Noam Rinetzky Lecture 7: Axiomatic Semantics - Concurrency

Program Analysis and Verification 0368-4479http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html Noam Rinetzky Lecture 7: Axiomatic Semantics - Concurrency Slides credit: Roman Manevich, MoolySagiv, EranYahav

Good manners • Mobiles

Home Work Assignment #1 & #2 • #1 due today • Modulo justified extensions • #2 Wednesday • Due lesson 10

Axiomatic Semantics (Hoare Logic) • Programming Language • Syntax (skip | S1;S2 | … ) • Semantics (e.g., states ∑ + StmtsC, ss) • Assertions • Syntax ( x = 3 | x < y + a | …) • Semantics (⟦P⟧ ⊆ ∑ alt. s p P) • Judgments • {P} C {Q}, [P] C [Q] • p {P} C {Q} : s, s’ . (s p P  C, ss’)  s’pQ) • Inference rules • Proofs

Axiomatic semantics for While Axiom for every primitive statement { P[a/x] } x:= a { P } [assp] [skipp] { P } skip { P } { P } S1 { Q }, { Q } S2 { R } { P } S1; S2 { R } [compp] { b P} S1 { Q}, { b P} S2 { Q} { P} if bthenS1elseS2 { Q} { b P } S { P } { P } while bdoS {b P } { P’ } S { Q’ } { P } S { Q } Inference rule for every composed statement [ifp] [whilep] [consp] if PP’ and Q’Q

Factorial proof Goal: { x=n } y:=1; while (x1) do (y:=y*x; x:=x–1) { y=n!  n>0} W = while (x1) do (y:=y*x; x:=x–1) INV = x > 0  (y  x! = n!  n  x) { INV[x-1/x] } x:=x-1{INV} { INV[x-1/x][y*x/y] } y:=y*x { INV[x-1/x] } [comp] { INV[x-1/x][y*x/y] } y:=y*x; x:=x–1{INV} [cons] {x1  INV } y:=y*x; x:=x–1{ INV} [while] { INV } W {x=1  INV} { INV[1/y] } y:=1 { INV } [cons] [cons] { x=n } y:=1 { INV } { INV } W { y=n!  n>0} [comp] { x=n } while (x1) do (y:=y*x; x:=x–1) { y=n!  n>0}

Soundness • The inference system is sound: • p{ P } C { Q } implies p{ P } C { Q }

Soundness and completeness • The inference system is sound: • p{ P } C { Q } implies p{ P } C { Q } • The inference system is relatively complete: • p{ P } C { Q } implies p{ P } C { Q } • ∀A,B. A⇒B • Assertion language is expressive enough

While + Concurrency Abstract syntax: a ::= n | x | a1+a2 | a1a2 | a1–a2 b ::=true|false|a1=a2|a1a2|b|b1b2 S::=x:=a | skip | S1;S2| ifbthenS1elseS2 | whilebdoS | cobeginS1‖ …‖Sncoend

Proofs … … { P2} S2{ Q2} { P1} S1{ Q2} … {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 } Challenge: Interference

Disjoint Parallelism { P2} S2{ Q2} { P1} S1{ Q2} {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 } ∅ FV(P1,S1,Q1) ∩ FV(P2,S2,Q2) =

Global Invariant I ⊢ { P2} S2{ Q2} I ⊢ { P1} S1{ Q2} I ⊢ {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 }

Global Invariant I ⊢ { P } S1 { Q } I ⊢ { Q } S2 { R } I ⊢ { P } S1; S2 { R } I ⊢ { P2} S2{ Q2} I ⊢ { P1} S1{ Q2} I ⊢ {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 }

Global Invariant I ⊢ { P } S1 { R } { P Λ I } S{ Q ΛI } I ⊢ { R } S2 { Q} I ⊢ { P } S1; S2 { Q } I ⊢ { P } S{ Q } I ⊢ { P2} S2{ Q2} I ⊢ { P1} S1{ Q2} I ⊢ {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 }

Owicky-Gries • A command Cwith a precondition pre(C)does not interfere with the proof of {P} S {Q} if: • {Q  pre(C) } C {Q} • For any S’ “∈” S: {pre(S’)  pre(C) } C {pre(S’)} • {P1} C1 {Q1} ... {Pk} Ck {Qk} are interference freeif ∀ i j and ∀x:=a“∈”Ci , x:=a does not interfere with {Pj} Cj {Qj}

Parallel Composition Rule I ⊢ { P2} S2{ Q2} I ⊢ { P1} S1{ Q2} I ⊢ {P1 ΛP1} S1‖ S2{ Q2 ΛQ2 } {P1} C1 {Q1} ... {Pk} Ck {Qk} are interference free

Owicky-Gries: Limiations • Checking interference can be hard • Non-compositionality • Until you finished the local proofs cannot check interference • Proofs need to be “saved” • Hard to handle libraries and missing code • A non-standard meaning of Hoare triples • Depends on the interference of other threads with the proof • Soundness is non-trivial • Completeness depends on auxiliary variables

Rely / Guarantee • Aka assume Guarantee • Cliff Jones • Main idea: Modular capture of interference • Compositional proofs

Commands as relations • It is convenient to view the meaning of commands as relations between pre-states and post-states • In {P} C {Q} • P is a one state predicate • Q is a two-state predicate • Recall auxiliary variables • Example • {true} x := x + 1 {x= x + 1}

C C Intuition Hoare: { P} S { Q } ~ {P} ⇒⇒⇒⇒{Q} R/G: R,G⊢{ P} S { Q } ~ {P} ⇒⇒⇒⇒⇒⇒⇒{Q} R G R G G R G

p(, ) =p() p(, ) =p() A single state predicate p is preserved by a two-state relation R if p R p , : p() R(, ) p() From one- to two-state relations

Operations on Relations • (P;Q)(, )=:P(, ) Q(, ) • ID(, )= (=) • R*=IDR (R;R) (R;R;R) … 

Formulas • ID(x) = (x = x) • ID(p) =(pp) • Preserve (p)= pp

Informal Semantics • c (p, R, G, Q) • For every state  such that p: • Every execution of c on state  with (potential) interventions which satisfy R results in a state  such that (, )  Q • The execution of every atomic sub-command of c on any possible intermediate state satisfies G

Informal Semantics • c (p, R, G, Q) • For every state  such that p: • Every execution of c on state  with (potential) interventions which satisfy R results in a state  such that (, )  Q • The execution of every atomic sub-command of c on any possible intermediate state satisfies G • c [p, R, G, Q] • For every state  such that p: • Every execution of c on state  with (potential) interventions which satisfy R must terminate in a state  such that (, )  Q • The execution of every atomic sub-command of c on any possible intermediate state satisfies G

A Formal Semantics • Let CR denotes the set of quadruples <1, 2, 3, 4 > s.t. that when c executes on 1 with potential interferences by R it yields an intermediate state 2 followed by an intermediate state 3 and a final state 4 • as usual 4= when c does not terminate • CR = {<1, 2, 3, 4> :  : <1, >  R  ( <C, > * 2  2 =3= 4   ’, C’: <C, >* <C’, ’ >  ( (2= 1 2 = )  (3 =   3=’)  4= )  <’, 2, 3, 4 >  C’R ) • c (p, R, G, Q) • For every <1, 2, 3 , 4 >  CR such that 1p • < 2, 3>  G • If 4 : <1, 4 >  Q

Simple Examples • X := X + 1  (true, X=X, X =X+1X=X, X =X+1) • X := X + 1  (X 0, X X, X>0 X=X, X>0) • X := X + 1 ; Y := Y + 1  (X 0Y 0, X X  YY, G, X>0 Y>0)

Inference Rules • Define c  (p, R, G, Q) by structural induction on c • Soundness • If c  (p, R, G, Q) then c  (p, R, G, Q)

(Atomic) atomic {c}  (p, preserve(p), QID, Q) Atomic Command {p} c {Q}

(Critical) await b then c  (p, preserve(p), QID, Q) Conditional Critical Section {pb} c {Q}

(SEQ) c1 ; c2 (p1, R, G, (Q1; R*; Q2)) Sequential Composition c1(p1, R, G, Q1) c2(p2, R, G, Q2) Q1 p2

(IF) if atomic {b} then c1 else c2 (p, R, G, Q) Conditionals c1(p b1, R, G, Q) p b  R* b1 c2(p b2, R, G, Q) p b  R* b2

(WHILE) while atomic {b} do c  (j, R, G, b j) Loops c (j b1, R, G, j) j b  R* b1 R  Preserve(j)

(REFINE) c  (p’, R’, G’, Q’) Refinement c (p, R, G, Q) p’ p Q Q’ R’  R G  G’

(PAR) c1 || c2 (p1 p1, (R1R2), (G1G2), Q) where Q= (Q1 ; (R1R2)*; Q2) (Q2 ; (R1R2)*; Q1) Parallel Composition c1(p1, R1, G1, Q1) c2(p2, R2, G2, Q2) G1 R2 G2 R1

Issues in R/G • Total correctness is trickier • Restrict the structure of the proofs • Sometimes global proofs are preferable • Many design choices • Transitivity and Reflexivity of Rely/Guarantee • No standard set of rules • Suitable for designs

Noam Rinetzky Lecture 7: Axiomatic Semantics - Concurrency