The emergence of the Internet has sparked a tremendous explosion in the special class of systems called mission critical systems. These systems are so vital to their intended tasks that they must operate continuously. Two problems affect them: unplanned, and therefore disastrous, downtime and planned downtime for software maintenance. As the pressure to keep these systems operating continuously increases, scheduling downtime becomes complex. However, dynamically modifying the mission critical systems without disruption can reduce the need for a planned downtime. Every executing process has an executing code tightly coupled with an associated state, which continuously changes as the code executes. A dynamic modification at this juncture involves modifying the executable code and the state present within the binary image of the associated process. An ill-timed modification can create runtime incompatibilities that are hard to rectify and eventually cause a system crash. The purpose of the research in this thesis is to examine the causes for incompatibilities and propose the design of a dynamic modification technique: Software Hot Swapping. To achieve these objectives, the researcher proposes mechanisms which these incompatibilities can prevent, examines the characteristics and the implementation issues of such mechanisms, and demonstrates dynamic modification with a simple prototype Hot Swapping program. / Master of Science

La mise à jour dynamique des programmes consiste en la modification de ceux-ci sans en arrêter l'exécution. Cette caractéristique est primordiale pour les applications critiques en continuelles évolutions et nécessitant une haute disponibilité. Le but de notre travail est d'effectuer la vérification formelle de la correction de la mise à jour dynamique d'applications Java Card à travers l'étude du système EmbedDSU. Pour ce faire, nous avons premièrement établi la correction de la mise à jour du code en définissant une sémantique formelle des opérations de mise à jour sur le code intermédiaire Java Card en vue d'établir la sûreté de typage des mises à jour. Nous avons ensuite proposé une approche pour vérifier la sémantique du code mis à jour à travers la définition d'une transformation de prédicats. Nous nous sommes ensuite intéressés à la vérification de la correction concernant la détection de points sûrs de la mise à jour. Nous avons utilisé la vérification de modèles. Cette vérification nous a permis de corriger d'abord un problème d'inter blocage dans le système avant d'établir d'autres propriétés de correction : la sûreté d'activation et la garantie de mise à jour. La mise à jour des données est effectuée à travers les fonctions de transfert d'état. Pour cet aspect, nous avons proposé une solution permettant d'appliquer les fonctions de transfert d’état tout en préservant la consistance du tas de la machine virtuelle Java Card et en permettant une forte expressivité dans leurs écritures. / Dynamic Software Updating (DSU) consists in updating running programs on the fly without any downtime. This feature is interesting in critical applications that are in continual evolution and that require high availability. The aim of our work is to perform formal verification the correctness of dynamic software updating in Java Card applications by studying the system EmbedDSU. To do so, we first established the correctness of code update. We achieved this by defining formal semantics for update operations on java Card bytecode in order to ensure type safety. Then, we proposed an approach to verify the semantics of updated programs by defining a predicate transformation. Afterward, we were interested in the verification of correction concerning the safe update point detection. We used model checking. This verification allowed us first to fix a deadlock situation in the system and then to establish other correctness properties: activeness safety and updatability. Data update is performed through the application of state transfer functions. For this aspect, we proposed a solution to apply state transfer functions with the preservation of the Java Card virtual machine heap consistency and by allowing a high expressiveness when writing state transfer functions.

abstract: Dynamic software update (DSU) enables a program to update while it is running. DSU aims to minimize the loss due to program downtime for updates. Usually DSU is done in three steps: suspending the execution of an old program, mapping the execution state from the old program to a new one, and resuming execution of the new program with the mapped state. The semantic correctness of DSU depends largely on the state mapping which is mostly composed by developers manually nowadays. However, the manual construction of a state mapping does not necessarily ensure sound and dependable state mapping. This dissertation presents a methodology to assist developers by automating the construction of a partial state mapping with a guarantee of correctness. This dissertation includes a detailed study of DSU correctness and automatic state mapping for server programs with an established user base. At first, the dissertation presents the formal treatment of DSU correctness and the state mapping problem. Then the dissertation presents an argument that for programs with an established user base, dynamic updates must be backward compatible. The dissertation next presents a general definition of backward compatibility that specifies the allowed changes in program interaction between an old version and a new version and identified patterns of code evolution that results in backward compatible behavior. Thereafter the dissertation presents formal definitions of these patterns together with proof that any changes to programs in these patterns will result in backward compatible update. To show the applicability of the results, the dissertation presents SitBack, a program analysis tool that has an old version program and a new one as input and computes a partial state mapping under the assumption that the new version is backward compatible with the old version. SitBack does not handle all kinds of changes and it reports to the user in incomplete part of a state mapping. The dissertation presents a detailed evaluation of SitBack which shows that the methodology of automatic state mapping is promising in deal with real world program updates. For example, SitBack produces state mappings for 17-75% of the changed functions. Furthermore, SitBack generates automatic state mapping that leads to successful DSU. In conclusion, the study presented in this dissertation does assist developers in developing state mappings for DSU by automating the construction of state mappings with a correctness guarantee, which helps the adoption of DSU ultimately. / Dissertation/Thesis / Doctoral Dissertation Computer Science 2015

[pt] O desenvolvimento baseado em sistemas de componentes de software consiste em compor sistemas a partir de unidades de sotfware prontas e reutilizáveis. Muitos sistemas de componentes software em produção, precisam ficar disponíveis durante 24 horas por dia nos 7 dias da semana. Atualizações dinâmicas permitem que os sistemas sejam atualizados sem interromperem a execução dos seus serviços, aplicando a atualização em tempo de execução. Muitas técnicas de atualização dinâmica, na literatura, utilizam aplicações feitas especificamente para cobrir os pontos implementados e poucas utilizam um histórico de necessidades de um sistema real. Este trabalho estuda os principais casos de atualizações que ocorrem em um sistema de componentes de uso extenso, o Openbus, que consiste em uma infraestrutura de integração responsável pela comunicação de diversas aplicações de aquisição, processamento e interpretação de dados. Além deste estudo, implementamos uma solução de atualização dinâmica para acomodar as necessidades deste sistema. Depois, utilizando a solução implementada, apresentamos um teste de sobrecarga e algumas aplicações de atualizações do Openbus. / [en] The component-based development of software systems consists on composing systems from ready and reusable sotfware units. Many software componente systems on production, need to be available 24 hours a day 7 days a week. Dynamic updates allow systems to be upgraded without interrupting the execution of its services, applying the update at runtime. Many dynamics software update techniques in the literature use applications specically implemented to cover the presented points and only a few use a historical need of a real system. This work studies the main cases of updates that occur in a system of components with extensive use, the Openbus, which consists of an integration infrastructure responsible for communication of various applications for acquisition, processing and interpretation of data. In addition to this study, we implement a solution of dynamic software update to accommodate the needs of this system. After, using the implemented solution, we present an overhead test and applications of updates on Openbus.

Mettre à jour des applications durant leur exécution est utilisé aussi bien en production pour réduire les temps d’arrêt des applications que dans des environnements de développement interactifs (IDE pour live programming). Toutefois, ces deux scénarios présentent des défis différents qui font que les solutions de mise à jour dynamique (DSU pour Dynamic Software Updating) existantes sont souvent spécifiques à l’un des deux. Par exemple, les DSUs pour la programmation interactives ne supportent généralement pas la détection automatique de points sûrs de mise à jour ni la migration d’instances, alors que les DSUs pour la production nécessitent une génération manuelle de l’ensemble des modifications et manquent d’intégration avec l’IDE. Les solutions existantes ont également une capacité limitées à se mettre à jour elles-mêmes ou à mettre à jour les bibliothèques de base du langage ; et certaines d’entre elles introduisent mêmle une dégradation des performances d’exécution en dehors du processus de mise à jour.Dans cette thèse, nous proposons un DSU (nommé gDSU) unifié qui fonctionne à la fois pour la programmation interactive et les environnements de production. gDSU permet la détection automatique des points sûrs de mise à jour en analysant et manipulant la pile d’exécution, et offre un mécanisme réutilisable de migration d’instances afin de minimiser les interventions manuelles lors de l’application d’une migration. gDSU supporte également la mise à jour des bibliothèques du noyau du langage et du mécanisme de mise à jour lui-même. Ceci est réalisé par une copie incrémentale des objets à modifier et une application atomique de ces modifications.gDSU n’affecte pas les performances globales de l’application et ne présente qu’une pénalité d’exécution lors processus de mise à jour. Par exemple, gDSU est capable d’appliquer une mise à jour sur 100 000 instances en 1 seconde. Durant cette seconde, l’application ne répond pas pendant 250 milli-secondes seulement. Le reste du temps, l’application s’exécute normalement pendant que gDSU recherche un point sûr de mise à jour qui consiste alors uniquement à copier les éléments modifiés.Nous présentons également deux extensions de gDSU permettant un meilleur support du développement interactif dans les IDEs : la programmation interactive transactionnelle et l’application atomique de reusinages (refactorings). / Updating applications during their execution is used both in production to minimize application downtine and in integrated development environments to provide live programming support. Nevertheless, these two scenarios present different challenges making Dynamic Software Update (DSU) solutions to be specifically designed for only one of these use cases. For example, DSUs for live programming typically do not implement safe point detection or insistance migration, while production DSUs require manual generation of patches and lack IDE integration. These sollutions also have a limited ability to update themselves or the language core libraries and some of them present execution penalties outside the update window.In this PhD, we propose a unified DSU named gDSU for both live programming and production environments. gDSU provides safe update point detection using call stack manipulation and a reusable instance migration mechanism to minimize manual intervention in patch generation. It also supports updating the core language libraries as well as the update mechanism itself thanks to its incremental copy of the modified objects and its atomic commit operation.gDSU does not affect the global performance of the application and it presents only a run-time penalty during the window. For example, gDSU is able to apply an update impacting 100,000 instances in 1 second making the application not responsive for only 250 milliseconds. The rest of the time the applications runs normally while gDSU is looking for a safe update point during which modified elements will be copied.We also present extensions of gDSU to support transactional live programming and atomic automactic refactorings which increase the usability of live programming environments.