Formal verification of a TDMA protocol start-up mechanism

This paper presents a formal verification of the start-up algorithm of the DACAPO protocol. The protocol uses TDMA (Time Division Multiple Access) bus arbitration. It was verified that an ensemble of four communicating stations becomes synchronized and operational within a bounded time from an arbitrary initial state. The system model included a clock drift corresponding to /spl plusmn/10/sup -3/. The protocol was modeled using a network of timed automata, and verification was performed using the symbolic model checker UPPAAL.