Multi-Formalism Specification and Verification in Verisoft Thorsten - PowerPoint PPT Presentation

Multi-Formalism Specification and Verification in Verisoft Thorsten Bormer Universit¨ at Koblenz-Landau June 15th, 2007

Component Overview Application Email Client Signature Software (User Interface) Module Com− piler Networking / Mail Server (SMTP) Communication TCP/IP System Operating Micro− Memory Software System kernel Manage− Tools ment Network Hardware Processor Screen Keyboard File System Host System T. Bormer (UKL) June 15th, 2007 2 / 18

Specification/Implementation Layers Requirement Specification System Specification Email SMTP Client T. Bormer (UKL) June 15th, 2007 3 / 18

Top level Specification: One Email Client... screen/kbd events Screen + Keyboard getKey updateScreen Email Email System Client signMail sendMail checkSig getMail Signature SMTP + Module TCP/IP network events T. Bormer (UKL) June 15th, 2007 4 / 18

Top level Specification: One Email Client... screen/kbd events SMTP + TCP/IP network events T. Bormer (UKL) June 15th, 2007 5 / 18

Top level Specification: ... or Two Clients? screen/kbd screen/kbd events events Screen + Screen + Keyboard Keyboard getKey getKey updateScreen updateScreen Two Communicating Email Email Email Systems Client Client signMail sendMail sendMail signMail checkSig getMail getMail checkSig Signature Signature SMTP + Module Module TCP/IP T. Bormer (UKL) June 15th, 2007 6 / 18

Specification using Histories Components communicate using events � . . . ,(sender, receiver, message),. . . � ✻ ✻ ✻ ❄ ❄ ❄ Signature SMTP Client Specification on histories can be combined Computation of component is determined by events received T. Bormer (UKL) June 15th, 2007 7 / 18

Example of Compontent specification Example from the Component Specification of the Email Client: “The User can enter any Email at will.” Let m be a string representing an email message. { h | h = h init ◦ h ′ ∧ ∃ k . ( h ′ ↓ kbd , email = k ∧ mailclientState ( h ′ ) . email = m ) } T. Bormer (UKL) June 15th, 2007 8 / 18

Specification/Implementation Layers Requirement Specification System Specification Email SMTP Client T. Bormer (UKL) June 15th, 2007 9 / 18

Specification/Implementation of the eMail Component Requirement Specification System Specification Email Client Component Spec. Statecharts Event Mail Loop Functions ? A SMTP B Hoare ? Spec. Mail Event Loop Functions C0 Implementation T. Bormer (UKL) June 15th, 2007 10 / 18

Specification/Implementation of the eMail Component Requirement Specification System Specification Email Client Component Spec. Statecharts Event Mail Loop Functions ? A SMTP B Hoare ? Spec. Mail Event Loop Functions C0 Implementation T. Bormer (UKL) June 15th, 2007 11 / 18

Specification with Automata Run Mode Command Mode H sign Send Mode Sent [SUCCESS] send [SUCCESS] Signed Edit Email sign edit|view H [SUCCESS] Not Changed quit viewing insert pub. key Unsigned Changed quit editing generate key pair typing move cursor Receive Mode Checked check Edit Pub. Key [SUCCESS] edit|view Not Changed H Not Checked quit viewing | editing Changed typing poll / new email arrived move cursor T. Bormer (UKL) June 15th, 2007 12 / 18

Relation: Implementation/Automata/Histories Specification with Histories Run Mode Execute Update Command Mode H Command Send Mode Screen Sent send [SUCCESS] Signed Edit Email sign H edit|view [SUCCESS] Not Changed quit viewing insert pub. key Unsigned Changed quit editing generate key pair typing move cursor Receive Mode Checked check Edit Pub. Key [SUCCESS] edit|view Update Get Not Changed H Not Checked quit viewing | editing Changed Command Screen typing poll / new email arrived move cursor {Pre} {Post} main loop Proc C0 Implementation T. Bormer (UKL) June 15th, 2007 13 / 18

Enhancing Automata with Structure sign Signed Unsigned [success] [pre]sign/[post] Unsigned Signed stateInv: stateInv: mailLength>0 isSigned(mail) T. Bormer (UKL) June 15th, 2007 14 / 18

Implementation of the Event Loop Event Loop while (cmd != CMD QUIT) { applicConfUpdateScreen ( applicConf , osConf ) ; osConfGetKeyStroke ( osConf , key ) ; cmd = command( ∗ key , applicConf − > s t a t e ) ; applicConfUpdateScreen ( applicConf , osConf ) ; execute ( applicConf , cmd , ∗ key ) ; } T. Bormer (UKL) June 15th, 2007 15 / 18

Connection Automaton ↔ C0 Current Status verified that C0 implementation performs single transition in the statechart have to show that ’event loop’ implements automaton Verification of ’event loop’ prove using Hoare-logic that one iteration always performs a valid transition prove using temporal logic that event loop implements automaton T. Bormer (UKL) June 15th, 2007 16 / 18

Conclusion integration of specification/verification non-trivial task But: we’re almost done! verification of the ’event loop’ will be covered by my diploma thesis grateful for comments! T. Bormer (UKL) June 15th, 2007 17 / 18

Thank you for your attention! T. Bormer (UKL) June 15th, 2007 18 / 18