A Java toolkit for the design and the automatic checking of server architectures

This paper presents Saburo, a Java toolkit that generates, from a single Java specification, Java Internet server implementations, together with their formal model that can be automatically checked using the model checker SPIN. This approach ensures the coherence between the Internet server behavior and the static verifications applied on its formal model. Moreover, the use of the Java language as a unique input specification should help the dissemination of formal verification techniques. To simplify the automatic abstraction of the formal model, the Saburo approach is based on the separation of concerns principle. The Java specification is decomposed into three parts: a concurrency model chosen among several predefined ones, a graph describing all the communication and synchronization, and the business code. This approach has two main advantages: the change of the concurrency model is straightforward, and the classical problem of state explosion induced by the automatic extraction of the formal model from the source code is minimized. This work blends together a set of features coming from server design, compilers, software engineering and formal verification. Even though we do not claim novelty in each of the techniques adopted for Saburo, they have been unified into our Java toolkit, which supports all server design phases.