Models for the Verification of Distributed Java Objects

of 22/22
Eric Madelaine OSMOSE -- WP2 -- Prague June 2004 Models for the Verification of Distributed Java Objects Eric Madelaine work with Tomás Barros, Rabéa Boulifa, Christophe Massol OASIS Project, INRIA Sophia Antipolis June 2004
  • date post

    03-Jan-2016
  • Category

    Documents

  • view

    19
  • download

    1

Embed Size (px)

description

Models for the Verification of Distributed Java Objects. Eric Madelaine work with Tomás Barros, Rabéa Boulifa, Christophe Massol OASIS Project, INRIA Sophia Antipolis June 2004. Goals. Analysis and verification software platform for behavioural properties of distributed applications. - PowerPoint PPT Presentation

Transcript of Models for the Verification of Distributed Java Objects

  • Models for the Verification of Distributed Java ObjectsEric Madelainework with Toms Barros, Raba Boulifa, Christophe Massol

    OASIS Project, INRIA Sophia AntipolisJune 2004

  • Goals Analysis and verification software platform for behavioural properties of distributed applications. Long term goal: full language, usable by non-specialists Automatic tools = static analysis, model-checkers, equivalence / preorder checkers.Graphical / Logical SpecificationsCode analysisModelAutomatic tools, diagnostics, etc.

  • PlanDistributed objects in ProActiveParameterized hierarchical modelsExtracting modelsCompositional verificationComponents

  • ProActive : distributed activitiesActive objects communicate by Remote Method Invocation.

    Each active object: has a request queue (always accepting incoming requests)has a body specifying its behaviour (local state and computation, service of requests, submission of requests)manages the wait by necessity of responses (futures)

  • ProActive : communication!S_m(args) request served (executed and removed) response received!S_m(args) method callCurrent object Remote object request arriving in the queue!Q_m(args)?Q_m(args)!R_m(val)?R_m(val) !Q_m(args) ?Q_m(args)?R_m(val) response sent back!R_m(val)

  • ProActive : High level semantics Independence wrt. distributionGuarantee and Synchrony of delivery :RdV mechanism ensures the delivery of requests, and of responses.Determinism / Confluence :Asynchronous communication and processing do not change the final result of computation.

    ASP Calculus: D. Caromel, L. Henrio, B. Serpette, Asynchronous and Deterministic Objects, POPL2004

  • Methodology: Challenges Specification language : usable by non-specialistsAutomatic verification : construction of models from source code integrated software Standard, state-of-the-art model checkers : finite state models, hierarchical models, compositional construction

  • Methodology : SnapshotInformalRequirements

    Model Checker

  • Model (1) :Synchronisation NetworksLabelled Transition Systems (LTS) Synchronisation Network (Net) with T= with vLT, v=[lt,1,, n], i Ii idle,, lt AGSynchronisation product : builds a global LTS from a Net of arity n, and n argument LTSs.

    Arnold 1992 : synchronisation networksLakas 1996 : Lotos open expressions=> Boulifa 2003, Model generation for distributed Java programs, Fidji03

  • (2) Parameterized NetworksParameterized actions (with typed variables) pAParameterized LTS (pLTS) with state variables vs, and labels l=(b, (x), e)Synchronisation Network (Net) with pT = with Hn = {(pIi,Ki)}i a finite set of holes vLT, v=[lt,1k1,, nkn], iki pIi idle, ki Ki, lt AGInstantiation : for a finite abstract domain Dv pLTS x Dv LTS pNet x Dv Net

    Barros, Boulifa, Madelaine Parameterized Models for Distributed Java Objects, Forte 2004, Madrid.Finite Network

  • Graphical Models

  • Large case-study:Electronic Invoices in Chile

  • Electronic Invoices in ChileBarros, Madelaine Formalisation and Verification of the Chilean electronic invoice system, INRIA report RR-5217, june 2004.

    15 parameterized automata / 4 levels of hierarchy state explosion: grouping, hiding, reduction by bisimulation : instantiating 7 parameters yields > millions of states...

  • Parameterized PropertiesLogical parameterized LTSParameterized temporal logics

  • Extracting models by static analysis

  • Extended Call GraphsEncodes both the usual control flow usual in MCG (resolution of class analysis and method calls), and the data flow relative to interesting parameters (pieces of bytecode instructions);identifies ProActive objets (activities, remote calls, futures).Complex static analysis :class analysisalias analysisobject topology

  • Model generation : key pointsStatic topology : finite number of parameterized activities.For each Active Object Class : parameterized network of LTSs (one for each method)method calls = synchronisation messagesremote calls : wait by necessity using proxy processesrequests queue : the main potential blow-up!

    Property : starting from source code with abstracted data (simple types), we have a procedure that builds a finite parameterized model.

  • Consumer Network

  • Buffer NetworkBuf.BodyputBuf.Queueget

  • Electronic Invoices in ChileBarros, Madelaine Formalisation and Verification of the Chilean electronic invoice system, INRIA report RR-5217, june 2004.15 parameterized automata / 4 levels of hierarchy state explosion: grouping, hiding, reduction by bisimulation

  • Distributed Components

  • Fractal hierarchical model : composites encapsulate primitives, which encapsulates Java codeContentController

  • Fractal + ProActive Components for the GRIDAn activity, a process, potentially in its own JVMComposite: Hierarchical, and Distributed over machinesParallel: Composite + Broadcast (group)

  • Components : correct compositionBehaviour is an essential part of a component specification.Model of components : primitive = pLTS composite = pNet state-less component = static pNet controller = transducerCorrectness of composition : implementation preorder ?

  • Conclusions Parameterized, hierarchical model. Graphical language. Validated with a realistic case-study. Ongoing development : instantiation tool, graphical editor, generation of model from ProActive source code. Incorporation within a verification platform (ACI-SI Fiacre : INRIA-Oasis, INRIA-Vasy, ENST-Paris, SVF)

  • Perspectives Refine the graphical language, extend to other ProActive features, formalize the abstractions. (Direct) parameterized verification. Behavioural specifications of components, correct compositions.

    http://www-sop.inria.fr/oasis/Vercors

  • Algorithm rules

  • Call rule

    If o is remote, we simply generate a send message !o.Q_m(this, f, args) encoding the method name, its status and its (abstracted) param. with future var.else the message !o.Call_m(args) is sent to the method proccess and according to the return value is void or no the response is awaited or no.