InProceedingsofthe14thInternationalIFIPSymposiumonProtocolSpecication,Testing,andVerication,pages339{346,Chapmann&Hall,1994

Transcription

1 InProceedingsofthe14thInternationalIFIPSymposiumonProtocolSpecication,Testing,andVerication,pages339{346,Chapmann&Hall,1994 CompositionalSpecicationandVericationof Abstract Dept.ofComputerScience,DortmundUniversity,D-44221Dortmund,Germany High-SpeedTransferProtocols Transferprotocolsarecomposedfrombasicprotocolmechanismsandaccordinglyacomplex protocolcanbeveriedbyaseriesofrelativelysimplemechanismproofs.ourapproachapplies PeterHerrmann,HeikoKrumm L.Lamport'sTemporalLogicofActions(TLA).ItisbasedonamodularcompositionalTLAstyleandsupportstheanalysisofexiblyconguredhigh-speedtransferprotocols. KeywordCodes:C.2.2;F.3.1;D.3.3 Keywords:ProtocolVerication;TLA;Composition protocolmechanismscorrespondstoastructuringofservicerequirementsintodierent serviceproperties.itappliesdecompositionandstructurestheprotocolvericationinto high-speednetworks[3,10].thereforeecientmeansfortheanalysisofprotocolspectra areneeded.ourapproachreectsthatthecompositionoftransferprotocolsfrombasic Flexibleapplication-drivenprotocolcongurationcanhelptoenhancetheperformanceof 1Introduction referstotheconceptsofrenementmappings[1]andformalcompositionbylogicalconjunction[2].tlaiswell-suitedfortheneedsofpracticalprotocolverication.protocol ofinterestinglivenesspropertiesissupportedbytla. separatedandeasy-to-understandmechanismproofs. designersarefamilarwithstatetransitionbasedmodels.thedenitionandverication meanswhicharetailoredtothemodellingofconcurrentprocesssystems.therefore,we Nevertheless,TLAisaveryfundamentalapproachanddoesnotprovideforspecial TheapproachisbasedonL.Lamport'sTemporalLogicofActions(TLA[5])and performjointactions.thisstatelesswayofinteractionhasdierentbenets.especially resource-orientedprocessesaswellasconstraint-orientedprocessescanberepresented Lotos[4].Incomparisonwith[2],theprocessesdonotinteractviasharedvariablesbut (cf.[9]).furthermore,thestylesupportsdecompositionalproofs.asystemisthelogical conjunctionofitsprocessesandthestyleconventionsassuretheabsenceofcontradictions inthesystemformula.thereforeprocesspropertiesdirectlyareinheritedtothesystem. designedacompositionalspecicationstylefortlawhichisorientedatccs[7]and dierenttransferprotocols.theapplicationsweresupportedbyexistinggeneraltla- Weappliedthecompositionalstyleandthedecompositionalvericationmethodto 1

2 tools(syntax-directededitor,browser,interpreter,modelchecker,predicatelogictheorem proverfrontend)whichnotyethavebeentailoredtothestyle.yetwemadetheexperience familarwithtlaandrenementmappings[5,1]. thatitispossibletoverifycomplexprotocolswithinfewman-month(e.g.,theverication viewstothevericationofxtparegiveninordertoexamplifytheapplicationandto giveanimpressionofthereducedvericationcomplexity.thereaderisassumedtobe ofxtp[8]needed7weeks,3weeksforthedesignofspecicationsandproofideas,4weeks fortheformaltheoremproofs). 2Compositionalspecicationstyle Atrstthepaperintroducesthestyleandthevericationmethod.Thereaftersome AsinCCSandLotos,aprocessinprincipleisanopensubsystembutasingleprocess TheinitialpredicateP:Initdescribesthesetofstartingstates.P:Vstandsforthetuple specicationcanbeinterpretedforitsown.inthiscaseitreectsaclosedsystemconsistingoftheprocessandanevironmentwhichisuniversalinthesensethatitdoesnot constraintheprocess.aprocesspisdenedbyacanonicaltla-formulap: ofprivatestatevariablesofp.p:acti(p:p:ptypei)arethedierentactionsofpwhich constituteitsnext-staterelation.theactionsmaybeparametrizedbydataparameters supportingthecommunicationofvaluesbetweentheprocessanditsenvironment.by P=P:Init^2[9p2P:ptype1:P:act1(p)_::_9p2P:ptypen:P:actn(p)]P:V styleconventions,theactionsonlyaectprivatevariablesandmustbemutuallydisjoint ^8p2P:ptypek:SFP:V(P:eactk(p))^::^8p2P:ptypel:SFP:V(P:eactl(p)): ^8p2P:ptypei:WFP:V(P:eacti(p))^::^8p2P:ptypej:WFP:V(P:eactj(p)) P^2(e1=P:ptype1^::^en=P:ptypen)describesaseparatedprocessinanuniversal intheirnon-stutteringsubrelations. environment. p2ei,theenvironmentcantoleratetheactionacti(p)inthenextstep.thustheformula environmentreadinessvariable.itisassumedtobesetbytheenvironmentofp:if P:eacti(p:ptypei)=P:acti(p)^p2eiwhereaP:eactiistheconjunctionoftheaction P:actiandanenvironmentcondition.eistandsforanadditionalstatevariablecalled Thelivenesspropertiesaredescribedbyfairnessassumptionsonconditionedactions thespeciccouplingofthesystem.itcanbestructuredintoaconjunctionofparticipation constraintspjcofthedierentprocesses:cc=2(p1c^::^pmc).aparticipation constraintagainisaconjunctionoftwoparts:pjc=pjcon^pjred. anotherconjunctiveterm,thecouplingconstraintcc.ccisaninvariantanddescribes P2^::^Pm^CC.ThedierentPjdenotetheprocessformulas.Additionally,thereis PjCONconstrainstheoccurrenceofPj-stepsinsystemexecutions.Itisadisjunction AsystemScomposedofprocessesP1;P2;::;PmisdescribedbyaTLA-formulaS=P1^ action,i.e.,ifitisnotinvolvedinjointactions,thenpeeractionsequalstotrue. thesamejointaction:peeractions=pk:acto(p)^::^pl:actq(p).ifpj:actiisaninternal ofunchanged(pj:v)andofactionterms9p2pj:ptypei:(pj:acti(p)^peeractions)^ StutteringRestwhichareintroducedforeachactionPj:actiofPj. PeerActionsisaconjunctionofactionsofotherprocesseswhichshallcontributeto 2

3 non-connectedactionsaswell.furthermore,itispossibletopostulatetheinterleaving keepthesystemformulasimple,werecommendtointroduceinterleavingasstrictasitis possiblewithrespecttoaspecicsystemofinterest. arenotinvolvedinajointactionwithpj:acti.itdescribestheinterleavingatomicityof Pj:actiandmaybesettotrueifparallelismshallbetoleratedwithrespecttologically atomicityofpj:actionlywithrespecttosomesubsetoftheotherprocesses.inorderto StutteringRestisaconjunctionofUnchanged-statementsforprocessesPr;::;Pswhich term.forinternalactionspj:actitheequationpj:ei=pj:typeiisintroduced. theprocessesandactionsreferencedarethoseofpeeractionsofthecorrespondingaction Pj:ei=fp:Enabled(Pk:acto(p))^::^Enabled(Pl:actq(p))ghastobeintroducedwhere variablespj:ei.ithastobechoseninaccordancewiththejointactiontermsofpjcon andisaconjunctionofequations.foreachinterfaceactionpj:actiofpj,anequation Bystyleconvention,weclaimthatthedierentfairnessassumptionsoftheprocess TheotherpartofPjC,PjREDstatesthesubstitutionoftheenvironmentreadiness actions,contributingtothesamejointaction,ttogether,i.e.,allprocessactionsofthe S:Initistheconjunctionoftheprocesses'Init-predicates.TheactionsS:actiareconjunctionsofprocessactionsandUnchanged-statements(guidedbythePjCON).Dueto ThecompositionalsystemformulaS=P1^P2^::^Pm^CCcanbetransformed syntacticallyintoanequivalent`at'canonicalformula samejointactionmusteitherbeweakfair,strongfair,orwithoutanyfairnesscondition. thestyleconventionsthefairnessassumptionsofsystemactionsareinheritedfromthe processactions'fairness. S=S:Init^2[9p2ptype1:S:act1(p)_::_9p2ptypen:S:actn(p)]S:V ThespecicationstyleisdenedintermsofTLA+[6]andtakesprotfromTLA+ ^8p2ptypek:SFS:V(S:eactk(p))^::^8p2ptypel:SFS:V(S:eactl(p)) ^8p2ptypei:WFS:V(S:eacti(p))^::^8p2ptypej:WFS:V(S:eactj(p)) ToprovethataprotocolPimpliesaserviceS,decompositionsPCandSCcanbeused. modules.atoolcansupportthedenitionofsystemstructures(e.g.,interactivegraphical editingofcouplingconstraints)andcancomputetheatformula. 3Structuredverication PCiscomposedofasetofprotocolmechanismsPPj:PC=PP1^PP2^::^PPn^PCC. SC)S.Theproofofthedecompositioncorrectness(P)PCandSC)S)is easysincebothsidesoftheimplicationsarestronglyrelated.moreover,p)pccan besplitted(pcisaconjunction).thediculttaskofthevericationistheproofof Correspondingly,SCiscomposedofasetofservicepropertiesSPj:SC=SP1^SP2^ PC)SC.Duetothecorrespondingdecompositions,thisproofcanbestructuredinto ::^SPn^SCC.EachsingleprotocolmechanismPPiprovidesforonefunctionalservice nmechanismproofsppi)spiandoneadditionalcouplingproofpcc)scc.the propertyspi. couplingproofisapuresafetyproofandcanbeperformedquitemechanicallybecause TheprotocolvericationhastoprovetheimplicationsP)PC,PC)SC,and onecanprotfromthoseintermediateresultsofmechanismproofswhichdescribethe 3

4 numberofbasicmechanisms.thereforemechanismproofscanbere-usedrespectively action-structureoftherenementmapping.themechanismproofsaremuchsimplerthan amonolithicalproofbecauseonlyasubsetofvariablesandactionshastoberegarded. Furthermore,themultitudeofpresenttransferprotocolsisfacedbyarelativelysmall transferdirection.theactionsubmitmodelstherequestofthetransferofamessagei outlinedinfig.1,thetransferservicescanbespeciedbyafifomessagequeueper 4Example canbereplacedbyreferencestoformerproofs. fromsitestositedwhichisrepresentedbyanenqueuingoperation.theparameternodc denotesthe`nodatacorruptioncontrol'ag.thedequeuingactiondelivermodelsthe indicationatsitedest.e SomeaspectsofthedatatransferofXTP[8]shallexemplifytheapproach.Asitis - q e ThecompositionalservicespecicationSCiscomposedofserviceconstraintprocesses submit (s,d,i,nodc) Figure1:MonolithicalService6deliver(s,d,i) alreadyrenedmodelsofserviceconstraints.theyreectaprotocol-neardistributionof variablesoverthethreepartiestransmitter,medium,andreceiver. NoCorruption,NoGaps,andNoDuplicates.Tosimplifytheverication,wehavechosen submit (s,d,i,k,nodc) send(s,d,k,i) sbu e? 36 -removeqkqqq rbu e tbu 6deliver(s,d,k,i) typestatevariablessbu,tbu,andrburepresentmessagebuersofthethreeparties. transfererrorsbutdoesonlypermitcorruptionsiftheparameternodcisset.theset- Fig.2outlinestheserviceconstraintprocessNoCorruption.Ittoleratesvarious Figure2:ServiceConstraintNoCorruption receive(s,d,k,i) Messagesarerepresentedbytuplesoftransmitteraddresss,receiveraddressd,message identicationkeyk,anduserdatai.asinfig.1,theactionssubmitanddelivermodel transferrequestsandindicationsnowbysetinsertionandmemberselectionoperations totoleratereorderingandduplication.theotheractionsareinternal.theymodelloss andtheforwardingofbuerelements.4

5 submit(s,d,k)? send(s,d,k) sbu e36 received data-removedelivered QkQQQ rbu e tbu 6deliver(s,d,k) receive(s,d,k) Figure3:ServiceConstraintNoGapsrctr thesafetyaspectoftheabsenceofloss,namelythatthesequenceofpacketsdeliveredis freefromgaps.indicationsarecontrolledbythereceivecounterrctr.secondlytheliveness aspectisreectedbyexclusionofthelossofnon-deliveredpackets(removerestrictions) inconnectionwithfairnessassumptions. InFig.3,thesecondserviceconstraintprocessNoGapsisoutlined.Atrstitmodels submit(s,d,k) -e edeliver(s,d,k) countersctrassignskeysktothemessagessothatthereceivercandetectduplications. ThethirdserviceconstraintprocessNoDuplicatesisoutlinedinFig.4.Thesend Figure4:ServiceConstraintNoDuplicates ThecompositionalservicespecicationSCcanbebuiltnowbyacompositionofthe rctr variables.theideabehindthisinvariantguidesthedesignoftherenementmappingas wellȧfterdescribingxtpbyamonolithicalprotocolspecicationpwedesignacompositionalprotocolsystempc.pcisacompositionofthreesubsystemsppnc,ppng,and processestobeperformedjointly.scimpliesthemonolithicqueuemodel.themaintask oftheproofisthedesignofaninvariantwhichrelatesthebuercontentsandcounter threeconstraintprocesses,thecouplingofwhichdenestheequally-namedactionsofthe PPNDwhichcorrespondwiththethreeserviceconstraintsNoCorruption,NoGaps,and lossandtheprotocolmechanismsarenotstructuredfurther. plicationsp)ppxandp)pcc(sincetheppxarecompositionstheproofofeach lyingnetworkwireandmodelsoftheprotocolmechanismsbuers,selectiverepeat,and NoDuplicates.TwoofthePPxagainarecompositions,namelyofamodeloftheunder- P)PPxcanbesplittedagain). KeepOrder.PPNCconsistsofWireandBuers;PPNGofWire,Buers,andSelective componentsoftheprotocolsystem.sowireisdescribedasfollows(canonicalprocess Repeat;andPPNDofKeepOrder.Tosimplifythisexample,Wireisreliablebesidesof formulaomitted). TheproofofP)PCisstraightforwardandconsistsoftheproofofthefourim- Togivesomeimpressionontheessentialtasksoftheverication,wenowlookatbasic 5

6 typeadr,packet init8x2adr:inq[x]=empty actionsend(p:packet,src,dest:adr)= varinq:array[adr]ofqueueofpacket ^inq[dest]0=enqueue(inq[dest],p) Wire Thenetworkmodelconsistsofanarrayofmessagequeuesinq[dest],keepingthedestdirectedXTP-PDUs.Theactionssendandreceivemodelthetransferrequestandtransfer indicationofpdus.thelossofpdusisexpressedbytheactionloss,removingpdus actionloss=9x2adr:inq[x]0=dequeue(inq[x]) ^p=rstqueue(inq[dest]) ^inq[dest]0=dequeue(inq[dest]) actionreceive(p:packet,src,dest:adr)= non-deterministicallyfromthequeues.buers ^p.src=src^p.dest=dest parmstation:adr init8x2key,a2adr:sb[a,x].i=?^rb[a,x].i=? actionsubmit(i:info,dest:adr,k:key)=sb[dest,k].i=?^sb[dest,k].i0=i typeadr,info,packet,key varsb:array[adr,key]of[[i:info[f?g]] actionsendinfo(p:packet,dest:adr,k:key)= actiondeliver(i:info,src:adr,k:key)=rb[src,k].i=i RB:array[Adr,Key]of[[i:Info[f?g]] actionrecinfo(p:packet,src:adr,k:key)= actionsendctrl(p:packet,dest:adr)= p.src=station^p.dest=dest^p.type=ctrl ^SB[dest,k].i6=? ^p.src=station^p.dest=dest^p.he.key=k actionrecctrl(p:packet,src:adr)= ^RB[src,k].i=? ^RB[src,k].i0=p.info ^p.src=src^p.dest=station^p.type=info^p.he.key=k ^p.type=info^p.info=sb[dest,k].i buerrbincludingmessageswhichareindexedbytheaddressofthestation,theaddress TheprocessBuersdescribesonebasicXTPprotocolentityandwillbeparametrized bytheaddressstationofthesiteassignedto.itcontainsasendbuersbandareceive actionsendremove(dest:adr,k:key)=sb[dest,k].i6=?^sb[dest,k].i0=? actionrcvremove(src:adr,k:key)=rb[src,k].i6=?^rb[src,k].i0=? p.src=src^p.dest=station^p.type=ctrl deliver.becausextpdistinguishesbetweencontrolandinformationpackets,sending ofthetransferpartner,andthemessagekey.?denotesemptybuerelements.the communicationwiththeuseroftheprotocolisdescribedbytheactionssubmitand 6

7 andreceivingissplitintoactionssendinfo,sendctrl,recinfo,andrecctrl.theremoval ThecompositionofthemechanismsWireandBuersbuildsPPNCandcanbeprovedto ofbuerelementsisdescribedbytheactionssendremoveandrcvremove. implytheserviceconstraintnocorruptionbymeansoftherenementmappingabove. RM=^sbu=f[[src,dest,k,i]]:S[src].SB[dest,k]=ig ^rbu=f[[src,dest,k,i]]:s[dest].rb[src,k]=ig ^tbu=f[[src,dest,k,i]]: 9p:^inqueue(inq[dest],p)^p.src=src transmission.thespecicationisnotshownindetailhere.itprovidesforthesavingof ThevariablesofastationstareidentiedbythequalierS[st]. ThemechanismSelectiveRepeatdetectslostdataandperformsselective-repeatre- ^p.he.key=k^p.info=i^p.type=infog time-outbasedloss-detection. copiesofmessagessent,areceivecounter,span-listacknowledgements,notication,and actions[src].sendinfo(p:packet,dest:adr,k:key,rseq:bool)= ^SelectiveRepeat(src).sendinfo(p,dest,k,rseq) ^S[src].t[dest]0=IFrseqTHENstartELSES[src].t[dest] ^Wire.send(p,src,dest) ^p.src=src^p.dest=dest^p.he.key=k^p.type=info ^Buers(src).sendinfo(p,dest,k) ^S[src].SB[dest,k].i6=? ^inq[dest]0=enqueue(inq[dest],p) ^(timeout(s[src].t[dest]))rseq) expansion.theprocessactionbuers(src).sendinfoequalstotheactionsendinfoof processbuersundersubstitutionofparameterstationbysrc. ItshowsthesystemactionS[src].sendinfoasjointactionofprocessactionsandits PPNGisacompositionofWire,Buers,andSelectiveRepeatandimpliestheservice propertynogaps.thespecicationabovereectsaclippingoftheatformofppng. Inv=8p,src,dest,k: ^p.info=s[src].sb[dest,k].i^p.tr.f.rseq=rseq RM=^8src,dest:rctrg[src,dest]=S[dest].Rctrg[src] ^sbu=f[[src,dest,k]]:s[src].sb[dest,k].i6=?g ^tbu=f[[src,dest,k]]: _(src,k)2s[dest].rcv _S[src].SB[dest,k]6=?^:S[src].SB.Keep[dest,k] _^inqueue(inq[dest],p)^p.src=src^p.dest=dest )S[dest].RB[src,k].i6=?_S[dest].Rctrg[src]>k ^p.type=ctrl^p.tr.f.rseqresp^k2p.c FortheproofofPPNG)NoGapsweneedtheinvariantInvandtherenementmapping RMasdenedabove.Invassuresthatamessagecanonlybeconrmedtothetransmitter merelyequaltothatoftheproofofnocorruption. andremovedfromitssendbuerifitiscorrectlyreceived.therenementmappingis ^rbu=f[[src,dest,k]]:s[dest].rb[src,k].i6=?g 9p:^inqueue(inq[dest],p)^p.src=src TheprotocolmechanismKeepOrdersimplycontainstwocounters:Sctrassignsunambiguouskeystosubmittedmessagesinincrementalorder,Rctrpreventsthedelivery ^p.dest=dest^p.type=info^p.he.key=kg 7

8 theproofofppnd)noduplicationisverysimple. ofreorderedorduplicatedmessages.duetothecloserelationtotheserviceconstraint, performedquitemechanicallyandisnotoutlinedhere. 5Conclusion Weintroducedapracticableapproachforthecompositionalvericationoftransferprotocolswhichprovidesaframeworkfortheinvestigationofexibleprotocolcongurations. Finally,thecouplingproofhastobeperformedtocompletetheverication.Itcanbe PPi,servicepropertiesSPj,andvalidimplicationsPPi)SPj.Therefore,thevericationofaspecicprotocolcanbeperformedbythedesignofequivalentcompositional Presentworkconcentratesontheestablishmentoflibrariesofbasicprotocolmechanisms protocolandservicespecicationstowhichonlythecouplingproofhastobeadded. basicprotocolmechanisms. serviceconstraintssothattheseserviceconstraintscorrespondone-to-onewithsingle provideevenasingleserviceproperty(e.g.,nogapsinthextp-example).therefore, alibraryofmechanismcombinationswouldbeofinterest.insteadofintroducingthis largerlibraryofmechanismcombinations,wearesolvingtheproblemontheserviceside. Werepresentabstractserviceproperties(e.g.,NoGaps)byacompositionofmorebasic Aproblemremains:oftenalreadyacompositionofprotocolmechanismsisneededto References [1]M.AbadiandL.Lamport.TheExistenceofRenementMappings.TheoreticalComputer [2]M.AbadiandL.Lamport.Composingspecications.ACMTransactionsonProgramming [3]Z.Haas.Aprotocolstructureforhigh-speedcommunicationoverbroadbandISDN.IEEE [4]ISO.LOTOS:Languageforthetemporalorderingspecicationofobservationalbehaviour, Science,82(2):253{284,May1991. [5]L.Lamport.TheTemporalLogicofActions.TechnicalReport79,DECDigitalSystems LanguagesandSystems,15(1):73{132,Jan [6]L.Lamport.TLA+:SyntaxandSemantics.Toappear,PreliminaryVersion,DECDigital NetworkMagazine,pages64{70,Jan InternationalStandardISO/IS8807edition,1987. [8]ProtocolEngines,Incorporated.XTPProtocolDenitionRevision3.4,1989. [9]C.A.Vissers,G.Scollo,andM.vanSinderen.Architectureandspecicationstylein [7]R.Milner.ACalculusforCommunicatingSystems.LectureNotesinComputerScience92. ResearchCenter,PaloAlto,May1991.ResearchReport.ToappearinACMTOPLAS. Springer,Berlin,1980. SystemsResearchCenter,PaloAlto,Feb.1992.ResearchReport. [10]M.Zitterbart,B.Stiller,andA.N.Tantawy.Application-drivenexibleprotocolconguration.InN.Gerner,H.-G.Hegering,andJ.Swoboda,editors,KommunikationinVerteilten Systemen,pages144{158,8.Fachtagung,Munchen,Mar.1993.GI/ITG,Springer-Verlag. Specication,TestingandVerication,volumeVIII,pages189{204,Elsevier,1988.IFIP. formaldescriptionsofdistributedsystems.ins.agarwalandk.sabnani,editors,protocol 8