Download presentation

Presentation is loading. Please wait.

1
Program Analysis and Verification 0368-4479 http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html Noam Rinetzky Lecture 8: Axiomatic Semantics – Rely/Guarantee (Take II * ) Slides credit: Roman Manevich, Mooly Sagiv, Eran Yahav

2
We begin … Mobiles Scribe

3
Programming Language Syntax: … S 1 ‖ … ‖ S n | c | await b then c – In our case: c = case | x:=a Operational Semantics: – States – Commands – Traces S 1, s ⇒ S’ 1, s’ S 1 ‖ S 2, s ⇒ S’ 1 ‖ S 2, s [Par 1 ] s ∈ ∑ S 0, s 0 ⇒ S 1, s 1 ⇒ … ⇒ s k c0c0 c1c1 ckck

4
Programming Language Syntax: … S 1 ‖ … ‖ S n | c | await b then c – In our case: c = case | x:=a Operational Semantics: – States – Commands – Traces S 1, s ⇒ S’ 1, s’ S 1 ‖ S 2, s ⇒ S’ 1 ‖ S 2, s [Par 1 ] s ∈ ∑ S 0, s 0 ⇒ S 1, s 1 ⇒ … ⇒ … c0c0 c1c1 ckck

5
Axiomatic Semantics (Hoare Logic) Disjoint parallelism Global invariant Owicky – Gries [PhD. ‘76] { P } S 1 ‖ S 2 { Q } … …

6
Rely / Guarantee Aka Assume/Guarantee Cliff Jones [IFIP ‘83] Main idea: Modular capture of interference – Compositional proofs

7
Meaning of (atomic) Commands A relation between pre-states and post-states c ⊆ ∑ × ∑ S 0, s 0 ⇒ S 1, s 1 ⇒ … ⇒ s k+1 c0c0 c1c1 ckck

8
Meaning of (atomic) Commands A relation between pre-states and post-states c ⊆ ∑ × ∑ S 0, s 0 ⇒ S 1, s 1 ⇒ … ⇒ s k+1 c0c0 c1c1 ckck

9
Meaning of (atomic) Commands A relation between pre-states and post-states S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 ⇒ ⇒ ⇒ ⇒ ⇒ ⇒ … c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn

10
Intuition: Global Invariant Every (intermediate) state satisfies invariant I S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn ⇒ ⇒ ⇒ ⇒ ⇒ ⇒ … I=I= c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn

11
Intuition: Global Invariant Thread-view S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 ⇒ ⇒ ⇒ ⇒ ⇒ … I=I= c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn ⇒

12
Intuition: Rely Guarantee Thread-view S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn ⇒ ⇒ ⇒ ⇒ … ⇒ …

13
Intuition: Rely Guarantee Thread-view S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn ⇒ ⇒ ⇒ ⇒ … ⇒ … G G G G RRRR R

14
Intuition: Rely Guarantee Thread-view S 0, s 0 ⇒ s 1 ⇒ … ⇒ s k+1 ⇒ s k+2 ⇒ s k+3 ⇒ s k+3 ⇒ s k+4 … ⇒ s n+1 c0c0 c1c1 ckck c k+1 c k+2 c k+3 cncn ⇒ ⇒ ⇒ ⇒ … ⇒ … G G G G R*R* R*R* R*R*

15
Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option I: {P} C {Q} – P is a one state predicate – Q is a two-state predicate Example – {true} x := x + 1 {x= x + 1}

16
Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option II: {P} C {Q} – P is a one state predicate – P is a one-state predicate Use logical variables to record pre-state Example – {x = X} x := x + 1 {x= X + 1}

17
Intuition (again) C G Hoare: { P } S { Q } ~ {P} ⇒⇒⇒⇒ {Q} C R/G: R,G ⊢ { P } S { Q } ~ {P} ⇒⇒⇒⇒⇒⇒⇒ {Q} G RRR GG

18
Goal: Parallel Composition R G 2, G 1 ⊢ { P } S 1 ‖ S 2 { Q } R, G 1 G 2 ⊢ { P } S 1 ‖ S 2 { Q } (PAR) R G 1, G 2 ⊢ { P } S 1 ‖ S 2 { Q }

19
Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option I: {P} C {Q} – P is a one state predicate – Q is a two-state predicate Example – {true} x := x + 1 {x= x + 1}

20
Meaning of (atomic) Commands meaning of atomic commands is relations between pre-states and post-states C {Q} – P is a one state predicate – Q is a two-state predicate Example – {true} x := x + 1 {x= x + 1}

21
Meaning of (atomic) Commands meaning of atomic commands is relations between pre-states and post-states C {Q} – P is a one state predicate – Q is a two-state predicate Example – {true} x := x + 1 {x= x + 1}

22
From one- to two-state relations p( , ) =p( ) A single state predicate p is preserved by a two-state relation R if – p R p – , : p( ) R( , ) p( ) – P is stable under R

23
Operations on Relations (P;Q)( , )= :P( , ) Q( , ) ID( , )= ( = ) R * = ID R (R;R) (R;R;R) … – Reflexive transitive closure of R

24
Formulas ID(x) = (x = x) ID(p) =(p p) Preserve (p)= p p

25
Judgements c (p, R, G, Q)

26
Informal Semantics c (p, R, G, Q) – For every state such that p: Every execution of c on state with (potential) interventions which satisfy R results in a state such that ( , ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G

27
Informal Semantics c (p, R, G, Q) – For every state such that p: Every execution of c on state with (potential) interventions which satisfy R results in a state such that ( , ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G c [p, R, G, Q] – For every state such that p: Every execution of c on state with (potential) interventions which satisfy R must terminate in a state such that ( , ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G

28
A Formal Semantics Let C R denotes the set of quadruples s.t. that when c executes on 1 with potential interferences by R it yields an intermediate state 2 followed by an intermediate state 3 and a final state 4 – 4 = when c does not terminate C R = { : : R ( * 2 2 = 3 = 4 ’, C’: * ( ( 2 = 1 2 = ) ( 3 = 3 = ’) 4 = ) C’ R ) c (p, R, G, Q) – For every C R such that 1 p G If 4 : Q

29
A Formal Semantics Let C R denotes the set of quadruples s.t. that when c executes on 1 with potential interferences by R it yields an intermediate state 2 followed by an intermediate state 3 and a final state 4 – 4 = when c does not terminate C R = { : : R ( * 2 2 = 3 = 4 ) ( ’, C’: * ( ( 2 = 1 2 = ) ( 3 = 3 = ’) ( 4 = C’ R ) ) c (p, R, G, Q) – For every C R such that 1 p G If 4 : Q

30
A Formal Semantics Let C R denotes the set of quadruples s.t. that when c executes on 1 with potential interferences by R it yields an intermediate state 2 followed by an intermediate state 3 and a final state 4 – 4 = when c does not terminate C R = { : : R ( * 2 2 = 3 = 4 ) ( ’, C’: * ( ( 2 = 1 2 = ) ( 3 = 3 = ’) 4 = ) C’ R )) c (p, R, G, Q) – For every C R such that 1 p G If 4 : Q

31
Simple Examples X := X + 1 (true, X=X, X =X+1 X=X, X =X+1) X := X + 1 (X 0, X X, X>0 X=X, X>0) X := X + 1 ; Y := Y + 1 (X 0 Y 0, X X Y Y, G, X>0 Y>0)

32
Inference Rules Define c (p, R, G, Q) by structural induction on c Soundness – If c (p, R, G, Q) then c (p, R, G, Q)

33
Atomic Command {p} c {Q} c (p, preserve(p), Q ID, Q) (Atomic)

34
Conditional Critical Section {p b} c {Q} await b then c (p, preserve(p), Q ID, Q) (Critical)

35
Sequential Composition c 1 (p 1, R, G, Q 1 ) c 1 ; c 2 (p 1, R, G, (Q 1 ; R * ; Q 2 )) (SEQ) c 2 (p 2, R, G, Q 2 ) Q 1 p 2

36
Conditionals c 1 (b 1, R, G, Q) p b R * b 1 if atomic {b} then c 1 else c 2 (p, R, G, Q) (IF) c 2 (b 2, R, G, Q) p b R* b 2

37
Loops c (j b 1, R, G, j) j b R * b 1 while atomic {b} do c (j, R, G, b j) (WHILE) R Preserve(j)

38
Refinement c (p, R, G, Q) c (p’, R’, G’, Q’) (REFINE) p’ p Q Q’ R’ R G G’

39
Parallel Composition c 1 (p 1, R 1, G 1, Q 1 ) c 1 || c 2 (p 1 p 1, (R 1 R2), (G 1 G 2 ), Q) where Q= (Q 1 ; (R 1 R 2 )*; Q 2 ) (Q 2 ; (R 1 R 2 )*; Q 1 ) (PAR) c 2 (p 2, R 2, G 2, Q 2 ) G 1 R 2 G 2 R 1

40
Issues in R/G Total correctness is trickier Restrict the structure of the proofs – Sometimes global proofs are preferable Many design choices – Transitivity and Reflexivity of Rely/Guarantee – No standard set of rules Suitable for designs

Similar presentations

OK

Concurrency Verification. Why concurrency verification Concurrent programs show in many systems –Multi-task support in OS kernels –Handling interrupts.

Concurrency Verification. Why concurrency verification Concurrent programs show in many systems –Multi-task support in OS kernels –Handling interrupts.

© 2018 SlidePlayer.com Inc.

All rights reserved.

To ensure the functioning of the site, we use **cookies**. We share information about your activities on the site with our partners and Google partners: social networks and companies engaged in advertising and web analytics. For more information, see the Privacy Policy and Google Privacy & Terms.
Your consent to our cookies if you continue to use this website.

Ads by Google

Ppt on home automation using gsm Ppt on total internal reflection Ppt on information and communication technology Ppt on english grammar in hindi Ppt on economic order quantity examples Ppt on natural resources and conservation degree Ppt on different types of dance forms productions Ppt on tsunami in india 2004 Ppt on public private partnership in india Ppt on nestle india ltd