Protocol Analysis/Testing

Based on Sidhu et al in IEEE TSE 89 and TN 93

Figures from the papers.

Basic Idea

• Given a protocol spec, how do you know if an implementation conforms to it (conformance testing)

• Use black-box testing methods – Give input, see if output is “right” per spec

• Need a formal specification

– What input / output pairs should be checked• Fault coverage • Automatic generation

Mealy Machine

• Is an FSM that produces an output on each transition.

• Minimal – least number of states• Completely Specified – each state has a

transition for every input symbol• Strongly connected – if there is a

transition path for each state pair• Test subsequence, subsequence, test

sequence, optimized test sequence

An Example Mealy Machine

Protocol Modelling

• Model protocol as Mealy Machine• Protocol specified state/input combinations

are core, others are noncore• Strong vs Weak Conformance

– Weak if similar behavior on core, unspeficied on noncore

• Analyze coverage via simulation using mutated machines– Showing that machines are equivalent ?

Basic Test generation methods

• T-Method– Assume minimal, strongly connected, completely specified

machine– Generate random inputs till machine has traversed each

transition once, eliminate loops

• U-Method– Assume minimal, strongly connected, completely specified

machine– Derive Unique IO sequence for each state– For each transition (si,sj), reset, find shortest path from 0 to si,

add input to cause transition to sj, add UIO– Beta sequence is concatenation of each subsequence, create

optimized sequence.

More test generation methods

• D-Method– Assume minimal, strongly connected, completely specified

machine with distinguishing sequence– Construct the same way as U method but replace UIO with DS

• W-Method– Assume minimal, strongly connected, completely specified

machine– Derive a Characterizing set W

• Set of input strings a s.t the last output symbol obtained by applying these strings in a fixed order is different for different states.

• Use these instead of UIOs

Testing issues

• Finding shortest test sequence to check a given set of behaviors– How long to give complete coverage ?– Can we create a hierarchy of sequences

• State cardinality may differ in spec and implementation – masking behavior is different

• Test subsequence to test (p,q) transition can be viewed as L1.L2…Lk.CS(q)

• Bk test subsequence has an L sequence of length k. B0 tests a state. Every Bk is proper subsequence of some Bk+1 if machine is complete.

• Reset and Bridge Sequences