Hansen, Klaus

English

Copenhagen University Research Information System

u n i ve r s i t y  o f  co pe n h ag e n  Københavns UniversitetVerification of flow control protocolsHansen, KlausPublished in:Computer communication reviewPublication date:1985Document versionPublisher's PDF, also known as Version of recordCitation for published version (APA):Hansen, K. (1985). Verification of flow control protocols. Computer communication review, 15(1).Download date: 02. Feb. 2020Verification of £Io~ control protocols. ~J@us Hansen DIKU, University of Copenhagen Sigurdsgade 41, DK-2200 Copenhagen N ABSTRACT An important issue in computer network design is end-to-end control, a term covering error control and flow control. The validity of schemes for these purposes may be demonstrated using simple formal models, in which assertions about central program variables are proven. S.Krogdahl [2] and D.E.Knuth [I] have shown the validity of error control for a class of data link protocols using such methods. In this paper their method is extended to cover flow control. The method is illustrated by proving assertions for a simple case, and it Is shown how complex systems may be seen as compositions of the simple case. I, I~troduction. End-to-end protocols in computer networks guarantee that a data path between a producer (or data source) and a consumer (or data slnkj provides a reliable service. An end-to-end protocol incorporates mechanisms for error control and flow control. Error control covers the aspects of preserving the sequence as well as detecting loss, duplication or corruptlon of data. This is important when data are transfered over a data path wlth a slgnlflcant probability for errors. Flow control covers resource management. Transmlsslon of data involves a certain amount of copying, and flow control methods are employed to utilize limited buffer resources. A flow control scheme is valid, when it ensures that transmission is always possible in spite of limited resources. Other aspects of flow control, i.e. smooth flow and good utilization of resources. are not treated in this paper. They involve statistical behavlour of the com- ponents, and a treatment calls for e.g. queueing theory, which is outside the scope of this paper. The meth(xl used to verify schemes is similar to that in [1]. A scheme is given by a set of algorithms working on a set of common varlables. Each algo- rithms is given a name and is called an operation. The particular order in which the operations will be performed Is immaterial for the purpose. To cite: "Our goal is to derive facts about any scheme that is ~s~wd on these operations ° ~t ~s In this sense ~e are studylng a "protocol skeleton" for a l;~ge class of concelvable protocols, The facts we shall derive are expressed in terms of relations that [-emaln lns.~.z<~a,~£ under all operations," The scheme is thus completed by speclfy~g a set of assertlons ab;Jut the varia~les~ The set of assertions conslsts of global and local assert~ons, the gio- h{l assemtlons speclfy~n~ the behavlour of combinations of operatlons, and the local assertions deterT~inlng the appllcabi!ity of each operatlono The meth~ i s  app l ied  to  a s imp le  case  and two compos l te  cases ,  The cases are s~mplified verslons o{ protocols found in real networks: the s~m- plificatlon Is done by ignorl~7 the representatlon of varlous data. while keepir~ the essentlal ~ s  of the protocols concerned with queues and feed- ~ck,  2, F lu  cowl .  A constrained pc'oducer/co~umer system (fiqmme i) conslsts of a producer of  full buffers, a consumer that emptles them, and two queues, Producer ® Full Buffers F Empty Buffers E Q Consumer . . . . . .  (F denotes queue of full buffers, £ queue of empty) F19~ire l: Constrained producer/co[~umer system, Flew control ~s impliclt in the synchronlzation method us~ as a process Is b lock~ (walts) ~t~enever a q~./eue is empty. The system is stable Irrespec- tively of the relative speeds: this Is one of the purposes of synchronlzation ~eth,ods, However when the system Is spllt Into two and a transmlsslon system Is added (figure 2), It is neces~ to provlde a buffer pool at the consumer end, as the transmission ~th  acts as a cOpyl~ mecb~nl~ only, which cannot ~f fer  data~ We the transmission ~th  to ~ e~or-free arid have l,lm- itS/, but positive s~ed~ ~0 Transmitter Receiver c o o Producer J'l W Consumer O Note: lower case letters denote numbers. The queues are: E empty buffers, H buffers held before transmisslon, B auxiliary pool of empty, W full buffers waltlng to be consumed. X Is transmlsslon path. k credits in translt, c available credits at T. Figure 2: Producer/consumer with transmission system. The queue of full buffers (F) has been split in three: buffers waltlng for transmission (H), buffers in transit (X), and buffers delivered to the consumer, but waiting to be emptied (W). The producer fills an empty buffer from E and delivers it to the transmitter, where It is put into the H queue. At an appropriate time, it is put into the transmlsslon path, and the buffer is returned empty to E. When data arrives at the receiver, It is put into a buffer taken from B and delivered to the consumer queue W. After emptylng it. the consumer returns it to B. X may contain any number of buffers, dependlng on propagation time and speed of the data path. The feed-back needed is provided by a stream o~ credits that conveys information about empty buffers, one credit representing one empty buffer. The purpose of flow control is now to avoid the situation where B is empty when data are received, an unrecoverable sltuatlon. If the number of buffers in X and B are called x and b respectively, this may be expressed as xlb (1.1) i.e. the number of buffers in transit must not exceed the current size of B. The full description of the varlables is: II e size o{ empty queue <E) h slze of hold queue <H) × numlL~r of buffers in translt b size of free queue <~ w slze of <~Jeue of waiting <W) k credits in tramsat c c~am'ent cram/its at  t ransmi t te r  in i t ia l l y  in i t ia l l y  O in i t ia l l y  O in i t ia l l y  5 amitlally 0 lnatlally 0 inatlally 5 3, ior~s and iotas f~  ~uhe s id le  syste~o Usi<q the var i f ies  descr l~  above, we can gave a scheme for  the  sample system in figure 2 that has five operations, t~ee  for the transmitter (Ti, T2~ T3) ard two for the receiver (Ri. R2), The operatlons are given below, The com~ents enclosed in (e and *) shows the semantics of tse statement, which is othemwlse only s~c i f i~  by the effect on the common variableso Local assertlons are shown for each operation, and have to be true for the operation to he appllc&ble, e.go h>0 and c>0 for a buffer to be transmitted by o~rat ion  T2o A protocol usi~@ flow control wall consist o[ some sequence of these operations; a sequence is valld only If the local assertlons are true ~#hen an o~rat lon  as invoke,  TI: ~ ~JLL (~ asse~ e>0 {) e:: e-l; h:= h+l: (~ ewseue *) T2: DKL I~ FOCAL (~ assert h>0 *) h:= h-l; c:: c-I~ x:= ×,I; e:= e+11 (~ dequeue ~) (~ S~© DATA ~) (e deliver empty ~) (*  asse~ k>O ~) k:= k - i :  c:= C+I: {~ assert x>O *) x:= x-l; b:= b-l; w:= w+l : (~ deq~u~eue ~) (~ det iver  fu l l  ~) R2: PUT u:= w-I ; b:= ~1 ; k:= k+1; (~ er~queue ~) (* SOD CPEDIT ~ ! 2 The global assertions are as follows. All variables except c are non- negative: for c a weaker assumption c+k>0 may be used (the meanlng of thls Is not elaborated here),First~ the purpose of flow control is reformulated as c+k=b-x (1.1a) Second~ no buffers may be lost or misplaced at T or R: e+h=~ (I~,2) w+b=B (1.3) It is easily seen that the assertions are true for the and invariant under the operations. To prove x<b observe that which implies that b-x = c÷k and c÷k 2_ 0 x -b&0 initial values The global assertions will then be true, and the total scheme he valid. A simplified version of the operations is worth considering. When the variables c and k, and operatlon T3 are omitted, there is no feed-back. If the consumer and transmission path are faster than the consumer, it Is easy to construct a valid sequence which violates equatlon (i.I)~ an example is (TI T2 RI) repeated a sufficient number of times. This scheme is invalid for flow control: bt~ it may of course be used if one dares to use timlng con- siderations in validity arguments. 4. Composite systems. Two common ways ~.f obtaining more complex schemes are to combine simple schemes by concatenation or nesting, in the followlng called serlal and mul- tiplexed flow control. Serial flow control is found in gateways between different nets and in front-ends for host computers. Multiplexing and the resulting nesting of flow control is common, exam- ples are the X.25 datalink and DCE-DTE levels, or the datalink, network and transport layers in the Open Systems Interconnection model [3]. 5. Ser ia l  f low cont ro l .  Figure 3 shows the concatenation of two schemes. The arguments above are easily generalized to a concatenatlon of simple schemes 3oined in the obvious way. The five operations are still valid, with a change of variables to indexed variables, to distingulsh between the component schemes. As a consequence, some variable names are synonyms: 13 Pro- duce r x~ X~ Con-~ sumer ~W t FiTare 3: Serial flow control° bl:e 2 and wi:h 2 The operations are derived from those of the simple system of variables. The assertions are <i having values I and 2): ci+ki:bi-xi e +h :~ l i i w~ +b, =B, 1 1 1 by indexing <2.i)  (2.2) (2.3) It is easily verified that the assertions are valid. The proof of x,ib, is similar to that of the simple schemes The conclusion is that concaten~!o~ of flow control is a meanirgful operation, which Dreserve the validity~ 6. ~Jltiplexirg. W%en several data streams share a channel, but .are otherwise zndepen- dents the data streams are said to be multiplexed [see also [3]). The outer transmission systems (for the streams) use that of the inner <the channel) for the act~,ial transfer <see figure 4), As both the channel and the streams need flow control, this leads to nested flow control. The combined producers a~ stream transmitters act as one producer for the channel, and slmllarily the combined consumers and receivers act as one consumer. In the followir~ the index zero signifies the channel variables, and a positive irdex the corresponding stre~m~ The notation is otherwise uncharged. The scheme has been s i~ l i f i ed  somewhat with respect to the queues. I t  is a that no copying Is needed at the stream/channel interface. As a co ~e E n and B are omltted, Similarriiy the buffers in B are non- existent, bu~ b I i~ the n~ber  of buffers in B 0 that stream i considers its 14 e amq-- I ~ Hi Channel i ± c~ [Z3 E~ [13 t Bo k£ w~ Con- ~h sumer i Figure 4: Multiplexing, nested flow control. share. Allocation of buffers is a separate zssue. The operations of the channel and the streams are  as follows (note some actions are coupled together): Operations o£ the channel. TI: g g / .  (* assert nil *) ho:= h0+1: T2: DELIVER FULL (* assert h0>0 *) h0:= h0-1; 0. "0.. X D. " X~+I, c~ll STREAMi.T4: T3: CREDIT ARRIVED (* assect kA>0 *) k0:= k0:l: Co:= c0+I: RI: RILL ARRIVED (* assert xn>0 *) x0:= x0=l: 'b0:: b0-1: (* engueue *) (* dequeue *) (* SEND DATA *) (* deliver empty *) (* degueue * ) (* call STREAMi.RI *) R2: PUT EMPTY (* assert nil *) kb~i = bn+t: k~+t ;(* enqueue * ) (* SEND CREDIT *) that 15 ' , , I f  ii[i i ¸¸  iiii lli OR:rat ior~ f or st ream i TI: F~ FJLL (~ asser t  e >0 ~) el;: e . ! l  ° h ;  h :+l  1 1 T2; D~I~ F J~ (~ assert h >0 *) hi:: h if° c ' :  c~- l '  l" ×i ;= :×:+i°: (~ assert k >0 ~) k := k [i: i :  c~+l ° c: T4: ' ~  ~.~I~ (~ assert nil ~) el;: el+l~ RI: ~ ~I%IED (~ assert x >0 ~) x := x~!l: b}:: b}-:. R2: PD~ (~ assert w >0 *) w,:= u. ! l ;  ::i= ::+i: c:l i : kA~EL.  R 2 ; k, ;= k .+ l ;  l t (~ enqueue *) (~ dequeue 2) (~ call CNULNNEL,T'I *) t~ deiiver e) (~ de l iver  fu l l  *~ (* SEND CREDIT ~) The invariants are {note i>0 unless otherwlse stated>" ci+k i = bi-x I (all i) Z(e +h )+h~ = Z~. 1 1 u 1 Zwi+bo = ~0 MultiDlexing is consistent ~, 3,1 (3,2 (3,3 + ~xi=h 0 x 0 <3.4) It is easily verified that the assertions are true under the operations. If ~ i  i B 0 then follows <as ~ i  i b 0 is invarlant): bl-xi=ci+ki ~0 which lmplies bl~x I which implies b 0 i ZJo i i Zx z = ho+x 0 i x 0 As this does not involve the assertions for c A and k~, i t  shows that independent of the channel flow control mechanism, the-channel will never overflow if the stream flow control is conservative enough. Thus interesting enough, we have shown that the channel flow control can he omitted. Thls may be taken as an argument against indiscriminate use of nested or layered sys- tems. 7, Conclusion, It has been shown that a simple scheme conslsting of a few time- independent operatlons and their associated variables and assertions may be used to validate the essential part of flow control protocols. Furthermore, it is possible to obtain results for composite systems using the same method. The method combines well with the error control validation of [I], to give a total method for verifying end-to-end protocols. Other methods for specification and verification [4] like finite-state automata or Petri nets are used for speciflc protocols to prove e.g. freedom from deadlock, completeness, or stability, or to verify that the design meets its specification. The approach in this paper is not quite the same, as it zs more limted with respect to properties, and more general in scope, as the properties are shown for classes of conceivable protocols. 8. Acknowledgeme.+~° I wish to thank Jens Hammerum for the original idea, which appeared in his Master's thesis in disguise, and A.P.Ravn for much advice on the presen- tation of the ideas. 9. Litterature. [I] [2] [3] [4] D.E.Knuth: Verification of link-level protocols. BIT 21,1 (1981) S.Krogdahl: Verification of a class of link-level protocols. BIT 18,4 (1978) ISOIIS 7498 Open Systems Interconnection (1983) C.A.Sunshine: Formal Modelling of Communication Protocols. USC/Information Sciences Institute, RR-81-89 (March 1981~ s' / 17 

Verification of flow control protocols

https://curis.ku.dk/portal/files/11200498/pdf

Verification of flow control protocols

Abstract

Similar works

Full text

Available Versions

Copenhagen University Research Information System