Verifying Properties of Process Definitions Jamieson M. Cobleigh, Lori A. Clarke, and Leon J. Osterweil Laboratory for Advanced Software Engineering Research University of Massachusetts Amherst Thanks to Aaron Cass, Sandy Wise, and Hyungwon Lee

Outline Process Example Process Analysis of the Process Conclusions

What is a Process? Complex Task Resources Artifacts Agents Examples: Design Configuration Management e-commerce

Example: An Auction Need to coordinate bidders and auctioneer These may be distributed over a network May be human users or computer programs Want an process definition that describes how to conduct an auction

A process definition language Graphical language Has rigorous formal semantics specified Supports Concurrency Resource Management Exceptions Choice steps to give humans users flexibility Pre- and post-requisites

Little-JIL Step Step Name Interface Resources Used Exceptions Thrown Parameters Pre-requisite Post-requisite Exception Handling Control Flow Substep Sequencing

Accept One Bid Submit Bid BidIsHigher Accept Bids From Bidder Update Best Bid BidIsBetter Sequencing Badges : Sequential Parallel Choice Try Open-Cry Auction AuctionNotClosed Accept One Bid Accept Bids From Bidder Close Auction

NoMoreBidders AuctionClosed Accept One Bid Submit Bid BidIsHigher Accept Bids From Bidder Update Best Bid BidIsBetter Sequencing Badges : Sequential Parallel Choice Try Open-Cry Auction AuctionNotClosed Accept One Bid Accept Bids From Bidder Exception Badges: Rethrow Continue Complete Restart NoMoreBidders AuctionClosed BidNotHigher BidNotBetter DeadlineExpired Close Auction

Modeling Processes This process is intuitively easy to understand However, it still has complicated control structures These constructs can mask erroneous behavior Even high-level process definitions need to be validated

Auction Concerns Are late bids considered? Does the highest bidder win the auction? Is the auction vulnerable to fraud?

FLow Analysis for VERification of Systems Can verify concurrent and sequential software Uses an efficient state propagation algorithm Worst case bounds: O(N 2 ·S) Relatively language independent: Ada, Java, C++, Jovial Can incrementally add information to the analysis to improve precision

FLAVERS Overview Property Specification Software Software Translator TFG State Propagation Property Translator Property FSA Constraint FSA... Results s Little-JIL Human Translator

FLAVERS Model A Trace Flow Graph (TFG) Derived from labeled Control Flow Graphs (CFG) Labels represent events of interest Need CFG models for Little-JIL constructs

Leaf Step Model

A Choice Step Do B Choice Do ADo C Do ADo CDo B A Completed Do BDo C Choice A Terminated Choice Completed … … … …

Choice Step Model

Properties Checked No Late Bids Accepted Checked on the Open-Cry Auction Inconclusive Results Several process experts studied the example in detail without noticing the fault Need to add an “AuctionNotClosed” prerequisite to “Update Best Bid”

Race Condition Property Another property involved data flow There is a variable best that keeps track of the best bid seen so far Can be used by multiple steps concurrently Want to ensure there is no race condition

Race Condition Can Exist Determined a race condition can exist Auctioneer could be considering two bids at the same time Two updates to best occur The final value of best depends on the order of the updates

No Race Condition Need to ensure proper access to variable best Requires knowledge of agent behavior Proved that if no access control, a race condition can occur Proved that with a lock on best, no race condition can occur

Analysis Results The Little-JIL program had 8 steps

Conclusions Process models have strengths and weaknesses Leads to intuitive understanding Can mislead people into believing they understand the process Our example illustrates how important it it to validate processes FLAVERS successfully analyzed the Little-JIL process There is a tension between expressiveness and analyzability Humans require flexibility, leading to more complex analysis