1. Properties as Processes : FORTE 2005 1slide Properties as Processes: their Specification and Verification Joel Kelso and George Milne School of Computer Science and Software Engineering University of Western Australia {joel,george}@csse.uwa.edu.au

2. Properties as Processes : FORTE 2005 2slide Introduction ● The main contributions of this research are: – A technique for specifying temporal constraints as processes, and enforcing them via concurrent composition. – A technique for specifying safety properties as processes, and verifying them with a technique that makes use of concurrent composition.

3. Properties as Processes : FORTE 2005 3slide Outline ● Motivation ● Specifying and enforcing temporal constraints using concurrent composition ● Specifying and checking safety properties, making use of concurrent composition and equivalence checking ● Modelling and verification methodology ● Example ● Conclusion and related work

4. Properties as Processes : FORTE 2005 4slide Motivation for research ● To develop formal methodologies that suitable for non- mathematicians. ● To further this aim we adopt a “process-centric” modelling and verification methodology which: – introduces a minimum number of concepts – makes use of widely understood ideas i.e. state machines ● To extend our toolbox of process modelling techniques.

5. Properties as Processes : FORTE 2005 5slide Process-centric methodology ● Based on “pure process algebra” ie. processes with named atomic actions. ● Makes use of four concepts: – state diagrams for elementary behaviours – concurrent composition of processes – action abstraction (or combined compose-relabel-abstract “wiring diagrams”) – process equivalence checking ● Semantics derived from CIRCAL process algebra. ● XCircal (C-like) and Haskell Circal (functional) process construction languages.

6. Properties as Processes : FORTE 2005 6slide Constraint processes ● Constraints are things that limit system behaviour. A useful modelling style can be to specify a permissive system and add constraints separately. ● In formalisms using state variables, constraints can be inequalities or other relations. ● In the process-algebraic setting constraints can be expressed as processes that specify allowable behaviours over a subset of system actions. ● Constraint processes can be enforced via concurrent composition.

7. Properties as Processes : FORTE 2005 7slide Applying constraints via concurrent composition ● Concurrent composition of constraint processes enforces the constraint if: – the constraint mentions only system actions – synchronisation is enforced for constraint actions - and does not block non-constraint actions – synchronised actions are not consumed ie. they remain in the composite process ● CSP, LOTOS and CIRCAL have concurrent composition operators which are suitable.

8. Properties as Processes : FORTE 2005 8slide Applying constraints via concurrent composition (continued)

9. Properties as Processes : FORTE 2005 9slide Temporal constraint processes ● Temporal constraint processes can be formed by specifying allowable sequences of critical actions. Critical actions can be single actions, or actions marking the boundary of significant intervals. ● Relationships that can be expressed include: – before/after – during – non-overlapping – contained within – finishes before

10. Properties as Processes : FORTE 2005 10slide Safety property processes ● In the process-algebraic setting, safety properties can be expressed as processes that specify allowable behaviours over a subset of the system's actions. ● Note that this is almost the same as a constraint process. The difference is that we want to enforce a constraint process, whereas we want to verify that a system process conforms to a property process.

11. Properties as Processes : FORTE 2005 11slide Checking properties via concurrent composition and equivalence checking ● Safety property equation: S * P == S where S is a system description process P is a property processes == is a process equivalence relation ● If this equation holds true, the safety property is satisfied. ● (It turns out to be equivalent to the “abstract and refinement check” method of checking safety properties.)

12. Properties as Processes : FORTE 2005 12slide Modelling and verification methodology ● Modelling and verification proceeds in three phases: – construction of system processes – construction and application of constraint processes – construction and verification of properties

13. Properties as Processes : FORTE 2005 13slide Example: modelling the Fischer Protocol ● The Fischer Protocol ensures mutual exclusion among a set of concurrent processes each of which has a critical section. ● The protocol relies critically on timing for correct operation.

14. Properties as Processes : FORTE 2005 14slide Phase 1 : System model processes

15. Properties as Processes : FORTE 2005 15slide Phase 1 : Structure diagram for two- worker system

16. Properties as Processes : FORTE 2005 16slide Phase 2 : Fischer Protocol timing constraints ● For correct operation, each worker process must: – set the shared variable a short period of time after noticing the variable is free, and – wait long enough to ensure that any worker that might have “got in ahead” has set the shared variable

17. Properties as Processes : FORTE 2005 17slide ● It suffices to ensure that pcd does not occur in the interval [qab,qbc]

18. Properties as Processes : FORTE 2005 18slide Phase 3 : Mutual exclusion property ● Two-worker mutual exclusion property process. ● Verification: TimedFischer * MutexProperty == TimedFischer

19. Properties as Processes : FORTE 2005 19slide Related Work ● Other formalisms used for specifying similar timed systems: – Timed Automata – Timed Process Algebra – Untimed Process Algebra with clock tick actions ● The “single language for systems and properties” approach is seen in some work with TLA, and in other process algebra such as CSP, CCS etc.

20. Properties as Processes : FORTE 2005 20slide Conclusions / Future Directions ● We have developed techniques for (a) expressing a class of temporal constraints and (b) verifying safety properties in a simple process-centric formalism. ● Process construction scales well to complex system using XCircal or the Haskell Circal combinators. ● The diagramming convention could be developed into a visual language. ● Difficulties in arithmetic or dynamically sized data structures.

21. Properties as Processes : FORTE 2005 21slide Thank you for your attention.

22. Properties as Processes : FORTE 2005 22slide The local clocks Fischer implementation

23. Properties as Processes : FORTE 2005 23slide Safety equation soundness ● For the CIRCAL process algebra composition and abstraction operators, and trace equivalence, we have proved: S * P == S => S – (sig(S) \ sig(P)) < P where S is a system process P is a property process * is concurrent composition - is action abstraction sig(X) is the signature (or sort) of process X == and < are equivalence and refinement => and \ are implication and set difference