Fully automated runtime enforcement of component-based systems with formal and sound recovery

Abstract

We introduce runtime enforcement of specifications on component-based systems (CBS) modeled in the BIP (Behavior, Interaction and Priority) framework. Runtime enforcement is an increasingly popular and effective dynamic validation technique aiming to ensure the correct runtime behavior (w.r.t. a formal specification) of a system using a socalled enforcement monitor. BIP is a powerful and expressive component-based framework for the formal construction of heterogeneous systems. Because of BIP expressiveness however, it is difficult to enforce complex behavioral properties at design-time.We first introduce a theoretical runtime enforcement framework for component-based systems where we delineate a hierarchy of enforceable properties (i.e., properties that can be enforced) according to the number of observational steps a system is allowed to deviate from the property (i.e., the notion of k-step enforceability). To ensure the observational equivalence between the correct executions of the initial system and the monitored system, we show that i) only stutter-invariant properties should be enforced on CBS with our monitors, and ii) safety properties are 1-step enforceable. Second, given an abstract enforcement monitor for some 1-step enforceable property, we define a series of formal transformations to instrument (at relevant locations) a CBS described in the BIP framework to integrate the monitor. At runtime, the monitor observes and automatically avoids any error in the behavior of the system w.r.t. the property. Third, our approach is fully implemented in RE-BIP, an available tool integrated in the BIP tool suite. Fourth, to validate our approach, we use RE-BIP to i) enforce deadlock-freedom on a dining philosophers benchmark, and ii) ensure the correct placement of robots on a map.

Facilitating the Implementation of Distributed Systems with Heterogeneous Interactions

“…We also work on extending HDBIP to support fault tolerance. We also consider to leverage the asynchronous send/receive communication primitive to improve the efficiency of the runtime verification [10] and enforcement [9] of component-based systems.…”

Tracing Distributed Component-Based Systems, a Brief Overview

“…-(i) define specification formalisms tailored to our model of CBSs and study their monitorability [16]; -(ii) decentralize observers/monitors according to the system architecture by using decentralized runtime verification frameworks [6,15,13]; -(iii) adapt techniques for runtime enforcement [20] of sequential CBSs [18] to the distributed setting; -(iv) use heteregoneous communication primitives (synchronous and asynchronous) [25] for facilitating the implementation of optimized monitors; -(v) leverage aspect-oriented programming on CBSs [14] to define source-to-source transformations to inject runtime verification monitors.…”

Runtime Failure Prevention and Reaction

“…In [24,39], Charafeddine et al propose enforcement mechanism with k-step rollback abilities. Such enforcement mechanism allows the system to deviate from the desired property up to k observable execution steps.…”

“…Intuitively, the supervisor is composed with an automaton model of the system (synchronous product) and ensures the most permissive behaviour of the initial system while preventing bad behaviour (rejected by the automaton). Should the system try to execute References Models of enforcement mechanisms Specification formalisms used for synthesis [88] security automata Büchi automata [62] edit-automata deterministic finite-state automata [37] generalised enforcement monitors Streett automata [20] edit automata Rabin automata [76] delayers timed automata [40] delayers with suppression timed automata [65] security automata µ-calculus formulae [42] generalised enforcement monitors labelled transition systems [39] enforcement mechanisms with rollback finite-state automata [15] safety shields safety automata [92] shields for burst errors temporal logic (safety) [13] iteration suppression automata deterministic finite-state automata an action that could lead the system to exhibit a bad behaviour, the supervisor disables this action which then cannot execute on the system anymore.…”