A status protocol for system-operation in a fault-tolerant system — Verification and testing with SPIN

This paper presents a status protocol for a fault-tolerant distributed real-time system. The protocol aims to give all nodes a consistent view of the status of processing operations during one communication cycle; despite the occurrence of asymmetric omission failures. The system consists of nodes interconnected with a time-triggered network. A part of the protocol is performed only on-demand i.e. when failure is detected and can thus make use of event-triggered messages in e.g. FlexRay. The protocol is studied in several configurations of nodes and processes. Model checking with SPIN shows that it is not possible to guarantee a consistent decision when more than one failure occurs. SPIN is then used to enumerate the success-ratio (at least 90%) of the protocol in failure scenarios for a number of configurations of the protocol.