Bounded Retransmission Protocol

The model considered in this case study represents an implementation of the Bounded Retransmission Protocol (BRP) [4]. BRP is a data link protocol for transmitting partitioned files over unreliable channels. Each part, in the following referred to as chunk, is bounded in the number of permitted retransmissions. The underlying concept is similiar to the Alternating Bit Protocol. Each chunk contains a sequence bit. The sender transmits a chunk continually as long as it receives an acknowledgement for this chunk. Thereafter, the sequence bit is flipped and the next chunk is transmitted. Instead of trying retransmitting arbitrary often, BRP bounds the number of retransmissions for each chunk. The protocol has been modelled and verified with a multitude of different formalisms and methods. In particular, timed and functional properties have been checked using a timed automata model [2], while a probabilistic model based on Markov decision processes has been studied using both the RAPTURE verification tool [1] and PRISM. Our obtained Modest models [3] represent probabilistic timed automata, thus combining former timed automata and probabilistic models. The combination of both approaches is reasonable if we consider the loss of a chunk in a certain channel. If a timed automata model is used, the unlikely case that every chunk is lost is also considered. Since real life channels on a physical level, e.g. copper or coaxial-cables, fail or introduce noise with a certain probability this should be taken into account. Furthermore, this allows us to not only check the properties from the previously mentioned case studies, but also probabilistic time-bounded as well as expected-time reachability properties. For the purpose of this case study, we built two different models both of which implement the same behaviour. The first model is a flat one, i.e. it consists of many nested statements like invariant-checks. As mentioned before, the model is functionally correct, but is rather difficult to understand, debug and extend. For this reason, we also provide a modular model easier to understand and extend. For both models, we checked the following properties: