research article model-checking driven design of qos-based...

Research ArticleModel-Checking Driven Design of QoS-Based RoutingProtocol for Wireless Sensor Networks

Zhi Chen123 Ya Peng12 and Wenjing Yue24

1College of Computer Nanjing University of Posts and Telecommunications Nanjing 210023 China2Institute of Computer Technology Nanjing University of Posts and Telecommunications Nanjing 210023 China3State Key Laboratory for Novel Software Technology Nanjing University Nanjing 210023 China4College of Telecommunications and Information Engineering Nanjing University of Posts and TelecommunicationsNanjing 210003 China

Correspondence should be addressed to Wenjing Yue yuewjnjupteducn

Received 7 February 2015 Revised 26 May 2015 Accepted 27 May 2015

Academic Editor Jesus Corres

Copyright copy 2015 Zhi Chen et alThis is an open access article distributed under theCreative CommonsAttribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Accurate and reliable routing protocols with Quality of Service (QoS) support determine the mission-critical application efficiencyinWSNsThis paper proposes amodel-checking design driven framework for designing the QoS-based routing protocols ofWSNswhich involves the light-weight design process the timed automata model and the alternative QoS verification properties Theaccurate feedback of continually model checking in the iterative design process effectively stimulates the parameter tuning of theprotocols We demonstrate the straightforward and modular characteristics of the proposed framework in designing a prototypeQoS-based routing protocolThe prototype study shows that the model-checking design frameworkmay complement other designmethods and ensure the QoS implementation of the QoS-based routing protocol design for WSNs

1 Introduction

Wireless sensor networks (WSNs) as the multihop self-organizing networks usually provide vital support formission-critical applications [1] but have many design chal-lenges such as routing [2] topology control [3] and coverage[4] Quality of Service (QoS) support may determine therouting efficiency and effectiveness of real-timeWSNs due tothe constrained energy supply bandwidth and delay [5]

In order to design the QoS-based routing protocols forWSNs we usually verify and evaluate the correctness andperformance of these protocols using testing simulation andformal verification Testing usually analyzes the implemen-tations of these protocols and finds the protocol defectsbut it is often achieved at a cost and cannot analyze all theconditions of these protocols Simulation is commonly usedin QoS-based routing protocol analysis but it cannot analyzeall the protocol behaviors Formal verification for examplemodel checking can describe and analyzeQoS-based routingprotocols accurately and canmake up the deficiency of testingand simulation [6ndash8] Moreover model checking can drive

the design of some applications and systems such as theinteractive systems [9] and the web application [10] and maydesign the QoS-based routing protocols from model drivenengineering to verification driven engineering [11]

In order to effectively design the QoS-based routingprotocols for the mission-critical applications of WSNs thepaper proposes a model-checking driven design frameworkand demonstrates the effectiveness and advantages by theaccurate feedback of continually model checking in theiterative design process The rest of the paper is organizedinto five sections Section 2 briefly introduces related workSection 3 presents the model-checking driven design frame-work Section 4 introduces a prototype of the QoS-basedrouting protocol Section 5 presents the protocol verificationand design improvement Finally the conclusions are offeredin Section 6

2 Related Work

Akkaya andYounis [12] presented an energy-awareQoS rout-ing protocol for WSNs with best-effort traffic and validated

Hindawi Publishing CorporationJournal of SensorsVolume 2015 Article ID 716561 7 pageshttpdxdoiorg1011552015716561

2 Journal of Sensors

Input the network (0 1 119899 minus 1) QoS metrics (1198980 1198981 119898

119896minus1)

Design QoSRP the prototype of the QoSminus based routing protocol with the metric1198980

119894 larr 0while (119894 lt 119896) do

Model QoSRP using Timed AutomataVerify QoSRP via Model Checking and Output the verification resultsEvaluate the verification results and improve QoSRP119894 larr 119894 + 1

if (119894 lt 119896)Redesign QoSRP with the metrics119898

0 119898

119894

endifendwhileOutput QoSRP

Pseudocode 1 Model-checking driven design process

the effectiveness of the protocol through simulation Ben-Othman and Yahya [13] proposed a QoS aware multipathrouting protocol based on the concept of service differenti-ation to control the delay and then used the NS-2 simulationsto evaluate the performance of the protocol for WSNs Sunet al [14] presented a game-theoretic approach to coordinatethe QoS routing for WSNs and used NS-2 to verify itsperformance with simulations Cheng et al [15] used thegeographic opportunistic routing for QoS provisioning inWSNs and evaluated the protocol through NS-2 simulationsand tests on the hardware nodes Hu et al [16] proposeda multihop heterogeneous cluster-based optimization algo-rithm (MHCOA) for WSNs and also used NS-2 simulationto show the better performance ofMHCOA in heterogeneousWSNs

Akbas and Turgut [17] presented a routing protocol withQoS support for wireless sensor and actor networks andcarried out a series of simulations in OPNET modeler toanalyze the performance of the protocol Hammoudeh andNewman [18] presented an adaptive routing protocol withQoS metrics to meet application requirements of WSNs andused the Dingo WSN simulator to evaluate the performanceof the protocol Tschirner et al [19] presented the automata-based models for biomedical sensor networks (BSN) andsuccessfully used the driven model-checking technique tocomplement the simulation techniques to validate QoS prop-erties of BSN

In the above-mentioned related work the simulation-based method is the main design verification technique forthe QoS-based routing protocols of WSNs [20] but it ispossible that some errors whichmay only occur under specialconditions cannot be found in the simulations thus the QoSmetrics may not meet the routing requirements of WSNs inthe mission-critical applications

3 Model-Checking Driven Design Framework

To ensure that the QoS-based routing protocol can saveenergy reduce the transmission delay increase the probabil-ity of successful transmission to the sink node and providehigh QoS for WSNs we propose the model-checking driven

design framework consisting of the design process the timedautomata model and the verification properties

31 Design Process In the model-checking driven designframework for the QoS-based routing protocols of WSNsthe model-checking driven design process shown inPseudocode 1 uses the iterative and incremental develop-ment A QoS-based routing protocol of WSNs is designedthrough repeated cycles and in smaller parts at one timeand iteratively enhanced through model checking until thefull protocol is implemented At each iteration the designimprovement is made and one new QoS metric is added

In the model-checking driven design process weassume there are 119899 nodes in WSNs and 119898 QoS metrics(1198980 1198981 119898119896minus1) from the application requirements ofWSNs and firstly design one prototype of the QoS-basedrouting protocol using the QoS metric of 1198980 namelyQoSRP which we can react with and is simple enough to beunderstood and implemented easily then QoSRP is modeledusing timed automata [21 22] verified via model checkingand improved as a result of evaluating the verification resultsAfter taking the first iteration of the design improvementwe add one new QoS metric as the new feature to redesignQoSRP and continue to perform the process

32 Timed Automata Model In the model-checking drivendesign framework we define the timed automata modelincluding the timed automaton of the sink node and thetimed automaton of the sensor nodes according to thebehavior of nodes in WSNs

The timed automaton of the sink node is formallydescribed as

(Initial [119910 lt = INITIAL DELAY] [ ])

119910==INITIAL DELAY997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr (Received [119909 lt = 119877] [broad])

(1)

(Received [119909 lt = 119877] [ ])

997888rarr (Initial [119910 lt = INITIAL DELAY] [stop]) (2)

Journal of Sensors 3

The timed automaton of the sensor nodes is formallydescribed as

(Listen [timelt = backoff] [ ])

time==backoff997888997888997888997888997888997888997888997888997888997888rarr (Broadcasting [ ] [broad])

(3)

(119879119909 [119909 lt = TRANSMIT] [stop])

997888rarr (Broadcasting [ ] [ ]) (4)

(Broadcast [WaitTimelt = TIMEOUT] [ ])

WaitTime==TIMEOUT997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr (119879119909 [119909 lt = TRANSMIT] [ ])

(5)


997888rarr (Received [119909 lt = 119877] [start]) (6)

(Received [119909 lt = 119877] [ ])

997888rarr (Broadcasting [ ] [stop]) (7)

In the timed automata model of WSNs 119887119903119900119886119889 is theprobe information sending channel of the sink node 119904119905119886119903119905is the message transmitting starting channel of the sensornodes and 119904119905119900119901 is the message transmitting ending channelof the sensor nodes When the timed automata work theclock values increase all with the same speed and alongthe state transitions in every automaton of the sink node orone sensor node clock values being compared to integersform the guards whichmay enable or disable state transitionsand inhabit the possible behaviors in the mission-criticalapplications of WSNs

33 Verification Properties In the model-checking drivendesign framework we select four CTL properties includingno deadlock network connectivity delivery rate of datapacket and transmission delay [19] which may be used formodel checking

(1) No Deadlock This property can be formally specified asfollows

119860 [] not deadlock (8)

(2) Network ConnectivityAny node ofWSNs should commu-nicate with the sink node no matter directly or through themultihop paths within a certain time and the isolated nodesshould not exist in theory This property can be formallyspecified as follows

119860 ltgt received [119894] gt 0 (9)

(3) Packet Delivery Success Rate The channel access failuredata packet collision information transmission error causedby the thermal noise and external interference may result inthe loss of the packets Packet delivery success rate refers tothe ratio of the number of packets successfully received by thesink node and the number of packets sent to the sink nodeby the sensor nodes For example if the sensor nodes send 10

packets to the sink node we need to verify the packet deliveryrate reaching 90 this property can be formally specified asfollows

119860 [ ] (periods [119883] gt = 10) imply (received [119883] gt = 9) (10)

(4) Transmission Delay Transmission delay is the effective-ness of data packets which must be transmitted to the sinknode through the multihop paths in a bounded time Thisproperty of the transmission delay time not exceeding119872 ofsending a packet to the sink node by the sensor node 119894 can beformally specified as follows

119860 [ ] time [119894] lt= 119872 (11)

4 A Prototype of the QoS-Based RoutingProtocol QoSRP

We design a prototype of the QoS-based routing protocol forWSNs namely QoSRP Assuming there are 119899 nodes inWSNsincluding one sink node and 119899 minus 1 sensor nodes 119894 representsone node where 119894 isin 0 1 119899minus1 and the node 0 is the sinknode119908(119894 119895) is the link cost between the node 119894 and the node 119895where119908(119895 119894) = 119908(119894 119895)119908(119894 119894) = 0 119894 isin 0 1 119899minus1 and 119895 isin0 1 119899 minus 1 119889[119894] is the end-to-end optimal transmissioncost of the node 119894 and the sink node We define 119866 = (119881 119878)where 119881cup 119878 = 0 1 119899 minus 1 119881 represents the set of sensornodes without the optimal next-hop neighbor nodes and 119878 isthe set of sensor nodes with the optimal next-hop neighbornodes

(1) Initialization In an initial state every node in WSNsbroadcasts the ldquodetectingrdquo message consisting of its locationinformation ideal transmitting radius and residual energyinformation by flooding communication and calculates thelink costs between it and other nodes according to thereceived ldquodetectingrdquo messages in the network We selecttwo QoS metrics including the transmitting delay and theresidual energy over the data transfer paths for calculatingthe link costs All link costs of 119908(119894 119895) are stored in the node119894 and if the node 119894 does not receive the ldquodetectingrdquo messageof the node 119895 119908(119894 119895) = MAXCOST where MAXCOST is theideal maximum value Then the sink node starts the processof obtaining the least cost paths At first 119878 = 0 thereforewe can get

119889 [119894] =

119908 (119894 0) 119894 = 0

0 119894 = 0(12)

(2) Iteratively Updating the End-to-End Optimal TransmissionCosts For the node 119894 in WSNs where 119894 isin 119878 it updates its 119889[119894]according to (3) Consider

119889 [119894] = min 119889 [119894] 119889 [119896] +119908 (119896 119895) 119896 isin 119881 (13)

According to (14) QoSRP selects 119896 isin 119878 as the node in theoptimal path removes 119896 from 119878 and adds 119896 into 119881 Consider

119889 [119896] = min 119889119894 [119894] isin 119878 (14)


broad

broad

start[i]

stop[tmp]

received[tmp]++

i node_id

Received

C

Initial

x lt= R

ack[0][tmp] = 1

tmp=i

y lt= INITIAL_DELAY

y == INITIAL_DELAY

ack[0][tmp] == 0

topology[tmp][0] lt 0

topology[tmp][0] gt 0 ampamp

copy

Figure 1 Timed automaton model of 119878119894119899119896

start[id]broad

stop[id]

stop[id]

Listen

Sense

Broadcasting

ReceivedC

Tx

Broadcast

x lt= R

WaitTime lt= TIMEOUT

x lt= TRANSMIT

temp=i

temp=id

ReTransmit=4

ReTransmit=4

backoff =BTlowastC[id][tmp]time=backoffM++

P[id]=(P[tmp] + C[id][tmp])

period[id]++

P[id] gt (P[tmp] + C[id][tmp])

P[id] lt= (P[tmp] + C[id][tmp])

WaitTime = 0

ReTransmit minusminusWaitTime=0

i node_idstart[i]stop[tmp]

broad

time gt= backoff

M lt MAX_M

C[id][tmp] == MAX_PRICE

topology[temp][id] lt 0

WaitTime == TIMEOUT ampampack[0][temp] == 0

ReTransmit == 0

topology[temp][id] gt 0

received[tmp]++

Figure 2 Timed automaton model of119873119900119889119890(119894119889)

(3) Finding the Optimal Path and Steadily Sending Data Thesink node periodically broadcasts a message to form oneoptimal path other nodes select a node as the parent nodewithin the set of 119881 until all nodes can route to the sink nodeAfter forming one optimal path the sensor nodes steadilysend data to the sink node via the path in one period

5 Protocol Verification andDesign Improvement

51 Protocol Modeling Wemodel QoSRP based on the timedautomata model using the model checker UPPAAL [23]In usual scenarios all sensor nodes are modeled with theparametric timed automata in UPPAAL

First of all we set up a set of identifiers 119899119900119889119890 119894119889 to recordall nodes Assuming that there are 119899 sensor nodes in WSNs

119899119900119889119890 119894119889 = 0 1 2 119899 minus 1 In QoSRP the identifier of thesink node is 0 and the identifier of one other node is 119894119889where 119894119889 isin 1 2 119899 minus 1 The behaviors of one sensornode inWSNs can be described using two-timed automaton119878119894119899119896 and 119873119900119889119890(119894119889) The timed automaton of 119878119894119899119896 shown inFigure 1 describes the sink node and the timed automatonof 119873119900119889119890(119894119889) shown in Figure 2 is responsible for messagesending and receiving of other sensor nodes

Not all nodes in a real-time system are turned on simulta-neously and we constrain the turn-on times of sensor nodesin [0 119868119873119868119879119868119860119871 119863119864119871119860119884] during which any sensor node canbe turned on In Figure 1 119886119888119896[0][119905119898119901] indicates whether anacknowledge message of the node 119905119898119901 is received by thesink node and before the sink node receives the acknowledgemessage 119886119888119896[0][119905119898119901] = 0

119904119905119886119903119905[119899119900119889119890 119894119889] and 119904119905119900119901[119899119900119889119890 119894119889] respectively indicatethat one node starts transmitting messages and ends a


Table 1 Verification results in the first iteration

Property Network size Results CPU (s) Memory (MB)119860[] not deadlock 5 Y 25823 3136119860[] not deadlock 6 Y 564044 19335119860 ltgt received[2] gt 0 5 Y 32667 9345119860 ltgt received[2] gt 0 6 Y 63352 5305119860[] periods[1] lt 6 5 N 1224 11256119860[] periods[1] lt 7 5 Y 1334 11255119860[] periods[3] lt 2 5 N 1186 11262119860[] periods[3] lt 3 5 Y 1211 11258119860[] periods[5] lt 2 5 N 1256 11262119860[] periods[5] lt 3 5 Y 1297 11255119860[] periods[1] lt 5 6 N 1283 11257119860[] periods[2] lt 3 6 N 5674 63029119860[] (periods[2] gt= 10) imply (received[2] gt= 8) 5 Y 1164 11259119860[] (periods[2] gt= 10) imply (received[2] gt= 9) 5 N 525 10763119860[] (periods[2] gt= 10) imply (received[3] gt= 7) 5 Y 1158 11253119860[] (periods[2] gt= 10) imply (received[3] gt= 8) 5 N 412 10666119860[] (periods[2] gt= 10) imply (received[4] gt= 5) 5 Y 1163 11264119860[] (periods[2] gt= 10) imply (received[4] gt= 6) 5 N 495 10668119860[]time[2] lt 50 5 N 0763 2602119860[]time[2] lt 80 5 N 6363 16199119860[]time[2] lt 100 5 Y 3605 43113

message transmission 119904119905119886119903119905[119899119900119889119890 119894119889] and 119904119905119900119901[119899119900119889119890

119894119889] are synchronized with 119904119905119886119903119905[119899119900119889119890 119894119889] and 119904119905119900119901[119899119900119889119890119894119889] 119887119903119900119886119889 means that the sink periodically sendsprobe information and is synchronization with 119887119903119900119886119889119905119900119901119900119897119900119892119910[119899119900119889119890 119894119889][119899119900119889119890 119894119889] indicates the connection matrixof the nodes in WSNs 119903119890119888119890119894V119890119889[119899119900119889119890 119894119889] represents thenumber of packets sent to the sink node by the node 119899119900119889119890 119894119889and also ensures that the node can eventually connect to thesink node if 119903119890119888119890119894V119890119889[119899119900119889119890 119894119889] gt 0

In Figure 2 the time automaton of 119873119900119889119890(119894119889) is dividedinto two phases The first phase in 119873119900119889119890(119894119889) is to findout the minimum cost path from the node to the sinknode and the second phase is to the transmit data In119873119900119889119890(119894119889) 119903119890119888119890119894V119890119889[119899119900119889119890 119894119889] represents the number of pack-ets received by the node from the other node 119899119900119889119890 119894119889 and119901119890119903119894119900119889119904[119899119900119889119890 119894119889] represents the number of packets sent bythe node 119899119900119889119890 119894119889 We can compare 119903119890119888119890119894V119890119889[119899119900119889119890 119894119889] and119901119890119903119894119900119889119904[119899119900119889119890 119894119889] to illustrate the packet transmission successrate

In Figure 2 119875[119873119900119889119890 119894119889] indicates the shortest distancesof the node 119899119900119889119890 119894119889 to the sink node and 119862[119873119900119889119890

119894119889][119873119900119889119890 119894119889] is the link communication cost betweentwo nodes In 119873119900119889119890(119894119889) the variable of 119905119898119901 records theidentifier of the node sending messages 119873119900119889119890(119894119889) followsthe task processing mechanism of first-come first-servedin TinyOS [24] and considers the transmission delay inmodeling message sending Message transmission mayneed a few seconds change the order of message sendingand receiving and affect the protocol implementationso it cannot be ignored Therefore we add the variable of119909 simulating the message delay where 119909 le 119863119864119871119860119884 andDELAY is the maximum value of the message transmissiondelay

52 Protocol Verification We verify QoSRP about the prop-erties such as no deadlock network connectivity deliveryrate of data packet and transmission delay [19] Table 1 isthe verification results in the first iteration in which the QoSmetric is the residual energy over the data transfer paths andit shows that the performance properties were not satisfiedif the sensor nodes send fewer packets to the sink node andthe packet successful delivery rates did not satisfy the networkQoS requirements

53 Design Improvement According to the verificationresults shown in Table 1 the performance of the currentQoSRP still requires to be improved so we continue totune the parameters shown in Figures 1 and 2 such as119868119873119868119879119868119860119871 119863119864119871119860119884119879119877119860119873119878119872119868119879119872119860119883 119872119879119868119872119864119874119880119879 and119872119860119883 119875119877119868119862119864 and optimize QoSRP through model check-ing

Nowwe combine the twoQoSmetrics of the transmittingdelay and the residual energy over the data transfer paths toredesign QoSRP The pseudocode of the redesigned QoSRPin one period is given in Pseudocode 2 According to themodel-checking driven design framework the new QoSRPis reevaluated through model checking and Table 2 presentsthe verification results which show a better performance ofthe protocol

6 Conclusions

The QoS-based routing protocols are the mission-criticalapplication requirements of WSNs and involve many veri-fication and evaluation techniques such as testing simula-tion and formal verification This paper proposes a model-checking driven framework for designing these protocols


Input the network (0 1 119899 minus 1) QoS metrics (Residual Energy Transmitting Delay)Ouput QoSRP the impoved prototype of the QoSminus based routing protocolBEGINfor node (119894 larr 0 to 119899 minus 1)Broadcast Detecting Message(Location

119894 Transmitting radius

119894 Residual energy

119894)

endforfor node (119894 larr 0 to 119899 minus 1)for node (119895 larr 0 to 119899 minus 1)

Calculate 119908(119894 119895) only for verifications

119908(119894 119895) =

Transmitting radiusResidual energy

119894

sdot for the normalization function

endforfor node (119894 larr 1 to 119899 minus 1)Update 119889[119894]

endforrepeatAdjust 119866 larr (119881 119878)

Evalute QoSuntil Find one optimal pathfor node (119894 larr 1 to 119899 minus 1)Sending data via the optimal path

endforEND

Pseudocode 2 Pseudocode of the redesign QoSRP

Table 2 Verification results in one next iteration

Property Network size Results CPU (s) Memory (MB)119860[] not deadlock 5 Y 25915 3236119860[] not deadlock 6 Y 558729 20015119860 ltgt received[2] gt 0 5 Y 32465 9466119860 ltgt received[2] gt 0 6 Y 61337 53512119860[] periods[1] lt 6 5 Y 1316 11255119860[] periods[1] lt 7 5 Y 1355 11279119860[] periods[3] lt 2 5 Y 1159 11216119860[] periods[3] lt 3 5 Y 1251 11369119860[] periods[5] lt 2 5 Y 1297 11279119860[] periods[5] lt 3 5 Y 1248 11228119860[] periods[1] lt 5 6 Y 1265 11232119860[] periods[2] lt 3 6 N 5629 63155119860[] (periods[2] gt= 10) imply (received[2] gt= 8) 5 Y 1215 11443119860[] (periods[2] gt= 10) imply (received[2] gt= 9) 5 Y 565 10863119860[] (periods[2] gt= 10) imply (received[3] gt= 7) 5 Y 1201 11318119860[] (periods[2] gt= 10) imply (received[3] gt= 8) 5 Y 423 10508119860[] (periods[2] gt= 10) imply (received[4] gt= 5) 5 Y 1203 11198119860[] (periods[2] gt= 10) imply (received[4] gt= 6) 5 Y 498 10576119860[]time[2] lt 50 5 N 0754 2592119860[]time[2] lt 80 5 Y 6378 16203119860[]time[2] lt 100 5 Y 3614 43018

including the iterative design process the timed automatamodel and the alternative verification properties We designa prototype of the QoS-based routing protocol and demon-strate continuing improving the protocol using the proposedframework and UPPAAL model checking The results ofthe prototype study show that the model-checking drivendesign framework is a straightforward and modular methodand supports the light-weight iterative redesign for designing

QoS-based routing protocols of WSNs and the feedbackof continually model checking accurately drives the perfor-mance improving of the protocols of real-time WSNs

Conflict of Interests

The authors declare no conflict of interests


Acknowledgments

This work was supported by the National Natural Sci-ence Foundation of China (Grant no 60905040) the BasicResearch Program of Jiangsu Province (Natural ScienceFoundation) (Grant no BK20131382) the 11th Six Tal-ent Peaks Program of Jiangsu Province (Grant no XXRJ-009) China Postdoctoral Science Foundation (Grant no2013M531393) and Jiangsu Planned Projects for PostdoctoralResearch Funds (Grant no 1102102C)

References

[1] M A Mahmood W K G Seah and I Welch ldquoReliabilityin wireless sensor networks a survey and challenges aheadrdquoComputer Networks vol 79 pp 166ndash187 2015

[2] M Radi B Dezfouli K A Bakar and M Lee ldquoMultipathrouting in wireless sensor networks survey and research chal-lengesrdquo Sensors vol 12 no 1 pp 650ndash685 2012

[3] Z Chen S Li and W Yue ldquoSOFM neural network basedhierarchical topology control for wireless sensor networksrdquoJournal of Sensors vol 2014 Article ID 121278 6 pages 2014

[4] Z Chen S Li and W Yue ldquoMemetic algorithm-based multi-objective coverage optimization for wireless sensor networksrdquoSensors vol 14 no 11 pp 20500ndash20518 2014

[5] R A Uthra and S V K Raja ldquoQoS routing in wireless sensornetworksmdasha surveyrdquo ACM Computing Surveys vol 45 no 1article 9 2012

[6] J Woodcock P G Larsen J Bicarregui and J FitzgeraldldquoFormal methods practice and experiencerdquo ACM ComputingSurveys vol 41 no 4 article 19 2009

[7] D Le Metayer ldquoFormal methods as a link between softwarecode and legal rulesrdquo in Software Engineering and FormalMethods 9th International Conference SEFM 2011 MontevideoUruguay November 14ndash18 2011 Proceedings vol 7041 of LectureNotes in Computer Science pp 3ndash18 Springer Berlin Germany2011

[8] E M Clarke J O Grumberg and D A PeledModel CheckingMIT Press Boston Mass USA 1999

[9] A Cerone and N Elbegbayan ldquoModel-checking driven designof interactive systemsrdquo Electronic Notes inTheoretical ComputerScience vol 183 pp 3ndash20 2007

[10] F M Donini M Mongiello M Ruta and R Totaro ldquoA modelchecking-based method for verifying web application designrdquoElectronic Notes in Theoretical Computer Science vol 151 no 2pp 19ndash32 2006

[11] F Kordon J Hugues and X Renault ldquoFrom model drivenengineering to verification driven engineeringrdquo in SoftwareTechnologies for Embedded and Ubiquitous Systems vol 5287 ofLecture Notes in Computer Science pp 381ndash393 Springer BerlinGermany 2008

[12] K Akkaya and M Younis ldquoAn energy-aware QoS routingprotocol for wireless sensor networksrdquo in Proceedings of the23rd IEEE International Conference on Distributed ComputingSystems Workshops pp 710ndash715 Providence RI USA May2003

[13] J Ben-Othman and B Yahya ldquoEnergy efficient and QoS basedrouting protocol for wireless sensor networksrdquo Journal ofParallel and Distributed Computing vol 70 no 8 pp 849ndash8572010

[14] R Sun E Ding H Jiang R Geng and W Chen ldquoGametheoretic approach in adapting QoS routing protocol forwireless multimedia sensor networksrdquo International Journal ofDistributed Sensor Networks vol 2014 Article ID 745252 5pages 2014

[15] L Cheng J Niu J Cao S K Das and Y Gu ldquoQoS awaregeographic opportunistic routing in wireless sensor networksrdquoIEEE Transactions on Parallel and Distributed Systems vol 25no 7 pp 1864ndash1875 2014

[16] S Hu J Han XWei and Z Chen ldquoAmulti-hop heterogeneouscluster-based optimization algorithm for wireless sensor net-worksrdquoWireless Networks vol 21 no 1 pp 57ndash65 2015

[17] M I Akbas and D Turgut ldquoLightweight routing with dynamicinterests in wireless sensor and actor networksrdquo Ad Hoc Net-works vol 11 no 8 pp 2313ndash2328 2013

[18] M Hammoudeh and R Newman ldquoAdaptive routing in wirelesssensor networks QoS optimisation for enhanced applicationperformancerdquo Information Fusion vol 22 pp 3ndash15 2015

[19] S Tschirner X Liang and YWang ldquoModel-based validation ofQoS properties of biomedical sensor networksrdquo in Proceedingsof the 8th ACM International Conference on Embedded Softwarepp 69ndash78 October 2008

[20] S Sridevi and M Usha ldquoEnergy-aware QoS based routingprotocols for heterogeneous WSNsmdasha surveyrdquo InternationalJournal of Computer Science and Business Informatics vol 11 no1 pp 1ndash19 2014

[21] J Bengtsson and Y Wang ldquoTimed automata semantics algo-rithms and toolsrdquo in Lectures onConcurrency and Petri Nets vol3098 of Lecture Notes in Computer Science pp 87ndash124 SpringerBerlin Germany 2004

[22] P Fontana and R Cleaveland ldquoAmenagerie of timed automatardquoACM Computing Surveys vol 46 no 3 article 40 2014

[23] G Behrmann A David and K G Larsen ldquoA tutorial onuppaalrdquo in Formal Methods for the Design of Real-Time Systemsvol 3185 of Lecture Notes in Computer Science pp 200ndash236Springer Berlin Germany 2004

[24] P Levis and D Gay TinyOS Programming Cambridge Univer-sity Press Cambridge UK 2009

International Journal of

AerospaceEngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014


Active and Passive Electronic Components

Control Scienceand Engineering

Journal of



RotatingMachinery


Hindawi Publishing Corporation httpwwwhindawicom

Journal ofEngineeringVolume 2014

Submit your manuscripts athttpwwwhindawicom

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics


Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

SensorsJournal of


Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation



DistributedSensor Networks



Input the network (0 1 119899 minus 1) QoS metrics (1198980 1198981 119898

119896minus1)

Design QoSRP the prototype of the QoSminus based routing protocol with the metric1198980

119894 larr 0while (119894 lt 119896) do

Model QoSRP using Timed AutomataVerify QoSRP via Model Checking and Output the verification resultsEvaluate the verification results and improve QoSRP119894 larr 119894 + 1

if (119894 lt 119896)Redesign QoSRP with the metrics119898

0 119898

119894

endifendwhileOutput QoSRP

Pseudocode 1 Model-checking driven design process

the effectiveness of the protocol through simulation Ben-Othman and Yahya [13] proposed a QoS aware multipathrouting protocol based on the concept of service differenti-ation to control the delay and then used the NS-2 simulationsto evaluate the performance of the protocol for WSNs Sunet al [14] presented a game-theoretic approach to coordinatethe QoS routing for WSNs and used NS-2 to verify itsperformance with simulations Cheng et al [15] used thegeographic opportunistic routing for QoS provisioning inWSNs and evaluated the protocol through NS-2 simulationsand tests on the hardware nodes Hu et al [16] proposeda multihop heterogeneous cluster-based optimization algo-rithm (MHCOA) for WSNs and also used NS-2 simulationto show the better performance ofMHCOA in heterogeneousWSNs

Akbas and Turgut [17] presented a routing protocol withQoS support for wireless sensor and actor networks andcarried out a series of simulations in OPNET modeler toanalyze the performance of the protocol Hammoudeh andNewman [18] presented an adaptive routing protocol withQoS metrics to meet application requirements of WSNs andused the Dingo WSN simulator to evaluate the performanceof the protocol Tschirner et al [19] presented the automata-based models for biomedical sensor networks (BSN) andsuccessfully used the driven model-checking technique tocomplement the simulation techniques to validate QoS prop-erties of BSN

In the above-mentioned related work the simulation-based method is the main design verification technique forthe QoS-based routing protocols of WSNs [20] but it ispossible that some errors whichmay only occur under specialconditions cannot be found in the simulations thus the QoSmetrics may not meet the routing requirements of WSNs inthe mission-critical applications

3 Model-Checking Driven Design Framework

To ensure that the QoS-based routing protocol can saveenergy reduce the transmission delay increase the probabil-ity of successful transmission to the sink node and providehigh QoS for WSNs we propose the model-checking driven

design framework consisting of the design process the timedautomata model and the verification properties

31 Design Process In the model-checking driven designframework for the QoS-based routing protocols of WSNsthe model-checking driven design process shown inPseudocode 1 uses the iterative and incremental develop-ment A QoS-based routing protocol of WSNs is designedthrough repeated cycles and in smaller parts at one timeand iteratively enhanced through model checking until thefull protocol is implemented At each iteration the designimprovement is made and one new QoS metric is added

In the model-checking driven design process weassume there are 119899 nodes in WSNs and 119898 QoS metrics(1198980 1198981 119898119896minus1) from the application requirements ofWSNs and firstly design one prototype of the QoS-basedrouting protocol using the QoS metric of 1198980 namelyQoSRP which we can react with and is simple enough to beunderstood and implemented easily then QoSRP is modeledusing timed automata [21 22] verified via model checkingand improved as a result of evaluating the verification resultsAfter taking the first iteration of the design improvementwe add one new QoS metric as the new feature to redesignQoSRP and continue to perform the process

32 Timed Automata Model In the model-checking drivendesign framework we define the timed automata modelincluding the timed automaton of the sink node and thetimed automaton of the sensor nodes according to thebehavior of nodes in WSNs

The timed automaton of the sink node is formallydescribed as

(Initial [119910 lt = INITIAL DELAY] [ ])

119910==INITIAL DELAY997888997888997888997888997888997888997888997888997888997888997888997888997888997888rarr (Received [119909 lt = 119877] [broad])

(1)

(Received [119909 lt = 119877] [ ])

997888rarr (Initial [119910 lt = INITIAL DELAY] [stop]) (2)





(3)

(119879119909 [119909 lt = TRANSMIT] [stop])




(5)



(Received [119909 lt = 119877] [ ])







119860 ltgt received [119894] gt 0 (9)





119860 [ ] time [119894] lt= 119872 (11)




119889 [119894] =

119908 (119894 0) 119894 = 0

0 119894 = 0(12)


119889 [119894] = min 119889 [119894] 119889 [119896] +119908 (119896 119895) 119896 isin 119881 (13)


119889 [119896] = min 119889119894 [119894] isin 119878 (14)


broad

broad

start[i]

stop[tmp]

received[tmp]++

i node_id

Received

C

Initial

x lt= R

ack[0][tmp] = 1

tmp=i

y lt= INITIAL_DELAY

y == INITIAL_DELAY

ack[0][tmp] == 0



copy


start[id]broad

stop[id]

stop[id]

Listen

Sense

Broadcasting

ReceivedC

Tx

Broadcast

x lt= R


x lt= TRANSMIT

temp=i

temp=id

ReTransmit=4

ReTransmit=4



period[id]++



WaitTime = 0



broad

time gt= backoff

M lt MAX_M




ReTransmit == 0


received[tmp]++




















6 Conclusions






119894)



119908(119894 119895) =


119894





endforEND









Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation













(3)

(119879119909 [119909 lt = TRANSMIT] [stop])




(5)



(Received [119909 lt = 119877] [ ])







119860 ltgt received [119894] gt 0 (9)





119860 [ ] time [119894] lt= 119872 (11)




119889 [119894] =

119908 (119894 0) 119894 = 0

0 119894 = 0(12)


119889 [119894] = min 119889 [119894] 119889 [119896] +119908 (119896 119895) 119896 isin 119881 (13)


119889 [119896] = min 119889119894 [119894] isin 119878 (14)


broad

broad

start[i]

stop[tmp]

received[tmp]++

i node_id

Received

C

Initial

x lt= R

ack[0][tmp] = 1

tmp=i

y lt= INITIAL_DELAY

y == INITIAL_DELAY

ack[0][tmp] == 0



copy


start[id]broad

stop[id]

stop[id]

Listen

Sense

Broadcasting

ReceivedC

Tx

Broadcast

x lt= R


x lt= TRANSMIT

temp=i

temp=id

ReTransmit=4

ReTransmit=4



period[id]++



WaitTime = 0



broad

time gt= backoff

M lt MAX_M




ReTransmit == 0


received[tmp]++




















6 Conclusions






119894)



119908(119894 119895) =


119894





endforEND









Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










broad

broad

start[i]

stop[tmp]

received[tmp]++

i node_id

Received

C

Initial

x lt= R

ack[0][tmp] = 1

tmp=i

y lt= INITIAL_DELAY

y == INITIAL_DELAY

ack[0][tmp] == 0



copy


start[id]broad

stop[id]

stop[id]

Listen

Sense

Broadcasting

ReceivedC

Tx

Broadcast

x lt= R


x lt= TRANSMIT

temp=i

temp=id

ReTransmit=4

ReTransmit=4



period[id]++



WaitTime = 0



broad

time gt= backoff

M lt MAX_M




ReTransmit == 0


received[tmp]++




















6 Conclusions






119894)



119908(119894 119895) =


119894





endforEND









Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation




















6 Conclusions






119894)



119908(119894 119895) =


119894





endforEND









Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation













119894)



119908(119894 119895) =


119894





endforEND









Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation










Acknowledgments


References



























RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation











RoboticsJournal of





Journal of



RotatingMachinery





VLSI Design



Shock and Vibration







Journal of



Volume 2014


SensorsJournal of





Propagation









research article model-checking driven design of qos-based...

Documents