2. Development of Formally Verified Erlang Programs a case study Thomas Arts Clara Benac Earle Computer Science Lab Stockholm, Sweden

3. Research question how can we identify the hard-to-find errors in the code? can formal methods help in finding errors not uncovered by testing?

4. AXD 301 Architecture CP Switch Core DPDP DPDP DPDP DPDP DPDP DPDP DPDP AXD 301 Call setup

5. AXD 301 Architecture CP Switch Core DPDP DPDP DPDP DPDP DPDP DPDP DPDP CP OM CP OM CP OM CC CP CC OM AXD 301 fault tolerance

6. CP CC CP CC CP Switch Core DPDP DPDP DPDP DPDP DPDP DPDP DPDP CP OM CP OM CP OM CP CC OM CP OM CP CC CP CC node OM node app Billing application Take over

7. CP CC node OM node Billing application app Take over take over

8. CP OM node app CP CC node OM node Billing application app Take over

9. Application lock During take over the respective application should not be used. distributed resource locker with shared and exclusive locks

10. CLIENTSRESOURCES A C B LOCKER CLIENT 1 CLIENT 2 CLIENT 3 ok {request,[A],shared} ok {request,[A],exclusive} ok {release} done {release} done {request,[A,B],shared} C1 C2 C3

11. example -module(client). start_link(Locker) -> {ok,spawn_link(loop,[Locker])}. loop(Locker) -> gen_server:call(Locker,request), critical(), gen_server:call(Locker,release), loop(Locker).

12. example start_link() -> gen_server:start_link(locker,[],[]). init([]) -> {ok,[]}. handle_call(request,Client,Pending)-> case Pending of [] -> {reply, ok, [Client]}; _ -> {noreply, Pending ++ [Client]} end; handle_call(release, Client, [_|Pending]) -> case Pending of [] -> {reply, done, []}; _ -> gen_server:reply(hd(Pending), ok), {reply, done, Pending} end.

13. Supervisor processes standard supervision structure can be used to obtain initialization information for transition diagram supervisor locker gen_server client start supervision tree with 5 clients supervisor:start(locker_sup,start,[5]).

14. Testing versus Verification Thus, for one input, 100% coverage with verification testing: many program runs on different input verification: all runs on different input verify:allruns(locker_sup,start,[8]).

15. Mutual exclusion (at most one client has access to resource) -module(client). start_link(Locker) -> {ok,spawn_link(loop,[Locker])}. loop(Locker) -> gen_server:call(Locker,request), critical(), gen_server:call(Locker,release), loop(Locker). io:format(“enter cs~n”), critical(), io:format(“exit cs~n”), erlang:trace for gen_server:call

16. testing io client 2client 1 enter cs exit cs enter cs exit cs enter cs exit cs

17. Verification: generate State Space clients states transitions 2 14 18 3 53 75 4 230 344 5 1177 1805 6 7100 10980 8 398074 617216

18. Erlang -> transitions start verification with 2 clients verify:allruns(locker_sup,start,[2]) our Tool locker.erl client.erl locker_sup.erl client_sup.erl our Tool our Tool our Tool our Tool EtoE rest tool locker.erl client.erl init.erl instantiation

19. Erlang -> transitions start verification with 2 clients etomcrl:instantiator(locker_sup,start,[2]) locker.erl client.erl locker_sup.erl client_sup.erl locker.erl client.erl init.erl instantiation tomcrl.erl instantiation EtoE rest tool EtoPmcrl

20. Erlang -> transitions locker.erl client.erl locker_sup.erl client_sup.erl instantiation tomcrl.erl instantiation EtoE rest tool EtoPmcrl rest tool CWI tool instantiator locker.mCRL toMCRL start verification with 2 clients etomcrl:instantiator(locker_sup,start,[2]) locker.erl client.erl init.erl

21. Erlang -> transitions locker.erl client.erl locker_sup.erl client_sup.erl instantiation tomcrl.erl instantiation EtoE rest tool EtoPmcrl CWI tool instantiator locker.mCRL toMCRL start verification with 2 clients etomcrl:instantiator(locker_sup,start,[2]) locker.erl client.erl init.erl Aldebaran locker.aut

22. State Space analysis simulation with backtrack possibilities find execution sequence deadlock check states in the graph without out-arrow property check such as mutual exclusion

23. State Space analysis Between two handle_call(request,_,_) there should be a handle_call(release,_,_). [-*,“ handle_call(request,_,_) ”, (not “ handle_call(release,_,_) ”)*, “ handle_call(request,_,_) ” ]false Properties are specified as regular expressions over Erlang function calls in combination with [] and <> operators. After a gen_server:call(locker, request) there is always a gen_server:call(locker,release) possible. [-*,“ gen_server:call(locker, request) ”] true

24. Conclusions We developed software to verify properties of Erlang programs We verified a resource locker program featuring multiple resources with shared and exclusive access (upto 6 clients in many different configurations) State space upto a million states (several techniques to reduces state space if property is given) Working on addition of Erlang constructs to cover more of the language (fault tolerance handling, gen_fsm)