Behavioral Verification of Distributed Concurrent Systems with BOBJ

Behavioral Verification of Distributed Concurrent Systems with BOBJ Joseph Goguen Kai Lin Dept. Computer Science & Engineering San Diego Supercomputer Center University of California at San Diego [email protected] [email protected] Abstract grams [4]), whereas design level verification is easier and more likely to uncover subtle bugs, because it does not re- Following condensed introductions to classical and behav- quire dealing with the arbitrary complexities of program- ioral algebraic specification, this paper discusses the veri- ming language semantics. fication of behavioral properties using BOBJ, especially its These points are illustrated by our proof of the alternat- implementation of conditional circular coinductive rewriting bit protocol in Section 4. There are actually many dif- ing with case analysis. This formal method is then applied ferent ways to specify the alternating bit protocol, some of to proving correctness of the alternating bit protocol, in one which are rather trivial to verify, but our specification with of its less trivial versions. We have tried to minimize mathe- fair lossy channels is not one of them. The proof shows that matics in the exposition, in part by giving concrete illustra- this specification is a behavioral refinement of another be- tions using the BOBJ system. havioral specification having perfect channels, and that the latter is behaviorally equivalent to perfect transmission (we thank Prof. Dorel Lucanu for this interpretation). 1. Introduction Many important contemporary computer systems are distributed and concurrent, and are designed within the ob- Faced with increasingly complex software and hardware ject paradigm. It is a difficult challenge for formal meth- systems, including distributed concurrent systems, where ods to handle all the features involved within a uniform the interactions among components can be very subtle, de- framework. Hidden algebra, which was introduced in [12] velopers are turning more and more to formal methods. and elaborated in [21, 22, 16, 32, 34], is a systematic ap- Such methods use specifications written in mathematical proach to such problems. Hidden algebra allows models logic, and sound proof rules that support refinements, yield- that only satisfy their specifications behaviorally, in that ing rigorous mathematical proofs of significant properties. they appear to exhibit the required behavior under all rel- The goal is not only to increase quality and decrease cost, evant experiments; this is important because many clever but also to allow assertions about reliability that can be implementations used in practice only satisfy their specifi- checked in a precise way. Formal methods can be applied cations in this sense. Hidden algebra extends many sorted throughout a development cycle, or at selected steps, in algebra by distinguishing between “visible” sorts used to which case refinement proofs can insure the correctness of model data, and “hidden” sorts used to model states. This key decisions at those steps. framework provides natural ways to handle the most trou- Formal methods involve specification and verification. bling features of large systems, including concurrency, dis- Formal specifications describe a system and its desired tribution, nondeterminism, as well as the usual features of properties in a formal language, using notation derived from the object paradigm, including classes, subclasses (inheri- the underlying logic. Formal verification uses formal logic tance), and local states with attributes and methods, in addi- to prove that a specification satisfies certain desirable prop- tion to abstract data types, generic modules, and more gen- erties. A proof can be viewed as a test of a specification, erally, the powerful module system of parameterized pro- which can help understand requirements, improve speci- gramming [11]. Hidden algebra generalizes the approaches fications, and detect design errors. A specification with- of process algebra and transition system to include non- out proofs may contain inconsistencies or inappropriate as- monadic parameterized methods and attributes; this extra sumptions. In our opinion, code level verification is a dif- power can sometimes dramatically simplify verification. ficult task that is often not worth the trouble (since code Behavioral equations were introduced by Reichel [31] in level errors are a small percentage of the total errors in pro- 1981, and have since been used by many researchers. Be- havioral logic is a diverse research area, including not just We offer many thanks to Grigore Ros¸u for his work hidden algebra, but also the coherent hidden algebra of Di- on circular coinductive rewriting, and to Kokichi Futatsugi aconescu [8, 7], and the observational logic of Bidoit and for his ongoing support and encouragement. We also thank Hennicker [25, 3]. These approaches fall into two broad cat- Monica Marcus for finding a bug, and Dorel Lucanu for his egories, depending on whether or not a fixed data algebra is helpful remarks. assumed for all models. A new generalization of hidden algebra treats these variants in a uniform way [16, 34]. Coal- 2. Algebraic Specification and BOBJ gebra is another related area, in that is also supports behavioral specification, and uses coinduction; e.g., see the sur- This section begins with a review of classical algebraic vey paper [26]. specification, including both loose and initial specification, Of course, the proof rules in these logics are sound, and then moves on to behavioral algebraic specification, but they are also incomplete [6], so there cannot be any particularly its foundation in hidden algebra, and its imple- algorithm for proving all true statements. Context induc- mentation in BOBJ. tion [24, 2] and general coinduction [18, 19] are two pop- ular proof techniques for verifying behavioral properties, 2.1. Loose and Data Specification but both need intensive human intervention. Circular coinduction, introduced in [34], is a powerful method, effec- This subsection introduces the basic concepts, notation and tively implemented by the circular coinductive rewriting al- terminology that we need from classical algebraic specifi- gorithm, which has automatically proved many behavioral cation; readers may wish to consult this material on an as- properties [16, 17]. Behavioral equivalence generalizes the needed basis. Given a set , an -sorted set ¡ is a fam- ¤¦¥ notion of bisimilarity used in process algebra, where there ily of sets ¡£¢ , one for each . The elements of are §¨¡ ¤ ¥ is a very large literature, including proof methods that seem called sorts and the notation ¢ © is used. A signa- § ¤"! ¥ to be special cases of coinduction. Howerer, this lies outside ture is an -sorted set ¢© . The el- the scope of this paper, so we just mention Milner’s very in- ements of ¢ are called operation (or function) symbols ¤"! ¤ $%¥&£'( # fluential process algebra CCS [29], and [30], where the no- of arity , sort , and type ; in particular, ¢ $ tion of bisimilarity seems to have originated. is a constant symbol ( )+* denotes the empty string). If has ¤"! $-, ¤ BOBJ [16, 17, 34, 32] is an executable algebraic spec- the type , we write /. , and constants are writ- 0 , ¤ 0£¥12'( . ification language developed in the Meaning and Compu- ten when ¢ . tation Lab at the University of California, San Diego, for Signatures are given in BOBJ by giving sorts after the supporting behavioral specification and verification, based keywords sort or sorts, and operations after the key- on recent developments in hidden algebra. In addition to words op or ops. The form of an operation follows the op rewriting for order sorted equational logic1, BOBJ also im- keyword, then a colon followed by a list of the sorts for ar- plements order sorted behavioral rewriting and conditional guments to that operation, followed by an arrow, followed circular coinductive rewriting with case analysis (the latter by the value sort of the operation. Underbar characters may abbreviated C4RW). This paper illustrates this method by serve as place holders within the form, to indicate where verifying the Alternating Bit Protocol (abbreviated ABP), the arguments should go; the number of underbars and ar- in one of its less trivial versions; BOBJ seems to be the first gument sorts should be the same, as in the in operation be- system to support automatic coinduction proofs of anything low. If there are no underbars but the argument sort list is like this complexity. Such proofs have only recently become non-empty, as with the insert operation below, the op- possible, due to the implementation of C4RW in BOBJ, and eration is assumed to have syntax that requires opening and a new event mark stream approach to fairness, as discussed closing parentheses, with commas between arguments, as in in Section 4.2 below. CafeOBJ [7] and Spike [2] also sup- insert(2, S). The following is a simple signature for a port behavioral specification and verification, but C4RW is theory of sets in BOBJ notation: only implemented in BOBJ. sorts Elt Set . Section 2 explains some basics of classical and hidden op empty : -> Set . op _in_ : Elt Set -> Bool . algebraic specification, Section 3 discuss the C4RW algo- op insert : Elt Set -> Set . rithm, while Section 4 discusses conclusions and some fu- Note that overloading is possible (and is helpful for read- ture work. We try to keep theory to a minimum, and we ability) in this framework, since the same form can have also describe only features of BOBJ that are necessary for more than one type. For example, the form _in_ could our examples; much more information about BOBJ can be ! also be an operation on lists, with type #35476"8 35476¨89+:<;=;?> , found in the thesis of Kai Lin [27]. where Bool is the sort of Booleans, from the builtin module BOOL, which is imported by default into every other 1 I.e., many sorted with subsorts [20, 23]. module. 2 ¦ ¡ 2' ( ' ( ¤ ¥ ¢£¢¥¤ is a ground signature iff ¢ whenever the same sort ; we may write such an equation ab- ¦ ¤¨§ ¤ © ¢ ) * SRT G G© ¤ ¤ ¤ ¤ and unless . Union is defined com- stractly in the form and concretely in the form © © SR"P G G© §WP ¢ ¢ U 8V © © XU XV ¤ ¤ ¤ ponentwise, by ¢ .

Load more