Modelling and Verifying Contract-Oriented Systems in Maude

Abstract

We address the problem of modelling and verifying contractoriented systems, wherein distributed agents may advertise and stipulate contracts, but -differently from most other approaches to distributed agents -are not assumed to always behave "honestly". We describe an executable specification in Maude of the semantics of CO2, a calculus for contract-oriented systems [6]. The honesty property [5] characterises those agents which always respect their contracts, in all possible execution contexts. Since there is an infinite number of such contexts, honesty cannot be directly verified by model-checking the state space of an agent (indeed, honesty is an undecidable property in general [5]). The main contribution of this paper is a sound verification technique for honesty. To do that, we safely over-approximate the honesty property by abstracting from the actual contexts a process may be engaged with. Then, we develop a model-checking technique for this abstraction, we describe an implementation in Maude, and we discuss some experiments with it.

Choreographies in the wild

“…Two different approaches have been proposed in [18,24], where CO 2 is instantiated with binary session types. In [18], a type system for CO 2 processes is presented, associating behavioural types to all session variables used in a processe; honesty is then verified by model checking these behavioural types.…”

“…In [18], a type system for CO 2 processes is presented, associating behavioural types to all session variables used in a processe; honesty is then verified by model checking these behavioural types. The technique introduced in [24] is rather different, and more closely based on the semantic definition of honesty: it first devises an abstraction of the contexts wherein A[P ] may run, and then safely approximates the honesty of A by model checking such an abstraction. Basically, the abstraction only maintains the process of A and its contracts; the rest of the system is discarded, by over-approximating its moves; then, model checking is used to search the abstracted state space of A[P ] for states where A is not ready.…”

“…In particular, we now sketch one way to adapt the model checking technique of [24] to the present work.…”

“…This abstraction must preserve all the moves of A, while over-approximating the moves of other possible participants. This is done similarly to [24]. Such an abstraction also has a finite-state semantics.…”

“…Again, this abstraction can be obtained by slightly adapting the one in [24], using the abstract contracts from the previous item. Given any A[P ] with no delimitation/parallel under process definitions, such an abstraction has a finite-state semantics.…”