1. Laws of concurrent design Tony Hoare Microsoft ResearchCambridge FMCAD 2012 23 October

2. Summary What are they? Are they useful? Are they true? Are they beautiful?

3. 1. Laws

4. Subject matter (traces of) execution of a program – recording a set of events, – occurring inside and near a computer – while it is executing a program specifications/designs/programs – describing sets of traces – that are desired/planned/actual – when the program is executed the same laws will apply to both.

5. Three operators then;sequential composition with||concurrent composition skip I does nothing

6. Five Axioms assocp;(q;r) = (p;q);r(also ||) commp||q = q||p unitp|| I = p = I ||p(also ;)

7. Reversibility assocp;(q;r) = (p;q);r(also ||) commp||q = q||p unit p|| I = p = I ||p (also ;) swapping the order of operands of ; (or of ||) translates each axiom into itself.

8. Duality Metatheorem: (theorems for free) When a theorem is translated by reversing the operands of all ;s (or of all ||s), the result is also a theorem. Many laws of physics are also reversible in the direction of time

9. Comparison: p => q Example: refinement – every trace described by p is also described by q Example: definement(Scott ⊑) – if the trace p is defined it is equal to the trace q

10. Axiom => is a partial order – reflexivep => p – transitiveif p => q & q => r then p => r swapping the operands of => translates each axiom into itself justifies duality by order reversal

11. Monotonicity Definition: an operator  is monotonic if – p => q implies p  r => q  r & r  p => r  q Axiom: ; and || are monotonic justifies replacement of any component of a term by one that is more refined/defined

12. Monotonicity Metatheorem : Let F be a formula containing p. Let F’ be a translation of F that replaces an occurrence of p by q Let p => q be a theorem -------------------------------------------------------- Then F(p) => F’(q) is also a theorem

13. Exchange Axiom (p||q) ; (p’||q’)=>(p;p’) || (q;q’) Theorem (frame): (p||q) ; q’ => p||(q;q’) – Proof: substitute  for p’ in exchange axiom Theorem: p;q => p*q This axiom is self-dual by time-reversal

14. 2. Applications

15. The laws are useful for proof of correctness of programs/designs – by means of Hoare logic – extended by concurrent separation logic. for design/proof of implementations – using Milner transitions – extended by sequential composition.

16. The Hoare triple Definition: {p} q {r} = p;q => r – If p describes what has happened so far – and q is then executed to completion, – the overall result will satisfy r.

17. The rule of composition Definition: {p} q {r} = p;q => r Theorem: {p} q {s} {s} q’ {r} {p} q;q’ {r}

18. Proof Definition: {p} q {r} = p;q => r expanding the definition: p;q => s s;q’ => r p;q;q’ => r because ; is monotonic and associative

19. Modularity rule for || in concurrent separation logic {p} q {r} {p’} q’ {r’} {p||p’} q||q’ {r||r’} – permits modular proof of concurrent programs. it is equivalent to the exchange law

20. Modularity rule implies Exchange law By reflexivity: p;q => p;q and p’;q’ => p’;q’ Exchange is the conclusion of modularity rule (p||p’) ; (q||q’) =>(p;q) || (p’;q’)

21. Exchange law implies modularity Assume:p;q => r and p’;q’ => r’ monotonicity of || gives (p;q) || (p’;q’) =>r|| r’ the Exchange law says (p||p’) ; (q||q’) =>(p;q) || (p’;q’) by transitivity: (p||p’) ; (q||q’)=>r||r’ which is the conclusion of the modularity rule

22. Frame Rules {p} q {r} {p||f} q {r||f} – adapts a triple to a concurrent environment f – proof: from frame theorem {p} q {r}__ {f;p} q {f;r} – proof: mon, assoc of ;

23. The Milner triple: r - q -> p defined as q;p => r – the time reversal of {p} q {r} – r may be executed by first executing q – with p as continuation for later execution. maybe there are other ways of executing r Tautology: (q ; p) – q -> p Proof: from reflexivity: q;p => q;p

24. Technical Objection Originally, Hoare restricted q to be a program, and p, r to be state descriptions Originally, Milner restricted p and r to be programs, and q to be an atomic action. These restrictions are useful in application. And so is their removal (provided that the axioms are still consistent).

25. Sequential composition {p} q {s} {s} q’ {r} {p} q;q’ {r} r –q-> ss –q’-> p r –(q;q’)-> p Proof: by reversal of the Hoare rule

26. Concurrency in CCS r –p-> qr’ -p’-> q’ (r||r’) -(p||p’)-> (q||q’) – provided p||p’ = τ – where τ is the unobserved atomic transition, which occurs (in CCS) when p and p’ are an input and an output on the same channel. Proof: by reversal of the modularity rule

27. Frame Rules r –q-> p (r||f) –q-> (p||f) – a step q possible for a single thread r is still possible when r is executed concurrently with f r –q-> p (r;f) –q->(p;f) – operational definition of ;

28. The internal step r -> p = def. p => r – (the order dual of refinement) – the implementation may make a refinement step – reducing the range of subsequent behaviours

29. Rule of consequence p => p’ {p’} q {r’}r’ => r {p} q {r} r -> r’r’ –q-> p’p’ -> p r –q-> p – Proof: ; is monotonic and associative, – => is transitive. Each rule is the dual of the other – by order reversal and time reversal

30. Additional operators p \/ qdescribes all traces of p and all of q – describes options in design – choice (non-determinism) in execution p /\ q describes all traces of both p and q – conjunction of requirements (aspects) in design – lock-step concurrency in execution

31. Axioms /\ is the disjunction and \/ is the conjunction of a Boolean Algebra (even with negation). Axiom: ; and || distribute through \/ – which validates reasoning by cases – and implementation by non-deterministic selection

32. Choice {p} q {r}{p} q’ {r} {p} (q \/ q’) {r} – both choices must be correct – proof: distribution of ; through \/ ___r –q-> p____ (r \/ r’) –q-> p – only one of the alternatives is executed – proof: r => r \/ r’

33. Axioms proved from calculi from Hoare p ; (q\/r) => p;q \/ p;r p;r \/ q;r => (p\/q) ; r from Milner (p\/q) ; r => (p;r) \/ (q;r) p;q \/ p;r => p ; (q\/r) from both p ; (q;r) => (p;q) ; r (p;q) ; r => p ; (q;r) exchange law

34. Message Both the Hoare and Milner rules are derived from the same algebra of programming. The algebra is simpler than each of the calculi, and stronger than both of them combined. They are mutually consistent, provided the laws are true

35. 3. The laws are true

36. The laws are true of… specifications, designs, implementations of – programs – hardware – networks – hybrid systems – the real world of events occurring in space and time

37. Happens before (  ) Let e, f, g є Ev (a set of event occurrences). Let e  f mean (your choice of) : – ‘the occurrence e was/will be an immediate and necessary cause of the occurrence f ’ – ‘the occurrence f directly depends (depended) on the occurrence e ’ – ‘e happens before f ’‘f happens after e ’

38. Example: hardware a rising edge  next falling edge on same wire a rising edge  rising edge on another wire

39. Example: Petri nets e  f, f’  g e f g f’

40. Message sequence charts sqlappnet

41. Examples: software n th output  n th input(on reliable channel) n th V  n th P (on an exclusion semaphore) n th assignment  read of n th value (of a variable in memory) read of n th value  (n + 1) st assignment (in strong memory)

42. Precedes Define < as (  )* – the reflexive transitive closure Define >as<  – the converse of < Examples: – allocation of a resource <any use of it – disposal of a resource >any use of it

43. Interpretations e < f& f < e means – e and f are (part of) the same atomic action – or there is deadlock not e < f & not f < e means – e and f are independent of each other – their executions may overlap in time, – or one may complete before the other starts

44. Cartesian product Let p, q, r  Ev – traces of execution Define p × q = {(e,f) | e  p & f  q } – cartesian product Theorem: p × (q  r) = p×q  p×r (q  r) × p = q×p  r×p

45. Composition Let p, q, r  Ev (traces of execution) Let seq  Ev × Ev (arbitrary relation) Define p;q = p  qif p × q  seq & p, q are defined – and is undefined otherwise Theorem: ; is monotonic – with respect to definement ordering

46. Theorem:(p ; q) ; r = p ; (q ; r) Proof: when they are both defined, each side is equal to ( p  q  r ). LHS is defined  (by definition of ;) p × q  seq & (p  q) × r  seq (by × distrib  )  p × q  seq & p × r  seq & q × r  seq  p × (q  r)  seq & q × r  seq  RHS is defined

47. Sequential composition Define seq = < Then p;q is strong sequential composition means that p must finish before q starts – all events in p precede all events in q Example: Ev is NN – {1, 7, 19} ; {21, 32} = {1, 7, 19, 21, 32} – {1, 7, 19} ; {19, 32} is undefined

48. Sequential composition Define seq = not > Then p;q is weak sequential composition means that p may finish before q begins – note that q may start before p finishes – with events that are independent of p – just as in your computer today

49. Concurrent Composition Define par = seq  seq  Note:seq  par = par  Define p||q = p  q if p × q  par and p, q defined Theorem: || is associative and commutative. Strong || is interleaving. Weak || avoids deadlocks

50. Proof: when LHS is defined, it equals RHS LHS defined  q × q’  par & r × r’  par & (q  q’) × (r  r’)  seq  q × q’  r × r’  par & q’ × r’  q × r  q’ × r  q × r’  seq  q’ × r’  seq & q × r  seq & (q  r) × (q’  r’)  par  RHS defined. (q || q’) ; (r || r’)=> (q ; r ) || (q’ ; r’)

51. Interleaving Strong. {1, 7, 9}||{3, 12} = {1, 3, 7, 9, 12}

52. 4. Conclusion The laws are useful The laws are true

53. The Laws The laws are useful – they shorten formulae, theorems, proofs – they prove consistency of proof rules – with the implementation The laws are true – of specifications, designs, products – hardware/software/the real world The laws are beautiful