Formal Methods for Components and Objects: Third International Symposium, FMCO 2004, Leiden, The Netherlands, November 2-5, 2004, Revised Lectures (Lecture Notes in Computer Science, 3657) 3540291318, 9783540291312

Citation preview

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos New York University, NY, USA Doug Tygar University of California, Berkeley, CA, USA Moshe Y. Vardi Rice University, Houston, TX, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

3657

Frank S. de Boer Marcello M. Bonsangue Susanne Graf Willem-Paul de Roever (Eds.)

Formal Methods for Components and Objects Third International Symposium, FMCO 2004 Leiden, The Netherlands, November 2 – 5, 2004 Revised Lectures

13

Volume Editors Frank S. de Boer CWI, Centre for Mathematics and Computer Science Kruislaan 413, 1098 SJ Amsterdam, The Netherlands E-mail: [email protected] Marcello M. Bonsangue Leiden University Leiden Institute of Advanced Computer Science P.O. Box 9512, 2300 RA Leiden, The Netherlands E-mail: [email protected] Susanne Graf VERIMAG Centre Equitation 2 Avenue de Vignate, 38610 Grenoble-Gières, France E-mail: [email protected] Willem-Paul de Roever Christian-Albrechts-University of Kiel Institute of Computer Science and Applied Mathematics Hermann-Rodewald-Straße 3, 24118 Kiel, Germany E-mail: [email protected]

Library of Congress Control Number: 2005932547 CR Subject Classification (1998): D.2, D.3, F.3, D.4 ISSN ISBN-10 ISBN-13

0302-9743 3-540-29131-8 Springer Berlin Heidelberg New York 978-3-540-29131-2 Springer Berlin Heidelberg New York

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springeronline.com © Springer-Verlag Berlin Heidelberg 2005 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 11561163 06/3142 543210

Preface

Large and complex software systems provide the necessary infrastructure in all industries today. In order to construct such large systems in a systematic manner, the focus in the development methodologies has switched in the last two decades from functional issues to structural issues: both data and functions are encapsulated into software units which are integrated into large systems by means of various techniques supporting reusability and modifiability. This encapsulation principle is essential to both the object-oriented and the more recent componentbased software engineering paradigms. Formal methods have been applied successfully to the verification of mediumsized programs in protocol and hardware design. However, their application to the development of large systems requires more emphasis on specification, modelling and validation techniques supporting the concepts of reusability and modifiability, and their implementation in new extensions of existing programming languages. In order to stimulate interaction between the different areas of software engineering and formal methods, with a special focus on component-based and object-oriented software systems, we organized the 3rd International Symposium on Formal Methods for Components and Objects (FMCO) in Leiden, The Netherlands, from November 2nd to 5th, 2004. The program consisted of tutorial and technical presentations given by leading experts in the fields of theoretical computer science and software engineering. The symposium was attended by more than 75 people from all over the world. This volume contains the contributions after the symposium of the invited speakers. We believe that the presented material provides a unique combination of ideas on software engineering and formal methods which reflect the expanding body of knowledge on modern software systems.

July 2005

F.S. de Boer M.M. Bonsangue S. Graf W.-P. de Roever

Organization

The series of FMCO symposia are organized in the context of the bilateral NWO/DFG project Mobi-J and of the European IST project Omega.

The Mobi-J Project Mobi-J is a project founded by a bilateral research program of The Dutch Organization for Scientific Research (NWO) and the Central Public Funding Organization for Academic Research in Germany (DFG). The partners of the Mobi-J projects are: the Centrum voor Wiskunde en Informatica, the Leiden Institute of Advanced Computer Science, and the Christian-Albrechts-Universit¨ at Kiel. This project aims at the development of a programming environment which supports component-based design and verification of Java programs annotated with assertions. The overall approach is based on an extension of the Java language with a notion of component that provides for the encapsulation of its internal processing of data and composition in a network by means of mobile asynchronous channels.

The Omega Project The overall aim of the European IST project Omega (2001-33522) is the definition of a development methodology in UML for embedded and real-time systems based on formal verification techniques. The approach is based on a formal semantics of a suitable subset of UML, adapted and extended where needed with a special emphasis on time-related aspects. The Omega project involves the following partners: VERIMAG (France, Coordinator), Centrum voor Wiskunde en Informatica (The Netherlands), Christian-Albrechts-Universit¨at (Germany), University of Nijmegen (The Netherlands), Weizmann Institute (Israel), OFFIS (Germany), EADS Launch Vehicles (France), France T´el´ecom R&D (France), Israeli Aircraft Industries (Israel), and National Aerospace Laboratory (The Netherlands).

Sponsoring Institutions The Dutch Organization for Scientific Research (NWO) The European project IST-2001-33522 Omega The Lorentz Center, Leiden, The Netherlands The Royal Netherlands Academy of Arts and Sciences (KNAW) The Dutch Institute for Programming Research and Algorithmics (IPA) The Centrum voor Wiskunde en Informatica (CWI), Amsterdam, The Netherlands The Leiden Institute of Advanced Computer Science (LIACS), The Netherlands

Table of Contents

A Theory of Predicate-Complete Test Coverage and Generation Thomas Ball . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

A Perspective on Component Refinement Lu´ıs S. Barbosa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

A Fully Abstract Semanti cs for UML Components Frank S. de Boer, Marcello M. Bonsangue, Martin Steffen, ´ Erika Abrah´ am . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

49

From (Meta) Objects to Aspects: A Java and AspectJ Point of View Pierre Cointe, Herv´e Albin-Amiot, Simon Denier . . . . . . . . . . . . . . . . . .

70

MoMo: A Modal Logic for Reasoning About Mobility Rocco De Nicola, Michele Loreti . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

95

Probabilistic Linda-Based Coordination Languages Alessandra Di Pierro, Chris Hankin, Herbert Wiklicky . . . . . . . . . . . . . . 120 Games with Secure Equilibria Krishnendu Chatterjee, Thomas A. Henzinger, Marcin Jurdzi´ nski . . . . 141 Priced Timed Automata: Algorithms and Applications Gerd Behrmann, Kim G. Larsen, Jacob I. Rasmussen . . . . . . . . . . . . . . 162 rCOS: Refinement of Component and Object Systems Zhiming Liu, He Jifeng, Xiaoshan Li . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Program Generation and Components Davide Ancona, Eugenio Moggi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Assertion-Based Encapsulation, Object Invariants and Simulations David A. Naumann . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 A Dynamic Binding Strategy for Multiple Inheritance and Asynchronously Communicating Objects Einar Broch Johnsen, Olaf Owe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

VIII

Table of Contents

Observability, Connectivity, and Replay in a Sequential Calculus of Classes ´ Erika Abrah´ am, Marcello M. Bonsangue, Frank S. de Boer, Andreas Gr¨ uner, Martin Steffen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 Timing Analysis and Timing Predictability Reinhard Wilhelm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

A Theory of Predicate-Complete Test Coverage and Generation Thomas Ball Microsoft Research, Redmond, WA, USA [email protected]

Abstract. Consider a program with m statements and n predicates, where the predicates are derived from the conditional statements and assertions in a program. An observable state is an evaluation of the n predicates under some state at a program statement. The goal of predicatecomplete testing (PCT) is to evaluate all the predicates at every program state. That is, we wish to cover every reachable observable state (at most m × 2n of them) in a program. PCT coverage subsumes many existing control-flow coverage criteria and is incomparable to path coverage. To support the generation of tests to achieve high PCT coverage, we show how to define an upper bound U and lower bound L to the (unknown) set of reachable observable states R. These bounds are constructed automatically using Boolean (predicate) abstraction over modal transition systems and can be used to guide test generation via symbolic execution. We define a static coverage metric as |L|/|U |, which measures the ability of the Boolean abstraction to achieve high PCT coverage.

1

Introduction

Control-flow-based test generation generally has as its goal to cover all the statements or branches in a program. There are various control-flow adequacy criteria that go beyond branch coverage, such as multiple condition coverage, the ultimate of which is path coverage. Errors that go undetected in the face of 100% statement or branch coverage may be due to complex correlations between the predicates (that control the execution of statements) and the statements (that affect the value of these predicates) of a program. However, paths are notoriously difficult to work with as a coverage metric because there are an unbounded number of them in programs with loops, which characterizes most interesting programs in existence. So, we seek an alternative to path coverage that has its “exhaustive” quality but induces a finite (rather than infinite) state space. We start with a fixed notation for atomic predicates (not containing Boolean connectives), taken from the relevant programming language. A predicate maps a state to a Boolean value. For example, the predicate (x > 0) observes whether or not variable x has a positive value in a given state. Consider a program with m statements and n predicates. These predicates can be drawn from the conditional statements and assertions in a program, as well as from implicit run-time safety checks (for F.S. de Boer et al. (Eds.): FMCO 2004, LNCS 3657, pp. 1–22, 2005. c Springer-Verlag Berlin Heidelberg 2005 

2

T. Ball

checking for array bounds violations or divide-by-zero errors, for example). An observable state is an evaluation of the n predicates under some program state at a statement. While the set of states in a program is unbounded, the size of the set of observable states (S) is at most (m × 2n ). The goal of predicate-complete testing (PCT) is to evaluate all the predicates at every program state. That is, we wish to cover all reachable observable states. PCT coverage is motivated by the observation that certain errors in a program only can be exposed by considering the complex dependences between the predicates in a program and the statements whose execution they control. The n predicates represent all the case-splits on the input that the programmer has identified (Of course, the programmer may have missed certain cases– specification-based testing would need to be used to determine the absence of such case-splits). In the limit, each of the m statements may have different behavior in each of the 2n possible observable states, and so should be tested in each of these states. We show that PCT coverage subsumes traditional coverage metrics such as statement, branch and multiple condition coverage and that PCT coverage is incomparable to path coverage. PCT groups paths ending at a statement s into equivalence classes based on the observable states the paths induce at s. Control-flow coverage metrics result from dividing a dynamic measure (for example, the number of statements executed by a test) into a static measure (for example, the number of statements in a program). Clearly, such a metric also can be defined for observable states. However, the choice of (m × 2n ) as a denominator will not do, as we expect many of the (m × 2n ) states to be unreachable. (Statement coverage does not suffer greatly from this problem because most statements are reachable). For example, if the set of predicates contains (x = 0) and (x = 1) then not all combinations are possible. Thus, we desire a way to define a better denominator for PCT coverage. The main result of this paper is a way to overapproximate and underapproximate the set of reachable observable states (R) using the theory of modal transition systems and Boolean abstraction. The Boolean abstraction of a program with respect to its n predicates is a non-deterministic program, whereas the original concrete program is deterministic. We show how reachability analysis of this abstract program yields an upper bound U for R (R ⊆ U ) as well as a lower bound L for R (L ⊆ R). The set U is an overapproximation of R: any state outside U is not a reachable observable state and need not (indeed, cannot) be tested. This set U provides a better denominator than (m × 2n ). Conversely, the set L is an underapproximation of R: any state in L must be a reachable observable state. That is, every state in L must be testable. We show how to use L to guide symbolic path-based test generation to cover the untested states in L. Our definition of L relies on a novel enhancement to modal transition systems that enlarges the set of states that can be proved to be reachable observable states. This paper is organized as follows. Section 2 compares predicate-complete test coverage to other forms of control-flow coverage. Section 3 precisely defines

A Theory of Predicate-Complete Test Coverage and Generation

3

the system of abstraction we will use to compute the upper and lower bounds. Section 4 gives algorithms to compute these upper and lower bounds. Section 5 gives an example that shows how the use of PCT coverage and the lower and upper bounds can be used to expose an error in a small function. Section 6 presents an algorithm that uses the lower bound to guide test generation. Section 7 discusses some of the implications of our results. Section 8 reviews related work and Section 9 concludes the paper.

2

A Characterization of Predicate-Complete Test Coverage

This section compares PCT coverage with other forms of control-flow coverage. In this comparison, we decompose complex predicates into atomic predicates. So, the program fragment “L1: if ((x