One might wish to verify whether there is a solution which involves three journeys for the goat. This can be done by altering the LTL formula. Instead of seeking a path satisfying φ U ψ, where φ equals (goat = cabbage goat = wolf) → goat = ferryman and ψ equals cabbage goat wolf ferryman, we now seek a path satisfying (φ U ψ) G (goat → G goat). The last bit says that once the goat has crossed, he remains across; otherwise, the goat makes at least three trips. NuSMV verifies that the negation of this formula is true, confirming that there is no such solution.

3.3.6 The alternating bit protocol

The alternating bit protocol (ABP) is a protocol for transmitting messages along a ‘lossy line,’ i.e., a line which may lose or duplicate messages. The protocol guarantees that, providing the line doesn’t lose infinitely many messages, communication between the sender and the receiver will be successful. (We allow the line to lose or duplicate messages, but it may not corrupt messages; however, there is no way of guaranteeing successful transmission along a line which can corrupt.)

The ABP works as follows. There are four entities, or agents: the sender, the receiver, the message channel and the acknowledgement channel. The sender transmits the first part of the message together with the ‘control’ bit 0. If, and when, the receiver receives a message with the control bit 0, it sends 0 along the acknowledgement channel. When the sender receives this acknowledgement, it sends the next packet with the control bit 1. If and when the receiver receives this, it acknowledges by sending a 1 on the acknowledgement channel. By alternating the control bit, both receiver and sender can guard against duplicating messages and losing messages (i.e., they ignore messages that have the unexpected control bit).

If the sender doesn’t get the expected acknowledgement, it continually resends the message, until the acknowledgement arrives. If the receiver doesn’t get a message with the expected control bit, it continually resends the previous acknowledgement.

Fairness is also important for the ABP. It comes in because, although we want to model the fact that the channel can lose messages, we want to assume that, if we send a message often enough, eventually it will arrive. In other words, the channel cannot lose an infinite sequence of messages. If we did not make this assumption, then the channels could lose all messages and, in that case, the ABP would not work.

Let us see this in the concrete setting of SMV. We may assume that the text to be sent is divided up into single-bit messages, which are sent

FAIRNESS running

LTLSPEC G F st=sent

Figure 3.14. The ABP sender in SMV.

sequentially. The variable message1 is the current bit of the message being sent, whereas message2 is the control bit. The definition of the module sender is given in Figure 3.14. This module spends most of its time in st=sending, going only briefly to st=sent when it receives an acknowledgement corresponding to the control bit of the message it has been sending. The variables message1 and message2 represent the actual data being sent and the control bit, respectively. On successful transmission, the module obtains a new message to send and returns to st=sending. The new message1 is obtained non-deterministically (i.e., from the environment); message2 alternates in value. We impose FAIRNESS running, i.e., the sender must be selected to run infinitely often. The LTLSPEC tests that we can always succeed in sending the current message. The module receiver is programmed in a similar way, in Figure 3.15.

We also need to describe the two channels, in Figure 3.16. The acknowledgement channel is an instance of the one-bit channel one-bit-chan below. Its lossy character is specified by the assignment to forget. The value of

FAIRNESS running

LTLSPEC G F st=received

Figure 3.15. The ABP receiver in SMV.

input should be transmitted to output, unless forget is true. The two-bit channel two-bit-chan, used to send messages, is similar. Again, the nondeterministic variable forget determines whether the current bit is lost or not. Either both parts of the message get through, or neither of them does (the channel is assumed not to corrupt messages).

The channels have fairness constraint which are intended to model the fact that, although channels can lose messages, we assume that they infinitely often transmit the message correctly. (If this were not the case, then we could find an uninteresting violation of the liveness property, for example a path along which all messages from a certain time onwards get lost.)

It is interesting to note that the fairness constraint ‘infinitely often !forget’ is not su cient to prove the desired properties, for although it forces the channel to transmit infinitely often, it doesn’t prevent it from (say) dropping all the 0 bits and transmitting all the 1 bits. That is why we use the stronger fairness constraints shown. Some systems allow fairness

MODULE one-bit-chan(input)

VAR

output : boolean; forget : boolean;

ASSIGN

next(output) := case

forget : output; 1: input;

esac;

FAIRNESS running

FAIRNESS input & !forget

FAIRNESS !input & !forget

MODULE two-bit-chan(input1,input2)

VAR

forget : boolean; output1 : boolean; output2 : boolean;

ASSIGN

next(output1) := case

forget : output1; 1: input1;

esac; next(output2) := case

forget : output2; 1: input2;

esac;

FAIRNESS running

FAIRNESS input1 & !forget

FAIRNESS !input1 & !forget

FAIRNESS input2 & !forget

FAIRNESS !input2 & !forget

Figure 3.16. The two modules for the two ABP channels in SMV.

contraints of the form ‘infinitely often p implies infinitely often q’, which would be more satisfactory here, but is not allowed by SMV.

Finally, we tie it all together with the module main (Figure 3.17). Its role is to connect together the components of the system, and giving them initial values of their parameters. Since the first control bit is 0, we also initialise the receiver to expect a 0. The receiver should start o by sending 1 as its