Formal techniques for networked and distributed systems-- FORTE 2007: 27th IFIP WG 6.1 international conference, Tallinn, Estonia, June 27-29, 2007: proceedings [1 ed.] 9783540731955, 3540731954

Citation preview

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Moshe Y. Vardi Rice University, Houston, TX, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

4574

John Derrick Jüri Vain (Eds.)

Formal Techniques for Networked and Distributed Systems – FORTE 2007 27th IFIP WG 6.1 International Conference Tallinn, Estonia, June 27-29, 2007 Proceedings

13

Volume Editors John Derrick University of Sheffield Department of Computer Science Regent Court, 211 Portobello Street, Sheffield, S1 4DP, UK E-mail: [email protected] Jüri Vain Tallinn University of Technology Department of Computer Science Ehitajate tee 5, 19086 Tallinn, Estonia E-mail: [email protected]

Library of Congress Control Number: 2007928737 CR Subject Classification (1998): C.2.4, D.2.2, C.2, D.2.4-5, D.2, F.3, D.4 LNCS Sublibrary: SL 2 – Programming and Software Engineering ISSN ISBN-10 ISBN-13

0302-9743 3-540-73195-4 Springer Berlin Heidelberg New York 978-3-540-73195-5 Springer Berlin Heidelberg New York

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springer.com © IFIP International Federation for Information Processing 2007 Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12079162 06/3180 543210

Preface

These proceedings contain papers from the 27th FORTE conference. FORTE (Formal Techniques for Networked and Distributed Systems) is the joint international annual conference combining the former PSTV (Protocol Specification Testing and Verification) and former FORTE (Formal Description Techniques for Distributed Systems and Communication Protocols) conferences. The first PSTV conference took place in 1981, and the first FORTE took place in 1988. They were merged into one larger conference in 1996 and have run under the name of FORTE from 2001. The conference is a forum for presentation and discussion of the state of the art in theory, application, tools, and industrialization of formal methods. Over the years, FORTE has been held in numerous locations, and this is reflected by its recent history, with meetings in Pisa (Italy), Cheju Island (Korea), Houston (USA), Berlin (Germany), Madrid (Spain), Paris (France), Taiwan and now Tallinn, Estonia. FORTE was sponsored by Working Group 6.1 of Technical Committee 6 (TC6) of the InternationalFederation for Information Processing (IFIP). Indeed FORTE is one of the flagship conferences of Working Group 6.1 (Architectures and Protocols for Distributed Systems), and covers many aspects of the main themes of WG6.1, namely, formal description techniques, open distributed systems, and quality of service. WG6.1 provided a Best Paper Award as well as funds to help student participation, and we are particularly grateful for this. The 27th FORTE conference was held during June 26–29, 2007, in Tallinn (Estonia), in the historical building of the Brotherhood of the Black Heads. The focus of FORTE 2007 was on service-oriented computing and architectures using formalized and verified approaches. In addition to the classical protocol specification and verification problems, FORTE 2007 addressed the issues of composition of protocol functions and of algorithms for distributed systems. We had a large number of submissions, and finally selected 22 papers from 67 submissions These papers covered a variety of topics, and the program was divided into eight sessions: Message Sequence Charts and SDL; Concurrency; Model Programs; Theory; Verification; Model Checking; Requirements and QoS; and Components. Our invited speaker this year was Susanne Graf, and it was a pleasure to welcome her to Tallinn and FORTE. In a new departure for FORTE, this year’s conference was co-located with TESTCOM/FATES.TESTCOM/FATES is itself a merger of two conferences: the 19th edition of the IFIP-sponsored International Conference on Testing of Communicating Systems and the seventh edition of the International Workshop on Formal Approaches to Testing of Software. TESTCOM is a series of international conferences addressing the problems of testing communicating systems, including communication protocols, services, distributed platforms, and middleware. FATES is an international series of workshops discussing the

VI

Preface

challenges of using rigorous and formal methods for testing software systems, such as communication-, control-, embedded-, administrative-, and Web-based software. The aim of the combined TESTCOM/FATES 2007 conference was to produce a forum for researchers, developers, testers, vendors, and users to review, discuss, and learn about new approaches, concepts, theories, methodologies, tools, and experiences in the field of testing of software and communicating systems. Testing is, of course, a subject which has had a strong presence in FORTE, and, in particular, in PSTV. It was a pleasure to welcome our colleagues in TESTCOM and FATES, and we ensured that testing-related papers were dealt with in TESTCOM/FATES rather than FORTE. We shared invited speakers, and Antti Huima of Conformiq Software gave the TESTCOM/FATES invited talk on “Implementing Conformiq Qtronic,” which appears in the TESTCOM/FATES LNCS volume. FORTE 2007 was organized jointly by the Department of Computer Science and the Institute ofCybernetics at Tallinn University of Technology. We owe special thanks to the local organization team, who provided a very smooth organization and excellent set of facilities. Juhan Ernits acted as Local Arrangements Chair, Monika Perkmann as Registrations Chair, and they were assisted by Jaagup Irve, Ando Saabas, Kristi Uustalu, and Tarmo Uustalu. Kirill Bogdanov (University of Sheffield, UK) acted as Publicity Chair. The proceedings are published by Springer in the Lecture Notes in Computer Sciences series, and we are grateful to all those at Springer for their help in producing the proceedings. Submissions were made through EasyChair. Finally, we would like to thank members of the FORTE Steering Committee, the Chair of WG6.1 Elie Najm, and the Chair of TC6 Guy Leduc for their support in preparing the event. Of course, special thanks go to all members of the Program Committee and additional reviewers for their efforts in compiling rigorous reviews. June 2007

John Derrick J¨ uri Vain

Organization

FORTE is one of the flagship conferences of Working Group 6.1 (Architectures andProtocols for Distributed Systems) of IFIP.

Steering Committee Gregor v. Bochmann (Canada) Tommaso Bolognesi (Italy) John Derrick (UK) Ken Turner (UK)

Program Chairs John Derrick (UK)

J¨ uri Vain (Estonia)

Local Organization Juhan Ernits Monika Perkmann Kristi Uustalu Kirill Bogdanov

Jaagup Irve Ando Saabas Tarmo Uustalu

Program Committee G. V. Bochmann (Canada) T. Bolognesi (Italy) A. Cavalli (France) J. Derrick (UK) C. Fidge (Australia) H. Garavel (France) S. Haddad (France) D. Hogrefe (Germany) P. Inverardi (Italy) M. Kim (Korea) L. Logrippo (Canada) E. Najm (France) O. Owe (Norway) A. Petrenko (Canada) J.-F. Pradat-Peyre (France) J.B. Stefani (France) P. Traverso (Italy) H. Ural (Canada) F. Wang (Taiwan)

K. Bogdanov (UK) M. Bravetti (Italy) J. Colom (Spain) L. Duchien (France) D. de Frutos-Escrig (Spain) R. Gotzhein (Germany) T. Higashino (Japan) G. J. Holzmann (USA) C. Jard (France) H. Koenig (Germany) J. Magee (UK) M. Nunez (Spain) D. A. Peled (UK) F. Plasil (Czech Republic) W. Reisig (Germany) K. Suzuki (Japan) K. Turner (UK) J. Vain (Estonia)

VIII

Organization

Additional Reviewers Omar Alfandi Marco Beccuti Sergiy Boroday Henrik Brosenne Tomas Bures Patryk Chamuczynski Fida Dankar Sami Evangelista Johan Fabry Dirk Fahland Blaise Genest Andreas Glausch Nicolas Gorse Hesham Hallal Irfan Hamid May Haydar Seng-Phil Hong Akira Idoue Baik Jongmoon

Sungwon Kang In-Young Ko Fang-Chun Kuo Marcel Kyas Ivan Lanese Fr´ed´eric Lang Luis Llana Niels Lohmann Natalia Lopez Stephane Maag Wissam Mallouli Radu Mateescu Mercedes G. Merayo Yutaka Miyake Satoshi Nishiyama Tomohiko Ogishi Yolanda Ortega-Mall´en Patrizio Pelliccione Isabel Pita

Tomas Poch Olivier Ponsini Cristian Prisacariu Fernando Rosa-Velardo Gerardo Schneider Soonuk Seol Wendelin Serwe Ondrej Sery Carron Shankland Christian Stahl Martin Steffen Massimo Tivoli Miguel Valero Bachar Wehbi Gianluigi Zavattaro Marcel Kyas

Supporting Institutions Institute of Cybernetics at Tallinn University of Technology Department of Computer Science, Tallinn University of Technology

Table of Contents

Invited Talk Contracts for BIP: Hierarchical Interaction Models for Compositional Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Susanne Graf and Sophie Quinton

1

Technical Session 1. Message Sequence Charts and SDL Thread–Based Analysis of Sequence Diagrams . . . . . . . . . . . . . . . . . . . . . . . Haitao Dan, Robert M. Hierons, and Steve Counsell

19

Recovering Repetitive Sub-functions from Observations . . . . . . . . . . . . . . . Guy-Vincent Jourdan, Hasan Ural, Shen Wang, and H¨usn¨u Yenig¨un

35

Specification of Timed EFSM Fault Models in SDL . . . . . . . . . . . . . . . . . . . ¨ Uyar S.S. Batth, E.R. Vieira, A. Cavalli, and M.U.

50

Technical Session 2. Concurrency Coordination Via Types in an Event-Based Framework . . . . . . . . . . . . . . . Gianluigi Ferrari, Roberto Guanciale, Daniele Strollo, and Emilio Tuosto

66

Exploring the Connection of Choreography and Orchestration with Exception Handling and Finalization/Compensation . . . . . . . . . . . . . . . . . Yang Hongli, Zhao Xiangpeng, Cai Chao, and Qiu Zongyan

81

Towards Modal Logic Formalization of Role-Based Access Control with Object Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Junghwa Chae

97

Technical Session 3. Model Programs State Isomorphism in Model Programs with Abstract Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Margus Veanes, Juhan Ernits, and Colin Campbell Composition of Model Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Margus Veanes, Colin Campbell, and Wolfram Schulte

112 128

X

Table of Contents

Technical Session 4. Theory New Bisimulation Semantics for Distributed Systems . . . . . . . . . . . . . . . . . David de Frutos-Escrig, Fernando Rosa-Velardo, and Carlos Gregorio-Rodr´ıguez

143

Event Correlation with Boxed Pomsets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T homas Gazagnaire and Lo¨ıc H´elou¨et

160

A Simple Positive Flows Computation Algorithm for a Large Subclass of Colored Nets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S. Evangelista, C. Pajault, and J.F. Pradat-Peyre

177

Technical Session 5. Verification Improvements for the Symbolic Verification of Timed Automata . . . . . . . Rongjie Yan, Guangyuan Li, Wenliang Zhang, and Yunquan Peng

196

The DHCP Failover Protocol: A Formal Perspective . . . . . . . . . . . . . . . . . . Rui Fan, Ralph Droms, Nancy Griff eth, and Nancy Lynch

211

Verifying Erlang/OTP Components in µCRL . . . . . . . . . . . . . . . . . . . . . . . . Qiang Guo

227

Technical Session 6. Model Checking Formal Analysis of Publish-Subscribe Systems by Probabilistic Timed Automata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fei He, Luciano Baresi, Carlo Ghezzi, and Paola Spoletini Testing Distributed Systems Through Symbolic Model Checking . . . . . . . Gabriel K alyon, T hierry Massart, C´edric Meuter, and Laurent Van Begin An Incremental and Modular Technique for Checking LTL\X Properties of Petri Nets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K ais K lai, Laure Petrucci, and Michel Reniers

247 263

280

Technical Session 7. Requirements and QoS Identifying Acceptable Common Proposals for Handling Inconsistent Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K edian Mu and Zhi Jin Formalization of Network Quality-of-Service Requirements . . . . . . . . . . . . Christian Webel and Reinhard Gotzhein

296 309

Table of Contents

XI

Technical Session 8. Components Robustness in Interaction Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mila Majster-Cederbaum and Moritz Martens

325

Transactional Reduction of Component Compositions . . . . . . . . . . . . . . . . Serge Haddad and Pascal Poizat

341

Specifying and Composing Interaction Protocols for Service-Oriented System Modelling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jo˜ao Abreu, Laura Bocchi, Jos´e Luiz Fiadeiro, and Ant´onia Lopes

358

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

375

Contracts for BIP: Hierarchical Interaction Models for Compositional Verification⋆ Susanne Graf and Sophie Quinton Verimag/CNRS and Verimag/ENS Cachan

Abstract. This paper presents an extension of the BIP component framework to hierarchical components by considering also port sets of atomic components to be structured (ports may be in conflict or ordered, where a larger port represents an interaction set with larger interactions). A composed component consisting of a set of components connected through BIP connectors and a set of ports representing a subset of the internal connectors and ports, has two semantics: one in terms if interactions as defined by the BIP semantics, and one in terms of the actions represented by external ports where the structure of the port set of the component is derived from the internal structure of the component. A second extension consists in the addition of implicit interactions which is done through an explicit distinction of conflicting and concurrent ports: interactions involving only non conflicting ports can be executed concurrently without the existence of an explicit connector. Finally, we define contract-based reasoning for component hierarchies.

1

Introduction

We aim at contract-based verification. We consider a framework where a system is a hierarchically structured set of components. For this purpose, we extend the component framework BIP [GS05,BBS06] and in particular its instance based on hierarchical connectors [BS07] to a framework for hierarchical components enriched with contracts as defined in the SPEEDS project [BC07+ ]. In the BIP framework, components interact through ports typed by trig or sync and are connected via hierarchical n-ary connectors which are typed in the same way as ports. In BIP, only connectors are hierarchical and we consider here also a hierarchical organisation of the components. Only leaf components represent models with behaviour explicitly defined by a transition system labelled by interactions. Originally, in BIP, atomic components have a sequential behaviour, but here they are not different from hierarchical components, at least from outside. We represent behaviours by an asynchronous transition system, and we may choose other, more efficient, representations in the future. The behaviour of a hierarchical component is obtained as a composition of the behaviours of its leaf components depending on its internal connectors. A hierarchical rich component (HRC) K has includes contracts, in the form of an assumption A and a guarantee G, represented both by transition systems. A ⋆

This work has been partially financed by the project SPEEDS and the NoE Artist.

J. Derrick and J. Vain (Eds.): FORTE 2007, LNCS 4574, pp. 1–18, 2007. c IFIP International Federation for Information Processing 2007 

2

S. Graf and S. Quinton

defines a property of the environment of K, and G a property of K that should hold if K runs in an environment guaranteeing A. We define a framework for verifying that components satisfy their contracts compositionally, by showing that the contracts associated with each component dominate the contracts of its inner components, and leaf components satisfy their contracts. In Section 2, we define the syntactic framework of hierarchical components and connectors. We define the semantics in two steps. First, we say how to obtain a transition system defining the behaviour of a hierarchical component from the transition systems of its subcomponents and the connectors between them. The BIP framework allows expressing synchronous and asynchronous interaction and execution, including blocking rendez-vous. Here, we only represent the abstract setting without taking into account data flow. A main issue in embedded systems is absence of interference between transactions, possibly executed concurrently. Using BIP interactions, we can guarantee interference freedom by construction, as only non interfering transactions are executed concurrently. As a counterpart, it must be verified that interlock situations and violations of non functional requirements cannot occur; such bad situations can be reduced a deadlock in a modified system. In Section 3, we describe how we intend to verify the consistency of a contract hierarchy. We adapt classical assume guarantee reasoning (see [RB+ 01] for a good overview) to our framework. To prove that a contract (A, G) of K dominates a composition of contracts {(Ai , Gi )} — those of the subcomponents of K — it is sufficient to show that – AG1 ....Gn |= G; that is, if every Ki ensures its guarantee, then the composition ensures G, as long as the environment behaves according to A – AG1 ...Gn |= Ai for all i; that is, each assumption Ai can be derived from A and the guarantees Gj of the peer components. This proof rule is sound as A and G constrain different components. Notice that this proof rule is global at a given level of hierarchy, the gain comes from a hierachical structure with several layers. In Section 4 we give a first idea on how we intend to achieve a more efficient and scalable handling of contracts. In particular, proving verification conditions is reduced to showing deadlock freedom of a transformed system, and we are presently developing efficient methods for such checks.

2

Specifications and Their Semantics

Definition 1 (Interaction set). Let Σ be a set, and