48 research outputs found

    Analysis and Verification of Service Contracts

    Get PDF

    Automated Validation of State-Based Client-Centric Isolation with TLA+

    Get PDF
    Clear consistency guarantees on data are paramount for the design and implementation of distributed systems. When implementing distributed applications

    Low complexity system architecture design for medical Cyber-Physical-Human Systems (CPHS)

    Get PDF
    Cyber-Physical-Human Systems (CHPS) are safety-critical systems, where the interaction between cyber components and physical components can be influenced by the human operator. Guaranteeing correctness and safety in these highly interactive computations is challenging. In particular, the interaction between these three components needs to be coordinated collectively in order to conduct safe and effective operations. The interaction nevertheless increases by orders of magnitude the levels of complexity and prevents formal verification techniques, such as model checking, from thoroughly verifying the safety and correctness properties of systems. In addition, the interactions could also significantly increase human operators' cognitive load and lead to human errors. In this thesis, we focus on medical CPHS and examine the complexity from a safety angle. Medical CPHS are both safety-critical and highly complex, because medical staff need to coordinate with distributed medical devices and supervisory controllers to monitor and control multiple aspects of the patient's physiology. Our goal is to reduce and control the complexity by introducing novel architectural patterns, coordination protocols and user-centric guidance system. This thesis makes three major contributions for improving safety of medical CPHS. Reducing verification complexity: Formal verification is a promising technique to guarantee correctness and safety, but the high complexity significantly increases the verification cost, which is known as state space explosion problems. We propose two architectural patterns: Interruptible Remote Procedure Call (RPC) and Consistent View Generation and Coordination (CVGC) protocol to properly handle asynchronous communication and exceptions with low complexity. Reducing cyber-medical treatment complexity: Cyber medical treatment complexity is defined as the number of steps and time to perform a treatment and monitor the corresponding physiological responses. We propose treatment and workflow adaptation and validation protocols to semi-autonomously validate the preconditions and adapt the workflows to patient conditions, which reduces the complexity of performing treatments and following best practice workflows. Reducing human cognitive load complexity: Cognitive load (also called mental workload) complexity measures human memory and mental computation demand for performing tasks. We first model individual medical staff's responsibility and team interactions in cardiac arrest resuscitation and decomposed their overall task into a set of distinct cognitive tasks that must be specifically supported to achieve successful human-centered system design. We then prototype a medical Best Practice Guidance (BPG) system to reduce medical staff's cognitive load and foster adherence to best practice workflows. Our BPG system transforms the implementation of best practice medical workflow

    A fault tolerant, peer-to-peer based scheduler for home grids

    Get PDF
    This thesis presents a fault-tolerant, Peer-to-Peer (P2P) based grid scheduling system for highly dynamic and highly heterogeneous environments, such as home networks, where we can find a variety of devices (laptops, PCs, game consoles, etc.) and networks. The number of devices found in a house that are capable of processing data has been increasing in the last few years. However, being able to process data does not mean that these devices are powerful, and, in a home environment, there will be a demand for some applications that need significant computing resources, beyond the capabilities of a single domestic device, such as a set top box (examples of such applications are TV recommender systems, image processing and photo indexing systems). A computational grid is a possible solution for this problem, but the constrained environment in the home makes it difficult to use conventional grid scheduling technologies, which demand a powerful infrastructure. Our solution is based on the distribution of the matchmaking task among providers, leaving the final allocation decision to a central scheduler that can be running on a limited device without a big loss in performance. We evaluate our solution by simulating different scenarios and configurations against the Opportunistic Load Balance (OLB) scheduling heuristic, which we found to be the best option for home grids from the existing solutions that we analysed. The results have shown that our solution performs similar or better to OLB. Furthermore, our solution also provides fault tolerance, which is not achieved with OLB, and we have formally verified the behaviour our solution against two cases of network partition failure

    Convergence et sécurité d'accès dans les systèmes d'édition collaborative massivement répartis

    Get PDF
    RÉSUMÉ Parmi les défis des systèmes d'édition collaborative figure la cohérence des objets partagés. Dans la perspective d'une édition cohérente, le système doit garantir la convergence. Pour assurer la cohérence des objets partagés, la littérature propose plusieurs solutions. Les différentes approches majeures proposées sont : l'approche des types de données commutatives répliquées (CRDT) et l'approche de la transformée opérationnelle (OT). L'approche CRDT considère des opérations commutatives qui peuvent être exécutées dans un ordre différent. L'une des difficultés auxquelles CRDT se bute réside en la commutativité des opérations. Toutes les opérations d'édition doivent être commutatives afin d'être exécutées dans un ordre quelconque. L'approche de la transformée opérationnelle quant à elle propose une transformation des opérations distantes reçues par rapport aux opérations qui lui sont concurrentes ; même si elles sont déjà exécutées. Pour effectuer les transformations, l'approche OT utilise un algorithme de transformation inclusive (IT). Dans la littérature, plusieurs travaux ont prouvé que les principaux algorithmes de transformation inclusive proposés ne satisfont pas le critère de convergence. Outre la cohérence, la sécurisation des interactions est un autre défi des systèmes d'édition collaborative. Le contrôle d'accès est l'un des modèles de politiques de sécurité applicable dans ce cadre. Il s'agit d'autoriser ou d'interdire l'édition à certains utilisateurs. Le contrôle d'accès doit être uniformément déployé pour éviter de compromettre la cohérence des opérations d'édition. Une opération d'édition valide sur un site doit l'être partout. Une opération refusée sur un site doit être refusée partout. Dans le contexte étudié, le protocole de sécurité est fiable s'il préserve la cohérence du système. Fournir cette preuve de fiabilité est une tâche ardue. Le nombre de cas à examiner est infini. De plus, pour une vérification automatique, le défaut de ressources survient si des techniques appropriées ne sont pas exploitées. Dans cette thèse, nous nous intéressons aux défis que constituent la convergence et le contrôle d'accès dans les systèmes d'édition collaborative répartis. Nous considérons un objet textuel à structure linéaire qui est massivement édité dans une architecture répartie. L'approche de gestion de cohérence utilisée est la transformée opérationnelle. Ainsi, chaque utilisateur a sa copie locale du document partagé. Les opérations générées sur un site sont aussitôt diffusées aux autres utilisateurs. Elles peuvent être exécutées dans un ordre quelconque. Les types d'opérations d'édition sont : l'insertion d'un caractère et la suppression de caractère. Nous intégrons également un protocole de contrôle d'accès à l'édition collaborative. Notre thèse se présente sous la forme de trois articles scientifiques, chacun traitant d'une problématique bien spécifique. Dans le premier article, nous abordons la problématique de la convergence. Nous avons adopté une démarche en plusieurs étapes. Une exploration a été initialement faite afin de vérifier s'il est possible d'avoir une fonction IT convergente. En utilisant la méthode de la synthèse de contrôleur et les automates de jeu, nos investigations ont révélé qu'aucune IT basée uniquement sur le caractère et la position ne peut garantir une convergence. L'identification des causes de divergence a permis d'amorcer la résolution du « problème de synthèse de contrôleur ». Ainsi, un troisième paramètre a été ajouté aux opérations d'insertion. Il permet de manipuler le nombre de caractères supprimés avant la position d'insertion indiquée. Une fonction de détermination de la valeur de ce paramètre a été proposée. Une fonction IT a été par la suite proposée, en tenant compte des propositions précédentes. En utilisant la vérification sur modèle (model-checking), la preuve a été apportée que notre IT garantit bien la convergence. Le deuxième article propose l'intégration d'un protocole de sécurité optimiste. L'article aborde la problématique de la fiabilité du protocole dans un espace d'états infini. Il est déployé au dessus de protocole de synchronisation du système d'édition collaborative. Nous faisons l'hypothèse que le système vérifie la propriété de cohérence en l'absence du contrôle d'accès. Pour affronter les difficultés relatives à la preuve de fiabilité, l'approche du model-checking symbolique a été préférée. Le model-checking borné a été utilisé avec l'outil Alloy. L'exploration faite pour des instances dont la taille maximale est de treize « signatures », a permis de conclure la préservation de la cohérence par le protocole de contrôle d'accès. Notons que ces instances ne sont pas massives mais la combinatoire résultante n'est pas négligeable. Le troisième article aborde la problématique de réduction de système. Des investigations ont été menées afin d'avoir un modèle fini équivalent au système d'édition collaborative, au regard de la propriété de cohérence. Le modèle abstrait proposé comporte trois sites coopératifs, dont l'un est administrateur. Ce modèle à espace d'états fini étant prouvé équivalent par rapport à la propriété de cohérence, au système à espace d'états infini, il a servi de cadre pour la vérification automatique. En utilisant l'outil Uppaal et le formalisme d'automate, nous avons prouvé par model-checking que le modèle abstrait préserve la cohérence. Par conséquent, le protocole de contrôle d'accès préserve la cohérence de système d'édition collaborative. Nos travaux comportent quelques limitations liées à leur portée. Nous avons manipulé des objets textuels à structure linéaire sur lesquels ne sont appliquées que des opérations d'insertion et de suppression de caractères. De plus, la gestion des droits d'accès est basée sur un modèle mono-administrateur. La performance du protocole de contrôle d'accès n'a pas non plus été prise en compte. Les travaux auraient sans doute plus d'envergure s'ils couvraient plusieurs types d'objets, plusieurs types d'opérations d'édition, plusieurs administrateurs et une étude de performance. Nos futures travaux pourraient être consacrés à l'élargissement de la portée de la présente thèse.----------ABSTRACT The consistency of the shared documents is one of the most important challenges in collaborative editing systems. To achieve consistency, a solution must ensure the convergence criteria. Several solutions are proposed in litterature to achieve consistency of the shared documents. The major approaches are: commutative replicated data type (CRDT) and operational transformation (OT). CRDT considers some commutative operations which could be executed in different order. The main difficulty of CRDT is to compute commutative operations. OT approach proposes to transform remote operations against their concurrent operations, even if they are already executed. An inclusive transformation function is used to compute the transformations. In the litterature, several works show that the main inclusive transformation (IT) functions proposed do not ensure convergence. Besides consistency, security of the edition is another challenge in distributed collaborative systems. Access control is a model of security policy that could be used. It consists of granting or revoking editing authorizations for users. Access control must be uniformly deployed to not compromise the consistency of the system. A valid editing operation at one site must be valid at all other sites. As the same time, an invalid operation at one site, must be invalid everywhere. In the current context, the security protocol is reliable if it preserves the consistency of the system. Produce the proof of reliability is difficult. It requires examining infinite number of cases. In addition, with automatic verification, ressources become insufficient if appropriate techniques are not used. This thesis is interested in consistency and access control challenges in distributed collaborative editing systems. It considers a textual object with a linear structure that is massively edited in a distributed architecture. OT is used to manage consistency. Each user has a local copy of the shared document. Locally-generated operations are immediately broadcast to other users. Operations could be executed in any order. Their types are inserting and deleting characters. To ensure security, collaborative edition is combined with an access control protocol. The thesis consists of three scientific articles. Each of them deals with a specific problem. In the first article, we adress the problem of consistency and proceed in several steps. Initially, we explore the existence of convergent IT functions of OT, which ensure data consistency. Using the controller synthesis approach and game automata, we conclude that there is no IT function, based only on character and position as parameters of insert and delete operations, which ensure data consistency. The investigation of the causes of divergence led to solve the controller synthesis problem. Thus, a new parameter is added to the insert operation signature. It handles the number of characters deleted before the inserting position. The function needed to compute the value of this parameter is provided. Finally, based on these contributions, we propose an IT function and show that it ensures convergence. The proof is achieved by a symbolic model-checking emulated using the tool Uppaal. The second article adresses the reliability of security protocol in an infinite state space. An optimist access control protocol is considered to be deployed over any correct synchronization protocol. The symbolic model-checking approach is choosen to deal with the proof of reliabi--lity. For this purpose, bounded model-checking is used with the tool Alloy. Exploration made with instances whose maximum size is thirteen allow to conclude the preservation of consistency by the access control protocol. These instances are not massive but the resulting combinatorial is important. The third article adresses the problem of system reduction. In this article, we investigate a finite model equivalent to a distributed collaborative editing system, with regard to consistency. The abstract model proposed consists of three cooperative sites including the administrator. This finite state model is proved by model-checking to preserve consistency. Consequently, the access control protocol preserves consistency of any correct distributed collaborative editing system. The model-checking techniques exploits Uppaal tool and automata. Our work has several limitations. We consider textual objects with linear structure. These objects are edited by applying some operations which are inserting and deleting characters. In addition, the management of access rights is based on one-administrator model. The performance study of the access control protocol is not done. The work would probably be more extensive if it covered several types of objects, several types of editing operations, many administrators and the performance study. Our future work could be devoted to the widening of the scope of this thesis

    FLACOS’08 Workshop proceedings

    Get PDF
    The 2nd Workshop on Formal Languages and Analysis of Contract-Oriented Software (FLACOS’08) is held in Malta. The aim of the workshop is to bring together researchers and practitioners working on language-based solutions to contract-oriented software development. The workshop is partially funded by the Nordunet3 project “COSoDIS” (Contract-Oriented Software Development for Internet Services) and it attracted 25 participants. The program consists of 4 regular papers and 10 invited participant presentations

    A Formal Methodology for Engineering Heterogeneous Railway Signalling Systems

    Get PDF
    Ph. D. Thesis.Over the last few decades, the safety assurance of cyber-physical systems has become one of the biggest challenges in the field of model-based system engineering. The challenge arises from an immense complexity of cyber-physical systems which have deeply intertwined physical, software and network system aspects. With significant improvements in a wireless communication and microprocessor technologies, the railway domain has become one of the frontiers for deploying cyber-physical signalling systems. However, because of the safety-critical nature of railway signalling systems, the highest level of safety assurance is essential. This study attempts to address the challenge of guaranteeing the safety of cyber-physical railway signalling systems by proposing a development methodology based on formal methods. In particular, this study is concerned with the safety assurance of heterogeneous cyber-physical railway signalling systems, which have emerged by gradually replacing outdated signalling systems and integrating mainline with urban signalling systems. The main contribution of this work is a formal development methodology of railway signalling systems. The methodology is based on the Event-B modelling language, which provides an expressive modelling language, a stepwise model development and a proof-based model verification. At the core of the methodology is a generic communication-based railway signalling Event-B model, which can be further refined to capture specific heterogeneous or homogeneous railway signalling configurations. In order to make signalling modelling more systematic we developed communication and hybrid railway signalling modelling patterns. The proposed methodology and modelling patterns have been evaluated on two case studies. The evaluation shows that the methodology does provide a system-level railway signalling modelling and verification method. This is crucial for verifying the safety of cyber-physical systems, as safety is dependent on interactions between different subsystems. However, the study has also shown that automatic formal verification of hybrid systems is still a major challenge and must be addressed in the future work in order to make this methodology more practical.(EPSRC and Siemens Rail Automation
    corecore