A Framework for Compositional Design and Analysis of Systems by Arindam Chakrabarti B. Tech. (Indian Institute of Technology Kharagpur) 2001 M.S. (University of California at Berkeley) 2005 A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the GRADUATE DIVISION of the UNIVERSITY OF CALIFORNIA, BERKELEY Committee in charge: Professor Thomas A. Henzinger, Co-Chair Professor George C. Necula, Co-Chair Professor Edward A. Lee Professor Jack H. Silver Fall 2007 The dissertation of Arindam Chakrabarti is approved. Co-Chair Date Co-Chair Date Date Date University of California, Berkeley Fall 2007 A Framework for Compositional Design and Analysis of Systems Copyright c 2007 by Arindam Chakrabarti Abstract A Framework for Compositional Design and Analysis of Systems by Arindam Chakrabarti Doctor of Philosophy in Computer Science University of California, Berkeley Professor Thomas A. Henzinger, Co-Chair Professor George C. Necula, Co-Chair Complex system design today calls for compositional design and implementation. However each component is designed with certain assumptions about the environment it is meant to operate in, and delivering certain guarantees if those assumptions are satisfied; numerous inter-component interaction errors are introduced in the manual and error-prone integration process as there is little support in design environments for machine-readably representing these assumptions and guarantees and automatically checking consistency during integration. Based on Interface Automata [54] we propose a framework for compositional de- sign and analysis of systems: a set of domain-specific automata-theoretic type sys- tems for compositional system specification and analysis by behavioral specification of open systems. We focus on three different domains: component-based hardware sys- tems communicating on bidirectional wires. concurrent distributed recursive message- passing software systems, and embedded software system components operating in 1 resource-constrained environments. For these domains we present approaches to for- mally represent the assumptions and conditional guarantees between interacting open system components. Composition of such components produces new components with the appropriate assumptions and guarantees. We check satisfaction of temporal logic specifications by such components, and the substitutability of one component with another in an arbitrary context. Using this framework one can analyze large systems incrementally without needing extensive summary information to close the system at each stage. Furthermore, we focus only on the inter-component interaction behavior without dealing with the full implementation details of each component. Many of the merits of automata-theoretic model-checking are combined with the compositionality afforded by type-system based techniques. We also present an integer-based exten- sion of the conventional boolean verification framework motivated by our interface formalism for embedded software components. Our algorithms for checking the behavioral compatibility of component interfaces are available in our tool Chic [1], which can be used as a plug-in for the Java IDE JBuilder [2] and the heterogenous modeling and design environment Ptolemy II [3]. Finally, we address the complementary problem of partitioning a large system into meaningful coherent components by analyzing the interaction patterns between its basic elements. We demonstrate the usefulness of our partitioning approach by evaluating its efficacy in improving unit-test branch coverage for a large software system implemented in C. 2 Professor Thomas A. Henzinger Dissertation Committee Co-Chair Professor George C. Necula Dissertation Committee Co-Chair 3 To my dear father, Arya Kumar Chakrabarti, and my dear mother, Minati Chakrabarti, with love and respect, as a token of gratitude for the innumerable sacrifices they have always silently made for me throughout my life. i Contents Contents ii List of Figures v Acknowledgements vii 1 Introduction 1 1.1 Compositionaldesignofsystems. 1 1.1.1 Compatibility and Composition . 7 1.1.2 Refinement ............................ 8 1.1.3 Specifications ........................... 9 1.1.4 Application Domains . 10 1.2 RelatedWork ............................... 14 1.2.1 Staticapproaches . 14 1.2.2 Dynamicapproaches . 26 1.2.3 DesignPatterns.......................... 32 1.2.4 Software architecture specification . 33 1.2.5 Game semantics for programming languages . 36 1.3 Outline................................... 38 2 Synchronous and Bidirectional Component Interfaces 39 2.1 Introduction................................ 40 2.1.1 Thegraphview .......................... 41 ii 2.1.2 Thegameview .......................... 43 2.1.3 Synchronous interface models . 44 2.2 Compatibility and Composition . 45 2.2.1 Mooreinterfaces ......................... 45 2.2.2 Bidirectional Interfaces . 53 2.2.3 Properties of compatibility and composition . 58 2.3 Refinement ................................ 59 2.4 CompositionalVerification . 63 3 An Interface Formalism for Web Services 68 3.1 Introduction................................ 69 3.2 SignatureInterfaces............................ 72 3.2.1 Compatibility and Composition . 74 3.2.2 Refinement ............................ 75 3.3 ConsistencyInterfaces .......................... 76 3.3.1 Compatibility and Composition . 77 3.3.2 Refinement ............................ 78 3.3.3 Specifications ........................... 80 3.4 ProtocolInterfaces ............................ 83 3.4.1 Compatibility and Composition . 89 3.4.2 Refinement ............................ 90 3.4.3 Specifications ........................... 97 3.5 CaseStudy ................................ 119 4 Resource Interfaces 125 4.1 Introduction................................ 125 4.2 Preliminaries ............................... 129 4.3 ResourceInterfaces ............................ 132 4.4 Algorithms................................. 138 4.5 Examples ................................. 145 4.5.1 Distribution of resources in a Lego robot system . 145 iii 4.5.2 Resource accounting for the PicoRadio network layer . 148 5 A Natural Extension of Automata 152 5.1 Introduction................................ 153 5.2 The Integer-based Quantitative Setting . 158 5.3 Quantitative-BoundAutomata. 162 5.3.1 Specifying Quantitative Properties . 162 5.3.2 Bound Functions for Automata . 165 5.3.3 Quantitative-Bound Model Checking and Game Solving . 167 5.4 The Quantitative-Bound µ-Calculus................... 170 5.5 Unbounded Quantitative Automata and their Expressiveness . 176 5.6 Conclusion................................. 177 6 Function Interfaces and Software Partitioning 180 6.1 Introduction................................ 181 6.2 The Software Partitioning Problem . 184 6.3 Interfaces ................................. 186 6.4 Software Partitioning Algorithms . 188 6.4.1 Callee Popularity . 188 6.4.2 SharedCode............................ 193 6.5 ExperimentalResults. 197 6.6 Discussion and Other Related Work . 203 6.7 Conclusion................................. 207 Bibliography 210 iv List of Figures 1.1 Architectureofacompiler ........................ 2 1.2 Online shopping supply chain management system . 6 2.1 A counter modeled as a Moore interface. The guarded-command syn- tax is derived from the one of reactive modules [17] and Mocha [20, 53]; input atoms describe the input assumptions, and the output atoms de- scribe the output behavior. When more than one guard is true, the command is selected nondeterministically. Input variables not men- tioned by the command are updated nondeterministically. 46 2.2 A ±1 adder modeled as a Moore interface. 47 2.3 PCI and Token-ring Protocols 2.3(a) PCI Local Bus Structural Dia- gram 2.3(b) PCI Master Interface 2.3(c) Composite interface for two PCI Master Modules 2.3(d) Token Ring Network Configuration 2.3(e) Token-ringNTInterface . 57 3.1 The supply chain management application . 72 3.2 Proof rules for specification checking (part 1) . 102 3.3 Proof rules for specification checking (part 2) . 103 3.4 Proof rules for specification checking (part 3) . 104 3.5 Proof rules for specification checking (part 4) . 105 3.6 Proof rules for specification checking (part 5) . 106 3.7 Proof rules for specification checking (part 6) . 107 3.8 Proof rules for specification checking (part 7) . 108 3.9 Proof rules for specification checking (part 8) . 109 3.10 Proof rules for specification checking (part 9) . 110 v 3.11 Proof rules for specification checking (part 10) . 111 3.12 Proof rules for specification checking (part 11) . 112 3.13 Proof rules for specification checking (part 12) . 113 3.14 Proof rules for specification checking (part 13) . 114 4.1 Games illustrating the four classes of resource interfaces. 135 4.2 A/G interfaces modeling a Lego robot. 148 5.1 System K ................................. 161 6.1 The call-graph, and the partition created by sc7 ............ 196 6.2 The partition created by cp1i ...................... 197 6.3 Coverage and incidences of false alarms . 199 6.4 Overallbranchcoverage . 200 6.5 Numberoffalsealarms.......................... 201 6.6 Ratio of coverage to false alarm . 202 vi Acknowledgements First and foremost, I would like to thank my advisor, Professor Tom Henzinger, for the incredibly immense amount of support, help, encouragement, and motivation I have always received from him. I have been immensely lucky to have had the opportunity to interact with him closely for