Modeling and Verifying a Price Model for Congestion Control in Computer Networks Using PROMELA/SPIN

Transcription

1 Modeling and Veifying a Pice Model fo Congestion Contol in Compute Netwoks Using PROMELA/SPIN Clement Yuen and Wei Tjioe Depatment of Compute Science Univesity of Toonto 1 King s College Road, Toonto, Ontaio M5H 3G4, Canada {clhyuen,wtjioe}@cs.toonto.edu Abstact. Congestion contol is an impotant eseach aea in compute netwoks. Using PROMELA/SPIN, we veified that pioity picing schemes [1-4] can be used to effectively contol netwok congestion. This is ealized though simulation/veification of the popositions that the use of pioity picing (i) esults in an equilibium state in packet allocation, and (ii) effectively contols congestion level though dynamic adjustment of pices. We also extended these popositions in ode to veify the convegence popety of such an equilibium. This paticula esult would be difficult to veify with existing netwok simulation tools. 1 Intoduction PROMELA/SPIN is a vesatile tool in the simulation and veification of softwae systems [5]. A common application of PROMELA/SPIN is in modelling and veifying communication potocols [6]. In the aea of mobile communication, pat of the MCNet achitectue has been simulated and veified in SPIN [7]. With Java PathFinde [8], it is now possible to tanslate pogams witten in JAVA vesion 1. to PROMELA. In addition, PROMELA/SPIN has been showed to be useful in modeling business ules [9]. Inspie by these novel applications, we examine the applicability of SPIN fo a nontivial picing model in elation to congestion contol in compute netwoks. As demand fo Intenet sevices inceases, so is the impotance of congestion contol in netwok taffic. Conventionally, congestion contol can be accomplished by (i) sending contol packets fom an oveloaded node to some o all of its souces, (ii) poviding delay infomation in influencing netwok outing decisions, o (iii) making use of end-to-end pobe packets and time stamps to measue the delay between two end nodes. One dawback fom these appoaches is that moe contol packets must be added to the netwok befoe data taffic can be educed. Putting netwok uses in a moe active decision making position is a novel idea emeged fom ecent congestion contol eseaches [2,3]. Pioity picing scheme is one implementation of this idea. The quality of packet tansmission is associated with the pice a use is willing to pay. The establishment of pioitized sevice class based on picing will enable netwok povide to adjust netwok volume though picing. Howeve, ideas based on pioity picing emain difficult to veify due to the complexity of thei scopes. We discuss two such ideas below. Gupta [4] pesented a obust model using pioity picing in the dynamic management of netwok bandwidth. In this model, a netwok node may etun an estimated pice and waiting time to a use in esponse to the quality of sevice equested. Afte collecting the cuent picing and pedicted waiting times fom all seves, the use calculates the total expected cost in using the netwok. If the estimated cost is highe than the benefit of using the netwok, the use may decide to delay tansmission until a moe ageeable pice becomes available. Othewise, the use may begin eleasing packets into the netwok. Note that the cost and waiting time may incease when taffic volume becomes high. In esponse to inceased cost, the use will educe the volume of packets eleased into the netwok. Howeve, netwok delays ae common and andom enough that updated picing infomation may not each the use in time to become useful. Theefoe, this picing scheme can be difficult to implement and veify. 1

2 Mabach [1] descibed a simple model that may become moe effective in pactice. In this model, each pioity tansmission level is associated with a fixed pice (on a fast time-scale). Among this hieachy of picing choices, the picing at two consecutive levels ae of geat significance. In this pape, we will efe to the highe pice as the pemium pioity pice, and the lowe one the best effot pice. When packets ae eleased into the netwok with pemium pioity, they ae assued to be tansmitted successfully. Packets eleased with best-effot pioity will always be associated with a cetain non-zeo pobability of packet dop. All submissions at a pice highe than the pemium ae guaanteed to succeed, while submissions at a pice below the best-effot pioity ae bound to be dopped. Uses ae expected to dynamically adjust the quantity of packets submitted (on a fast time-scale) to maximize thei economic benefits. Mabach s model showed that an equilibium in packet allocation fom netwok uses can be established unde pioity picing scheme. This equilibium can potentially be manipulated to contol congestion. While thee ae many excellent tools available fo netwok simulation [1-12], they do not povide any veification capability. When a model is intoduced, its coectness must be analytically poven befoe it can be used as the bases fo futhe discussion. Simulation is an altenative to a fomal poof when analytical veification becomes too difficult. Howeve, simulation cannot povide as stong an assetion on any impotant esults. In this egad, PROMELA/SPIN is a valuable altenative in asseting popeties that may othewise be difficult to veify. In this wok, we will examine the applicability of PROMELA/SPIN as a simulation-veification tool fo nontivial congestion contol models based on Mabach s pioity picing model [1]. Ou objective is to examine whethe SPIN can be used to povide effective assetion to impotant popeties of the undelying model, and demonstate the stonge esults bing foth though SPIN s unique simulation-veification famewok. In paticula, we will apply SPIN to simulate exhaustively the coectness of Mabach s pioity picing poposition and povide veification in LTL on its convegence popety. Futhemoe, we will extend this model with a SPIN simulation to show that allocation equilibium can be maintained unde the dynamic picing scheme suggested by Gupta [4]. This latte esult has not been analytically poven and would be vey had to veifying with existing tools in netwok simulation. We have chosen SPIN fo this wok due to its inheent powe and flexibility in modeling complex softwae systems. We would like to examine the possibility of expanding the scope of SPIN fo models based on economic o mathematical famewoks. The emainde of this pape is oganized as follows. Section 2 povides an oveview of the pice model, along with two poposed models fo veification of its popeties. Section 3 pesents the design details and achitectue of ou models. Section 4 discusses details of simulation and veification in PROMELA/SPIN. Section 5 discusses esults and implementation limitations. We conclude this pape in Section 6. 2 Oveall Design of the Picing Model This section intoduces Mabach s pioity picing model with highlights on the petinent details and teminologies that is fundamental to discussions thoughout this pape. Popositions of Mabach s model ae then pesented. We designed two models with PROMELA/SPIN to veify Mabach s popositions. Model 1 veifies Mabach s poposition that an equilibium in packet allocation exists. Futhemoe, it veifies the convegence of this equilibium. Model 2 is a natual extension to Model 1. It contains an additional pocess in manipulating tansmission pices. In effect, this pocess allows us to veify whethe congestion contol can be achieved by dynamically adjusting pioity picing. 2.1 The Mathematical Pioity Picing Model A compute netwok that implements pioity picing is modelled in [1] based on the following famewok: A discete-time, single-link buffeless channel with a fixed capacity C. Thee ae R uses shaing the channel, R = {1,, R}. 2

3 Netwok sevices ae povided in N diffeent pioity classes, N = {1,, N}. Class i is at a highe pioity than class j if i > j, i, j N. Packet taffic of a highe pioity class eceives pefeential teatment ove a lowe pioity class. Associated with each use R ae: allocation quantities denoted by d (i) which ae the amount of packets allocated by the use at pioity i N in each time slot; and a pivate utility function U known to the use. A utility function is an economics concept that eflects a use s monetay gain as a esult of using the netwok. It is assumed to be a stictly inceasing function of the peceived thoughput, denoted by x. Associated with each pioity class i N ae: a tansmission pobability P t (i) defined as N 1 if C > d( k) k = i N C d ( k ) N k + ( ) = > = i 1 Pt i if d( k) C d ( i) k i othewise = k = i+ 1 N d( k) (1) whee d ( i) = d ( i) is the aggegated allocation of packets ove all uses at pioity i. This is the pobability that packets allocated (submitted) at pioity i ae successfully tansmitted; and a pice u i. In a pioity picing scheme, < u i < u j wheneve i < j, i, j N. Submitting packets at a highe pioity is moe expensive. It can be seen fom the definition of tansmission pobability (1) that a best-effot class i exists such that (a) < P t (i ) 1, (b) P t (i) = 1 fo all i > i and (c) P t (i) = fo all i < i. In othe wods, packets in besteffot class ae tansmitted with a non-zeo pobability; packets fom highe pioity classes ae guaanteed to be tansmitted; packets fom lowe pioity classes ae all dopped. In this pape the class i +1 is efeed to as the pemium class. u is efeed to as the best-effot pice, and u i + 1 the pemium pice. i In a discete-time fomulation, the following inteactions take place in evey time slot. The netwok channel povides pioity sevices accoding to the pobability distibution in (1). Netwok use detemines an optimal allocation of packets (i.e. d (i)) fo the next time slot accoding to the same tansmission pobabilities. The optimality aises fom the fact that the quantity of packets allocated fom the netwok maximizes the net economic gain of the use. In mathematical tems, the detemined allocation fo use is the solution of the maximization poblem max U ( x ) d ( i) u. Let G (x ) (the maginal utility d ( i) 1 function) be the deivative of U (x ), and G its invese function, then it can be shown analytically that when best-effot cost is lowe than pemium cost, allocation is optimal with d ( i ) = 1 Pt ( i ) G 1 ( u i t i P ( i )), d ( i) = fo all i i. This means all packets should be submitted to the besteffot class to peceive the best benefit. When best-effot cost is highe than pemium cost, allocation is 1 optimal with d i 1) = G ( u ), d ( i) = fo all i i + 1. This means all packets should be submitted to ( + i + 1 the pemium class to peceive the best benefit. Finally, when best-effot cost equals pemium cost, use eceives identical benefit fom submitting packets to eithe class. Hence both allocation stategies ae optimal. A netwok use makes use of the above stategy in detemine thei allocation of packets fo the next time slot. Unde this model, Mabach [1] povided an analytically poof fo the following two popositions. i 3

4 Popositions: I. Unde a fixed picing scheme, an equilibium condition exists in packet allocations of channel uses. II. Pioity picing is effective in congestion contol. At equilibium, each use s allocation maximizes its own net benefit. Theefoe, no use has an incentive to change its allocation. Theefoe equilibium is defined to be the state whee no use allocation will deviate fom its cuent value. In the model, this condition can be ealized when all uses allocations emain unchanged between any two consecutive time slots. Note that congestion level of the netwok channel can be eflected in the sum (aggegate) of packets allocated by all uses. With a fixed tansmission capacity, the channel is consideed congested when packet submission exceeds its capacity. This in eality will esult in packet dops and poo Quality of Sevice. Congestion contol is obseved though poposition II. In ode to veify popositions I and II, we fomulate the following models in PROMELA/SPIN and show thei elationships with Mabach s analytical model [1] in tems of thei main components and objective of thei popositions. 2.2 Model 1 (Demand Equilibium Model) Model 1 is designed to captue the majo ingedients of the mathematical model. It is eadily tanslated into PROMELA and veified in SPIN. It also seves as the basis fo Model 2 whee congestion contol is veified. Model 1 is made up of the following main constituents. A channel pocess with a fixed capacity R use pocesses unning in paallel with the channel pocess (shaing the channel). A use pocess can pobe the channel fo the tansmission pobabilities on a fequent but fai basis. It deives an optimal allocation of packets fo the next time slot using the stategy descibed in Section 2.1. A channel pocess computes the tansmission pobabilities of the netwok accoding to (1). This value is made available to all uses of the netwok. The objective of Model 1 is to examine the validity of poposition I though the simulation and veification famewok povided by PROMELA/SPIN. Futhemoe, Poposition I is enhanced to a stonge postulation which we now estate as poposition 1. Poposition 1 Unde a fixed picing scheme, an equilibium condition in packet allocations of channel uses exists and conveges fom some initial allocations. Since Pomela/SPIN only wok with discete values, an equilibium condition in Model 1 is consideed attained when the diffeences between consecutive allocations of all uses ae bounded by a small intege. In this model we choose the bound to be 1. It should be noted in geneal that convegence popeties ae difficult to pove analytically. In paticula an analytical poof fo convegence in poposition 1 has not been given in [1]. Howeve with an automated veification tool such as SPIN, we ae able to mechanically veify the coectness of such poposition. 4

5 2.3 Model 2 (Dynamic Pice Adjustment Model) In ode to exploe the effect of dynamic pice adjustments and veify poposition 2, we extend Model 1 to Model 2 by adding an administato pocess to the system. The channel and use pocesses opeate and inteact in the same manne as in Model 1. The administato pocess monitos the aggegated packet allocation at egula intevals and adjusts the besteffot pice. In esponse to a pice change, use pocesses adopt the same allocation stategy as descibed in Section 2.1 based on the new pice given by the administato. The objective of Model 2 is to examine the validity of poposition II using PROMELA/SPIN. Poposition II is estated as Poposition 2 to moe specifically addess the mechanism in which pioity picing contols congestion. Poposition 2 Pioity picing can effectively change the aggegated equilibium level of packet allocation. 3 Design and Achitectue This section descibes the equiements, oveall achitectue, and vaious components that ae impotant to the models. The following equiement applies to both Models. The time-scale on which simulation is pefomed should be discete. Uses ae expected to closely monito the level of congestion as eflect by the tansmission pobability of the netwok, and eact pomptly by computing a new quantity of packets to submit fo the next time slot. The channel pocess is expected to etun up-to-date tansmission statistics to its uses in an equally timely fashion. As a esult, both use and channel pocesses should poceed on a fast time-scale. Picing fo each pioity classes should be maintained at a steady level to allow the system sufficient time to eaching equilibium (if exists). Since this falls unde the administato s esponsibility, the administato pocess should poceed on a slow time-scale. The main implementation choices applicable to Models 1 and 2 ae: The channel pocess should be invoked following evey change in use allocation. A use pocess should poceed immediately afte each update of the netwok tansmission pobabilities. In ode to guaantee that uses submit packets at a constant and deteministic ate, a paticula use should be equied to wait (block) until all othe uses have updated thei allocations fo the next time slot. This mechanism is necessay to enfoce stong fainess. An additional implementation choice fo Model 2 is: An administato pocess should be invoked on occasions and dynamically adjust the best-effot tansmission pice if the netwok channel is cuently in the state of equilibium. The oveall achitectue of Model 1 contains an envionment whee both use and the netwok inteact dynamically. The successful opeation of Model 1 equies use pocesses to submit packets to the channel pocess, and the channel pocess etun the cuent tansmission pobability of the netwok to all uses. Figue 1 descibes the oveall achitectue of the envionment containing use and channel pocesses. 5

6 Use 1 Use 2 packet allocations tansmission pobabilities Channel Use R Envionment Fig. 1. Oveview of Model 1 Achitectue The achitectue of Model 2 contains a channel, an administato, and use pocesses. In this achitectue, the netwok channel communicates dynamically with both uses and the administato. Given the quantity of packets submitted by uses, the channel pocess etuns the cuent tansmission pobabilities to uses. The administato pocess communicates cuent picing infomation to uses in fixed but lage time intevals. Figue 2 descibes the oveall achitectue of the envionment containing use, administato and the channel pocesses. Use 1 packet allocations Channel Use 2 tansmission pobabilities new best-effot pice Use R packet allocations Administato Envionment Fig. 2. Oveview of Model 2 Achitectue 6

7 Othe impotant paametes in the modeling envionment consist of the quantity of packets use submits, the tansmission pobability of the netwok channel, and an aay of pices each associating with a pioity class. The concept of pioity picing is epesented as a hieachy of picing choices, with highe picing values associated with inceased tansmission pobability. The condition in which equilibium can be detected is also of geat impotance. It was not clea whethe the limitation of PROMELA/SPIN as a discete-value modeling tool will impact the outcome of simulation. In paticula, it is unlikely to obseve convegence in packet allocation to one single value fo all cases. On the othe hand, packet allocation may also divege. Though expeimentation, we found in geneal that the model did convege to within a vey small ange. Though the actual behavio depended on scalable paametes such as the numbe of uses. An effective way to veify convegence within a small ange is to defined in PROMELA a statement #define BOUND(A,B,C) (A - B <= C) && (A - B >= -C). It maintains a pevious (B) and cuent (A) value of inteest and compaes thei distance with the bound (C). Anothe aea equiing special attention is the epesentation of ational numbes, o factions in modeling. It is obvious that factions such as tansmission pobabilities cannot be stoed in intege vaiables as they ae likely to be tuncated. As a esult, a faction data type is devised to stoe ational numbes as pais of integes (numeato, denominato). In this way, faction multiplication can be tanslated to intege multiplication and division. The quantity of uses in modeling also equies some consideation. In geneal, modeling lage numbe of uses povide bette appoximation to eality. When a netwok is shaed by a vey small amount of uses, the model may not convege to within a easonably small ange. It may oscillate between two distant values. This esult is infeed fom the non-coopeative game assumption that a lage numbe of uses is equied to buffe individual impact. A system effectively modeling channel and use stategies should contain the following. A paamete N epesenting the numbe of pioity classes. Paametes associated with each use pocess: a data stuctue of allocation quantities, epesenting packet allocations to each class; and a utility function defined fo the use. This should be a simple function with the desied (stictly inceasing) popety. A data stuctue epesenting ational tansmission pobabilities. A data stuctue epesenting pices associated with pioity classes. 3.1 Channel and Use Stategies (Model 1) The channel pocess should eview the tansmission pobability of a netwok link in a timely fashion. It coodinates the execution of use pocesses and continuously emains active thoughout the simulation. Since a communication channel usually assumes full capacity when it fist becomes available, the tansmission pobability is initialized to 1. The channel pocess is also the fist to be instantiated. This ensues that a communication infastuctue is available befoe use pocesses can possibly inteact. The channel pocess poceeds by computing the available tansmission capacity of the netwok link and detemines the sum of total demands fom uses of the netwok. If the netwok capacity exceeds the sum of use demands, then the tansmission pobability of the netwok is set to 1. Othewise, it is equal to available capacity of the link divided by the sum of total use demands. Note that the tansmission pobability is updated at each pocess cycle, and stoed as a global vaiable. This aangement effectively simulates the situation whee uses of a netwok can pobe the netwok link fo cuent congestion infomation. The use pocess computes the next allocation of packets accoding to the cuent congestion infomation. The quantity of packet allocation is detemined by the benefit each individual use eceives fom using the netwok. Use benefit can be epesented in tems of a utility function U ( x ) = A x. This definition satisfies the geneal equiements that a utility function inceases with stictly deceasing maginal value. The scaling constant A is assumed to be unique in elation to a use s financial stategy. Fo simplicity, we assume a homogeneous use population, adopting to the same scaling constant A. 7

8 In geneal, use stategy in packet allocation follows the deivation in Section 2.1. A use pocess is enabled only when tansmission pobabilities have been update by the channel pocess. All uses in the netwok ae guaanteed a fai chance in allocating tansmission esouce. In paticula, packets ae allocated to all low pioity classes up to but not including the best-effot class. If the condition 2 u P u ) is tue, then use submits A u packets at pemium class. When ( best effot best effot pemium condition ( u best effot P best effot u pemium 2 4 pemium ) becomes tue, use submits A 2 P best u effot 2 4 best effot packets at best-effot class fo tansmission. Zeo quantity is allotted to all emaining high pioity classes. Note that when both conditions 1 and 2 becomes tue, the use pocess nondeteministically selects eithe class to allot. 3.2 Administato Pocess (Model 2) The object of administato pocess is to intoduce picing petubations into the system at designated time intevals. It calculates the sum of cuent use demand and detemines if equilibium has been established. It then assets whethe the total demand and tansmission pice at equilibium exhibits an invesely popotional elationship. When equilibium is asseted, the administato pocess nondeteministically picks the new best-effot pice fom the set { u init 1, u init, u init + 1 } whee u init epesents the initial value fo the best-effot class. Uses ae foced to e-calculate thei economic benefit unde the new pice, and adapt a packet allocation that will optimize thei benefits in the next pocess cycle. As a esult, the tansmission pobability of the netwok is dynamically changed at un time. 4 Simulation and Veification Simulations and veifications wee pefomed in ode to obseve convegence in packet allocation, and its stability theeafte. Since Model 1 and 2 wee designed to mimic the continuous opeation of a netwok channel, each simulation would not nomally teminate. Thee is eally no final state in both Models 1 and 2. Data was theefoe collected though simulations of 5 seconds tials. Appoximately 15 data point can be obtained fom each tial. Simulation and data collection fo both Models 1 and 2 followed the same pocedue, howeve, each simulation was conducted independently of each othe. Fo data analysis, simulation of Model 1 was executed thee times, and the aveaged data set was taken in the constuction of Figue 3. Simulation of Model 2 was pefomed numeous times, howeve only data fom one tial is shown in Figue 4. Each simulation of Model 2 mimics a self-contained netwok system, with an administato abitaily adjusting pices. Theefoe, thee is little coheence between diffeent executions of the model to justify aveaging of data. All simulations and veifications wee pefomed using SPIN Vesion on a Sun UltaSPARC seve with 4 4MHz pocessos and 4GB of physical memoy. 4.1 Simulation of Channel, Use and Administato Pocesses Table 1 tabulates the simulation of Model 1. It shows the data value fom the fist 2 cycles of the inteaction between the use pocess and the channel pocess. In paticula, ows 1 to 1 show use packet allocations fom the fist ten cycles. Rows 11 to 2 show subsequent packet allocations fo the same uses. At Time 1, Use 7 allocates 25 packets unde pioity class 1. The total aggegated demand fo the entie channel at this time is only 25 packets. Othe uses have not yet allotted thei submissions. At Time 2, Use allotted 2 packets to the netwok. The aggegate demand at this instance becomes the sum of allotments of both Use 7 and Use. Befoe Use 3 eleases its submission to the netwok at Time 3, it has computed that submitting at pioity class 2 caies moe advantage than a lowe class. Theefoe, a shift in allotment to highe pioity classes can be obseved in subsequent cycles. Afte all 1 uses have eleased thei submissions to the netwok, the allocation cycle epeats again. The ode in which uses elease thei packets to the netwok in the new cycle is detemined andomly. This featue is impotant in simulating a woking netwok whee the aivals of packets ae commonly consideed as andom and independent events. 8

9 The aggegated demand epesents the cuent allocation of all uses of the netwok. Fo example, at Time 1, Use 7 allocates 25 packets fo the fist time slot. At Time 13, Use 7 updates its allocation to 277 packets. Hence, at Time 13, aggegated demand = aggegated demand Pioity N Time Use Aggegated Demand Table 1. Aggegated Use Demand The aveage aggegated demand in total packets allocation is illustated in Figue 3. Aveage Aggegated Demand Equilibium Aggegated Allocation Time Fig. 3. Equilibium in Picing Model 9

10 In Figue 3, the aggegated allocation (demand) fom all netwok uses is pesented on a fast time-scale. The data was aveaged ove thee simulation uns. Befoe netwok becomes satuated, all uses upload as many packets as desied unde the assumption that tansmission pobability equals one. Guided by the solution of thei benefit function, uses ealize that submitting as desied is not economically optimal. Total demand fom uses theefoe begins to shift towads a value that would optimize eveyone s benefit function. It eaches a plateau aound iteation (time) 2 and emains elatively unchanged theeafte. This emakable esult indicates that the system has eached an equilibium condition in packets allocation. Each use, in optimizing it s own economic benefit, paticipated in a non-coopeative game with the outcome of effectively difting the netwok taffic to a steady level. This essentially suppots Poposition I that an equilibium is indeed possible unde pioity picing scheme. To simulate Model 2, an administato pocess is added. Data values between evey pice change follow the tend obseved in the simulation of Model 1. Model 2 can be consideed as a sequence of Model 1 simulation, each with a diffeent best-effot pice maintained by the netwok administato. Figue 4 illustates the simulation of Model 2. Pice Dynamic Equilibium Time Aggegated Allocation Fig. 4. Aggegated Equilibium The uppe cuve in Figue 4 epesents the cuent best-effot pice detemined by the netwok administato. The lowe cuve is the aggegated allocation fo all uses in the netwok along simulation time. To illustate the effect of dynamic pice adjustment, we can focus on the data segment between Time 1 and Time 2. The best-effot pice at Time 1 stats with a dolla value 5. The aggegated allocation stabilizes to an equilibium of about 28 packet units at Time 114 and emains stable at this level. Note that the netwok capacity is only 2 packet units. The pobability of tansmission is clealy below 1 at the cuent best-effot pice. Seeing that netwok taffic is maintained at a steady level, the administato pocess inceases the best-effot pice to 7. Facing a new highe cost in using the netwok, uses begin to educe the amount of packet allocation, esulting in a downwad incline obseved in the aggegated allocation cuve. This phenomenon continues to Time 148, whee the total allocation dops to 1975 packet units, which is below the total link capacity. As a esult, a tansmission pobability of 1 is etuned to the next use. This use allocates as many packets as desied unde the false assumption that tansmission fo all packets submitted would be successful. Subsequent computations of the benefit function emind uses that netwok bandwidth is not as abundant as anticipated. Each use then educes its allocation to maximize the economical benefit unde the new pice. As a esult, a new equilibium at a lowe aggegated allocation level is obseved. 1

11 4.2 Veification of Convegence to Equilibium (Poposition 1) To veify that an equilibium exists and conveges, we fomulate Poposition 1 as an LTL popety and seach fo an acceptance cycle fo the coesponding Büchi automata. Model 1 essentially descibes the inteleaving executions of the channel and use pocesses. The pesence of an equilibium entails the model s stability. It was fo this eason that we opted to leave out the administato pocess in this scenaio so that the tempoal natue of convegence could be veified. We have fomulated the following LTL popety to specify this poposition fo one use and submitted to SPIN: ( cu cl = pev _ cl) ( d ( cu _ cl) d ( pev _ cl) 1) ( d ( cu _ cl) d ( pev _ cl) 1) _ This popety indicates that eventually use will allocate its packets to a single pioity class and that allocation will emain constant. Altenatively, use has eached an equilibium in its packet allocation. Fo R numbe of uses in the netwok, thee will be R such LTL popeties one fo each use. Due to homogeneity, we can anticipate consistent esults fom all uses. Note that the LTL always opeato ( ) in the above veifies the existence of equilibium in packet allocation while the LTL eventually opeato ( ) veifies the convegence of such equilibium. We configued SPIN to use the maximum amount of available memoy, 496MB, and allowed a seach depth of 3,,. We also adopted 26-bit bit-state hashing in ou veification. A typical un esulted in a 668-byte state vecto, with states and tansitions. In geneal veification of poposition 1 lasts fo fou hous with the given maximum seach depth. 4.3 Veification of Dynamic Picing Adjustment With the addition of an administato pocess, Poposition 2 can be veified by means of an assetion statement embedded into the PROMELA code. To veify this poposition, the administato pocess is intoduced to pefom picing adjustments on the best-effot class. Specifically we would like to deive and veify an invese elationship between pice and allocation at equilibium. The following asset statement is embedded into the administato pocess whee equilibium is detected: asset(bound( d all ( cu _ cl) * Pice( cu _ cl ),K,2)); This statement assets that the poduct of total demand (allocation) and pice of the cuent allocated class of any use is equal to K We configued SPIN to use the same esouces as in the case of poposition 1. A typical un esulted in a 692-byte state vecto, with states and tansitions. In geneal veification of poposition 2 lasts fo two and a half hous with the given maximum seach depth. 5 Discussion This section biefly discusses the ole of PROMELA/SPIN in eaching the objectives of Models 1 and 2. It also discusses some limitations we have expeienced duing the couse of design and simulation. 5.1 Contibution of PROMELA/SPIN in Model 1 Model 1 was constucted based on the mathematical famewok of Mabach s Model [1]. It is distinguished fom Mabach s model with the veification that convegence in packet allocation is 11

12 attainable. This povision consideably stengthens the esult of equilibium and povides the foundation fo simulation and veification of congestion contol in Model Contibution of PROMELA/SPIN in Model 2 With the addition of an administato pocess, PROMELA/SPIN povide an impotant mean to simulate untime dynamic pice adjustment in the pioity picing scheme. Model 2 distinguishes itself fom ealie wok on dynamic pice adjustment [4] in two impotant ways. Using the simulation-veification capability povided by PROMELA/SPIN and the esults obtained fom Model 1, each inte-pice-change segment in Figue 4 can be consideed as an independent simulation simila to Model 1. Theefoe, the existence of an equilibium fo each segment and its convegence can be fomally veified. In addition, data collected fom the simulation of Model 2 also indicates an invese popotionality between pice and total packets allotted to netwok uses. As illustated in Figue 4, when pice is high, the aggegated demand ests on a lowe volume in equilibium. This esults obtained fom PROMELA/SPIN is aguably stonge than simila esults based on simulation alone. Futhe investigation and veification of this invese pice-volume elationship can be eadily suppoted by PROMELA/SPIN. In this egad, congestion contol studies based on pioity picing modelling using PROMELA/SPIN clealy pesents a unique advantage ove othe simulation tools. 5.3 Limitations In Model II we have pefomed veifications using only one set of initial conditions, namely all use pocesses begin with a zeo allocation to all pioity classes. Given anothe set of initial allocations, it would be desiable to obseve an identical equilibium condition. The ultimate goal is to veify the moe geneal case whee poposition 1 and 2 emain affimative fo all sets of initial conditions. Little evidence is obseved whee PROMELA/SPIN would be limited in veifying the geneal case. Howeve, it may not be feasible to fomulate each use pocess in LTL. In spite of this, the simulation and veification famewok povided by PROMELA/SPIN is still stonge than using simulation alone with the cuently available netwok tools. We have compaed the applicability between SPIN vesus SMV in modeling pioity picing. In SMV, it is possible to model all uses updating packets allocation in one single time slot. When modeling in SPIN, we ae foced to simulate the inteaction between use and the netwok asynchonously. In each time slot, only one use pocess opeates. In this egad, SMV s capability to model synchonous system seems to make it a moe logical choice. Afte expeimenting with both automated veification tools, we have chosen PROMELA/SPIN fo PROMELA s expessiveness and SPIN s veification capability. We ae especially impessed with the ich language constucts and pogamming flexibility povided by PROMELA. 6 Conclusion Thoughout this wok, we have been impessed with the expessiveness of PROMELA and intepetative stength of SPIN as a simulation-veification tool. We have been equally impessed with the stength of automated veification tools in geneal in poviding modeling and veifying capability to complicated scenaios. By following the assumptions made [1], we successfully developed thee pocess types in SPIN, inteacting with one anothe asynchonously in simulation of a netwok link in action. Not only have we veified in SPIN that the postulated equilibium indeed existed, we have shown in Model 1 that convegence to equilibium can be achieved. Futhemoe, we demonstated in Model 2 the unique esult that effective congestion contol can be achieved though dynamic pice adjustment. The choice of using PROMELA/SPIN fo this wok had aisen though necessity. The stength of combined simulation and veification famewok povided by PROMELA/SPIN would be difficult to eplicate using anothe tool. 12

13 Acknowledgement We would like to expess ou gatitude to Pofesso Masha Chechik fo he invaluable suggestions and patient guidance thoughout this wok. We ae especially indebted to he tieless effot that had led us though numeous evisions of this manuscipt. We would like to thank Pofesso Pete Mabach fo his guidance in the undestanding of the pioity picing model fo congestion contol. Refeences [1] P. Mabach, Picing Pioity Classes in Diffeentiated Sevices Netwoks, 37th Annual Alleton Confeence on Communication, Contol, and Computing, Monticello, IL, Septembe [2] A. Gupta, D. O. Stahl, and A. B. Whinston, A Pioity Picing Appoach to Manage Multi-Sevice Class Netwoks in Real-Time, Pesented at MIT Wokshop on Intenet Economics, Mach [3] A. Gupta, D. O. Stahl, and A. B. Whinston, The Economics of Netwok Management, Communications of the ACM, 42(9):57-63, Septembe [4] A. Gupta, D. O. Stahl, and A. B. Whinston, A Stochastic Equilibium Model of Intenet Picing, Jounal of Economics Dynamics and Contol, 21: , [5] G.J. Holzmann, The Model Checke SPIN, IEEE Tansactions on Softwae Engineeing, 23(5):1-17, May [6] E. Fesman and B. Jonsson, Abstaction of Communication Channels in PROMELA: A Case Study, In SPIN Model Checking and Softwae Veification: Poc. 7th Int. SPIN Wokshop, volume 1885 of Lectue Notes in Compute Science, pages , Stanfod, CA, 2. Spinge Velag. [7] Theo C. Ruys and Rom Langeak, Validation of Bosch Mobile Communication Netwok Achitectue with SPIN, In Poceedings of SPIN97, the Thid Intenational Wokshop on SPIN, Univesity of Twente, Enschede, The Nethelands, Apil [8] Klaus Havelund, Thomas Pessbuge, Model Checking JAVA Pogams using JAVA PathFinde, STTT 2(4): (2) [9] Wil Janssen, Radu Mateescu, Sjouke Mauw, Pete Fennema, Peta van de Stappen, Model Checking fo Manages, SPIN 1999: [1] Lee Beslau, Deboah Estin, Kevin Fall, Sally Floyd, John Heidemann, Ahmed Helmy, Polly Huang, Steven McCanne, Kannan Vaadhan, Ya Xu, and Haobo Yu, Advances in Netwok Simulation, IEEE Compute, 33 (5), pp , May, 2. [11] Sandeep Bajaj, Lee Beslau, Deboah Estin, Kevin Fall, Sally Floyd, Padma Halda, Mak Handley, Ahmed Helmy, John Heidemann, Polly Huang, Satish Kuma, Steven McCanne, Reza Rejaie, Puneet Shama, Kannan Vaadhan, Ya Xu, Haobo Yu, and Daniel Zappala, Impoving Simulation fo Netwok Reseach, Technical Repot 99-72, Univesity of Southen Califonia, Mach, [12] Deboah Estin, Mak Handley, John Heidemann, Steven McCanne, Ya Xu, and Haobo Yu, Netwok Visualization with the VINT Netwok Animato Nam, Technical Repot 99-73, Univesity of Southen Califonia, Mach,