A High-Level Language for Modeling Algorithms and their Properties - PowerPoint PPT Presentation

A High-Level Language for Modeling Algorithms and their Properties Sabina Akhtar Stephan Merz Martin Quinson LORIA – INRIA Nancy Grand Est and Nancy University, Nancy, France SBMF 2010 1 / 55

Outline Introduction 1 Background Motivations for P LUS C AL -2 P LUS C AL -2 2 The Language The Statements The Compiler Results 3 Verification of P LUS C AL -2 algorithms Comparison with P LUS C AL 4 Summary 2 / 55

Background Formal verification of concurrent and distributed systems Problems like deadlocks, race conditions,... TLA + : Specification language developed by Leslie Lamport a language based on mathematical set theory TLC : Model checker for verifying TLA + specifications Leslie Lamport. Specifying Systems, The TLA+ Language and Tools for Hardware and Software Engineers. Addison-Wesley, 2002. 3 / 55

An Example Lamport’s Mutual Exclusion Algorithm 4 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 5 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 6 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 7 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 8 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 9 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 10 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 11 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 12 / 55

TLA+ Specifications ∆ Init = ∧ clock = 0 ∧ . . . ∧ ProcSet = SiteIDs ∪ CommunicatorIDs ∧ pc = [ self ∈ ProcSet �→ CASE self ∈ SiteIDs → ” ncrit ” � self ∈ CommunicatorIDs → ” chkMsg ”] ∆ ncrit ( self ) = ∧ pc [ self ] = ” ncrit ” ∧ . . . ∧ pc ′ = [ pc EXCEPT ![ self ] = ” try ”] ∧ UNCHANGED vars \{ pc } ∆ try ( self ) = ∧ pc [ self ] = ” try ” ∧ . . . . . . ∆ Site ( self ) = ncrit ( self ) ∨ try ( self ) ∨ enter ( self ) ∨ crit ( self ) ∨ exit ( self ) . . . ∆ Communicator ( self ) = chkMsg ( self ) ∆ Next = ∨ ∃ self ∈ SiteIDs : Site ( self ) ∨ ∃ self ∈ CommunicatorIDs : Communicator ( self ) ∨ ( ∧ ∀ self ∈ ProcSet : pc [ self ] = ” Done ” ) ∧ UNCHANGED vars ∆ Spec = Init ∧ ✷ [ Next ] vars 13 / 55

P LUS C AL : A high-level language TLA + : Specification language requires specifications in the form of formulas difficult to write for algorithm designers P LUS C AL : Algorithmic Language proposed by Leslie Lamport for algorithm designers a language for modeling algorithms generates TLA + specifications for a given model Features allows writing informal description of algorithms no complicated concepts constructs for expressing non-determinism Leslie Lamport. The +CAL Algorithm Language. Theoretical Aspects of Computing-ICTAC 2009, number 5684, pp. 36-60. 14 / 55