Créer une présentation
Télécharger la présentation

Télécharger la présentation
## Picturing program execution

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -

**Picturing program execution**Tony Hoare and Peter O’Hearn November 2008**1. Traces**are sets of atomic events linked by data flow drawn as a labelled arrow**Atomic Events**e f**A program command**R1 := R1+y**a traceis a set of events**d!(x – z) c?z R1:=r1 + y d?y**with arrowslinking dependent events**d!(x–z) c?z R1:=R1 + y d?y**labelled by locations**z c d!(x–z) c?z z x d x x := x + y d?y y y x**...and by values transmitted**z c 3 3 d!(x–z) c?z z 3 x d 9 x 12 x := x + y 5 d?y y y 9 7 x 12**Dependence**• p q means perhaps • q uses a value assigned by p • or p outputs a value input by q • or p releases a resource used next by q • Define separation between pairs of events as absence of dependence**Four degrees of separation**• p ( ) q = p q • p (;) q = p q & q p • p (||)q = p q & q p & p q • p ([]) q = false • Theorems: ([]) (||) (;) (*) ([]) (||) (*) commute p ([]) p = p (;) p = p (||) p = p (*) p = false**Separation of traces**• We define four separation operators splitting a trace into separate parts. • The weakest is disjoint union of events: tr = tp + tq tr = tp tq & p,q. p ε tp & q ε tq p ( ) q (equivalently, tr = tp tq &tp tq = { } )**Separation of traces**• sequence: tr = tp ; tq tr = tp tq & p,q. p εtp & q εtq p (;) q • parallel: tr = tp || tq tr = tp tq & p,q. p εtp & q εtq p (||) q • choice: tr = tp [] tq tr = tp tq & p,q. p εtp & q εtq false (equivalently, tr = tp tq & (tp = {} V tq = {}) )**A trace tr**may be split in four ways**concurrently**tp+tq**sequentially**tp ; tq**Disjointly**tp || tq**by Choice**tp[]tq**Linearity theorem**e ε tr tp, tq . tr = (tp ; {e} ; tq) Proof: tp = {d|d … e} and is acyclic tq tp + e**Programs are predicates**We identify program P with a predicate P(tr) which describes each of its possible traces. The free variable tr refers to an arbitrary trace. We define total binary separators over programs by ‘lifting’ the trace separators to predicates**Concurrency (fine-grained)**(P*Q) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp+ tq any trace tr of (P*Q) can be split into tp and tq, where tp is a trace of P and tq is a trace of Q, and tp is disjoint from tq .**Sequential composition**(P ; Q) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp; tq any trace tr of (P;Q) can be split into tp and tqwhere tp is a trace of P and tq is a trace of Q , and tp nowhere depends on tq.**Parallel composition (disjoint)**(P||Q) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp || tq Any trace tr of (P||Q) can be split into tp and tqwhere tp is a trace of P and tqis a trace of Q , and tp is everywhere separate from tq.**Choice**(P[]Q) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp[] tq Any trace tr of (P[]Q) can be split into tp and tqwhere tp is a trace of P and tqis a trace of Q , and either tp or tq is empty.**Conjunction (not separating)**(P&Q) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp tq & tp= tq Any trace tr of (P&Q) can be split into tp and tqwhere tp is a trace of P and tqis a trace of Q , and tp is the same as tq.**Disjunction (not choice)**(PvQ) (tr) = tp, tq. P(tp) & Q(tq) & tr = tp tq & tp = tq Any trace tr of (PvQ) is either a trace of P or a trace of Q ,**Implicationsearlier lines imply the later lines**P [] Q P || Q P ; Q P * Q Proof: ([]) (;) (||) (*)**2. The logic of programming**familiar axioms of the Hoare calculus are derived as theorems**Theorems**Our proofs use only the properties (;) (*) and (*) commutes They apply to any such pair of relations [P Q] means tr . P(tr) Q(tr) P = Q means[P Q] & [Q P]**Theorems**(P ; Q) ; R = P ; (Q ; R) association P ; (Q V R) = (P ; Q) V (P ; R) distribution (Q V R) ; P = (Q ; P) V (Q ; R) [P Q] [P ; R Q ; R] monotonicity & [R ; P R ; Q] Proof: Predicate calculus only**Theorems**Def: skip tr = { } P ; skip = P = skip ; P unit skip P ; false = false = false ; P zero false valid for all separators including P [] false = false (versus P false = false)**Hoare Triples**Def: P { Q } R tr. (P ; Q)(tr) R(tr) Theorems P { Q } R & P { Q } R’ P { Q } R & R’ P { Q } R & P’ { Q } R (P V P’) { Q } R P { Q } S & S { Q’ } R P { Q ; Q’ } R P { Q } R & P {Q’ } R P { Q V Q’ } R**Galois connection**Def: (Q ; R)(tp) tq. Q(tq) R(tp; tq) Theorem:P {Q} R [P (Q ; R)] Q ; R = weakest prespec (Q, R) specifies what is needed before Q to achieve R Theorems: (Q -; R) ; Q R P Q -; (P ; Q) Proof: Predicate calculus**Program algebra**(P * Q) ; R P * (Q ; R) (*assoc;) P ; (Q * R) (P ; Q) * R (*assoc;) (P*Q) ; (R*S) (P;R) * (Q;S) (*exchange;) Proofs: event algebra.**(P * Q ) ; R P * (Q ; R)**• RHS has less prohibitions than LHS. P P R R Q Q**Separation logic (Theorems)**P { Q } R F * P { Q } F * R frame P { Q } R & P’ { Q’ } R’ P * P’ { Q * Q’ } R * R’concurrency • Proof: program algebra**P { Q } R F * P { Q } F * R**• LHS = P ; Q R (def { }) so F * (P ; Q) F * R (* mon) (F * P) ; Q F * R (*assoc;) = RHS (def { })**3. Rely/guarantee calculus**extends sequential reasoning to concurrent programs**Invariant algebra**Def: G G’(tr) = (r. r εtr G({r}) V G’({r}) ) Thm: G;G’ G G’ and G*G G G’, etc. Def: G is invariant iffG = G G or equivalently, G(tr) = (r. r εtr G({r}) ) Thm: G({ }) G(tp tq) = G(tp) & G(tq) G;G = G and G*G = G .... etc.**Guarantee conditionsdescribe commitment of thread to**environment Def: Q guar G [Q G] , for G invariant Thm: skip guar G (tr = {e}) guar G G({e}) Q guar G & Q’ guar G’ (Q ; Q’) guar (G G’) and(Q * Q’) guar (G G’) ...etc**Rely conditionsdescribe the environment of a thread**Thm: If R and R’ are invariant, so is R&R’ R & R’ (R ; R’) andR & R’ (R*R’) ,... etc. R*{e} R ; {e} ; R (R & R’) * (Q ; Q’) (R * Q) ; (R’ * Q’) (R & R’) * (Q * Q’) (R * Q) * (R’ * Q’)**R*{e} R ; {e} ; R**LHS = ts . R(ts) & tr = ts + {e} tr1, tr2 . tr = tr1 ; {e} ; tr2 (linearity) tr1, tr2 . R(tr1) & R(tr2) & tr = tr1 ; {e} ; tr2 RHS R * {e} * R (event algebra) R * R * {e} (* assoc comm) LHS (R invariant)**Jones quintuple**Def: P R {Q} G S P {R*Q} S & Q guar G where G and R are invariants Thm: P R {skip} G P if P {R} P P R {e} G S P {R ; e ; R} S & G({e}) P R {Q} G S & S R’ {Q’} G’ S’ P R&R’ {Q ; Q’} (G G’) S’**Concurrency**[G’ R] & [G R’] & P R {Q} G S & P’ R’ {Q’} G’ S’ P&P’ R&R’ {Q * Q’} (G G’) S&S’**Example**LetR = R’ = G = G’ = P = P’ = (a . a ε tr n > 0. prog(a) = {x := x + n } ) S = (R & a . a ε tr & prog(a) = {x := x + 1}) S’ = (R & a . a ε tr & prog(a) = {x := x + 2}) Then P R {x := x + 1 | x := x + 2} G S&S’ a very weak result, because we cannot rely on memory.**4. Arrows**cross interfaces carry values between events as described by assertions**arrows**d!(x–z) c?z x := x + y d?y**Source and target**a0 a’ Def: a0 is the source event of arrow a Def: a’ is the target event of arrow a • Def: e f = a . e = a0 & f = a’ • defines what was earlier an undefined primitive • so all previous theorems remain true**Boundary**• drawn around an arbitrary set of events**External boundary**Def: in(tr) = {a|a’ εtr & a0 tr} Def: out(tr) = {a|a0εtr & a’ tr} Thm: in(tr) out(tr) = { }**Internal boundary**tq tp Thm: out(tp*tq) = out(tp)\in(tq) out(tq)\in(tp) in(tp*tq) = in(tp)\out(tq) in(tq)\out(tp) … the same for the other three separators