| 
  
   
    |  |  |  
    |  | Olga Shumsky |  
    |  | Lawrence Henschen |  
    |  |  |  
    |  | Northwestern University |  
    |  | [shumsky,henschen]@ece.nwu.edu |  | 
 
  | 
  
   
    |  |  |  
    |  | Formal verification is widely used in hardware
    verification |  
    |  | Errors found late in the production cycle are
    more expensive to correct in hardware than in software |  
    |  | In safety-critical software systems correctness
    requirements warrant formal verification |  
    |  | Emphasis on design processes that already employ
    formal methods |  | 
 
  | 
  
   
    |  |  |  
    |  | A formal description technique standardized in
    1988 by International Telecommunication Union |  
    |  | Intended for description of communication
    protocols |  
    |  | Used on a variety of distributed, concurrent,
    communicating, asynchronous systems |  
    |  | Many support tools exists, but no framework for
    theorem-proving based verification |  
    |  | Main building blocks are processes represented
    by extended finite-state machines and delaying and instantaneous
    communication links |  | 
 
  | 
  
   
    |  |  |  
    |  | A sender and a receiver communicate |  
    |  | Buffer size is 1: each message must be
    acknowledged before next is sent |  
    |  | If acknowledgement does not arrive in a
    reasonable time, message is resent |  
    |  | The communication network may lose but not
    corrupt messages |  | 
 
  |  | 
 
  |  | 
 
  | 
  
   
    |  |  |  
    |  | We are building a verified simulator for SDL
    specifications – one-time effort |  
    |  | Design engineers can use the simulator  to verify SDL specifications – multiple
    verification efforts on multiple designs |  
    |  | ACL2 used in both cases |  | 
 
  |  | 
 
  | 
  
   
    |  |  |  
    |  | Superficial, stores entities as lists |  
    |  | Receiver process translated: |  
    |  | (receiver (1 . 1) |  
    |  | (ackid frameid) |  
    |  | (start (() (task ackid -1) |  
    |  | (label 1) |  
    |  | (output ack (ackid) () ()) |  
    |  | (nextstate waiting))) |  
    |  | (waiting ((frameid (frameid)) |  
    |  | (decision ((= frameid (+ ackid 1)) |  
    |  | (task ackid (+ ackid 1)) |  
    |  | (join 1)) |  
    |  | ((<> frameid (+ ack 1)) |  
    |  | (join 1)))))) |  | 
 
  | 
  
   
    |  |  |  
    |  | Paths consisting of several links are collapsed
    into multi-component single entities |  
    |  | Instantaneous paths: |  
    |  | (source destination route-name) |  
    |  | Delaying paths: |  
    |  | (source destination (member routes) queue) |  
    |  | Network from example: |  
    |  | (sender receiver (out1 link in2) nil) |  
    |  | (receiver sender (out2 link in1) nil) |  | 
 
  | 
  
   
    |  |  |  
    |  | Defined an inverse function untranslate, and
    prove that no information is lost w.r.t. to a specialized equivalence
    relation |  
    |  | (equal* (untranslate (translate S)) S) |  
    |  | Trivial for process translation |  
    |  | Tricky for network translation |  | 
 
  | 
  
   
    |  |  |  
    |  | SDL differentiates between process definition
    and process instance |  
    |  | Defined process activation mechanism |  
    |  | Receiver process instance |  
    |  | (1 receiverprocess start |  
    |  | ((ackid . nil) (frameid . nil) (self . 1) |  
    |  | (sender . nil) (parent
    . 0) (offspring . nil) |  
    |  | ((start …)) nil) |  
    |  | Correctness property: defined a recognizer for
    valid instances of a system |  
    |  | (defthm activate-makes-instance |  
    |  | (implies (wf-type S) |  
    |  | (wf-instance (activate S) S))) |  | 
 
  | 
  
   
    |  |  |  
    |  | Receiver Process Simulation |  | 
 
  | 
  
   
    |  |  |  |  
    |  | An oracle indicates to the top-level simulator
    function the id of the next instance to simulate |  
    |  | How fine-grained should a simulation be? |  
    |  | Transitions are considered atomic: the
    simulation might miss some possible real-life process interleaving
    scenarios |  
    |  | Actions are considered atomic: some actions,
    such as procedure calls, are more time consuming than simple actions, such
    as goto and nextstate |  
    |  | We are implementing mechanisms to handle both
    cases, so that appropriate process interleaving can be selected for each
    application |  | 
 
  | 
  
   
    |  |  |  
    |  | A signal traveling through an instantaneous path
    is immediately delivered to the destination |  
    |  | An oracle is supplied to delaying paths to
    determine whether the path forwards the signal |  
    |  | If there is an inconsistency in the address of
    the signal, a warning is generated, and the signal is discarded |  | 
 
  | 
  
   
    |  |  |  
    |  | Once the simulator is proved correct, we can
    prove properties of specifications w.r.t. the simulator |  
    |  | Our protocol is correct if sender and receiver
    agree on the id of the last successfully transmitted frame |  
    |  | (defthm sender-receiver-agree-1 |  
    |  | (<=
    (variable-value 'ackid |  
    |  | (instance 'receiver (simulate S O))) |  
    |  | (variable-value 'frameid |  
    |  | (instance 'sender (simulate S O))))) |  
    |  | (defthm sender-receiver-agree-2 |  
    |  | (let ((v1 (variable-value |  
    |  | 'ackid (instance 'receiver (simulate
    S O)))) |  
    |  | (v2 (variable-value |  
    |  | 'frameid (instance 'sender
    (simulate S O))))) |  
    |  | (implies (< v1 v2) (= (+ 1 v1) v2)))) |  
    |  | Defined access functions to extract variables
    and instances |  | 
 
  | 
  
   
    |  |  |  
    |  | Simulator can be used for testing: implemented
    units are substituted in place of simulations |  | 
 
  | 
  
   
    |  |  |  |  
    |  | Other approaches to verification of SDL
    specifications are based on model checkers.  A couple of examples |  
    |  | IF system from Verimag converts SDL to PROMELA
    and uses SPIN model checker |  
    |  | A proprietary verification system at Siemens
    relies on a BDD-based symbolic checker |  | 
 
  | 
  
   
    |  |  |  
    |  | We are developing a simulator for SDL
    specifications |  
    |  | We are using ACL2 for the development and
    verification of the simulator |  
    |  | The goal is to provide a framework for
    verification of SDL specifications using a theorem prover |  
    |  | The simulator also helps in testing of
    implementations: acts as a test driver and helps compute expected results
    for test cases |  |