Applying Formal Methods in Software leonard/thesis/ Applying Formal Methods in Software

download Applying Formal Methods in Software leonard/thesis/  Applying Formal Methods in Software

of 183

  • date post

    08-Jun-2020
  • Category

    Documents

  • view

    6
  • download

    2

Embed Size (px)

Transcript of Applying Formal Methods in Software leonard/thesis/ Applying Formal Methods in Software

  • Applying Formal Methods in Software Development

    Leonard Lensink

  • Copyright c© 2013 Leonard Lensink ISBN/EAN: 978-94-90834-62-3

    Typeset using LATEX 2ε Cover design: Marije Rosing

    Publisher: Kontrast

    This work is licensed under a Creative Commons

    Attribution-NonCommercial-NoDerivs 3.0 Unported Li-

    cense. See http://creativecommons.org/

    licenses/by-nc-nd/3.0/.

    The work in this thesis has been carried out under the auspices of the research school

    IPA (Institute for Programming research and Algorithmics).

  • Applying Formal Methods in Software Development

    PROEFSCHRIFT

    ter verkrijging van de graad van doctor

    aan de Radboud Universiteit Nijmegen

    op gezag van de rector magnificus, prof. mr. S.C.J.J. Kortmann,

    volgens besluit van het college van decanen

    in het openbaar te verdedigen op woensdag 6 november 2013

    om 16:30 uur precies

    door

    Leonard Lensink

    geboren op 3 maart 1970,

    te Amstelveen

  • Promotor:

    Prof. dr. Marko C.J.D. van Eekelen

    Copromotor:

    Dr. Sjaak Smetsers

    Manuscriptcommissie:

    Prof. dr. Erik Barendsen

    Prof. dr. Jozef Hooman

    Dr. Alwyn E. Goodloe National Aeronautics and Space Administration

    Langley Research Center, Hampton, USA

  • Applying Formal Methods in Software Development

    DOCTORAL THESIS

    to obtain the degree of doctor

    from Radboud University Nijmegen

    on the authority of the Rector Magnificus, Prof. dr. S.C.J.J. Kortmann,

    according to the decision of the Council of Deans

    to be defended in public on Wednesday, November 6, 2013

    at 16:30 hours

    by

    Leonard Lensink

    Born on March 3, 1970

    in Amstelveen, The Netherlands

  • Supervisor:

    Prof. dr. Marko C.J.D. van Eekelen

    Co-supervisor:

    Dr. Sjaak Smetsers

    Doctoral Thesis Committee:

    Prof. dr. Erik Barendsen

    Prof. dr. Jozef Hooman

    Dr. Alwyn E. Goodloe National Aeronautics and Space Administration

    Langley Research Center, Hampton, USA

  • ACKNOWLEDGEMENTS

    I cannot allow this thesis to be published without thanking some of the people that

    helped me in many ways during these years. With some trepidation I have compiled a

    short list of people who were instrumental to the completion of this thesis. Many more

    people than are on this list have made my stay at the Radboud University from 2006

    until 2012 very enjoyable. To them I extend a lot of gratitude.

    First I would like to thank Marko van Eekelen and Sjaak Smetsers for guiding me

    through this process and for being the co-authors of the research papers that make up

    the main body of this thesis. They have had to put up with my sometimes very erratic

    writing schedule and the fact that I gave precedence to other activities from time to time.

    However, they have always given a lot of support and stimulated me wholeheartedly to

    finish the job.

    Many thanks should go to Alwyn Goodloe, whom I have collaborated with on Java

    code generation from PVS models. He has been extremely helpful and a lot of fun to be

    around. I would also like to thank the other members of the manuscript committee, Erik

    Barendsen and Jozef Hooman, who have spent their valuable time reading my work and

    made the final result much better. Of course I should not forget to thank Bernard van

    Gastel who has been a co-author on two of the papers on the reentrant readers-writers

    algorithm.

    To all the people at NIA and NASA, especially César Muñoz, Heber Herencia, Al-

    wyn Goodloe and Radu Siminiceanu, who have made my visits there interesting as well

    as educational and entertaining, I would like to say thank you for the wonderful time.

    Finally, I owe a lot to my parents, Bé and Ineke, as well as my brother and sisters,

    Marianne, Ap and Suzanne. I also thank Rosalie who has been my muse for the past

    thirteen years, and of course Jelte, who has been my pride and joy during the final stages

    of writing this thesis.

    vii

  • CONTENTS

    Title i

    Acknowledgements vii

    1 Introduction 1

    1.1 Introduction to Formal Methods . . . . . . . . . . . . . . . . . . . . . 3

    1.1.1 The Need for Formal Methods . . . . . . . . . . . . . . . . . . 3

    1.1.2 Varieties of Formal Methods . . . . . . . . . . . . . . . . . . . 4

    1.1.3 Software Surgery . . . . . . . . . . . . . . . . . . . . . . . . . 4

    1.2 Model Checking in Spin . . . . . . . . . . . . . . . . . . . . . . . . . 6

    1.2.1 Specifying a Model . . . . . . . . . . . . . . . . . . . . . . . . 6

    1.2.2 Checking the Model . . . . . . . . . . . . . . . . . . . . . . . 8

    1.3 Theorem Proving with PVS . . . . . . . . . . . . . . . . . . . . . . . . 9

    1.3.1 Specifying a Model . . . . . . . . . . . . . . . . . . . . . . . . 10

    1.3.2 Verifying the Model . . . . . . . . . . . . . . . . . . . . . . . 12

    1.3.3 Generating Code from PVS . . . . . . . . . . . . . . . . . . . 14

    1.4 Contributions and Organization of this Thesis . . . . . . . . . . . . . . 16

    2 Machine Checked Formal Proof of a Scheduling Protocol for Smartcard

    Personalization 19

    2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

    2.2 Personalization Machine . . . . . . . . . . . . . . . . . . . . . . . . . 23

    2.3 PVS Model of the Personalization Machine . . . . . . . . . . . . . . . 24

    2.4 Validating the Model . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

    2.5 The Complete State Invariant . . . . . . . . . . . . . . . . . . . . . . . 30

    2.6 Proof of the Complete State Invariant . . . . . . . . . . . . . . . . . . 34

    2.7 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

    2.8 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

    2.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

    3 Reentrant Readers-Writers 39

    3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

    3.2 The Readers-Writers Problem . . . . . . . . . . . . . . . . . . . . . . 42

    3.3 Model Checking Readers-Writers with Uppaal . . . . . . . . . . . . . . 45

    3.3.1 Constructing the Uppaal Model . . . . . . . . . . . . . . . . . 45

    ix

  • 3.3.2 Checking the Model . . . . . . . . . . . . . . . . . . . . . . . 47

    3.3.3 Correcting the Implementation and Model . . . . . . . . . . . . 47

    3.4 General Reentrant Readers-Writers Model . . . . . . . . . . . . . . . . 49

    3.4.1 Readers-Writers Model in PVS . . . . . . . . . . . . . . . . . 49

    3.4.2 Translation from Uppaal to PVS . . . . . . . . . . . . . . . . . 50

    3.4.3 System Invariants . . . . . . . . . . . . . . . . . . . . . . . . . 51

    3.4.4 No Deadlock . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

    3.5 Related and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . 54

    3.6 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

    4 Deadlock and Starvation Free Reentrant Readers-Writers 57

    4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

    4.2 The Readers-Writers Problem . . . . . . . . . . . . . . . . . . . . . . 61

    4.3 Qt’s Implementation of Readers-Writers Locks . . . . . . . . . . . . . 62

    4.4 Model Checking Readers-Writers with Spin . . . . . . . . . . . . . . . 63

    4.4.1 Modeling the Basics . . . . . . . . . . . . . . . . . . . . . . . 64

    4.4.2 Modeling Readers-Writers . . . . . . . . . . . . . . . . . . . . 66

    4.4.3 Modeling Usage of the Lock . . . . . . . . . . . . . . . . . . . 67

    4.4.4 Checking for Deadlock and Assertions . . . . . . . . . . . . . . 68

    4.4.5 Checking LTL Safety Properties . . . . . . . . . . . . . . . . . 69

    4.4.6 Checking for Absence of Starvation . . . . . . . . . . . . . . . 71

    4.4.7 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

    4.5 General Reentrant Readers-Writers Model . . . . . . . . . . . . . . . . 73

    4.5.1 Readers-Writers Model in PVS . . . . . . . . . . . . . . . . . 73

    4.5.2 Translation from Spin to PVS . . . . . . . . . . . . . . . . . . 76

    4.5.3 System Invariants . . . . . . . . . . . . . . . . . . . . . . . . . 78

    4.5.4 Freedom from Deadlocks and Livelocks . . . . . . . . . . . . . 80

    4.5.5 Freedom from Starvation . . . . . . . . . . . . . . . . . . . . . 81

    4.6 Related and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . 81

    4.7 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

    5 A Proof Framework for Concurrent Programs 85

    5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

    5.2 Framework Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

    5.2.1 Transition System . . . . . . . . . . . . . . . . . . . . . . . . 88

    5.2.2 Theorems and Proofs . . . . . . . . . . . . . . . . . . . . . . . 90

    5.2.3 Translating Spin Models to the Framework . . . . . . . . . . . 92

    5.3 An Example: Bakery Algorithm . . . . . . . . . . . . . . . . . . . . . 94

    5.4 Framework with Thread Synchronization . . . . . . . . . . . . . . . . 98

    5.4