Soundness of a Reasoning System for Asynchronous Communication with Futures Crystal

Distributed systems play an essential role in society today. For example, distributed systems form the basis for critical infrastructure in different domains such as finance, medicine, aeronautics, telephony, and Internet services. It is of great importance that such systems work properly. However, quality assurance of distributed systems is non-trivial since they depend on unpredictable factors, such as different processing speeds of independent components. It is highly challenging to test such distributed systems after deployment under different relevant conditions. These challenges motivate frameworks combining precise modeling and analysis with suitable tool support. In particular, compositional verification systems allow the different components to be analyzed independently from their surrounding components. Thereby, it is possible to deal with systems consisting of many components. Object orientation is the leading framework for concurrent and distributed systems, recommended by the RM-ODP [12]. However, method-based communication between concurrent units may cause busy-waiting, as in the case of remote and synchronous method invocation, e.g., Java RMI [2]. Concurrent objects communicating by asynchronous method calls, which allows the caller to continue with its own activity without blocking while waiting for the reply, combine object-orientation and distribution in a natural manner, and therefore appears as a promising paradigm for distributed systems. Moreover, the notion of futures [4, 15, 10, 16] improves this setting by providing a decoupling of the process invoking a method and the process reading the returned value. By sharing future identities, the caller enables other objects to wait for method results. ABS is a high-level imperative object-oriented modeling language, based on the concurrency and synchronization model of Creol [14]. It supports futures and concurrent objects with an asynchronous communication model suitable for loosely coupled objects in a distributed setting. In ABS , each concurrent object encapsulates its own state and processor, and internal interference is avoided as at most one process is executing. The concurrent object model of ABS without futures supports compositionality because there is no direct access to the internal state variables of other objects, and a method call leads to a new process on the called object. With futures, compositionality is more challenging. In this paper, we focus on the communication model of ABS with futures but ignore the aspects of inheritance and object creation. A compositional reasoning system for ABS with futures has been presented in [9] based on local communication histories. We here show that this system is sound with respect to a revised version of the operational semantics of ABS , which incorporates a notion of global communication history. The execution of a distributed system can be represented by its communication history or trace; i.e., the sequence of observable communication events between system components [5, 11]. At any point in time the communication history abstractly captures the system state [7, 6]. In fact, traces are used in the semantics for full abstraction results (e.g., [13, 1]). The local history of an object reflects the communication visible to that object, i.e., between the object and its surroundings. A system may be specified by the finite initial segments of its communication histories, and a history invariant is a predicate which holds for all finite sequences in the set of