210 likes | 311 Views
Modeling and Analysis of Architectural Exceptions. Fernando Castor Filho Patrick Henrique da S. Brito {fernando}@ic.unicamp.br {patrick.silva}@ic.unicamp.br Cecília Mary F. Rubira {cmrubira}@ic.unicamp.br FM’2005 Workshop on Rigorous Engineering of Fault-Tolerant Systems
E N D
Modeling and Analysis ofArchitectural Exceptions Fernando Castor Filho Patrick Henrique da S. Brito {fernando}@ic.unicamp.br{patrick.silva}@ic.unicamp.br Cecília Mary F. Rubira {cmrubira}@ic.unicamp.br FM’2005 Workshop on Rigorous Engineering of Fault-Tolerant Systems REFT’2005, Newcastle upon Tyne, July 19th 2005
Exception Handling • Popular mechanism for structuring forward error recovery in software systems • Exceptions can be derived incrementally at different phases of development: • Requirements • Architecture • Detailed Design • Implementation REFT'2005 - July 19th 2005
Exception Handling • Popular mechanism for structuring forward error recovery in software systems • Exceptions can be derived incrementally at different phases of development: • Requirements • Architecture • Detailed Design • Implementation REFT'2005 - July 19th 2005
Exceptions at the Architectural Level • A system’s exceptional activity should be addressed since the early phases of development • In recent years, many approaches combining software architecture and exception handling have been proposed • There hasn’t been much focus on the description of exceptions at the architectural level • This may be required for systems with strict dependability requirements such as commercial applications, control systems, and so on. REFT'2005 - July 19th 2005
Operating System Attachments Processor Network O/S E. A. S. I/O Devices ATC Console Local/Group A.M. G.A.M M&C Console A.S.O.U An Air-Traffic Control System Example Exceptions Exceptions Exceptions Exceptions Exceptions Exceptions Source: Bass, Clements, and Kazman, Software Architecture in Practice, 2nd Edition, 2003. REFT'2005 - July 19th 2005
... Some Interesting questions... • What does a double-headed arrow mean? • What are the exceptions that each component signals and handles? • Are there any relevant cause-effect relationships? • Is this analyzable? REFT'2005 - July 19th 2005
Problem • To describe software architectures so that it is possible to reason about the flow of exceptions at the architectural level REFT'2005 - July 19th 2005
Requirements of the Solution • Easy to use (pictorial representation) • Integrated with the concept of architectural style • Precise (unambiguous) • Analyzable • Capable of expressing rules of existing exception handling models REFT'2005 - July 19th 2005
Alloy Design Language • Lightweight formal method • Similar to Z (less expressive but supports automated analysis) • Support for complex data structures • Declarative • Alloy constraint analyzer • Easy to use • Requirements 3-5 REFT'2005 - July 19th 2005
Proposed Framework: Aereal “Normal” Architectural Styles “Exceptional” Architectural Styles Architecture Description Extended with Exceptions Translation Arch. Description + Exception Flow View REFT'2005 - July 19th 2005
Proposed Framework: Aereal “Normal” Architectural Styles “Exceptional” Architectural Styles Architecture Description Extended with Exceptions Translation Arch. Description + Exception Flow View • Documentation • Analysis of stylistic constraints REFT'2005 - July 19th 2005
Proposed Framework: Aereal “Normal” Architectural Styles “Exceptional” Architectural Styles Architecture Description Extended with Exceptions Translation Arch. Description + Exception Flow View • Exception flow analysis REFT'2005 - July 19th 2005
Proposed Framework: Aereal “Normal” Architectural Styles ACME “Exceptional” Architectural Styles Architecture Description Extended with Exceptions Translation Arch. Description + Exception Flow View Alloy REFT'2005 - July 19th 2005
Elements of the Model REFT'2005 - July 19th 2005
An Example CoalFeederController Duct1 AirFlowController REFT'2005 - July 19th 2005
An Example REFT'2005 - July 19th 2005
Properties of Interest • Basic EH mechanism properties • Desirable EH properties • Application-specific properties • Verified using the Alloy Analyzer • Violations of properties generate graphical counter-examples REFT'2005 - July 19th 2005
Examples of Properties • Exceptions encountered by a component and not handled or propagated are signaled • If a component raises an exception, it must also signal the exception • The exceptions encountered by a component are all the exceptions signaled by ducts in the components CatchesFrom set • No useless handlers REFT'2005 - July 19th 2005
Example: No useless handlers pred no_useless_handlers() { all C : Component | all D : C.CatchesFrom | D.(C.Handles) in D.(C.Encounters) && D.(C.Encounters)<:(D.(C.Propagates))=D.(C.Propagates) } REFT'2005 - July 19th 2005
Future Directions • Model coordinated exception handling • Technical report describing the whole model • Extend the implementation of Aereal in order to automatically compute the sets of exceptions that are caught and signaled REFT'2005 - July 19th 2005
Thank You! Contact information: Fernando Castor Filho fernando@ic.unicamp.br fernando.castor@newcastle.ac.uk REFT'2005 - July 19th 2005