TLAPS : The TLA + Proof System Stephan Merz joint work with K. Chaudhuri, D. Cousineau, D. Doligez, L. Lamport INRIA Nancy Microsoft Research - INRIA Joint Centre Saclay http://www.msr-inria.inria.fr/Projects/tools-for-formal-specs Deduction at Scale, Schloss Ringberg March 2011 TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 1 / 23
Overview The TLA + Specification Language 1 Theorem Proving With TLAPS 2 The TLA + Proof Language 3 Conclusions 4 TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 2 / 23
Euclid’s Algorithm in TLA + (1/2) We start by defining divisibility and GCD MODULE Euclid EXTENDS Naturals ∆ = Nat \ { 0 } PosInteger ∆ Maximum ( S ) = CHOOSE x ∈ S : ∀ y ∈ S : x ≥ y ∆ d | q = ∃ k ∈ 1 .. q : q = k ∗ d \ * definition of divisibility ∆ Divisors ( q ) = { d ∈ 1 .. q : d | q } \ * set of divisors ∆ GCD ( p , q ) = Maximum ( Divisors ( p ) ∩ Divisors ( q )) Standard mathematical definitions ◮ TLA + is based on (untyped) set theory ◮ simple module language for structuring larger specification ◮ import TLA + library module Naturals for basic arithmetic ◮ TLA + module contains declarations, assertions, and definitions TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 3 / 23
Euclid’s Algorithm in TLA + (2/2) Now model the algorithm and assert its correctness CONSTANTS M, N ∆ = M ∈ PosInteger ∧ N ∈ PosInteger ASSUME Positive VARIABLES x, y ∆ Init = x = M ∧ y = N = x < y ∧ y ′ = y − x ∧ x ′ = x ∆ SubX = y < x ∧ x ′ = x − y ∧ y ′ = y ∆ SubY ∆ = Init ∧ � [ SubX ∨ SubY ] � x , y � Spec ∆ Correctness = x = y ⇒ x = GCD ( M , N ) THEOREM Spec ⇒ � Correctness Transitions represented by action formulas SubX , SubY Algorithm represented by initial condition and next-state relation Correctness expressed as TLA formula TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 4 / 23
Euclid’s Algorithm in TLA + (2/2) Now model the algorithm and assert its correctness CONSTANTS M, N ∆ = M ∈ PosInteger ∧ N ∈ PosInteger constant formula ASSUME Positive VARIABLES x, y state formula ∆ Init = x = M ∧ y = N = x < y ∧ y ′ = y − x ∧ x ′ = x ∆ SubX action formulas = y < x ∧ x ′ = x − y ∧ y ′ = y ∆ SubY ∆ = Init ∧ � [ SubX ∨ SubY ] � x , y � Spec temporal formula ∆ Correctness = x = y ⇒ x = GCD ( M , N ) THEOREM Spec ⇒ � Correctness Transitions represented by action formulas SubX , SubY Algorithm represented by initial condition and next-state relation Correctness expressed as TLA formula TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 4 / 23
Verification of Euclid’s Algorithm: Model Checking TLC : explicit-state model checker ◮ verify correctness properties for finite instances ◮ Euclid: fix concrete values for M and N ◮ check that the result is correct for these inputs Variation: verify correctness over fixed interval Invaluable for debugging TLA + models ◮ verify many seemingly trivial properties ◮ type correctness, executability of every individual action, . . . ◮ absence of deadlock, eventual response to requests, . . . ◮ reveal corner cases before attempting full correctness proof TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 5 / 23
Overview The TLA + Specification Language 1 Theorem Proving With TLAPS 2 The TLA + Proof Language 3 Conclusions 4 TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 6 / 23
Using TLAPS to Prove Euclid’s Algorithm Correct Verify correctness for all possible inputs TLAPS : proof assistant for verifying TLA + specifications ◮ interesting specifications cannot be verified fully automatically ◮ user provides proof (skeleton) to guide verification ◮ automatic back-end provers discharge leaf obligations TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 7 / 23
Using TLAPS to Prove Euclid’s Algorithm Correct Verify correctness for all possible inputs TLAPS : proof assistant for verifying TLA + specifications ◮ interesting specifications cannot be verified fully automatically ◮ user provides proof (skeleton) to guide verification ◮ automatic back-end provers discharge leaf obligations Application to Euclid’s algorithm ◮ first step: strengthen correctness property � inductive invariant ∆ = ∧ x ∈ PosInteger InductiveInvariant ∧ y ∈ PosInteger ∧ GCD ( x , y ) = GCD ( M , N ) TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 7 / 23
Underlying Data Properties The algorithm relies on the following properties of GCD ∆ THEOREM GCDSelf = ASSUME NEW p ∈ PosInteger GCD ( p , p ) = p PROVE ∆ THEOREM GCDSymm = ASSUME NEW p ∈ PosInteger , NEW q ∈ PosInteger GCD ( p , q ) = GCD ( q , p ) PROVE ∆ THEOREM GCDDiff = ASSUME NEW p ∈ PosInteger , NEW q ∈ PosInteger , p < q GCD ( p , q ) = GCD ( p , q − p ) PROVE ASSUME . . . PROVE : TLA + notation for sequents We won’t bother proving these properties here TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 8 / 23
Proving an Invariant in TLA + Inv ∧ [ Next ] v ⇒ Inv ′ Init ⇒ Inv Inv ⇒ Corr Init ∧ � [ Next ] v ⇒ � Corr TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 9 / 23
Proving an Invariant in TLA + Inv ∧ [ Next ] v ⇒ Inv ′ Init ⇒ Inv Inv ⇒ Corr Init ∧ � [ Next ] v ⇒ � Corr Representation as a TLA + sequent ∆ THEOREM ProveInv = ASSUME STATE Init , STATE Inv , STATE Corr , ACTION Next , STATE v , Init ⇒ Inv , Inv ∧ [ Next ] v ⇒ Inv ′ , Inv ⇒ Corr Init ∧ � [ Next ] v ⇒ � Corr PROVE Currently, TLAPS doesn’t handle temporal logic We’ll prove the non-temporal hypotheses TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 9 / 23
Simple Proofs Prove that InductiveInvariant implies Correctness LEMMA InductiveInvariant ⇒ Correctness OBVIOUS TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 10 / 23
Simple Proofs Prove that InductiveInvariant implies Correctness LEMMA InductiveInvariant ⇒ Correctness BY GCDSelf DEFS InductiveInvariant , Correctness ◮ by default, definitions and facts must be cited explicitly ◮ this helps manage the size of the search space for backend provers TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 10 / 23
Simple Proofs Prove that InductiveInvariant implies Correctness LEMMA InductiveInvariant ⇒ Correctness BY GCDSelf DEFS InductiveInvariant , Correctness ◮ by default, definitions and facts must be cited explicitly ◮ this helps manage the size of the search space for backend provers Prove that Init implies InductiveInvariant LEMMA Init ⇒ InductiveInvariant BY Positive DEFS Init , InductiveInvariant To prove simple theorems, expand definitions and cite facts TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 10 / 23
Hierarchical Proofs Complex proofs consist of a sequence of claims, ending with QED Prove that all transitions preserve InductiveInvariant LEMMA InductiveInvariant ∧ [ SubX ∨ SubY ] � x , y � ⇒ InductiveInvariant ′ TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 11 / 23
Hierarchical Proofs Complex proofs consist of a sequence of claims, ending with QED Prove that all transitions preserve InductiveInvariant LEMMA InductiveInvariant ∧ [ SubX ∨ SubY ] � x , y � ⇒ InductiveInvariant ′ � 1 � USE DEF InductiveInvariant ◮ (scoped) USE DEF causes TLAPS to silently expand definitions TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 11 / 23
Hierarchical Proofs Complex proofs consist of a sequence of claims, ending with QED Prove that all transitions preserve InductiveInvariant LEMMA InductiveInvariant ∧ [ SubX ∨ SubY ] � x , y � ⇒ InductiveInvariant ′ � 1 � USE DEF InductiveInvariant � 1 � 1. ASSUME InductiveInvariant , SubX InductiveInvariant ′ PROVE � 1 � 2. ASSUME InductiveInvariant , SubY InductiveInvariant ′ PROVE ◮ The steps � 1 � 1 and � 1 � 2 will be proved subsequently TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 11 / 23
Hierarchical Proofs Complex proofs consist of a sequence of claims, ending with QED Prove that all transitions preserve InductiveInvariant LEMMA InductiveInvariant ∧ [ SubX ∨ SubY ] � x , y � ⇒ InductiveInvariant ′ � 1 � USE DEF InductiveInvariant � 1 � 1. ASSUME InductiveInvariant , SubX InductiveInvariant ′ PROVE � 1 � 2. ASSUME InductiveInvariant , SubY InductiveInvariant ′ PROVE � 1 � q . QED BY � 1 � 1, � 1 � 2 ◮ QED step verifies that the lemma follows from above steps — includes trivial case UNCHANGED � x , y � TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 11 / 23
Hierarchical Proofs: Sublevels ( ... ) � 1 � 1. ASSUME InductiveInvariant , SubX InductiveInvariant ′ PROVE � 1 � 2. ASSUME InductiveInvariant , SubY InductiveInvariant ′ PROVE ( ... ) TLAPS : The TLA + Proof System Stephan Merz (INRIA Nancy) Deduction at Scale, 03/2011 12 / 23
Recommend
More recommend
