This paper presents the overal structure, the design criteria, and the main features of the tool box Uppaal. It gives a detailed user guide which describes how to use the various tools of Uppaal version 2.02 to construct abstract models of a real-time system, to simulate its dynamical behavior, to specify and verify its safety and bounded liveness properties in terms of its model. In addition, the paper also provides a short review on case-studies where Uppaal is applied, as well as references to its theoretical foundation.

UPPAAL in a Nutshell

https://www.cis.upenn.edu/~alur/TCS95.pdf

The algorithmic analysis of hybrid systems

Part 1 Basic: introduction protocol structure error control flow control. Part 2 Specification and modeling: validation models correctness requirements protocol design finite state machines. Part 3 Conformance testing synthesis and validation: conformance testing protocol synthesis protocol validation. Part 4 Design tools: a protocol simulator a protocol validator using the validator.

/pdf/design-and-validation-of-computer-protocols-39ngbrhx80.pdf

Design and validation of computer protocols

With advanced computer technology, systems are getting larger to fulfill more complicated tasks: however, they are also becoming less reliable. Consequently, testing is an indispensable part of system design and implementation; yet it has proved to be a formidable task for complex systems. This motivates the study of testing finite stare machines to ensure the correct functioning of systems and to discover aspects of their behavior. A finite state machine contains a finite number of states and produces outputs on state transitions after receiving inputs. Finite state machines are widely used to model systems in diverse areas, including sequential circuits, certain types of programs, and, more recently, communication protocols. In a testing problem we have a machine about which we lack some information; we would like to deduce this information by providing a sequence of inputs to the machine and observing the outputs produced. Because of its practical importance and theoretical interest, the problem of testing finite state machines has been studied in different areas and at various times. The earliest published literature on this topic dates back to the 1950's. Activities in the 1960's mid early 1970's were motivated mainly by automata theory and sequential circuit testing. The area seemed to have mostly died down until a few years ago when the testing problem was resurrected and is now being studied anew due to its applications to conformance testing of communication protocols. While some old problems which had been open for decades were resolved recently, new concepts and more intriguing problems from new applications emerge. We review the fundamental problems in testing finite state machines and techniques for solving these problems, tracing progress in the area from its inception to the present and the stare of the art. In addition, we discuss extensions of finite state machines and some other topics related to testing.

Principles and methods of testing finite state machines-a survey

We introduce the framework of hybrid automata as a model and specification language for hybrid systems. Hybrid automata can be viewed as a generalization of timed automata, in which the behavior of variables is governed in each state by a set of differential equations. We show that many of the examples considered in the workshop can be defined by hybrid automata. While the reachability problem is undecidable even for very restricted classes of hybrid automata, we present two semidecision procedures for verifying safety properties of piecewiselinear hybrid automata, in which all variables change at constant rates. The two procedures are based, respectively, on minimizing and computing fixpoints on generally infinite state spaces. We show that if the procedures terminate, then they give correct answers. We then demonstrate that for many of the typical workshop examples, the procedures do terminate and thus provide an automatic way for verifying their properties.

/pdf/hybrid-automata-an-algorithmic-approach-to-the-specification-90c14uxt2h.pdf

Hybrid Automata: An Algorithmic Approach to the Specification and Verification of Hybrid Systems

We present probabilistic algorithms for testing IP routing protocols. Different than commercial testing tools, which select their test cases in an ad-hoc manner, our technique chooses test cases with a guaranteed fault coverage. Our algorithms are applied to testing RIP, OSPF, and BGP routing protocols. We test the routing table correctness, database information consistency with network topology and packet forwarding behaviors. We provide an analysis of test execution time and fault coverage. The algorithms are part of a software tool SOCRATES, developed at Bell laboratories. SOCRATES also creates a testing environment so that the generated test cases can be executed in real time on high speed routers.

/pdf/testing-ip-routing-protocols-from-probabilistic-algorithms-41vqd5iadc.pdf

Testing IP Routing Protocols - From Probabilistic Algorithms to a Software Tool

We describe a method for the automatic generation of test sequences that has been implemented as part of the Virtual Finite State Machine (VFSM) toolset. VFSM has been used extensively in software development for the Lucent Technologies 5ESS® switching system. The method produces a set of sequences of messages which, when provided as input to a VFSM, result in nearly complete code coverage. The method relies on information collected by the VFSM validation tool, which uses Holzmann’s supertrace algorithm to explore execution scenarios of a network of VFSMs and search for errors such as deadlock and unexpected inputs. We have applied our method for the generation of test sequences to a VFSM implementation of the ETSI Intelligent Network Application Protocol (INAP). Because of the large size of INAP, we were unable to validate it completely due to state explosion arising from the exhaustive search that the VFSM validator performs. We therefore devised a novel partial validation technique that attempts to generate a subset of the state space of a network of VFSMs and derives test sequences that maximize the code coverage and minimize the number of tests. In this paper, we present an overview of our test-sequence-generation method and its application to the VFSM implementation of NAP.

Validation-based test sequence generation for networks of extended finite state machines

Efficient gateway synthesis from formal specifications

We study both the correctness and performance of the source/destination protocol of the available bit rate (ABR) service in asynchronous transfer mode (ATM) networks. Although the basic source/destination protocol for congestion management is relatively simple, the protocol specification has to cope with several "real-world" cases such as failures and delayed/lost feedback which may introduce complexity. Rigorous proofs of the correct functioning of the protocol based on a formal specification is necessary. We use a formal extended finite state machine (EFSM) model to show that the ABR source/destination protocol is free of live-locks, so that under all conditions both resource management (RM) and data cells will be transmitted. We also show that the network options of explicit forward congestion indication (EFCI) and explicit rate (ER) interoperate correctly. We use the understanding of the informal English description of the source/destination behavior and of our EFSM model to derive conditions that ensure that the source transmission rate is stable in the presence of delayed or lost feedback RM cells, especially under the operation of a source rule that requires the reduction of the source rate under these conditions. We arrive at bounds on the number of consecutive RM cell losses tolerated while the rate remains stable. We also provide a worst-case analysis of the delay in turning around RM cells at the destination station and the worst-case inter-departure time of forward RM cells from the source.

Performance and correctness of the ATM ABR rate control scheme

A systematic procedure that takes exponential time to synthesize protocol converters from formal specifications is presented. The algorithm proceeds in two steps: compute the largest common subset of services provided by the two mismatched protocols, and reduce the converter, retaining common services, without traversing the entire machine that represents the composition of the two mismatched protocols. In a number of cases, the converter can be constructed by a memoryless translation of messages from one protocol to another. Conditions under which such stateless conversion is possible are given. Two examples are presented to illustrate the techniques. In the first example, a converter that interconnects a half-duplex protocol with a full-duplex protocol from their formal specifications is computed. In the second example, the polynomial procedure is applied to computation of a converter for interconnecting the SNR and TCP protocols. >

David Lee

Papers

Testing IP Routing Protocols - From Probabilistic Algorithms to a Software Tool

Validation-based test sequence generation for networks of extended finite state machines

Efficient gateway synthesis from formal specifications

Performance and correctness of the ATM ABR rate control scheme

A polynomial algorithm for gateway generation from formal specifications