Developing a Framework
for Simulation, Verification and Testing of SDL Specifications
 
  |  |  | 
 
  |  | Olga Shumsky | 
 
  |  | Lawrence Henschen | 
 
  |  |  | 
 
  |  | Northwestern University | 
 
  |  | [shumsky,henschen]@ece.nwu.edu | 
Introduction
 
  |  |  | 
 
  |  | Formal verification is widely used in
  hardware verification | 
 
  |  | Errors found late in the production
  cycle are more expensive to correct in hardware than in software | 
 
  |  | In safety-critical software systems
  correctness requirements warrant formal verification | 
 
  |  | Emphasis on design processes that
  already employ formal methods | 
Specification and
Description Language SDL
 
  |  |  | 
 
  |  | A formal description technique
  standardized in 1988 by International Telecommunication Union | 
 
  |  | Intended for description of
  communication protocols | 
 
  |  | Used on a variety of distributed,
  concurrent, communicating, asynchronous systems | 
 
  |  | Many support tools exists, but no
  framework for theorem-proving based verification | 
 
  |  | Main building blocks are processes
  represented by extended finite-state machines and delaying and instantaneous
  communication links | 
Example of Modeling with
SDL: 
a simple communication protocol
 
  |  |  | 
 
  |  | A sender and a receiver communicate | 
 
  |  | Buffer size is 1: each message must be
  acknowledged before next is sent | 
 
  |  | If acknowledgement does not arrive in a
  reasonable time, message is resent | 
 
  |  | The communication network may lose but
  not corrupt messages | 
Protocol Modeling in SDL:
Part 1
Protocol Modeling in SDL:
Part 2
Simulator vs.
Specification Verification
 
  |  |  | 
 
  |  | We are building a verified simulator
  for SDL specifications – one-time effort | 
 
  |  | Design engineers can use the
  simulator  to verify SDL
  specifications – multiple verification efforts on multiple designs | 
 
  |  | ACL2 used in both cases | 
SDL Specifications
Simulator Architecture
Process Translation
 
  |  |  | 
 
  |  | Superficial, stores entities as lists | 
 
  |  | Receiver process translated: | 
 
  |  | (receiver (1 . 1) | 
 
  |  | (ackid frameid) | 
 
  |  | (start (() (task ackid -1) | 
 
  |  | (label 1) | 
 
  |  | (output ack (ackid) () ()) | 
 
  |  | (nextstate waiting))) | 
 
  |  | (waiting ((frameid (frameid)) | 
 
  |  | (decision ((= frameid (+ ackid 1)) | 
 
  |  | (task ackid (+ ackid 1)) | 
 
  |  | (join 1)) | 
 
  |  | ((<> frameid (+ ack 1)) | 
 
  |  | (join 1)))))) | 
Communication Network
Translation
 
  |  |  | 
 
  |  | Paths consisting of several links are
  collapsed into multi-component single entities | 
 
  |  | Instantaneous paths: | 
 
  |  | (source destination route-name) | 
 
  |  | Delaying paths: | 
 
  |  | (source destination (member routes)
  queue) | 
 
  |  | Network from example: | 
 
  |  | (sender receiver (out1 link in2) nil) | 
 
  |  | (receiver sender (out2 link in1) nil) | 
Translator Correctness
 
  |  |  | 
 
  |  | Defined an inverse function
  untranslate, and prove that no information is lost w.r.t. to a specialized
  equivalence relation | 
 
  |  | (equal* (untranslate (translate S)) S) | 
 
  |  | Trivial for process translation | 
 
  |  | Tricky for network translation | 
Activator
 
  |  |  | 
 
  |  | SDL differentiates between process
  definition and process instance | 
 
  |  | Defined process activation mechanism | 
 
  |  | Receiver process instance | 
 
  |  | (1 receiverprocess start | 
 
  |  | ((ackid . nil) (frameid . nil) (self . 1) | 
 
  |  | (sender . nil) (parent .
  0) (offspring . nil) | 
 
  |  | ((start …)) nil) | 
 
  |  | Correctness property: defined a
  recognizer for valid instances of a system | 
 
  |  | (defthm activate-makes-instance | 
 
  |  | (implies (wf-type S) | 
 
  |  | (wf-instance (activate S) S))) | 
Process Simulator
 
  |  |  | 
 
  |  | Receiver Process Simulation | 
Concurrency Simulation
 
  |  |  |  | 
 
  |  | An oracle indicates to the top-level
  simulator function the id of the next instance to simulate | 
 
  |  | How fine-grained should a simulation
  be? | 
 
  |  | Transitions are considered atomic: the
  simulation might miss some possible real-life process interleaving scenarios | 
 
  |  | Actions are considered atomic: some
  actions, such as procedure calls, are more time consuming than simple
  actions, such as goto and nextstate | 
 
  |  | We are implementing mechanisms to
  handle both cases, so that appropriate process interleaving can be selected
  for each application | 
Network Handling
 
  |  |  | 
 
  |  | A signal traveling through an
  instantaneous path is immediately delivered to the destination | 
 
  |  | An oracle is supplied to delaying paths
  to determine whether the path forwards the signal | 
 
  |  | If there is an inconsistency in the
  address of the signal, a warning is generated, and the signal is discarded | 
SDL Specifications
Verification
 
  |  |  | 
 
  |  | Once the simulator is proved correct,
  we can prove properties of specifications w.r.t. the simulator | 
 
  |  | Our protocol is correct if sender and
  receiver agree on the id of the last successfully transmitted frame | 
 
  |  | (defthm sender-receiver-agree-1 | 
 
  |  | (<= (variable-value 'ackid | 
 
  |  | (instance 'receiver (simulate S O))) | 
 
  |  | (variable-value 'frameid | 
 
  |  | (instance 'sender (simulate S O))))) | 
 
  |  | (defthm sender-receiver-agree-2 | 
 
  |  | (let ((v1 (variable-value | 
 
  |  | 'ackid (instance 'receiver
  (simulate S O)))) | 
 
  |  | (v2 (variable-value | 
 
  |  | 'frameid (instance 'sender
  (simulate S O))))) | 
 
  |  | (implies (< v1 v2) (= (+ 1 v1) v2)))) | 
 
  |  | Defined access functions to extract
  variables and instances | 
Testing of
implementations
 
  |  |  | 
 
  |  | Simulator can be used for testing: implemented
  units are substituted in place of simulations | 
Related Work
 
  |  |  |  | 
 
  |  | Other approaches to verification of SDL
  specifications are based on model checkers. 
  A couple of examples | 
 
  |  | IF system from Verimag converts SDL to
  PROMELA and uses SPIN model checker | 
 
  |  | A proprietary verification system at
  Siemens relies on a BDD-based symbolic checker | 
Summary
 
  |  |  | 
 
  |  | We are developing a simulator for SDL
  specifications | 
 
  |  | We are using ACL2 for the development
  and verification of the simulator | 
 
  |  | The goal is to provide a framework for
  verification of SDL specifications using a theorem prover | 
 
  |  | The simulator also helps in testing of
  implementations: acts as a test driver and helps compute expected results for
  test cases |