A Scalable Incomplete Test for Message Buffer Overflow in Promela Models

Abstract

Abstract. In Promela, communication buffers are defined with a fixed length, and buffer overflows can be handled in two different ways: block the send statement or lose the message. Both solutions change the semantics of the system, compared to one with unbounded channels. The question arises, if such buffer overflows can ever occur in a given system and what buffer lengths are sufficient to avoid them. We describe a scalable incomplete boundedness test for the communication buffers in Promela models, which is based on overapproximation and static analysis. We first reduce Promela models to systems of communicating finite state machines (CFSMs) and then apply further abstractions that leave us with a system of linear inequalities. Those represent the message sending and receiving effect that the control flow cycles of every process have on any message buffer. The test tries to establish the existence of a linear combination of the effect vectors so that at least one message can occur an unbounded number of times. If no such linear combination exists then the system is bounded. We discuss the complexity of this test and present experimental results using our implementation in the IBOC system. Scalability of the test is in part due to the fact that it is polynomial for the type of sparse control flow graphs derived from Promela models. Also, the analysis is local, i.e., it avoids the combinatorial state space explosion due to concurrency of the models. We also present a method to derive upper bound estimates for the maximal occupancy of each individual message buffer. Previously, we have applied this approach to UML RT models, while in this paper we focus on the additional problems specific to Promela code: determining the potential message types of any channel, tracking potential contents of variables, channels passed as arguments to processes, channel assignments, channel arrays and parallel process creation.

Compatibility Checking for Asynchronously Communicating Software

“…Jeron and Jard [24] propose a sufficient condition for testing unboundedness, which can be used as a decision procedure for checking reachability for CFSMs. In [26], the authors present an incomplete boundedness test for communication channels in Promela and UML RT models. They also provide a method to derive upper bound estimates for the maximal occupancy of each individual message buffer.…”

“…This means that, in general, verification techniques based on explicit state space exploration will not be sound for such systems. Analysis of asynchronously communicating systems has been investigated extensively during the last 30 years, e.g., [11,24,26,14,31]. A common approach used in analyzing asynchronously communicating systems is to bound the state space by bounding the number of cycles, peers, or buffers.…”

Software Maintenance through Supervisory Control

“…For instance, Bandera (see e.g. [16]) allows for model extraction from Java programs and can output these models in different languages such as PROMELA ( [17], [18]). …”

A Livelock Freedom Analysis for Infinite State Asynchronous Reactive Systems

“…This observation underlies the conservative abstraction approach sketched below for our livelock freedom analysis. The same abstraction steps were also used in our previous work on buffer boundedness analysis, which are detailed in [14,13]. In particular [13] deals with specifics of abstracting Promela models.…”