Modular Development of Correct Meander Programs

Mo dularDevelopmentofCorrectMeanderProgramsHolger Giese andGuido WirtzInstitut f urInformatik, Westfalische Wilhelms-Universitat,Einsteinstrae 62,48149M unster, GERMANYAbstractWedescribethemodulardevelopmentofcorrectparal lelsoftwarwiththeMeandersys-temfromhigh-levelspeci cationsdowntoacon-creteimplementation,basedonacommunicatingalgebraformalism.Wefocusontheexternalbe-haviorofthecomponentsandkeepbehavioralpropertiesthroughre nementandabstraction.Acombinationofaexiblesetsyntacticalmeta-rules and nite model checking permits to even treatsoftware systems with in nite state space in a exi-ble and stepwise modular development process.Keywords:parallelsoftware design, formal de-signmetho ds,abstraction,correctnessbyde-sign, veri cation to ols1Intro ductionDeveloping parallel software is a complex task.A well-founded metho dology and adequate de-velopment to ols are needed to aoid deadlo cksandstarvations,theanomaliesofconcurrentsystems.Inahierarchicalmo dulardevelop-ment pro cess the emb edding of a mo dule sp eci- cation is used to abstract from the mo dule im-plementation and hide it's details.For sequen-tial systems the syntactical interfaces are used,butinconcurrentsystems,thecorresp ondingatmo delwhichcanhaveanenormoussizemust b e buildand analyzed to detect the rele-vant prop erties like deadlo cks and starvations.Due to the missing mo dular analysis of the sys-tem, designerrors willnot b edetectedduringthe designpro cess itself,only at it's end.Theresultsofsucha nalanalysisreectthesys-tem at such a detailed level, that the resultinginformationdep endsonthe nalimplementa-tion and do es not indicatethe design errors ofearlier development stages.So the mo dular de-sign of complex systems must supp ort deadlo ckandstarvationanalysisinmo dularfashionusing a more sophisticated kind of abstractionconsideringb ehaviorofmo dule.Moreprecise,formo dulesp eci cationorinter-face and every valid mo dule implementation, asp ecial form of relation concerning their b ehav-ior must hold.In the literature many relationsareprop osedforb ehavioralabstraction(see[12] for a detailedcomparison of them). Esp e-cially for complex software systems the chosenpreorderrelationshouldb easweakp ossi-ble, but must preserve the relevant prop erties.TheCSPbasedapproachtomo delchecking[10]andavariationtoit{theCFFDmo del(e.g.[11]){triestoreectonlythep ossiblefailures of a mo dule, when comparing two sys-tems.The availableeri cation techniquesforCFFDand nitemo dels(e.g.[13])areabletohandlecomplex nitemo delsupacer-tain size.But often complex mo dular softwaresystems can not b e treated directly.Commonstatemachinebasedapproacheslike[8]andthewellknownstatechartap-proach[6]canonlyb eusedtodescrib e nitesp eci cationsandimplementations.Amorerealisticviewofasoftwaresystemshoulddi-videstatesto nitecontrolandp os-siblyin nitedatastatesofprograms(likinMeander). Sosp ecifyingsuchsoftwaresys-temswithstatemachineswillleadtoagapb etween the sp eci cation and the implementa-tions.Bottom-updevelopmentstepsaredi-cultonthatlevelandthecorresp ondenceb e-tweenstatessp ecifyingstatemachineand the program of the pro cess are not obvious.So we cho ose a formalism reecting this dualityof states using the same semantic environment