Probabilistic Contracts for Component-based Design Gregor G ossler - PowerPoint PPT Presentation

Probabilistic Contracts for Component-based Design Gregor G¨ ossler Alain Girault Dana N. Xu INRIA, France ATVA 2010 D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 1 / 18

Probabilistic Contracts System designers have to cope with multiple sources of uncertainty: Embedded and distributed systems usually encompass unreliable components. Behaviors of (black-box) components and the environment may be uncertain. Abstraction from complex deterministic behavior (“network access is available with p=95%”). We want to describe properties such as: “The probability that this component fails at this point of its behavior is ≤ 0 . 1 % .” We introduce probabilistic contracts , which distinguish assumptions on how a component is used from guarantees on the component behavior. D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 2 / 18

Interactive Markov Chain (IMC) Example: client – link – server. req rec del’ req’ Client (C) Link (L) Server (S) res del rec’ res’ An IMC is an LTS with action states/transitions and probabilistic states/transitions [Hermanns 2002]. IMC used to model component behaviors: fail 2 l 7 del ′ l 8 l 9 0 . 02 fail 1 rec ′ 0 . 05 l 6 del ′ rec ′ 0 . 98 rec l 1 l 2 l 3 l 4 0 . 95 l 0 l 5 del The IMC M ℓ of the Link. D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 3 / 18

Probabilistic Contracts req rec del’ req’ Client (C) Link (L) Server (S) res del rec’ res’ A probabilistic contract is an IMC with probability intervals and a special ⊤ state: req ′ [ 0 , 0 . 1 ] t 3 ⊤ req ′ t 1 [ 0 . 9 , 1 ] res ′ t 0 t 2 Contract C s for Server action transitions leading to ⊤ are assumed not to be synchronized. action transitions not leading to ⊤ are guaranteed to be offered. actions not labelling any transition at a state are guaranteed not to be offered. D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 4 / 18

Operations for Contract-based Design Flow Essential operations: refinement and satisfaction ; parallel composition ( C 1 || I C 2 ): E.g. I = { a | d , b | e , c | f , g , u , v } conjunction of contracts ( C 1 ∧ C 2 ): Additional definitions: bisimulation, reduction, projection D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 5 / 18

Contract Refinement a a ⊤ [ 0 . 5 , 0 . 9 ] [ 0 . 6 , 0 . 8 ] s 2 t 2 b a [ 0 . 1 , 0 . 5 ] [ 0 . 2 , 0 . 4 ] t 1 s 1 a t 0 b s 0 b s 3 t 3 C 1 C 3 c a u 4 [ 0 . 6 , 0 . 8 ] u 2 b a [ 0 . 2 , 0 . 4 ] u 1 u 0 b u 3 C 1 ≤ C 3 C 2 C 2 ≤ C 3 D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 6 / 18

Contract refinement for probabilistic states [ 0 , 0 . 2 ] s 2 d 1 [ 0 . 1 , 0 . 3 ] d 2 [ 0 . 1 , 0 . 6 ] s 3 t 2 s 1 [ 0 . 5 , 0 . 7 ] [ 0 . 2 , 0 . 4 ] d 3 t 3 t 1 s 4 d 4 [ 0 . 2 , 0 . 5 ] t 4 [Jonsson and Larsen : LICS’91] D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 7 / 18

Contract Satisfaction res ′ s 3 s 3 res ′ [ 0 . 7 , 0 . 7 ] 0 . 7 [ 0 . 1 , 0 . 1 ] 0 . 1 s 1 s 2 s 1 s 2 req ′ req ′ req ′ req ′ 0 . 2 [ 0 . 2 , 0 . 2 ] res ′ res ′ s 0 s 0 handle handle s 4 s 4 res ′ res ′ er 2 er 2 IMC M s Lifted IMC ⌊ M s ⌋ D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 8 / 18

Contract Satisfaction res ′ s 3 s 3 res ′ [ 0 . 7 , 0 . 7 ] 0 . 7 [ 0 . 1 , 0 . 1 ] 0 . 1 s 1 s 2 s 1 s 2 req ′ req ′ req ′ req ′ 0 . 2 [ 0 . 2 , 0 . 2 ] res ′ res ′ s 0 s 0 handle handle s 4 s 4 res ′ res ′ er 2 er 2 IMC M s Lifted IMC ⌊ M s ⌋ Definition (Contract satisfaction) An IMC M satisfies a contract C (written M | = C ) iff ⌊ M ⌋ ≤ C . req ′ [ 0 , 0 . 1 ] t 3 ⊤ req ′ t 1 [ 0 . 9 , 1 ] res ′ t 0 t 2 That is to check: s 0 ≤ t 0 Contract C s for Server D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 8 / 18

Contract Satisfaction Definition (Models of contracts) The set of models of a contract C (written M ( C ) ) is the set of IMCs that satisfy C : M ( C ) = { M | M | = C } . Definition (Semantical equivalence) Contracts C 1 and C 2 are semantically equivalent (written C 1 ≡ C 2 ) iff M ( C 1 ) = M ( C 2 ) . Lemma (Refinement and model inclusion) For all contracts C 1 and C 2 , if C 1 ≤ C 2 , then M ( C 1 ) ⊆ M ( C 2 ) . D.N. Xu, G. G¨ ossler, A. Girault (INRIA, France) Probabilistic contracts ATVA 2010 9 / 18

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 ( s 0 , t 0 ) C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 [ 0 , 0 . 1 ] ( s 1 , t 0 ) ( s 0 , t 0 ) [ 0 . 9 , 1 ] ( s 2 , t 0 ) C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 a | c [ 0 , 0 . 1 ] ( s 1 , t 0 ) ( s 3 , t 1 ) ( s 0 , t 0 ) [ 0 . 9 , 1 ] ( s 2 , t 0 ) C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 a | c [ 0 , 0 . 1 ] ( s 1 , t 0 ) ( s 3 , t 1 ) ( s 0 , t 0 ) [ 0 . 9 , 1 ] b ( s 2 , t 0 ) C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 [ 0 . 2 ∗ 0 . 7 , 0 . 5 ∗ 0 . 9 ] ( s 5 , t 2 ) [ 0 . 5 ∗ 0 . 7 , 0 . 8 ∗ 0 . 9 ] ( s 6 , t 2 ) a | c [ 0 , 0 . 1 ] ( s 1 , t 0 ) ( s 3 , t 1 ) [ 0 . 5 ∗ 0 . 1 , 0 . 8 ∗ 0 . 3 ] ( s 0 , t 0 ) [ 0 . 9 , 1 ] b [ 0 . 2 ∗ 0 . 1 , 0 . 5 ∗ 0 . 3 ] ( s 6 , t 3 ) ( s 2 , t 0 ) ( s 5 , t 3 ) C 1 || I C 2 where I = { a | c , b , d }

Parallel Composition of contracts over two components A probabilistic transition has higher priority than an action transition. Interaction set I : only transitions labeled with interactions in I can occur. Synchronize two probabilistic transitions. If one contract reaches ⊤ , the composed contract reaches ⊤ . c a s 5 [ 0 . 2 , 0 . 5 ] b a s 6 [ 0 , 0 . 1 ] [ 0 . 5 , 0 . 8 ] [ 0 . 7 , 0 . 9 ] t 2 s 1 s 3 c s 0 t 0 t 1 [ 0 . 9 , 1 ] b [ 0 . 1 , 0 . 3 ] d c s 2 t 3 ⊤ C 1 C 2 [ 0 . 2 ∗ 0 . 7 , 0 . 5 ∗ 0 . 9 ] ( s 5 , t 2 ) b [ 0 . 5 ∗ 0 . 7 , 0 . 8 ∗ 0 . 9 ] ( s 6 , t 2 ) a | c [ 0 , 0 . 1 ] ( s 1 , t 0 ) ( s 3 , t 1 ) [ 0 . 5 ∗ 0 . 1 , 0 . 8 ∗ 0 . 3 ] ( s 0 , t 0 ) [ 0 . 9 , 1 ] b [ 0 . 2 ∗ 0 . 1 , 0 . 5 ∗ 0 . 3 ] ( s 6 , t 3 ) ( s 2 , t 0 ) ( s 5 , t 3 ) C 1 || I C 2 where I = { a | c , b , d }