1. Automating Checking of Models Built Using a Graphically Based Formal Language Robert John Walters

2. RDT A Graphically based formal modelling language Models represented as diagrams (not text) Communications inspired by π-calculus Drawn in two parts: Behaviour of components (processes) How they are connected together

3. RDT Processes Inspired by RADs Have named state Three types of event: Send Receive Create They describe a type of behaviour

4. RDT Models Process instances labelled with a name and their type Channels known to an instance are shown and labelled Connections between channels shown by lines Concerned with instances

5. Why SPIN? Highly regarded and widely available Input language looks like “C” Direct input of property to be checked Natural correspondence between channels in Promela and RDT

6. Translation Several parts to the operation RDT processes converted to Promela processes RDT model conversion - the “init” process Channel allocations Special consideration of features of RDT

7. Translation: Processes (1) Could have used a single “do” loop with process state stored in a variable State would have to be since there is no string type in Promela Establishing the extent to which a process is exercised is not straightforward

8. Translation: Processes (2) Each RDT process is converted to a process in Promela Label in Promela for each state of the RDT process “if” statement with each label with two statements which Perform the communication Move process to the next state

9. Translation: Processes (3) proctype Sink(chan In, val) { initial: if :: In?Val; goto initial; fi; } proctype Source(chan Out) { initial: if :: Out?Out; goto initial; fi; }

10. Translation: Models (1) Performed in the “init” process Required instances of processes are created (run) Actions enclosed in “atomic” statement Connections implemented by appropriate allocation of channels as parameters to process instances

11. Translation: Models (2) chan ch0 = [CHLEN] of {chan}; chan nch0 = [0] of {chan}; /* Process definitions here */ init { Atomic { run Source(ch0); run Sink(ch0, nch0); } };

12. Translation: Models (3) Promela permits the creation of channels which carry channels Length of channels is determined by user at translation time Each process is given a channel as a parameter for each channel name it knows

13. Issues – the Create type event Permits a process to bring a new channel (value) into existance Translation scheme outlined so far requires all channels to be declared before start of execution Solution adopted is a provide processes with a collection of channels to use

14. Issues – Special case of Read if :: X?X; goto second; fi; chan tmp; … if :: atomic{X?tmp; X = tmp; } goto second; fi;

15. Conclusion & further work I have a tool which performs this translation automatically More complete solution to the problem of the Create type event