124 Chapter 8. Case Study: A Memory Component ndcatng some error condton. An exceptonal return of a value e s called rasng excepton e. A return s ssue

Size: px

Start display at page:

Download "124 Chapter 8. Case Study: A Memory Component ndcatng some error condton. An exceptonal return of a value e s called rasng excepton e. A return s ssue"

Moses Hines
5 years ago
Views:

1 Chapter 8 Case Study: A Memory Component In chapter 6 we gave the outlne of a case study on the renement of a safe regster. In ths chapter wepresent the outne of another case study on persstent communcaton; we deal wth a memory component. Ths memory component s mplemented by a memory that communcates va a remote procedure call component. At the Dagstuhl Semnar on Speccaton and Renement of Reactve Systems [Dag94], organsed by Lamport and Broy, ths case study has been treated usng derent formalsms. In ths chapter we examne the soluton n the ImpUNITY framework. To descrbe the case study and the goals of the renement we quote the orgnal Speccaton Problem. Ths chapter s organsed as follows. Secton 8.1 deals wth the speccaton of a procedure nterface between components. It denes some of the domans used n ths chapter. In secton 8.2 a memory component s speced and we show that a relable memory s a renement of an unrelable memory. Secton 8.3 gves a remote procedure call component and secton 8.4 shows that an unrelable memory can be mplemented by a combnaton of a relable memory and a remote procedure component. 8.1 The Procedure Interface About the procedure nterface, the Speccaton Problem says: The problem calls for the speccaton and vercaton of a seres of components. Components nteract wth one another usng a procedure-callng nterface. One component ssues a call to another, and the second component responds by ssung a return. A call s an ndvsble (atomc) acton that communcates a procedure name and a lst of arguments to the called component. A return s an atomc acton ssued n response to a call. There are two knds of returns; normal and exceptonal. A normal call returns a value (whch could be a lst). An exceptonal return also returns a value, usually 123

2 124 Chapter 8. Case Study: A Memory Component ndcatng some error condton. An exceptonal return of a value e s called rasng excepton e. A return s ssued only n response to a call. There may be \syntactc" restrctons on the types of arguments and return values. A component may contan multple processes that can concurrently ssue procedure calls. More precsely, after one process ssues a call, other processes can ssue calls to the same component before the component ssues a return from the rst call. A return acton communcates to the callng component the dentty of the process that ssued the correspondng call. In the ImpUNITY framework, components are modelled by programs. A component provdng servces exports a call procedure and mports a return procedure of the callng component. A call communcates the dentty of the callng process, a procedure name and a lst of arguments. A return communcates the dentty of the process and a value. We do not dstngush normal and exceptonal returns, normal and exceptonal values are just derent tems of the same doman. So, we use the followng types for the arguments of call and return procedures: CallType RetType = ProcId Names Args; = ProcId Values; where ProcId s the doman of process denttes, Names s the doman of procedure names, Values s the doman of argument values, and Args the doman of lsts of Values. Selecton of a eld of a tuple s denoted by the varable name followed by a dot and the name of the eld n the tuple. For a varable a : CallType, the elds are named by a = (a:proc; a:name; a:args). For a varable a : RetType, the elds are named by a =(a:proc; a:ret). For lsts we have the standard lst operatons cons (:), head (hd) and tal (tl), the length # gvng the length of a lst, and the selector :n that selects the n th tem n the lst. To handle calls, components have an array of slots as a local varable. A slot s a varable of the type SlotType = Tstat ProcId Names Args Values; and s used for storng status nformaton, the argument and the value to return. For a slot S : SlotType elds are named by S =(S :stat; S :proc; S :name; S :args; S :ret). On a call, a free slot s chosen to store the nformaton of the call. Wth every slot a set of statements s assocated dealng wth the call. The bult-n UNITY farness takes care of the progress for each call. A consequence of ths approach s that only a xed number of processes can be served.

3 8.2. A Memory Component A Memory Component About the memory component, the Speccaton Problem says: The component to be speced s a memory that mantans the contents of a set MemLocs of locatons. The contents of a locaton s an element of a set MemVals. Ths component has two procedures, descrbed nformally below. Note that beng an element of MemLocs or MemVals s a \semantc" restrcton, and cannot be mposed solely by syntactc restrctons on the types of arguments. Name Read Arguments loc : an element ofmemlocs Return Value an element ofmemvals Exceptons BadArg: argument loc s not an element ofmemlocs. MemFalure: the memory cannot be read. Descrpton Returns the value stored n address loc. Name Wrte Arguments loc : an element ofmemlocs val : an element of MemVals Return Value some xed value Exceptons BadArg: argument loc s not an element ofmemlocs, or argument val s not an element ofmemvals. MemFalure: the wrte mght not have succeeded. Descrpton Stores the value val n address loc. The memory must eventually ssue a return for every Read and Wrte call. Dene an operaton to consst of a procedure call and the correspondng return. The operaton s sad to be successful t has a normal (nonexceptonal) return. The memory behaves as f t mantans an array of atomcally read and wrtten locatons that ntally all contan the value IntVal, such that: An operaton that rases a BadArg excepton has no eect on the memory. Each successful Read(l) operaton performs a sngle atomc read to locaton l at some tme between the call and return. Each successful Wrte(l ; v ) operaton performs a sequence of one or more atomc wrtes of value v to locaton l at some tme between the call and return.

4 126 Chapter 8. Case Study: A Memory Component Each unsuccessful Wrte(l ; v ) operaton performs a sequence of zero or more atomc wrtes of value v to locaton l at some tme between the call and return. A varant of the Memory Component s the Relable Memory Component, n whch no MemFalure exceptons can be rased. Problem 1 (a) Wrte a formal speccaton of the Memory component and of the Relable Memory component. (b) Ether prove that a Relable Memory component s a correct mplementaton of a Memory component, or explan why t should not be. Soluton of problem 1(a) The memory component uses the procedure nterface as descrbed n secton 8.1. So, t exports a procedure call, t mports a return procedure and has a local varable Slot. The call procedure stores ts argument n a free slot,.e. a slot whch status s FREE and changes the status of ths slot to CALL. Wth every slot two actons are assocated. The rst chooses the value to return and updates a local memory varable n the proper way. The second takes care of ssung the return and frees the slot. The bult-n ImpUNITY farness takes care of the progress: every call has a return. In the speccaton of the memory component, we use the followng abbrevatons: Read(name; args) Wrte(name; args) IsMemCall(name; args) IsRead(name; args) IsWrte(name; args) BadArgs(name; args) = name = Read ^ #(args) =1; = name = Wrte ^ #(args) =2; = Read(name; args) _ Wrte(name; args); = Read(name; args) ^h9l : l 2 MemLocs : args =[l]; = Wrte(name; args) ^h9l ; v : l 2 MemLocs; v 2 MemVals : args =[l ; v ]; = IsMemCall(name; args) ^:(IsRead(name; args) _ IsWrte(name; args)): Now, the Memory component Mem s speced n example 8.1. The Relable Memory component Rel s smlar to the memory component but t cannot fal,.e. t does not return a MemFalure. Ths s modelled by the program Rel n example 8.2.

5 8.2. A Memory Component 127 Program Mem hde fslot; memg external [=fslot ;memg] export proc call(a : CallType) = IsMemcall(a:name; a:args)! f [] Slot[]:stat = FREE! Slot[] :=(CALL; a:proc; a:name; a:args; MemFalure) mport proc return(rettype) nt h8 : 2 MemLocs : mem[] =IntVal^h8 : 2 SlotLocs : Slot[]:stat = FREE assgn h []s : s 2 SlotLocs : Slot[s]:stat = CALL! f IsRead(Slot[s]:name; Slot[s]:args)! Slot[s]:ret := mem[slot[s]:args:1] [] IsWrte(Slot[s]:name; Slot[s]:args)! mem[slot[s]:args:1] := Slot[s]:args:2 ; Slot[s]:ret := FxedVal [] BadArgs(Slot[s]:name; Slot[s]:args)! Slot[s]:ret := BadArg [] true! Slot[s]:ret := MemFalure [] h []s : s 2 SlotLocs : Slot[s]:stat = CALL! return((slot[s]:proc; Slot[s]:ret)) ; Slot[s]:stat := FREE endfmemg Example 8.1. Soluton of problem 1(b) The Relable Memory component s a renement of the Memory component and ths renement sproven n two steps. Frst, the nondetermnsm of the statements n the rst set s reduced by transformaton Second, the guards of the statements n the second set are strengthened by transformaton We have to prove that the followng propertes hold n the relable memory components: (Slot[s]:stat = CALL),. CM (Slot[s]:stat 6= CALL _ ret 6= MemFalure); (ret 6= MemFalure) unless CM (Slot[s]:stat = CALL): Ths holds f MemFalure 62 MemVals.

6 128 Chapter 8. Case Study: A Memory Component Program Rel hde fslot; memg external [=fslot ;memg] export proc call(a : CallType) = IsMemcall(a:name; a:args)! f [] Slot[]:stat = FREE! Slot[] :=(CALL; a:proc; a:name; a:args; MemFalure) mport proc return(rettype) nt h8 : 2 MemLocs : mem[] =IntVal^h8 : 2 SlotLocs : Slot[]:stat = FREE assgn h []s : s 2 SlotLocs : Slot[s]:stat = CALL! f IsRead(Slot[s]:name; Slot[s]:args)! Slot[s]:ret := mem[slot[s]:args:1] [] IsWrte(Slot[s]:name; Slot[s]:args)! mem[slot[s]:args:1] := Slot[s]:args:2 ; Slot[s]:ret := FxedVal [] BadArgs(Slot[s]:name; Slot[s]:args)! Slot[s]:ret := BadArg [] h []s : s 2 SlotLocs : Slot[s]:stat = CALL ^ (ret 6= MemFalure)! return((slot[s]:proc; Slot[s]:ret)) ; Slot[s]:stat := FREE endfrelg Example The RPC Component About the RPC component, the Speccaton Problem says: The RPC component nterfaces wth two envronment components, a sender and a recever. It relays procedure calls from the sender to the recever, and relays the return values back to the sender. Parameters of the component are a set Procs of procedure names and a mappng ArgNum, where ArgNum(p) s the number of arguments of each procedure p. The RPC component contans a sngle procedure:

7 8.3. The RPC Component 129 Name RemoteCall Arguments Procs: name of a procedure args: lst of arguments Return Value any value that can be returned by a call to Procs Exceptons RPCFalure: the call faled BadCallProcs s not a vald name or args s not a syntactcally correct lst of arguments for Procs. Rases any excepton rased by a call to Procs Descrpton Calls procedure Procs wth arguments args A call of RemoteCall(Procs; args) causes the RPC component to do one of the followng: Rase a BadCall excepton f args s not a lst of ArgNum(Procs) arguments. Issue one call to procedure Procs wth arguments args, wat for the correspondng return (whch the RPC component assumes wll occur) and ether (a) return the value (normal or exceptonal) returned by that call, or (b) rase the RPCFalure excepton. Issue no procedure call, and rase the RPCFalure excepton. The component accepts concurrent calls of RemoteCall from the sender, and can have multple outstandng calls to the recever. Problem 2 Wrte a formal speccaton of the RPC component. Soluton of problem 2 The RPC component s an nterface component between two components, a sender and a recever. It provdes a procedure-callng nterface to the sender. So, the component exports a call procedure (rpc call), mports a return procedure (rpc return) and uses the slot mechansm as descrbed n secton 8.1. The RPC component also uses a procedure-callng nterface to the recever. Therefore t mports a call procedure (call) andexports a return procedure (return). In the descrpton of the RPC component we use the followng abbrevatons. IsRpcCall(name; args) GoodCall(args) BadCall(args) = name = RemoteCall ^ #(args) > 1 = arg:1 2 Procs ^ ArgNum(args:1) = #(args), 1 = :GoodCall(args) Now, the RPC component s speced n example 8.3. A call to rpc call communcates a remote procedure call and ths nformaton s stored n a free slot. In case of a bad call

8 130 Chapter 8. Case Study: A Memory Component Program RPC hde fslotg external [=fslotg] export proc rpc call(a : CallType) = IsRpcCall(a:name)! f [] Slot[]:stat = FREE! Slot[] :=(CALL; a:comp; a:proc; a:name; a:args; RPCFalure) [] proc return(a : RetType) = f true! Slot[a:proc]:ret := a:val ; Slot:[a:proc]:stat := RETURN mport proc rpc return(rettype) [] true! Slot[a:proc]:ret := RPCFalure ; Slot:[a:proc]:stat := RETURN [] proc call(calltype) nt h8 : 2 SlotLocs : Slot[]:stat = FREE assgn h []s : s 2 SlotLocs : f Slot[s]:stat = CALL! f GoodCall(Slot[s]:args)! Slot[s]:ret := CALLING endfrpcg ; call(s; hd(args); tl(args)) [] BadCall(Slot[s]:args)! Slot[s]:ret := BadCall ; Slot[s]:stat := RETURN [] true! Slot[s]:ret := RPCFalure [] Slot[s]:stat = RETURN! rpc return((slot[s]:proc; Slot[s]:ret)) ; Slot[s]:stat := FREE Example 8.3. ; Slot[s]:stat := RETURN

9 8.4. Implementaton of the Memory 131 the second statement of the program decdes to return wth a BadCall or a RPCFalure by settng the status eld to RETURN. On a proper call, the statement forwards the call to the recever or decdes to return wth a RPCFalure. The recever calls the return procedure wth the result of the remote call or an excepton. The last statement takes care of the return. 8.4 Implementaton of the Memory About mplementng the memory, the Speccaton Problem says: A Memory component s mplemented by combnng an RPC component wth a Relable Memory component as follows. A Read or Wrte call s forwarded to the Relable Memory by ssung the approprate call to the RPC component. If ths call returns wthout rasng an RPCFalure excepton, the value returned s returned to the caller. (An exceptonal return causes an excepton to be rased.) If the call rases an RPCFalure excepton, then the mplementaton may ether ressue the call to the RPC component or rase a MemFalure excepton. The RPC call can be retred arbtrarly many tmes because of RPCFalure exceptons, but a return from the Read or Wrte call must eventually be ssued. Problem 3 Wrte a formal speccaton of the mplementaton, and prove that t correctly mplements the speccaton of the Memory component of Problem 1. Soluton of problem 3 A memory component s mplemented by combnng the RPC component, as gven n example 8.3, wth a (Relable) Memory component, as gven n example 8.2. Besdes these two components, the mplementaton Imp contans an nterface component Int,.e. Imp = proc(frpc call ; rpc returng : Int[]RpcMem) where RpcMem = proc(fcall ; returng : RPC []Rel). Component Int s an nterface component that accepts memory calls and relays them to component RpcMem. Therefore, component Int provdes a procedure-callng nterface to the envronment, t exports a call procedure (call), mports a return procedure (return), and uses the slot mechansm as descrbed before. Furthermore, t uses the procedure-callng nterface of the RPC component,.e. t mports the call procedure (rpc call) and exports a return procedure (rpc return).

10 132 Chapter 8. Case Study: A Memory Component Program Int hde fslotg external [=fslotg] export proc call(a : CallType) = IsMemcall(a:name; a:args)! f [] Slot[] =FREE! Slot[] :=(CALL; a:proc; a:name; a:args; MemFalure) [] proc rpc return(a : RetType) = f Slot[a:proc]:stat = CALLING! Slot[a:proc]:ret := Map(a:val) ; Slot[a:proc]:stat := CALLED [] Slot[a:proc]:stat = CALLING! Slot[a:proc]:ret := Map(a:val) ; Slot[a:proc]:stat := RETURN [] Slot[a:proc]:stat = TERM! Slot[a:proc]:ret := Map(a:val) ; Slot[a:proc]:stat := RETURN mport proc return(rettype) [] proc rpc call(calltype) nt h8 : 2 SlotLocs : Slot[]:stat = FREE assgn h []s : s 2 SlotLocs : endfintg f Slot[s]:stat = CALL! Slot[s]:stat := CALLING ; rpc call(s; RemoteCall; name : args) [] Slot[s]:stat = CALLED! Slot[s]:stat := CALLING ; rpc call(s; RemoteCall; name : args) [] Slot[s]:stat = RETURN! return((slot[s]:proc; (Slot[s]:ret)) ; Slot[s]:stat := FREE [] h []s : s 2 SlotLocs : f Slot[s]:stat = CALLED! Slot[s]:stat := RETURN [] Slot[s]:stat = CALLING! Slot[s]:stat := TERM Example 8.4. The Int component s speced by program Int n example 8.4, where Map s the functon that maps RPCFalure to MemFalure and s the dentty on all other arguments.

11 8.5. Conclusons 133 To show that ths s a proper mplementaton of a Memory component we have to prove the renement Mem v Imp. Ths s done n a number of steps. We start wth the program Mem, gven n example 8.1, and show t s rened by a program proc(frpc call ; rpc returng : Int[]RelMem 0 ). Then, program RelMem 0 s rened to the program proc(frpc call ; rpc returng : RPC []Mem). In secton 8.2, we have proven the renement Mem v Rel, so, wemay conclude that RefMem 0 v RefMem and, consequently, Mem v Imp. The complete proof s rather long and can be found n [UK94]. All steps are applcatons of the renement rules we have gven before. 8.5 Conclusons In ths chapter we presented the outlne of a case study of the renement of a memory component n the ImpUNITY framework. Frst, t llustrates the use of procedures n the ImpUNITY framework as presented n the prevous chapter. It shows how a memory can be modelled and rened n ths framework and how the program transformaton rules are appled. It also shows that renement n envronment s useful. Furthermore, t s another example of modellng persstent communcaton n ths framework.

12 134 Chapter 8. Case Study: A Memory Component

all pre- and postcondton pars of programs. By modelng reactve systems as sequental programs and by usng data renement, the Renement Calculus can also

all pre- and postcondton pars of programs. By modelng reactve systems as sequental programs and by usng data renement, the Renement Calculus can also The RPC-Memory Speccaton Problem: UNITY + Renement Calculus Rob T. Udnk? & Joost N. Kok Department of Computer Scence, Leden Unversty, P.O. Box 9512, 2300 RA Leden, The Netherlands. Abstract. We use the