This paper compares the tools SPIN and UPPAAL by modelling and verifying a Collision Avoidance Protocol for an Ethernet{like medium. We nd that SPIN is well suited for modelling the untimed aspects of the protocol processes and for expressing the relevant (untimed) properties. However, the modelling of the media becomes ackward due to the lack of broadcast communication in the PROMELA language. On the other hand we nd it easy to model the timed aspects using the UPPAAL tool. Especially, the notion of committed locations supports the modelling of broadcast communication. However, the property language of UPPAAL lacks some expessivity for veri cation of bounded liveness properties, and we indicate how timed testing automata may be constructed for such properties, inspired by the (untimed) checking automata of SPIN. During the last few years, the SPIN tool Hol91] has attracted much interest from university people teaching formal methods and from industrial developers. Its merits include a simple yet powerful design language based on asynchronous channels, as well as an expressive logic for property veri cation. However, until recently TC96], it has not been possible to apply SPIN to veri cation of real time systems. In this paper we compare the existing (untimed) SPIN with a recent real time tool, UPPAAL, which is based on timed automata speci cations. This is done through application of the tools on a small protocol 1 for collision avoidance on an Ethernet-like broadcast medium. The untimed properties are veri ed on a PROMELA model and the real time properties are veri ed on a timed automata model.
Collision avoidance protocol was modeled and verified using SPIN and UPPAAL model checkers in REF and its safety properties were analyzed.
Modelling and Analysis of a Collision Avoidance Protocol using SPIN and UPPAAL
BRICS Report Series
Computer Science