Port Protocols for Deadlock-Freedom of Component Systems

Transcription

1 Port Protocols for Dedlock-Freedom of Comonent Systems Christin Lmbertz Mil Mjster-Cederbum University of Mnnheim, Germny In comonent-bsed develoment, roches for roerty verifiction exist tht void building the globl system behvior of the comonent model. Tyiclly, these roches rely on the nlysis of the locl behvior of fixed sized subsystems of comonents. In our roch, we wnt to void not only the nlysis of the globl behvior but lso of the locl behviors of the comonents. Insted, we consider very smll rts of the locl behviors clled ort rotocols tht suffice to verify roerties. 1 Introduction Comonent-bsed develoment (CBD) hels to mster the design comlexity of softwre systems nd enhnces reusbility. In forml CBD models, ech comonent tyiclly offers set of orts for cooertion with other comonents. Thereby, restrictions on the rchitecture of the system nd the behvior of comonents llow to verify roerties such s dedlock-freedom without exhustively serching the globl stte sce. Here, we consider the CBD model of interction systems by Sifkis et. l. [7] in which dt nd I/O oertions re comletely bstrcted wy nd every single oertion is clled n ction. Ech comonent s behvior is modeled s lbeled trnsition system (LTS), where the set of lbels equls the set of ctions nd ech ction is understood s ort of the ssocited comonent. The ctions re then groued into sets clled interctions to model cooertion. Thereby, ny ction cn only be executed if ll other ctions contined in n rorite interction re lso executble. The globl behvior is then derived by executing the interctions nondeterministiclly ccording to their executbility. A drwbck of the originl model is tht ort is considered s single ction nd thus no dditionl behvior cn be secified for it. Here, we extend the model of interction systems to lso cture ort behvior. We grou severl ctions of one comonent nd cll this grou ort lhbet. Additionlly, every ort lhbet is equied with LTS which we cll ort rotocol. The ide behind this roch is tht in verifiction stes we use the ort rotocols of involved comonents insted of their LTSs. This is more efficient since the behvior of the comonent is tyiclly much lrger (if we comre the number of sttes nd trnsitions) thn its ort rotocols. The verifiction of roerties for the whole comonent then follows from the verifiction ste tht used only the ort rotocols. Furthermore, this suorts gry box view of the comonents tht is desired in CBD similr to the rincile of informtion hiding [4]. In Hennicker et. l. [9] nd Mot et. l. [11], we find similr ides. In [9], ech ort rovides rotocol which is correct w.r.t. its comonent, i.e., the behvior of the comonent restricted to the ctions in the ort lhbet (i.e., ny other ction becomes unobservble) is wek bisimilr to the ort rotocol. Then, notion clled neutrlity llows to ly reduction strtegy such tht roerties need only to be verified on the reduced rt of the system. Thereby, neutrlity of ort q for ort mens tht the comosition of the rotocols of nd q restricted to the lhbet of is wek bisimilr to the rotocol of, i.e., it is sufficient to consider only. In [11], similr ide is clled comtibility of two orts nd requires tht ll sequences of ctions of one ort re lso ossible in the other one. After introducing our definitions in Sec. 2, we consider in Sec. 3 n exmle where two orts re neither neutrl nor comtible, but our roch resented in Sec. 4 llows to verify its dedlock-freedom. Bliudze, Bruni, Grohmnn, Silv (Eds.): Third Interction nd Concurrency Exerience (ICE 2010) EPTCS 38, 2010,. 7 11, doi: /eptcs.38.3

2 8 Port Protocols for Dedlock-Freedom of Comonent-Bsed Systems Note tht severl roches for roving dedlock-freedom in interction systems exist, e.g., Mjster- Cederbum nd Mrtens [10] or Benslem et. l. [2] in the context of BIP [1] (for which interction systems re theoreticl model). Art from the lck of gry box view of the comonents, which is desired in CBD [4], these roches lso exloit the comositionl structure of the system. In Sec. 3, we demonstrte how the roch of [10] cn further benefit from the introduction of ort rotocols by mens of n exmle system. The roch of [2] is bsed on finding invrints for the comonents, which must be rovided for ech roerty, nd for the interctions, which re comuted utomticlly. Unfortuntely, ccording to Benslem et. l. [3], for this comuttion there is risk of exlosion, if exhustiveness of solutions is necessry in the nlysis rocess. Thus, this roch is not gurnteed to be olynomil in the number nd size of the comonents resectively the ort rotocols which is n imortnt roerty of our roch. However, the introduction of ort rotocols in BIP could be romising extension w.r.t. gry box view, if comonent invrints cn be estblished from the informtion only vilble from the ort rotocols. 2 Formliztion of Protocol Interction Systems A rotocol interction system is defined by tule Sys := (Com,{P i } i Com,{A i } i Com P i,int,beh). Here, Com is finite set of comonents, which re referred to s i Com. The vilble orts of comonent i re given by the finite set P i, nd the ming orts(i) := {i: P i } llows to refer to ort of i s i: orts(i). The ctions of ech ort i: re given by the set A i, lso denoted by ort lhbet A i:, nd re ssumed to be disjoint, i.e., i, j Com, P i,q P j : i j q = A i A q j = /0. All vilble ctions of comonent i re contined in the ction set A i := P i A i, nd the union of ll ction sets is clled the globl ction set Act := i Com A i. A nonemty finite set α Act of ctions is clled n interction, if it contins t most one ction of every comonent, i.e., α A i 1 for ll i Com. For ny interction α nd comonent i we ut i(α) := A i α. Similrly, for α nd ort i: of i we ut i:(α) := A i: α. The interction set Int contins ll vilble interctions nd covers ll ctions, i.e., we require tht α Int α = Act holds. The behvior model Beh of Sys contins for every comonent i LTS [[i]] := (S i,a i,{ i } Ai,I i ) describing the locl behvior of i where S i is the locl stte sce, ction set A i contins the lbels, { i } Ai is fmily of trnsition reltions with i S i S i, nd I i S i is the set of locl initil sttes. Whenever (s,s ) we write s s insted. For every ort i: of i, Beh contins LTS [[i:]] := (S i:,a i: {τ},{ i: } Ai: {τ},i i: ) describing the ort rotocol of i:. The secil symbol τ is used to model unobservble behvior, nd we require τ / Act, i.e., no comonent uses τ s n ction. However, the ort rotocols re llowed to contin τ-trnsitions. A ort i: of comonent i is sid to be conform to the comonent if [[i:]] b f i: ([[i]]) where b denotes brnching bisimilrity [6] nd f i: ( ) is relbeling function tht relces ll lbels resectively trnsitions not contined in the ort lhbet A i: with the lbel τ resectively with τ-trnsition. Thereby, we ssume tht the ort rotocols re minimized w.r.t. brnching bisimilrity. Note tht we use brnching bisimilrity insted of wek bisimilrity, which is used in the roch of Hennicker et l. [9], becuse brnching bisimilrity reserves more roerties of systems ( logicl chrcteriztion of b in CTL* X exists [5]), it is more efficient to clculte [8], nd, s remrked by vn Glbbeek nd Weijlnd [6], mny systems tht re wek bisimilr re lso brnching bisimilr. In the following, we fix rotocol interction system Sys. The globl behvior of Sys is LTS [[Sys]] := (S,Int,{ } α α Int,I) where the set of globl sttes S := i Com S i is given by the Crtesin

3 C. Lmbertz & M. Mjster-Cederbum 9 roduct of the locl stte sces, which we consider to be order indeendent. Globl sttes re denoted by tules s := (s 1,,s n ) with n = Com, nd the set of globl initil sttes is I := i Com I i. The fmily of globl trnsition reltions { } α α Int is defined cnoniclly where for ny α Int nd ny s,s S we hve s α s if i Com: if i(α) = { i } then s i i i s i nd if i(α) = /0 then s i = s i. Let C Com be set of comonents. The rtil behvior of Sys with resect to C is LTS [[C]] := (S C,Int C,{ α C } α IntC,I C ) where S C := i C S i, I C := i C I i, Int C := {α ( i C A i ) α Int} \ {/0}, nd { α C } α IntC is defined nlogously to the fmily of globl trnsition reltions. Let P i Com orts(i) be set of orts. The ort behvior of Sys with resect to P is LTS [[P]] := (S P,Int P {τ},{ α P } α IntP {τ},i P ) where S P := i: P S i:, I P := i: P I i:, nd Int P := {α ( i: P A i: ) α Int}\{/0}. For ny α Int P nd ny s,s S P we hve s α P s if i: P: if i:(α) = { i: } then s i: i: i: s i: nd if i:(α) = /0 then s i: = s i:. Additionlly, for s,s τ S P we hve s P s τ if i: P: s i: i: s i: nd j:q P \ {i:}: s j:q = s j:q. Finlly, define the rotocol communiction grh G := (V,E) of Sys where the vertices re given by V := Com ( i Com orts(i)) nd the edges by E := {{i,i:} i Com i: orts(i)} {{i:, j:q} i, j Com i: orts(i) j:q orts( j) α Int : i:(α) /0 j:q(α) /0}. Two orts re connected if they re relted by n edge in G. The ort connectivity of ort i: is defined s the number of orts to which i: is connected. If the ort connectivity of ort is less thn two, we sy tht the ort is uniquely connected. If G forms tree in the grh-theoreticl sense, we sy tht G is tree-like. We cll LTS dedlock-free if ll its sttes, which re rechble from n initil stte, hve t lest one outgoing trnsition. 3 Two Exmle Systems We resent two exmles: The first one shows tht the roches of Hennicker et. l. [9] nd Mot et. l. [11] re not lwys licble nd the second how dedlock nlysis in interction systems cn benefit from ort rotocols. The first exmle is the rotocol interction system Sys ex1 shown in Fig. 1 with Com = {i, j}, orts(i) = {i:}, nd orts( j) = { j:q}. The interction set is given by Int = { { i, j },{b i,b j },{c i,c j }, {d i,d j } }. Obviously, ll orts re conform to their corresonding comonent. The exmle shows tht the two connected orts re neither neutrl nor comtible, since they restrict ech other, i.e., in [[{i:, j:q}]] only the execution th { i, j } {c i,c j } is ossible which restricts either ort. i [[i]] = [[i:]]: [[ j]] = [[ j:q]]: d j b i i j b j q j c i d i c j () Prot. comm. grh (b) Behvior nd ort rotocol of i res. i: (c) Behvior nd ort rotocol of j res. j:q Figure 1: Protocol interction system Sys ex1 with Int = { { i, j },{b i,b j },{c i,c j },{d i,d j } } The second exmle is the rotocol interction system Sys ex2 shown in Fig. 2 with Com = {m,1,2,,n}, orts(m) = {m:i i Com \ {m}}, nd orts(i) = {i:} for i Com \ {m}. The interction set is given by Int = { { i m, i } i Com \ {m} }. Obviously, ll orts re conform to their corresonding comonent.

4 10 Port Protocols for Dedlock-Freedom of Comonent-Bsed Systems n 1 n n m [[m]]: 1 m 2 m n m n 1 m [[m:i]]: i m (c) Port rot. of ort m:i with 1 i n [[i]] = [[i:]]: i () Protocol communiction grh 3 m (b) Behvior of com. m (d) Behvior nd ort rot. of border com. i res. ort i: with 1 i n Figure 2: Protocol interction system Sys ex2 with Int = { { i m, i } 1 i n } As n exmle for dedlock nlysis, we consider the nlysis of Mjster-Cederbum nd Mrtens [10] for tree-like interction systems. The check for dedlock-freedom of Sys ex2 requires mong other things tht we nlyze the rtil behvior of ll irs of connected comonents, i.e., we hve to crry out this nlysis n times. Since the size of ny such rtil behvior is O(n) becuse in ech check the middle comonent is used the whole dedlock nlysis needs O(n 2 ). If we use the ort rotocols insted of the whole behvior in ech ste, ech rotocol behvior cn be trversed in constnt time. Thus, the totl mount of work is O(n). Note tht the exmle only motivtes the use of ort rotocols in tree-like systems nd tht the globl stte sce of the exmle cn be trversed in O(n). But, with more comlex behvior of the non-middle comonents the cost of this trversl increses such tht globl stte sce nlysis becomes unfesible. 4 Proving Dedlock-Freedom In order to exloit the comositionl informtion nd the informtion obtined by combining the ort rotocols, we need to ut restrictions on the rchitecture, e.g., on the form of the rotocol communiction grh, nd on the locl behviors, e.g., on the existence of unobservble behvior in the ort rotocols. The following theorem exloits such restrictions nd llows for efficient verifiction of dedlockfreedom in interction systems, which cn be erformed in time olynomil in the number nd size of the ort rotocols. Note tht the exmles of Sec. 3 cn be verified in this wy. Theorem: Let Sys be rotocol interction system nd G its rotocol communiction grh. Assume tht G is tree-like nd tht every ort is uniquely connected nd conform to its corresonding comonent nd its miniml ort rotocol w.r.t. brnching bisimilrity is τ-free. If for ll connected orts i: nd j:q of ll comonents i, j Com holds tht [[{i:, j:q}]] is dedlock-free then [[Sys]] is dedlock-free. The theorem exloits the ide tht n unobservble ste in ort rotocol is only resent if the comonent s future behvior cn be influenced by the cooertion with its environment. If no τ is resent, the comonent s behvior visible through the ort rotocol is inevitble. Becuse of the structure of the rotocol communiction grh, it is then sufficient to check irs of ort rotocols for dedlock-freedom, becuse due to their τ- nd dedlock-freedom, no cyclic witing reltion is ossible. Proof (Sketch): We successively consider rtil behviors of connected comonents of incresing size in n induction like mnner. Assume tht there is set C Com of comonents such tht [[C]] is dedlockfree. Now ick comonent j / C nd consider C := C { j}. Assume [[C ]] is not dedlock-free, lthough comonent i C nd ort i: orts(i) exist such tht i: is connected to ort j:q orts( j)

5 C. Lmbertz & M. Mjster-Cederbum 11 nd [[{i:, j:q}]] is τ- nd dedlock-free which follows from the ssumtions. Due to the dedlock, there is rechble stte s C S C tht hs no outgoing trnsition. Since the corresonding stte s C S C in the system without j is dedlock-free, there must be n ction i A i nd sttes s i,s i S i with s i being i s locl rt in s C nd s i i i s i. But, the corresonding interction α with i(α) = i:(α) = { i} is not vilble in s C nymore due to the dedlock, i.e., there must be n j A j with j(α) = j:q(α) = { j } tht is not enbled in the locl rt s j of s C. Consider the rtil behvior [[{i, j}]] nd the stte (s i,s j ) S {i, j}, which is rechble from n initil stte in [[{i, j}]] since the dedlocked stte s C is rechble in [[C ]]. Now, n equivlent stte (s i:,s j:q ) S {i:, j:q} with s i b s i: nd s j b s j:q is lso rechble in the rotocol behvior [[{i:, j:q}]] becuse of the rotocol conformnce. But then, [[C ]] cnnot be dedlocked since t lest one α Int {i:, j:q} nd thus α Int is enbled in (s i:,s j:q ) becuse of the rotocol behvior s dedlock-freedom, nd this α cn neither be blocked by i becuse i s cooertion with the other comonents in C is dedlock-free nor by j becuse the only cooertion rtner of j is i in [[C ]] becuse otherwise the rotocol behvior [[{i:, j:q}]] would contin τ-trnsition. Currently, we re investigting weker versions of the theorem, e.g., we conjecture tht it is sufficient tht the rotocol behvior of combined ort rotocols is τ-free insted of requiring the τ-freedom of ll ort rotocols, nd we try to ly the ort rotocol roch to the verifiction of other generic roerties such s rogress nd secific roerties of given system secified in CTL* X. Additionlly, the roof of the theorem shows n liction for correctness-by-construction roch. References [1] Annd Bsu, Mrius Bozg & Joseh Sifkis (2006): Modeling Heterogeneous Rel-time Comonents in BIP. Softwre Engineering nd Forml Methods, Interntionl Conference on, [2] Sddek Benslem, Mrius Bozg, Thnh-Hung Nguyen & Joseh Sifkis (2009): D-Finder: A Tool for Comositionl Dedlock Detection nd Verifiction. Comuter Aided Verifiction, [3] Sddek Benslem, Mrius Bozg, Joseh Sifkis & Thnh-Hung Nguyen (2008): Comositionl Verifiction for Comonent-Bsed Systems nd Aliction. In: ATVA 08: Proceedings of the 6th Interntionl Symosium on Automted Technology for Verifiction nd Anlysis, Sringer-Verlg, [4] Hns de Bruin (2000): A Grey-Box Aroch to Comonent Comosition. Genertive nd Comonent-Bsed Softwre Engineering, [5] Rocco De Nicol & Frits Vndrger (1995): Three logics for brnching bisimultion. J. ACM 42(2), [6] Rob J. vn Glbbeek & W. Peter Weijlnd (1996): Brnching time nd bstrction in bisimultion semntics. J. ACM 43(3), [7] Gregor Gössler & Joseh Sifkis (2003): Comosition for Comonent-Bsed Modeling. In: FMCO 02: First Interntionl Symosium on Forml Methods for Comonents nd Objects, [8] Jn Groote & Frits Vndrger (1990): An efficient lgorithm for brnching bisimultion nd stuttering equivlence. Automt, Lnguges nd Progrmming, [9] Rolf Hennicker, Stehn Jnisch & Alexnder Kn (2008): On the Observble Behviour of Comosite Comonents. In: Interntionl Worksho on Forml Asects of Comonent Softwre (FACS 08), Electronic Notes in Theoreticl Comuter Science (ENTCS), [10] Mil Mjster-Cederbum & Moritz Mrtens (2008): Comositionl nlysis of dedlock-freedom for treelike comonent rchitectures. In: EMSOFT 08: Proceedings of the 7th ACM interntionl conference on Embedded softwre, ACM, New York, NY, USA, [11] Rodrigo Rmos, Augusto Smio & Alexndre Mot (2009): Systemtic Develoment of Trustworthy Comonent Systems. In: FM 2009: Forml Methods, Sringer-Verlg,