Analysis of Concurrent Software Models Using Partial Order Views

1. Analysis of Concurrent Software Models Using Partial Order Views Qiang Sun, sun-qiang@sjtu.edu.cn Yuting Chen, chenyt@cs.sjtu.edu.cn Jianjun Zhao, zhao-jj@cs.sjtu.edu.cn Shanghai Jiaotong University 22-Aug-14

2. Outline • Motivation • An approach to analysis of concurrent software models using partial order views • Some simple examples

3. Motivation • Checking and analyzing the software design model become crucial • Analysis of concurrent software behavioural models still faces challenges • Data races, atomicity violations, bugs • A number of analyses are on the basis of state models • A process can be modeled as a state machine in which the transitions are atomic or indivisible actions executed by the process. • LTS: Labeled Transition Systems • FSP (Finite State Processes), CCS, CSP

4. Analyzing a state model usually faces difficulties • Combination of state models leads to state space explosion

5. Solution? • Modeling concurrency using partial orders • Partial order view • Extraction of partial orders of interest events from state machines • Partial orders can also be extracted from partial behavioral models. • BiG provides the mechanism of the model transformation and synchronization. • State machine ↔ Pomset model

6. Labeled Partial Order (LPO) • A partial order is a pair (E, <), where < is an irreflexive transitive binary relation on the vertex set E. • A labeled partial order (lpo) is a structure (E, ∑, μ, <), where (E, <) is a partial order, and μ : E→∑ labels the vertices of E with elements of the set ∑. • (E, ∑, μ, <) and (E’, ∑’, μ’, <’) over the same set of labels ∑ are isomorphic if • there exists a bijection τ: E→E’ such that for all u, v ∈ E, μ(u)= μ’(τ(u)), and u < v iff τ(u) <’ τ(v).

7. Partial Order Multi-Set (Pomset) • A pomset [E, ∑, μ, <] is the isomorphism class of an lpo (E, ∑, μ, <). • A pomset [E, ∑, μ, <] is finite if E is finite. • Two pomsets [E, ∑, μ, <] and [E’, ∑’, μ’, <’] are isomorphic if • there exist bijections τ : E→E’and ν: ∑→ ∑’, such that for all u, v ∈E and for all a ∈ ∑, μ(u) = a iff μ’ (μ(u)) = ν(a), and u < v iff τ(u) <’τ(v).

8. Two Operations • Let • p = [E, ∑, <, μ] • p' = [E’, ∑, <’, μ’] • E ∩ E' =Φ. • Series operation • p;p’ = [E∪E’, ∑, (< ∪<’ ∪(E×E’)), μ ∪μ’] • Parallel operation • p||p’ = [E∪E’, ∑, (< ∪<’), μ ∪μ’]

9. Pomset Model • Actions & events • An action may occur more than once. ∑ • An occurrence of an action is an event. E • Pomset model helps analyze and understand the behaviors of concurrent software better. • Happens-before relationship for the events of interest • Calculating the possible traces • Pomset model can avoid state space explosion; the increment of the events is linear. A B

10. Analysis of Concurrent Software Models Using Partial Order Views • To extract pomset model • Computing the partial order of events within one process. • Merging partial orders of different processes through parallel operation. • To analyze pomset model and check event traces • To revisit state model whether we detect abnormal event traces • Bidirectional Graph Transformation technique provides with support in transforming state model to pomset model and keeping model synchronization. • The result can be easily mapped back to the original LTS.

11. Small examples

12. Semaphore • Semaphore LTS • Loop up 1 -1 0 up down up up 1 1 critical 1 0 critical 2 0 2 2 down down

13. up critical 1 down End Begin up critical 2 down

14. Elevator System • Outer request • FLOOR × {UP, DOWN} • Inner request • FLOOR TO GO TO • Controller of elevators • Out requests: accessing request queue • Inner requests: message passing 5 floors and 2 elevators

15. Outer request queue 0 send receive receive receive getREQ User in elevator 0 1 2 3 4 send send send response response -1 0 1 2 3 response response 5 receive send receive receive elevator Inner request buffer

16. Begin getREQ send send send receive receive receive response End

17. remove Begin get send send send receive receive receive response End

18. Outer request queue 0 1’ send get remove receive receive receive User in elevator 0 1 2 3 4 send send send response response -1 0 1 2 3 response response 5 receive send receive receive elevator Inner request buffer

19. remove Begin Begin get getREQ BIG receive receive receive getREQ send send send send send send 1’ get remove receive receive receive 0 1 2 3 4 receive receive receive receive receive receive 0 1 2 3 4 response response response response response response response response End End 5 response response 5

20. Two elevators Outer request queue 1’ 1’ get remove get remove receive receive receive receive receive receive 0 1 2 3 4 0 1 2 3 4 response response response response response response response response 5 5 Elevator 2 Elevator 1

21. Begin get1 get2 remove1 remove2 get1 → get2 → remove1 → remove2

22. Lock & Unlock Begin Begin lock lock lock lock get1 get2 get1 get2 remove2 remove2 remove1 remove1 unlock unlock unlock unlock

23. Outer request queue get remove get remove 1’ 1’’ 1’’’ 1’ 1’’ 1’’’ receive receive receive lock unlock receive receive receive lock unlock 0 1 2 3 4 0 1 2 3 4 response response response response response response response response 5 5 Elevator 1 Elevator 2

24. Partial order event model provides engineers with • A different view about the events occurring in the concurrent software system and their order. • Bidirectional model transformation technique helps transform state model to partial order event model • Detection of potential errors is possible from taking advantage of information about partial order event model • To detect data races by associating the events to accessing the shared memory • To detect atomicity violations by associating actions to accessing resources • Determination of the real bugs usually relies on human judgements • Bidirectional model transformation technique helps reveal the bugs in the state model if any abnormal event traces are found

25. Conclusions • State model is widely used in practice • Pomset model can avoid state space explosion • An approach to checking and analyzing state model using pomset model • BiG provides the mechanism of model transformation and bug elimination

26. Future Work • A systematic approach • Correctness of the approach • Case studies and experiments • Tool Support