CSL Technical Report September Formal Verication of McMillans Compositional AssumeGuarantee - PDF document

AbstractToillustratesomeofthepowerandconvenienceofitsspecicationlanguageandthe-oremprover,weusethePVSformalvericationsystemtoverifythesoundnessofaproofruleforassume-guaranteereasoningduetoKenMcMillan. i ii Contents Contents 1 1Introduction 3 2FormalizationandVericationinPVS 7 Bibliography 13 1 Chapter1IntroductionThekeyideainassume-guaranteereasoning,rstintroducedbyChandyandMisra[ MC81 ]andJones[ Jon83 ],isthatweshowthatcomponentX1guaranteescertainpropertiesP1ontheassumptionthatcomponentX2deliverscertainpropertiesP2,andviceversaforX2,andthenclaimthatthecompositionofX1andX2(i.e.,bothrunningandinteractingtogether)guaranteesP1andP2unconditionally.Wecanexpressthisideasymbolicallyintermsofthefollowingputativeproofrule. hP2iX1hP1ihP1iX2hP2i htrueiX1jjX2hP1^P2iHere,X1jjX2denotesthecompositionofX1andX2andformulaslikehpiXhqiassertthatifXispartofasystemthatsatisesp(i.e.,pistrueofallbehaviorsofthecompositesystem),thenthesystemmustalsosatisfyq(i.e.,Xassumespandguaranteesq).Rulessuchasthisarecalled“compositional”becausewereasonaboutX1andX2separately(inthehypothesesabovetheline)anddeducepropertiesaboutX1jjX2(intheconclusionbelowtheline)withouthavingtoreasonaboutthecomposedsystemdirectly.Theproblemwithsuchproofrulesisthattheyarecircular(X1dependsonX2andviceversa)andpotentiallyunsound.Infact,theunsoundnessismorethanpotential,itisreal:forexample,letP1be“even-tuallyx=1,”letP2be“eventuallyy=1,”letX1be“waituntily=1,thensetxto1,”andletX2be“waituntilx=1,thensetyto1,”wherebothxandyareinitially0.Thenthehypothesestotherulearetrue,buttheconclusionisnot:X1andX2canforeverwaitfortheothertomaketherstmove.Thereareseveralmodiedassume-guaranteeproofrulesthataresound.Differentrulesmaybecomparedaccordingtothekindsofsystemmodelsandspecicationtheysupport,theextenttowhichtheylendthemselvestomechanizedanalysis,andtheextenttowhichtheyarepreservedunderrenement(i.e.,thecircumstancesunderwhichX1canbereplacedbyanimplementationthatmaydomorethanX1).Earlyworkconsideredmanydifferent 3 NoticethatpqcanbewrittenastheLTLformula:(pU:q),whereUistheLTL“until”operator. 1 ThismeansthattheantecedentformulascanbeestablishedbyLTLmodelcheckingifthetransitionrelationsforX1andX2arenite.Theproofrule 1.1 hasthecharacteristicswerequire,butwhatexactlydoesitmean,andisitsound?Thesequestioncanberesolvedonlybygivingasemanticstothesymbolsandformulasusedintherule.McMillan'spresentationoftheruleonlysketchestheargumentforitssoundness;amoreformaltreatmentisgivenbyNamjoshiandTreer[ NT00 ],butitisnoteasyreadinganddoesnotconveythebasicintuition.Accordingly,wepresentinthenextChapteraformalizationandvericationofMcMil-lan'sruleusingPVS.ThedevelopmentissurprisinglyshortandsimpleandshouldbecleartoanyonewithknowledgeofPVS. 1ThesubexpressionpU:qholdsifqeventuallybecomesfalse,andpwastrueateveryprecedingpoint;thisistheexactoppositeofwhatwewant,hencetheouternegation. 5 6 Chapter2FormalizationandVericationinPVSWebeginwithaPVSdatatypethatdenesthebasiclanguageofLTL(tobeinterpretedoverastatetypestate). pathformula[state:TYPE]:DATATYPEBEGINHolds(state_formula:pred[state]):Holds?U(arg1:pathformula,arg2:pathformula):U?X(arg:pathformula):X?˜(arg:pathformula):NOT?\/(arg1:pathformula,arg2:pathformula):OR?ENDpathformula Here,UandXrepresenttheuntilandnextmodalitiesofLTL,respectively,and˜and\/representnegationanddisjunction,respectively.Holdsrepresentsapplicationofastate(asopposedtoapath)formula.Thesemanticsofthelanguagedenedbypathformulaaregivenbythefunction|=denedinthetheorypaths.LTLformulasareinterpretedoversequencesofstates(thus,anLTLformulaspeciesasetofsuchsequences).Thedenitions|=P 1 (ssatisesP)recursivelydecomposesthepathformulaPbycasesanddetermineswhetheritissatisedbythesequencesofstates. 1PVSinxoperatorssuchas|=mustappearinprexformwhentheyaredened. 7 ofaprogram(i.e.,itrepresentsapossiblesequenceofthestatesastheprogramexecutes)ifeachpairofadjacentstatesinthesequenceisconsistentwiththetransitionrelation.Thesenotionsarespeciedinthetheoryassume guarantee,whichisparameterizedbyastatetypeandatransitionrelationNoverthattype. assume_guarantee[state:TYPE,N:pred[[state,state]]]:THEORYBEGINIMPORTINGpaths[state]i,j:VARnats:VARsequence[state]path:TYPE=fs|FORALLi:N(s(i),s(i+1))gp:VARpathJUDGEMENTsuffix(p,i)HAS_TYPEpath Akeyproperty,expressedasaPVSjudgement(i.e.,alemmathatcanbeappliedbythetypechecker)isthateverysufxtoapathofNisalsoapathofN.Theproofobligationthatjustiesthisjudgementisprovedautomatically.Next,wespecifywhatitmeansforapathformulaPtobevalidforN(thisnotionisnotusedinthisdevelopment,butitisimportantinothers). 2 Wethenstateausefullemmaand lem.Itisprovedby(GRIND). H,P,Q:VARpathformulavalid(P):bool=FORALLp:p|=Pand_lem:LEMMA(p|=(P&Q))=((p|=P)AND(p|=Q)) Next,wedenethefunctionag(P,Q)thatgivesaprecisemeaningtotheinformalnotation&#xP000;N&#xQ000;usedearlier(again,theNisimplicitasitisatheoryparameter). ag(P,Q):bool=FORALLp:(p|=P)IMPLIES(p|=Q) Twokeylemmasarethenstatedandproved. agr_box_lem:LEMMAag(H,[]Q)=FORALLp,i:(p|=H)IMPLIES(suffix(p,i)|=Q)constrains_lem:LEMMAag(H,P�|Q)=FORALLp,i:(p|=H)AND(FORALL(j:below(i)):suffix(p,j)|=P)IMPLIES(suffix(p,i)|=Q)ENDassume_guarantee 2NotethatNisimplicitasitisaparametertothetheory;thisisnecessaryfortheJUDGEMENT,whichwouldotherwiseneedtocontainNasafreevariable(whichisnotallowedinthecurrentversionofPVS). 9 Therstlemmaallowsthealways([])modalitytoberemovedfromtheconclusionofanassume-guaranteeassertion,whilethesecondlemmaallowseliminationoftheconstrains(�|)modality.Bothoftheseareprovedby(GRIND:IF-MATCHALL).Finally,wecanspecifycompositionandMcMillan'sruleforcompositionalassume-guaranteereasoning. composition[state:TYPE]:THEORYBEGINN,N1,N2:VARPRED[[state,state]]//(N1,N2)(s,t:state):bool=N1(s,t)ANDN2(s,t)IMPORTINGassume-guaranteei,j:VARnatH,P,Q:VARpathformula[state]kens_thm:THEOREMag[state,N1](H,P�|Q)ANDag[state,N2](H,Q�|P)IMPLIESag[state,N1//N2](H,[](P&Q))ENDcomposition Here,//isaninxoperatorthatrepresentscompositionofprograms,denedastheconjunctionoftheirtransitionrelations.Then,kens thmisadirecttransliterationintoPVSoftheproofrule 1.1 onpage 4 .ThePVSproofofthistheoremissurprisinglyshort:itbasicallyusesthelemmastoexposeandindexintothepaths,andthenperformsastronginductiononthatindex. (SKOSIMP)(APPLY(REPEAT(THEN(REWRITE"agr_box_lem")(REWRITE"constrains_lem"))))(INDUCT"i":NAME"NAT_induction")(SKOSIMP*:PREDS?T)(REWRITE"and_lem[state,N1!1//N2!1]")(GROUND)(("1"(APPLY(THEN(INST-6"p!1""j!1")(LAZY-GRIND))))("2"(APPLY(THEN(INST-5"p!1""j!1")(LAZY-GRIND))))) Ourrstattempttoformalizethisapproachtoassume-guaranteereasoningwaslong,andtheproofswerealsolong—anddifcult.Othergroupshaveapparentlyinvestedmonthsofworkinasimilarendeavorwithoutsuccess.ThatthenaltreatmentinPVSissostraight-forwardistestamenttotheexpressivenessofthePVSlanguage(e.g.,itsabilitytodeneLTLinafewdozenlines)andthepowerandintegrationofitsprover(e.g.,thepredicate 10 subtypepathanditsassociatedJUDGEMENT,whichautomaticallydischargesnumeroussideconditionsduringtheproof).AlthoughwehaveprovedMcMillan'sassume-guaranteemethodtobesound,itisknowntobeincomplete(i.e.,therearecorrectsystemsthatcannotbeveriedusingtherule 1.1 ).NamjoshiandTreer[ NT00 ]presentanextendedrulethatisbothsoundandcomplete,anditwouldbeinterestingtoextendourPVSvericationtothisrule.Anotherextensionwouldexpandtheformaltreatmentfromthetwo-processtothen-processcase(thisisatechnicalchallengeinformalverication,ratherthananactivitythatwouldyieldadditionalinsight).Finally,itwillbeusefultoinvestigatepracticalapplicationoftheapproachpresentedhere.Onepossibleapplicationistothemutualinterdependenceofmembershipandsyn-chronizationinTTA:eachoftheseisveriedonthebasisofassumptionsabouttheother.AcknowledgmentThePVSformalizationofLTLwasperformedbyCarstenSch¨urmann.ThePVSformal-izationandproofof 1.1 wasacollaborativeeffortwithJonathanFord,SamOwre,HaraldRueß,andN.Shankar. 11 12 Bibliography [Jon83] C.B.Jones.Tentativestepstowardadevelopmentmethodforinterferingpro-grams.ACMTOPLAS,5(4):596–619,1983. 3 [KG94] HermannKopetzandG¨unterGr¨unsteidl.TTP—aprotocolforfault-tolerantreal-timesystems.IEEEComputer,27(1):14–23,January1994. 4 [MC81] JayadevMisraandK.ManiChandy.Proofsofnetworksofprocesses.IEEETransactionsonSoftwareEngineering,7(4):417–426,July1981. 3 [McM99] K.L.McMillan.Circularcompositionalreasoningaboutliveness.InLaurencePierreandThomasKropf,editors,AdvancesinHardwareDesignandVeri-cation:IFIPWG10.5InternationalConferenceonCorrectHardwareDesignandVericationMethods(CHARME'99),volume1703ofLectureNotesinComputerScience,pages342–345,BadHerrenalb,Germany,September1999.Springer-Verlag. 4 [NT00] KedarS.NamjoshiandRichardJ.Treer.Onthecompletenessofcomposi-tionalreasoning.InE.A.EmersonandA.P.Sistla,editors,Computer-AidedVerication,CAV'2000,volume1855ofLectureNotesinComputerScience,pages139–153,Chicago,IL,July2000.Springer-Verlag. 5 , 11 [TTT01] Time-TriggeredTechnologyTTTechComputertechnikAG,Vienna,Austria.SpecicationoftheTTP/CProtocol(version0.6p0504),May2001. 4 13