Modeling and Verification of Asynchronous Systems Using Timed Integrated Model of Distributed Systems

Abstract

In modern computer systems, distributed systems play an increasingly important role, and modeling and verification are crucial in their development. The specificity of many systems requires taking this into account in real time, as time dependencies significantly affect the system’s behavior, when achieving the goals of its processes or with adverse phenomena such as deadlocks. The natural features of distributed systems include the asynchrony of actions and communication, the autonomy of nodes, and the locality of behavior, i.e., independence from any global or non-local features. Most modeling formalisms are derived from parallel centralized systems, in which the behavior of components depends on the global state or the simultaneous achievement of certain states by components. This approach is unrealistic for distributed systems. This article presents the formalism of a timed integrated model of distributed systems that supports all of the mentioned features. The formalism is based on the relation between the states of the distributed nodes and the messages of distributed computations, called agents. This relation creates system actions. A specification in this formalism can be translated into timed automata, the most popular formalism for specifying and verifying timed parallel systems. The translation rules ensure that the semantics of T-IMDS and timed automata are consistent, allowing use of the Uppaal validator for system verification. The development of general formulas for checking the deadlock freedom and termination efficiency allows for automated verification, without learning temporal logics and time-dependent formulas. An important and rare feature is the finding of partial deadlocks, because in a distributed system a common situation occurs in which some nodes/processes are deadlocked, while others work. Examples of checking timed distributed systems are included.

Formal Verification of the European Train Control System (ETCS) for Better Energy Efficiency Using a Timed and Asynchronous Model

“…As the clock resets can occur anytime, the difference between clock values can be a real number. The equivalence of semantics between T-IMDS and its translation to timed automata, shown schematically in Figure 5, is proved in [46]. Model asynchrony is achieved by inserting additional TA separating the servers.…”

“…The verifier confirms the desired behavior by showing the witness or the violation by means of a counterexample. Additionally, the simulation of a witness/counterexample on graphical component behavior is possible [46].…”

“…However, in our opinion, modeling distributed systems using automata that follow synchronous transitions is unrealistic. Therefore, we developed a real-time version of IMDS (T-IMDS [46]). First, we recalled that IMDS is really asynchronous, which we illustrate in Figure 4 with automata that send messages to their input structures represented by putting messages into individual input message sets of the automata.…”

“…The action m' is ready to invoke an action in the target server after the same time plus the channel delay drawn in the same manner. Timed IMDS is precisely defined in [46], together with its translation to timed automata. The translation converts every server to a timed automaton with its own clock and appropriate time invariants.…”

“…Every inter-server channel is modeled as an additional timed automaton that gets a message from the sending automaton, holds it for a drawn delay time, and then deposits the message with the target automaton. The precise translation rules are given in [46]. In this study, we only use the action durations; the message delivery is instant and does not require additional automata.…”