Towards a Formal Approach to Modeling and Verifying the Design of Dynamic Software Updates

Abstract

Even though software systems in some domains are expected to provide continuous services, most of them must undergo some form of changes. It leads to the emergence of dynamic software updating, a technique for updating a running software system without incurring any downtime. One of the challenges of designing a correct dynamic update is to identify a set of update points where the update can be safely applied to a running system. In this paper, we present a formal approach to modeling dynamic software updates and use the formal model to identify safe update points. In our approach, we formalize dynamic updates as state machines, and verify by model checking a set of desired properties which the running system is expected to satisfy after being updated. If counterexamples are found, we exclude those states that cause the counterexamples, and do model checking again. The process is iterated until all desired properties are successfully verified. We then finally obtain a set of safe update points. A case study is also presented to demonstrate the feasibility of the proposed approach.

Dynamic software updating: a systematic mapping study

“…In addition, number of studies have mentioned additional tools including Jrebel [42, 46, 48, 53, 91 ], LUCOS [22, 51, 76, 79, 94 ], Javelus [35, 40, 42, 44 ], JavAdaptor [16, 38, 46, 52 ], DVM [4, 42, 44, 52 ], HotSwap [16, 42, 50, 57 ], DynaMOS [51, 76, 78, 105 ], Dlpop [37, 39, 106 ], Mx [83, 88, 90 ], EcoDSU [106, 108 ], PROTEOS [51, 95 ], Ekiden [6, 105 ], lusagent [59, 84 ], DYMOS [22, 47 ], EmbedDSU [106, 112 ], UpgradeJ [4, 47 ], Prose [41, 57 ], REPLUS [76, 113 ], FASA [65, 106 ], and Adapt.net [59, 68 ].…”

“…Existing types of update pointsA group of studies have presented 11 different types of update points including checkpoints [44, 49, 51, 74, 87, 114, 115 ], synchronisation points [3, 36, 47, 116 ], version‐consistent points [35, 115 ], breakpoints [76 ], single join‐points [96 ], injection points [43 ], scheduling points [5 ], rescue points [76 ], mapping points [76 ], writing object points [73 ], and version‐consistent points [115 ]. B. Current techniques to nominate DSU update pointsA number of studies have demonstrated 15 techniques to recommend update points including automatic definition [35, 73 ], insert checkpoints [51, 74 ], enumerate potential points [104, 107 ], expressing update points in the code [117 ], pre‐compiled at fixed points [104 ], bring the software to an update point [83 ], define update points implicitly [111 ], define update points dynamically [44 ], using collector and point filters [73 ], locating injection points [43 ], automatic recommendation [35 ], using continuation points [6 ], session typing [118 ], restrictions on runtime [118 ], and observing the heap state [39 ]. (ii) Runtime techniquesIn this examination, we have identified an existing code segment, data segment, stack segment, heap segment, and multithread dynamic updating techniques as follows: A. Code segmentA number of investigations have presented five types of code segment techniques including indirection [4, 46, 47, 53, 55, 74, 77, 94, <...>…”

“…Heap segmentA number of explorations have demonstrated five different types of heap segment techniques including heap garbage collection [4, 42, 49, 63 ], virtual heap [114 ], map the heap from locations to values [115 ], modify heap bindings [115 ], and heap state transformations [87 ]. E. MultithreadIn this exploration, we have recognised ten techniques utilised for multithread including achieving quiescence [3, 58, 72 ], immediate update of multi‐thread [44, 51 ], scheduling [37, 67 ], constraint‐based [115 ], pre‐emptive multi‐threading [93 ], utilising thread‐shared locations [115 ], two‐phase thread‐based locking [83 ], utilising critical sections [104 ], blocking on condition variables [3 ], and controlling between threads [99 ]. (iii) Safety techniquesIn this study, we have identified existing types of safety, techniques to define safety, and techniques to apply safety in DSU as follows: A. Existing types of safety for DSUIn this study, we have identified 29 types of safety in DSU.…”

“…In this exploration, we have recognised ten techniques utilised for multithread including achieving quiescence [3, 58, 72 ], immediate update of multi‐thread [44, 51 ], scheduling [37, 67 ], constraint‐based [115 ], pre‐emptive multi‐threading [93 ], utilising thread‐shared locations [115 ], two‐phase thread‐based locking [83 ], utilising critical sections [104 ], blocking on condition variables [3 ], and controlling between threads [99 ].…”

“…In this study, we have identified existing types of states, techniques to define states, and techniques for states transformations in DSU as follows: A. Existing types of statesA group of studies have highlighted a group of 15 states that gets attention in DSU including initial state [9, 29, 36, 58, 64, 83, 95, 102, 104, 122, 128 ], quiescent state [5, 9, 40, 65, 83, 91, 112, 126 ], heap state [36, 39, 42, 87, 95, 116 ], object state [4, 5, 45, 116 ], shared state [3, 5 ], backward compatibility state [128 ], tranquil state [63 ], old‐version state [39 ], buggy state [83 ], class state [45 ], components state [65 ], deadlock state [102 ], thread states [104 ], inconsistent state [56 ], and multi‐cycle state [65 ]. B. Current techniques to define statesA number of studies have demonstrated 12 techniques to define states in DSU including state transformer [45, 73, 83, 95, 115 ], formalise as state machine [9, 61, 83, 120 ], adaptation [41, 65 ], prepare ready tainted states [101 ], state convergence algorithm [126 ], state‐based specification language […”