While multi-threading has become commonplace in many application domains (e.g., embedded systems,... more While multi-threading has become commonplace in many application domains (e.g., embedded systems, digital signal processing (DSP), networks, IP services, and graphics), multi-threaded code often requires complex co-ordination of threads. As a result, multi-threaded implementations are prone to subtle bugs that are difficult and time-consuming to locate. Moreover, current testing techniques that address multi-threading are generally costly while their effectiveness is unknown. The development of cost-effective testing plans requires an in-depth study of the nature, frequency, and cost of concurrency errors in the context of real-world applications. The full paper will lay the groundwork for such a study, with the purpose of informing the creation of a parametric cost model for testing multi-threaded software. The current version of the paper provides motivation for the study, an outline of the full paper, and a bibliography of related papers.
The Software Engineering and Network Systems (SENS) Laboratory supports research in software engi... more The Software Engineering and Network Systems (SENS) Laboratory supports research in software engineering, formal methods, distributed computing, fault tolerance, and computer networking. In addition to projects within each area, the diversity in faculty expertise enables SENS researchers to address challenging problems that span multiple areas. Examples include: automated development of software for embedded systems in automobiles and aircraft; adaptive software for protecting critical infrastructures from cascading failures and cyber-attack; robust software for networks of sensors used in military reconnaissance; adaptive protocols for pervasive computing via handheld and wearable computers; and providing security and privacy in peer-to-peer computing systems. Current SENS research projects are supported by grants from NSF, ONR, and DARPA. Several projects also involve industrial support and collaboration; partners include Motorola, Lucent, Cisco, Siemens, NASA/JPL, and Texas Instr...
Interval logic has been introduced as a temporal logic that provides higher-level constructs and ... more Interval logic has been introduced as a temporal logic that provides higher-level constructs and an intuitive graphical representation, making it easier in interval logic than in other temporal logics to specify and reason about concurrency in software and hardware designs. In this paper we present axiomatizations for two propositional interval logics and relate these logics to Until Temporal Logic. All of these logics are discrete linear-time temporal logics with no next operator. The next operator obstructs the use of hierarchical abstraction and re nement, and makes reasoning about concurrency di cult.
This document describes the semantics of the Synchronization Units Model (Szumo) [SBD05]. Szumo e... more This document describes the semantics of the Synchronization Units Model (Szumo) [SBD05]. Szumo extends object-oriented languages with declarative features for expressing the synchronization concern. Using Szumo, the programmer writes code to allocate processes 1 ; however, in lieu of operational code to synchronize the processes, he declares how his objects cluster into synchronization units and associates a synchronization constraint with each unit. A synchronization constraint specifies a unit's access needs (i.e., those units that objects within the given unit access directly) as a function of the unit's local state. 2 At runtime, processes negotiate with one another for exclusive access to units in order to satisfy these constraints, all while avoiding starvation and a large class of deadlocks. Automated negotiation frees the programmer from having to implement many of the details of synchronization. To take advantage of Szumo features, a programmer does not need to understand the implementation of the negotiation machinery. However, she does need to understand how Szumo concepts (e.g., units and synchronization constraints) and operations (such as changes to synchronization states) affect and are affected by the concepts and operations of objectoriented programs. This suggests that synchronization aspects in Szumo should be specifiable as a self-contained partial specification, known as a view, and that the integration of these aspects with the functional core should be specifiable by view composition. Views afford a powerful separation of concern. They allow complex specifications to be constructed incrementally by composing simpler partial specifications, each of which describes some aspect of the full specification. Their use is recommended in structuring specifications of complex systems for comprehensibility [ACWG94, BD95, DBS95, Jac95, ZJ93].
It is unlikely that any single approach to analysis of concurrent software systems will meet all ... more It is unlikely that any single approach to analysis of concurrent software systems will meet all the needs of software developers throughout the development process. Thus, experimental evaluation of different analysis techniques is needed to determine their relative strengths and practical limitations. Such evaluation requires automated tools implementing the analysis techniques. This paper describes a prototype toolset automating the constrained expression approach to the analysis of concurrent software systems. The results of preliminary experiments with the toolset are reported and the implications of these experiments are discussed.
The visitor pattern is appealing to developers of program-analysis tools because it separates the... more The visitor pattern is appealing to developers of program-analysis tools because it separates the design of the data structures that represent a program from the design of software that traverses these structures. Unfortunately, the visitor pattern is difficult to apply when the analysis involves transformation logic that involves multiple program fragments simultaneously. We encountered this problem in our work on the {\proj} project and discovered a novel way to use multiple cooperating visitor objects to systematically implement such functions when they are specified via a set of transformation rules. This paper introduces our {\em curried-visitor framework} and illustrates how we applied it to implement a key component in the {\proj} framework. We are working on a code generator that will automatically synthesize curried-visitor frameworks from a description of a program's abstract syntax and a set of pattern-matching transformation rules.
International Workshop on Systems Development in SOA Environments (SDSOA'07: ICSE Workshops 2007), 2007
This position paper concerns formal methods for developing safe service-oriented architectures (S... more This position paper concerns formal methods for developing safe service-oriented architectures (SOAs) with support for resource management. We seek an approach to building such SOAs based on the specification of service requirements as declarative contracts, and the enforcement of these contracts at the level of the middleware. Using hierarchical containers that provide the necessary middleware services, we expect to guarantee certain safety properties by construction and raise the level of model abstraction for verifying other necessary properties.
2009 IEEE 17th International Conference on Program Comprehension, 2009
We describe a framework, called the Synchronization Policy Prototyper (SyPP), for generating tool... more We describe a framework, called the Synchronization Policy Prototyper (SyPP), for generating tools to aid in assessing the appropriateness of strictly exclusive synchronization policies under expected program usage scenarios. A SyPP tool aims to help during evolution of an existing program when the synchronization policy that it implements needs to be changed.
Proceedings of the 21st international conference on Software engineering, 1999
This experience report describes a case study in which a key component of a software system was m... more This experience report describes a case study in which a key component of a software system was modeled and analyzed to better understand a proposed algorithm prior to implementation. A Promela model of a linear scheduler for a CAD framework was developed. The Spin simulator was used to debug the model and, later, to illustrate how the algorithm works in different scenarios. Additionally, the Spin verifier was used to check various safety and liveness properties. The study revealed a deficiency with the algorithm, as originally proposed. Subsequently, the modeling tools provided by Spin were used in devising solutions to the problems. Finally, the Promela model was modified and verified to be correct. The actual implementation of the scheduler involves a significant amount of message passing, multiple e%cution threads, and potentially huge data structures. By focusing on the interfaces between threads, restricting the system scope, and abstracting details of data structures and irrelevant computations, a very simple model was obtained, which nevertheless provides an accurate representation of the communication between threads. The paper describes the steps that were abstracted and highlights the restrictions imposed on the model.
Proceedings of the symposium on Testing, analysis, and verification, 1991
At TAV3, we described a prelimimu-y version of the constrained expression toolset, and reported o... more At TAV3, we described a prelimimu-y version of the constrained expression toolset, and reported on the results of our initial experiments with it, Through those experiments we discovered shortcomings in some of the tools that limited the size of the examples that we could analyze. We have since redesigned and reimplementcd several components of the toolset, with performance improvements of more than two orders of magnitude in some cases. The improved toolset has been successfully used with designs that involve hundreds of concurrent processes. In this paper, we describe several experiments with the new version of the toolset, including preliminary experiments with a technique for analyzing systems that include an essentially arbitrary number of identical components.
While multi-threading has become commonplace in many application domains (e.g., embedded systems,... more While multi-threading has become commonplace in many application domains (e.g., embedded systems, digital signal processing (DSP), networks, IP services, and graphics), multi-threaded code often requires complex co-ordination of threads. As a result, multi-threaded implementations are prone to subtle bugs that are difficult and time-consuming to locate. Moreover, current testing techniques that address multi-threading are generally costly while their effectiveness is unknown. The development of cost-effective testing plans requires an in-depth study of the nature, frequency, and cost of concurrency errors in the context of real-world applications. The full paper will lay the groundwork for such a study, with the purpose of informing the creation of a parametric cost model for testing multi-threaded software. The current version of the paper provides motivation for the study, an outline of the full paper, and a bibliography of related papers.
The Software Engineering and Network Systems (SENS) Laboratory supports research in software engi... more The Software Engineering and Network Systems (SENS) Laboratory supports research in software engineering, formal methods, distributed computing, fault tolerance, and computer networking. In addition to projects within each area, the diversity in faculty expertise enables SENS researchers to address challenging problems that span multiple areas. Examples include: automated development of software for embedded systems in automobiles and aircraft; adaptive software for protecting critical infrastructures from cascading failures and cyber-attack; robust software for networks of sensors used in military reconnaissance; adaptive protocols for pervasive computing via handheld and wearable computers; and providing security and privacy in peer-to-peer computing systems. Current SENS research projects are supported by grants from NSF, ONR, and DARPA. Several projects also involve industrial support and collaboration; partners include Motorola, Lucent, Cisco, Siemens, NASA/JPL, and Texas Instr...
Interval logic has been introduced as a temporal logic that provides higher-level constructs and ... more Interval logic has been introduced as a temporal logic that provides higher-level constructs and an intuitive graphical representation, making it easier in interval logic than in other temporal logics to specify and reason about concurrency in software and hardware designs. In this paper we present axiomatizations for two propositional interval logics and relate these logics to Until Temporal Logic. All of these logics are discrete linear-time temporal logics with no next operator. The next operator obstructs the use of hierarchical abstraction and re nement, and makes reasoning about concurrency di cult.
This document describes the semantics of the Synchronization Units Model (Szumo) [SBD05]. Szumo e... more This document describes the semantics of the Synchronization Units Model (Szumo) [SBD05]. Szumo extends object-oriented languages with declarative features for expressing the synchronization concern. Using Szumo, the programmer writes code to allocate processes 1 ; however, in lieu of operational code to synchronize the processes, he declares how his objects cluster into synchronization units and associates a synchronization constraint with each unit. A synchronization constraint specifies a unit's access needs (i.e., those units that objects within the given unit access directly) as a function of the unit's local state. 2 At runtime, processes negotiate with one another for exclusive access to units in order to satisfy these constraints, all while avoiding starvation and a large class of deadlocks. Automated negotiation frees the programmer from having to implement many of the details of synchronization. To take advantage of Szumo features, a programmer does not need to understand the implementation of the negotiation machinery. However, she does need to understand how Szumo concepts (e.g., units and synchronization constraints) and operations (such as changes to synchronization states) affect and are affected by the concepts and operations of objectoriented programs. This suggests that synchronization aspects in Szumo should be specifiable as a self-contained partial specification, known as a view, and that the integration of these aspects with the functional core should be specifiable by view composition. Views afford a powerful separation of concern. They allow complex specifications to be constructed incrementally by composing simpler partial specifications, each of which describes some aspect of the full specification. Their use is recommended in structuring specifications of complex systems for comprehensibility [ACWG94, BD95, DBS95, Jac95, ZJ93].
It is unlikely that any single approach to analysis of concurrent software systems will meet all ... more It is unlikely that any single approach to analysis of concurrent software systems will meet all the needs of software developers throughout the development process. Thus, experimental evaluation of different analysis techniques is needed to determine their relative strengths and practical limitations. Such evaluation requires automated tools implementing the analysis techniques. This paper describes a prototype toolset automating the constrained expression approach to the analysis of concurrent software systems. The results of preliminary experiments with the toolset are reported and the implications of these experiments are discussed.
The visitor pattern is appealing to developers of program-analysis tools because it separates the... more The visitor pattern is appealing to developers of program-analysis tools because it separates the design of the data structures that represent a program from the design of software that traverses these structures. Unfortunately, the visitor pattern is difficult to apply when the analysis involves transformation logic that involves multiple program fragments simultaneously. We encountered this problem in our work on the {\proj} project and discovered a novel way to use multiple cooperating visitor objects to systematically implement such functions when they are specified via a set of transformation rules. This paper introduces our {\em curried-visitor framework} and illustrates how we applied it to implement a key component in the {\proj} framework. We are working on a code generator that will automatically synthesize curried-visitor frameworks from a description of a program's abstract syntax and a set of pattern-matching transformation rules.
International Workshop on Systems Development in SOA Environments (SDSOA'07: ICSE Workshops 2007), 2007
This position paper concerns formal methods for developing safe service-oriented architectures (S... more This position paper concerns formal methods for developing safe service-oriented architectures (SOAs) with support for resource management. We seek an approach to building such SOAs based on the specification of service requirements as declarative contracts, and the enforcement of these contracts at the level of the middleware. Using hierarchical containers that provide the necessary middleware services, we expect to guarantee certain safety properties by construction and raise the level of model abstraction for verifying other necessary properties.
2009 IEEE 17th International Conference on Program Comprehension, 2009
We describe a framework, called the Synchronization Policy Prototyper (SyPP), for generating tool... more We describe a framework, called the Synchronization Policy Prototyper (SyPP), for generating tools to aid in assessing the appropriateness of strictly exclusive synchronization policies under expected program usage scenarios. A SyPP tool aims to help during evolution of an existing program when the synchronization policy that it implements needs to be changed.
Proceedings of the 21st international conference on Software engineering, 1999
This experience report describes a case study in which a key component of a software system was m... more This experience report describes a case study in which a key component of a software system was modeled and analyzed to better understand a proposed algorithm prior to implementation. A Promela model of a linear scheduler for a CAD framework was developed. The Spin simulator was used to debug the model and, later, to illustrate how the algorithm works in different scenarios. Additionally, the Spin verifier was used to check various safety and liveness properties. The study revealed a deficiency with the algorithm, as originally proposed. Subsequently, the modeling tools provided by Spin were used in devising solutions to the problems. Finally, the Promela model was modified and verified to be correct. The actual implementation of the scheduler involves a significant amount of message passing, multiple e%cution threads, and potentially huge data structures. By focusing on the interfaces between threads, restricting the system scope, and abstracting details of data structures and irrelevant computations, a very simple model was obtained, which nevertheless provides an accurate representation of the communication between threads. The paper describes the steps that were abstracted and highlights the restrictions imposed on the model.
Proceedings of the symposium on Testing, analysis, and verification, 1991
At TAV3, we described a prelimimu-y version of the constrained expression toolset, and reported o... more At TAV3, we described a prelimimu-y version of the constrained expression toolset, and reported on the results of our initial experiments with it, Through those experiments we discovered shortcomings in some of the tools that limited the size of the examples that we could analyze. We have since redesigned and reimplementcd several components of the toolset, with performance improvements of more than two orders of magnitude in some cases. The improved toolset has been successfully used with designs that involve hundreds of concurrent processes. In this paper, we describe several experiments with the new version of the toolset, including preliminary experiments with a technique for analyzing systems that include an essentially arbitrary number of identical components.
Uploads
Papers by Laura Dillon