Revisiting Auxiliary Variables Stephan Merz joint work with Leslie Lamport Inria & LORIA, Nancy, France IFIP Working Group 2.2 Bordeaux, September 2017 Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 1 / 24
Specifications of State Machines Standard way of describing algorithms ◮ initial condition, next-state relation express what may happen ◮ fairness / liveness conditions assert what must happen Part of the state may be hidden ◮ do not expose implementation details ◮ delimit observable behavior that should be implemented Concrete syntax: TLA + ∃ ∃ x : Init ∧ � [ Next ] vars ∧ L ∃ ∃ ∃ ∃ Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 2 / 24
Refinement of State Machines From high-level specification to concrete implementation ◮ executions of lower-level state machine coherent with specification ◮ formally: inclusion of set of (observable) state sequences ( ∃ ∃ y : Impl ) ⇒ ( ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ x : Spec ) Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 3 / 24
Refinement of State Machines From high-level specification to concrete implementation ◮ executions of lower-level state machine coherent with specification ◮ formally: inclusion of set of (observable) state sequences ( ∃ ∃ y : Impl ) ⇒ ( ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ ∃ x : Spec ) Standard proof technique: refinement mapping ◮ reconstruct high-level internal state from low-level state Impl ⇒ Spec { f / x } ◮ pointwise computation of internal state components Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 3 / 24
Example: Compute the Maximum Input Value First specification: store the set of all inputs ∆ Init 1 = inp = {} ∧ lastinp = − ∞ ∧ max = − ∞ = inp ′ = inp ∪ { x } ∧ lastinp ′ = x ∧ max ′ = Max ( inp ′ ) ∆ Input 1 ( x ) ∆ Next 1 = ∃ x ∈ Int : Input 1 ( x ) ∆ = ∃ ∃ ∃ Spec 1 ∃ ∃ ∃ inp , lastinp : Init 1 ∧ � [ Next 1 ] � inp , lastinp , max � Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 4 / 24
Example: Compute the Maximum Input Value First specification: store the set of all inputs ∆ Init 1 = inp = {} ∧ lastinp = − ∞ ∧ max = − ∞ = inp ′ = inp ∪ { x } ∧ lastinp ′ = x ∧ max ′ = Max ( inp ′ ) ∆ Input 1 ( x ) ∆ Next 1 = ∃ x ∈ Int : Input 1 ( x ) ∆ = ∃ ∃ ∃ Spec 1 ∃ ∃ ∃ inp , lastinp : Init 1 ∧ � [ Next 1 ] � inp , lastinp , max � Second specification: store just the maximum value ∆ Init 2 = lastinp = − ∞ ∧ max = − ∞ = lastinp ′ = x ∧ max ′ = IF x > max THEN x ELSE max ∆ Input 2 ( x ) ∆ Next 2 = ∃ x ∈ Int : Input 2 ( x ) ∆ = ∃ ∃ ∃ ∃ ∃ ∃ lastinp : Init 2 ∧ � [ Next 2 ] � lastinp , max � Spec 2 Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 4 / 24
Example: Compute the Maximum Input Value First specification: store the set of all inputs ∆ Init 1 = inp = {} ∧ lastinp = − ∞ ∧ max = − ∞ = inp ′ = inp ∪ { x } ∧ lastinp ′ = x ∧ max ′ = Max ( inp ′ ) ∆ Input 1 ( x ) ∆ Next 1 = ∃ x ∈ Int : Input 1 ( x ) ∆ = ∃ ∃ ∃ Spec 1 ∃ ∃ ∃ inp , lastinp : Init 1 ∧ � [ Next 1 ] � inp , lastinp , max � Second specification: store just the maximum value ∆ Init 2 = lastinp = − ∞ ∧ max = − ∞ = lastinp ′ = x ∧ max ′ = IF x > max THEN x ELSE max ∆ Input 2 ( x ) ∆ Next 2 = ∃ x ∈ Int : Input 2 ( x ) ∆ = ∃ ∃ ∃ ∃ ∃ ∃ lastinp : Init 2 ∧ � [ Next 2 ] � lastinp , max � Spec 2 What is the formal relationship between the two specifications? Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 4 / 24
Proving Refinement The two specifications are equivalent ◮ they generate same externally visible behaviors (variable max ) Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 5 / 24
Proving Refinement The two specifications are equivalent ◮ they generate same externally visible behaviors (variable max ) Spec 1 refines Spec 2 prove invariant max = Max(inp) 1 use identical refinement mapping for variable lastinp 2 Spec 1 ∧ � ( max = Max ( inp )) ⇒ Init 2 ∧ � [ Next 2 ] � lastinp , max � Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 5 / 24
Proving Refinement The two specifications are equivalent ◮ they generate same externally visible behaviors (variable max ) Spec 1 refines Spec 2 prove invariant max = Max(inp) 1 use identical refinement mapping for variable lastinp 2 Spec 1 ∧ � ( max = Max ( inp )) ⇒ Init 2 ∧ � [ Next 2 ] � lastinp , max � Spec 2 refines Spec 1 ◮ holds semantically, but no refinement mapping ◮ cannot compute set of inputs given the maximum value Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 5 / 24
Proving Refinement The two specifications are equivalent ◮ they generate same externally visible behaviors (variable max ) Spec 1 refines Spec 2 prove invariant max = Max(inp) 1 use identical refinement mapping for variable lastinp 2 Spec 1 ∧ � ( max = Max ( inp )) ⇒ Init 2 ∧ � [ Next 2 ] � lastinp , max � Spec 2 refines Spec 1 ◮ holds semantically, but no refinement mapping ◮ cannot compute set of inputs given the maximum value Refinement mappings alone are incomplete Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 5 / 24
Auxiliary Variables Augment implementation, then construct refinement mapping ∃ a : Impl a Impl ≡ ∃ ∃ ∃ ∃ ∃ specific rules justifying auxiliary variables: 1 Impl a ⇒ ∃ ∃ ∃ augmented specification refines high-level: ∃ ∃ ∃ x : Spec 2 Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 6 / 24
Auxiliary Variables Augment implementation, then construct refinement mapping ∃ a : Impl a Impl ≡ ∃ ∃ ∃ ∃ ∃ specific rules justifying auxiliary variables: 1 Impl a ⇒ ∃ ∃ ∃ augmented specification refines high-level: ∃ ∃ ∃ x : Spec 2 Two particular kinds of auxiliary variables ◮ history variables: record information about previous states ◮ prophecy variables: predict information about future states Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 6 / 24
Auxiliary Variables Augment implementation, then construct refinement mapping ∃ a : Impl a Impl ≡ ∃ ∃ ∃ ∃ ∃ specific rules justifying auxiliary variables: 1 Impl a ⇒ ∃ ∃ ∃ augmented specification refines high-level: ∃ ∃ ∃ x : Spec 2 Two particular kinds of auxiliary variables ◮ history variables: record information about previous states ◮ prophecy variables: predict information about future states Classic reference M. Abadi, L. Lamport. The Existence of Refinement Mappings. TCS (1991). ◮ introduces history and prophecy variables ◮ proves completeness under certain conditions ◮ closely related: forward / backward simulations Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 6 / 24
Outline Refinement Mappings 1 History Variables 2 Simple Prophecy Variables 3 Arrays of Auxiliary Variables 4 Stuttering Variables 5 Establishing Completeness 6 Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 7 / 24
Record Information About Past States Update history variable at every transition ∃ h : Spec ∧ h = h 0 ∧ � [ vars ′ � = vars ∧ h ′ = f ( h )] � vars , h � Spec ≡ ∃ ∃ ∃ ∃ ∃ ◮ variable h does not occur in Spec , vars or h 0 ◮ term f ( h ) does not contain h ′ ◮ h 0 is the initial value of the history variable ◮ f represents the update function applied at every observable step Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 8 / 24
Record Information About Past States Update history variable at every transition ∃ h : Spec ∧ h = h 0 ∧ � [ vars ′ � = vars ∧ h ′ = f ( h )] � vars , h � Spec ≡ ∃ ∃ ∃ ∃ ∃ ◮ variable h does not occur in Spec , vars or h 0 ◮ term f ( h ) does not contain h ′ ◮ h 0 is the initial value of the history variable ◮ f represents the update function applied at every observable step Example: step counter ∃ h : Spec ∧ h = 0 ∧ � [ vars ′ � = vars ∧ h ′ = h + 1 ] � vars , h � Spec ≡ ∃ ∃ ∃ ∃ ∃ ◮ similar: record the input values during executions of Spec 2 Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 8 / 24
Parameterized Refinement Mappings Idea: many refinement mappings are better than one introduce parameterized specification equivalent to low-level spec 1 Impl ≡ ∃ β ∈ S : PImpl ( β ) define separate refinement mappings per parameter value 2 ∀ β ∈ S : PImpl ( β ) ⇒ Spec { f ( β ) / x } Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 9 / 24
Parameterized Refinement Mappings Idea: many refinement mappings are better than one introduce parameterized specification equivalent to low-level spec 1 Impl ≡ ∃ β ∈ S : PImpl ( β ) define separate refinement mappings per parameter value 2 ∀ β ∈ S : PImpl ( β ) ⇒ Spec { f ( β ) / x } Example: introduce a downward counter = n = 0 ∧ � [ n ′ = n + 1 ] � n � ∧ ♦� [ n ′ = n ] � n � ∆ Impl = n = 0 ∧ k ∈ N ∧ � [ k > 0 ∧ n ′ = n + 1 ∧ k ′ = k − 1 ] � k , n � ∆ Spec Prove Impl ⇒ ∃ ∃ ∃ ∃ ∃ ∃ k : Spec Stephan Merz Revisiting Auxiliary Variables WG 2.2, 2017-09 9 / 24
Recommend
More recommend
