Development of an atomic-broadcast protocol using LOTOS

Abstract

In this article we report on the development of a group-communication service using the formal specification language LOTOS, and present our experience in using publicly available tools for this purpose. The service implements atomic broadcast through a Two-Phase-Commit protocol, providing at-least-once delivery semantics and with no restriction on message delivery order. First we wrote an informal specification describing the desired properties from the service, the interfaces with the underlying network layer and the upper user layer, and the protocol to be used by the service. Then we developed the formal specification of the protocol in LOTOS. After validating the formal specification and thus having a certain confidence in its adequacy with respect to the informal specification, we derived test cases from the formal specification and implemented the service using the Concert/C distributed programming language. While testing the implementation, we found that most errors were related to unspecified features or bugs in the execution environment. From this experience, we draw our conclusions on the usefulness of software development based on formal techniques.It is the result of a large cooperative project. Its description can be found elsewhere [12]. We could have also used general purpose tools (e.g., PVS from Stanford [13] or HOL from Oxford [14]), but they would have required switching to another logic system, and consequently also a mapping between their formal systems and the one used by LOTOS.Unfortunately, the documentation of the LOTOS tools we selected indicated that more tool support was available than is in fact the case. Even so, we believe that LOTOS was a good choice for the development of a multi-agent communication protocol.

Testing Data Types Implementations from Algebraic Specifications

“…This approach has been used by James for testing an implementation of the Two-Phase-Commit Protocol developed from a LOTOS specification into Concert/C. The results of this experiment are reported in [40].As said in the previous sub-section, tests for the data types were obtained first with the LOFT system. Then a set of testers was derived manually from the process part of the specification.…”

“…The specifications and test sets of these case studies are too large to be given here. Details can be found in [26] and [25] for the first one, in [2] and [49] for the transit node, and in [40] for the Two-Phase-Commit protocol.…”