SLIDE 1
Verification of Erlang-style Concurrency
Emanuele D’Osualdo, Jonathan Kochems and Luke Ong
Department of Computer Science University of Oxford
11 September 2012
The goal
1
Veri fi cation of Erlang-style Concurrency Emanuele DOsualdo , - - PowerPoint PPT Presentation
Veri fi cation of Erlang-style Concurrency Emanuele DOsualdo , - - PowerPoint PPT Presentation
Veri fi cation of Erlang-style Concurrency Emanuele DOsualdo , Jonathan Kochems and Luke Ong Department of Computer Science University of Oxford 11 September 2012 1 The goal Automatic Veri fi cation 1 The goal Automatic Veri fi cation of
SLIDE 2
SLIDE 3
The goal
1
- f
Automatic Verification
SLIDE 4
The goal
1
- f
Automatic Verification Properties
SLIDE 5
The goal
1
- f
- f
Automatic Verification Properties
SLIDE 6
The goal
1
- f
- f
Automatic Verification Properties Concurrent Systems
SLIDE 7
The goal
1
- f
- f
Automatic Verification Properties Concurrent Systems based on Message Passing
SLIDE 8
The goal
1
- f
- f
Automatic Verification Properties Concurrent Systems based on the Actor Model
SLIDE 9
The goal
1
- f
- f
Automatic Verification Properties Erlang programs
functional sequential fragment dynamic process creation asynchronous message passing
SLIDE 10
The goal
1
- f
- f
Effective Sound Approximation Properties Erlang programs
functional sequential fragment dynamic process creation asynchronous message passing
SLIDE 11
The goal
1
- f
- f
Effective Sound Approximation Reachability Erlang programs
functional sequential fragment dynamic process creation asynchronous message passing
SLIDE 12
Example: Erathostene’s sieve
2
Running Example: a concurrent version of Erathostene’s sieve Inspired by: Rob Pike. Concurrency and message passing in Newsqueak. Google Tech Talks, 2007.
SLIDE 13
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✮ ❝❧✐❡♥t
SLIDE 14
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✮ ❝❧✐❡♥t poke
SLIDE 15
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✮ ❝❧✐❡♥t poke
SLIDE 16
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✮ ❝❧✐❡♥t poke poke
SLIDE 17
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✮ ❝❧✐❡♥t poke poke
SLIDE 18
Example: Erathostene’s sieve
3
1 ❝♦✉♥t❡r✭◆✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❋r♦♠✦④❛♥s✱ ◆⑥✱
4
❝♦✉♥t❡r✭◆✰✶✮
5
❡♥❞✳
❝♦✉♥t❡r✭◆✰✶✮ ❝❧✐❡♥t poke N
SLIDE 19
Example: Erathostene’s sieve
4
1 ♠❛✐♥✭✮ → 2
▼ ❂ s❡❧❢✭✮✱
3
❈ ❂ s♣❛✇♥✭❝♦✉♥t❡r✱❬✷❪✮✱
4
s♣❛✇♥✭s✐❡✈❡✱ ❬❈✱▼❪✮✳
❝♦✉♥t❡r✭✷✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙ ❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 20
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✷✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙ ❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 21
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✷✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 22
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✷✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 23
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
2
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 24
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
2
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 25
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
prime 2
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 26
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❈✱▼✮
❙
2
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 27
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 28
Example: Erathostene’s sieve
4
1 s✐❡✈❡✭■♥✱ ❖✉t✮ → 2
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
3
r❡❝❡✐✈❡ ④❛♥s✱❳⑥ →
4
❖✉t✦④♣r✐♠❡✱❳⑥✱
5
❋ ❂ s♣❛✇♥✭❢✉♥✭✮→
6
❢✐❧t❡r✭❞✐✈❴❜②✭❳✮✱ ■♥✮
7
❡♥❞✮✱
8
s✐❡✈❡✭❋✱❖✉t✮
9
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 29
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 30
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 31
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✸✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 32
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 3
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 33
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 3
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 34
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 3
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 35
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✶✱▼✮
❙
2 3
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 36
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 37
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 38
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 39
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✹✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 40
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✺✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 4
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 41
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✺✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 poke
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 42
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✻✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 5
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 43
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✻✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 5
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 44
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✻✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 5
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 45
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✻✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✷✱▼✮
❙
2 3 5
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 46
Example: Erathostene’s sieve
4
1 ❢✐❧t❡r✭❚❡st✱ ■♥✮ → 2
r❡❝❡✐✈❡ ④♣♦❦❡✱ ❋r♦♠⑥ →
3
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❋r♦♠✮
4
❡♥❞✳
5 6 ❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮ → 7
■♥✦④♣♦❦❡✱ s❡❧❢✭✮⑥✱
8
r❡❝❡✐✈❡ ④❛♥s✱❨⑥ →
9
❝❛s❡ ❚❡st✭❨✮ ♦❢
10
❢❛❧s❡ →
11
❖✉t✦④❛♥s✱❨⑥✱
12
❢✐❧t❡r✭❚❡st✱ ■♥✮❀
13
tr✉❡ →
14
❢✐❧t❡r✭❚❡st✱ ■♥✱ ❖✉t✮
15
❡♥❞
16
❡♥❞✳
❝♦✉♥t❡r✭✻✮
❈
♠❛✐♥
▼ ❢✐❧t❡r✭❞✐✈❴❜②✭✷✮✳✳ ❋✶ ❢✐❧t❡r✭❞✐✈❴❜②✭✸✮✳✳ ❋✷
s✐❡✈❡✭❋✸✱▼✮
❙
2 3 5
❢✐❧t❡r✭❞✐✈❴❜②✭✺✮✳✳ ❋✸
SLIDE 47
Erlang
5
Erlang: Pure functional sequential fragment Call-by-value Dynamically typed Higher Order Process creation: s♣❛✇♥ / s❡❧❢ Message passing: r❡❝❡✐✈❡ / send P ✦ ▼s❣ Send is asynchronous, receive is blocking Jim Larson. Erlang for concurrent programming. Communications of the ACM, 2009.
SLIDE 48
Related Work
6
Bug-finding tools:
SLIDE 49
Related Work
6
Bug-finding tools: Dialyzer (Lindahl&Sagonas) based on control-flow-analysis, success types and detection of wrong use of built-ins
SLIDE 50
Related Work
6
Bug-finding tools: Dialyzer (Lindahl&Sagonas) based on control-flow-analysis, success types and detection of wrong use of built-ins QuickCheck (Arts et al.) / PropEr (Sagonas’ group) property-based testing
SLIDE 51
Related Work
6
Bug-finding tools: Dialyzer (Lindahl&Sagonas) based on control-flow-analysis, success types and detection of wrong use of built-ins QuickCheck (Arts et al.) / PropEr (Sagonas’ group) property-based testing
SLIDE 52
Related Work
7
Verification tools:
SLIDE 53
Related Work
7
Verification tools: McErlang (Fredlund&Svensson) instrumented custom runtime which exhaustively explores (on-the-fly) all the execution paths. Parametrised by user-provided abstractions
SLIDE 54
Related Work
7
Verification tools: McErlang (Fredlund&Svensson) instrumented custom runtime which exhaustively explores (on-the-fly) all the execution paths. Parametrised by user-provided abstractions Termination and soundness depend entirely on user params
SLIDE 55
Related Work
7
Verification tools: McErlang (Fredlund&Svensson) instrumented custom runtime which exhaustively explores (on-the-fly) all the execution paths. Parametrised by user-provided abstractions Termination and soundness depend entirely on user params Abstract Model Checking (Huch) reduction of the operational semantics to a sound finite transition system via user-provided data-abstractions
SLIDE 56
Related Work
7
Verification tools: McErlang (Fredlund&Svensson) instrumented custom runtime which exhaustively explores (on-the-fly) all the execution paths. Parametrised by user-provided abstractions Termination and soundness depend entirely on user params Abstract Model Checking (Huch) reduction of the operational semantics to a sound finite transition system via user-provided data-abstractions Applies to a very restricted fragment of Erlang
SLIDE 57
Erlang
8
Goals: SAFETY PRECISION
SLIDE 58
Erlang
8
Goals: SAFETY PRECISION
Prove safety
SLIDE 59
Erlang
8
Goals: SAFETY PRECISION
Prove safety Infinite state abstract model
SLIDE 60
Erlang
8
Goals: SAFETY PRECISION
Prove safety Infinite state abstract model Must abstract to be automatic!
SLIDE 61
Why is it difficult to verify?
9
Sources of infinity in the state space: recursive function definitions higher order infinite domains of values message space is infinite unbounded dynamic processes creation mailboxes have unbounded capacity
SLIDE 62
Why is it difficult to verify?
9
Sources of infinity in the state space: recursive function definitions CFA-like abs higher order CFA-like abs infinite domains of values CFA-like abs message space is infinite unbounded dynamic processes creation mailboxes have unbounded capacity
SLIDE 63
Why is it difficult to verify?
9
Sources of infinity in the state space: recursive function definitions CFA-like abs higher order CFA-like abs infinite domains of values CFA-like abs message space is infinite CFA-like abs unbounded dynamic processes creation CFA-like abs mailboxes have unbounded capacity CFA-like abs Using methodology from Van Horn & Might. Abstracting Abstract Machines. ICFP, 2010.
SLIDE 64
Why is it difficult to verify?
9
Sources of infinity in the state space: recursive function definitions CFA-like abs higher order CFA-like abs infinite domains of values CFA-like abs message space is infinite finite abs unbounded dynamic processes creation counter abs mailboxes have unbounded capacity counter abs
SLIDE 65
Actor Communicating Systems
10
We define an abstract model: finite set of control states q finite set of messages ♠ finite set of pid-classes ι finite set of rules:
- Seq. red.
ι: q
τ
− − − − → q′ Send ι: q
ι′!♠
− − − − − → q′ Receive ι: q
?♠
− − − − − → q′ Spawn ι: q
νι′.q′
− − − − − − − → q′′
SLIDE 66
Actor Communicating Systems
10
We define an abstract model: finite set of control states q finite set of messages ♠ finite set of pid-classes ι finite set of rules:
- Seq. red.
ι: q
τ
− − − − → q′ Send ι: q
ι′!♠
− − − − − → q′ Receive ι: q
?♠
− − − − − → q′ Spawn ι: q
νι′.q′
− − − − − − − → q′′ They are equivalent to Vector Addition Systems (VAS)
SLIDE 67
Erlang and ACS mailboxes
11
Erlang
◗ → r❡❝❡✐✈❡ ❛ → ❆❀ ❜ → ❇❀ ❝ → ❈ ❡♥❞✳
◗ ③, ❜, ❛, ❛ ❇ ③, ❛, ❛ ◗ ❛ ❆ ◗ ❜ ❇ ◗ ❝ ❈ ◗ ❛ ❜ ❝ ③ ❇ ❛ ❜ ❝ ③ ❆ ❛ ❜ ❝ ③
SLIDE 68
Erlang and ACS mailboxes
11
Erlang
◗ → r❡❝❡✐✈❡ ❛ → ❆❀ ❜ → ❇❀ ❝ → ❈ ❡♥❞✳
◗ ③, ❜, ❛, ❛ ❇ ③, ❛, ❛ ◗ ❛ ❆ ◗ ❜ ❇ ◗ ❝ ❈ ◗ ❛ ❜ ❝ ③ ❇ ❛ ❜ ❝ ③ ❆ ❛ ❜ ❝ ③ Finite State control + FIFFO queue is Turing Powerful
SLIDE 69
Erlang and ACS mailboxes
11
Erlang
◗ → r❡❝❡✐✈❡ ❛ → ❆❀ ❜ → ❇❀ ❝ → ❈ ❡♥❞✳
◗ ③, ❜, ❛, ❛ ❇ ③, ❛, ❛ ACS ι: ◗
?❛
− − − − − → ❆ ι: ◗
?❜
− − − − − → ❇ ι: ◗
?❝
− − − − − → ❈ ◗ ❛ ❜ ❝ ③ ❇ ❛ ❜ ❝ ③ ❆ ❛ ❜ ❝ ③
SLIDE 70
Erlang and ACS mailboxes
11
Erlang
◗ → r❡❝❡✐✈❡ ❛ → ❆❀ ❜ → ❇❀ ❝ → ❈ ❡♥❞✳
◗ ③, ❜, ❛, ❛ ❇ ③, ❛, ❛ ACS ι: ◗
?❛
− − − − − → ❆ ι: ◗
?❜
− − − − − → ❇ ι: ◗
?❝
− − − − − → ❈ ◗ ❛ ❜ ❝ ③ 2 1 1 ❇ ❛ ❜ ❝ ③ 2 1 ❆ ❛ ❜ ❝ ③ 1 1 1
SLIDE 71
Erlang and ACS mailboxes
11
Erlang
◗ → r❡❝❡✐✈❡ ❛ → ❆❀ ❜ → ❇❀ ❝ → ❈ ❡♥❞✳
◗ ③, ❜, ❛, ❛ ❇ ③, ❛, ❛ ACS ι: ◗
?❛
− − − − − → ❆ ι: ◗
?❜
− − − − − → ❇ ι: ◗
?❝
− − − − − → ❈ ◗ ❛ ❜ ❝ ③ 2 1 1 ❇ ❛ ❜ ❝ ③ 2 1 ❆ ❛ ❜ ❝ ③ 1 1 1 ACS mailboxes over-approximate Erlang ones
SLIDE 72
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
SLIDE 73
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
- 1
+1
- Seq. reduction
ι1: q0
τ
− − − − → q1
SLIDE 74
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
- 1
+1 +1
Send ι1: q0
ι0 ! m1
− − − − − − − → q1
SLIDE 75
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
- 1
+1
- 1
Receive ι1: q0
?m1
− − − − − → q1
SLIDE 76
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
- 1
+1 +1
Spawn ι1: q0
νι0.q0
− − − − − − → q1
SLIDE 77
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
Interesting properties: Mutual Exclusion v(ι1, q1) < 2
SLIDE 78
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
Interesting properties: Absence of error v(ι1, q1) = 0
SLIDE 79
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
Interesting properties: Bound on mailbox
- 0≤i≤k v(ι1, mi) ≤ B
SLIDE 80
Underlying VAS
12
ι0 . . . . . . control states mailbox ι1 . . . . . . ιp . . . . . . pid-classes . . . . . . q0 m0 q1 m1 qn−1 mk−1 qn mk
Interesting properties: Coverability queries (Expspace-complete)
SLIDE 81
Verification pathway
13
Our method:
1 (Core) Erlang code as source 2 A k-CFA-like analysis abstracts the control-flow 3 The analysis produces an ACS which soundly approximates the
program
4 Model-check the ACS with VAS coverability engine (BFC)
The analysis is parametric and can be tuned for accuracy.
SLIDE 82
In the paper
14
What’s in the paper: A fully formal description of the parametric analysis Formal definition of ACS generation, with polynomial bounds
- n size of the model
Formal proofs of soundness and termination A tool with some benchmarks (available as virtual machine and web-interface)
SLIDE 83
Soter
15
ACS BFC model
Coverab. Query Elang module +prop. annot. Core Elang module erlc
Analysis Data Abs Msg Abs
bfc
Gen.
SAFE UNSAFE (ERROR)
Mailbox Abs Context Abs Simpl Phase 3 Phase 1 Phase 2
❤tt♣✿✴✴♠❥♦❧♥✐r✳❝s✳♦①✳❛❝✳✉❦✴s♦t❡r✴
SLIDE 84
Future Work
16
Planned work includes support for full Erlang improve precision wrt:
- process identities
- stack behaviour
find ways to handle open systems
SLIDE 85