More flexible models using a new version of the translator of Java sources

Transcription

1 Theoretical and Applied Informatics ISSN Vol.21 (2009), no. 2 pp More flexible models using a new version of the translator of Java sources to timed automatons J2TADD ARTUR RATAJ a a Institute of Theoretical and Applied Informatics of the Polish Academy of Sciences, Bałtycka 5, Gliwice, Poland Received date30 June 2009, Revised date10 September 2009, Accepted date1 October 2009 Abstract: Abstract. Several extensions to the translator J2TADD of Java source code to timed automatons with discrete data are discussed. The changes include support for arrays, reference comparisons, abstract classes and methods, interfaces, the instanceof operator and the so called experiments. Also, more types of statements can be interpreted. Keywords: model checking, programming language, timed automatons, J2TADD, Uppaal, Verics 1. Introduction J2TADD [8, 7] is a translator of a subset of Java into timed automatons extended with discrete data (TADD) [3]. Currently supported output formats are Verics [4] and Uppaal [1]. The previous version, described in [5, 6] had several limitations that decreased the flexibility of specifying models, what was the incentive of enhancing the translator. Main additions, in comparison to the previous versions, are support for arrays, reference comparisons, abstract classes and methods, interfaces, the instanceof operator, and the so called experiments, understood in a similar way as the Prism [2] experiments. The interpreted thread now can consist of more types of statements. The Object.notifyAll() operation can now be translated without the requirement of Uppaal s broadcast channels. 2. Extensions This section describes a number of new features, introduced to J2TADD.

2 Support for arrays The Uppaal[1] model checker supports arrays. To take advantage of this feature, arrays have been implemented in J2TADD as well. The arrays are fully supported in the interpreted thread [5, 6], and indexing of arrays, without array creation, is supported in the compiled TADD threads [5, 6]. The arrays internally are dereferences just like field dereferences are. Thus, wherever a field dereference is possible in the internal assembly language described in [5, 6], an indexing dereference of an array is possible as well. if(index >= 2) if(index == 2) result = element2; else result = element3; else if(index == 0) result = element0; else result = element2; Fig. 1. Simulation of an array of the size 4, using four scalar variables It is considered to add array simulation in the future versions, for model checkers that do not support arrays, by the means of a set of scalar variables, branches and assignments, using bisection as illustrated in the example in Fig Interfaces and abstract methods These are standard methods of objective programming. Enabling them in J2TADD eliminates a substantial restriction put by the translator on the programmer. Thanks to this, Runnable, from standard Java library, can now be defined as an interface as expected, as opposed to a bogus, unused class, as it was in the previous version, where the functionality of Runnable was substituted by the root class Object. If the results of: comparison of references; instanceof operator 2.3. References and instanceof are known after the interpreting step [5, 6], then these expressions can be translated by J2TADD, which simply replaces them by constant expressions false or true, as determined in the interpreting step.

3 Enhanced interpreter As opposed to the previous version, the interpreter now supports the following statements, that previously were enabled only in the compiled TADD threads: if, while, do while, for, switch, break and continue. As loops are enabled, possibility of infinite loops is possible. This would make J2TADD never finish. To avoid that, as well as to detect a computationally very intensive code, it is possible to specify the maximum number of interpreted operations. If exceeded, an error is reported by the translator notifyall() using non broadcast synchronization The method Object.notifyAll() required Uppaal s broadcast channel, so that the notifying thread could notify all waiting threads at once. The current version can translate the method without the need for broadcast channels as well. Let all possibly waiting threads be w 0, w 1,... w N 1, and a notify() statement that notifies the thread w i be n i. The one information available about the waiting threads is the variable that hold the total number of waiting threads c [8, 7]. If c = 0, it is known that no threads are waiting. If c 0, it is known that some threads are waiting, but obviously it is not known which ones. This is why, in the first step of notifyall(), all possibilities n 0, n 1,... n N 1 should be made available. Once one is nondeterministically chosen, let it be n k, then, in the next step of notifyall(), if still c 0 0, then n 0, n 1,... n k 1, n k+1,... n N 1 should be made available, as it is known n k is not already waiting, and so on. This way, the method notifyall() is translated to a special tree. Traversing the tree along transitions makes it possible to choose a sequence being an arbitrary permutation of {n 0, n 1,... n N 1 }, and also escape out of the tree if c = 0. As can be seen, unlike the case of a broadcasting channel, the waiting threads are not notified all at once, but there is some sequence of notifications instead. Yet, the order of the notification does not have any meaning, as the notified threads still need to wait for the monitor [8, 7], that is, they need to wait at least until the notifying thread leaves the critical section. An example of the discussed tree is shown in Fig Experiments Fields, if of integer type or of integer array type, instead of a normal Java initializer, can also support now set initializers. Within such a set, individual values and ranges can be defined. A range definition consists of minimum value, maximum value and step. The grammar of a set initializer is as follows:

4 110 Fig. 2. An example of translation of notifyall(). There are four threads possibly waiting, n i means notify the ith thread, 1 means decrease the value of c by 1 initializer ::= element (# element ) element ::= number range range ::= number number [: number ] where number is an integer identifier. The sets of each such initializer create together a Cartesian product. The product size is S = S 0 S 1... S n (1) where S i is the set of integer values defined by ith set initializer, and S contains all possible combinations of fields with set initializers. J2TADD then produces S output files with generated models for each combination, but also can produce S different Java source files for each combination and each Java class, that contains at least a single integer set initializer within. The source files have the set initializers replaced by concrete values, as necessary to be compiled by a normal Java compiler. This way, not only model checking of the models with different initializers is possible, but also execution of the modeled algorithms by the Java virtual machine. 3. Example In [6] a dining philosophers example is discussed. threads used in that paper is as follows: The code of the interpreted

5 111 s1 public class College3 { s2 s3 public static void main(string args []) { s4 Fork fork0 = new Fork(false); s5 Fork fork1 = new Fork(false); s6 Fork fork2 = new Fork(false); s7 s8 Philosopher p0 = new Philosopher(0, fork0, fork1); s9 Philosopher p1 = new Philosopher(1, fork1, fork2); s10 Philosopher p2 = new Philosopher(2, fork2, fork0); s11 s12 (new Thread(p0)).start(); s13 (new Thread(p1)).start(); s14 (new Thread(p2)).start(); s15 } s16 } As can be seen, the code is redundant and still works only for the case of three philosophers. The code can be replaced when using the current version of J2TADD as shown below: s1 public class College { s2 static final int NUM = 2~10:4#20; s3 s4 public static void main(string args []) { s5 s6 Fork[] forks = new Fork[NUM]; s7 s8 for(int i = 0; i < NUM; ++i) s9 forks[i] = new Fork(false); s10 s11 for(int i = 0; i < NUM; ++i) { s12 Philosopher p = new Philosopher(i, forks[i], forks[(i + 1)%NUM]); s13 (new Thread(p)).start(); s14 } s15 } s16 } The code is cleaner, and the number of philosophers is determined by a single constant. In this example, the constant has a set initializer, that defines four experiments, with the number of philosophers being respectively 2, 6, 10 and 20.

6 112 Feature Int. Comp. access modifiers + + allocation statements + - arithmetic operators arrays, including indexing casts call statements classes 5, including interfaces + + control flow statements: + + blocks, break, continue, do while, if, for, labels, switch, while, return class inheritance, implementation + + dereferences of objects Feature Int. Comp. exceptions initializers, including + + aray initializers instanceof packages + + relational operators Random.nextInt (int) string operations synchronized blocks - + and methods Thread.sleep(int) Thread.start() + - thread control: join(), notify(), notifyall(), wait() virtual methods exact subset is backend dependent, the operators + - * / are supported by all backends 2 in the backends XML, Uppaal 3 if backend supports the operator % 4 non recursive 5 no support for nested classes 6 only if resolvable after the interpreting step 7 try catch constructs are supported if the catch blocks are compiled to empty statements, and assuming no exceptions are actually thrown 8 only if object is known after the interpreting step 9 object comparison only if objects known after the interpreting step 10 argument must be a constant 11 do not cause translation errors, but are removed 12 argument must be either a constant or Random.nextInt(int) 13 notifyall() in the backends XML, Uppaal 14 only if resolvable after the interpreting step Tab. 1. Summary of features of J2TADD, for respectively interpreted and compiled threads.

7 Summary As the former version of J2TADD is described in [5, 6], while the new version is described in this paper, Tab. 1 presents a summary of all Java features supported by J2TADD in a single place. 5. Conclusion The new version of J2TADD overcomes some limitations of the previous version, allowing for definition of more flexible models with a cleaner code. Support for experiments allows for checking of a set of models, that differ in values that initialize field variables, without the need of defining each model with a separate source code. References 1. Behrmann G., David A., Larsen K. G.: A Tutorial on Uppaal. In Formal Methods for the Design of Real-Time Systems: 4th International School on Formal Methods for the Design of Computer, Communication, and Software Systems, SFM-RT 2004, pages , Hinton A., Kwiatkowska M., Norman G., Parker D.: PRISM: A Tool for Automatic Verification of Probabilistic Systems. Lecture Notes in Computer Science, 3920, pp , Janowska A., Janowski P.: Slicing of timed automata with discrete data, Fundamenta Informaticae, vol. 72(1-3), pp , Kacprzak M., Nabiałek W., Niewiadomski A., Penczek W., Półrola A., Szreter M., Woźna B., Zbrzezny A.: VerICS 2007 a Model Checker for Knowledge and Real-Time, Fundamenta Informaticae, vol. 85(1 4), pp , Rataj A., Woźna B., Zbrzeźny A.: A translator of Java programs to TADD, Concurrency, Specification and Programming (CS&P 08), Groß Väter near Berlin, Deutschland, pp , Rataj A., Woźna B., Zbrzeźny A.: A translator of Java programs to TADDs, Fundamenta Informaticae, vol. 93(1 3), pp , Woźna B., Zbrzeźny A.: Towards verification of Java programs in VerICS, Fundamenta Informaticae, vol. 85(1 4), pp , Zbrzeźny A., Woźna B., Orzechowski M., Raimondi F.: Towards verification of Java programs in VerICS, Concurrency, Specification and Programming (CS&P 07), pp , Lagow, Poland 2007.

8 114 Bardziej elastyczne modele z użyciem nowej wersji translatora źródeł Javy do automatów czasowych J2TADD Streszczenie W artykule omawiane jest kilka rozszerzeń w nowej wersji translatora źródeł Javy do automatów czasowych, J2TADD. Zmiany te to między innymi możliwość używania tablic, porównań referencji, abstrakcyjnych klas i metod, interfejsów, operatora instanceof oraz porównań referencji obiektów. Możliwe jest również opisywanie tak zwanych eksperymentów. Nowa wersja J2TADD umożliwia definiowanie bardziej elastycznych modeli z użyciem bardziej klarownego kodu źródłowego.