Session-Based Compositional Verification on Actor-based Concurrent Systems Session Types for ABS Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 1
Motivation ◮ ABS language can be verified w.r.t. methods preserving class invariants ◮ Specification is written class-local directly in the verification logic 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 2
Motivation ◮ ABS language can be verified w.r.t. methods preserving class invariants ◮ Specification is written class-local directly in the verification logic Aim Use session types as specification language for global communication of ABS systems. 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 2
Motivation ◮ ABS language can be verified w.r.t. methods preserving class invariants ◮ Specification is written class-local directly in the verification logic Aim Use session types as specification language for global communication of ABS systems. ◮ But session types are not defined for such a restrictive concurrency model 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 2
The ABS Concurrency Model ◮ ABS stands for Abstract Behavioural Specification ◮ Communication between objects are always asynchronous method calls ◮ No direct access to the fields of other objects ◮ Asynchronous method calls are realized through futures ◮ Futures can be passed around through method calls ◮ Object fields with future types ◮ At most one process is active on an object at a time ◮ Cooperative scheduling ◮ scheduling points are made syntactically explicit in the code ◮ await statement (on future or boolean expression) 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 3
The ABS Concurrency Model ◮ ABS stands for Abstract Behavioural Specification ◮ Communication between objects are always asynchronous method calls ◮ No direct access to the fields of other objects ◮ Asynchronous method calls are realized through futures ◮ Futures can be passed around through method calls ◮ Object fields with future types ◮ At most one process is active on an object at a time ◮ Cooperative scheduling ◮ scheduling points are made syntactically explicit in the code ◮ await statement (on future or boolean expression) 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 3
An ABS Example (asynchronous call + future) int n( int i ){ Fut< int > f = o!m(i); await f ?; int r = f . get ; return r; } 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 4
ABS-based Session Types ◮ Adapt session types to futures Instead of using arbitary channels ◮ Projections (global types to local types): global behavior → object-local behavior → method-local behavior ◮ Specify history-based class invariants based on the session types ◮ Verify the history-based class invariants using KeY-ABS theorem prover 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 5
Basic Projection from Global Types to Local Types Global Types f − → q : m ( S ). G ::= p Local Types q ! f m ( S ). L | p ? f m ( S ). L ::= 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 6
Basic Projection from Global Types to Local Types Global Types f − → q : m ( S ). G | q ↓ f : ( S ). G ::= p Local Types q ! f m ( S ). L | p ? f m ( S ). L | Put f : ( S ). L ::= 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 6
Basic Projection from Global Types to Local Types Global Types f − → q : m ( S ). G | q ↓ f : ( S ). G | f ↑ p : ( S ). G ::= p Local Types q ! f m ( S ). L | p ? f m ( S ). L | Put f : ( S ). L ::= | Get f : ( S ). L 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 6
Basic Projection from Global Types to Local Types Global Types f − → q : m ( S ). G | q ↓ f : ( S ). G | f ↑ p : ( S ). G | Rel( p , f ). G | end ::= p Local Types q ! f m ( S ). L | p ? f m ( S ). L | Put f : ( S ). L ::= | Get f : ( S ). L | Aw( f , f ′ ). L | React f . L | end 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 6
Basic Projection from Global Types to Local Types Global Types f − → q : m ( S ). G | q ↓ f : ( S ). G | f ↑ p : ( S ). G | Rel( p , f ). G | end ::= p Local Types q ! f m ( S ). L | p ? f m ( S ). L | Put f : ( S ). L ::= | Get f : ( S ). L | Aw( f , f ′ ). L | React f . L | end ◮ Global Rel only needed if multiple Aw could be possible ◮ React never needed in global type 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 6
Example f ′ f 0 f ′ ↑ b . f a ↓ f ′ . 0 − → a : m . a − → b : m 1 . b − → a : m 2 . b ↓ f . a ↓ f 0 . end 0 a b m2 m1 m f' f f0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 7
Example f ′ f 0 f ′ ↑ b . f a ↓ f ′ . 0 − → a : m . a − → b : m 1 . b − → a : m 2 . b ↓ f . a ↓ f 0 . end Get f ′ . b ? f m 1 . ! f ′ m 2 . Put f . end Put f ′ . a ? f 0 m . ! f m 1 . Aw( f 0 , f ).? f ′ m 2 . React f 0 . Put f 0 . end 0 a b m2 m1 m f' f f0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 7
Example f ′ f 0 f ′ ↑ b . f a ↓ f ′ . 0 − → a : m . a − → b : m 1 . b − → a : m 2 . b ↓ f . a ↓ f 0 . end Get f ′ . b ? f m 1 . ! f ′ m 2 . Put f . end Put f ′ . a ? f 0 m . ! f m 1 . Aw( f 0 , f ).? f ′ m 2 . React f 0 . Put f 0 . end m ? f 0 m . ! f m 1 . Aw( f 0 , f ). Put f 0 m 2 ? f ′ m 2 . Put f ′ m 1 ? f m 1 . ! f ′ m 2 . Get f ′ . Put f 0 a b m2 m1 m f' f f0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 7
Wellformed Global Types ◮ Consistency constraints on valid types, e.g. no reuse of futures ◮ For projecting on methods, keep track of ◮ busy objects ◮ currently computed futures ◮ waiting futures ◮ Current status: relying on unambiguous and scheduler-independent control flow 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 8
Wellformed Global Types ◮ Consistency constraints on valid types, e.g. no reuse of futures ◮ For projecting on methods, keep track of ◮ busy objects ◮ currently computed futures ◮ waiting futures ◮ Current status: relying on unambiguous and scheduler-independent control flow f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . a − → c : m 2 . b − → c : m 2 . ... 0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 8
Wellformed Global Types ◮ Consistency constraints on valid types, e.g. no reuse of futures ◮ For projecting on methods, keep track of ◮ busy objects ◮ currently computed futures ◮ waiting futures ◮ Current status: relying on unambiguous and scheduler-independent control flow f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . a − → c : m 2 . b − → c : m 2 . ... 0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 8
Wellformed Global Types ◮ Consistency constraints on valid types, e.g. no reuse of futures ◮ For projecting on methods, keep track of ◮ busy objects ◮ currently computed futures ◮ waiting futures ◮ Current status: relying on unambiguous and scheduler-independent control flow f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . a − → c : m 2 . b − → c : m 2 . ... 0 f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . c − → e : m 2 . d − → f : m 2 . ... 0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 8
Wellformed Global Types ◮ Consistency constraints on valid types, e.g. no reuse of futures ◮ For projecting on methods, keep track of ◮ busy objects ◮ currently computed futures ◮ waiting futures ◮ Current status: relying on unambiguous and scheduler-independent control flow f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . a − → c : m 2 . b − → c : m 2 . ... 0 f 0 f 1 f 2 f 3 − → a : m 0 . a − → b : m 1 . c − → e : m 2 . d − → f : m 2 . ... 0 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 8
Branching Branching operator l 1 : G 1 l 2 : G 2 p ... l n : G n ◮ With arbitary channels the choice is made by sending the label over a channel ◮ But futures cannot send arbitary data 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 9
Branching Branching operator f 1 − → q 1 : m 1 . G ′ l 1 : p 1 f 2 l 2 : p − → q 2 : m 2 . G ′ p 2 ... f n l n : p − → q n : m n . G ′ n ◮ With arbitary channels the choice is made by sending the label over a channel ◮ But futures cannot send arbitary data ◮ Each choice must be made by calling a different method: m i � = m j , if q i = q j ◮ Methodname takes role of branch-label 20. Oktober 2015 | TU Darmstadt | Eduard Kamburjan, Crystal Chang Din, Tzu-Chun Chen | 9
Recommend
More recommend
