Automatic distributed code generation from formal models of asynchronous processes interacting by multiway rendezvous

Abstract

Formal process languages inheriting the concurrency and communication features of process algebras are convenient formalisms to model distributed applications, especially when they are equipped with formal verification tools (e.g., model checkers) to help hunting for bugs early in the development process. However, even starting from a fully verified formal model, bugs are likely to be introduced while translating (generally by hand) the concurrent model -which relies on high-level and expressive communication primitives-into the distributed implementation -which often relies on low-level communication primitives. In this paper, we present DLC, a compiler that enables distributed code to be generated from models written in a formal process language called LNT, which is equipped with a rich verification toolbox named CADP, and where processes interact by value-passing multiway rendezvous. The generated code uses an elaborate protocol to implement rendezvous, and can be either executed in an autonomous way (i.e., without requiring additional code to be defined by the user), or connected to external software through user-modifiable C functions. The protocol itself is modeled in LNT and verified using CADP. We present several experiments assessing the performance of DLC, including the Raft consensus algorithm.

Reflections on Bernhard Steffen’s Physics of Software Tools

“…Maybe this is going too far: there is no reason, for instance, why a BDD package should be verified using itself, whereas proof techniques for pointer manipulation algorithms are clearly more appropriate. However, we can mention, in the case of CADP, three examples that sustain Bernhard Steffen's intuition about "circular use" of formal tools: (i) The CAESAR.ADT compiler [12], which translates LOTOS abstract data types to C, is used to bootstrap itself and to build the XTL model checker [39], both tools being mostly written using LOTOS abstract data types; (ii) Similarly, the LNT language [19], as implemented by the TRAIAN compiler, serves as a basis for implementing the LNT2LOTOS translator for LNT, as well as a dozen of compilers/translators for other languages [16]; (iii) The DLC compiler [10], which translates LNT concurrent descriptions with multiway rendezvous [20] into distributed POSIX processes communicating using TCP sockets, enables formal validation, as its inputs and outputs, both expressed in LNT, can be compared against each other modulo safety equivalence.…”

Debugging of Behavioural Models using Counterexample Analysis

“…The last example we present is the Multiway Rendezvous Protocol. This case study represents the evaluation of a formal model, written in LNT, of the multiway rendezvous protocol implemented in DLC (Distributed LNT Compiler) [16], a tool that automatically generates a distributed implementation in C of a given LNT specification. The multiway rendezvous protocol must allow processes (called tasks) to synchronize, through message exchange, on a given gate.…”

MCC’2017 – The Seventh Model Checking Contest

“…DLCshifumi and DLCround model distributed implementations of two well-known games: shifumi (rock-paper-scissors) and musical chairs. These two models, contrary to the three other ones, have not been written by hand in LNT, but produced automatically using the DLC tool [14,16]. DLC (Distributed LNT Compiler) generates, from an LNT specification, a distributed implementation running on a set of machines communicating through TCP sockets and synchronizing using the aforementioned Multi-waySync protocol.…”