1 Prtil Orer Simultion of SDL Speitions Dniel Toggweiler, Jens Growski, n Dieter Hogrefe University of Berne, Institute for Informtis, Neurukstr. 10, CH-3012 Berne, Switzerln, ftoggweil, growsk, hogrefeg@im.unie.h The nee of eient simultion methos for vlition n verition of protool speitions les to the evelopment of prtil orer simultion methos. Two new lgorithms for the prtil orer simultion of SDL speitions re presente. Both lgorithms hve shown to e useful for the utomti genertion of test ses. They re implemente in the test se genertion tool SMsTG. The results of some experiments re isusse. 1. Introution Due to omplexity the possiilities for vlition n verition of ommunition protools often re very restrite. A lot of omplexity is introue y the semntis of the speition lnguge whih is use to esrie the ehvior of the protool funtions. For exmple, SDL [10] is se on interleving semntis. Conurreny is introue y ineterminism, i.e., the exeution of n SDL speition is esrie y ll interleve tres 1 of onurrently exeute events. Exploring ll interleve tres is not lwys neessry for verition. Tres whih orrespon to the sme onurrent exeution ontin relte informtion. Susequently, prtil orer simultion methos exist for verition [1,4,6,9]. They ttempt to limit the explortion of tres for onurrent exeutions. At est for eh onurrent exeution only one tre is generte. We inten to improve the utomti genertion of test ses for SDL speitions y using prtil orer simultion methos. Our test se genertion metho is SMsTG 2 [2,7]. SMsTG genertes test ses y serhing system tres with spei properties in the stte spe of n SDL speition. The most prolemti point of SMsTG is the serh proeure. Until now, ue to the SDL interleving semntis, SMsTG investigte ll interleve tres of the given speition within the serh lgorithm. But for test se genertion in most ses it is suient to exmine one tre only for eh onurrent exeution. Consequently, we evelope n implemente the Inepenene Prioritizing Simultion (IPS) n the Conition Loking Simultion (CLS). These new lgorithms pt the ies of prtil orer simultion methos to the nees of SMsTG. They re presente in this pper. However, the enets of prtil orer simultion methos for SDL 1 Throughout this pper tre is ment to e totlly orere sequene of events. 2 SMsTG is n revition for 'Sl An Ms Se Test Ase Genertion'.
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 2 speitions re not restrite to SMsTG. Therefore IPS n CLS re esrie inepenently from SMsTG. Throughout this pper we ssume tht we simulte lose SDL systems, i.e., systems whih o not ommunite with the system environment. This is no restrition, euse it is lwys possile to moel the ehvior of the environment y mens of speil SDL proesses whih re le to sen n reeive ll possile signls t ny time. The vntge of this ssumption is tht we re le to tret the ommunition with the system environment in the sme wy s the ommunition mong SDL proesses. The pper is orgnize in the following wy: Setion 2 introues some funmentl notions. A smll exmple is introue in Setion 3. Throughout the pper it will e use to explin the mehnism of prtil orer simultion methos. The IPS lgorithm is esrie in Setion 4. Setion 5 presents the CLS lgorithm. The results of some experiments re isusse in Setion 6. In Setion 7 summry n outlook re presente. 2. Fountions It is ommon prtie to esrie the ehvior of n SDL system in form of ehvior tree. Figure 2 () presents prt of ehvior tree. The root of the tree S0 esries the initil stte n the leves S2 n S3 enote nl sttes. The other noes esrie sttes whih re rehe uring the simultion of the system. Stte trnsitions re represente y nnotte eges. The nnottions esrie the events whih le to the orresponing stte trnsition. The mening of the terms stte n event my nee some lrition. A stte is ment to e n SDL system stte whih omprises the lol sttes of the proesses, the vlues of vriles, n the ontents of ll queues. An event enotes n ritrry SDL event like input, output, or tsk. In priniple it mkes no ierene to use omplete (tomi) stte trnsitions 3 inste of SDL events only. In generl, the ehvior tree of n SDL system is not nite. One reson for this is tht often n ongoing n never ening ehvior is require y the pplition re of SDL, e.g., telephone system shoul not en. Another reson is the existene of innite signl queues whih my le to n innite stte spe of the SDL system. However, the tres of n SDL system n e exmine y using n ritrry SDL simultor whih provies the funtions initilize, enle-events, n exeute-event. We esrie these funtions y using the following BNF nottion: < F untionnme > ([< P rmeter > f; < P rmeter >g ])[!< ReturnV lue >] (1) initilize()! InitilStte : initilizes the SDL simultor n returns the strt stte of the simultion. (2) enle-events(stte)! StkOf EnleEvents : returns for given stte stk of ll enle events, i.e., events whih n e exeute next. (3) exeute-event(stte; Event)! N extstte : tkes Stte s tul stte, exeutes Event, n returns the new stte. 3 An SDL stte trnsition is ment to e sequene of events whih is performe y one proess n whih les from one SDL stte to the next SDL stte.
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 3 1 elre 2 S stk of sttes := (initilize()); 3 T R stk of events := (); 4 AL stk of stk of events := (); 5 U pperboun integer onstnt := externl; 6 7 InterlevingSimultion() 8 f 9 push(al; enle-events(top(s))); 10 while(:isempty(top(al)) ^ length(t R) < U pperboun) 11 f 12 e := top(top(al)); 13 push(s; exeute-event(top(s); e)); 14 push(t R; e); 15 push(al; rest(pop(al))); 16 ll : InterlevingSimultion(); 17 g 18 pop(s); pop(t R); pop(al); 19 g Figure 1. Interleving Simultion (ILS) lgorithm The funtion enle-events returns stk of events. A stk is t struture whih n e use to store elements of some type. It n e esse n mnipulte only y pplying the funtions push, pop, top, rest, isempty, n length. (4) push(stk; Element) : pushes Element on the top of Stk. (5) pop(stk)! Element : removes n returns the top element of Stk. (6) top(stk)! Element : returns the element whih ws lst pushe on Stk. (7) rest(stk)! Stk : removes the top element of Stk n returns the resulting stk. (8) isempty(stk)! BoolenV lue : returns the oolen vlue true if Stk is empty n flse if Stk is not empty. (9) length(stk)! IntegerV lue : returns the numer of elements whih re tully store in Stk. Bse on the funtions (1) - (9) we ene n lgorithm whih is le to exmine the tres of n SDL system. The lgorithm is lle interleving simultion (ILS) n is shown in Figure 1. The expression (initilize()) in line 2 enotes stk whih only inlues the initil stte of the SDL system. The empty prentheses () in the lines 3 n 4 esrie empty
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 4 S0 e S1 S4 S5 f h Bottom S2 S3 g S6 i S7 k S2 S1 S0 e Bottom Bottom Bottom Bottom S TR AL () () Figure 2. The interleving simultion lgorithm t work stks. The ILS lgorithm mkes use of the glol t strutures S, T R, AL, n U pperboun. The ILS lgorithm lwys rememers the omplete pth, i.e., sttes n events, from the initil stte to the tul stte. The sttes re store in the stk S n the events, i.e., the tul tre, re store in T R. The lterntives re store in AL. In se of innite ehvior termintion riterion is neee. We use length restrition for the exmine tres. The mximl length is given y the onstnt U pperboun. The wy how the ILS lgorithm explores the ehvior of n SDL system is shown shemtilly in Figure 2. The she rrow in () inites the wy through the stte spe of the investigte system. () esries the ontents of S, T R, n AL immeitely fter the exeution of, i.e., the tul stte is S2. 3. Exmple In Figure 3 smll SDL speition is presente. The system is lle Exmple. It onsists of the proesses P1, P2, n P3. The proesses o not ommunite with the system environment, i.e., the system is lose. The system is nite, i.e., the system ehvior ens in glol stte where the lol stte of P2 is P2 Stte, n the proesses P1 n P3 re stoppe. P1, P2, n P3 exhnge the signls,,, n. Proess P1 my perform two events in ritrry orer. The events re the reeption of from P2 n the sening of to P2. Proess P3 hs similr ehvior. It my perform the reeption of from P2 n the sening of to P2 in ritrry orer. Proess P2 rets on the reeption of the signls n. On the input of it gives to P3 n on the reeption of, signl is sent to P1. A etile nlysis shows tht some signls my ross eh other. This pplies for the signls n, n for the signls n. Applying the ILS lgorithm will le to n explortion of the ehvior tree shown in Figure 4. The sttes re not insrie with stte nmes euse we re intereste in tres only. The eges re nnotte with event esriptions. A '!' enotes n output event, e.g., the nnottion! esries the output of signl, n '?' esries n input, e.g., represents the input of signl. The proess whih performs the sen or reeive event nees no speil ientition. Eh signl n e sent, resp. reeive,
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 5 System Exmple SDL Overview Proess P1 P1_Pge(1) Blok Exmple P1 (1,1) P1_Stte1 P2 (1,1) P3 (1,1) SR12 SR23 P1_Stte2 NONE NONE P1_Stte3 () System igrm () Proess enition of P1 Proess P2 P2_Pge(1) Proess P3 P3_Pge(1) P3_Stte1 P2_Stte NONE P3_Stte2 NONE P3_Stte3 P2_Stte () Proess enition of P2 () Proess enition of P3 Figure 3. SDL speition of the exmple system
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 6!!!!!!!!!! Figure 4. Applying the ILS lgorithm to the exmple system y one proess only. The input NONE events in P1 n P3 re omitte euse they esrie no ommunition events. They speify the spontneous sening of n. Sine prllelism is esrie y ll interleve tres of onurrently exeute events the ehvior tree in Figure 4 looks omplite. Vrious tres of Figure 4 elong to the sme onurrent exeution. Within onur-
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 7 ms MSC1 P1 P2 P3 ms MSC2 P1 P2 P3 () () ms MSC3 P1 P2 P3 ms MSC4 P1 P2 P3 () Figure 5. Conurrent exeutions of the exmple system () rent exeution only the usl epenenies etween events re onsiere whih result in prtilly orere set of events in ontrry to tres in whih the events re orere totlly with respet to their exeution time. The onurrent exeutions n e esrie in ompt n intuitive mnner y using Messge Sequene Chrts (MSCs) [11]. Our SDL exmple (f. Figure 3) hs four onurrent exeutions. They re epite in Figure 5. The vli tres elonging to n MSC re esrie y the tres whih o not violte the prtil orer of the MSC. Our im is to generte one tre only for eh onurrent exeution. By using the knowlege tht the events of one proess re totlly orere in time n tht the orer of events of ierent proesses re meite y messges n MSC representtion of the onurrent exeution n e onstrute from eh tre. 4. The Inepenene Prioritizing Simultion lgorithm During the simultion proess the ILS lgorithm ienties the onurrently enle events for eh rehe stte. Uner ertin onitions suh events n e exeute in ritrry orer. The ie of the Inepenene Prioritizing Simultion (IPS) lgorithm is to tke vntge of this ft. Inepenently from our work, similr ie hs een investigte y Holzmnn n Pele [5]. But, their pproh is pte to the spei nees of verition n not to the nees of test se genertion n the simultion of SDL systems. However, t rst we hve to ene the onitions whih hve to e heke uring the simultion of the SDL system. We ene three onitions whih ientify epenent events, i.e., events whih nnot e exeute in ritrry orer. For presenting ompt onition formuls we nee some enitions n nottions.
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 8 For n ritrry SDL system with nite set of events 4 let O e the set of output events, I e the set of input events, ST e the set of spontneous trnsitions (input NONE), T e the set of timeout events, P e enote the proess exeuting the event e, Q e the input queue ete y the exeution of event e, initites(e i ; e j ) funtion whih returns true, if e i, e j elong to the sme SDL stte trnsition n e i 2 ST [ T, n Dep(e i ; e j ) stte tht e i n e j re epenent. Conition 1. Generlly we ssume tht hnnels n signlroutes re unelye. In this se output events, tht o not originte from the sme proess, ut o et the sme input queue, inuene the onurrent exeution. This is expresse formlly y: if e i ; e j 2 O ^ P e i 6= P e j ^ Q e i = Q e j then Dep(e i; e j ) Conition 2. Consier the se, where signl n e onsume n spontneous trnsition or timeout is possile. Then the SDL proess hs to mke n ineterministi hoie etween the ierent events. The hoie inuenes the onurrent exeution. This is formlly expresse y: if P e i = P e j ^ e i ; e j 2 I [ T [ ST ^ (e i 62 I _ e j 62 I) then Dep(e i ; e j ) Conition 3. If n SDL stte trnsition is initite y n event e n nother event e j of this SDL stte trnsition is epenent on nother event e k, then e must e epenent on e k too. This is formlly expresse y: if Dep(e j ; e k ) ^ initites(e ; e j ) then Dep(e ; e k ) The onitions 1-3 re se on the ontrol n signl ow of n SDL system. Therefore they re only pplile to systems whih o not shre vriles etween proesses, i.e., the use of the onstruts view, export, import n remote proeure ll is prohiite. A further restrition onerning the use of elye hnnels hs een mentione lrey in the esription of Conition 1. It is ovious, tht the existing onitions n e rene n preise. The vntge of the onitions 1-3 is, tht they n e heke sttilly efore the simultion strts. The epenenies etween events o not hnge uring run time. For esriing the IPS lgorithm enition of the terms inepenent n glolly inepenent is neee. Denition of inepenent n glolly inepenent. Let E e ll events of n SDL system n e,e i 2 E. e n e i re inepenent if none of the onitions 1-3 is vli. e is glolly inepenent if 8e i 2 Enfeg : e n e i re inepenent. 4 Equl events in ierent SDL stte trnsitions re ment to e ierent events.
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 9 1 elre glol 2 S stk of sttes := (initilize()); 3 T R stk of events := (); 4 AL stk of stk of events := (); 5 U pperboun integer onstnt := externl; 6 7 InepeneneP rioritizingsimultion() 8 f 9 if (9e 2 enle-events(top(s)) : e is glolly inepenent) 10 then push(al; (e)) 11 else push(al; enle-events(top(s))); 12 while(:isempty(top(al)) ^ length(t R) < U pperboun) 13 f 14 e := top(top(al)); 15 push(s; exeute-event(top(s); e)); 16 push(t R; e); 17 push(al; rest(pop(al))); 18 ll : InepeneneP rioritizingsimultion(); 19 g 20 pop(s); pop(t R); pop(al); 21 g Figure 6. Inepenene Prioritizing Simultion (IPS) lgorithm Roughly spoken, the exeution orer of glolly inepenent events whih re enle onurrently hs no inuene on the orresponing onurrent exeution. Therefore we re llowe to ssume n ritrry exeution orer of these events without running the nger to loose ny onurrent exeution. This ie is relize in the Inepenene Prioritizing Simultion lgorithm (IPS) whih is shown in Figure 6. The IPS lgorithm works in similr mnner s the ILS lgorithm (f. Figure 1). But, if there re glolly inepenent events enle in stte s, n ritrry one is selete s the only trnsition whih is exeute from s (f. lines 9-11 in Figure 6). By pplying the IPS lgorithm to our exmple system the ehvior tree (f. Figure 7) is reue from 34 to six pths. Eh one of the events,, n is glolly inepenent n the following six pirs of events re epenent: (!;!), (!;!), (!; ), (;!), (;!), n (!; ). It is ovious, tht the IPS lgorithm is not pplile if the system ehvior inlues loop of glolly inepenent events. Furthermore the lgorithm oes not hieve ny improvement if ll events re epenent. 5. The Conition Loking Simultion lgorithm The pplition of the IPS lgorithm les to the explortion of six ierent tres lthough we n istinguish four onurrent exeutions only. In this setion we present n
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 10!!!!!! Figure 7. Applying the IPS lgorithm to the exmple system lgorithm whih explores one tre only for eh onurrent exeution. The lgorithm is expline y mens of nite system onsisting of n events e 1 ; : : : ; e n whih permits tres of nite length only. Sine the exeution orer of inepenent events my e neglete, onurrent exeution is ene y the exeution orer of the epenent events. We represent onurrent exeution uniquely y using n nn mtrix. Only some els of the mtrix re lle with oolen vlues. A el t lotion (i; j) is lle if the events e i n e j re epenent. The vlue is true if e i is exeute efore e j. Otherwise it is flse. The mtrix is lle onition mtrix (CM) n the mtrix els CM(1 : : : n; 1 : : : n) re lle onitions. Now our prolem of generting one tre only for eh onurrent exeution is reue to the prolem of omputing eh possile onition mtrix extly one. Consier the se where n SDL system S with the initil stte s 0 is in the tul stte s. Let s 1 ; : : : ; s n e the possile suessor sttes of s, e 1 ; : : : ; e n e the events leing from s to s 1 ; : : : ; s n, Def s e the set of onitions whose oolen vlues re ene y the simultion from the initil stte s 0 to s (if s is the initil stte Def s = ;), Uef s e the onitions whose vlues re not ene yet, T r e1 := fcm(1; n) j Dep(e 1 ; e n ) ^ e 1 is exeute efore e n g is the set of onitions whih evlute to true when e 1 is exeute, n F e1 := fcm(n; 1) j Dep(e n ; e 1 ) ^ e 1 is exeute efore e n g is the set of onitions whih evlute to flse when e 1 is exeute. When e 1 is exeute the system hnges to the new stte s 1. The sets Def s1 n Uef s1 re lulte y Def s1 := Def s [ T r e1 [ F e1 n Uef s1 := Uef s n(t r e1 [ F e1 ).
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 11 The onept of the onition mtrix n the lultion of the sets n e integrte into the IPS lgorithm. All possile onition mtries will e generte t lest one. The result will e the sme s using the originl IPS lgorithm (f. Setion 4), i.e., ertin onition mtries will e generte more thn one. We esrie the prolem y using smll exmple. Consier the sitution where the system S is in the stte s n the events e 1 n e 2 n e exeute next. The events e 1 n e 2 re inepenent, ut not glolly inepenent. Therefore uring simultion they re trete s lterntives. Both lterntives will e exmine lthough e 1 n e 2 n e exeute in ritrry orer without hving ny inuene on the orresponing onurrent exeution. This n e shown y lulting the sets ene ove. Let s 12 e the stte whih is rehe if e 1 is exeute efore e 2 n let s 21 e the stte whih is rehe if e 2 is exeute efore s 1. Then: Def s12 = (Def s [T r e1 [F e1 )[T r e2 [F e2 = (Def s [T r e2 [F e2 )[T r e1 [F e1 = Def s21 n Uef s12 = Uef s n(t r e1 [F e1 [T r e2 [F e2 ) = Uef s n(t r e2 [F e2 [T r e1 [F e1 ) = Uef s21 The solution to this prolem is to evlute the simultion run strting in stte s with event e 1 in the norml mnner, n to lok the exeution of e 1 when the lterntive run strting in s with e 2 is exmine until we n gurntee tht n lrey ompute onition mtrix nnot e generte gin. This n e gurntee if onition CM(1; n) 2 T r e1 ^ Uef s hnges its vlue to flse. Suh riterion n e heke uring the simultion proess. The lgorithm implementing the ies of onition mtrix n event loking is lle Conition Loking Simultion (CLS) lgorithm. It retes eh possile onition mtrix extly one. The proof for this n forml esription of the lgorithm n e foun in [8]. In the following the CLS lgorithm is esrie informlly y referring to the IPS lgorithm presente in Figure 6 n explining the hnges to e me: Glol t strutures (lines 1-5) { In ition to the glol t strutures of IPS the CLS lgorithm uses onition mtrix CM n stk of stks of loke events (LE). Evlution of the enle events (lines 9-11) { elete ll events from the list of enle events whih re store within the top element of LE. Forwr steps (lines 14-18) { mke opy of the top element of LE n push it onto LE { elete ll events from LE whih re epenent to e { enter the hnges use y the exeution of e into CM { fter the forwr step (line 18) push e onto the top element of LE Bkwr step (line 20) { uno the hnges in CM use y the exeution of the event store in the top element of T R { pop the top element from the LE stk
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 12!!!!!! Figure 8. Applying the CLS lgorithm to the exmple system By pplying the CLS lgorithm to our exmple four tres re explore. The orresponing ehvior tree is presente in Figure 8. The CLS lgorithm hs een expline y mens of stti n nite system whih permits only tres of nite length. For the tretment of innite SDL systems we generlize the CLS lgorithm. The generliztion hs to ope with ynmi onition mtries. The etils n e foun in [8]. 6. Experiments The presente lgorithms ILS, IPS, n CLS re implemente. We ompre their pilities y using them to simulte test rhiteture of the Inres protool [3]. Here we present the results of three experiments whih hve een rrie out on Sun Spr 5 worksttion. Spee of the lgorithms. We mesure the numer of sttes generte per seon. The ext vlues of this experiment re shown in Figure 9. Astonishingly the ILS lgorithm is slower then IPS n CLS. The reson for this is tht, in generl the ILS lgorithm hs to store more lterntively enle events for eh stte. Exploring omplete ehvior tree up to given epth. The results of this test re shown in Figure 10. The epth of the tree is esrie on the horizontl xis. The numer of generte noes is presente in logrithmi sle long the vertil xis. The experiments show tht the prtil orer simultion lgorithms llow to explore ehvior trees up to igger epth thn the interleving simultion. Genertion of test ses. The lgorithms hve een implemente in the SMsTG test se genertor [2,7]. We generte test se for the Inres protool. We use
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 13 Algorithm Mximl Spee Miniml Spee sttes per seon sttes per seon ILS 1111 909 IPS 1111 1000 CLS 1111 1000 Figure 9. The spee of the lgorithms 1e+06 100000 ILS IPS CLS numer of expne noes 10000 1000 100 10 0 10 20 30 40 50 60 70 80 90 100 epth of serhtree Figure 10. Exploring omplete ehvior trees Algorithm ILS IPS CLS Consume time Interrupte fter 7 hours, more thn 10 mio sttes hve een explore 8'33" 3'39" Figure 11. Using ILS, IPS, n CLS for test se genertion test purpose whih heks the t trnsfer with n knowlegement fter the rst trnsmission of the t pkge. The results of this experiment re shown in Figure 11. They emphzise the power of prtil orer simultion methos for test se genertion. 7. Summry n outlook We presente two lgorithms whih pt the ies of prtil orer simultion methos to SDL speitions. The lgorithms re implemente n their power for the utomti
SDL'95 - Proeeings of the 7th SDL Forum, 25.-29. Sept. 1995, Oslo, Norwy 14 genertion of test ses hs een proven y some experiments. However, the rst version of the SMsTG tool uses interleving simultion for test se genertion. In orer to reue the omplexity of the genertion proess we implemente itionl heuristis like resonle environment or strong resonle timers [7]. These heuristis hve proven to e useful for interleving simultion. Consequently, we strte to investigte whether these heuristis lso improve the test se genertion se on prtil orer simultion methos. Aknowlegements The presente work is fune prtilly y the KWF-Projet No. 2555.1 'Grphil Methos in the Test Proess', the R & D projet No. 299 'Conformne Testing - A Tool for the Genertion of Test Cses' fune y Swiss PTT, n the SPP IF projet 'The Automti Genertion of Test Purposes'. The uthors woul like to thnk Dr. E. Ruolph for proofreing n vlule omments. REFERENCES 1. P. Goefroi. Prtil-Orer Methos for the Verition of Conurrent Systems { An Approh to the Stte-Explosion Prolem. PhD thesis, Universite e Liege, Fulte es Sienes Appliquees, Otoer 1994. 2. J. Growski, D. Hogrefe, R. Nhm. Test Cse Genertion with Test Purpose Speition y MSCs. In: SDL'93 - Using Ojets. North-Holln, Otoer 1993. 3. D. Hogrefe. OSI Forml Speition Cse Stuy: The INRES Protool n Servie. Tehnil Report IAM-91-012, University of Berne, My 1991. Upte My 1992. 4. G. Holzmnn, P. Goefroi, D. Pirottin. Coverge Preserving Reution Strtegies for Rehility Anlysis. In: Proeeings 12th IFIP WG 6.1 Interntionl Symposium on Protool Speition Testing n Verition. North-Holln, June 1992. 5. G. Holzmnn n D. Pele. An Improvement in Forml Verition. In: Proeeings of Seventh Interntionl Conferene on Forml Desription Tehniques (FORTE'94) in Berne (Switzerln), Otoer 1994. 6. R. Lngerk. True Conurreny Moels for LOTOS. In: FORTE'94 - Tutoril Notes, Otoer 1994. 7. R. Nhm. Conformne Testing Bse on Forml Desription Tehniques n Messge Sequene Chrts. PhD thesis, University of Berne, Ferury 1994. 8. D. Toggweiler. Eient Test Genertion for Distriute Systems Speie y Automt. PhD thesis, University of Berne, My 1995. 9. P. Wolper, P. Goefroi. Prtil-orer Methos for Temporl Verition. In: CON- CUR'93, 4th Interntionl Conferene on Conurreny Theory, Leture Notes in Computer Siene, vol. 715, Springer-Verlg. August 1993. 10. Z.100 (1993), CCITT Speition n Desription Lnguge (SDL), ITU-T, June 1994. 11. Z.120 (1993), Messge Sequene Chrt (MSC), ITU-T, Septemer 1994.