Table Of ContentIFIP Transactions C:
Communication Systems
International Federation for Information Processing
Technical Committee 6
IFIP Transactions Abstracted/Indexed in:
INSPEC Information Services
C-8
PROTOCOL
SPECIFICATION,
TESTING A ND
VERIFICATION, XII
Proceedings of the IFIP TC6/WG6.1. Twelth International Symposium on
Protocol Specification, Testing and Verification
Lake Buena Vista, Florida, U.S.A., 22-25 June, 1992
Edited by
R.J. LINN, Jr.
Computer Systems Laboratory
National Institute of Standards and Technology
Gaithersburg, MD, U.S.A.
M.Ü. UYAR
AT&T Bell Laboratories
Holmdell, NJ, U.S.A.
1992
NORTH-HOLLAND
AMSTERDAM · LONDON · NEW YORK · TOKYO
ELSEVIER SCIENCE PUBLISHERS B.V.
Sara Burgerhartstraat 25
P.O. Box 211,10OO AE Amsterdam, The Netherlands
ISBN: 0 444 89874 3
ISSN: 0926-549X
© 1992 IFIP. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any
means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of
the publisher, Elsevier Science Publishers B.V., Copyright & Permissions Department, P.O. Box 521,1000 AM
Amsterdam, The Netherlands.
Special regulations for readers in the U.S.A. - This publication has been registered with the Copyright Clearance
Center Inc. (CCC), Salem, Massachusetts. Information can be obtained from the CCC about conditions under
which photocopies of parts of this publication may be made in the U.S.A. All other copyright questions, including
photocopying outside of the U.S.A., should be referred to the publisher, Elsevier Science Publishers B.V., unless
otherwise specified.
No responsibility is assumed by the publisher or by IFIP for any injury and/or damage to persons or property
as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products,
instructions or ideas contained in the material herein.
This book is printed on acid-free paper.
Printed in The Netherlands
ν
© THE WALT DISNEY COMPANY
Preface
Between June 22 - 25, 1992, participants of the 12th International Protocol Specification, Testing and
Verification Symposium met at Lake Buena Vista, Florida, USA. The main theme of the symposium was
"Success Stones in Industry" discussing the application of formal description techniques to protocol
specification, implementation, testing and verification. The keynote speech by A. G. Fraser highlighted
some of the software production success stories in AT&T Bell Laboratories, USA. The invited speaker, H.
Rudin of IBM, Switzerland, presented a survey of the known successful applications of formal methods. J.
P. Favreau of NIST, USA, summarized the standardization efforts of the formal methods in conformance
testing arena.
The first panel session was devoted to a presentation of industry success stories from J. Allen of AT&T Bell
Laboratories, USA, F. Brady of NPL, UK, L. Collica of NIST, USA, and J. Quemada of Technical
University of Madrid, Spain. We learned that there are indeed success stories in specification, testing and
standardization aspects of communication protocols. However, the task of applying formal methods to
real-life applications are much more difficult than first anticipated in 1980, when the first PSTV workshop
was held. Ironically, the proceedings of the first workshop were entitled "Protocol Testing: Towards
Proof?"
In a second panel session, titled "Should There Be A Protocol Science?" and chaired by R. Miller of
University of Maryland, USA, the issue of education was discussed. The panel members were G. von
Bochmann of University of Montreal, Canada, M. Diaz of LAAS du CNRS - FORTE, France, M. Gouda of
University of Texas, USA, and B. Pehrson of SICS, Sweden. The panel and the participants agreed that we
need to do more to prepare our students if they are to become "protocol engineers." Indeed, IFIP WG 6.1
should consider this issue and sponsor a study of an appropriate curriculum at both the undergraduate and
graduate levels.
The symposium was preceded by a one-day tutorial. There were four sessions in the tutorial: "Formal
Methods for Protocol Conversion" by M. T. Liu, Ohio State University, USA, "OS/ Conformance Abstract
Test Suite Design" by B. Sarikaya, Bilkent University, Turkey, "Protocols for B-ISDN Networks" by K.
Sabnani and S. Dravida, AT&T Bell Laboratories, USA and "Alternatives in Efficient Protocol
Implementations For High Speed Networks" by P. Gunningberg, SICS, Sweden. These tutorials will be
reviewed and published as a special issue of (he Computer Networks and ISDN Systems.
vi
There were many individuals who made this symposium a success. The authors and referees, who reviewed
the largest number of papers in the history of this symposium, are the first to be recognized. Among the 89
papers submitted from 18 countries, the Program Committee accepted 22 papers. We owe a particular debt
of gratitude to the Program Committee, who drafted colleagues as referees, reviewed papers, assisted in the
selections for the final program, and chaired sessions during the symposium. The financial support provided
by AT&T Bell Laboratories, USA, Hewlett Packard/Idacom, Canada, NIST, USA, and Tekelec, USA, is
much appreciated. The dinner speaker, Thomas Piatkofsky of Western Michigan University, USA, gave an
emotional and remarkable speech. We must also thank Harry Rudin for having all the answers. The efforts
of the Symposium Secretary Aldona Karlbon deserves an acknowledgement for her organizational abilities.
All participants enjoyed the extraordinary work of the Local Arrangements Committee, Aleta Lapone and
Barry Litofsky of AT&T Bell Laboratories. All were left with many memories beyond those found in the
formal proceedings.
R. J. (Jerry) Linn, NIST, USA
M. Umit Uyar, AT&T Bell Laboratories, USA
vii
Organizing Committee
Chairpersons: R. J. (Jerry) Linn, USA, M. Ümit Uyar, USA
Secretary: Aldona Karlbon, USA
Local Arrangements Committee: Aleta Lapone, USA, Barry Litofsky, USA
Technical Committee:
Sudhir Aggarwal, USA Paul Amer, USA Ed Brinksma, The Netherlands
Gregor v. Bochmann, Canada Andre Danthine, Belgium Jan B. de Meer, Germany
Jean-Philippe Favreau, USA Mohammed Gouda, USA Dieter Hogrefe, Switzerland
Jan Kroon, The Netherlands Ming T. (Mike) Liu, USA Raymond Miller, USA
Björn Pehrson, Sweden Juan Quemada, Spain Krishan Sabnani, USA
Behcet Sarikaya, Turkey Hasan Ural, Canada Son Vuong, Canada
viii
Referees
S. Aggarwal U. Akdemir P. D. Amer A. Azcorra
Y. Baguette H. Baumer G. v. Bochmann B. Botma
Ε. Brinksma J. Burmeister T. Κ. Capin S. Chamberlain
T. Y. Cheung J. A. Cobb F. Cornelius J. Curgus
A. Danthine A. Das A. Dasdan J. de Meer
C. Demir R. Dssouli H. Eertink M. Erradi
J. P. Favreau L. Fredlund D. de Frutos S. Gallouzi
R. Gotzhein M. Gouda J. Grabowski H. Hansson
D. Hogrefe G. Holzmann B.Jonsson W. T. M. Kars
M. Kim H. G. Knehler J. Kroon Κ. Kubitscheck
E. Kwast P. Ladkin R. Langerak G. Leduc
D. Lee G. Leih L. Leonard S. Leue
M. Levy R. J. Linn M. T. Liu L. Logrippo
A. Loureiro G. Luo J. A. Ma'nas C. Miguel
R. E. Miller R. Nahm S.Naik D. New
F. Orava D. Ouimet J. Parrow S. Pavon
C. Pécheur A. Peeters B. Pehrson J. Quemada
A. Rensink R. Roth K. Sabnani B. Sarikaya
P. Schoo J. Schot R. Sijelmassi I. Sirin
P. Sjodin Α. Spichiger S. Storp E. Sukan
J. Tretmans P. Tripathy G. Tsiknis H. Ural
M. U. Uyar S. P. v.d. Burgt P. v.d. Merkhof S. Vuong
C.J.Wang M. Y. Yao S. Zhang J. S. Zhu
Protocol Specification, Testing and Verification, XII
R J. Linn, Jr. and M.Ü. Üyar
Elsevier Science Publishers B.V. (North-Holland) 3
© 1992 IFIP. All rights reserved.
Formal Methods Applied to Software Production
A. G. Fraser
AT&T Bell Laboratories,
Murray Hill, New Jersey 07974, USA
ABSTRACT
A new laboratory for Software and Systems Research provides the
context for AT&T's research on formal methods of software production.
Joint experiments are carried out with software developers working
under the real conditions of business life. Advantages of formal
specification and verification have been demonstrated for software
used in a telephone switching system. It is hoped that this success
indicates that formal methods used more extensively with code
generation, controlled refinement and test generation will in future do
much to reduce the cost and increase the quality of software .
AT&T intends to become a world leader in software quality and production
capability. With this in mind, in the fall of 1990 AT&T created a new lab for
Software and Systems Research under the direction of Peter Weinberger. It is in
this lab that we will focus much of the research that is directed at more effective
software production. Two aspects of the lab should be of particular interest at this
conference.
First is the emphasis that we are giving to formal methods of software design,
specification, generation and test. I want to see much greater precision in all
aspects of software specification and development. We can achieve that by using
languages and tools that have a solid foundation in mathematics. Most likely we
shall make good use of the work being discussed at this conference.
4
Second is a direct focus on the processes used during software development. I
want to see a research program based upon real experience as real products are
designed, developed and tested. For example, we have engaged statisticians in
the hope that our research results can be more quantitative than is now common in
the literature on this subject.
In summary, I hope that we can do for software what Henry Ford did for cars 70
years ago.
Research at Bell Labs has the great advantage that it is surrounded by problems.
Development experience keeps researchers honest, and problems exposed during
development provide the stimulus for new research. So it is with our research on
software production.
The control program for AT&T's 5ESS® switching system contains over 5 million
lines of code, and is the work of more than 2500 designers and programmers.
Obviously it is a program that must operate non-stop with ultra high reliability. It is
also a program for which there is a continuously growing long list of changes and
additions waiting to be made. We find that each country has a unique set of
evolving requirements. The 5ESS project therefore offers a unique opportunity to
understand what opportunities there are for new research, and to verify that our
research is on track.
RESEARCH ON PRODUCTION PROCESSES
Coincident with the formation of the laboratory for Software and Systems Research,
we have established a research department a few miles west of Chicago, along-
side the developers who are working on the 5ESS software. Senior management
in 5ESS development and in research are committed to using the experiences of
the 5ESS International team as a means of improving the software development
process not only for switching, but also for all of AT&T.
This is a really exciting opportunity. Perhaps for the first time, researchers find
themselves able to conduct research experiments in a factory that is producing
mission critical software under the real conditions of business life. I will give you
one example of why this is so exciting.
5
THE NEWCORE PROJECT
Last year we were engaged in an effort to write the signaling software for a 5ESS
switching system that was to be delivered to Spain. The requirements for this
software had been prepared in the traditional manner. It was a book of English
text entered into a computer using one of the common text processing systems.
The project also had a deadline by which the program had to be working. The task
was assigned to two independent teams. One team of about 40 people was to use
the normal software development methodology. The other, a team that ranged in
size between 2 and 8 people working jointly with research, was to use formal
methods. Both were expected to deliver on the same schedule.
In the fall of last year, before the project was complete, I made a short movie to
report on this project to the upper management of Bell Laboratories. I want to
show that tape to you now.
<video tape>
What Barbara Hornbach does not point out is that the cost of a network crash
induced by a software bug could easily exceed the cost of her entire project. A
network failure that causes loss of service across the country can cost many
millions of dollars, as well as lost customers to the RBOCs, PTTs, or common
carriers.
You will be pleased to know that since that tape was made the software has been
completed on schedule, and has been delivered to the customer. This project
seems to have been the first major application of temporal logic verification of a
large piece of code. I don't know how many of the 40 errors that verification found
would have been carried through into the final product, but statistics collected by
AT&T over some number of years indicate that programmers typically are better at
finding their own errors than they are at finding errors in specifications.
Formal methods are now being used to write versions of the 5ESS signaling
system for Japan and 5 other countries. Given that different versions of the
program are required for each country, the program was composed in two parts, a
