Proc. RELECTRONIC 95, Budapest, pp. 181-186; October 1995 Petr Net Based Software Dependablty Engneerng Monka Hener Brandenburg Unversty of Technology Cottbus Computer Scence Insttute Postbox 101344 D-03013 Cottbus Germany mh@nformatk.tu-cottbus.de Tel/Fax: (+ 49-355) 69-2794 Abstract: Methods of software dependablty engneerng can be dvded nto two groups - methods to mprove the software dependablty and methods to predct the reached degree of software dependablty. Among those methods, whch am at the mprovement of software dependablty, the Petr net based valdaton technques to avod faults durng the development phase have attract a lot of attenton n the last years. Wthn ths framework, Petr net models play the role of a common ntermedate software representaton, from whch dfferent valdaton technques are able to start - qualtatve as well as quanttatve ones. Based on ths experence, the approach to ntegrate dfferent methods on a common representaton s extended by a formal method to derve Petr net models sutable for a structureorented relablty predcton. 1 Motvaton Startng from the taxonomy of dependablty ntroduced n /Avzens 86/, methods of software dependablty engneerng can be dvded nto two groups - methods to mprove the software dependablty by fault avodance or fault tolerance (procurement) and methods to predct the reached degree of software dependablty (assessment). Among those methods, whch am at the mprovement of software dependablty, dfferent knds of Petr net based valdaton technques to avod faults durng the development phase have attract a lot of attenton n the last years. A classfcaton of software valdaton technques should separate the valdaton methods (man prncples) on the one sde and the propertes to be valdated on the other sde /Hener 92/. These software valdaton technques should then be embedded n a process model to develop software wth hgh dependablty demands. A sutable order of valdaton methods takes nto account that valdaton should be appled as early as possble, 1 / 6
Petr Net Based Software Dependablty Engneerng the proper functonalty s a prerequste for an evaluaton of quanttatve propertes, and the expected functonalty can only be guaranteed n any case f all consstency condtons of context checkng have been fulflled. Wthn ths general framework a Petr net based methodology of software dependablty engneerng can be outlned. The approach combnes qualtatve analyss (1), montorng and testng (2) as well as quanttatve analyss n terms of performance evaluaton/predcton (3) and relablty predcton (4) on the bass of a common Petr net-based ntermedate representaton of the parallel/dstrbuted software system under consderaton. A sketch of the man prncples whch are common to the frst three ponts s gven n the next secton, whle the last pont s dscussed n the next but one secton. 2 Net Based Methods to Improve Dependablty Dfferent valdaton methods may requre net models whch vary partly n ther level of abstracton. Ths varety comprses not only such typcal quanttatve parameters as delay and branchng nformaton (whch are obvously necessary n case of quanttatve analyss), but also the granularty of consdered control and/or data flow,.e. the degree of detals concernng structural nformaton. Therefore, n order to ntegrate qualtatve as well as quanttatve analyss on a common ntermedate software representaton, an mportant feature of a related methodology s the ablty of a controlled structural reducton, combned wth compresson of any quanttatve parameters. In /Hener 95/, a method s outlned how to develop these models step-by-step: qualtatve models control structure models as place/transton nets (Any branchng nformaton s neglected. Every structurally possble path of the model s consdered to be realzable n the software. The set of executon paths of the model s greater or equal as the software s executon path set.) control flow models as coloured nets (All control varables determnng the actually control flow are added to the control structure model. So, the control flow model s generally much greater than the control structure one. But model and software have the same set of executon paths.) quanttatve models performance models as tmed, nterval or stochastc Petr nets (dependng on the type of performance measures to be evaluated) relablty models as stochastc Petr nets All transformatons (from the parallel software system descrpton nto a frst qualtatve Petr net model, and between the dfferent knds of net models) can be done formally, and therefore automated to a hgh degree. 2 / 6
Proc. RELECTRONIC 95, Budapest, pp. 181-186; October 1995 Obvously, the ndvdual valdaton technques are essentally nfluenced by the analyzng possbltes avalable for the correspondng net classes. (1) The valdaton of qualtatve propertes comprses two steps. At frst, the context checkng of general semantc propertes (bascally lveness propertes) s done by a sutable combnaton of statc and dynamc analyss technques of (classcal) Petr net theory. Afterwards, the verfcaton of well-defned specal semantc propertes (among them safety propertes) gven by a separate specfcaton of the requred functonalty s performed. Durng ths second step, the power of classcal Petr net theory s supplemented by the model checkng approach, usng temporal logc as a flexble query language for askng questons over the (complete/reduced) set of reachable states. (2) The obectves of the montorng and testng component are twofold. Besdes the provson of the quanttatve attrbutes accordng to the user-drven tme abstracton level, the net-based testng method supports a systematc test of parallel systems. Technques to derve automatcally dedcated test sutes and to measure the test coverage obtaned are mportant features of ths systematc testng. (3) The valdaton of quanttatve propertes has to be based on quanttatve net models. The frequency and maybe also delay attrbutes necessary to transform qualtatve models nto quanttatve ones are provded by the montorng and testng component or, n smple cases, calculated from the basc nstructon sequences. The avalable Tme Petr net classes dffer essentally n the provded tme concept (tmed nets: constant delay, nterval nets (usually called tme nets): nterval delay, stochastc nets: dfferent knds of probablty dstrbutons of the delay, or combnatons of them). The choce of a sutable net class should be guded by the well-known engneer s basc prncple to keep everythng as smple as possble. So the answer depends on the propertes to be valdated. As long as there are hard deadlnes to meet defntely, e.g. as t should be the case for systems wth predctably tmng behavour, the exact evaluaton by tmed or nterval nets s unavodable. If average or probablty dstrbutons of performance measures lke load, throughput, utlzaton etc. are wanted, then the applcaton of stochastc Petr nets becomes useful. In /Hener 94/, an example s gven how to obtan the quanttatve model from the qualtatve one by quanttatve expanson and property-preservng structural compresson usng the so-called locally Markovan Obect Nets (MONs) as stochastc net class. Conflct clusterng wthn the underlyng net and a concept for tme abstracton of sequental software parts are crucal ponts of ths transformaton. General rules are gven n those paper for a sutable decomposton of Petr nets nto obects or to fnd sutable tme abstractons, respectvely. 3 Net Based Method to Predct Dependablty Based on ths experence, we are now gong to extend the approach to ntegrate dfferent methods on a common representaton by ntroducng an approach to structure-orented relablty predcton nspred by /Roca 88/. Ths s ntended as a frst step n the drecton 3 / 6
Petr Net Based Software Dependablty Engneerng Fgure 1: Input parameters of relablty evaluaton. p 1 t 1 n falure free case: n p k = 1 k = 1 p n t n n case of falure n p k < 1 k = 1 notaton: p - probablty of enterng the path (,) and executng the path successfully, t - (average) tme to execute the path (,) probablty of unsuccessfully executng the path (,) n 1 p k k = 1 to ncorporate further dependablty measures too. Agan, the model whch we need as reference pont for the evaluaton to be done, should not be bult from the scratch, but nstead of ths, the dependablty model should be derved to a hgh degree automatcally from that net models whch we do have due to our valdaton efforts. Because we already know, how to map software onto (place/transton) Petr nets, we have then altogether a formal method to derve systematcally Petr net models sutable for dependablty predcton of the software under consderaton. The quanttatve parameters are now, n case of dependablty predcton (see Fgure 1), the probablty of enterng and executng successfully a gven path and the (average) tme to execute a gven path. The executon tme can agan be measured by the testng and montorng component or, n specal cases, calculated from nstructon sequences. The probablty of unsuccessfully executng a path (,) depends on the proporton of bugs n the total program. Ths proporton could be assessed from experence, e.g. by testng software of the same characterstcs and sze developed by the same programmng team. The method proposed conssts bascally of a set of rules descrbng the allowed structural reductons and the correspondng transformaton rules of the quanttatve parameters wthn any well-structured sequental substructures (see Fgure 2). Provded there are no nformaton about the probablty dstrbutons of any nputs, then the assumpton s ustfed that the probablty of enterng the path (,) s equal for all program branches. In that case, the total falure (hazard) rate z of the gven software can be computed mmedately for a well-structured sequental program whch has been completely 4 / 6
Proc. RELECTRONIC 95, Budapest, pp. 181-186; October 1995 p 1 p reduced to be by be z be = ----------------. b t e t be be Generally, n case of parallel programs, the falure rate has to be evaluated by sutable stochastc Petr net evaluaton tools. But a structural reducton combned wth compresson of quanttatve parameters, done before as strong as possble, may reduce the computatonal costs essentally. 4 Fnal Remarks The evaluaton of the stochastc software model by conventonal stochastc Petr nets tools requres a model transformaton to mantan the rght conflct soluton strategy (see Fgure 3). At frst, the branchng of control flow has to be decded, and afterwards the tme consumpton (of any sequental program parts) may take place. Obvously, ths transformaton comes along wth ntroducng a lot of mmedate transtons causng agan many transent reachablty states. Because these transent states are useless from the practcal pont of vew t would be worth thnkng over how to avod them. Fgure 2: Structural compresson wthn sequental parts. p k t k p k p k p = p k p k t k k t k t = t k + t k t' p = + p'' p'' t'' t' + p'' t'' t = -------------------------------------------- + p'' t' t p p = -------------- 1 p p t t = t' + --------------- 1 p 5 / 6
Petr Net Based Software Dependablty Engneerng Fgure 3: Transformaton nto stochastc model. t' t' p'' t'' p'' t'' notaton: mmedate transtons determnstcally delayed transtons wth reservaton of marks determnstcally delayed transtons, no reservaton of marks The ntended extenson to other dependablty measures requres more sophstcated fault models, whch have to be added as envronment assumpton to the total evaluaton model. To support the user, a lbrary of approprate Petr net components for dfferent fault models would be useful. 5 References /Avzens 86/ Avzens, A.; Lapre, J.-C.: Dependable Computng: From Concepts to Desgn Dversty; Proc. of the IEEE 74(86)5, pp. 629-638. /Hener 92/ Hener, M.: Petr Net Based Software Valdaton - Prospects and Lmtatons; Techn. Report ICSI Berkeley/CA, TR-92-022. /Hener 94/ Hener, M.; Wkarsk, D.: An Approach to Petr Net Based Integraton of Qualtatve and Quanttatve Analyss of Parallel Systems; Techn. Report BTU Cottbus, I-09/1994. /Hener 95/ Hener, M.: Petr Net Based Software Dependablty Engneerng - a Case Study; to appear as Tutoral materals at ISSRE 95 (The 6th Int. Symposum on Software Relablty Engneerng), Toulouse, Oct. 1995. /Roca 88/ Roca, J. L.: A Method for Mcroprocessor Software Relablty Predcton; IEEE Trans. on Relablty 37(88)1, pp. 88-91. 6 / 6