CADP a protocol validation and verification toolbox

Proceedings Fifth IEEE International Conference on Engineering of Complex Computer Systems (ICECCS'99) (Cat. No.PR00434), 1999

We report on our efforts to formally specify and verify a new protocol of the E-2C Hawkeye Early Warning Aircraft. The protocol, which is currently in test at Northrop Grumman, supports communication between a Mission Computer (MC) and three or more Tactical Workstations (TWSs), connected by a single-segment LAN. We modeled the protocol in the PROMELA specification language of the SPIN verification tool, and used SPIN to analyze a number of properties of the protocol. Our investigation revealed a race condition that can lead to a disconnect of an MC/TWS connection when there is one lost UDP datagram and significant timing delays. Such delays are virtually impossible under normal E-2C operating conditions, but could be due to noise on the MC/TWS LAN. A simple modification was proposed that avoids the disconnect in many situations. Practical considerations, however, mandated that the protocol be left as is: shutting down a noisy connection and reinitializing the TWS, with minimal delay and loss of information to the operator, was deemed preferable to operating in degraded mode.

IEEE Transactions on Computers, 1991

A description is given of L.0, an executable specification language designed for describing communications protocols and similar reactive systems. L.0 is synchronous and rule-based. The rules are either cause-effect rules or constraints. Rules can be activated and deactivated dynamically, and several can be fired simultaneously. L.0 has modern notions of encapsulation and data sharing. Indirection, quantification, and recursive definition of

INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY

In this paper, we develop a sound Conformance Test Suite for the Transport Layer Protocol Internationally standardized by both ISO and IEC. This is to test the implementations of the protocol, promote and facilitate standardized test suites, and promote the use of formal methods. We use formal methods for the generation of testing sequences to make the results sound. The protocol is formally specified in Lotos; the ISO/IEC Formal Description Technique for computer/communications protocols and distributed systems.

… IEEE Transactions on, 1980

Abstraft--The production of error-& protomls or complex process interactions is essential to reliable communications. This paper presents techniques for both the detection of errors in prdoeols and for prevention of errors in their design. The methods have been used suceesstully , t o detect and correct errors in existing protomls. A technique based on a reachability analysis is described which detects errors in a design. This "perturbation technique" has been implemented and has s u d y detected inconsistencies or errors in existing protocol designs including both X.21 and X.25. The types of errors handled are state deadlocks, unspecified receptions, nonexecutable interactions, and state ambiguities. Therrors are d s e d and their effects considered. An interactive design technique is then described that prevents design errors. The technique is based on a set of production rules which guarantee that complete reception capability is provided in the interacting processes. These rules have been implemented in the form of a tracking algorithm that prevents a designer from creating unspecified receptions and nonexecutable interactions and monitors for the presence of state deadlocks and ambiguities. ZAFIROPULO et al.: ANALYZING AND SYNTHESIZING PROTOCOLS IEEE

Computer Networks, Architecture and Applications, 1995

Testing is an integral part of protocol development cycle. In this paper, we will briefly discuss the protocol conformance testing methodologies and framework proposed by the International Standards Organization. Many efficient test sequence generation methods have been proposed to check the conformance of an implementation of a protocol to its standards. We will discuss these methods briefly. Finally, we will compare different test methodologies based on their fault coverage and the length of the test sequence.

2018

The EMVCoorganisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperability of secure electronic payments. Despite recent advances, it has proved difficult for academia to provide an acceptable solution to construction of secure applications within industry’s constraints. In this paper, we describe a methodology we have applied to EMV1. It involves domain specific languages and verification tools targeting different analysis of interest. We are currently collaborating with EMVCo on their upcoming EMV R ©2nd Generation (EMV2) specifications.

1993

Dans Ie cadre de mes etudes~l'Ecole Polytechnique d'Eindhoven il est necessaire d'effectuer un stage de fin d'etudes concretisant rna formation d'ingenieur. J'ai effectue Ie premier mois (decembre 1992)~Philips Research Laboratories en Eindhoven, et les huit autres mois Ganvier 1993 jusqu'

Computer Networks and ISDN Systems, 1993

It can be remarkably hard to design a good communications protocol, much harder even than it is to write a normal sequential program. Unfortunately, when the design of a new protocol is complete, we usually have little trouble convincing ourselves that it is trivially correct. It can be a unreasonably hard to prove those facts formally and to convince also others. Faced with that dilemma, a designer usually decides to trust his or her instincts and forgo the formal proofs. The subtle logical flaws in a design thus get a chance to hide, and inevitably find the worst possible moment in the lifetime of the protocol to reveal themselves.

IEEE Design & Test of Computers, 2007

It's usually necessary to apply formal verification on very small modules or else be content with bounded proofs on realistically large modules. But there is no denying that despite its capacity problems, formal verification has its strengths and utility and is a complementary technique to simulation. Used judiciously, simulation and formal techniques can complement each other's strengths, thereby balancing their respective weaknesses. There are different ways to combine these two techniques. In this article, we present two case studies of the application of one such technique: the hybrid verification of a serial protocol. We chose this example because of serial protocols' added complexity compared to parallel protocols. Both case studies involve the same serial protocol (I2C) but demonstrate different aspects of its verification. Selection of the same protocol in both case studies also demonstrates the tremendous value of reuse in formal verification.

IEEE Transactions on Software Engineering, 2000

SPANNER is a software package for the specification, analysis, and evaluation of protocols. It is based on a mathematical model of coordinating processes called the selection/resolution model. SPANNER presently comprises three modules. The parser module checks a formal specification (in the SPANNER specification language) for syntactic correctness. The reachable graph module generates a database that consists of reachable states, transitions, and other information useful for analysis. The analysis module, with a user-friendly interface, allows a user to query the database interactively and evaluate the behavior of the protocol. This paper discusses the selection/resolution model, describes the specification language, and shows how SPANNER can be used for the development and analysis of protocols.