[Paper Review] Modelling and Analysis of AODV in UPPAAL

Ansgar Fehnker, Rob van Glabbeek+4 more|arXiv (Cornell University)|Dec 23, 2015

Formal Methods in Verification5 references4 citations

TL;DR

This paper presents a formal model of the AODV routing protocol in UPPAAL, enabling automated verification of correctness properties such as loop freedom. By translating a process algebraic specification (AWN) into an executable UPPAAL model, the authors identify and diagnose problematic behaviors—like routing loops—through counterexamples, demonstrating the method's effectiveness in detecting protocol flaws with minimal computational overhead.

ABSTRACT

This paper describes work in progress towards an automated formal and rigorous analysis of the Ad hoc On-Demand Distance Vector (AODV) routing protocol, a popular protocol used in ad hoc wireless networks. We give a brief overview of a model of AODV implemented in the UPPAAL model checker, and describe experiments carried out to explore AODV's behaviour in two network topologies. We were able to locate automatically and confirm some known problematic and undesirable behaviours. We believe this use of model checking as a diagnostic tool complements other formal methods based protocol modelling and verification techniques, such as process algebras. Model checking is in particular useful for the discovery of protocol limitations and in the development of improved variations.

Motivation & Objective

• To develop a formal, executable model of the AODV routing protocol using UPPAAL for rigorous analysis.
• To detect and diagnose known and previously unknown protocol flaws, such as routing loops, through automated model checking.
• To complement process algebraic formalization (AWN) with executable verification to enhance confidence in protocol behavior.
• To support systematic evaluation of protocol improvements by enabling fast, scalable testing across diverse network topologies.

Proposed method

• Formalizing AODV in the process algebra AWN to capture its core semantics and resolve ambiguities in the IETF RFC.
• Translating the AWN model into an executable UPPAAL model for simulation and formal verification.
• Using UPPAAL's model checker to verify key correctness properties, including loop freedom, under various network topologies.
• Generating counterexamples when properties fail to provide diagnostic insights into failure conditions.
• Validating the UPPAAL model against known protocol behaviors and comparing results with prior formal analyses.
• Employing a systematic approach to explore network scenarios, including dynamic and complex topologies, to uncover edge-case behaviors.

Experimental results

Research questions

• RQ1 Can an executable formal model of AODV in UPPAAL detect known problematic behaviors such as routing loops?
• RQ2 How effective is model checking in identifying protocol flaws that are not easily exposed through simulation or testing?
• RQ3 What is the scalability and performance of the UPPAAL model in verifying AODV across different network topologies?
• RQ4 How does the integration of AWN and UPPAAL enhance the reliability and diagnostic power of formal protocol analysis?
• RQ5 Can the model be used to systematically evaluate proposed improvements to AODV in problematic network scenarios?

Key findings

• The UPPAAL model successfully detected routing loop behaviors in AODV, confirming known issues through automated counterexample generation.
• A counterexample for a loop was found in under 0.1 seconds on a standard PC, demonstrating the efficiency of the approach.
• The model revealed that route discovery could fail to establish optimal paths in certain topologies, such as a 3-node loop with two RREQs.
• The model confirmed that the protocol's behavior is sensitive to message timing and topology structure, even in untimed models.
• The approach enabled the identification of a potential fix—using the first RREQ received to establish reverse routes—which may reduce suboptimal routing.
• The largest model tested (5 nodes, two messages) had 19,833 reachable states, showing the method is scalable for realistic network sizes.