Finite Model Generation for Distributed Java Programs

1
Finite Model Generation for Distributed Java
Programs

• Eric MADELAINE
• Rabea BOULIFA
• OASIS team
• INRIA Sophia-Antipolis, France

2
Context

• Analysis and verification software platform for
  distributed Java applications.
• Pervasive and mobile computing, e-commerce, grid
  computing
• Long term goal full language, usable by
  non-specialists
• Automatic tools static analysis,
  model-checkers, equiv / preorder checkers.

Graphical / Logical Specifications
Automatic tools, diagnostics, etc.
Code analysis
Finite model
3

• Software verification
• ESC-Java, CADP, Slam, Blast, Feaver,
  Bandera, JPF
• So, whats special with distributed applications
  ?
• Asynchronous communication
• error-prone, state explosion
• Structured composition of distributed components
• hierarchical construction / reduction / analysis
  of models
• bisimulation semantics
• Well-defined, architecture-independent semantics
• with the ProActive Library.

• Inherit methods and tools from existing
  software
• Static analysis from Soot.
• Slicing / abstraction from Bandera.
• Standard or prototype checkers (action based)

4
Related Work

• ESC-JAVA Java code, pre-post conditions,
  invariants on methods data, debug oriented.
• CADP Lotos code, simulation, test generation,
  model-checking, equivalence checking.
• SLAM C code, pointer analysis and boolean
  abstraction, device driver verification, Bebop
  and Moped checkers.
• BLAST C code, abstraction refinement, temporal
  safety properties.
• FEAVER C code (large telecom software),
  properties as logic, automata, or diagram, model
  extraction, Spin.
• BANDERA - JPF Sequential and multi-threaded Java
  code, slicing and abstraction, Spin or others.

5
Outline

• Distributed Java Applications, the ProActive
  Library
• Models Parameterised Networks of LTSs
• Model Construction
• Verification Platform
• Conclusion

6
Distributed Java Applications the ProActive
Library

• Features distributed, mobile, heterogeneous.
• Transparent distribution
• no shared data between distributed
  objects.
• Message semantics (method calls request queue)
  gt
• delivery guarantied by the middleware
  (MOP).
• Requests and responses transparent future
  objects with wait by necessity.

7
ProActive Communication Scheme
Local object
Remote object

8
Model Parameterised Networks of synchronised LTSs

• Actions Requests/Responses
• (method name finite abstraction of arguments)
• Finite Extended LTSs (integer variables)
• Synchronisation Networks Arnold 80
• Global action lt , , L1, , L2, ,
• Concrete syntax
• FC2 intermediate language
• extended for encoding integer parameters

9
Model Construction (1) Nets
Q3 A3

• Finitely many active objects class / creation
  points
• User provided approximation of arguments
• (abstract interpretation to finite or integer
  domains)
• gt Boxes and Links computed by static analysis
  (dataflow, reference and alias analysis)

Q1 A1
Req (M, args)
P(k)
Q2 A2
Rep (v)
10
Model Construction (2) Activities

• 1 LTS per activity
• Construction by SOS rules, based on the Method
  Call Graph of the active object.
• Termination guarantied (for a finite data
  abstraction)
• gt Rules and proofs in the full paper
• http//www-sop.inria.fr/oasis/Vercors

11
Model Construction Queues

• Arbitrary unbounded structures, usually regular,
  depending on the inspection primitives used in
  the code. We use finite approximations.
• In many interesting cases it can be proved that a
  bounded size is enough (global property of the
  system).

• Factorisation / optimisation of the model by
  code analysis.

12
Parameterised Verification Methods
Source Code
Model Construction
Finite Instantiation
Parameterised Specification
Parameterised networks / Parameterised
logics
13
Conclusion

• Behaviour models of ProActive distributed
  applications encode asynchronous communication
  between distributed objects.
• With usual data/structure abstraction, we build
  finite, hierarchical, models suitable for
  automatic verification.
• Parameterised models can be finitely instantiated
  (adapted to each property), or directly fed into
  specialised tools. They are more compact and more
  flexible.
• Case Study Chilean electronic tax system
• Other ProActive features group communication,
  security policy specification.
• Behaviour specification for distributed
  components (in ObjectWeb / Fractal)

Directions
14
Finite Model Generation for Distributed Java
Programs

• Eric MADELAINE
• Rabea BOULIFA
• OASIS team
• INRIA Sophia-Antipolis, France

http//www-sop.inria.fr/oasis/Vercors
http//www-sop.inria.fr/oasis/Proactive