1 INTAS Meeting, Moscow Tools for Verification of Specification Given by Basic Protocols Oleksandr Letychevskyi, Ph.D. Glushkov Institute of Cybernetics of Ukrainan Academy of Sciences Telephone: +38(044)

2 INTAS Meeting, Moscow 28-Aug-07 VRS Tools Algebraic Programming System Verification of Requirements System (academic version) Verification of Requirements System (business version) Client Client (academic version)

3 INTAS Meeting, Moscow 28-Aug-07 Basic Protocols – Input of Verification System I1I2 S R Process Precondition Postcondition Basic protocol in MSC form  x S(x)->A(x). R(x) Action A will be performed if S is true and then condition R will be true after A

4 INTAS Meeting, Moscow 28-Aug-07 Example of industrial formalization

5 INTAS Meeting, Moscow 28-Aug-07 Wimax ( protocol) specifications are very close to basic protocols and could be converted easily Basic protocol format Transition system specifications Environment description Formalization of Wimax requirements

6 INTAS Meeting, Moscow 28-Aug-07 Some basic protocols for protocol

7 INTAS Meeting, Moscow 28-Aug-07 Basic Protocols Technology Concrete Trace Generator Symbolic Trace Generator Static Requirements Checker Formalized requirements Verdict, set of traces

8 INTAS Meeting, Moscow 28-Aug-07 Concrete Simulation  Concrete Trace Generator (CTG) simulates system behavior which is restricted by set of basic protocols and filters.  Simulation is performed by checking of PRE conditions and applying POST conditions.  During simulation CTG detects deadlocks, non-determinisms, safety violations, unreachable requirements, usage of uninitialized attributes and admitted region attribute overflow.  CTG generates counterexamples for detected inconsistencies and set of traces correspondingly to filter settings.

9 INTAS Meeting, Moscow 28-Aug-07 Symbolic Generation  Symbolic Trace Generator (STG) simulates set of basic protocol by applying of possible protocols that present behavior of system without computing of concrete environment state.  Simulation is performed by proving of existing of solution of formula in PRE-condition. If solution does not exist – the corresponded counterexample with symbolic values will be presented.  During simulation STG shall detect deadlocks, safety violations, and non-determinisms without initial values of attributes.  STG shall generate counterexamples by means of backward generation for inconsistencies that were detected by static requirements checking. These inconsistencies may be not reached by concrete trace generation.

10 INTAS Meeting, Moscow 28-Aug-07 Common Scheme of Symbolic Modeling Environment Description Set of Basic Protocol Initial State of Environment Safety Condition Checking of Basic Protocol ApplicabilityProving Machine If applicable: Change State of Environment Selection of Basic Protocol If not applicable Checking of Properties (safety, reachability) Trace Creating New Trace Set of Traces Verdict

11 INTAS Meeting, Moscow 28-Aug-07 Backward Trace Generation Initial state Inconsistency or safety violation Initial state Inconsistency or safety violation Inconsistency or incompleteness could be unreachable by means of direct trace generation If we’ll use backward trace generation we could reach initial state by means of deductive tools

12 INTAS Meeting, Moscow 28-Aug-07 Static Requirements Checking  Static Requirements Checker proves the following properties: >Consistency; >Completeness; >User-defined safety conditions;

13 INTAS Meeting, Moscow 28-Aug-07 Piloting and verification by VRS (CDMA) AttributeValueComment Pages971Total number of pages in the source documentation Requirements6000Total number of all requirements in the source documentation Behavioral Requirements 1800The number of behavioral requirements in the source documentation Requirement Coverage 80%Percentage of the behavioral requirements which were formalized and then verified Formalization is still not completed due to a huge amount of findings detected Basic Protocols558Total number of basic protocols developed from the covered behavioral requirements Considered Trace Space 7*10 9 Total number of traces originated from the developed basic protocols and considered during the verification process Findings870:Low; 42:Medium; 45:High Document errors11612:Low; 104:Medium; 0:High Piloting Statistics

14 INTAS Meeting, Moscow 28-Aug-07 Piloting and verification by VRS (CDMA) Efforts Spent and Defects Found Defects Found Accepted170 Rejected29 Still uncertain4 Total:203 Effort in Staff-weeks Spent for Studying documentation1.8 Developing basic protocols8.35 Trace generation1.0 Trace analysis0.05 Creating Verification Report0.2 Total: hours per defect; 3.2 hours per accepted defect 22% of defects are of HIGH severity!