We consider the problems of verifying properties of LOTOS speci cations with speci c reference t o t w o case studies, one of which was proposed b y a n i n d u strial collaborator. The case studies present quite different veri cation requirements and we study a range of veri cation and validation techniques, based o n various behavioural congruences and preorders, which may be applied, also using some mechanised t o ol support. We consider the implications of the (formal) proofs which succeed or fail with respect to our desired properties, and draw some conclusions about the verication process. what we can conclude about the state of the art in LOTOS veri cation. In this paper we g i v e a n o verview of some of the work we h a ve carried out, including the techniques and tools used, and two kinds of case studies considered. We describe our experiences with two particular case studies in some detail: a communications protocol and a control device for a dual mode radiotherapy m a c hine. The former case study originates from a major U.K. defence contractor and the latter is an abstraction of a real machine. While some aspects of these two particular studies have been reported elsewhere, e.g. in 13] and 24], we use these two studies here to illustrate what we h a ve learned about various aspects of the veri cation issues given above, as well as reporting on further work on the studies. LOTOSThe reader is referred to the LOTOS standard 10] and 1] for an introduction to LOTOS. LOTOS consists of two parts: so-called Basic LOTOS, for describing interaction and ow o f c o n trol, and ACT ONE, for describing equationally speci ed abstract data types. Basic LOTOS is very similar to CCS 21], drawing some aspects, particularly multi-way s y n c hronisation, from CSP 9].The semantics of LOTOS speci cations are given by structured labelled transition systems (de ned by inference rules). Various relations based on observable behaviour may be de ned over these systems we have found the most useful relations for veri cation purposes are weak bisimulation congruence and the testing relation cred. The full de nitions of these relations may be found in 10].Brie y, t wo processes are weak bisimulation congruent if they have the same observable behaviour in all contexts, ignoring occurrences of the internal action, and two processes are related via the cred preorder if, in all contexts, whenever one process passes a test, the other process does too. We c hoose these relations as the system under examination will probably have t o interact with other systems, therefore it is important that it behaves in the same way in all contexts.

We explore some of the problems of verification by trying ~o prove that some sort of relationship holds between a given specification and implementation. We are particularly interested in the decisions taken in the process of establishing and formalising the verification requirements and of automating the proof. Despite the apparent simplicity of the original problem, the verification is non-trivial. The example chosen is an abstraction of a real communications problem. We use the formal description technique LOTOS [8] for specification and implementation, and equational reasoning, automated by the RIRL term rewriting system [9], for the proof.

Temporal logic can be used to describe desirable properties of a system in a more abstract, less constructive, manner than when using process algebra alone. This is a well researched area for other process algebras, but not so for LOTOS. This paper is an initial attempt to fill that gap by investigating the use of the modal 11-calculus with Basic LOTOS, laying the groundwork for current work on Full LOTOS, i.e. including data types, and logic.

Introduction

No abstract