any message or ack at anytime Can switch loss off readily by use of the guard false on the loss transitions

12. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200312 SWP over Lossy non-FIFO: Results 1 Theorem 1 For the SWP of CPN2 (lossy non-FIFO channels), with MaxRetrans and MaxSeqNo > 0, the message channel is unbounded. Proof sketch: find transition sequence (cycle) that on each repetition will increase the number of tokens in mess_channel by 1 consider: send_mess, receive_mess (sn=rn), send_ack, timeout_retrans, receive_ack from the initial marking, a new marking with send_mess enabled and duplicate in mess_channel is obtained repeat transition sequence every repetition of the sequence increases the number of tokens in mess_channel by one sequence can be repeated indefinitely => unbounded.

13. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200313 SWP over Lossy non-FIFO: Results 2 Theorem 2 For the SWP of CPN2 with MaxRetrans and MaxSeqNo > 0, the ack channel is unbounded. Proof: consider transition sequence: send_mess, receive_mess(sn=rn), send_ack, timeout_retrans, receive_ack, receive_mess, send_ack same arguments as for the proof of Theorem 1

14. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200314 SWP over Lossy non-FIFO: Results 3 Theorem 3 The SWP of CPN2 with MaxRetrans and MaxSeqNo > 0, does not satisfy the Stop and Wait service. Theorem 4 For the SWP of CPN2 with MaxRetrans and MaxSeqNo > 0, duplicates may be received as new messages. Theorem 5 For the SWP of CPN2 with MaxRetrans and MaxSeqNo > 0, messages can be lost without being detected.

15. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200315 Proof of Theorems 3-5 Use language analysis to consider sequences of sends and receives: desired service is (send receive)* send is send_mess; receive is receive_mess(sn=rn) Restricted to bounded channels (capacity = 2), but if there are failures in this case, they will also occur for capacities > 2 (conjecture) Set MaxRetrans = 1 = MaxSeqNo. Any incorrect behaviour also present when MaxRetrans, MaxSeqNo > 1 (conjecture) Two cases: No message loss With message loss

16. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200316 FSA for Lossless Channel OG: 410 nodes and 848 arcs Minimised FSA: 14 states and 21 transitions Stop and Wait Service not satisfied as Alternating sequences of sends and receives is violated (s=send, r=receive) Duplicate acceptance cycles: (srr)* : 5 s 8 r 11 r 13 s 6 r 4 r 5 (srsrrr)* : 7 s 10 r 13 s 6 r 4 r 5 r 7 Loss Cycles: (sssr)* : 13 s 6 s 9 s 12 r 13 Messages lost even though channel not lossy ! Problems do not occur till SNs wrap

17. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200317 FSA for Lossy Channel OG: 624 nodes and 2484 arcs Minimised FSA: 29 states and 47 transitions All states are acceptance states Stop and Wait Service not satisfied Duplicate acceptance cycles Loss Cycles Problems do not occur till SNs wrap

18. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200318 Relevance to TCP TCP uses a sliding window mechanism with dynamic changes to window size and 32 bit SN Reduces to a stop and wait protocol if window size is set to one Conjecture that similar modes of loss and duplication will occur with TCP if Sequence numbers wrap; and Duplicates still exist in the Internet Time-to-live field in IP packets (hop count!) RFC 793 (TCP) suggests Max Seg Lifetime of 2 minutes At 1 Gbit/s effective throughput, SN wrap in 34 secs, allowing duplicates to still be present, but need 4GB of data to send! RFC 1323 recommends the use of 32 bit time-stamps to overcome this problem (PAWS) 64 bit SN? - at 10 Gbit/s would take 470 years to wrap

19. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200319 Relevance to TCP - II Unbounded channels Will potentially unbounded growth of messages lead to congestion? Due to retransmissions, which will occur Most duplicates will be deleted by the receiver Remaining duplicates will be killed off after time to live limit is reached (if implemented) Congestion control procedures already in place Conclusion: No problem for TCP

20. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200320 Conclusions Shown that Stop and Wait Protocols do not work over reordering channels in the following ways: The channels are unbounded (for any MaxRetrans, MaxSeqNo) The SWP does not satisfy its service of (sr)* Cyclic behaviour exists where: Duplicates can be accepted as new messages Messages can be lost (unknowingly) Congestion Lossy FIFO channels, congestion contained (2MaxRetrans + 1) Reordering channels, other mechanisms required The last 3 problems depend on SNs wrapping For Gbit/s networks, duplicates and loss can be a problem => implement PAWS as per RFC 1323

21. How ISO/IEC 15909: Simple SWP Example J. Billington CSEC EIE16/9/2003SC7/WG19 Geneva 200321 Future Work Extend work to TCP mechanisms, including PAWS Incorporate mechanisms into CPN model for deleting old messages Formally extend results for loss and duplication to arbitrary values of MaxRetrans, MaxSeqNo and channel capacity Investigate duplication and loss even when (sr)* is not violated