1. 8 May 2008IPA Lentedagen Dynamic Consistency in Process Algebra: From Paradigm to ACP Suzana Andova (FM TU/e) Luuk Groenewegen (LIACS Leiden Univ.) Erik de Vink (FM TU/e)

2. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 2 of 35 Outline Paradigm via two examples ACP and translation into ACP mCRL2 specification of the examples and results Conclusions

3. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 3 of 35 Introduction Paradigm: a coordination specification language

4. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 4 of 35 Paradigm Component collaboration ?

5. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 5 of 35 Paradigm Employee Manager subprocesses = “phases” global behaviour trap partition = “particular view on the component” = subprocesses + traps

6. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 6 of 35 Running example Client – Server (Critical section)  1 Server and n clients trying to get service Chosen way of modeling:  Server = manager  Clients = employees

7. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 7 of 35 Clients – detailed dynamics With:Without:Interrupt: AtDoor OutWaiting leave enter AtDoor OutWaiting leave Waiting Busy AtDoor explain thank subprocesses = “phases” enter thank explainleave Out Waiting Busy AtDoor

8. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 8 of 35 With: Clients – from detailed to global dynamics Without:Interrupt: AtDoor OutWaiting notYet Waiting Busy AtDoor explain thank AtDoor OutWaiting triv request done trap constraints and partition CS enter thank explainleave Out Waiting Busy AtDoor

9. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 9 of 35 With: Clients – global dynamics in Paradigm Without:Interrupt: AtDoor OutWaiting notYet Waiting Busy AtDoor enter thank explainleave Out Waiting Busy AtDoor OutWaiting triv request done Without With Interrupt notYet triv request done triv Without With Interrupt notYet triv request done notYet triv request done [request] Interrupt [triv] [notYet] Without [triv] [done] [triv] With done notYet request

10. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 10 of 35 With: Clients – consistency of detailed and global dynamics Without:Interrupt: AtDoor OutWaiting notYet Waiting Busy AtDoor OutWaiting triv request done triv notYet triv request done [request] Interrupt [triv] [notYet] Without [triv] [done] [triv] With done notYet request

11. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 11 of 35 Synchronizing composition – manager and employees Client 1 Client 2 Client 3 Client 1 (CS)Client 2 (CS)Client 3 (CS) P r o t o c o l Server Collaboration CS Employ 1 Employ n Role 1 Role n P r o t o c o l Manager m Manager 1... Role 2 1 Role 2 m P r o t o c o l Manager 2 k Manager 2 1... consistency rules

12. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 12 of 35 Server as a manager – nondeterministic Idle Checking 1 Helping 1 check 1 refuse permitcontinue Checking n Helping n check n refuse permitcontinue

13. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 13 of 35 Consistency rules = consistent dynamics (ND server) Idle Checking 1 Helping 1 check 1 refuse permitcontinue Checking n Helping n check n refuse permitcontinue Without With Interrupt notYet triv request done

14. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 14 of 35 Server as a manager – Round-robin

15. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 15 of 35 Consistency rules = consistent dynamics (RR server) Without With Interrupt notYet triv request done

16. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 16 of 35 From Paradigm... via ACP

17. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 17 of 35 PA notions essential for Paradigm  parallel composition  Paradigm components run in parallel  with communication (synchronization) function  for consistency rules  abstraction  for different levels of abstraction in Paradigm  equivalence relations  for reasoning about Paradigm models via PA to automated verification of Paradigm models using mCRL2  direct translation of ACP specification to mCRL2 language  properties checking using model checking  relating models using equivalence relations (e.g. branching bisimulation) Why Process Algebra?

18. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 18 of 35 Parametrized by Act and cf : Act x Act  Act Operators: +, , ||, |,  I,… Axioms: ax || by = a(x || by) + b(ax || y) + cf(a,b)(x || y) Recursive specifications: Out i = enter i Waiting i Waiting i = explain i Busy i Busy i = thank i AtDoor i AtDoor i = leave i Out i ACP in one slide

19. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 19 of 35 Translation notYet triv request done Interrupt Without With Client 1 Client 2 Client 3 Client 1 (CS)Client 2 (CS)Client 3 (CS) P r o t o c o l Server ?

20. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 20 of 35 Translation (cont.) notYet triv request done Interrupt Without With - Can I do “enter” and start waiting? - Yes, it is ok!(enter) / No - Are you waiting at “Waiting” so I can do “request”? - Yes, at!(Waiting) / No

21. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 21 of 35 Translation (cont.) Client i : NDServer: Client i (CS): notYet triv request done Interrupt Without With

22. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 22 of 35 Translation (cont.) Communication: Collaboration process: CSNDet =   ( Client 1 || Client 1 (CS) || …|| Client n || Client n (CS) || NDServer)

23. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 23 of 35 Translation (cont. RRServer) Client i : Client i (CS): RRServer:

24. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 24 of 35 Translation (cont.) Communication: Collaboration process: CSRR =   ( Client 1 || Client 1 (CS) || …|| Client n || Client n (CS) || RRServer)

25. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 25 of 35 From Paradigm... via ACP... to mCRL2

26. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 26 of 35 mCRL2 specification CSNDet

27. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 27 of 35 Client i (CS):

28. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 28 of 35 Collaboration process: CSNDet =   ( Client 1 || Client 1 (CS) || …|| Client 3 || Client 3 (CS) || NDServer)

29. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 29 of 35 CSNDet – properties checking % never two clients in critical section (valid) [ true*. ok(A,explain). (!ok(A,thank))*. ok(B,explain) ] false % the same from server point of view (valid) [ true*. sync(permit,A,request). (!sync(continue,A,done))*. sync(permit,B,request) ] false % two clients may approach the critical section (valid) true % fair reachability of critical section (valid) [ true*. ok(A,enter). (!ok(A,thank))* ] true % general reachability of critical section (not valid) [ true*. ok(A,enter) ] mu X. [ !ok(A,thank) ] X

30. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 30 of 35 CSNDet – equivalent behaviour % file ndserver-spec.mcrl2 % non-deterministic server for 3 clients sort CName = struct A | B | C ; act incs, outcs : CName ; proc Idle = sum i:CName. tau. CritSection(i) ; CritSection(i:CName) = incs(i). outcs(i). Idle ; init Idle ;

31. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 31 of 35 CSRR – properties checking % never two clients in critical section (valid) [ true*. ok(A,explain). (!ok(A,thank))*. ok(B,explain) ] false % the same from server point of view (valid) [ true*. sync(permit,A,request). (!sync(continue,A,done))*. sync(permit,B,request) ] false % two clients may approach the critical section (valid) true % fair reachability of critical section (valid) [ true*. ok(A,enter). (!ok(A,thank))* ] true % general reachability of critical section (valid) [ true*. ok(A,enter) ] mu X. [ !ok(A,thank) ] X

32. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 32 of 35 CSRR – equivalent behaviour

33. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 33 of 35 CSRR for n=2

34. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 34 of 35 After abstraction from internal activity B requested entrance to CS

35. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 35 of 35 CSRR for n=3 #st=270 #tr = 684

36. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 36 of 35 After abstraction from internal activity #st = 28 #tr = 60

37. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 37 of 35 CSRR for n=4 #st = 1080 #tr = 3456 for n=5 #states = 4050, #transitions=15660 for n=6 #states = 14580, #transitions=66096

38. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 38 of 35 After abstraction from internal activity #st = 77 #tr = 200 for n clients #states = (5x2 n-2 -1)xn + 1

39. Suzana Andova, Luuk Groenewegen, Erik de Vink Sheet 39 of 35 Conclusions: Paradigm models translated to ACP via ACP they can be analyzed formally mCRL2 used for our experiments (small components may still produce a big state space to be analyzed) Paradigm migration approach to self-adaptation Verification of self-adaptation straightforward