Automating commutativity analysis at the design level

Abstract

Two operations commute if executing them serially in either order results in the same change of state. In a system in which commands may be issued simultaneously by different users, lack of commutativity can result in unpredictable behaviour, even if the commands are serialized, because one user's command may be preempted by another's, and thus executed in an unanticipated state.This paper describes an automated approach to analyzing commutativity. The operations are expressed as constraints in a declarative modelling language such as Alloy, and a constraint solver is used to find violating scenarios. A case study application to the beam scheduling component of a proton therapy machine (originally specified in OCL) revealed several violations of commutativity in which requests from medical technicians in treatment rooms could conflict with the actions of a beam operator in a master control room. Some of the issues involved in automating the analysis for OCL itself are also discussed.

From UML to Alloy and back again

“…To debug overconstrained models, the tool can identify which elements of the model specification are hindering the generation of instances [17]. Alloy has been used for analysing a wide number of protocols and systems [9,10,5]. Specifically, Jackson and Sullivan [9] have analysed COM architecture and Khurshid and Jackson [10] have analysed consistency of the International Naming Scheme (INS).…”

“…Specifically, Jackson and Sullivan [9] have analysed COM architecture and Khurshid and Jackson [10] have analysed consistency of the International Naming Scheme (INS). Dennis et al [5] have used Alloy to analyse a radiation therapy machine, exposing flaws in the original design of the system.…”

Kodkod: A Relational Model Finder

“…The underlying logic supports first order quantifiers, connectives, arbitrary-arity relations, and transitive closure. Alloy has been applied to a wide variety of problems, including the design of an intentional naming scheme [22], the safety properties of the beam scheduler for a proton therapy machine [23], code analysis [2,3], test-case generation [4], and network configuration [24].…”

UML2Alloy: A Challenging Model Transformation

“…More specifically Denis et al [9] use Alloy to expose hidden flaws in the UML design of a radiation therapy machine. Georg et al [8] have used Alloy to analyse the runtime configuration of a distributed system.…”

“…Alloy has received considerable attention in the academic and research community. For example, it has been successfully applied to modelling and analysis of protocols in distributed systems [7], networks [8] and mission critical systems [9] There are clear similarities between Alloy and UML languages such as class diagrams and OCL. From a semantic point of view both Alloy and UML can be interpreted by sets of tuples [5,10].…”