Interactive Design and Verification: A Message Switching Network Example

Abstract

Traditionally, program verification systems have inadequately supported the incremental aspects of designing and verifying programs. For example, they provide only minimal assistance in determining what previous work is affected by changes to specifications. Problems of this general nature arise frequently and pose difficult challenges for the user. This paper describes and illustrates how several such problems have been largely overcome by a recently developed program verification system.

The illustration takes the form of a transcript from a working session in which a realistic message switching network is specified, implemented, and proved. The network allows a fixed number of users to communicate through a multilevel secure network. The basic interprocess communication paradigm is message passing (rather than shared memory). Roughly speaking, the specification of the network says that the mail received by each user process is a subsequence of the mail intended for it. This functional property is expressed as a hierarchically structured assertion about histories of message traffic among processes. The example is intended to be prototypical of how one could go about the more complicated task of structuring and formally specifying functional properties of real communications processing systems.