causality in message-based interface contracts: a temporal logic "whodunit"

Sylvain Hallé

NOSHOW

Sylvain Hallé

A lighthearted introduction

Sylvain Hallé

Player ‘‘O’’ Player ‘‘X’’

Sylvain Hallé

1. and must alternate

2. Can’t put two symbols

in same square

3. Eventually, there must be

a line of three ’s

Sylvain Hallé

‘‘O’’ web service

‘‘X’’ web service

Sylvain Hallé

Message

Sylvain Hallé

Message

Interfacecontract

Sylvain Hallé

Message

Interfacecontract

Sylvain Hallé

Transaction

Message

Interfacecontract

Sylvain Hallé

Shop service

Customerservice

A more serious example

Each has its own on the course of a transaction

requirements

Sylvain Hallé

A more serious example

All carts with more than three items arelabelled ‘‘large’’ and must be paid by credit

Every cart created must be cbecked out

Payment mode must be only one of‘‘Credit’’ or ‘‘PayPal’’

C1. A cart created with a mode of paymentmust be checked out with the same modeof payment

Interface contract = ‘ sum’ (i.e. logical of individual requirements

‘ ’conjunction)

Sylvain Hallé

Formalizing interface contracts

The service’s behaviour follows constraints on...

1. Sequences of operations only2. Parameter values only3. Both at the same time

LTL-FO+: extension of LTL with quantifiers on message parameters (Hallé & Villemaire, EDOC 2008)

Sylvain Hallé

LTL formula= assertion on a (of messages)trace

a "always a" a "the next message is a" a "eventually a"

a b "a until b

But what about data contents?

abacdcbaqqtam...G (a ® b)X (q cÚ t) WØFALSE TRUE

Sylvain Hallé

What if symbols are XML documents?

LTL-FO+ = LTL + first-order quantification onelements

Let...

p = argument of a function f...filters acceptable values for x...according to the current message s0

$ x : j(x) Û $k : s |= j(k) AND k Îf(s ,p) p 0s |=

Sylvain Hallé

Example:

p = a/b

LTL-FO+

Sylvain Hallé

Example:

p = a/b

XPath expression

LTL-FO+

Sylvain Hallé

Example:

p = a/bf(s ,p) =

LTL-FO+

Sylvain Hallé

Example:

p = a/bf(s ,p) = {1,2}

LTL-FO+

Sylvain Hallé

Example:

p = a/bf(s ,p) =

LTL-FO+

Sylvain Hallé

Example:

p = a/bf(s ,p) = {}

LTL-FO+

Sylvain Hallé

Example:

"a/b x : x=1 x=2Ú

"c x : x=5

"c cx : F $ y : x=y"c x : x=5G

LTL-FO+

Sylvain Hallé

LTL-FO+

‘‘ ’’X and must alternateO

Sylvain Hallé

LTL-FO+

Sylvain Hallé

LTL-FO+

Move/Player p : ( )X " p’ : p=p’G ( )"

Sylvain Hallé

LTL-FO+

Move/Player p : ( )X " p’ : p=p’G ( )"

Sylvain Hallé

LTL-FO+

Move/Player Move/Playerp : ( )X " p’ : p=p’G ( )"

Sylvain Hallé

LTL-FO+

Move/Player Move/Playerp : ( )X " p’ : p=p’G ( )" /

Sylvain Hallé

LTL-FO+

Move/Player Move/Playerp : ( )X " p’ : p=p’G ( )" /

A trace of messages that an interface contractis noted

satisfies j

Sylvain Hallé

If , whose fault is it?

Contract compliance

who dun·it·A whodunit (for "Who['s] done it?") is a complex, plot-driven variety of the detective story in which the puzzle is the main feature of interest. The reader is provided with clues from which the identity of the perpetrator of the crime may be deduced before the solution is revealed in the final pages of the book.

(Wikipedia)

Sylvain Hallé

If , whose fault is it?

Contract compliance

who dun·it·A whodunit (for "Who['s] done it?") is a complex, plot-driven variety of the detective story in which the puzzle is the main feature of interest. The reader is provided with clues from which the identity of the perpetrator of the crime may be deduced before the solution is revealed in the final pages of the book.

(Wikipedia)

Sylvain Hallé

Applications:

Which component does not thestandard correctly?

Which component should the others for the violation?

At runtime: which component should to avoid a violation?

implement

compensate

takea different action

Contract compliance

Sylvain Hallé

Direct violation

m jm.m j/

A message is a for a trace if:

· and·

m direct violation.

Sylvain Hallé

Direct violation

m jm.m j/

· and·

m direct violation.

Sylvain Hallé

Direct violation

m jm.m j/

· and·

m direct violation.

Sylvain Hallé

Direct violation

m jm.m j/

· and·

m direct violation.

Sylvain Hallé

Direct violation

m jm.m j/

· and·

m direct violation.

Sylvain Hallé

Direct violation

· and·

m direct violation.

m jm.m j/

Sylvain Hallé

Direct violation

· and·

m direct violation.

m jm.m j/1. and must alternate

in same square

Sylvain Hallé

· and·

m direct violation.

Hypothesis #1 The sender of is responsible for the contract violationm

Direct violation

m jm.m j/WANTED

Player ‘ O’‘ ’for violating the

interface contract

Sylvain Hallé

· and·

m direct violation.

Hypothesis #1 The sender of is responsible for the contract violationm

Direct violation

m jm.m j/WANTED

interface contract

WANTED

Player ‘ O’‘ ’

for violating the

interface contract

Sylvain Hallé

Another example:

Direct violation

WANTED

interface contractOO

Sylvain Hallé

Another example:

Direct violation

WANTED

Sylvain Hallé

Another example:

Direct violation

WANTED

1. and must alternate

in same square

Sylvain Hallé

Another example:

Direct violation

WANTED

Sylvain Hallé

Another example:

Direct violation

WANTED

Player ‘ X’‘ ’for violating theinterface contract

Sylvain Hallé

· and· for any (infinite) suffix , we have

m root violation.

Root violation

m’m j

m.m.m’ j/

Sylvain Hallé

· and· for any (infinite) suffix , we have

Hypothesis #2: The sender of is responsible for the contract violation

root violation.

Root violation

m’m j

m.m.m’ j/

Sylvain Hallé

Root violation

Sylvain Hallé

Root violation

Sylvain Hallé

WANTED

Player ‘ O’‘ ’for violating theinterface contract

Root violation

Sylvain Hallé

Observations

Sylvain Hallé

1. Root violations capture the fact that direct violations aresometimes the result of a sequence of ‘‘ ’’forced moves

Observations

Sylvain Hallé

1. Root violations capture the fact that direct violations aresometimes the result of a sequence of ‘‘ ’’

2. The faulty peer as in an ensuing direct violation

forced moves

may not be the same.

Observations

WANTED WANTED

Sylvain Hallé

1. Root violations capture the fact that direct violations aresometimes the result of a sequence of ‘‘ ’’

2. The faulty peer as in an ensuing direct violation

3. The interface contract is not contradictoryin itself: a root violation depends on theactual taken

forced moves

may not be the same

course of actions

Observations

WANTED WANTED

Sylvain Hallé

How to find root violations?

Solution #1Bauer et al. (RV 2007): for LTLanticipatory semantics

Sylvain Hallé

Solution #1Bauer et al. (RV 2007): for LTL

1. Create the Büchi automaton equivalent to

anticipatory semantics

Sylvain Hallé

2. Label each state based on language emptiness ( )or not ( )

Sylvain Hallé

3. Read by keeping pointers to states of

Sylvain Hallé

m = a b

Sylvain Hallé

:discard any pointer to

m = a b

Sylvain Hallé

m = a b a

Sylvain Hallé

4. A message is a root violation ifno pointer is left

m = a b a

Sylvain Hallé

Problem:

· Designed for LTL

Sylvain Hallé

Problem:

· Designed for LTL

· With LTL-FO+, is infinite.

Sylvain Hallé

Solution #2Conversion to LTL

1. the domains for each path expression

2. Convert quantifiers into equivalent expressions

Bound.

f(_, a/b) Í {1,2}

"a/b a/bx : F $ y : x=y

a/bF $ y : 1=y a/bF $ y : 2=y

becomes

...and so on

If , then

Ù( ) ( )

Sylvain Hallé

3. The formula is now pure LTL; use solution #1OR

4. Send messages one by one to an LTL model checker

Sylvain Hallé

m1 j ?

Sylvain Hallé

m1 j ?m1 m2 j ?

Sylvain Hallé

m1 j ?m1 m2 j ?

m1 m m2 3 j ?

Sylvain Hallé

4. Send messages one by one to an LTL

The first message that causes the validation to fail isa root violation

model checker

m1 j ?m1 m2 j ?

m1 m m2 3 j ?

Sylvain Hallé

Problem:

· Requires bounded data domains

· Exponential blow-up of formula

· Non-incremental process

Sylvain Hallé

Proposed solution

Exploit an on-the-fly algorithm for linear temporal logic

runtime monitoring

Sylvain Hallé

Proposed solution

1. Monitor state = set of LTL-FO+ formulas

runtime monitoring

Sylvain Hallé

Proposed solution

1. Monitor state = set of LTL-FO+ formulas2. Upon each new message: update state according to

transformation rules

runtime monitoring

Sylvain Hallé

Proposed solution

transformation rules

runtime monitoring

Sylvain Hallé

Proposed solution

transformation rules3. Compute an outcome function on resulting state

to decide if contract is violated

runtime monitoring

Sylvain Hallé

Proposed solution

transformation rules3. Compute an outcome function on resulting state

to decide if contract is violated

runtime monitoring

Sylvain Hallé

Algorithm overview:

1. An LTL formula is decomposed into nodes of the form

Example:

sub-formulas thatmust be true now

sub-formulas that mustbe true in the next state

Runtime monitoring

Sylvain Hallé

2. Negations pushed inside (classical identities + dual of U = V)

3. At the leaves, G contains atoms + negations of atoms:we evaluate them

Verdict:

! All leaves contain : formula is false! A leaf is : formula is true! Otherwise:

4. Next event: D copied into G and we continue

FALSEempty

Runtime monitoring

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

G (a ® )X Øa ’

a, X Øa G (a ® )X Øa’

a G (a ® ), X Ø Øa a’

Øa G (a ® )X Øa’

a ® X Øa G (a ® )X Øa’

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

a G (a ® ), X Ø Øa a’

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

a G (a ® ), X Ø Øa a’

Sylvain Hallé

a G (a ® ), X Ø Øa a’

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

a G (a ® ), X Ø Øa a’

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

G (a ® ), X Ø Øa a’

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

G (a ® ), X Ø Øa a’

’G (a ® ), X Ø Øa a

Sylvain Hallé

Example: G (a ® )X Øa

a, X , Ø Øa a G (a ® )X Øa’

a, Øa G (a ® ), X Ø Øa a’

a ® b, bX G (a ® )X Øa’

’G (a ® ), X Ø Øa a

Runtime monitoring

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

A variable and its negationcan never be true at the sametime

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

s = aa

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

s = aa

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

Example:

s = aa

No way to extend the trace:formula is false, i.e. message c

is a of the formuladirect violation

Runtime monitoring

G (a ® )X Øa

Sylvain Hallé

By construction (Gerth et al., PSTV 1995):

Let = be a monitor node resulting from theprocessing of a message The message is a violation of the conditions in if and only if it contains

for some proposition p.

Nm. direct

Detecting direct violations

p Ù Øp

Sylvain Hallé

By construction (Gerth et al., PSTV 1995):

Let = be a monitor node resulting from theprocessing of a message The message is a violation of the conditions in if and only if it contains

for some proposition p.

Consequence

is a if this happens for all leaf nodes

. direct

direct violation

Detecting direct violations

p Ù Øp

Sylvain Hallé

Theorem

Let = be a monitor node resulting from theprocessing of a message The message is a violation of the conditions in if and only if the formula

is unsatisfiable. (See paper for the proof!)

Nm. root

Detecting root violations

Ù D( )Ù G( ) Ù X

Sylvain Hallé

Theorem

Let = be a monitor node resulting from theprocessing of a message The message is a violation of the conditions in if and only if the formula

is unsatisfiable. (See paper for the proof!)

Consequence

is a if this happens for all leaf nodes

. root

root violation

Detecting root violations

Ù D( )Ù G( ) Ù X

Sylvain Hallé

1. In the algorithm, each leaf node represents a possible set ofconditions for a valid extension of the current trace

2. If the conditions are contradictory, no trace extension canever satisfy them

3. The formula p Ù Øp is a special case of ,where the contradiction occurs in the current message

4. Detection of root violations reduces to satisfiability solving ofsome set of LTL formulas

Intuition

sub-formulas thatmust be true now

sub-formulas that mustbe true in the next state

Ù D( )Ù G( ) Ù X

Sylvain Hallé

Decomposition rules can be added to deal with LTL-FO+; the definition of root violation does not change

1. Atoms become equality tests

2. Decomposition rules for quantifiers

Adding first-order quantifiers

(and vice versa)

Sylvain Hallé

A workflow for root violation detection

Sylvain Hallé

1 1 n n. . . }

Leaf nodes from currentmonitor state

Sylvain Hallé

1 1 n n. . . }

Incomingmessage

Sylvain Hallé

m UPDATE

1 1 n n. . . }

Monitorupdate function

Sylvain Hallé

m UPDATE

1 1 n n. . . } }

1 1' '

k k' '

New leaf nodes

Sylvain Hallé

m UPDATE

1 1 n n. . . } }

1 1' '

k k' '

Node sent to LTL-FO+satisfiability solver

Sylvain Hallé

m UPDATE

1 1 n n. . . } } 1 1

1 1' '

k k' '

Kept ifsatisfiable

Sylvain Hallé

m UPDATE

1 1 n n. . . } } 1 1

1 1' '

k k' '

X Deleted if not

Sylvain Hallé

m UPDATE

1 1 n n. . . } } 1 1

1 1' '

k k' '

Repeat for every node

Sylvain Hallé

m UPDATE

1 1 n n. . . } } 1 1

1 1' '

k k' '

New monitornodes

Sylvain Hallé

m UPDATE

1 1 n n. . . } } 1 1

1 1' '

k k' '

Declare root violation if no node remains after pruning

Sylvain Hallé

(Hallé & Villemaire, 2011) used as theLTL-FO+ runtime monitor

(Ludwig & Hustadt, 2010) used as thetemporal satisfiability solver

100 randomly-generated traces of shopping carttransactions

Validation of the shopping cart contract

BeepBeep

TSPASS

Experimental setup

Sylvain Hallé

1-2 2-3 3-4 > 4

Overhead

Experiment 1: overhead incurred by use of a solver

Experimental results

Solver time:13 ms / message

Sylvain Hallé

Experiment 2: difference (in messages) between root and direct violation

1-5 6-10 11-15 16-20

Length difference

Violation detected‘‘in advance’’: 18%

less messages consumed

Experimental results

Sylvain Hallé

The concept of violation is a one:parameterized

Future work

Sylvain Hallé

The concept of violation is a one:parameterized

Future work

Call an error whenthe current trace cannot be

extended by at least suffixes with at leastn

k messages

Sylvain Hallé

The concept of violation is a one:

= ‘ lookahead’

parameterized

k ‘ ’ = ‘‘degree of freedom’’n

Future work

k messages

Sylvain Hallé

= ‘ lookahead’

parameterized

k ‘ ’ = ‘‘degree of freedom’’

· Direct violation=1, =1

Future work

k messages

Sylvain Hallé

= ‘ lookahead’

parameterized

k ‘ ’ = ‘‘degree of freedom’’

· Direct violation=1, =1

· Root cause=1, =¥

Future work

k messages

Sylvain Hallé

1. The peer responsible for an interface contract violation

2. A occurs when no infinite extension of thecurrent transaction can ever fulfill an interface contract

3. Using LTL-FO+ as the specification language, reductionto the propositional case results in an

4. Leveraging on a runtime monitoring algorithm, root causedetection reduces to satisfiability solving

5. An experimental setup can detect directviolations ahead of time with reasonableoverhead

maynot cause it directly

root violation

infinite search problem

Take-home points

causality in message-based interface contracts: a temporal logic "whodunit"

Technology

collaborative contracts and cooperating teams€¦ ·...

code contracts abc 16.04.2011

présentation de l'agence whodunit

unit 7 a ‘whodunit ’ 侦探小说

1.04 contracts

master contracts outline

whodunit & howcatchem - mediamanual€¦ · whodunit &...

bilingual contracts

contracts - carolina academic press contracts and sample...

whodunit album

international contracts

causality assessment workshop for clinical trial...

reductions and causality (v) labeled...

ten contracts-v001

agile contracts

chapter 8 causality and subjectivity: the causal

discourse markers of clarification and causality …

p contracts

nicholas jolley - causality and mind [2014][a]

designing sharia contracts