Proving Liveness of Parameterized Programs Zachary Kincaid - PowerPoint PPT Presentation

Proving Liveness of Parameterized Programs Zachary Kincaid University of Toronto & Princeton University July 5, 2016 Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg

• no matter how many threads there are • automatically // busy wait Goal: Prove that no thread starves } // bump service counter s++ // critical section } until (m <= s) global t : int // ticket counter // acquire ticket m := t++ do forever { // my ticket local m : int // service counter global s : int do { init s = t

• no matter how many threads there are • automatically // busy wait Goal: Prove that no thread starves } // bump service counter s++ // critical section } until (m <= s) global t : int // ticket counter // acquire ticket m := t++ do forever { // my ticket local m : int // service counter global s : int do { init s = t

• automatically // ticket counter Goal: Prove that no thread starves } // bump service counter s++ // critical section } until (m <= s) // busy wait global t : int // acquire ticket m := t++ do forever { // my ticket local m : int // service counter global s : int do { init s = t • no matter how many threads there are

global t : int // ticket counter Goal: Prove that no thread starves } // bump service counter s++ // critical section } until (m <= s) // busy wait do { // acquire ticket m := t++ do forever { // my ticket local m : int // service counter global s : int init s = t • no matter how many threads there are • automatically

A parameterized concurrent program, P : instructions (in some programming language). Call the set of of which execute P . m:=t++ [m>=s] s++ [m<s] • thread template = finite directed graph with edges labeled by instructions Σ . • For any N ∈ N , P ( N ) denotes the program with N identical threads, all

• Associate linear-time property • Associate P N w/ set of traces • Program traces • P correct is infeasible. P every error trace in P N N P corresponding to interleaved paths through the thread template Program instructions N P N that satisfy it. w/ set of traces Thread identifiers A trace is a sequence τ = ⟨ σ 1 : i 1 ⟩⟨ σ 2 : i 2 ⟩ ... ∈ ( Σ × N ) ω

• Associate P N w/ set of traces • Program traces • P correct Program instructions Thread identifiers P N N corresponding to interleaved paths through the thread template P N P N every error trace in P is infeasible. A trace is a sequence τ = ⟨ σ 1 : i 1 ⟩⟨ σ 2 : i 2 ⟩ ... ∈ ( Σ × N ) ω • Associate linear-time property Φ w/ set of traces L (Φ) that satisfy it.

• Program traces • P correct Program instructions Thread identifiers corresponding to interleaved paths through the thread template P N P N every error trace in P is infeasible. A trace is a sequence τ = ⟨ σ 1 : i 1 ⟩⟨ σ 2 : i 2 ⟩ ... ∈ ( Σ × N ) ω • Associate linear-time property Φ w/ set of traces L (Φ) that satisfy it. • Associate P ( N ) w/ set of traces L ( P ( N )) ⊆ (Σ × { 1 , ..., N } ) ω

• P correct Program instructions Thread identifiers corresponding to interleaved paths through the thread template N every error trace in P is infeasible. A trace is a sequence τ = ⟨ σ 1 : i 1 ⟩⟨ σ 2 : i 2 ⟩ ... ∈ ( Σ × N ) ω • Associate linear-time property Φ w/ set of traces L (Φ) that satisfy it. • Associate P ( N ) w/ set of traces L ( P ( N )) ⊆ (Σ × { 1 , ..., N } ) ω ∪ • Program traces L ( P ) = L ( P ( N ))

Program instructions Thread identifiers corresponding to interleaved paths through the thread template N A trace is a sequence τ = ⟨ σ 1 : i 1 ⟩⟨ σ 2 : i 2 ⟩ ... ∈ ( Σ × N ) ω • Associate linear-time property Φ w/ set of traces L (Φ) that satisfy it. • Associate P ( N ) w/ set of traces L ( P ( N )) ⊆ (Σ × { 1 , ..., N } ) ω ∪ • Program traces L ( P ) = L ( P ( N )) • P correct ⇐ ⇒ every error trace in L ( P ) \ L (Φ) is infeasible.

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Property fails! Proof Generalization

• Concurrency: Same proof applies to many interleavings. • Parameterization: Same proof applies to many instantiations. Two key problems: 1 How do we generalize proofs? 2 How do we check that a proof is complete? • P H R : inclusion between infinite sets of infinite words over an infinite alphabet

• Parameterization: Same proof applies to many instantiations. Two key problems: 1 How do we generalize proofs? 2 How do we check that a proof is complete? • P H R : inclusion between infinite sets of infinite words over an infinite alphabet • Concurrency: Same proof applies to many interleavings.

Two key problems: 1 How do we generalize proofs? 2 How do we check that a proof is complete? • P H R : inclusion between infinite sets of infinite words over an infinite alphabet • Concurrency: Same proof applies to many interleavings. • Parameterization: Same proof applies to many instantiations.

Invariance proof m:=t++ old s m:=t++ old s s m old s Variance proof s t true s m:=t++ true [m>s] true [m<=s] true s++ true m:=t++ true m old s s Loop old s m s old s [m<=s] old s m s old s [m>s] s++ old s Stem ⟨ m:=t++ : 1 ⟩⟨ m:=t++ : 2 ⟩ ( ⟨ [m>s] : 2 ⟩⟨ [m<=s] : 1 ⟩⟨ s++ : 1 ⟩⟨ m:=t++ : 1 ⟩ ) ω � �� � � �� �

Invariance proof true s t m:=t++ true m:=t++ true [m>s] Loop Variance proof [m<=s] true s++ true Stem m:=t++ true Ranking formula ⟨ m:=t++ : 1 ⟩⟨ m:=t++ : 2 ⟩ ( ⟨ [m>s] : 2 ⟩⟨ [m<=s] : 1 ⟩⟨ s++ : 1 ⟩⟨ m:=t++ : 1 ⟩ ) ω � �� � � �� � { old ( s ) = s } ⟨ [m>s] : 2 ⟩ { old ( s ) = s ∧ m (2) ≥ old ( s ) } ⟨ [m<=s] : 1 ⟩ { old ( s ) = s ∧ m (2) ≥ old ( s ) } ⟨ s++ : 1 ⟩ { old ( s ) < s ∧ m (2) ≥ old ( s ) } ⟨ m:=t++ : 1 ⟩ { old ( s ) < s ∧ m (2) ≥ old ( s ) }

Invariance proof Stem Variance proof Loop ⟨ m:=t++ : 1 ⟩⟨ m:=t++ : 2 ⟩ ( ⟨ [m>s] : 2 ⟩⟨ [m<=s] : 1 ⟩⟨ s++ : 1 ⟩⟨ m:=t++ : 1 ⟩ ) ω � �� � � �� � { s = t } ⟨ m:=t++ : 1 ⟩ { true } ⟨ m:=t++ : 2 ⟩ { old ( s ) = s } { true } ⟨ [m>s] : 2 ⟩ ⟨ [m>s] : 2 ⟩ { old ( s ) = s ∧ m (2) ≥ old ( s ) } { true } ⟨ [m<=s] : 1 ⟩ ⟨ [m<=s] : 1 ⟩ { old ( s ) = s ∧ m (2) ≥ old ( s ) } { true } ⟨ s++ : 1 ⟩ ⟨ s++ : 1 ⟩ { old ( s ) < s ∧ m (2) ≥ old ( s ) } { true } ⟨ m:=t++ : 1 ⟩ ⟨ m:=t++ : 1 ⟩ { old ( s ) < s ∧ m (2) ≥ old ( s ) } { true }

{ old ( s ) = s } { old ( s ) = s } { ϕ } ⟨ [m>s] : 2 ⟩ ⟨ s++ : 1 ⟩ ⟨ σ : i ⟩ { m (2) ≥ old ( s ) } { old ( s ) < s } { ϕ }

Sequencing m := t++ : 1 m := t++ : 2 s t m := t++ : 1; m := t++ : 2 m m { s ≤ t } { m (1) < t } { m (1) < t } { m (1) < m (2) }

Sequencing m := t++ : 1 m := t++ : 2 m := t++ : 1; m := t++ : 2 { s ≤ t } { s ≤ t } { m (1) < t } { m (1) < t } { m (1) < m (2) } { m (1) < m (2) }

Symmetry N times [m <= s] : 2 P ( N ) = P ∥ P ∥· · · ∥ P � �� � { s ≤ m (1) ∧ m (1) < m (2) } { false }

Symmetry N times [m <= s] : 2 [m <= s] : 1 P ( N ) = P ∥ P ∥· · · ∥ P � �� � { s ≤ m (1) ∧ m (1) < m (2) } { s ≤ m (2) ∧ m (2) < m (1) } [1 �→ 2] [2 �→ 1] { false } { false }

Symmetry N times [m <= s] : 2 [m <= s] : 3 P ( N ) = P ∥ P ∥· · · ∥ P � �� � { s ≤ m (1) ∧ m (1) < m (2) } { s ≤ m (2) ∧ m (2) < m (3) } [1 �→ 2] [2 �→ 3] { false } { false }

Conjunction m := t++ : 3 m := t++ : 3 m t m t m := t++ : 3 m m m m { m (1) < t } { m (2) < t } { m (1) < m (3) } { m (2) < m (3) }