1. Scenario Synthesis from Imprecise Requirements Bill Mitchell, Robert Thomson, Paul Bristow

2. Enterprise Development Process Feature High Level Designs Detailed Designs Technical Marketing Requirements Functional Requirements System Architecture Requirements Standards System Requirements Component Requirements Groups Technical Marketing Feature Teams Box Teams Integration Teams Testing Teams Customers

3. Telecoms Example Network provider deploying 3G. Placing order for handsets. One of the many features included will be access to network Java game repository. User Interface Java Game Menu Network Infrastructure Java Game Repository

4. Initial Customer Requirements UserHandsetNetwork Menu Key Options Select Fetch Resource Java GameConfirmation

5. Technical Marketing Scenarios SignalBattery Default Screen Display B1B2B3 B4B5B6 PowerJavaAck Ph. BkMenuHold Java Key Press Each event modifies functionality and UI configuration SignalBattery Java Games B1B2B3 B4B5B6 PowerJavaAck BackMenuSelect Doom 8 Quake 9 etc...... Customer Scenario broken down into sequence of atomic events, which change interface functionality.

6. Functional Requirements

7. Technical Marketing Scenarios Normative scenarios are very focused on isolated behaviour of feature in these requirements: What if voice or data call received during download? If memory is expandable (as with some PIM-phone hybrids) how should the mem-full error be handled if the user could add extra memory with, say, a USB flash memory stick? What if during the download the network service provider tries to update the phone configuration via the air interface for enhanced game play? Need to synthesise model of system from all MSC requirements scenarios for simulation and analysis. Problem: Practitioners use states imprecisely Different engineering groups define scenarios differently Legacy requirements

8. Deadlock example from TETRA PPT AB S0 S2 a c S0 S1 S3S2 !a FSA for A S1 AB S0 S3 b d S1 !b !c?d S0 S1 S3S2 ?a FSA for B ?b ?c!d S0 S1 S2 S0 S1 S3 ruthless pre-empt agreed pre-empt

9. Example Deadlock Avoided AB S0 S2 a c S1 AB S0 S3 b d S1 S0 S1S2 !a !b !c Extended DFSA for A S3 ?d AB S0 S2 a c S1 AB S0 S3 b d S1 S0 S1 S2 S0 S1 S3 ruthless pre-empt agreed pre-empt Too Weak to ever give any interactions! Composite States Anonymous internal states Multiple entry/exit states

10. Example, Call Waiting from paper in FIW 2000 SysBCD call_setup[B] call(B) accept(D) hang_up_on(C) ack_accept(D) disconnect(B) call_active(B) call_active[B,D] idle call_active[B,C]

11. Example, RBWF, from paper in FIW 2000 ASysB call_setup[B] call(B) rbwf(B) call_active[B,C] hang_up_on(C) idle ring(A,B) rbwf_call_progressing[A,B]

12. Example, FI from paper in FIW 2000 ASysBC call_setup[B] call(B) rbwf(B) D call_setup[B] idle call(B) accept(D) hang_up_on(C) ack_accept(D) disconnect(B) call_active(B) call_active[B,D] idle call_active[B,C] Whenever in these composite states CW can happen

13. Trace semantics for states S0S2 uvwxy !a?b !c ?d S1 State x is (In, Out), where In and Out are sets of traces. ux t1 For every trace t1 of In there is a path some initial state u xy t2 For every trace t2 of Out there is a path some accepting state y

14. Deterministic trace semantics S0S2 uvwxy !a?b !c ?d S1 ux t1 For any t1 of In if there is a path for some initial state u xy t2 then for every trace t2 of Out there is a path for some accepting state y

15. MSC trace semantics for exit/entry states S0S2 uvwxy !a?b !c ?d S1 ux t1 For any t1 if there is a path for any state u xy t2 then there is a path for some state y Every MSC trace t can be split into pairs (t1,t2) where t1 leads to exit state.

16. State semantics S0S1 v’w’x’ ?b !c S3 y’ ?e S0: ?b S0: !cS1: ?e

17. Overlapping Processes, continued S0S2 uvwxy !a?b !c ?d Scenario 1, machine for A S0S1S3 v’w’x’y’ ?b !c ?e Scenario 2, machine for A S1 S0: !a S0: ?b S0: !c S0: ?b S0: !c Match 

18. Overlapping Composition of Processes P trace simulates Q when: given any (state annotated) execution traces t1 and t2: PP1 t1 QQ1 t2 where t1 matches t2, then P1 must be able to simulate Q1

19. Livelock from naive composite state semantics AB S0 a a S1 b b x !a ?b S0 S1 DFSA for A y !a ?b !a S0 S1

20. Exit State transition matching P trace simulates Q when: given any (state annotated) execution traces t1 and t2: PP1 t1 QQ1 t2 where t1 matches t2, and t1, t2 have reached exit states then P1 must be able to simulate Q1. where t1 matches t2, and t1, t2 have reached entry states then P1 must be able to simulate Q1.

21. Temporal contexts for defining matching traces Composite stateEvent LTL semantics for execution trace LTL formula defining context

22. Download File with Browser

23. Overlap of Java Game and Browser Download

24. Error Check Will have universal scope over exit states

25. Overlap Java App + Browser + Error Check

26. Questions