Model checking active networks with SPIN

Recent advances in languages and execution environments (EEs) for active networks make it now possible to develop applications with this new exciting approach. In particular, active networks have proven to be very suitable for multicast services. Nevertheless, to open the network nodes to the code written by users requires the use of analysis techniques to avoid the degradation of the network performance. Model checking is one of the most powerful techniques to ensure software reliability. This technique has been successfully applied to many protocols developed with the classic (non-active) approach. Our aim is to extend its application to the area of active protocols. The paper consists of two main contributions: (a) a clear scheme to use the language PROMELA in order to formalize different elements in the active service (network EE, capsules and user applications) and (b) the practical (and successful) application of the approach to analyze an active multicast protocol using the model checker SPIN. q 2004 Elsevier B.V. All rights reserved.