Microsoft Technology Licensing, LLC

Sriram K Rajamani

Thomas J Ball

Anthony Dean Andrews

Shaz Qadeer

Jakob Rehof

Niels Jakob Rehof

James R Larus

Todd David Millstein

Rupak Majumdar

Vladimir A Levin

Cédric Fournet

Robert Palmer

Jakob Rehob

Charles Antony Richard Hoare

Yichen Xie

A distributed software system of communicating software components can be tested for undesirable behavior. A specification of a component can be substituted in place of the component when testing a model of the distributed software system. Thus, the system can be checked to see if it exhibits undesirable behavior without having code for all components of the system. Also, a component can be checked to see if it is in conformance with its specification. If models built with respective components and substituted specifications indicate that the system does not exhibit undesirable behavior, and the components conform to their specifications, then a system assembled from the components will not exhibit the undesirable behavior. Thus, collaborative testing can be achieved, even if no one entity has access to code for the entire distributed system.

Analysis of distributed software systems via specification substitution

Methods are discussed that enhance program analysis. One aspect of the invention includes a method for checking a model of a program. The method includes a control-flow graph having vertices from the model, applying a transfer function to each vertex to form a set of path edges, and analyzing the set of path edges of a vertex. The set of path edges includes valuations that are implicitly represented so as to inhibit an undesired explosion in the valuations that would hinder the act of analyzing.

Method for enhancing program analysis

Described are embodiments for developing a message-passing application program. The program is constructed using stages having a plurality of asynchronous functions, or operations. The operations communicate with other operations of other message-passing programs in a distributed computing environment. The operations also communicate with other operations on other stages of the message-passing application. In order to reduce deadlock errors, a behavioral type signature is appended to the declaration of each operation of the message-passing application program. The behavioral type signature specifies behavioral properties for each operation, such as when an operation should send a message to another operation. A type checker utilizes typing rules and the behavioral type signature to extract an implementation model of each function. The type checker then compares the implementation model to the behavioral type signature to determine whether the asynchronous function conforms to the behavioral type signature.

Programming model to detect deadlocks in concurrent programs

An asynchronous programming language that facilitates concurrent programming by utilizing futures, asynchronous calls, and joins on futures. For each of a client interface and a service interface of an asynchronous interface, respective models are automatically extracted. A behavioral contract is defined on the asynchronous interface. The client and service models are then passed to modular checking algorithm that checks to ensure that both the client and the service conform to the behavioral contract. The checking algorithm combines region-based type systems with model checking techniques to handle pointer aliasing in a sound manner.

Contracts and futures in an asynchronous programming language

Described is a method that enables the automatic generation of a boolean program that is a predicate abstraction of a program written using a general programming language. The method is capable of abstracting code statements within the program that include procedure calls, assignments, goto statements, conditionals, and pointers. In accordance with the invention, predicates of interest are identified for each code statement in the program. For each particular code statement, the process generates predicate statements that describe an effect that the statement has on the predicates of interest. If the effect of a particular code statement is indeterminable, non-deterministic predicate statements are included in the boolean program to model the indeterminable nature of the code statement. In addition, if a particular code statement includes a procedure call, the arguments and return value of the procedure call are translated to associated predicates in the calling context.

System and method for generating a predicate abstraction of a program

Described techniques and tools help model checking scale to large programs while reducing missed errors. In particular, described techniques and tools help reduce the state space of concurrent programs without depending on cycle detection and without scheduling execution of postponed threads at all cycles. For example, described techniques and tools use a type of partial-order reduction called transaction-based reduction to reduce program state space. Analysis is performed at commit points to determine whether to schedule delayed threads.

Sound transaction-based reduction without cycle detection

Procedure summaries can be generated and used for multithreaded software. A set of actions for a software procedure can be identified as atomically modelable with respect to multithreaded execution of the software. Such actions can be considered a transaction and deemed to have occurred one after another without interruption by other threads. Thus, multithreaded execution of the software can be modeled to detect programming flaws. For example, reachability analysis can be used in concert with the procedure summaries to determine if specified invariants fail.

Procedure summaries for multithreaded software

Methods and systems are provided for automatically generating an accurate model of communications processes between disparate computing systems that may be analyzed in an efficient manner for error detection in web services systems. Business Process Execution Language for Web Services (BPEL) descriptions are automatically generated for the BPEL-based executable processes utilized by each communicating computing system in a given web services system. The BPEL abstract process descriptions for each communicating computing system are translated into a combined process model according to a suitable modeling language. The process model is tested by a model checking software application. Communications errors between the disparate computing systems are detected by automatically testing the combined process model according to a variety of potential communications scenarios.

Error detection in web services systems

The state space of modeled software can be explored using an object-based systematic state explorer. The object-based model can perform well even in light of the complexities of concurrent software. During state space exploration, differences between states can be stored instead of storing a complete copy of the state.

Object-based systematic state space exploration of software

A system and method for modeling a message-passing program module using type annotations is disclosed. The message-passing program module is constructed with operations that communicate with operations of other message-passing program modules in an asynchronous computing environment. Type annotations are communication protocols that represent processes of input and/or output actions that the program module developer expects each operation to perform or take on a selected set of communication channels. During development of the program module, the type annotations are declared at each operation of the program module. Soundness of the type annotations and whether implementation of the program module conforms to the type annotations is checked using a type system. If the program module is well-typed and well-implemented, the type system abstracts a behavioral module of the message-passing program module that reflects the relevant processes expressed by the type annotations. A model checker determines whether the behavioral module is in fact a valid abstraction of the implementation, and if so, evaluates one or more properties of the behavioral module to render a conclusion about these properties for the program module.

Growing community of inventors

Bellevue, WA, United States of America

Sriram K Rajamani