Compositional Message Sequence Charts

A message sequence chart (MSC) is a standard notation for describing the interaction between communicating objects. It is popular among the designers of communication protocols. MSCs enjoy both a visual and a textual representation. High-level MSCs (HMSCs) allow specifying infinite scenarios and different choices. Specifically, an HMSC consists of a graph, where each node is a finite MSC with matched send and receive events, and vice versa. In this paper we demonstrate a weakness of HMSCs, which disallows one to model certain interactions. We will show, by means of an example, that some simple finite state communication protocol cannot be represented using HMSCs. We then propose an extension to the MSC standard which allows HMSC nodes to include unmatched messages. The corresponding graph notation will be called HCMSC, which stands for high-level Compositional message sequence charts. With the extended framework, we provide an algorithm for automatically constructing an MSC representation for finite state asynchronous message passing protocols.

Message Sequence Charts (MSCs) is a visual formalism for the descrip- tion of communication behaviour of distributed systems. An MSC specifies relations between communication events with partial orders. A situation when two visually ordered events may occur in any order during an execution of an MSC is called a race and is usually considered as a design error. While there is a quadratic time al- gorithm detecting races in a finite communication behaviours called Basic Message Sequence Charts (BMSCs), the race detection problem is undecidable for High-level Message Sequence Charts (HMSCs), an MSC formalism describing potentially infi- nite sets of potentially unbounded behaviours. To improve this negative situation for HMSCs, we introduce two new notions: a new concept of race called trace-race and an extension of the HMSC formalism with open coregions, i.e. coregions that can extend over more than one BMSC. We present three arguments showing benefits of our notions over the standard notions of race and HMSC. First, every trace-race-free HMSC is also race-free. Second, every race-free HMSC can be equivalently ex- pressed as a trace-race-free HMSC with open coregions. Last, the trace-race detec- tion problem for HMSC with open coregions is decidable and PSPACE-complete. Finally, the proposed extension of coregions allows to represent in a visual fash- ion whether an arbitrary number of racing events in the usual MSC formalism are concurrent or not.

Communicating state machines provide a formal foundation for distributed computation. Unfortunately, they are Turing-complete and, thus, challenging to analyse. In this paper, we classify restrictions on channels which have been proposed to work around the undecidability of verification questions. We compare half-duplex communication, existential B-boundedness, and k-synchronisability. These restrictions do not prevent the communication channels from growing arbitrarily large but still restrict the power of the model. Each restriction gives rise to a set of languages so, for every pair of restrictions, we check whether one subsumes the other or if they are incomparable. We investigate their relationship in two different contexts: first, the one of communicating state machines, and, second, the one of communication protocol specifications using high-level message sequence charts. Surprisingly, these two contexts yield different conclusions. In addition, we integrate multiparty session types, another approach to specify communication protocols, into our classification. We show that multiparty session type languages are half-duplex, existentially 1-bounded, and 1-synchronisable. To show this result, we provide the first formal embedding of multiparty session types into high-level message sequence charts.

Scenario-based specifications such as Message Sequence Charts (MSCs) are becoming increasingly popular as part of a requirements specification. Scenario describe how system components, the environment and users work concurrently and interact in order to provide system level functionality. Each scenario is a partial story which, when combined with other scenarios, should conform to provide a complete system description. However, although it is possible to build a set of components such that each component behaves in accordance with the set of scenarios, their composition may not provide the required system behaviour. Implied scenarios may appear as a result of unexpected component interaction. In this paper, we present an algorithm that builds a labelled transition system (LTS) behaviour model that describes the closest possible implementation for a specification based on basic and high-level MSCs. We also present a technique for detecting and providing feedback on the existence of implied scenarios. We have integrated these procedures into the Labelled Transition System Analyser (LTSA), which allows for model checking and animation of the behaviour model.

Existing notations for expressing time constraints in high-level message sequence charts (HMSC) may cause ambiguity when used with HMSC compositions such as alternative and iteration. To overcome such limitation, we propose timed high-level message sequence charts (THMSC) which include an unambiguous subset of time constraints and timed edges as a new complementary notation. THMSC is effective in accurately specifying popular requirement patterns such as watchdog timers and periodic tasks. We present the formal semantics and demonstrate the effectiveness of THMSC using a real-world example that formalizes timing requirements for Korea Multi-Purpose Satellite (KOMPSAT) software.

Networks of Hybrid Automata are a clean modelling framework for complex systems with discrete and continuous dynamics. Message Sequence Charts (MSCs) are a consolidated language to describe desired behaviors of a network of interacting components. Techniques to analyze the feasibility of an MSC over a given HA network are based on specialized bounded model checking techniques, and focus on efficiently constructing traces of the network that witness the MSC behavior. Unfortunately, these techniques are unable to deal with the “unfeasibility” of the MSC, i.e. that no trace of the network satisfies the MSC. In this paper, we tackle the problem of MSC unfeasibility: first, we propose specialized techniques to prove that an MSC can not be satisfied by any trace of a given HA network; second, we show how to explain why an MSC is unfeasible. The approach is cast in an SMT-based verification framework, using a local time semantics, where the timescales of the automata in the network are synchronized upon shared events. In order to prove unfeasibility, we generalize k-induction to deal with the structure of the MSC, so that the simple path condition is localized to each fragment of the MSC. The explanations are provided as formulas in the variables representing the time points of the events of the MSCs, and are generated using unsatisfiable core extraction and interpolation. An experimental evaluation demonstrates the effectiveness of the approach in proving unfeasibility, and the adequacy of the automatically generated explanations.

Message Sequence Charts (MSCs) is a standardized visual notation for expressing requirements in communicating systems. MSCs are commonly used to specify scenarios describing message exchange among entities such as objects, components, systems, etc. A multiplicity is a modeling construct that is used to define constraints in the existential relationships between entities and it is frequently found in static models, such as class or entity diagrams. This paper describes a formal approach for formalizing the combination of MSCs with multiplicities. The formalization is achieved by defining an instantiation partial function that provides a clear interpretation of how to instantiate MSCs with multiplicities. The formalization uses composition operators that are used to formalize inline expressions (a well-known MSCs modeling construct). This formalization is designed to allow integration with the current formal semantics proposed for MSCs

Message Sequence Charts (MSCs) are an attractive visual formalism<br /> widely used to capture system requirements during the early<br />design stages in domains such as telecommunication software. It is<br />fruitful to have mechanisms for specifying and reasoning about <br />collections of MSCs so that errors can be detected even at the requirements<br /> level. We propose, accordingly, a notion of regularity for <br />collections of MSCs and explore its basic properties. In particular, we<br />provide an automata-theoretic characterization of regular MSC <br />languages in terms of finite-state distributed automata called bounded<br />message-passing automata. These automata consist of a set of <br />sequential processes that communicate with each other by sending and<br />receiving messages over bounded FIFO channels. We also provide a<br />logical characterization in terms of a natural monadic second-order<br />logic interpreted over MSCs.<br />A commonly used technique to generate a collection of MSCs is<br />to use a Message Sequence Graph (MSG). We show that the class of<br />languages arising from the so-called locally synchronized MSGs constitute<br /> a proper subclass of the languages which are regular in our sense.<br />In fact, we characterize the locally synchronized MSG languages as<br />the subclass of regular MSC languages that are finitely generated.

Message sequence charts (MSC) are widely used in the early design of communication protocols. They allow describing the communication skeleton of a system. We consider a basic verification task for hierarchical MSCs, the matching problem via MSC templates. We characterize the complexity of checking properties which are expressible by and-or templates, resp. by LTL formulas. Both problems are shown to be PSPACE-complete.

Message sequence charts (MSCs) are one widespread method for understanding interactions between components within complex systems. Although the language for MSCs is standardized, techniques for displaying them are far from standard and the current test and typographic based methods do not scale to industrial sized MSCs. We have developed some novel displays of MSCs that use color, interaction, and linked views to display large MSCs and verified their effectiveness with a user study.

We study the notion of safe realizability and implied scenarios for Message Sequence Chart (MSC) specifications with the following contributions: (1) We investigate the cause of implied scenarios and show that even though implied scenarios are an artifact of the distributed and global system behaviour, nevertheless, they are the result of the nondeterminism in the local behaviour of processes, (2) Instead of deadlock states and safe realizability for MSC specifications, we introduce the notions of stuck states and strong safe realizability. Moreover, we use emergent scenarios to name both implied scenarios and those anomalies of MSC specifications that are captured by the notion of strong safe realizability, (3) We give an algorithm that reduces strong safe realizability (or safe realizability) of MSC specifications to strong safe realizability (or safe realizability) of a set of MSCs.

Message Sequence Charts (MSC) have been traditionally used to depict execution scenarios in the early stages of design cycle. MSCs portray inter-object interactions. Synthesizing intra-object executable specifications from an MSC-based description is a non-trivial task. Here we present a model of computation called Communicating Transaction Processes (CTP) based on MSCs from which an executable specification can be extracted in a straightforward manner. Our model describes a network of communicating processes in which the processes interact via common action labels. Each action is a non-atomic interaction described as a guarded choice of MSCs. Thus our model achieves a separation of concerns: the high-level network of processes depicting intra-process computations and control flow, while the common non-atomic communication actions capture inter-process interaction viaMSCs. We show how to extract an ordinary Petri net from a CTP model thereby leading to a standard operational semantics. We also discuss the connection of our formalism to Live Sequence Charts, an extension of MSCs which also has an executable semantics.

The UML 2.0 integrates a dialect of High-Level Message Sequence Charts (HMSCs) for interaction modelling. We describe a translation of UML 2.0 interactions into automata for model checking whether an interaction can be satisfied by a given set of message exchanging UML state machines. The translation supports basic interactions, state invariants, strict and weak sequencing, alternatives, ignores, and loops as well as forbidden interaction fragments. The translation is integrated into the UML model checking tool HUGO/RT.

Message sequence charts (MSCs) are commonly used to specify interactions between agents in communicating systems. Their visual nature makes them attractive for describing scenarios, but also leads to ambiguities that can result in incomplete or inconsistent descriptions. One such problem is that of implied scenarios—a set of MSCs may imply new MSCs which are “locally consistent” with the given set. If local consistency is defined in terms of local projections of actions along each process, it is undecidable whether a set of MSCs is closed with respect to implied scenarios, even for regular MSC languages [3]. We introduce a new and natural notion of local consistency called causal closure, based on the causal view of a process—all the information it collects, directly or indirectly, through its actions. Our main result is that checking whether a set of MSCs is closed with respect to implied scenarios modulo causal closure is decidable for regular MSC languages.

In testing systems with distributed interfaces/ports, we may place a separate tester at each port. It is known that this approach can introduce <it>controllability problems</it> which have received much attention in testing from finite state machines. Message sequence charts (MSCs) form an alternative, commonly used, language for modelling distributed systems. However, controllability problems in testing from MSCs have not been thoroughly investigated. In this paper, controllability problems in MSC test cases are analysed with three notions of observability: local, tester and global. We identify two types of controllability problem in MSC-based testing. It transpires that each type of controllability problem is related to a type of MSC pathology. <it>Controllability problems of timing</it> are caused by races but not every race causes controllability problems; <it>controllability problems of choice</it> are caused by non-local choices and not every non-local choice causes controllability problems. We show that some controllability problems of timing are avoidable and some controllability problems of choice can be overcome when testers have better observational power. Algorithms are provided to tackle both types of controllability problems. Finally, we show how one can overcome controllability problems using a coordination service with status messages based on algorithms developed in this paper.