on; after changes in the specifications, to check that the system has not regressed. During all these stages, the simulation allows the detection of specification or design-level anomalies, preventing them to be embedded in the implementation. Once the code is loaded into a target device embedded into a complex test environment, each error detected is more difficult and expensive to analyze than during an SDL model simulation: the error can come not only from the specification but also from the coding, from the testing environment, from the hardware and SO on. Also, SDL simulation enables the execution of the specification before the target hardware and software platform is available: board, board support package, compiler and SO on. Validation of Communications Systems with SDL: The Art of SDL Simulation and Reachability Analysis. Laurent Doldi © 2003 John Wiley & Sons, Ltd ISBN: 0-470-85286-0 2 Validation of Communications Systems with SDL The SDL Simulators, especially in exhaustive mode, quickly find error scenarios far beyond human imagination: bugs that could appear after millions of devices have been sold, revealed by a modification of their environment, can be detected and fixed during the specification or design phase. Concerning safety-critical systems such as fault-tolerant aircraft systems architectures, medi- cal or car devices, the validation by simulation can prove formally that their specified behavior is correct, according to a set of criteria. 1.2 SDL, LANGUAGE TO MASTER COMPLEX SYSTEMS DEVELOPMENT 1.2.1 Overview of SDL SDL stands for Specification and Description Language. It is standardized by the ITU (Inter- national Telecommunication Union) in the Z.100 Recommendation [SDL00, SDL99]. In SDL-921, the architecture is modeled as a system containing blocks, as depicted in Figure 1.1. Each block may contain either blocks or processes. Each process contains an extended finite state machine. State machines communicate by exchanging signals through channels (or signal routes). system TCP_IP [sig1] [