Failure Semantics Research Articles

Finite complete suites for CSP refinement testing

In this paper, new contributions for model-based testing using Communicating Sequential Processes (CSP) are presented. For a finite non-terminating CSP process representing the reference model, finite test suites for checking the conformance relations traces and failures refinement are presented, and their completeness (that is, capability to uncover conformity violations) is proven. The fault domains for which complete failure detection can be guaranteed are specified by means of normalised transition graphs representing the failures semantics of finite-state CSP processes. While complete test suites for CSP processes have been previously investigated by several authors, a sufficient condition for their finiteness is presented here for the first time. Moreover, it is shown that the test suites are optimal in two aspects: (a) the maximal length of test traces cannot be further reduced, and (b) the nondeterministic behaviour cannot be tested with smaller or fewer sets of events, without losing the test suite's completeness property. • Model-based testing (MBT) can be performed against CSP reference processes. • For the first time, we provide finite, complete test suites for MBT based on CSP. • The suites serve to check traces refinement and failures refinement. • Completeness means that every conformance violation will be uncovered. • For the first time, we provide complexity results indicating the number of test executions required to achieve conformance.

Fault-based refinement-testing for CSP

The process algebra CSP has been studied as a notation for model-based testing. Theoretical and practical work has been developed using its trace and failure semantics, and their refinement notions as conformance relations. Two sets of tests have been defined and proved to be exhaustive, in the sense that they can identify any SUT that is non-conforming with respect to the relevant refinement relation. However, these sets are usually infinite, and in this case, it is obviously not possible to apply them to verify the conformity of an SUT. Some classical selection criteria based on models have been studied. In this paper, we propose a procedure for online test generation for selection of finite test sets for traces refinement from CSP models. It is based on the notion of fault domains, focusing on the set of faulty implementations of interest. We investigate scenarios where the verdict of a test campaign can be reached after a finite number of test executions. We illustrate the usage of the procedure with some case studies.

Trace and Stable Failures Semantics for CSP-Agda

CSP-Agda is a library, which formalises the process algebra CSP in the interactive theorem prover Agda using coinductive data types. In CSP-Agda, CSP processes are in monadic form, which sup- ports a modular development of processes. In this paper, we implement two main models of CSP, trace and stable failures semantics, in CSP-Agda, and define the corresponding refinement and equal- ity relations. Because of the monadic setting, some adjustments need to be made. As an example, we prove commutativity of the external choice operator w.r.t. the trace semantics in CSP-Agda, and that refinement w.r.t. stable failures semantics is a partial order. All proofs and definitions have been type checked in Agda. Further proofs of algebraic laws will be available in the CSP-Agda repository.

Testing Preorders for dMTS

Testing preorders on component specifications ensure that replacing a specification by a refined one does not introduce unwanted behavior in an overall system. Considering deadlocks as unwanted, the preorder can be characterized by a failure semantics on Labeled Transition Systems (LTSs). In previous work, we have generalized this to Modal Transition Systems (MTSs) with a new, MTS-specific testing idea. In the present article, we generalize this idea further to DMTS, a subclass of disjunctive MTSs. On the one hand, the testing preorder can be characterized by the same failure semantics, and dMTS have no additional expressivity in our setting. On the other hand, the technical treatment is significantly harder and, surprisingly, the preorder is not compositional. Furthermore, we regard deadlocks and divergence (infinite unobservable runs) as unwanted and characterize the testing preorder with an unusual failure-divergence semantics. This preorder is already on LTSs strictly coarser—and hence arguably better—than the traditional failure-divergence preorder. It is a precongruence on dMTS, also for hiding, and much easier to handle than the deadlock-based preorder. It arises as well from a new variant of De Nicola’s and Hennessy’s must-testing.

Failure Semantics for Modal Transition Systems

With the aim to preserve deadlock freedom, we define a new refinement preorder for modal transition systems (MTSs), using an MTS-specific variant of testing inspired by De Nicola and Hennessy. We characterize this refinement with a kind of failure semantics and show that it “supports itself,” for example, in the sense of thoroughness—in contrast to standard modal refinements. We present a conjunction operator with respect to our new refinement, which is quite different from existing ones. It always returns an MTS—again in contrast to the case of modal refinement. Finally, we also consider De Nicola’s and Hennessy’s may- and must-testing, where the latter leads to a semantics that is also compositional for hiding.

A simulation process for asynchronous event processing systems: Evaluating performance and availability in transaction models

Simulation is essential for understanding the performance and availability behavior of complex systems, but there are significant difficulties when trying to simulate systems with multiple components, which interact with asynchronous communication. A systematic process is needed, in order to cope with the complexity of asynchronous event processing and the failure semantics of the interacting components. We address this problem by introducing an approach that combines formal techniques for faithful representation of the complex system effects and a statistical analysis for simultaneously studying multiple simulation outcomes, in order to interpret them. Our process has been successfully applied to a synthetic workload for distributed transaction processing. We outline the steps followed towards generating a credible simulation model and subsequently we report and interpret the results of the applied statistical analysis. This serves as a proof of concept that the proposed simulation process can be also effective in other asynchronous system contexts, like for example distributed group communication systems, file systems and so on.

External and internal choice with event groups in Event-B

Abstract Abrial’s Event-B formalism for refinement-based system development is influenced by Back’s action system approach. Morgan has defined a CSP-like failures-divergence semantics for action systems that distinguishes internal and external choice of actions. Morgan’s semantics has the characteristic that the choice between enabled actions is external while internal choice is represented less directly through nondeterministic effect of actions. Practical experience with Event-B has demonstrated the need to be able to represent both internal and external choice between enabled events more explicitly. In this paper, Morgan’s failures semantics for action systems is modified to allow both internal and external choice to be represented directly. This is achieved by grouping events so that external choice is between event groups and internal choice is within event groups. This leads to a refinement rule for preservation of choice between event groups while allowing for reduction of choice within event groups. We also provide a refinement rule for splitting event groups in order to increase external choice. The refinement rules are justified in terms of failures refinement.

On Architecting Software Fault Tolerance using Abstractions

In this position paper, we argue how architectural abstractions can be effective in developing fault-tolerant software systems. Depending on the fault model and the resources available, different abstractions can be employed for representing architectural issues related to fault tolerance. These architectural abstractions, and their internal views, can be instantiated into concrete components and connectors for designing fault-tolerant software architectures. Since structural and behavioural properties associated with these abstractions are formally specified, the process of verifying and validating software architectures can be automated. In this paper, we focus on two architectural abstractions: the idealised fault-tolerant architectural element (iFTE), which is based on exception handling, and the halt-on-failure architectural element (HoFE), which assumes crash failure semantics.

On finite alphabets and infinite bases

Van Glabbeek presented the linear time–branching time spectrum of behavioral semantics. He studied these semantics in the setting of the basic process algebra BCCSP, and gave finite, sound and ground-complete, axiomatizations for most of these semantics. Groote proved for some of van Glabbeek’s axiomatizations that they are ω - complete, meaning that an equation can be derived if (and only if) all of its closed instantiations can be derived. In this paper, we settle the remaining open questions for all the semantics in the linear time–branching time spectrum, either positively by giving a finite sound and ground-complete axiomatization that is ω -complete, or negatively by proving that such a finite basis for the equational theory does not exist. We prove that in case of a finite alphabet with at least two actions, failure semantics affords a finite basis, while for ready simulation, completed simulation, simulation, possible worlds, ready trace, failure trace and ready semantics, such a finite basis does not exist. Completed simulation semantics also lacks a finite basis in case of an infinite alphabet of actions.

A singleton failures semantics for Communicating Sequential Processes

Abstract This paper defines a new denotational semantics for the language of Communicating Sequential Processes (CSP). The semantics lies between the existing traces and failures models of CSP, providing a treatment of non-determinism in terms of singleton failures . Although the semantics does not represent a congruence upon the full language, it is adequate for sequential tests of non-deterministic processes. This semantics corresponds exactly to a commonly used notion of data refinement in Z and Object-Z: an abstract data type is refined when the corresponding process is refined in terms of singleton failures. The semantics is used to explore the relationship between data refinement and process refinement, and to derive a rule for data refinement that is both sound and complete.

Towards a structure-aware failure semantics for streaming media communication models

Failure semantics in communication models for distributed systems deal with the impossibility of achieving an exactly once invocation semantics in failure-prone environments. For remote procedure invocation models, failure semantics such as at-least-once and at-most-once specify guarantees about the number of executions of an invocation as well as its completeness even under the assumption that communication and server failures may occur. While such failure semantics are quite successful for remote procedure call models they have significant weaknesses when applied to streaming media communication. The main reasons are fundamental differences in the basic communication model as well as case-dependency and granularity of failure treatment in media streams, resulting in awkward abstractions as well as inefficient implementations. This paper is a step towards an adaptive failure semantics for streaming media communication. We argue that in order to achieve simplicity and economy, failure semantics must dynamically exploit application-level knowledge as well as knowledge from lower system layers, the three corner stones being media stream structure, timing constraints and resource availability. The paper focuses on structure-awareness as one of these three corner stones. It discusses the role of importance of a media stream fragment, develops a function to quantify importance, and discusses its computability. Experimental results evaluating importance based failure handling conclude the work.

Localic sup-lattices and tropological systems

The approach to process semantics using quantales and modules is topologized by considering tropological systems whose sets of states are replaced by locales and which satisfy a suitable stability axiom. A corresponding notion of localic sup-lattice (algebra for the lower powerlocale monad) is described, and it is shown that there are contravariant functors from sup-lattices to localic sup-lattices and, for each quantale Q, from left Q-modules to localic right Q-modules. A proof technique for third completeness due to Abramsky and Vickers is reset constructively, and an example of application to failures semantics is given.

Improving cluster availability using workstation validation

We demonstrate a framework for improving the availability of cluster based Internet services. Our approach models Internet services as a collection of interconnected components, each possessing well defined interfaces and failure semantics. Such a decomposition allows designers to engineer high availability based on an understanding of the interconnections and isolated fault behavior of each component, as opposed to ad-hoc methods. In this work, we focus on using the entire commodity workstation as a component because it possesses natural, fault-isolated interfaces. We define a failure event as a reboot because not only is a workstation unavailable during a reboot, but also because reboots are symptomatic of a larger class of failures, such as configuration and operator errors. Our observations of 3 distinct clusters show that the time between reboots is best modeled by a Weibull distribution with shape parameters of less than 1, implying that a workstation becomes more reliable the longer it has been operating. Leveraging this observed property, we design an allocation strategy which withholds recently rebooted workstations from active service, validating their stability before allowing them to return to service. We show via simulation that this policy leads to a 70-30 rule-of-thumb: For a constant utilization, approximately 70% of the workstation failures can be masked from end clients with 30% extra capacity added to the cluster, provided reboots are not strongly correlated. We also found our technique is most sensitive to the burstiness of reboots as opposed to absolute lengths of workstation uptimes.

A fully abstract model for the exchange of information in multi-agent systems

In this paper,11This paper is an extended version of [7]. we present a semantic theory for the exchange of information in multi-agent systems. We consider the multi-agent programming language agent communication programming language, which integrates the paradigms of concurrent constraint programming and communicating sequential processes (CSP). The constraint programming techniques are used to represent and process information, whereas the synchronous communication mechanism from CSP is generalised to enable the exchange of information. The semantics of the language, which is based on a generalisation of traditional failure semantics, is shown to be fully abstract with respect to observing of each terminating computation its final global store of information.

A compliant persistent architecture

The changing needs of modern application systems demand new and radical software architectures to support them. The attraction of persistent systems is that they define precisely the extent to which they are open, thereby allowing the dynamically changing resource requirements of applications to be tracked accurately within the persistent environment. Thus, an ever-growing body of work is being established to study the nature of running applications, and to use the information gleaned, to improve the run-time execution of these applications. Here we propose a new architectural approach to constructing persistent systems that accommodates, and thus is compliant to, the needs of particular applications. By separating policy from mechanism in all components, the architecture may be tailored to the policy needs of the application. (Policy may be regarded as strategy for achieving a goal, such as a cache eviction algorithm, whereas mechanism is the method by which the objective is achieved, such as the physical movement of the cache lines. As we see later, policy and mechanism are composable to form new mechanism.) We first propose a generic architecture for compliance, and then show how it may be instantiated. Finally, we describe an example of how the architecture operates in a manner that is compliant to a target application. We postulate, since we have not yet measured, that the benefits of compliant architectures will be a reduction in complexity, with corresponding gains in flexibility, portability, understandability in terms of failure semantics, and performance. Copyright © 2000 John Wiley & Sons, Ltd.

Conjunctive partial deduction: foundations, control, algorithms, and experiments

Partial deduction in the Lloyd–Shepherdson framework cannot achieve certain optimisations which are possible by unfold/fold transformations. We introduce conjunctive partial deduction, an extension of partial deduction accommodating such optimisations, e.g., tupling and deforestation. We first present a framework for conjunctive partial deduction, extending the Lloyd–Shepherdson framework by considering conjunctions of atoms (instead of individual atoms) for specialisation and renaming. Correctness results are given for the framework with respect to computed answer semantics, least Herbrand model semantics, and finite failure semantics. Maintaining the well-known distinction between local and global control, we describe a basic algorithm for conjunctive partial deduction, and refine it into a concrete algorithm for which we prove termination. The problem of finding suitable renamings which remove redundant arguments turns out to be important, so we give an independent technique for this. A fully automatic implementation has been undertaken, which always terminates. Differences between the abstract semantics and Prolog's left-to-right execution motivate deviations from the abstract technique in the actual implementation, which we discuss. The implementation has been tested on an extensive set of benchmarks which demonstrate that conjunctive partial deduction indeed pays off, surpassing conventional partial deduction on a range of small to medium-size programs, while remaining manageable in an automatic and terminating system.

On the Design of the Seljuk-Amoeba Operating Environment

Building dependable distributed applications is not an easy task. Designers of such systems have followed two complementary approaches to reduce design complexity, namely: i) the use of appropriate developing tools; and ii) the choice of the most restrictive failure semantics possible for the components that form the system’s underlying execution layer. The Seljuk model uses these two approaches to specify a structured way of providing fault tolerance services in the context of distributed operating environments, thus facilitating the construction and execution of dependable distributed applications. In this paper we present the design of the Seljuk-Amoeba operating environment, which follows the Seljuk model to enhance the Amoeba distributed operating system with the provision of fault tolerance services

Supervisory control using failure semantics and partial specifications

A framework is presented for the supervisory control of nondeterministic discrete-event systems based on failure semantics. It guarantees deadlock-free behavior under all circumstances, it allows for powerful specifications, it forms a sound basis for modular control, and it can handle nondeterminism without extra effort. A synthesis method to generate the least restrictive supervisor is presented. The control problem with partial specification is formulated, and it is shown that this control problem can be rewritten to a control problem with full specification. Special care has to be taken for traces with an unbounded internal extension (divergence). A condition, denoted bounded recurrence, is introduced to handle these traces. It is shown that the external behavior of the controlled system is not restricted by this condition.

Failures, Finiteness and Full Abstraction

For a simple CCS-like language a trace semantics and a failure semantics are presented. The failure semantics is shown to be fully abstract with respect to the trace semantics if and only if the set of internal actions is infinite.

CesiumSpray>: a Precise and Accurate Global Time Servicefor Large-scale Systems

In large-scale systems, such as Internet-based distributed systems, classical clock-synchronization solutions become impractical or poorly performing, due to the number of nodes and/or the distance among them. We present a global time service for world-wide systems, based on an innovative clock synchronization scheme, named CesiumSpray. The service exhibits high precision and accuracy; it is virtually indefinitely scalable; and it is fault-tolerant. It is deterministic for real-time machinery in the local area, which makes it particularly well-suited for, though not limited to, large-scale real-time systems. The main features of our clock synchronization scheme can be summarized as follows: hybrid external/internal synchronization protocol improves effectiveness of synchronization; heterogeneous failure semantics for clocks and processors improves previous lower bounds on processors; two-level hierarchy improves scalability. The root of the hierarchy is the GPS satellite constellation, which ’’sprays‘‘ its reference time over a set of nodes provided with GPS receivers, one per local network. The second level of the hierarchy performs internal synchronization, further ’’spraying‘‘ the external time inside the local network.