10/36 Introduction Larissa Formal Analysis Tools Conclusion Crosscutting Concern 2: Compass Mode Compass Vector model has compass mode select mode/Compass Add Compass mode to Altimax base program mode mode/.. Display mode/... mode/... Time Altimeter Barometer Memory . . . . . . . . .
10/36 Introduction Larissa Formal Analysis Tools Conclusion Crosscutting Concern 2: Compass Mode Compass Vector model has compass mode select mode/Compass Add Compass mode to Altimax base program mode mode/ Display Compass mode/... mode/... Time Altimeter Barometer Memory . . . . . . . . .
10/36 Introduction Larissa Formal Analysis Tools Conclusion Crosscutting Concern 2: Compass Mode Compass Vector model has compass mode select mode/Compass Add Compass mode to Altimax base program mode mode/Time mode/ Display Compass mode/... mode/... Time Altimeter Barometer Memory . . . . . . . . .
11/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa: Aspects for Argos Goal: aspect language for synchronous languages Argos adequate base language simple synchronous language expressive, characterizing constructs Must express cross-cutting concerns Same concepts as other aspect languages: join points, pointcuts, advice
12/36 Introduction Larissa Formal Analysis Tools Conclusion Outline Introduction 1 Larissa 2 Context and Requirements The Language Example Formal Analysis Tools 3 Conclusion and Further Work 4
13/36 Introduction Larissa Formal Analysis Tools Conclusion Argos Operators Base elements: boolean signals, complete and deterministic Mealy automata A a a/mod2 A
13/36 Introduction Larissa Formal Analysis Tools Conclusion Argos Operators Base elements: boolean signals, complete and deterministic Mealy automata Main operators: parallel product, local signals A a a/mod2 B mod2 mod2/mod4 mod2 ( A � B ) \ { mod2 }
13/36 Introduction Larissa Formal Analysis Tools Conclusion Argos Operators Base elements: boolean signals, complete and deterministic Mealy automata Main operators: parallel product, local signals Semantics: compilation into flat automata A a a a/mod2 a/mod4 a B mod2 a mod2/mod4 mod2 ( A � B ) \ { mod2 }
14/36 Introduction Larissa Formal Analysis Tools Conclusion Encapsulation Argos programs form expressions, e.g. (( A � B ) \ { a } ) � C A A, B and C automata or a/b Argos expressions a/b B a C
14/36 Introduction Larissa Formal Analysis Tools Conclusion Encapsulation Argos programs form expressions, e.g. (( A � B ) \ { a } ) � C I A A, B and C automata or a/b Argos expressions a/b Interface: inputs, outputs B a C O
14/36 Introduction Larissa Formal Analysis Tools Conclusion Encapsulation Argos programs form expressions, e.g. (( A � B ) \ { a } ) � C I A A, B and C automata or a/b Argos expressions a/b Interface: inputs, outputs B a Strong encapsulation: component structure invisible from outside C O
14/36 Introduction Larissa Formal Analysis Tools Conclusion Encapsulation Argos programs form expressions, e.g. (( A � B ) \ { a } ) � C I A A, B and C automata or a/b Argos expressions a/b Interface: inputs, outputs B a Strong encapsulation: component structure invisible from outside C Operators preserve i/o-trace O equivalence ( ∼ ): if A ′ ∼ A , then (( A ′ � B ) \ { a } ) � C ∼ (( A � B ) \ { a } ) � C
14/36 Introduction Larissa Formal Analysis Tools Conclusion Encapsulation Argos programs form expressions, e.g. (( A � B ) \ { a } ) � C I A ′ a/b A, B and C automata or Argos expressions Interface: inputs, outputs B a Strong encapsulation: component structure invisible from outside C Operators preserve i/o-trace O equivalence ( ∼ ): if A ′ ∼ A , then (( A ′ � B ) \ { a } ) � C ∼ (( A � B ) \ { a } ) � C
15/36 Introduction Larissa Formal Analysis Tools Conclusion Requirements: Aspects for Argos Express cross-cutting concerns crosscut structure of Argos expressions parallel composition can express some aspects for sequential languages
15/36 Introduction Larissa Formal Analysis Tools Conclusion Requirements: Aspects for Argos Express cross-cutting concerns crosscut structure of Argos expressions parallel composition can express some aspects for sequential languages Integrate well into Argos define as translation into automaton simple, formal semantics respect encapsulation, as other Argos operators usually not respected by aspect languages
16/36 Introduction Larissa Formal Analysis Tools Conclusion Related Work Aspects and Parallelism Concurrent aspects [Douence et al, GPCE06]: asynchronous base program, asynchronous execution of advice
16/36 Introduction Larissa Formal Analysis Tools Conclusion Related Work Aspects and Parallelism Concurrent aspects [Douence et al, GPCE06]: asynchronous base program, asynchronous execution of advice Formal Properties Many formalisations of aspect languages Aspects preserving the encapsulation: Composition Filters [Bergmans, Aksit]: intercept and modify messages between components Open Modules [Aldrich, ECOOP06]: add additional information to interface
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa Join points: one step in the execution I.e., transitions in an automaton
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Aspect
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Advice: modify transitions change target state and outputs Aspect
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Advice: modify transitions change target state and outputs Aspect
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa I Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Advice: modify transitions O change target state and outputs Challenge: respect encapsulation Aspect
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa I Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Advice: modify transitions O change target state and outputs Challenge: respect encapsulation Aspect
17/36 Introduction Larissa Formal Analysis Tools Conclusion Larissa I Join points: one step in the execution I.e., transitions in an automaton Pointcut: select transitions in automaton Advice: modify transitions O change target state and outputs Challenge: respect encapsulation Aspect aspect must only refer to interface
18/36 Introduction Larissa Formal Analysis Tools Conclusion Pointcuts I Must select transitions a b b O
18/36 Introduction Larissa Formal Analysis Tools Conclusion Pointcuts I Must select transitions a Solution: observer automaton b inputs: inputs and outputs b of observed program one output JP O Pointcut a b/JP
18/36 Introduction Larissa Formal Analysis Tools Conclusion Pointcuts I Must select transitions a Solution: observer automaton b inputs: inputs and outputs b of observed program one output JP O Pointcut emits JP Pointcut ⇒ transition in program selected a b/JP
18/36 Introduction Larissa Formal Analysis Tools Conclusion Pointcuts I Must select transitions a Solution: observer automaton b inputs: inputs and outputs b of observed program one output JP O Pointcut emits JP Pointcut ⇒ transition in program selected a b/JP JP
18/36 Introduction Larissa Formal Analysis Tools Conclusion Pointcuts I Must select transitions a Solution: observer automaton b inputs: inputs and outputs b of observed program one output JP O Pointcut emits JP Pointcut ⇒ transition in program selected a Transitions identified statically b/JP by parallel product JP
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state I O Aspect
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state trace a. b I Solution: execute finite input trace automaton deterministic, thus a always identifies one state b b O Aspect
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state trace a. b I Solution: execute finite input trace automaton deterministic, thus a always identifies one state b b O Aspect
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state trace a. b I Solution: execute finite input trace automaton deterministic, thus a always identifies one state b b O Aspect
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state trace a. b I Solution: execute finite input trace automaton deterministic, thus a always identifies one state b b O Aspect
19/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Difficulty: specify one new target state trace a. b I Solution: execute finite input trace automaton deterministic, thus a always identifies one state b Two kinds: b toInit advice: execute trace from initial state O toCurrent advice: execute trace from source state of transition Aspect
20/36 Introduction Larissa Formal Analysis Tools Conclusion Example: Logbook Shortcut Aspect LB Pointcut: transitions in main modes where minus is true Advice: trace mode.select.mode.mode, output Logbook mode/ Time mode/ mode/ Alti Baro Time Altimeter Barometer select select select Baro mode mode/ Time mode Alti mode/ mode/ mode mode mode Memory Logbook altimax
20/36 Introduction Larissa Formal Analysis Tools Conclusion Example: Logbook Shortcut Aspect LB Pointcut: transitions in main modes where minus is true Advice: trace mode.select.mode.mode, output Logbook minus ∧ mode/ JP ,Time mode/ Time .../ JP .../ JP mode/ mode/ .../ JP Alti Baro Time Altimeter Barometer minus/ JP .../ JP .../ JP select select select main .../ JP Time ∨ select Alti ∨ Baro mode mode/ Time mode Baro Alti sub mode/ mode/ mode mode mode pointcut of LB Memory Logbook altimax
20/36 Introduction Larissa Formal Analysis Tools Conclusion Example: Logbook Shortcut Aspect LB Pointcut: transitions in main modes where minus is true Advice: trace mode.select.mode.mode, output Logbook minus ∧ mode/ JP ,Time mode/ Time .../ JP .../ JP mode/ .../ JP Baro mode Time Altimeter Barometer minus/ JP .../ JP .../ JP select select select main .../ JP Time ∨ select Alti ∨ Baro mode mode/ Time mode Baro Alti sub mode/ mode/ mode mode mode pointcut of LB Memory Logbook altimax
20/36 Introduction Larissa Formal Analysis Tools Conclusion Example: Logbook Shortcut Aspect LB Pointcut: transitions in main modes where minus is true Advice: trace mode.select.mode.mode, output Logbook mode/ Time mode/ Baro mode Time Altimeter Barometer minus/ JP select select select main Time ∨ select minus/Logbook Alti ∨ minus/Logbook Baro mode mode/ Time mode Baro Alti sub mode/ mode/ mode mode mode pointcut of LB Memory Logbook altimax ⊳ LB
21/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Program mode Compass Advice insufficient for Compass Concern select mode/ mainMode Replace transition by advice program mode Advice program has terminating state: represents return to base program advice program mode/.. mode/... mode/... Time Altimeter Barometer . . . . . . . . .
21/36 Introduction Larissa Formal Analysis Tools Conclusion Advice Program mode Compass Advice insufficient for Compass Concern select mode/ mainMode Replace transition by advice program mode Advice program has terminating state: represents return to base program advice program mode/.. mode/... mode/... mode/... Time Altimeter Barometer Compass . . . . . . . . . . . . altimax ⊳ compass
22/36 Introduction Larissa Formal Analysis Tools Conclusion Recovery Advice and Compiler Recovery advice “Jumping backward” Identify set of recovery states Jump to last recovery state that was passed
22/36 Introduction Larissa Formal Analysis Tools Conclusion Recovery Advice and Compiler Recovery advice “Jumping backward” Identify set of recovery states Jump to last recovery state that was passed Compiler for Argos and Larissa All language variants implemented Experimentation with many examples Written in Java, AspectJ, BDD library Available at http://www-verimag.imag.fr/ ∼ stauch/ArgosCompiler/
23/36 Introduction Larissa Formal Analysis Tools Conclusion Outline Introduction 1 Larissa 2 3 Formal Analysis Tools Aspect Interference Aspects and Contracts Conclusion and Further Work 4
24/36 Introduction Larissa Formal Analysis Tools Conclusion Formal Analysis Tools Larissa: small language, formally defined, with simple semantics Well adapted to study formal properties of aspect languages We studied two such properties: interaction of several aspects combination of Larissa with contracts
25/36 Introduction Larissa Formal Analysis Tools Conclusion Aspect Interaction Aspect Interaction Do several aspects influence each other? When is P ⊳ A1 ⊳ A2 ∼ P ⊳ A2 ⊳ A1?
25/36 Introduction Larissa Formal Analysis Tools Conclusion Aspect Interaction Aspect Interaction plus/ JP m Do several aspects influence each other? When is P ⊳ A1 ⊳ A2 ∼ P ⊳ A2 ⊳ A1? main Time ∨ Example: Second Shortcut Aspect M select Alti ∨ Baro Also use plus button as shortcut sub in the main modes Pressing plus goes to the Memory mode Pointcut of M
26/36 Introduction Larissa Formal Analysis Tools Conclusion Weaving the Second Shortcut Aspect Weave M into altimax ⊳ LB plus/ JP m mode/ Alti Time ... main minus/... Time ∨ select Alti ∨ ... Baro Logbook sub altimax ⊳ LB Pointcut of M
26/36 Introduction Larissa Formal Analysis Tools Conclusion Weaving the Second Shortcut Aspect Weave M into altimax ⊳ LB When pressing minus in main mode: altimax ⊳ LB goes to submode pointcut stays in main mode plus/ JP m mode/ Alti Time ... main minus/... Time ∨ select Alti ∨ ... Baro Logbook sub altimax ⊳ LB Pointcut of M
26/36 Introduction Larissa Formal Analysis Tools Conclusion Weaving the Second Shortcut Aspect Weave M into altimax ⊳ LB When pressing minus in main mode: altimax ⊳ LB goes to submode pointcut stays in main mode plus/ JP m mode/ Alti Time ... main minus/... Time ∨ select Alti ∨ ... Baro Logbook sub altimax ⊳ LB Pointcut of M
26/36 Introduction Larissa Formal Analysis Tools Conclusion Weaving the Second Shortcut Aspect Weave M into altimax ⊳ LB When pressing minus in main mode: altimax ⊳ LB goes to submode pointcut stays in main mode Error: Advice transitions added to Logbook mode plus/ JP m mode/ Alti Time ... main plus/Memory minus/... Time ∨ select Alti ∨ ... Baro Logbook sub altimax ⊳ LB ⊳ M Pointcut of M
27/36 Introduction Larissa Formal Analysis Tools Conclusion Joint Weaving Problem: aspect M written for altimax, not for altimax ⊳ LB Idea: weave aspects jointly into the program
27/36 Introduction Larissa Formal Analysis Tools Conclusion Joint Weaving Problem: aspect M written for altimax, not for altimax ⊳ LB Idea: weave aspects jointly into the program Select join points for all aspects first, then apply advice Joint Weaving: altimax ⊳ (LB,M) apply pointcuts and determine join point transitions 1 sequentially apply advice 2
28/36 Introduction Larissa Formal Analysis Tools Conclusion Application to the Example: altimax ⊳ (LB,M) mode/ Time mode/ mode/ Alti Baro Time Altimeter Barometer select select select mode/ Baro mode mode/ Time mode mode/Alti mode mode mode Memory Logbook
28/36 Introduction Larissa Formal Analysis Tools Conclusion Application to the Example: altimax ⊳ (LB,M) mode/ Time minus ∧ mode/ JP ,Time .../ JP mode/ .../ JP mode/ .../ JP m .../ JP Alti Baro Time Altimeter Barometer .../ JP .../ JP .../ JP m select .../ JP m select select .../ JP mode/ Baro mode mode/ Time mode mode/Alti mode mode mode Memory Logbook
28/36 Introduction Larissa Formal Analysis Tools Conclusion Application to the Example: altimax ⊳ (LB,M) mode/ Time minus ∧ mode/ JP ,Time .../ JP mode/ .../ JP mode/ .../ JP Alti Baro Time Altimeter Barometer .../ JP .../ JP select select select .../ JP mode/ Baro mode mode/ Time plus/Memory mode mode/Alti mode mode mode Memory Logbook plus/Memory
28/36 Introduction Larissa Formal Analysis Tools Conclusion Application to the Example: altimax ⊳ (LB,M) mode/ Time mode/ mode/ Alti Baro Time Altimeter Barometer select select select minus/Logbook minus/Logbook mode/ Baro mode mode/ Time plus/Memory mode mode/Alti mode mode mode Memory Logbook plus/Memory
29/36 Introduction Larissa Formal Analysis Tools Conclusion Proving Non-Interference Is altimax ⊳ (LB,M) ∼ altimax ⊳ (M,LB)?
29/36 Introduction Larissa Formal Analysis Tools Conclusion Proving Non-Interference Is altimax ⊳ (LB,M) ∼ altimax ⊳ (M,LB)? Not always, because advice is still applied sequentially Jointly woven Larissa aspects still interfere, if they select the same join point transitions
29/36 Introduction Larissa Formal Analysis Tools Conclusion Proving Non-Interference Is altimax ⊳ (LB,M) ∼ altimax ⊳ (M,LB)? Not always, because advice is still applied sequentially Jointly woven Larissa aspects still interfere, if they select the same join point transitions Theorem for Jointly-Woven Aspects Noninterference of two aspects, for any base program: if no transition selected by both aspects in product of pointcuts
29/36 Introduction Larissa Formal Analysis Tools Conclusion Proving Non-Interference Is altimax ⊳ (LB,M) ∼ altimax ⊳ (M,LB)? Not always, because advice is still applied sequentially Jointly woven Larissa aspects still interfere, if they select the same join point transitions Theorem for Jointly-Woven Aspects Noninterference of two aspects, for any base program: if no transition selected by both aspects in product of pointcuts Noninterference of two aspects, for given base program P: if no transition selected by both aspects in product of pointcuts and P
30/36 Introduction Larissa Formal Analysis Tools Conclusion Design-by-Contract Originally introduced by Bertrand Meyer for object-oriented programming Contract: assumption A ⇒ guarantee G
30/36 Introduction Larissa Formal Analysis Tools Conclusion Design-by-Contract Originally introduced by Bertrand Meyer for object-oriented programming Contract: assumption A ⇒ guarantee G Example (in Java): class C{ / ∗ @ assume i < 10 ∗ / / ∗ @ guarantee \ result < 10 ∗ / int m(int i ) { . . . } }
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 i<10 m(9) 9 result<10
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: int around(int i): m(i){ i<10 m(9) return 1 + proceed(i + 1); } 9 result<10
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: int around(int i): m(i){ i<10 m(9) return 1 + proceed(i + 1); } 9 result<10
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: int around(int i): m(i){ i<10 m(9) m(10) return 1 + proceed( i + 1 ); } Now: A violated 9 result<10
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: int around(int i): m(i){ i<10 m(9) m(10) return 1 + proceed(i + 1); } Now: A violated, G violated 9 10 result<10
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: int around(int i): m(i){ i<10 m(9) m(10) return 1 + proceed(i + 1); } Now: A violated, G violated In this case, a new contract for method with aspect can be derived: 9 / ∗ @ assume i < 10 ∗ / 10 result<10 / ∗ @ guarantee \ result < 10 ∗ /
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: i<9 int around(int i): m(i){ i<10 m(8) m(9) return 1 + proceed(i + 1); } Now: A violated, G violated In this case, a new contract for method with aspect can be derived: 9 / ∗ @ assume i < 9 ∗ / 10 result<10 / ∗ @ guarantee \ result < 10 ∗ /
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: i<9 int around(int i): m(i){ i<10 m(8) m(9) return 1 + proceed(i + 1); } Now: A violated, G violated In this case, a new contract for method with aspect can be derived: 9 / ∗ @ assume i < 9 ∗ / 10 result<10 / ∗ @ guarantee \ result < 11 ∗ / result<11
31/36 Introduction Larissa Formal Analysis Tools Conclusion Aspects Modify Contracts Example call to m: i=9, returns 9 Adding aspect to m: i<9 int around(int i): m(i){ i<10 m(8) m(9) return 1 + proceed(i + 1); } Now: A violated, G violated In this case, a new contract for method with aspect can be derived: 9 / ∗ @ assume i < 9 ∗ / 10 result<10 / ∗ @ guarantee \ result < 11 ∗ / result<11 Idea: derive new contracts automatically
Recommend
More recommend
