Abstract: A router has a shape graph that is a compressed form of a trie that represents routing information for routing data packets in a network, and an update data structure that includes plural entries corresponding to nodes of the shape graph, the plural entries containing count values indicating respective numbers of nodes of the tie represented by the corresponding nodes of the shape graph. The router incrementally updates the shape graph as a portion of the routing information changes, where the incremental updating uses information in the update data structure.

Abstract: A router has a shape graph that is a compressed form of a trie that represents routing information for routing data packets in a network, and an update data structure that includes plural entries corresponding to nodes of the shape graph, the plural entries containing count values indicating respective numbers of nodes of the tie represented by the corresponding nodes of the shape graph. The router incrementally updates the shape graph as a portion of the routing information changes, where the incremental updating uses information in the update data structure.

Abstract: A system and method for generating shape graphs for a routing table are described herein. The method includes splitting a binary trie representing a routing table of a router into a number of layers, wherein each layer includes a number of nodes. The method also includes, for each layer, determining a number of groups of isomorphic nodes and merging the isomorphic nodes within each group to generate a shape graph.

Abstract: A method and apparatus for generating a covering set of test cases from a directed graph is provided. The directed graph includes nodes and edges connecting the nodes, and a test case is a path through the directed graph. To generate a partial set of test cases, a set of selected test cases is received. These test cases can be manually selected or they can be a maintained test case set. The edges or nodes on the directed graph (or requirements linked to nodes or edges) that are covered by the selected test cases are marked with an identifier. Test cases are then generated from the directed graph according to a coverage algorithm. Marked graph elements may, but need not, be included in the generated test cases. The resulting partial test case set together with the selected test cases satisfy the coverage criterion.

Abstract: A system and method for determining whether a set of message sequence charts (MSCs) is realizable or safely realizable in an implementation is provided. The determination is made by analyzing the set of MSCs for the existence of unspecified, implied MSCs. If the set of MSCs can be realized in a deadlock-free automaton, then the set of MSCs is safely realizable. If the set of MSCs is realizable (no implied MSCs exist), a state machine can be synthesized from the set of MSCs. If the set of MSCs is not realizable, then implied, unspecified (partial) MSCs are produced. Also, given an undesirable MSC, the system determines whether the set of required MSCs implies the given undesired MSC.

Abstract: A system and method for direct black box system verification is provided. For any property, a sequence of inputs for the black box is determined that will verify that the system exhibits the property. Counterexamples of the property are detected without inferring the black box's internal structure; that is, the verification proceeds without identifying all states and state transitions of the black box. A specification automaton operable to exhibit undesirable system behavior is constructed and it is then determined whether an accepting execution exists on the intersection of the black box and the specification automaton. To determine whether such an execution exists, the black box is configured such that it can be reset to its initial state upon command and such that the system indicates when an input is disabled from a current state. When an input is enabled, the implementation transitions to the next state. If an input is disabled, then there is no intersection on the input string.

Abstract: Model checking for message sequence charts (MSCs), message sequence chart graphs and hierarchical message sequence chart graphs (HMSCs) is provided. To verify the behavior of a given MSC, MSC graph and HMSC, a specification automaton is constructed. This specification automaton specifies the undesirable executions of the model under analysis. From the model under analysis, linearizations are defined from the model and a finite test automaton is constructed from the linearizations. The test automaton and the specification automaton are combined and it is determined whether there is an execution in the intersection. Where no state in the specification automaton is reachable from the test automaton, the model is verified.

Abstract: Model checking is applied to a hierarchical state machine (i.e., a state machine having at least one state (i.e., a superstate) that is itself a state machine) without first flattening the hierarchical state machine. In one embodiment, the model checking involves one or more or reachability, cycle-detection, linear-time requirements, and branching-time requirements analyses. For reachability analysis, in addition to keeping track of whether states have been visited, the algorithm also keeps track of the exit nodes for each superstate. Cycle-detection analysis has two phases: a primary phase in which target states are identified and a secondary phase in which it is determined whether identified target states are part of closed processing paths or loops. For cycle-detection analysis, the algorithm keeps track of (1) whether states have been visited during the primary phase, (2) the exit nodes for each superstate, and (3) whether states have been visited during the secondary phase.

Abstract: Techniques and testers for testing a system U including the steps of (a) defining a formal specification of a logical property P that system U is required not to satisfy; (b) generating a passive testing module T based upon property P to monitor system U; (c) invoking a function F at specific invocation points during the execution of system U to compute an abstract representation of the state of system U at the current point of execution; (d) passing the abstract representation computed by function F to passive testing module T in order to determine whether the abstract representation of the execution of system U to the current point matches illegal property P; and (e) declaring a "fail" result if the abstract representation of the execution of system U to the current point matches illegal property P and declaring a "pass" result if the abstract representation of the execution of system U to the current point does not match illegal property P.

Abstract: Apparatus for developing and verifying systems. The disclosed apparatus employs a computationally-tractable technique for verifying whether a system made up of a set of processes, each of which has at least one delay constraint associated with it, satisfies a given temporal property. The technique deals with the verification as a language inclusion problem, i.e., it represents both the set of processes and the temporal property as automata and determines whether there is a restriction of the set of processes such that the language of the automaton representing the restricted set of processes is included in the language of the automaton representing the temporal property.