From UML to Process Algebraand Back:An Automated Approach to Model-CheckingSoftware Design Artifacts of Concurrent Systems...
Model checking: a success story?Model CheckerSoftware/HardwareSystemNope, youregood to go!Houston, wehave a problem!Are th...
Are theredeadlocks inmy system?Model CheckerSoftware/HardwareSystemNope, youregood to go!Houston, wehave a problem!Model c...
Why state-of-the-art is not yetstate-of-the-practice?● SE wants efficient push-button verification solutions● Not everythi...
Sequence DiagramClass DiagramState Machine
State MachineClass DiagramSequence Diagram
Sequence Diagrams (UML2.x)alternativesloopparallelismbreak
Combined Fragments [ref]
For a broad domain of OO softwaresystems, Sequence Diagrams givethe most precise description of the behavior,the closest o...
Goal: a full round-trip approach,supported by a toolset.Ideally, model checking should be hiddenfrom the UML designer!
Target formalism: mCRL2● actions: atomic steps● processes: combination (sequential, parallel) ofactions …● Communication b...
The approach
The rationale: treating objects assequential processesTimeObjects (lifelines)"The general UML-to-Promela formalization app...
Objects: sequential or concurrent?In a concurrent setting, multiple threads of a process could beinvoking methods on the s...
The rationale: global choices- managing choices globally- dealing only with synchronouscommunication- not treating all Fra...
Goal: preserve the OO view in thetarget model● An OS level process is essentially a chain ofmethod invocations on objects●...
Validation● UML specification is semi-formal– Semantics deduced via partial meta-model views& natural language description...
Case Study: DIRAC Executor Framework
$ java ­jar UML2mCRL2 exportedModel.uml model.mcrl2 $ mcrl22lps ­nfbw model.mcrl2 model.lps$ lps2pbes model.lps model.pbes...
Conclusions and Future Work● Attempt to bridge the existing gap by providingtransformation methodology and toolset●Express...
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
NASA Formal Methods Symposium
Upcoming SlideShare
Loading in …5
×

NASA Formal Methods Symposium

1,053 views

Published on

From UML to Process Algebra
and Back:

An Automated Approach to Model-Checking Software Design Artifacts of Concurrent Systems

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,053
On SlideShare
0
From Embeds
0
Number of Embeds
3
Actions
Shares
0
Downloads
9
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • In conclusion: We tried to bridge the existing gap by suggesting a transformation methodology and a toolset in order to verify UML models,based on sequence diagrams. We wanted to preserve the Object Oriented aspects in the target formal model. The idea is for engineers to stay in the UML domain in the verification process. We applied it to a distributed object-oriented system, and discovered a logical flaw that prevents progress of jobs. Since we're aiming for a push-button approach, the number one problem we're currently tackling is expressing properties in the UML world too. Sequence diagrams can be easily translated into these temporal logic formulas of accept or reject scenarios, given that actions in the model correspond to message exchanges in sequence diagrams, but we're evaluating to what extent SDs can express just about any requirement.
  • NASA Formal Methods Symposium

    1. 1. From UML to Process Algebraand Back:An Automated Approach to Model-CheckingSoftware Design Artifacts of Concurrent SystemsDaniela Remenska, Jeff Templon , Tim A.C. Willemse,Philip Homburg, Kees Verstoep , Adria Casajus , and Henri BalNASA Formal Methods SymposiumMay 2013
    2. 2. Model checking: a success story?Model CheckerSoftware/HardwareSystemNope, youregood to go!Houston, wehave a problem!Are theredeadlocks inmy system?
    3. 3. Are theredeadlocks inmy system?Model CheckerSoftware/HardwareSystemNope, youregood to go!Houston, wehave a problem!Model checking: a success story?
    4. 4. Why state-of-the-art is not yetstate-of-the-practice?● SE wants efficient push-button verification solutions● Not everything is implemented in Java / C / Matlab● Not everything is described in a domain-specific verifiable language● Need to write a funky model in process algebra?● Forget it, lets just stick to testing and static analysis.● UML is the lingua franca for describing systems● Intuitive, visual, lots of CASE tools, automated test/code generation● Not officially formalized!
    5. 5. Sequence DiagramClass DiagramState Machine
    6. 6. State MachineClass DiagramSequence Diagram
    7. 7. Sequence Diagrams (UML2.x)alternativesloopparallelismbreak
    8. 8. Combined Fragments [ref]
    9. 9. For a broad domain of OO softwaresystems, Sequence Diagrams givethe most precise description of the behavior,the closest one to code implementation.
    10. 10. Goal: a full round-trip approach,supported by a toolset.Ideally, model checking should be hiddenfrom the UML designer!
    11. 11. Target formalism: mCRL2● actions: atomic steps● processes: combination (sequential, parallel) ofactions …● Communication between processes (exchange ofdata) via action synchronization ...● if-then-else constructs …● nondeterministic choices …● means to describe custom data structures ...(also:integers,reals,enumerations,booleans,lists,sets..)
    12. 12. The approach
    13. 13. The rationale: treating objects assequential processesTimeObjects (lifelines)"The general UML-to-Promela formalization approach is to mapobjects to processes in Spin (proctypes) that exchange messages...""...lines 7 and 8 specify the lifelines using process..."Executionoccurrence
    14. 14. Objects: sequential or concurrent?In a concurrent setting, multiple threads of a process could beinvoking methods on the same object.
    15. 15. The rationale: global choices- managing choices globally- dealing only with synchronouscommunication- not treating all Fragment typesWhy should object a need to knowlocal decisions of object b ?
    16. 16. Goal: preserve the OO view in thetarget model● An OS level process is essentially a chain ofmethod invocations on objects● Associate an mCRL2 process description witheach class method– Each mCRL2 process instance carries informationabout the class, object, and OS process instance towhich the method behavior belongs● Trivial to reverse model-checking traces back tothe UML domain
    17. 17. Validation● UML specification is semi-formal– Semantics deduced via partial meta-model views& natural language descriptions– No mathematically-formalized semantics– We dont have formal correctness proofs tosupport the validity of this transformation– Simulation on simple building blocks; applicationon a real case study
    18. 18. Case Study: DIRAC Executor Framework
    19. 19. $ java ­jar UML2mCRL2 exportedModel.uml model.mcrl2 $ mcrl22lps ­nfbw model.mcrl2 model.lps$ lps2pbes model.lps model.pbes –formula=formula.mcf$ pbes2bool model.pbes[true* .synch_call(1,ExecutorQueues,_queues,pushTask(JobPath,taskId,false)).true*.!(synch_call(1,ExecutorQueues,_queues,popTask([JobPath])))*.synch_reply(1,ExecutorDispatcher,_eDispatch,_sendTaskToExecutor_return(OK,0))]false● Problem: state-space explosion!- 50 processes in the model- >300million states and >600GB of memory● Workaround: standard monitoring automaton running lock-step with the model, fires a deadlock action if a violation isfound
    20. 20. Conclusions and Future Work● Attempt to bridge the existing gap by providingtransformation methodology and toolset●Express properties in UML rather than with µ-calculus[true* .synch_call(1,ExecutorQueues,_queues,pushTask(JobPath,taskId,false)).true*.!(synch_call(1,ExecutorQueues,_queues,popTask([JobPath])))*.synch_reply(1,ExecutorDispatcher,_eDispatch,_sendTaskToExecutor_return(OK,0))]falseremember this?

    ×