Model-based runtime analysis of distributed reactive systems

Abstract

As interactions and dependencies within distributed reactive systems increase, the problem of detecting failures which depend on the exact situation and environmental conditions they occur in grows. As a result, not only the detection of failures is increasingly difficult, but also the differentiation between the symptoms of a fault, and the actual fault itself, i. e., the cause of a failure. This thesis proposes an efficient approach for the analysis of distributed reactive systems at runtime. It introduces a framework, referred to as monitoring-based runtime reflection framework, for the detection of failures as well as identification of their causes. As an interface to the framework, this thesis proposes a specification language, Salt, to express desired system properties, which then have to hold at all times while a system executes. Detection of failures in the framework is based upon monitoring systems with respect to their associated properties, defined in the high-level specification language Salt. Salt specifications are translatable into the real-time temporal logic TLTL as well as in the untimed temporal logic LTL, and as such can also be used with other temporal logic verification frameworks, such as model checkers. For both logics, an efficient monitor generation procedure is developed for either monitoring qualitative assertions about a system's behaviour in the untimed case, or quantitative assertions reflecting dense real-time constraints. In order to reflect the semantics of LTL, respectively TLTL, with respect to a finite observational trace in a suitable and unambiguous manner, a 3-valued interpretation is proposed. The corresponding 3-valued monitoring procedure is shown to be optimal with respect to the space-complexity of the generated monitors, and able to detect all minimal bad prefixes of non-conforming system behaviour. Based on the results of the monitors, a dedicated failure diagnosis is performed to identify possible explanations for an observed deviation. As such, diagnosis can either confirm that a monitor detected the root cause for a failure, or indicate that the fault is located elsewhere, and possibly outside the scope of the monitored system. In the runtime reflection framework, diagnosis is based upon the principles of first-order model-based diagnosis, but developed in the propositional domain. The propositional diagnosis problem is then shown to correspond to a deterministic implementation of a solution to the #SAT problem for which a computationally efficient realisation is introduced. This thesis develops both the theoretical foundations for runtime reflection as well as efficient means for its implementation. v vi vii viii Chronology Much of §3 is based upon material developed by Bauer et al. [2006c], and subsequently published at the Eigth International Conference on Formal Engineering Methods (ICFEM, see Bauer et al. [2006d]). The approach to runtime verification described in §4 is based upon results developed first by Arafat et al. [2005], and subsequently published at ...

Implementation relations and test generation for systems with distributed interfaces

“…Recent work has shown that the presence of a status message can sometimes be used to overcome controllability problems, in testing from a DFSM, if suitable test sequences are chosen [20]. It might be possible to implement something similar to a status message using monitors, which have been developed for monitoring and debugging distributed systems [3,18,41,58].…”

“…Let us note that if t is the null process ⊥, which cannot send any input, then t p =⊥ p 3. We are only interested in the traces defined by a local tester since each tester only observes a local trace.…”

Oracles for Distributed Testing

“…In addition, there are approaches in which the testers communicate in order to determine the global trace that occurred (see, for example, [25], [26]). There has also been a significant amount of work on monitoring, in which we wish to determine the global state of the SUT (see, for example, [27], [28], [29], [30], [31]). In contrast to these, we are concerned with black-box testing and we are interested in conformance relations that capture the observational power of potential users.…”

How Do we Certify for the Unexpected?

“…There is extensive prior work on runtime monitoring for assurance and for error detection and recovery (e.g., 22,23 ). The main novelty in the approach proposed here is use of a safety case as the source of monitored properties.…”