Formalization and validation of the General Inter-ORB Protocol (GIOP) using PROMELA and SPIN

Kamel, Moataz; Leue, Stefan

doi:10.1007/s100090050045

Cited by 47 publications

(26 citation statements)

References 13 publications

(29 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We obtained a result "BOUNDED" which indicates that the two counterexamples were indeed the only sources of unboundedness in the system. While some of the buffer bound estimates were larger than the ones assumed in [9], there were also some channels with smaller estimates. For instance, the size of the channel h i à 3 Ú ' q in [9] is 3 while its estimate is 1.…”

Section: Resultsmentioning

confidence: 67%

See 1 more Smart Citation

A Scalable Incomplete Test for Message Buffer Overflow in Promela Models

Leue

Mayr

Wei

2004

Model Checking Software

Self Cite

View full text Add to dashboard Cite

Abstract. In Promela, communication buffers are defined with a fixed length, and buffer overflows can be handled in two different ways: block the send statement or lose the message. Both solutions change the semantics of the system, compared to one with unbounded channels. The question arises, if such buffer overflows can ever occur in a given system and what buffer lengths are sufficient to avoid them. We describe a scalable incomplete boundedness test for the communication buffers in Promela models, which is based on overapproximation and static analysis. We first reduce Promela models to systems of communicating finite state machines (CFSMs) and then apply further abstractions that leave us with a system of linear inequalities. Those represent the message sending and receiving effect that the control flow cycles of every process have on any message buffer. The test tries to establish the existence of a linear combination of the effect vectors so that at least one message can occur an unbounded number of times. If no such linear combination exists then the system is bounded. We discuss the complexity of this test and present experimental results using our implementation in the IBOC system. Scalability of the test is in part due to the fact that it is polynomial for the type of sparse control flow graphs derived from Promela models. Also, the analysis is local, i.e., it avoids the combinatorial state space explosion due to concurrency of the models. We also present a method to derive upper bound estimates for the maximal occupancy of each individual message buffer. Previously, we have applied this approach to UML RT models, while in this paper we focus on the additional problems specific to Promela code: determining the potential message types of any channel, tracking potential contents of variables, channels passed as arguments to processes, channel assignments, channel arrays and parallel process creation.

show abstract

Section: Resultsmentioning

confidence: 67%

“…As case studies we use the 2-Proctype model that is given in Figure 11 model of the CORBA General Inter-ORB Protocol (GIOP) [9] 4 . IBOC uses to LP-SOLVE tool for the linear programming tasks.…”

Section: Resultsmentioning

confidence: 99%

A Scalable Incomplete Test for Message Buffer Overflow in Promela Models

Leue

Mayr

Wei

2004

Model Checking Software

Self Cite

View full text Add to dashboard Cite

show abstract

“…NPC checks are often performed in formal verifications of protocols, where livelocks frequently occur. Using SPIN, livelocks were found, for instance, in the i-protocol from UUCP (see [3]) and GIOP from CORBA (see [10]), whereas DHCP was proved to be free of livelocks (see [9]). To be able to check for NPCs, desired activities of the system are marked in PROMELA by labeling the corresponding location in the process specification with a progress label: "statementi; progress: statementj;".…”

Section: Non-progress Cycle Checks By Spinmentioning

confidence: 99%

Improving Non-Progress Cycle Checks

Faragó

Schmitt

2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This paper introduces a new model checking algorithm that searches for non-progress cycles, used mainly to check for livelocks. The algorithm performs an incremental depth-first search, i.e., it searches through the graph incrementally deeper. It simultaneously constructs the state space and searches for non-progress cycles. The algorithm is more efficient than the method the model checker SPIN currently uses, and finds shortest (w.r.t. progress) counterexamples. Its only downside is the need for a subsequent reachability depth-first search (which is not the bottleneck) for constructing a full counterexample. The new algorithm is better combinable with partial order reduction than SPIN's method.

show abstract

“…For example, the specifications of CORBA ORB (Object Request Broker) properties are discussed in [2]. The descriptions of CORBA GIOP (General Inter-ORB Protocol) in PROMELA can be found in [8]. The motivation behind these works is to check the correctness of the protocols themselves.…”

Section: Related Workmentioning

confidence: 99%

Translation from Adapted UML to Promela for CORBA-Based Applications

Chen

2004

Model Checking Software

View full text Add to dashboard Cite

Abstract. Nowadays, many distributed applications take advantage of the transparent distributed object systems provided by CORBA middlewares. While greatly reduce the design and coding effort, the distributed object systems may also introduce subtle faults into the applications, which on the other hand, complicate the validation of the applications. In this paper, we present our work on applying SPIN to check the correctness of the designs of CORBA-based applications, taking into account those characteristics of CORBA that are essential to the correctness of the applications. In doing so, we provide adaptations to UML, so that the CORBA-based applications can be modeled with succinct yet sufficient details of the underlying middlewares. An automated translation tool is developed to generate Promela models from such UML design models. The translation tool embeds the behavioral details of the middleware automatically. In this way, the software developers can stay in their comfort zone while design faults, including those caused by the underlying distributed object systems can be pinpointed through the verification or the simulation with SPIN.

show abstract

Formalization and validation of the General Inter-ORB Protocol (GIOP) using PROMELA and SPIN

Cited by 47 publications

References 13 publications

A Scalable Incomplete Test for Message Buffer Overflow in Promela Models

A Scalable Incomplete Test for Message Buffer Overflow in Promela Models

Improving Non-Progress Cycle Checks

Translation from Adapted UML to Promela for CORBA-Based Applications

Contact Info

Product

Resources

About