Akio Nakata

Generating Test Cases for a Timed I/O Automaton Model

Recently various real-time communication protocols have been proposed. In this paper, first, we propose a timed I/O automaton model so that we can simply specify such real-time protocols. The proposed model can handle not only time but also data values. Then, we propose a conformance testing method for the model. In order to trace a test sequence (I/O sequence) on the timed I/O automaton model, we need to execute each I/O action in the test sequence at an adequate execution timing which satisfies all timing constraints in the test sequence. However, since outputs are given from IUTs and uncontrollable, we cannot designate their output timing in advance. Also their output timing affects the executable timing for the succeeding I/O actions in the test sequence. Therefore, in general, the executable timing of each input action in a test sequence can be specified by a function of the execution time of the preceding I/O actions. In this paper, we propose an algorithm to decide efficiently whether a given test sequence is executable. We also give an algorithm to derive such a function from an executable test sequence automatically using a technique for solving linear programming problems, and propose a conformance testing method using those algorithms.

Deriving Parameter Conditions for Periodic Timed Automata Satisfying Real-Time Temporal Logic Formulas

A symbolic model checking method for parametric periodic timed automata is proposed. The method derives symbolically the weakest condition for parameters such that the specified control state of a periodic timed automaton satisfies some temporal properties. Unlike several existing parametric symbolic model checking methods, the proposed method is ‘on-the-fly’ — it does not unnecessarily check all the states. Instead, it traverses some necessary part of the computation tree to derive the weakest condition. We show that if we constrain a timed automaton to be periodic, i.e. if we force a timed automaton to return to its initial state periodically at the specified constant time, we have only to traverse at most the first 3 periods in the infinite computation tree. In the proposed method, we can avoid a costly (and generally undecidable) fixpoint-calculation for dense-time-domain state sets, and derive the weakest condition for parameters of a timed automaton to satisfy given temporal properties written in a real-time temporal logic formula.

A test sequence generation method for communication protocols using the SAT algorithm

The specification for a communication protocol is generally represented by a finite-state machine, and the operation of the machine is represented by transitions among states. The device implementing such specification is called the implementation under test (IUT). It is important for the IUT that its operation should be verified for all state transitions on the finite-state machine given in the specification. This test is called the conformance testing. In such testing it is important to generate efficiently a route containing all state transitions from the initial state. This problem is called the test sequence generation problem. This paper considers the test sequence generation problem for a communication protocol and proposes an application of an algorithm for satisfiability problem (SAT) that can flexibly handle various constraints, such as the order constraint and the time constraint among multiple constraints. The proposed method is applied to the dynamic host configuration protocol (DHCP) and its effectiveness is demonstrated.

A Language for Describing Wireless Mobile Applications with Dynamic Establishment of Multi-way Synchronization Channels

In this paper, we define a new language called LOTOS/M which enables dynamic establishment of multi-way synchronization channels among multiple agents (processes running on mobile hosts) on ad hoc networks, and show how it can be applied to designing wireless mobile applications. In LOTOS/M, a system specification is given by a set of independent agents. When a pair of agents is in a state capable of communicating with each other, a synchronization relation on a given gate (channel) list can dynamically be assigned to them by a new facility of LOTOS/M: (i) advertisement for a synchronization peer on a gate list and (ii) participation in the advertised synchronization. The synchronization relation on the same gate list can also be assigned to multiple agents to establish a multi-way synchronization channel incrementally so that the agents can exchange data through the channel. When an agent goes in a state incapable of communication, a synchronization relation assigned to the agent is canceled and it can run independently of the others. By describing some examples, we have confirmed that typical wireless mobile systems can easily be specified in LOTOS/M, and that they can be implemented efficiently with our LOTOS/M to Java compiler.

Protocol synthesis from context-free processes using event structures

We propose a protocol synthesis method based on a partial order model (called event structures) for the class of context-free processes. First, we assign a unique name called event ID to every event executable by a given service specification. An event ID is a finite sequence of symbols derived from the context-free process specification. Then we show that some interesting sets of events are expressible by regular expressions on symbols, and that the event structure can be finitely represented by a set of relations among the regular expressions. Finally, we present a method to derive a protocol specification which implements a given service specification on distributed nodes, by using the obtained finite representation of event structures. The derived protocol specification contains the minimum message exchanges necessary to ensure the partial order of events of the service specification.

A Method for Functional Testing of Media Synchronization Protocols

In this paper, we propose a functional testing method of media synchronization protocols, which control the synchronization between audio and movie, described in concurrent synchronous timed I/O automata. In order to trace all test sequences (I/O event sequences) with synchronization on the model, we need to execute each I/O event at an adequate timing which satisfies the whole timing constraint for all the given test sequences. However, the outputs are given from the IUT and uncontrollable. Also each output/synchronization timing may affect executable timing for its succeeding I/O events in the test sequences. In this paper, we propose a technique to derive a set of time intervals which make all the given test sequences executable, and propose a method for functional testing using the technique.

A conformance testing method for communication protocols modeled as concurrent DFSMs. Treatment of non-observable non-determinism

According to the progress of high-speed networks, many communication protocols are specified as concurrent systems. Such systems can be modeled as concurrent deterministic FSMs (DFSMs). In those protocols, a common input may be taken by some of concurrent DFSMs competitively. In such a case, the global behaviour becomes non-deterministic in general. Conformance testing is typically a black-box testing, i.e. it is based on its specification. Formal methods for deriving conformance test cases are widely recognized as being capable of producing tests with high fault coverage. We propose a conformance testing method based on GWp-method for a sub-class of non-observable non-deterministic FSMs (NFSMs). In this class, the global behaviour of many protocols modeled as concurrent DFSMs can be specified. The proposed method can be used not only for testing NFSMs directly but also for testing concurrent DFSMs whose global behaviour becomes non-observable non-deterministic.

Time-action alternating model for timed LOTOS and its symbolic verification of bisimulation equivalence

Verification of timed bisimulation equivalence is generally difficult because of state explo- sion caused by concrete time values. In this paper, we propose a verification method to verify timed bisimulation equivalence of two timed processes using a symbolic technique similar to (Hennessy and Lin 1995). We first propose a new model of timed processes, Alternating Timed Symbolic Labelled Transition System(A-TSLTS). In A-TSLTS, each state has some parameter variables and those values determine its behaviour. Each tran- sition in an A-TSLTS has a guard predicate. The transition is executable if and only if its guard predicate is true under specified parameter values. In the proposed method, we can obtain the weakest condition for a state-pair in a finite A-TSLTS to make the state-pair be timed bisimulation equivalent. We also show that this result can be applied to the language LOTOS/T(Nakata et al. 1994), a timed extension of LOTOS(ISO 1989).

A Global Timed Bisimulation Preserving Abstraction for Parametric Time-Interval Automata

In the development of real-time (communicating) hardware or embedded-software systems, it is frequently the case that we want to refine/optimize the system’s internal behavior while preserving the external timed I/O behavior (that is, the interface protocol). In such a design refinement, modification of the systems’ internal branching structures, as well as re-scheduling of internal actions, may frequently occur. Our goal is, then, to ensure that such branch optimization and re-scheduling of internal actions preserve the systems’ external timed behavior, which is typically formalized by the notion of (timed) failure equivalence since it is less sensitive to the difference of internal branching structures than (timed) weak bisimulation. In order to know the degree of freedom of such re-scheduling, parametric analysis is useful. The model suitable for such an analysis is a parametric time-interval automaton(PTIA), which is a subset of a parametric timed automaton[1]. It has only a time interval with upper- and lower-bound parameters as a relative timing constraint between consecutive actions. In this paper, at first, we propose an abstraction algorithm of PTIA which preserves global timed bisimulation[2]. Global timed bisimulation is weaker than timed weak bisimulation and a sufficient condition for timed failure equivalence. Then, we also show that after applying our algorithm, the reduced PTIA has no internal actions, and thus the problem deriving a parameter condition in order that given two models are global timed bisimilar can be reduced to the existing parametric strong bisimulation equivalence checking[3]. We also apply our proposed equivalence checking algorithm to vulnerability checking for timing attack on web privacy.

Design and Implementation of FPGA Circuits for High Speed Network Monitors

Due to the recent progress of the Internet, we need high-speed network monitors which can observe millions of packets per second. Since several types of network attacks occur, we need to modify monitoring facilities and their capacities depending on monitoring items and network speed. In this paper, we propose (1) a methodology for designing and implementing such network monitors flexibly and (2) a high-level synthesis technique which automatically synthesizes FPGA circuits from specifications of network monitors in a model called concurrent synchronous EFSMs. The proposed technique makes it possible to synthesize an FPGA circuit suitable for given monitoring items and parameters where the designer need not consider about how pipe-line processing and parallel processing should be adopted. We have developed a tool to automatically derive FPGA circuits and evaluated the speed and size of derived circuits.