D-Finder 2: Towards Efficient Correctness of Incremental Design

Abstract

Abstract. D-Finder 2 is a new tool for deadlock detection in concurrent systems based on effective invariant computation to approximate the effects of interactions among modules. It is part of the BIP framework, which provides various tools centered on a component-based language for incremental design. The presented tool shares its theoretical roots with a previous implementation, but was completely rewritten to take advantage of a new version of BIP and various new results on the theory of invariant computation. The improvements are demonstrated by comparison with previous work and reports on new results on a practical case study. ContextLanguage. D-Finder 2 is part of a framework of tools that share a common language, BIP, to describe component-based systems [1]. The language is based on atomic components and connectors to describe their interactions. Components can also be hierarchically organized to build new components. An atomic component is a transition system B = (L, P, T ), where L = {l 1 , l 2 , . . . , l k } is a set of control locations, P is a set of ports, and T ⊆ L × P × L is a set of transitions. A component additionally can contain data and use C code for actions and conditions on the transitions to manipulate this data. Figure 1 shows a graphical representation of two atomic components B 1 and B 2 . We use cycles for locations and arrows for transitions. Every transition is labeled by a port to synchronize with ports of other components to create interactions. In the example, the ports trigger and tick of the two components are synchronized, which means the corresponding transitions have to be executed concurrently, and are only available if the guards in both components are fulfilled. The transition rel can be taken whenever a component is in the fire location. We can give only a very brief description of BIP here, please refer to [1] for more details. The rule states that if all components B i fulfill their respective component in-with the interactions γ fulfills an interaction invariant Ψ , and if furthermore the conjunction of the invariants ( i Φ i ) ∧ Ψ implies a predicate on the global system Φ, then also the global system γ {B i } i itself fulfills Φ. In this paper we concentrate on global deadlock-freedom. Indeed, it suffices to prove the invariance of the predicate ¬DIS, where DIS is the set of states of the system from which all the interactions are disabled.Tool Chain. The design flow between BIP and D-Finder is sketched in Figure 2. The framework allows to (1) start from scratch and describe a composite system with the BIP language, or (2) to use the Language Factory to translate existing models described in languages such as C, DOL [15]

Automatic distributed code generation from formal models of asynchronous processes interacting by multiway rendezvous

“…In addition, priorities may differentiate interactions: when several interactions are possible, the one with highest priority must occur, preempting others (when interaction have the same priority, any of them may occur). To our knowledge, BIP verification features are now limited to a deadlock detection tool [5], while CADP offers several model checkers [43,44,45], equivalence checkers [6], tools for compositional verification [23,38,25], test case generation [33], performance evaluation [14], and even more 5 . Nonetheless, a distributed code generation tool is available for BIP [9]; it instantiates a multiway rendezvous protocol to handle interaction in a distributed way-the protocol presented in this paper improves over the one used in BIP.…”

Incremental Generation of Linear Invariants for Component-Based Systems

“…Verimag Research Report n o TR-2012-15 components [6]. As shown in Figure 3, ψ can then be combined with the invariant φ i of each constituent component to deduce a global invariant for the complete system (see [17] for a proof).…”

“…But as explained in [6], Boolean invariants are sufficient to prove the deadlock freeness of a system. Moreover, if the linear invariants are more accurate than the boolean invariants, the approximated states of the linear invariants are not always a subset of those of the boolean invariants: the conjunction of the linear and boolean invariants increase the precision of the analysis for the cases with self-loops like in the Gas Station example.…”

“…In a series of recent work [3,4,5], we proposed novel approaches and the DFINDER tool [6] for generating invariants for systems described in the BIP framework [7]. BIP is an expressive modeling formalism equiped with a rich algebra to describe component interactions.…”

Assembly Theories for Communication-Safe Component Systems

“…The project proposal was successful: the FP7 Integrated Project ASCENS [2] on "Autonomic Service-Component Ensembles" is coordinated by MW; Joseph and his group are responsible for the work package on "Correctness of Service Components and Service Component Ensembles". Design techniques ensuring correctness-by-construction play a main role in ASCENS; current results comprise an extension of BIP for modeling dynamic architectures [6] and a novel implementation of the D-Finder tool for compositional deadlock detection in concurrent systems [5].…”