Model Requirements and JAVA Programs MVP 2 1

Transcription

1 Model Requirements and JAVA Programs MVP 2 1

2 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late (or maybe never). SPIN/PROMELA JAVA Testing REVIEWS MVP 2 2 Running System

3 Introducing, detecting and repairing errors Liggesmeyer 98 MVP 2 3

4 Formal Verification & Validation? Design Model Verification & Validation Specification MVP 2 4

5 Objective Design= behaviour + Requirement= desired or forbidden behaviour Xspin Yes/No! Simulation Deadlock? Livelock? Requirement violation? MVP 2 5

6 What is a state? X=5 Y=7 Z=3 a A state is characterized by: Values of local/global variables Channel(s) contents State of each process (=program location) MVP 2 6

7 What is a state (continued)? A state is the cross-product between the state of all processes (+ variable values + channel contents): A B A1 B1 (A1,B1) (A1,B2) (A2,B1) (A3,B1) A2 A3 B2 MVP 2 7

8 Interleaving example from MVP1 byte s = 1 proctype A(){s==1 -> s++ proctype B() {s==1 -> s-- init {run A(); run B() Transition systems: A <s=1> s==1 <s=1> s++ <s=2> MVP 2 8 B <s=1> s==1 <s=1> s-- <s=0>

9 Combined (interleaved) transition system (state graph) of (A B) state==1 1 state==1 state state==1 state==1 state++ state state++ state-- Each trace = a program execution (behaviour) SPIN checks all traces MVP state-- state++ state state++ 1 state--

10 Correctness Requirements to Promela models Behaviour: The set of all execution sequences in the state graph Sequences may be finite or infinite Two kinds of requirements: State requirements: Boolean conditions on some (or all) system states Temporal requirements: Requirements to a certain ordering of boolean conditions on states MVP 2 10

11 Correctness Analysis: Analysis of the State Graph Promela Program State Graph Each state is described by: Values of all variables Contents of all channels Location counters for all processes MVP 2 11

12 Assertions proctype A() {.. assert(condition).. Result of analysis When this location is part of the system state, the condition must be true! Note: assert(...) is always executable No error: condition is true for all possible executions Error: there exists at least one execution, where the condition is false Assert example MVP 2 12

13 Simple counter example 1 byte state=1; 2 3 proctype A() 4 { state==1 -> state++; 5 assert (state==2) proctype B() 9 { state==1 -> state--; 10 assert (state==0) init {run A(); run B() preparing trail, please wait...done 1: proc 0 (:init:) line 13 "pan_in" (state 1) [(run A())] 2: proc 0 (:init:) line 13 "pan_in" (state 2) [(run B())] 3: proc 2 (B) line 9 "pan_in" (state 1) [((state==1))] 4: proc 1 (A) line 4 "pan_in" (state 1) [((state==1))] 5: proc 2 (B) line 9 "pan_in" (state 2) [state = (state-1)] 6: proc 2 (B) line 10 "pan_in" (state 3) [assert((state==0))] 7: proc 2 terminates 8: proc 1 (A) line 4 "pan_in" (state 2) [state = (state+1)] spin: line 5 "pan_in", Error: assertion violated spin: text of failed assertion: assert((state==2)) MVP 2 13

14 Combined (interleaved) transition system of (A B) state==1 1 state==1 state state==1 state==1 state++ state Each trace = a program execution SPIN checks all traces 1 0 state++ state-- MVP state-- state++ state state++ 1 state--

15 Invariant properties p p p p p p p p p p is always true p is an invariant assert(p) must be evaluated for all system states One way of expressing an invariant: Define a dedicated process: proctype monitor(){assert(p) MVP 2 15

16 Invariant: Simple counter revisited int int x; x; active active proctype proctype P(){ P(){ do do :: :: x<200 x<200 --> --> x=x+1 x=x+1 od od Which values may x take? active active proctype proctype Q(){ Q(){ do do :: :: x>0 x>0 --> --> x=x-1 x=x-1 od od active active proctype proctype R(){ R(){ do do :: :: x==200 x==200 --> --> x=0 x=0 od od active active proctype proctype invariant(){ invariant(){ assert(x>=-1 assert(x>=-1 && && x<=200) x<=200) count200-inv MVP 2 16

17 Linear Temporal Logic (LTL) LTL can express requirements on the ordering of state conditions (predicates): <>p Eventually p []p Always/invariantly p p U q p until q A formula must hold for ALL traces MVP 2 17

18 LTL example #define p (state==2) #define q (state==3) byte state=1; active proctype A(){ do :: state=2 od active proctype B(){ do :: state=3 od <>q? puq? [](p -> <>q)? Ltl/ltl1 example MVP 2 18

19 Implementing processes Modeling processes as finite state machines using Promela Implementing threads in Java. Note: to avoid confusion, we use the term process when referring to the models, and thread when referring to the implementation in Java. MVP 2 19

20 Two basic object invokation call-return (caller waits for callee) Efficient Callee is protected from caller Callee is a passive object start-stop (caller and callee continues) Expensive calling sequence Callee is not protected from caller Callee becomes an active object (a thread) methods call-return one thread start-stop two threads MVP 2 20

21 JVM with threads JVM State 1 State 2 State 3 State 4 Fundamental problems: Scheduling, Protection, Synchronization Four Thread States each consisting of Program Counter & Object addresses MVP 2 21

22 Threads in Java A Thread class manages a single sequential thread of control. Threads may be created and deleted dynamically. Thread run() MyThread run() The Thread class executes instructions from its method run(). The actual code executed depends on the implementation provided for run() in a derived class. class MyThread extends Thread { public void run() { //... Thread x = new MyThread(); MVP 2 22

23 Threads in Java Since Java does not permit multiple inheritance, we often implement the run() method in a class not derived from Thread but from the interface Runnable. Runnable target Thread run() public interface Runnable { public abstract void run(); MyRun class MyRun implements Runnable{ public void run() { run() //... Thread x = new Thread(new MyRun()); MVP 2 23

24 An overview of the life-cycle of a thread as state transitions: thread life-cycle in Java new Thread() Created start() causes the thread to call its run() method. start() Alive failure, or run() returns The predicate isalive() can be used to test if a thread has been started but not terminated. Once terminated, it cannot be restarted (cf. mortals). Terminated MVP 2 24

25 Thread alive states in Java Once started, an alive thread has a number of substates : start() Running sleep() wait() yield() dispatch Runnable notify() timeout Non-Runnable failure, or run() returns MVP 2 25

26 Summary of thread methods Dummy: yield Blocking: wait, wait(msec), sleep, sleep(msec), join, join(msec) Unblocking: notify, notifyall, interrupt State inquiry: isalive, isinterrupted Priority: getpriority, setpriority MVP 2 26

27 CountDown timer example Develop a JAVA applet which can: Count down once per second from some constant number Display the current count value Stop after count down to zero or when requested by system (e.g. window change) Model in Promela? MVP 2 27

28 CountDown timer - Promela #define dummy 1 #define N 5 chan beep = [0] of {bit; chan tick = [0] of {bit; chan stop = [0] of {bit; chan start = [0] of {bit; byte count=0; active proctype counter() { byte i; if :: start?dummy -> i=n; do :: i>0 -> tick!dummy; i-- :: i==0 -> beep!dummy; break :: stop?dummy -> break od fi active proctype system() { start!dummy; stop!dummy active proctype display() { do :: tick?dummy -> count++ :: beep?dummy -> break :: timeout -> break od Properties? MVP 2 28

29 CountDown timer - properties Count down to zero should be possible The system should be able to terminate before count down to zero (at system stop) MVP 2 29

30 CountDown timer - Promela #define dummy 1 #define N 5 chan beep = [0] of {bit; chan tick = [0] of {bit; chan stop = [0] of {bit; chan start = [0] of {bit; byte count=0; active proctype counter() { byte i; if :: start?dummy -> i=n; do :: i>0 -> tick!dummy; i-- :: i==0 -> beep!dummy; break :: stop?dummy -> break od fi active proctype system() { start!dummy; stop!dummy active proctype display() { do :: tick?dummy -> count++ :: beep?dummy -> break :: timeout -> break od Implementation in Java? MVP 2 30

31 CountDown timer - class diagram Applet CountDown init() start() stop() run() tick() beep() counter display Runnable target The class NumberCanvas provides the display canvas. Thread NumberCanvas setvalue() The class CountDown derives from Applet and contains the implementation of the run() method which is required by Thread. MVP 2 31

32 CountDown class public class CountDown extends Applet implements Runnable { Thread counter; int i; final static int N = 10; AudioClip beepsound, ticksound; NumberCanvas display; public void init() {... public void start() {... public void stop() {... public void run() {... private void tick() {... private void beep() {... MVP 2 32

33 CountDown class - start(), stop() and run() COUNTDOWN Model public void start() { counter = new Thread(this); i = N; counter.start(); public void stop() { counter = null; public void run() { while(true) { if (counter == null) return; if (i>0) { tick(); --i; if (i==0) { beep(); return; active proctype counter() { byte i; if :: start?dummy -> i=n; do ::i>0 -> tick!dummy; i-- ::i==0 -> beep!dummy;break ::stop?dummy -> break od fi MVP 2 33

34 CountDown class tick() and beep() private void tick(){ display.setvalue(i); ticksound.play(); try{ Thread.sleep(1000); catch (InterruptedException e){ private void beep(){ display.setvalue(i); beepsound.play(); MVP 2 34

35 Summary Concepts process - unit of concurrency, execution of a program Models Promela to model processes as state machines - sequences of atomic actions Practice Java threads to implement processes Thread lifecycle - created, running, runnable, nonrunnable, terminated MVP 2 35