The document describes sdl2pml, a tool for automatically generating SPIN models in Promela from SDL specifications. SDL2pml takes an SDL specification as input and outputs a corresponding Promela model. It implements algorithms for model construction, static analysis of the SDL specification, and generation of the Promela code. The tool is implemented in C++ and consists of around 120,000 lines of code. Examples are provided showing an SDL specification and the corresponding Promela model generated by sdl2pml both with and without probes.

1. Boštjan Vlaovič, Ph.D. Aleksander Vr eže Faculty of Electrical Engineering and Computer Science, Maribor sdl2pml – Tool for automatic generation of SDL Models with Probes from System

2. Introduction SDL Specification SPIN model in Promela sdl2pml – SDL to Promela PROMELA – PROcess MEta LAnguage SDL – S pecification and Description Language Model construction: manually by an expert, automatic generation ( sdl2if , if2pml , sdl2pml ). ?

3. sdl2pml The sdl2pml is used for automatic generation of models . I nput : SDL Specification O utput : Promela Formal verification with Spin. SPIN – Simple Promela INtepreter s dl2pml.conf + Input parameters sdl2pml SPIN model in Promela Output Automatic generation of the SPIN model Input SDL Specification

4. Konfiguracijska datoteka # Synonym config definitions SYNONYM_SOURCE = synonym_source.log SYNONYM_LOG = synonym_log.log SYNONYM_DEBUG = synonym_debug.log SYNONYM_COLUMN_SEPARATOR = ; SYNONYM_ERROR = synonym_error.log # S ignal config definitions SIGNAL_LOG = signals.log SIGNAL_DEBUG = signal_debug.log SIGNAL_COLUMN_SEPARATOR = ; SIGNAL_ERROR = signal_error.log SIGNAL_PH_DEF = signals.ph … Config file (sdl2pml.conf) is devided in to s ections . synonym definition signal definition

5. SDL specification

6. SPIN model in Promela /******************************************************************************/ /* Process init */ /**************************************************************************** */ /* KOMENTAR : Process init - inicializacija procesov */ /* MAX : 1 */ /* MIN : 1 */ /******************************************************************************/ init { pt__pid offspring; atomic { if :: table__B__mux__free < table__B__mux__max -> offspring = run B__mux(chan__B__mux[table__B__mux__free],_pid); table_pid_channum[offspring] = chan__B__mux[table__B__mux__free]; table_pid_channame[offspring] = chan__B__mux__select + \ table__B__mux__free; table_channame_channum[chan__B__mux__select+table__B__mux__free] = \ chan__B__mux[table__B__mux__free]; if :: (offspring == 0) -> pv__runtime_error = true; :: (offspring != 0) -> table__B__mux__free++; fi ; :: else -> pv__runtime_error = true; fi ; } }

7. Architecture User Interface Algorithms for static analysis of SDL specification Algorithms for automatic generation of SPIN models in Promela Filesystem Level SDL Parser Business Level

8. Model generation 1. SDL specification preprocessing: extraction of comments, partitioning of the specification to its logical units. 2. Static analysis: parsing of logical units, preparation of data structures, and temporary files needed in generation phase. 3. Generation: inclusion of probes, generation of the SPIN model.

9. s dl2pml – properties Implemented in C++. Fully independent from other tools. The implementation took about 7 months. The SDL parser was developed by the ANTL 2.7.2 tool. Current implementation consist of about 120.000 lines of code.

10. sdl2pml – future work Algorithms for the inclusion of the embedded C code. Algorithms for the automatic generation of the system environment. Algorithms for the automatic model abstraction. Development of a graphical formal verification environment.

11. Examples

12. Example – SDL specification

13. Example (1) … /* === Decision start === */ if :: true -> d_step{ V_sp.val = V_sp.val+1; assert((1<=V_sp.val)&&(V_sp.val<=4)) } goto R1; :: true -> d_step{ V_sp.val = 2; assert((1<=V_sp.val)&&(V_sp.val<=4)) } goto client_endstate; :: else -> pv__runtime_error = true; fi; /* ==== Decision end === */ … … /* === Decision start === */ if :: true -> V_sp.val = V_sp.val+1; goto R1; :: true -> V_sp.val = 2; goto client_endstate; :: else -> pv__runtime_error = true; fi; /* ==== Decision end === */ … Model without probes Model with probes Command line: sdl2pml opis_sistema .pr -probe_range=yes

14. Example (2)

16. Example (2) local B__client__ntip B__client__V_sp; … /* === Decision start === */ if :: true -> B__client__ V_sp.val = B__client__ V_sp.val+1; goto R1; :: true -> B__client__ V_sp.val = 2; goto client_endstate; :: else -> pv__runtime_error = true; fi; /* ==== Decision end === */ … … /* === Decision start === */ if :: true -> V_sp.val = V_sp.val+1; goto R1; :: true -> V_sp.val = 2; goto client_endstate; :: else -> pv__runtime_error = true; fi; /* ==== Decision end === */ … Model without probes Model with probe for the variable V_sp Command line: sdl2pml opis_sistema .pr -probe_var=B__client/V_sp

17. Example (3) local bool environment__SUa-start-L_SetparmReq-ps; local bool environment__SUb-ready-L_SetparmInd-pr; proctype environment__SUa(pt__chan input; pt__pid parent){ . . . :: atomic{ /* koda za po š iljanje signala L_SetparmReq */ environment__SUa-start-L_SetparmReq-ps = true; } environment__SUa-start-L_SetparmReq-ps = false; . . . } proctype environment__SUb(pt__chan input; pt__pid parent){ . . . :: atomic{ /* koda za sprejem signala L_SetparmInd */ environment__SUb-ready-L_SetparmInd-pr = true; } environment__SUb-ready-L_SetparmInd-pr = false; . . . } Command line: sdl2pml opis_sistema .pr -probe_sig=environment__SUb/ready/L_SetparmInd/recv -probe_sig=environment__SUa/start/L_SetparmReq/send

18. Example (4) . . . /* Output signal : V76frame */ d_step{ assert(V76para.presen.val == unsigned_undefined__value); assert(V76para.I.DLCi.val == unsigned_undefined__value); assert(V76para.I.data == int_undefined__value); assert(V76para.I.CRC == int_undefined__value); assert(V76para.SABME.DLCi.val == unsigned_undefined__value); assert(V76para.DM.DLCi.val == unsigned_undefined__value); assert(V76para.DISC.DLCi.val == unsigned_undefined__value); assert(V76para.UA.DLCi.val == unsigned_undefined__value); assert(V76para.XIDcmd == int_undefined__value); assert(V76para.XIDresp == int_undefined__value); } if ::atomic{ table_pid_channame[DLCs.val[V76para.DM.DLCi.val]]== chan__DLCa__DLC__select -> table_pid_channum[DLCs.val[V76para.DM.DLCi.val]]! V76frame \ (_pid,pcv__null,V76para,pcv__null); … Command line: sdl2pml opis_sistema .pr -probe_undefined=yes