Proving Liveness of Parameterized Programs Zachary Kincaid - - PowerPoint PPT Presentation

▶
proving liveness of parameterized programs
SMART_READER_LITE
LIVE PREVIEW

Proving Liveness of Parameterized Programs Zachary Kincaid - - PowerPoint PPT Presentation

Apr 07, 2024 316 likes •884 views

Proving Liveness of Parameterized Programs Zachary Kincaid University of Toronto & Princeton University July 5, 2016 Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg no matter how many

slide-1
SLIDE 1

Proving Liveness of Parameterized Programs

Zachary Kincaid University of Toronto & Princeton University July 5, 2016

Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg

slide-2
SLIDE 2

global t : int // ticket counter global s : int // service counter local m : int // my ticket init s = t do forever { m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter } Goal: Prove that no thread starves

  • no matter how many threads there are
  • automatically
slide-3
SLIDE 3

global t : int // ticket counter global s : int // service counter local m : int // my ticket init s = t do forever { m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter } Goal: Prove that no thread starves

  • no matter how many threads there are
  • automatically
slide-4
SLIDE 4

global t : int // ticket counter global s : int // service counter local m : int // my ticket init s = t do forever { m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter } Goal: Prove that no thread starves

  • no matter how many threads there are
  • automatically
slide-5
SLIDE 5

global t : int // ticket counter global s : int // service counter local m : int // my ticket init s = t do forever { m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter } Goal: Prove that no thread starves

  • no matter how many threads there are
  • automatically
slide-6
SLIDE 6

A parameterized concurrent program, P:

  • thread template = finite directed graph with edges labeled by

instructions (in some programming language). Call the set of instructions Σ.

  • For any N ∈ N, P(N) denotes the program with N identical threads, all
  • f which execute P.

m:=t++ [m>=s] s++ [m<s]

slide-7
SLIDE 7

A trace is a sequence τ = ⟨σ1 : i1⟩⟨σ2 : i2⟩... ∈ ( Σ × N )ω Program instructions Thread identifiers

  • Associate linear-time property

w/ set of traces that satisfy it.

  • Associate P N w/ set of traces

P N N corresponding to interleaved paths through the thread template

  • Program traces

P

N

P N

  • P correct

every error trace in P is infeasible.

slide-8
SLIDE 8

A trace is a sequence τ = ⟨σ1 : i1⟩⟨σ2 : i2⟩... ∈ ( Σ × N )ω Program instructions Thread identifiers

  • Associate linear-time property Φ w/ set of traces L(Φ) that satisfy it.
  • Associate P N w/ set of traces

P N N corresponding to interleaved paths through the thread template

  • Program traces

P

N

P N

  • P correct

every error trace in P is infeasible.

slide-9
SLIDE 9

A trace is a sequence τ = ⟨σ1 : i1⟩⟨σ2 : i2⟩... ∈ ( Σ × N )ω Program instructions Thread identifiers

  • Associate linear-time property Φ w/ set of traces L(Φ) that satisfy it.
  • Associate P(N) w/ set of traces L(P(N)) ⊆ (Σ × {1, ..., N})ω

corresponding to interleaved paths through the thread template

  • Program traces

P

N

P N

  • P correct

every error trace in P is infeasible.

slide-10
SLIDE 10

A trace is a sequence τ = ⟨σ1 : i1⟩⟨σ2 : i2⟩... ∈ ( Σ × N )ω Program instructions Thread identifiers

  • Associate linear-time property Φ w/ set of traces L(Φ) that satisfy it.
  • Associate P(N) w/ set of traces L(P(N)) ⊆ (Σ × {1, ..., N})ω

corresponding to interleaved paths through the thread template

  • Program traces L(P) =

∪

N

L(P(N))

  • P correct

every error trace in P is infeasible.

slide-11
SLIDE 11

A trace is a sequence τ = ⟨σ1 : i1⟩⟨σ2 : i2⟩... ∈ ( Σ × N )ω Program instructions Thread identifiers

  • Associate linear-time property Φ w/ set of traces L(Φ) that satisfy it.
  • Associate P(N) w/ set of traces L(P(N)) ⊆ (Σ × {1, ..., N})ω

corresponding to interleaved paths through the thread template

  • Program traces L(P) =

∪

N

L(P(N))

  • P correct ⇐

⇒ every error trace in L(P) \ L(Φ) is infeasible.

slide-12
SLIDE 12

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-13
SLIDE 13

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-14
SLIDE 14

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-15
SLIDE 15

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-16
SLIDE 16

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-17
SLIDE 17

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-18
SLIDE 18

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-19
SLIDE 19

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-20
SLIDE 20

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-21
SLIDE 21

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

slide-22
SLIDE 22

Two key problems:

1 How do we generalize proofs?

  • Concurrency: Same proof applies to many interleavings.
  • Parameterization: Same proof applies to many instantiations.

2 How do we check that a proof is complete?

  • P

H R : inclusion between infinite sets of infinite words

  • ver an infinite alphabet
slide-23
SLIDE 23

Two key problems:

1 How do we generalize proofs?

  • Concurrency: Same proof applies to many interleavings.
  • Parameterization: Same proof applies to many instantiations.

2 How do we check that a proof is complete?

  • P

H R : inclusion between infinite sets of infinite words

  • ver an infinite alphabet
slide-24
SLIDE 24

Two key problems:

1 How do we generalize proofs?

  • Concurrency: Same proof applies to many interleavings.
  • Parameterization: Same proof applies to many instantiations.

2 How do we check that a proof is complete?

  • P

H R : inclusion between infinite sets of infinite words

  • ver an infinite alphabet
slide-25
SLIDE 25

⟨m:=t++ : 1⟩⟨m:=t++ : 2⟩

  • Stem

(⟨[m>s] : 2⟩⟨[m<=s] : 1⟩⟨s++ : 1⟩⟨m:=t++ : 1⟩

  • Loop

)ω

  • ld s

s [m>s]

  • ld s

s m

  • ld s

[m<=s]

  • ld s

s m

  • ld s

s++

  • ld s

s m

  • ld s

m:=t++

  • ld s

s m

  • ld s

Variance proof s t m:=t++ true m:=t++ true [m>s] true [m<=s] true s++ true m:=t++ true Invariance proof

slide-26
SLIDE 26

⟨m:=t++ : 1⟩⟨m:=t++ : 2⟩

  • Stem

(⟨[m>s] : 2⟩⟨[m<=s] : 1⟩⟨s++ : 1⟩⟨m:=t++ : 1⟩

  • Loop

)ω {old(s) = s} ⟨[m>s] : 2⟩ {old(s) = s ∧ m(2) ≥ old(s)} ⟨[m<=s] : 1⟩ {old(s) = s ∧ m(2) ≥ old(s)} ⟨s++ : 1⟩ {old(s) < s ∧ m(2) ≥ old(s)} ⟨m:=t++ : 1⟩ { old(s) < s ∧ m(2) ≥ old(s) } Variance proof Ranking formula s t m:=t++ true m:=t++ true [m>s] true [m<=s] true s++ true m:=t++ true Invariance proof

slide-27
SLIDE 27

⟨m:=t++ : 1⟩⟨m:=t++ : 2⟩

  • Stem

(⟨[m>s] : 2⟩⟨[m<=s] : 1⟩⟨s++ : 1⟩⟨m:=t++ : 1⟩

  • Loop

)ω {old(s) = s} ⟨[m>s] : 2⟩ {old(s) = s ∧ m(2) ≥ old(s)} ⟨[m<=s] : 1⟩ {old(s) = s ∧ m(2) ≥ old(s)} ⟨s++ : 1⟩ {old(s) < s ∧ m(2) ≥ old(s)} ⟨m:=t++ : 1⟩ { old(s) < s ∧ m(2) ≥ old(s) } Variance proof {s = t} ⟨m:=t++ : 1⟩ {true} ⟨m:=t++ : 2⟩ {true} ⟨[m>s] : 2⟩ {true} ⟨[m<=s] : 1⟩ {true} ⟨s++ : 1⟩ {true} ⟨m:=t++ : 1⟩ {true} Invariance proof

slide-28
SLIDE 28

{old(s) = s} ⟨[m>s] : 2⟩ {m(2) ≥ old(s)} {old(s) = s} ⟨s++ : 1⟩ {old(s) < s} {ϕ} ⟨σ : i⟩ {ϕ}

slide-29
SLIDE 29

Sequencing

{s ≤ t} m := t++ : 1 {m(1) < t} {m(1) < t} m := t++ : 2 {m(1) < m(2)} s t m := t++ : 1; m := t++ : 2 m m

slide-30
SLIDE 30

Sequencing

{s ≤ t} m := t++ : 1 {m(1) < t} {m(1) < t} m := t++ : 2 {m(1) < m(2)} {s ≤ t} m := t++ : 1; m := t++ : 2 {m(1) < m(2)}

slide-31
SLIDE 31

Symmetry

P(N) = P ∥ P ∥· · · ∥ P

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false}

slide-32
SLIDE 32

Symmetry

P(N) = P ∥ P ∥· · · ∥ P

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false} {s ≤ m(2)∧m(2) < m(1)} [m <= s] : 1 {false} [1 → 2] [2 → 1]

slide-33
SLIDE 33

Symmetry

P(N) = P ∥ P ∥· · · ∥ P

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false} {s ≤ m(2)∧m(2) < m(3)} [m <= s] : 3 {false} [1 → 2] [2 → 3]

slide-34
SLIDE 34

Conjunction

{m(1) < t} m := t++ : 3 {m(1) < m(3)} {m(2) < t} m := t++ : 3 {m(2) < m(3)} m t m t m := t++ : 3 m m m m

slide-35
SLIDE 35

Conjunction

{m(1) < t} m := t++ : 3 {m(1) < m(3)} {m(2) < t} m := t++ : 3 {m(2) < m(3)} {m(1) < t ∧ m(2) < t} m := t++ : 3 {m(1) < m(3) ∧ m(2) < m(3)}

slide-36
SLIDE 36

A Well-founded proof space (WFPS) ⟨H, R⟩ is a set of valid Hoare triples H which is closed under sequencing, symmetry, and conjunction, along with a set of ranking formulas R which is closed under symmetry. H is a set of theorems about finite traces. How do we prove infeasibility of infinite traces?

slide-37
SLIDE 37

A Well-founded proof space (WFPS) ⟨H, R⟩ is a set of valid Hoare triples H which is closed under sequencing, symmetry, and conjunction, along with a set of ranking formulas R which is closed under symmetry. H is a set of theorems about finite traces. How do we prove infeasibility of infinite traces?

slide-38
SLIDE 38

A WFPS ⟨H, R⟩ proves a trace τ infeasible if there is some ranking formula r ∈ R, some decomposition of τ: · · · τ τ1 τ2 τ3 and some sequence of “intermediate formulas” ϕ1, ϕ2, ... such that {pre}τ1{ϕ1} {ϕ1 ∧ old(x) = x}τ2{r} {pre}τ1τ2{ϕ2} {ϕ2 ∧ old(x) = x}τ3{r} . . . {pre}τ1τ2...τi{ϕi} {ϕi ∧ old(x) = x}τi+1{r} all belong to H. The set of traces H R proves infeasible is denoted H R .

slide-39
SLIDE 39

A WFPS ⟨H, R⟩ proves a trace τ infeasible if there is some ranking formula r ∈ R, some decomposition of τ: · · · τ τ1 τ2 τ3 and some sequence of “intermediate formulas” ϕ1, ϕ2, ... such that {pre}τ1{ϕ1} {ϕ1 ∧ old(x) = x}τ2{r} {pre}τ1τ2{ϕ2} {ϕ2 ∧ old(x) = x}τ3{r} . . . {pre}τ1τ2...τi{ϕi} {ϕi ∧ old(x) = x}τi+1{r} all belong to H. The set of traces ⟨H, R⟩ proves infeasible is denoted ω(H, R).

slide-40
SLIDE 40

Two key problems:

1 How do we generalize proofs?

  • Concurrency: Same proof applies to many interleavings.
  • Parameterization: Same proof applies to many instantiations.

2 How do we check that a proof is complete?

  • P

H R : inclusion between infinite sets of infinite words

  • ver an infinite alphabet
slide-41
SLIDE 41

Two key problems:

1 How do we generalize proofs?

  • Concurrency: Same proof applies to many interleavings.
  • Parameterization: Same proof applies to many instantiations.

2 How do we check that a proof is complete?

  • L(P) \ L(Φ) ⊆ ω(H, R): inclusion between infinite sets of infinite words
  • ver an infinite alphabet
slide-42
SLIDE 42

Infinite traces → finite traces

An ultimately periodic trace is a trace of the form πρρρ · · · Every ultimately periodic trace can be written (not uniquely) as a lasso π$ρ. Given a language L ⊆ Σω, define its lasso language $(L) as: $(L) = {π$ρ : πρω ∈ L} Theorem If P H R , then P H R .

  • For any N

, P N is

  • regular. Same for

and H R .

  • Fact: If L and L are
  • regular, then UP L

L implies L L .

slide-43
SLIDE 43

Infinite traces → finite traces

An ultimately periodic trace is a trace of the form πρρρ · · · Every ultimately periodic trace can be written (not uniquely) as a lasso π$ρ. Given a language L ⊆ Σω, define its lasso language $(L) as: $(L) = {π$ρ : πρω ∈ L} Theorem If $(L(P)) \ $(L(Φ)) ⊆ $(ω(H, R)), then L(P) \ L(Φ) ⊆ ω(H, R).

  • For any N

, P N is

  • regular. Same for

and H R .

  • Fact: If L and L are
  • regular, then UP L

L implies L L .

slide-44
SLIDE 44

Infinite traces → finite traces

An ultimately periodic trace is a trace of the form πρρρ · · · Every ultimately periodic trace can be written (not uniquely) as a lasso π$ρ. Given a language L ⊆ Σω, define its lasso language $(L) as: $(L) = {π$ρ : πρω ∈ L} Theorem If $(L(P)) \ $(L(Φ)) ⊆ $(ω(H, R)), then L(P) \ L(Φ) ⊆ ω(H, R).

  • For any N ∈ N, L(P) ∩ (Σ × {1, ..., N})ω is ω-regular. Same for L(Φ)

and ω(H, R).

  • Fact: If L1 and L2 are ω-regular, then UP(L1) ⊆ L2 implies L1 ⊆ L2.
slide-45
SLIDE 45

Infinite language → automaton

Quantified Predicate Automata (QPA): a class of infinite-state automata that recognize words over an infinite alphabet.

  • There is a QPA that recognizes

P .

  • There is a QPA that recognizes

.

  • There is not a QPA that recognizes

H R .

slide-46
SLIDE 46

Infinite language → automaton

Quantified Predicate Automata (QPA): a class of infinite-state automata that recognize words over an infinite alphabet.

  • There is a QPA that recognizes $(L(P)).
  • There is a QPA that recognizes

.

  • There is not a QPA that recognizes

H R .

slide-47
SLIDE 47

Infinite language → automaton

Quantified Predicate Automata (QPA): a class of infinite-state automata that recognize words over an infinite alphabet.

  • There is a QPA that recognizes $(L(P)).
  • There is a QPA that recognizes $(L(Φ)).
  • There is not a QPA that recognizes

H R .

slide-48
SLIDE 48

Infinite language → automaton

Quantified Predicate Automata (QPA): a class of infinite-state automata that recognize words over an infinite alphabet.

  • There is a QPA that recognizes $(L(P)).
  • There is a QPA that recognizes $(L(Φ)).
  • There is not a QPA that recognizes $(ω(H, R)).
slide-49
SLIDE 49

But...

There is a QPA that recognizes all lassos π$ρ such that there exists some intermediate assertion ϕ and some ranking formula r ∈ R such that {pre}π{ϕ} and {ϕ ∧ old(x) = x}ρ{r} belong to H. Call this language $(H, R). Membership of in H R does not imply that H R . It does not even imply that is infeasible! Theorem If P H R , then P H R .

slide-50
SLIDE 50

But...

There is a QPA that recognizes all lassos π$ρ such that there exists some intermediate assertion ϕ and some ranking formula r ∈ R such that {pre}π{ϕ} and {ϕ ∧ old(x) = x}ρ{r} belong to H. Call this language $(H, R). Membership of π$ρ in $(H, R) does not imply that πρω ∈ ω(H, R). It does not even imply that πρω is infeasible! Theorem If P H R , then P H R .

slide-51
SLIDE 51

But...

There is a QPA that recognizes all lassos π$ρ such that there exists some intermediate assertion ϕ and some ranking formula r ∈ R such that {pre}π{ϕ} and {ϕ ∧ old(x) = x}ρ{r} belong to H. Call this language $(H, R). Membership of π$ρ in $(H, R) does not imply that πρω ∈ ω(H, R). It does not even imply that πρω is infeasible! Theorem If $(L(P)) \ $(L(Φ)) ⊆ $(H, R), then L(P) \ L(Φ) ⊆ ω(H, R).

slide-52
SLIDE 52

But...

There is a QPA that recognizes all lassos π$ρ such that there exists some intermediate assertion ϕ and some ranking formula r ∈ R such that {pre}π{ϕ} and {ϕ ∧ old(x) = x}ρ{r} belong to H. Call this language $(H, R). Membership of π$ρ in $(H, R) does not imply that πρω ∈ ω(H, R). It does not even imply that πρω is infeasible! Theorem If $(L(P)) \ $(L(Φ)) ⊆ $(H, R), then L(P) \ L(Φ) ⊆ ω(H, R).

  • πρω ∈ L(P)\L(Φ) ⇒ πρn$ρk ∈ $(L(P))\$(L(Φ)) for all n ≥ 0, k ≥ 1.
  • H contains {pre}πρn{ϕn,k} and {ϕn,k ∧ old(x) = x}ρk{rn,k}. Ramsey!
slide-53
SLIDE 53

But...

There is a QPA that recognizes all lassos π$ρ such that there exists some intermediate assertion ϕ and some ranking formula r ∈ R such that {pre}π{ϕ} and {ϕ ∧ old(x) = x}ρ{r} belong to H. Call this language $(H, R). Membership of π$ρ in $(H, R) does not imply that πρω ∈ ω(H, R). It does not even imply that πρω is infeasible! Theorem If $(L(P)) \ $(L(Φ)) ⊆ $(H, R), then L(P) \ L(Φ) ⊆ ω(H, R). QPA language containment can be used to check proofs

slide-54
SLIDE 54

Summary

Two key problems:

1 How do we generalize proofs?

  • Well-founded proof spaces

2 How do we check that a proof is complete?

  • Lassos + Quantified Predicate Automata
slide-55
SLIDE 55

Thanks!