Scenario Synthesis from Imprecise Requirements

Scenario Synthesis from Imprecise Requirements Bill Mitchell, Robert Thomson, Paul Bristow

Enterprise Development Process Groups Feature System Customers Technical Marketing Requirements System Requirements Technical Marketing Feature Teams High Level Designs Component Requirements Box Teams Functional Requirements Architecture Requirements Integration Teams Detailed Designs Testing Teams Standards

Telecoms Example Network Infrastructure User InterfaceJava Game Menu Java GameRepository • Network provider deploying 3G. • Placing order for handsets. • One of the many features included will be access to network Java game repository.

Initial Customer Requirements Handset Network User Menu Key Options Select Fetch Resource Java Game Confirmation

Technical Marketing Scenarios Signal Signal Battery Battery Java Games • Doom 8 • Quake 9 • etc...... Back Menu Select Each eventmodifies functionality and UI configuration Power Java Ack Java Key Press B1 B2 B3 B4 B5 B6 Customer Scenariobroken down intosequence of atomicevents, which changeinterface functionality. Default ScreenDisplay Ph. Bk Menu Hold Power Java Ack B1 B2 B3 B4 B5 B6

Functional Requirements

Technical Marketing Scenarios • Normative scenarios are very focused on isolated behaviour of feature in these requirements: • What if voice or data call received during download? • If memory is expandable (as with some PIM-phone hybrids) how should the mem-full error be handled if the user could add extra memory with, say, a USB flash memory stick? • What if during the download the network service provider tries to update the phone configuration via the air interface for enhanced game play? • Need to synthesise model of system from all MSC requirements scenarios for simulation and analysis. • Problem: • Practitioners use states imprecisely • Different engineering groups define scenarios differently • Legacy requirements

Deadlock example from TETRA PPT ruthless pre-empt A B FSA for A S0 S0 S0 !a !b a S1 S1 S1 !c ?d c S2 S2 S2 S3 FSA for B A B S0 S0 S0 ?a ?b b S1 S1 S1 ?c !d d S2 S3 S3 S3 agreed pre-empt

Example Deadlock Avoided • Composite States • Anonymous internal states • Multiple entry/exit states ruthless pre-empt A A B B Extended DFSA for A S0 S0 S0 a a S0 S3 S1 S1 S1 c c S2 S2 S2 !a !b ?d S1 S2 A A B B S0 S0 S0 !c b b S1 S1 S1 d d Too Weak to ever give any interactions! S3 S3 S3 agreed pre-empt

Example, Call Waiting from paper in FIW 2000 call(B) accept(D) hang_up_on(C) ack_accept(D) disconnect(B) call_active(B) Sys B C D call_active[B,C] call_setup[B] idle call_active[B,D]

Example, RBWF, from paper in FIW 2000 A Sys B call_setup[B] call_active[B,C] call(B) rbwf(B) hang_up_on(C) idle ring(A,B) ring(A,B) rbwf_call_progressing[A,B]

Example, FI from paper in FIW 2000 call(B) rbwf(B) call(B) accept(D) Whenever in these composite states CW can happen hang_up_on(C) ack_accept(D) disconnect(B) idle call_active(B) call_active[B,D] A Sys B C D call_active[B,C] call_setup[B] call_setup[B] call_active[B,C] idle

Trace semantics for states t2 t1 x u y x For every trace t1 of In there is a path For every trace t2 of Outthere is a path some initial state u some accepting state y S0 S1 S2 !a ?b ?d !c u v w x y State x is (In, Out), where In and Out are sets of traces.

Deterministic trace semantics t2 t1 x u y x For any t1 of In if there is a path then for every trace t2 of Outthere is a path for some initial state u for some accepting state y S0 S1 S2 !a ?b ?d !c u v w x y

MSC trace semantics for exit/entry states t2 t1 x u y x then there is a path For any t1 if there is a path for any state u for some state y S0 S1 S2 !a ?b ?d !c u v w x y Every MSC trace t can be split into pairs (t1,t2) where t1 leads to exit state.

State semantics S3 ?e y’ S0: !c S1: ?e S0: ?b S0 S1 ?b !c v’ w’ x’

Overlapping Processes, continued S0: !a S0: ?b S0: !c Match e S0: ?b S0: !c Scenario 1, machine for A S0 S1 S2 !a ?b ?d !c u v w x y Scenario 2, machine for A S0 S1 S3 ?b ?e !c v’ w’ x’ y’

Overlapping Composition of Processes P trace simulates Q when: given any (state annotated) execution traces t1 and t2: t1 t2 P Q P1 Q1 where t1 matches t2, then P1 must be able to simulate Q1

Livelock from naive composite state semantics ?b !a DFSA for A A B !a S0 S0 a ?b b !a x y S0 a ?b b S1 S1 S1

Exit State transition matching t1 t2 P Q P1 Q1 P trace simulates Q when: given any (state annotated) execution traces t1 and t2: where t1 matches t2, and t1, t2 have reached exit states then P1 must be able to simulate Q1. where t1 matches t2, and t1, t2 have reached entry states then P1 must be able to simulate Q1.

Temporal contexts for defining matching traces LTL semantics for execution trace LTL formula defining context Event Composite state

Scenario Synthesis from Imprecise Requirements