Lecture 2 Recall A state is an assignment of values to all - - PowerPoint PPT Presentation

β–Ά
lecture 2 recall
SMART_READER_LITE
LIVE PREVIEW

Lecture 2 Recall A state is an assignment of values to all - - PowerPoint PPT Presentation

Oct 23, 2022 349 likes β€’713 views

Lecture 2 Recall A state is an assignment of values to all variables A step is a pair of states A stu'ering step wrt some variable leaves the variable unchanged An ac.on is a predicate over a pair of states If x is a variable in

slide-1
SLIDE 1

Lecture 2

slide-2
SLIDE 2

Recall

  • A state is an assignment of values to all variables
  • A step is a pair of states
  • A stu'ering step wrt some variable leaves the variable unchanged
  • An ac.on is a predicate over a pair of states
  • If x is a variable in the old state, then x’ is the same variable in the new state
  • A behavior is an infinite sequence of states (with an ini=al state)
  • A specifica.on characterizes the ini=al state and ac=ons
slide-3
SLIDE 3

Spec that generates all prime numbers

slide-4
SLIDE 4

Spec that generates all prime numbers

  • ------------------------------ MODULE prime -------------------------------

EXTENDS Naturals VARIABLE p isPrime(q) == q > 1 /\ \A r \in 2..(q-1): q%r /= 0 TypeInvariant == isPrime(p) Init == p = 2 Next == p' > p /\ isPrime(p') /\ \A q \in (p+1)..(p'-1): ~isPrime(q) Spec == Init /\ [] [Next]_p THEOREM Spec => []TypeInvariant

slide-5
SLIDE 5

Some more terms

  • A state func.on is a first-order logic expression
  • A state predicate is a Boolean state func=on
  • A temporal formula is an asser=on about behaviors
  • A theorem of a specifica=on is a temporal formula that holds over

every behavior of the specifica=on

  • If 𝑇 is a specifica=on and 𝐽 is a predicate and 𝑇 β‡’ ☐𝐽 is a theorem

then we call 𝐽 an invariant of 𝑇.

slide-6
SLIDE 6

Temporal Formula

Based on Chapter 8 of Specifying Systems

  • A temporal formula 𝐺 assigns a Boolean value to a behavior 𝜏
  • 𝜏 ⊨ 𝐺 means that 𝐺 holds over 𝜏
  • If 𝑄 is a state predicate, then 𝜏 ⊨ 𝑄 means that 𝑄 holds over the first

state in 𝜏

  • If 𝐡 is an ac=on, then 𝜏 ⊨ 𝐡 means that 𝐡 holds over the first

two states in 𝜏

  • i.e., the first step in 𝜏 is an 𝐡 step
  • note that a state predicate is simply an ac=on without primed variables
  • If 𝐡 is an ac=on, then 𝜏 ⊨ 𝐡 2 means that the first step in 𝜏 is an 𝐡

step or a stubering step with respect to 𝑀

slide-7
SLIDE 7

☐Always

  • 𝜏 ⊨ ☐𝐺 means that 𝐺 holds over every suffix of 𝜏
  • More formally
  • Let 𝜏45 be 𝜏 with the first π‘œ states removed
  • Then 𝜏 ⊨ ☐𝐺 β‰œ βˆ€π‘œ ∈ β„•: 𝜏45 ⊨ 𝐺
slide-8
SLIDE 8

Boolean combina@ons of temporal formulas

  • 𝜏 ⊨ (𝐺 ∧ 𝐻) β‰œ 𝜏 ⊨ 𝐺 ∧ 𝜏 ⊨ 𝐻
  • 𝜏 ⊨ (𝐺 ∨ 𝐻) β‰œ 𝜏 ⊨ 𝐺 ∨ 𝜏 ⊨ 𝐻
  • 𝜏 ⊨ ¬𝐺 β‰œ Β¬ 𝜏 ⊨ 𝐺
  • 𝜏 ⊨ 𝐺 β‡’ 𝐻 β‰œ (𝜏 ⊨ 𝐺) β‡’ 𝜏 ⊨ 𝐻
  • 𝜏 ⊨ (βˆƒπ‘ : 𝐺) β‰œ βˆƒπ‘ : 𝜏 ⊨ 𝐺
  • 𝜏 ⊨ βˆ€π‘  πœ— 𝑇: 𝐺 β‰œ βˆ€π‘  πœ— 𝑇: 𝜏 ⊨ 𝐺

// if 𝑇 is a constant set

slide-9
SLIDE 9

Example

What is the meaning of 𝜏 ⊨ ☐( 𝑦 = 1 β‡’ ☐ 𝑧 > 0 ) ? 𝜏 ⊨ ☐( 𝑦 = 1 β‡’ ☐ 𝑧 > 0 ) ≑ βˆ€π‘œ ∈ β„•: 𝜏45 ⊨ ( 𝑦 = 1 β‡’ ☐ 𝑧 > 0 ) ≑ βˆ€π‘œ ∈ β„•: (𝜏45 ⊨ 𝑦 = 1) β‡’ (𝜏45 ⊨ ☐ 𝑧 > 0 ) ≑ βˆ€π‘œ ∈ β„•: (𝜏45 ⊨ 𝑦 = 1) β‡’ (βˆ€π‘› ∈ β„•: 𝜏45 4M ⊨ 𝑧 > 0 ) If x = 1 in some state, then henceforth y > 0 in all subsequent states Not: once x = 1, x will always be 1. That would be 𝜏 ⊨ ☐( 𝑦 = 1 β‡’ ☐ 𝑦 = 1 )

slide-10
SLIDE 10

Not every temporal formula is a TLA+ formula

  • TLA+ formulas are temporal formulas that are invariant under stu'ering
  • They hold even if you add or remove stubering steps
  • Examples
  • 𝑄 if 𝑄 is a state predicate
  • β˜π‘„ if 𝑄 is a state predicate
  • ☐ 𝐡 2 if 𝐡 is an ac=on and 𝑀 is a state variable (or even state func=on)
  • But not
  • 𝑦N = 𝑦 + 1

not sa=sfied by 𝑦 = 1 ⟢ 𝑦 = 1 ⟢ 𝑦 = 2

  • 𝑦N = 𝑦 + 1 R

sa=sfied by 𝑦 = 1 ⟢ 𝑦 = 1 ⟢ 𝑦 = 3 but not by 𝑦 = 1 ⟢ 𝑦 = 3

  • Yet ☐ 𝑦N = 𝑦 + 1

R is a TLA+ formula!

slide-11
SLIDE 11

HourClock revisi@ed

Module HourClock

  • Variable π’Šπ’”
  • HCini β‰œ β„Žπ‘  ∈ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
  • HCnxt β‰œ β„Žπ‘ β€² = β„Žπ‘  mod 12 + 1
  • HC β‰œ HCini β‹€ β—»[HCnxt]bc

β„Žπ‘  is a parameter of the specifica=on HourClock

slide-12
SLIDE 12

Eventually F

◇𝐺 β‰œ ¬☐¬𝐺 𝜏 ⊨ ◇𝐺 ≑ 𝜏 ⊨ ¬☐¬𝐺 ≑ Β¬(𝜏 ⊨ ☐¬𝐺) ≑ Β¬(βˆ€π‘œ ∈ β„•: 𝜏45 ⊨ ¬𝐺) ≑ Β¬(βˆ€π‘œ ∈ β„•: Β¬(𝜏45 ⊨ 𝐺)) ≑ βˆƒπ‘œ ∈ β„•: (𝜏45 ⊨ 𝐺)

slide-13
SLIDE 13

Eventually an 𝐡 step occurs…

β—‡ 𝐡 2 β‰œ ¬☐ ¬𝐡 2 𝜏 ⊨ β—‡ 𝐡 2 ≑ 𝜏 ⊨ ¬☐ ¬𝐡 2 ≑ Β¬(𝜏 ⊨ ☐ ¬𝐡 2) ≑ Β¬(βˆ€π‘œ ∈ β„•: 𝜏45 ⊨ ¬𝐡 2) ≑ Β¬(βˆ€π‘œ ∈ β„•: 𝜏45 ⊨ (¬𝐡 ∨ 𝑀N = 𝑀)) ≑ βˆƒπ‘œ ∈ β„•: 𝜏45 ⊨ 𝐡 ∧ 𝑀N β‰  𝑀

slide-14
SLIDE 14

HourClock with liveness

clock that never stops

Module HourClock

  • Variable β„Žπ‘ 
  • HCini β‰œ β„Žπ‘  ∈ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
  • HCnxt β‰œ β„Žπ‘ β€² = β„Žπ‘  mod 12 + 1
  • HC β‰œ HCini β‹€ β—»[HCnxt]bc
  • LiveHC β‰œ HC β‹€ ☐(β—‡ HCnxt bc)
slide-15
SLIDE 15

Module Channel with Liveness

Send(d) β‰œ π‘‘β„Žπ‘π‘œ.rdy = π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ π‘€π‘π‘š ⟼ 𝑒, 𝑠𝑒𝑧 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Init β‰œ π‘‘β„Žπ‘π‘œ.val ∈ 𝐸𝑏𝑒𝑏 ∧ π‘‘β„Žπ‘π‘œ.rdy ∈ 0, 1 ∧ π‘‘β„Žπ‘π‘œ.ack = π‘‘β„Žπ‘π‘œ.rdy TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} Next β‰œ βˆƒπ‘’ ∈ 𝐸𝑏𝑒𝑏: π‘‡π‘“π‘œπ‘’ 𝑒 ∨ Recv Spec β‰œ Initβ‹€ β—»[Next]vbw5 R𝑓𝑑𝑀 β‰œ π‘‘β„Žπ‘π‘œ.rdy β‰  π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ 𝑀𝑏l ⟼ π‘‘β„Žπ‘π‘œ. π‘€π‘π‘š, 𝑠𝑒𝑧 ⟼ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Variable π‘‘β„Žπ‘π‘œ Constant 𝐸𝑏𝑒𝑏 π‘€π‘—π‘€π‘“π‘‡π‘žπ‘“π‘‘ β‰œ π‘‡π‘žπ‘“π‘‘ β‹€ ☐(β—‡βŸ¨π‘‚π‘“π‘¦π‘’βŸ©vbw5) ???

slide-16
SLIDE 16

Module Channel with Liveness

Send(d) β‰œ π‘‘β„Žπ‘π‘œ.rdy = π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ π‘€π‘π‘š ⟼ 𝑒, 𝑠𝑒𝑧 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Init β‰œ π‘‘β„Žπ‘π‘œ.val ∈ 𝐸𝑏𝑒𝑏 ∧ π‘‘β„Žπ‘π‘œ.rdy ∈ 0, 1 ∧ π‘‘β„Žπ‘π‘œ.ack = π‘‘β„Žπ‘π‘œ.rdy TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} Next β‰œ βˆƒπ‘’ ∈ 𝐸𝑏𝑒𝑏: π‘‡π‘“π‘œπ‘’ 𝑒 ∨ Recv Spec β‰œ Initβ‹€ β—»[Next]vbw5 R𝑓𝑑𝑀 β‰œ π‘‘β„Žπ‘π‘œ.rdy β‰  π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ 𝑀𝑏l ⟼ π‘‘β„Žπ‘π‘œ. π‘€π‘π‘š, 𝑠𝑒𝑧 ⟼ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Variable π‘‘β„Žπ‘π‘œ Constant 𝐸𝑏𝑒𝑏 π‘€π‘—π‘€π‘“π‘‡π‘žπ‘“π‘‘ β‰œ π‘‡π‘žπ‘“π‘‘ β‹€ ☐(β—‡βŸ¨π‘‚π‘“π‘¦π‘’βŸ©vbw5) ??? Too Strong --- If nothing to send that should be ok

slide-17
SLIDE 17

Module Channel with Liveness

Send(d) β‰œ π‘‘β„Žπ‘π‘œ.rdy = π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ π‘€π‘π‘š ⟼ 𝑒, 𝑠𝑒𝑧 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Init β‰œ π‘‘β„Žπ‘π‘œ.val ∈ 𝐸𝑏𝑒𝑏 ∧ π‘‘β„Žπ‘π‘œ.rdy ∈ 0, 1 ∧ π‘‘β„Žπ‘π‘œ.ack = π‘‘β„Žπ‘π‘œ.rdy TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} Next β‰œ βˆƒπ‘’ ∈ 𝐸𝑏𝑒𝑏: π‘‡π‘“π‘œπ‘’ 𝑒 ∨ Recv Spec β‰œ Initβ‹€ β—»[Next]vbw5 R𝑓𝑑𝑀 β‰œ π‘‘β„Žπ‘π‘œ.rdy β‰  π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ 𝑀𝑏l ⟼ π‘‘β„Žπ‘π‘œ. π‘€π‘π‘š, 𝑠𝑒𝑧 ⟼ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Variable π‘‘β„Žπ‘π‘œ Constant 𝐸𝑏𝑒𝑏 π‘€π‘—π‘€π‘“π‘‡π‘žπ‘“π‘‘ β‰œ π‘‡π‘žπ‘“π‘‘ β‹€ ☐(π‘‘β„Žπ‘π‘œ. rdy β‰  π‘‘β„Žπ‘π‘œ. ack β‡’ β—‡βŸ¨π‘†ecv⟩vbw5)

slide-18
SLIDE 18

Weak Fairness as a liveness condi@on

  • ENABLED ⟨𝐡⟩2 means ac=on A is possible in some state
  • State predicate conjuncts all hold
  • 𝑋𝐺

2 𝐡 β‰œ ☐(☐ENABLED 𝐡 2 β‡’ β—‡βŸ¨π΅βŸ©2)

  • HourClock:

𝑋𝐺

bc(πΌπ·π‘œπ‘¦π‘’)

  • Channel:

𝑋𝐺

bc(𝑆𝑓𝑑𝑀)

slide-19
SLIDE 19

(surprising) Weak Fairness equivalence

  • 𝑋𝐺

2 𝐡 β‰œ ☐(☐ENABLED 𝐡 2 β‡’ β—‡ 𝐡 2

≑ β˜β—‡ Β¬ENABLED 𝐡 2 ∨ β˜β—‡βŸ¨π΅βŸ©2 ≑ β—‡β˜ ENABLED 𝐡 2 β‡’ β˜β—‡ 𝐡 2

  • Always, if 𝐡 is enabled forever, then an 𝐡 step eventually occurs
  • 𝐡 if infinitely oken disabled or infinitely many 𝐡 steps occur
  • If 𝐡 is eventually enabled forever then infinitely many 𝐡 steps occur
slide-20
SLIDE 20

Strong Fairness

  • 𝑇𝐺

2 𝐡 β‰œ β—‡β˜ Β¬ENABLED 𝐡 2 ∨ β˜β—‡βŸ¨π΅βŸ©2

≑ β˜β—‡ ENABLED 𝐡 2 β‡’ β˜β—‡ 𝐡 2

  • 𝐡 is eventually disabled forever or infinitely many 𝐡 steps occur
  • If 𝐡 is infinitely oken enabled then infinitely many 𝐡 steps occur

𝑇𝐺

2 𝐡 : an 𝐡 step must occur if 𝐡 is con=nually enabled

𝑋𝐺

2 𝐡 : an 𝐡 step must occur if 𝐡 is con=nuously enabled

As always, be'er to make the weaker assump.on if you can

slide-21
SLIDE 21

How important is liveness?

  • Liveness rules out behaviors that have only stubering steps
  • Add non-triviality of a specifica=on
  • In prac=ce, β€œeventual” is oken not good enough
  • Instead, need to specify performance requirements
  • Service Level Objec=ves (SLOs)
  • Usually done quite informally
slide-22
SLIDE 22

A β€œFIFO” (async buffered FIFO channel)

Chapter 4 from Specifying Systems

Sender buffer Receiver in

  • ut

channels environment

slide-23
SLIDE 23

Module Channel

Send(d) β‰œ π‘‘β„Žπ‘π‘œ.rdy = π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ π‘€π‘π‘š ⟼ 𝑒, 𝑠𝑒𝑧 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Init β‰œ π‘‘β„Žπ‘π‘œ.val ∈ 𝐸𝑏𝑒𝑏 ∧ π‘‘β„Žπ‘π‘œ.rdy ∈ 0, 1 ∧ π‘‘β„Žπ‘π‘œ.ack = π‘‘β„Žπ‘π‘œ.rdy TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} Next β‰œ βˆƒπ‘’ ∈ 𝐸𝑏𝑒𝑏: π‘‡π‘“π‘œπ‘’ 𝑒 ∨ Recv Spec β‰œ Initβ‹€ β—»[Next]vbw5 R𝑓𝑑𝑀 β‰œ π‘‘β„Žπ‘π‘œ.rdy β‰  π‘‘β„Žπ‘π‘œ.ack ∧ chan’ = [ 𝑀𝑏l ⟼ π‘‘β„Žπ‘π‘œ. π‘€π‘π‘š, 𝑠𝑒𝑧 ⟼ π‘‘β„Žπ‘π‘œ. 𝑠𝑒𝑧, 𝑏𝑑𝑙 ⟼ 1 βˆ’ π‘‘β„Žπ‘π‘œ. 𝑏𝑑𝑙 ] Vπ›π¬π£π›πœπ¦πŸ π’…π’Šπ’ƒπ’ Constant 𝑬𝒃𝒖𝒃

slide-24
SLIDE 24

Instan@a@ng a Channel

π½π‘œπ·β„Žπ‘π‘œ β‰œ INSTANCE π·β„Žπ‘π‘œπ‘œπ‘“π‘š WITH 𝐸𝑏𝑒𝑏 ← 𝑁𝑓𝑑𝑑𝑏𝑕𝑓, π‘‘β„Žπ‘π‘œ ← π‘—π‘œ TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} InChan!TypeInvariant ≑ π‘—π‘œ ∈ π‘€π‘π‘š: 𝑁𝑓𝑑𝑑𝑏𝑕𝑓, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1}

Instan.a.on is Subs.tu.on!

slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28

Parametrized Instan@a@on

(not parameterized instan@a@on J)

π½π‘œπ·β„Žπ‘π‘œ β‰œ INSTANCE π·β„Žπ‘π‘œπ‘œπ‘“π‘š WITH 𝐸𝑏𝑒𝑏 ← 𝑁𝑓𝑑𝑑𝑏𝑕𝑓, π‘‘β„Žπ‘π‘œ ← π‘—π‘œ TypeInvariant β‰œ π‘‘β„Žπ‘π‘œ ∈ π‘€π‘π‘š: 𝐸𝑏𝑒𝑏, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} Chan(in)!TypeInvariant ≑ π‘—π‘œ ∈ π‘€π‘π‘š: 𝑁𝑓𝑑𝑑𝑏𝑕𝑓, 𝑠𝑒𝑧: 0,1 , 𝑏𝑑𝑙: {0,1} π·β„Žπ‘π‘œ(π‘‘β„Ž) β‰œ INSTANCE π·β„Žπ‘π‘œπ‘œπ‘“π‘š WITH 𝐸𝑏𝑒𝑏 ← 𝑁𝑓𝑑𝑑𝑏𝑕𝑓, π‘‘β„Žπ‘π‘œ ← π‘‘β„Ž

slide-29
SLIDE 29

Internal (= Non-Interface) Variables

buffer in

  • ut

There is no q here But there is a q here Not incorrect, but don’t really want q to be a specifica=on parameter

slide-30
SLIDE 30

Hiding Internal Variables

slide-31
SLIDE 31

Hiding Internal Variables

Not the normal existen=al quan=fier!!! In temporal logic, this means that for every state in a behavior, there is a value for q that makes Inner(q)!Spec true

slide-32
SLIDE 32
  • PreYy. Now for something cool!
  • Suppose we wanted to implemented a bounded buffer
  • That is, β—»π‘šπ‘“π‘œ π‘Ÿ ≀ 𝑂 for some constant 𝑂 > 0
  • The only place where q is extended is in BufRcv
slide-33
SLIDE 33
  • PreYy. Now for something cool!
  • Suppose we wanted to implemented a bounded buffer
  • That is, β—»π‘šπ‘“π‘œ π‘Ÿ ≀ 𝑂 for some constant 𝑂 > 0
  • The only place where q is extended is in BufRcv

∧ π‘šπ‘“π‘œ π‘Ÿ < 𝑂

slide-34
SLIDE 34

Even cooler (but tricky)

If it is a BufRcv step, then π‘šπ‘“π‘œ π‘Ÿ < 𝑂

slide-35
SLIDE 35

Even cooler (but tricky)