![](bg5.png)
[List 5]
View_Base :=
sequence(
Test_println_message_send,
System_out_println_receive,
System_out_toString_send,
Person_toString_receive)
View_Address_Layer_Person :=
sequence(
Person_toString_receive,
Person_toString_send_@Address,
Person_toString_receive_@Address)
View_Address_Layer_Employer :=
sequence(
Employer_toString_receive,
Employer_toString_send_@Address,
Employer_toString_receive_@Address)
View_Employment_Layer :=
sequence(
Person_toString_receive,
Person_toString_send_@Employment,
Person_toString_receive_@Employment,
Person_toString_send,
Employer_toString_receive)
[List 6]
; Merge Base and Address Layer Views
; (num of archpoints is 8)
Composition_Base_Address :=
sequence(
Layer_in_@Address,
Test_println_message_send,
System_out_println_receive,
System_out_toString_send,
Person_toString_receive,
Person_toString_send_@Address,
Person_toString_receive_@Address,
Layer_out)
; Merge Base, Address, and Employment
; Layer Views
; (num of archpoints is 15)
Composition_Base_Address_Employment :=
sequence(
Layer_in_@Address,
Layer_in_@Employment,
Test_println_message_send,
System_out_println_receive,
System_out_toString_send,
Person_toString_receive,
Person_toString_send_@Address,
Person_toString_receive_@Address,
Person_toString_send_@Employment,
Person_toString_receive_@Employment,
Person_toString_send,
Employer_toString_receive,
Employer_toString_send_@Address,
Employer_toString_receive_@Address,
Layer_out)
[List 7]
; num of ContextJ* execution events is 29
Trace :=
sequence(
Layer_with_@Address,
Test_println_message_call,
System_out_println_execution,
System_out_toString_call,
Person_toString_execution,
Person_toString_call_layer_@Address,
Person_toString_execution_layer_@Address,
Person_toString_call_base,
Person_toString_execution_base,
Layer_without,
Layer_with_@Address,
Layer_with_@Employment,
Test_println_message_call,
System_out_println_execution,
System_out_toString_call,
Person_toString_execution,
Person_toString_call_layer_@Employment,
Person_toString_execution_layer_@Employment,
Person_toString_call_layer_@Address,
Person_toString_execution_layer_@Address,
Person_toString_call_base,
Person_toString_execution_base,
Person_toString_call,
Employer_toString_execution,
Employer_toString_call_layer_@Address,
Employer_toString_execution_layer_@Address,
Employer_toString_call_base,
Employer_toString_execution_base,
Layer_without)
Figure 4: Logical Formula Representing Design and Its Execution Trace.
toString (Employment layer) is invoked. This vio-
lates the order of message sequence of the system
behavior shown in List 6. This bug is caused by
the usage of the ContextJ* framework consisting of
LayerDefinition
,
define
,
select
, and
next
. The
order of layered method definitions is not correct. It
is not necessarily easy for a novice to understand the
above behavior. If the number of layers and the num-
ber of classes associated to the layers increase, it be-
comes difficult to understand the detailed behavior
even if the programmer is not a novice.
Introducing Archpoints, the correspondence be-
tween design and its execution can be checked while
preserving adequate abstraction level. In List 6
(
Composition Base Address Employment
), we fo-
cus on only the layered method invocations—base
method invocations are out of consideration. We can
take into account only a special behavioral scenario if
a developer considers it important.
3.2 SMT-based Verification
The verification procedure shown in 3.1 can be auto-
mated by using formal verification tools. In RV4COP,
we use Yices (Yices, 2012), an SMT solver whose in-
put language is similar to Scheme. Yices is an SMT
solver that decides the satisfiability of formulas con-
taining uninterpreted function symbols with equality,
linear real and integer arithmetic, scalar types, ex-
tensional arrays, and so on. SMT is effective for
RV4COP because these expressive logical formulas
can be used.
3.2.1 Design Traceability
The behavioral aspect of design traceability can be
verified by checking the satisfiability of the logi-
cal formula refine(DESIGN) ∧ TRACE. This for-
mula can be encoded to List 8 in which only
Composition Base Address Employment
is shown
as a system design model due to the space limitation.
[List 8]
01: (define-type count (subrange 0 28))
; num of execution events is 29 (List 7)
02: (define i0::count) ; num of archpoints is 15 (List 6)
03: ...
04: (define i14::count)
05:
06: (assert (and ; assertion
07: ;; Encoding of refine(DESIGN)
08: (< i0 i1) (< i1 i2) (< i2 i3) (< i3 i4)
09: (< i4 i5) (< i5 i6) (< i6 i7) (< i7 i8)
10: (< i8 i9) (< i9 i10) (< i10 i11) (< i11 i12)
11: (< i12 i13) (< i13 i14)
12: (= (tlist i0) Layer_with_@Address)
13: (= (tlist i1) Layer_with_@Employment)
14: (= (tlist i2) Test_println_message_call)
15: (= (tlist i3) System_out_println_execution)
16: (= (tlist i4) System_out_toString_call)
17: (= (tlist i5) Person_toString_execution)
18: (= (tlist i6) Person_toString_call_layer_@Address)
19: (= (tlist i7) Person_toString_execution_layer_@Address)
20: (= (tlist i8) Person_toString_call_layer_@Employment)
21: (= (tlist i9) Person_toString_execution_layer_@Employment)
22: (= (tlist i10) Person_toString_call)
23: (= (tlist i11) Employer_toString_execution)
24: (= (tlist i12) Employer_toString_call_layer_@Address)
25: (= (tlist i13) Employer_toString_execution_layer_@Address)
26: (= (tlist i14) Layer_without)
27: ;; Encoding of TRACE
28: (= (tlist 0) Layer_with_@Address)
29: ...
30: (= (tlist 28) Layer_without)))
31:
32: (check) ; check the assertion
The symbol
tlist
, whose definition is omitted due
to the space limitation, is an array including trace
data (a sequence of execution events) in the exam-
ple. The occurrence order of refine(archpoints)
specified in
sequence
is encoded in line 08 - 26.
The
iteration
predicate can be encoded to Yices
by expanding the iteration limited times although
Composition Base Address Employment
does not
include this predicate. In this case, only the bounded
checking is available. As shown here, predicates for
UML-basedDesignandVerificationMethodforDevelopingDependableContext-awareSystems
93