Lecture 2:Reasoning with Distributed Programs
Anish Arora
CSE 6333
Required Reading
• Chapter 2, 1, 3, 4 in Paul Sivilotti's book
• www.cse.ohio-state.edu/~anish/763/763Handout-Propositional Logic.pdf
Syntax of programs
• A program is a set of variables and a finite set of actions
Each variable has a predefined nonempty domain
Each action has the form:
<guard> <statement>
A guard is a boolean expression over program variables
A statement updates zero or more program variables and always terminates upon execution
BNF for our programming language
stmt skip
| assignment_stmt
| parallel_assignment_stmt
| if_stmt
| terminating_do_stmt
| stmt ; stmt
action guard stmt
program action (▯ action)*
Semantics for our programming language
Intuition for program execution :
At every step, pick an enabled action.
Execute that action.
Repeat until no action is enabled.
(Note that some action(s) may be unfairly picked at every step, and other actions may be unfairly omitted even if they are enabled.)
Semantics of programs
Let p be a program
• A state of p is defined by a value for each variable of p, chosen from the domain of the variable
• A state predicate of p is a boolean expression over the variables of p
• An action of p is enabled at a state iff the guard of the action holds at that state
• A computation of p is a maximal sequence of steps; in every step, some action in p that is enabled in the current state is executed
Maximality of the sequence means that if the sequence is finite then no action in p is enabled in the final state
Examples of programs
Example 0 :
• Given : X,Y : integer constantso,x,y : integer variables
• Design : (X >0 Y >0 x=X y=Y) leads-to o=gcd(X,Y)
program EUCLIDx > y x x - y
▯ y > x y y - x
▯ x = y o xo x
Examples of programs
Example 1 :
• Given : x : array 0..N-1 of integer
k, j, m : integer
• Design : (k = 0 j = 0 m = 0) leads-to (x is in nondec order of INIT_x)
program BBSORT
k < N (if x.k < x.m then m k) ; k = k + 1
▯ k = N x.j, x.m, j, k, m x.m, x.j, j+1, j+1, j+1
j < N
Examples of programs
Example 2 :
• Given : x : array 0..N-1 of integer
• Design : true leads-to (x is in non-decec order of INIT_x)
program HYSORT
parameter j, k : 0 …. N-1
▯ (j,k) : j < k x.j > x.k x.j, x.k x.k, x.j
Specifications
• A specification consists of a safety specification and a liveness specification
A safety specification identifies a set of "bad" finite computation prefixes that should not appear in any program computation
Dually, a liveness specification identifies a set of "good" computation suffixes such that every computation has a suffix that is in this set
• Thus, a specification identifies a set of computations, none of which contain a bad prefix and all of which contain a good suffix
Specifications (contd.)
• For convenience, we will assume that a specification are suffix closed
suffix closed means that every suffix of a computation in a specification is also in the specification
• We say that a program computation satisfies a specification if the former is in the set of computations identified by the latter
Program Correctness
• Program p is correct with respect to its specification iff every computation of p satisfies the specification
• In other words, every computation in p has no bad prefix, as identified by the safety specification, and has some good suffix, as identified by the liveness specification
• Safety captures the intuition that nothing bad ever happens
• Liveness captures the intuition that something good happens eventually
• Note that since the specification is suffix closed, if a program p is correct with respect to its specification, all suffixes of the computations of p also satisfy the specification
Methods for proving program correctness:Sequence of states
• A state is a fixpoint of p iff no action of p is enabled in that state
• An action of p preserves S iff executing the action, starting from any state where the action is enabled and S holds, yields a state where S holds
Recall the Hoare-triple notation: {S} ac {T},
where S and T are state predicates of p, ac is an action of p
{S} ac {T} means that starting from any state where S holds, execution of ac upon termination yields a state where T holds
Method for proving program correctness:Sequence of states
Observe:
- {S} ac {true} is always true
- {S} ac {false} is never true
- {false} ac {S} is always true
- {S} ac {S} iff ac preserves S
Closed
• S is closed in p iff each action of p preserves S
We will use the abbreviation
{S} p {T} for ( ac : ac p : {S} ac {T})
• Observe:
- S is closed in p iff {S} p {S}
- true is closed in p is always true
- false is closed in p is always true
The temporal modality closed is used to prove safety properties
Leads-to
• S leads-to R in p iff each computation of p that starts at a state where S holds eventually reaches a state where R holds
• Observe:
- leads-to is reflexive: T leads-to T
- leads-to is transitive: if T leads-to S and S leads-to R, then T leads-to R
• The temporal modality leads-to is used to prove progress properties
Leads-to (contd.)
• If S is closed, one way to prove S leads-to R in p is in terms of a variant function
• A variant function is a mapping from the state space of p to a set W that is well-founded under a relation <
A set W is well-founded under < iff every <-chain of W-elements is finite
A <-chain is one where the successor of every element in the chain is < the element
• To prove S leads-to R, show that at any state where S holds, either R holds or executing any action of p decreases the value of the variant function
Since the variant function value cannot decrease infinitely, it follows that eventually a state is reached where R holds
Proofs of Program Correctness
• To simplify the proof of program correctness, we distinguish one state predicate as the invariant of p
• S is a invariant of p iff S is closed and every computation of p that starts at a state where S holds satisfies the specification
• Observe:
Since the invariant S is closed, it holds at all states in all computations of p that start at states where S holds
Thus, S characterizes the set of all states that p reaches from some set of states
It follows that reachability analysis is one way of calculating the invariant
Proofs of Program Correctness (contd.)
• Observe:
Not every state predicate that is closed in p needs to hold at states where the invariant holds; e.g. false
The proofs of correctness -of safety and of liveness- are carried out with respect to the invariant
• In some case, "auxilliary" (or "thought") variables have to be added to a program to define its invariant
Proof of programs (sequential)
Example 0 : program EUCLID
invariant : gcd(x,y) = gcd(X,Y)
variant function : (x max y) + { or
x + y + {
0 if x=y o=x
1 if xy ox
0 if x=y o=x
1 if xy ox
Proof of programs (sequential)
Example 1 : program BBSORT
invariant : x is a permutation of INIT_x
0 j m k N
(n : 0 n < j : x.n x.(n+1) n=N-1)
(n : k n < j : x.m x.n)
(n,l : 0 n < j j l < N : x.n x.l)
variant function : N-j , N-k
Proof of programs (sequential)
Example 2 : program HYSORT
invariant : x is a permutation of INIT_x
variant function : ( j : 0 j < N : N-j X.j )
Alternative Model for Proving Program Correctness:Sequence of actions
• Let b and c be actions of p
• We say b commutes over c iff
the effect of executing b followed by c is identical to
the effect of executing c followed by b