A Mechanically Proved and Incremental Development of IEEE 1394 Tree Identify Protocol
Résumé
The \ieee tree identify protocol illustrates the adequacy of the \textit{event-driven approach} used together with the B Method . This approach provides a complete framework for developing mathematical models of distributed algorithms. A specific development is made of a series of more and more refined models. Each model is made of a number of static properties (the invariant), and of a dynamic parts (the guarded events). The internal consistency of each model as well as its correctness with regards to its previous abstraction are proved with the proof engine of Atelier B, which is the tool associated with B. In the case of \ieee, the initial model is very primitive: it provides the basic properties of the graph (symmetry, acyclicity, connectivity), and its dynamic parts essentially contains a single event which \textit{elects the leader} in one shot. Further refinements introduce more events, showing how each node of the graph non-deterministically participates to the leader election. At some stage in the development, message passing is introduced. This raises a specific potential contention problem, whose solution is given. The last stage of the refinement completely localize the events by making them taking decision based on local data only.