A Lightweight Formal Method for the Prediction of Non-Functional System Properties Der Technischen Fakultät der Universität Erlangen-Nürnberg zur Erlangung des Grades Doktor-Ingenieur vorgelegt von Jörg Barner Erlangen — 2005 Als Dissertation genehmigt von der Technischen Fakultät der Universität Erlangen-Nürnberg Tag der Einreichung: 20.06.2005 Tag der Promotion: 14.10.2005 Dekan: Prof. Dr.-Ing. Alfred Leipertz Berichterstatter: Prof. Dr. Fridolin Hofmann, Prof. Dr. Khalid Al-Begain Acknowledgments First of all, I would like to thank Prof. Dr. Fridolin Hofmann for supervising this dissertation and for the open environment he created together with Prof. Dr.-Ing. Wolfgang Schröder- Preikschat in our department which allowed me to finish this project. Furthermore, I am particularly grateful to Prof. Dr. Khalid Al-Begain, my co-promoter, whose interest in appli- cations and the encouraging feedback he gave were always a great pleasure. I owe a lot of thanks to Dr.-Ing. Gunter Bolch, my “Ana” research group leader for many inspiring discussions which helped me a lot to sharpen my thoughts on important issues and prevented me from losing my direction. Without the commitment that Björn Beutel and Patrick Wüchner exhibited during the preparation of their master theses some of the concepts presented in this dissertation would have remained purely theoretical. My former office mate Dr.-Ing. Michael Schröder proof-read various intermediate ver- sions of this dissertation. Together with him, Stephan Kösters supported me in the nerve- wracking final phase before submitting the thesis by doing some valuable last-minute proof- reading. It has been a lot of fun to work at the department for distributed systems and operat- ing systems with all the colleagues and students. The pleasant working atmosphere was extraordinary, and I will always remember my time there with happiness! Special acknow- ledgments go to Dr.-Ing. Uwe Linster who gave me the opportunity to participate in the interesting UnivIS project and to Dr.-Ing. Jürgen Kleinöder for his support concerning vari- ous funding and working contract issues. Finally, I would like to express my gratitude to my parents Ilsetraut and Klaus Barner for their continuous and loving support over all these years. Far away in “down under” Leonie, Christopher and Ellen Barner always kept their fingers crossed for me and my project — Thank you all! Abstract The goal of performance and reliability evaluation during the development of computer- based systems is to predict the compliance of the projected system with a set of non-func- tional requirements. As an example, consider the expected mean end-to-end delay of data packets in a communication network, which can be predicted on the basis of a stochas- tic model during the early conceptual design phase. A glance at the software engineering practice reveals that despite their high financial savings potential academic methods of per- formance evaluation are not applied on a large scale. Frequently quoted reasons for these findings are the cumbersome notation of some stochastic description techniques and the impractical presentation of the theoretical foundations. The successful application of per- formance evaluation methods thus remains reserved to a handful of well-educated experts. This phenomenon, termed insularity problem by some members of the academic perfor- mance evaluation community, can be regarded as a special case of the general problem of low formal method acceptance in industrial software development. The first formal meth- ods were developed by several computer scientists about 40 years ago with the ambitious goal to create programs which are proven to be correct by construction. Because of the quite revolutionary approach to programming and the inability of their developers to show that formal methods are appropriate to solve larger real-world problems they did not become widely accepted and used by the software engineering industry. A promising attempt to bridge this “industry-academia gap” was initiated in the early-mid 1990s with the advent of “lightweight” formal methods for the verification of functional system requirements, some of which could be applied successfully in industrial software development projects. The initial point of view which is adopted in this dissertation is to regard performance evaluation as a branch of requirements verification techniques which are applied during the development of software-based systems. Because of the similarities in the structure and the objectives of the methods in both areas, we assume that the transfer of the lightweight for- mal method concept to the area of performance evaluation will have a positive effect on the solution of the insularity problem. In order to corroborate this assumption, a new lightweight formal method for the prediction of nonfunctional system requirements is de- veloped within the scope of this thesis. The method consists of a formal description tech- nique which is based on a well-defined syntax and semantics. It enables the user to specify the system structure and behaviour, the interaction of the system with its enviroment as well as the interesting nonfunctional system requirements as a stochastic model on a high abstraction level. The syntax of our description language combines the advantages of the pragmatic network-oriented modelling paradigm with the succinctness of a pure textual notation. The evaluation of the system properties is carried out in a user-friendly man- ner by the automatic analysis of the model in the evaluation environment prototype which was implemented in the context of this thesis. In order to demonstrate the applicability of the method we present some detailed case studies from the area of communication systems (WLAN, GSM). The keynote of this dissertation is to promote the transfer of technology from academia to industry by the integration of formal methods for performance and reliability evaluation in the early phases of the software development process. i Parts of the material presented in this thesis has previously been published as: 1. Al-Begain, Khalid; Barner, Jörg; Bolch, Gunter; Zreikat, Aymen: The Performance and Reliability Modelling Language MOSEL-2 and its Applications. International Journal on Simulation: Systems, Science and Technology, 3(3 – 4)(66-80), 2002. 2. Barner, Jörg: Performance and reliability modelling with MOSEL-2. Tutorial. ASMTA- Track of the 17th European Simulation Multiconference: Foundations for Successful Modelling & Simulation (ESM’03), Nottingham Trent University, Nottingham, England, Juni 2003 3. Barner, Jörg; Bolch, Gunter: MOSEL-2: Modeling, Specification and Evaluation Lan- guage, Revision 2 . In: Sanders, William (Hrsg.): Proc. 13th International Conference on Modeling Techniques and Tools for Computer Performance Evaluation (Performance TOOLS 2003 Urbana-Champaign, Illinois, 2 - 5.9 2003). 2003, S. 222 – 230. ii Table of Contents 1. Introduction 1 1.1. Motivation . 1 1.2. Objectives . 4 1.3. Thesis Outline . 5 2. Software Engineering meets Performance Evaluation 9 2.1. SWE – Standardised Development Processes and Description Techniques . 9 2.1.1. Origins and Concepts of Software Engineering . 9 2.1.2. The Unified Modelling Language UML ...................... 11 2.1.3. Early System Verification — An Economic Motivation . 13 2.1.4. Requirements Verification using Formal Methods . 15 2.2. Performance Evaluation — Stochastic Modelling and Analysis Techniques . 19 2.2.1. Non-Functional System Properties . 20 2.2.2. Stochastic High-Level Modelling Formalisms . 24 2.3. The Roots of Stochastic Modelling . 32 3. The MOSEL-2 Lightweight Formal Method 41 3.1. “Explain by example” vs. “Explain by methodology” . 42 3.2. Methods and Formal Systems . 44 3.2.1. Syntax, Semantics and Formal Systems . 46 3.2.2. Properties of Formal Description Techniques . 49 3.2.3. Problems in Formal Method Application . 50 3.2.4. Practical Formal Methods: The Lightweight Approach . 52 3.3. The LWFM approach for Performance Evaluation . 54 3.3.1. MOSEL-2 methodology . 54 3.3.2. The MOSEL-2 formal framework . 57 3.4. Architecture of the MOSEL-2 LWFM . 58 3.4.1. Informality: The Real World . 60 3.4.2. Formalization: From Reality to Formal Specification . 60 3.4.3. What does it mean? Semantic Mapping . 61 3.4.4. The Mathematical Foundation: Stochastic Processes . 62 4. The MOSEL-2 Formal Description Technique 77 4.1. Fixing the Expressiveness: Core Language . 78 4.1.1. The node construct . 78 4.1.2. The rule construct . 78 iii Table of Contents 4.1.3. Constant and Parameter Declarations . 82 4.2. Advanced language constructs . 83 4.2.1. The loop construct . 83 4.2.2. COND and FUNC constructs . 86 4.2.3. Reward measure definition . 87 4.2.4. The rule preprocessor . 87 5. The MOSEL-2 Evaluation Environment 91 5.1. Structure and Application Flow . 91 5.2. A Simple Analysis Example . 95 6. Related Work 99 6.1. Related Tools and Languages . 99 6.2. A Comparative Assessment with MOSEL-2 ....................... 101 7. Case Studies 105 7.1. Modelling a single GSM/GPRS Cell with Delay Voice Calls . 105 7.1.1. Informal real-world system description . 105 7.1.2. Conceptual Model . 106 7.1.3. MOSEL-2 description . 107 7.1.4. System evaluation . 108 7.2. Performance Model of a WLAN-System . 110 7.2.1. System Architecture and Working Modes . 110 7.2.2. Conceptual Model . 113 7.2.3. MOSEL-2 description . 114 7.2.4. System evaluation . 117 7.2.5. Discussion . 117 8. Conclusion 119 8.1. A Retrospect . 119 8.2. Has the Goal been reached? . 121 8.3. Future Work . 122 Einleitung 129 Zusammenfassung 136 A. MOSEL-2 syntax reference 143 B. Using the MOSEL-2 environment 147 Bibliography 148 iv List of Figures 1.1. The “Industry-Academia” Gap . 4 2.1. UML 2.0 diagram types . 12 2.2. Requirements vs. cost of error correction . 14 2.3. Potential application areas of formal methods for requirements verification and example tools .