Proving Transformation Functions Abdessamad Imine, Pascal Molli, Gérald Oster, Michaël Rusinowitch Project ECOO & CASSIS LORIA – INRIA Lorraine
Context � RT Groupware Algorithm requires properties on Transformation Functions: ≡ op T ( op , op ) o 1 2 1 C1: op T ( op , op ) o 2 1 2 = T ( op op T ( op , op )) o 3 , 1 2 1 C2: T ( op op T ( op , op )) o 3 , 2 1 2
Problem � Proving C1 and C2 is not obvious � For a String Object (insert, delete): � For C2: 123 cases � For a (simple) XML object (6op) � For C2: 6*6*6 =216 base cases + all combination of preconditions… � How to develop SAFE transformation function for complex objects ??
Approach : Automatic proof… � Use an Automatic Theorem Prover to prove C1, C2 on transformation functions… (SPIKE in our case) � Allow to handle more complex typed objects � Discover quickly erroneous executions…
Our XML Object… � CN(int n, String tn) : int nn � DN(int n) : void � CA(int n, String a) � DA(int n String a) � CHA(int n, String a, String v);
Example of use… (CRC Card) CN(1,"Class")->2 Root : 1 CA(2,"Description") CHA(2,"Description","Model in MVC") CN(2,"Responsibility")->3 Description: Class : 2 Model in MVC CA(3,"Description") CHA(3,"Description","Contain data to be displayed") Collaboration : 4 Responsability : 3 CN(2,"Collaborations")->4 CA(4,"Description") Description: Description: CHA(3,"Description","Controller, Views") Contain data to be displayed Controller, Views
Example of SPIKE Feedback T(CHA(n1,a1,v1),CHA(n2,a2,v2)):- if n1=n2 ^ a1=a2 ^ v1=v2 return noop if n1=n2 ^ a1=a2 ^ v1<>v2 return CHA(n1,a1,max(v1,v2)) else return CHA(n1,a1,v1)
C2 violated… � Problematic scenario: S1 S2 S3 CHA(n,a,v1) CHA(n,a,v2) CHA(n,a,v3) With max(v1,v2)=max(v2,v3)…
Corrected transformation functions… T(CHA(n1,a1,v1),CHA(n2,a2,v2)):- if n1=n2 ^ a1=a2 return CHA(n1,a1,max(v1,v2)) else return CHA(n1,a1,v1) ok for C2…
Another example… T(CA(n1,a1),DA(n2,a2)) :- return CA(n1,a1) T(CA(n1,a1),CHA(n2,a2,v2)) :- if n1=n2 ^ a1=a2 return noop else return CA(n1,a1) T(DA(n1,a1),CA(n2,a2)) :- if n1=n2 ^ a1=a2 return noop else return DA(n1,a1) T(DA(n1,a1),CHA(n2,a2,v2)) :- return DA(n1,a1) T(CHA(n1,a1,v1),CA(n2,a2)):- return CHA(n1,a1,v1) T(CHA(n1,a1,v1),DA(n2,a2)):- if n1=n2 ^ a1=a2 return noop else return CHA(n1,a1,v1)
C2 violated ! S1 S2 S3 CA(n,a) CHA(n,a,v) DA(n,a) n and a are linked variables…
Correcting transformation functions… New… Old… T(CA(n1,a1),DA(n2,a2)) : T(CA(n1,a1),DA(n2,a2)) :- if n1=n2 ^ a1=a2 return noop return CA(n1,a1) else return CA(n1,a1) T(DA(n1,a1),CA(n2,a2)) :- T(DA(n1,a1),CA(n2,a2)) :- return DA(n1,a1) if n1=n2 ^ a1=a2 return noop else return DA(n1,a1)
Writing SPIKE specifications… � C1 based on equivalence � Requires to specify state, more difficult… � C2 based on syntactic equality � Only needs definition of operations !! � C2 very easy to prove, C1 requires more work…
Proving C2... Our definition SPIKE Formalism… T(CN(n1,tn1),CN(n2,tn2)):- T(CN(n1,tn1),CN(n2,tn2))=CN(n1,tn1) return CN(n1,tn1) T(CN(n1,tn1),DN(n2)):- Childof(n1,n2)=true -> T(CN(n1,tn1),DN(n2)) = Nop if (n1 childof n2) return noop Childof(n1,n2)=false -> else return CN(n1,tn1) T(CN(n1,tn1),DN(n2)) = CN(n1,tn1)
Proving C2… specification : convergence use : nats ; sorts: Op Tag Node Att SetAtt Val State; constructors : CN__: Node Tag -> Op; DN_: Node -> Op; CA__: Node Att -> Op; DA__: Node Att -> Op; CHA___: Node Att Val -> Op; Nop : -> Op; defined functions : Childof__: Node Node -> Bool;
Proving C2… (end…) conjectures: %C2 T(T(i,k),T(j,k)) = T(T(i,j),T(k,j));
Proving C1 � Requires to specify unordered Trees… � A little more technical… axioms: Eqn(n1,n2)=true => Del(Create(St,n1),n2)=Del(St,n2); Eqn(n1,n2)=false, Childof(n1,n2)=true => Del(Create(St,n1),n2)=Del(St,n2); Eqn(n1,n2)=false, Childof(n1,n2)=false => Del(Create(St,n1),n2)=Create(Del(St,n2),n1); …
User User and project desktop names The switching mode part �
XML Tree Reception Log of operations queue
User : Pol User : Seb
Then, when Pol wants to publish his card, he has to Commit his work. At that moment, the local operations are broadcasted to the other sites. Broadcast Commit
Integration Update
Same state Update
Seb and Pol work in parallel in Multi-Synchronous mode.
User Pol want to switch to synchronous mode
Pol switch to synchronous mode
Broadcast
Seb switch to synchronous mode
Integration
Integration Broadcast
Color Color Both workspaces Pol Seb are merged
Synchronous Synchronous mode mode
Conclusion – Perspectives… � Allow to develop safe transformation Functions… � For more complex typed object… � Find quickly bad scenario… � Writing specifications not very hard… � Plan to build an IDE for developping transformation functions…
Recommend
More recommend
