An Axiomatic Proof Technique for Parallel Programs

1. An Axiomatic Proof Technique for Parallel Programs Susan Owicki & David Gries Presented by Omer Katz Seminar in Distributed Algorithms Spring 2013 29/04/13

2. What’s next? • What are we trying to do? • The sequential solution • The parallel solution • Interference freedom • Auxiliary variables • Examples • Cooperation with other synchronization tools • If given enough time • Deadlocks • Termination

3. The problem • We want to prove correctness of parallel programs • Most existing methods rely on informal arguments • Not accurate enough • We would like to formally prove correctness and other properties • Preferably statically

4. Hoare (1969) • Hoare presented a simple deductive system • Used to describe variable and program states during execution. • Used for proving properties of sequential programs. • Originally meant to be verified by compilers

5. Partial correctness VS.total correctness • We only deal with partial correctness • The program is correct only if it terminates • Total correctness will be dealt with later • Termination • Deadlocks& Blocking

6. Notation and Declarations • P, Q = assertions • S = statement • If P was true prior to execution of S, then Q is true after execution. • If a is true than b is also true.

7. Notation and Declarations • Null statements:

8. Notation and Declarations • Assignments: • is formed by replacing every appearance of in with . if then and we get

9. Notation and Declarations • Alternation:

10. Notation and Declarations • Iteration:

11. Notation and Declarations • Composition:

12. Notation and Declarations • Consequence:

13. Sequential Example • We want to prove • Assume we already know:

14. Sequential Example

15. Proof Outline • The previous proofcan be written as:

16. Extension for parallel programs • We need to introduce new statements: • Statements will be executed in parallel. • statement finishes only after all statements have finished. • may not contain any or statements. • can be used to make any action indivisible

17. Extension for parallel programs • We need to introduce new statements: • Used by Gries to prove correctness of Dijkstra’s on-the-fly garbage collector

18. Assumptions • We do not assume anything regarding processing speed • We require that all assignments be executed and all expression be evaluated as an indivisible action • Not necessary if every expression in the program may refer to at most one shared variable and at most once • Only required indivisible action is memory access • All following examples will adhere to this convention • (similarly for assignments)

19. Interference • Let’s examine two programs: • If we try to run them in parallel: • We cannot guarantee the post-condition.

20. Interference • Given a proof for a program and a statement with precondition , does not interfere with if: • Execution of won’t change the outcome • such that is not within an statement, • Execution of will not prevent execution of the rest of

21. Interference • are interference free if: • is an statement or an statement (not in an ) • does not interfere with • Redefine as:

22. Proving a parallel program • When proving correctness of a program we will start by proving each thread sequentially. • We will then show that each thread does not interfere with another thread’s prove • Interfere = invalidate the prove

23. Proving a parallel program • We will prove the following program: • We will do so by loosening the assertions

24. Proving a parallel program

25. Proving a parallel program • All that is left is to show interference freedom • We need to verify:

26. Proving a parallel program

27. Proving a parallel program

28. Auxiliary Variables • Consider the following program: • Can we prove ?

29. Auxiliary Variables • {x=0} The processes are not interference free Not the required result

30. Auxiliary Variables • Now consider the following proof outline? • Can we prove that this is correct? • If this proof outline is correct we can prove invalid statements • in this case we will get

31. Auxiliary Variables • A variable that is only in assignments is an Auxiliary Variable • Let AV be the set of Auxiliary Variables in the program • If is obtained from by deleting all the assignment to variables in AV then

32. Auxiliary Variables • Consider the following program: • This program has the same behavior as with the auxiliary variables

33. Auxiliary Variables

34. Another Example - Descriptrion • A parallel program for finding the 1st item in an array which is greater than 0.

35. Another Example – Proof Outline 1

36. Another Example – Proof Outline 2

37. Another Example - Proof • To prove the correctness of the program we need to: • Separately check each thread (evensearch & oddsearch) sequentially • Verify interference freedom between the threads • We will show that oddsearch does not interfere with evensearch • (the complementary  argument is similar)

38. Another Example - Proof • No need to check all possible statements in oddsearch • Enough the check only assignments of oddsearch that change a shared variable • The only suitable statement is • No need to check all possible statements in evensearch • Enough the check only assertions of evensearch affected by the change of a shared variable • The only suitable assertion is

39. Another Example - Proof • Need to show that: • is part of • Therefore • We conclude that the assertion holds!

40. Synchronization Mechanism • The deductive system presented is flexible enough to handle other existing parallel programming tools • Semaphores • Mutual exclusion • The tools can be converted to assertions and verified

41. Synchronization Mechanism • Semaphores • Obtain a semaphore: • Release a semaphore:

42. Synchronization Mechanism • Mutual Exclusion • We introduce another statement to the system: • is the resource on which we want mutual exclusion ( and same as in the staement) • The assertion (invariant of , if exists) is appended to the assertions of

43. Conclusion • a strong versatile deductive system for parallel program verification • Few assumptions on the system and/or program • The main ideas: • Start by verifying the sequential case and than check that parallel execution doesn’t invalidate the proof • Sometimes we might need to loosen our assertions to be able to prove them • In some cases we might need to add auxiliary variables to a program in order to verify it

44. References • An Axiomatic Proof Technique for Parallel Programs • Susan Owicky & David Gries, 1976 • Verifying Properties of Parallel Programs: An axiomatic Approach • Susan Owicky & David Gries, 1976 • An Axiomatic Basis for Computer Programming • C. A. R. Hoare, 1969 • An Exercise in Proving Parallel Programs Correct • David Gries, 1977 • Verification of Sequential and Concurrent Programs • Krzysztof R. Apt, Frank S. de Boer, Ernst-RudigerOldberog3rd edition, 2010

45. Questions?