1 / 53

Laws of concurrent design

Laws of concurrent design. Tony Hoare Microsoft Research Cambridge FMCAD 2012 23 October. Summary. What are they? Are they useful? Are they true? Are they beautiful?. 1. Laws. Subject matter. (traces of) execution of a program recording a set of events,

tiger
Download Presentation

Laws of concurrent design

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Laws of concurrent design Tony Hoare Microsoft Research Cambridge FMCAD 2012 23 October

  2. Summary • What are they? • Are they useful? • Are they true? • Are they beautiful?

  3. 1. Laws

  4. Subject matter • (traces of) execution of a program • recording a set of events, • occurring inside and near a computer • while it is executing a program • specifications/designs/programs • describing sets of traces • that are desired/planned/actual • when the program is executed • the same laws will apply to both.

  5. Three operators • then ; sequential composition • with || concurrent composition • skip I does nothing

  6. Five Axioms • assoc p;(q;r) = (p;q);r (also ||) • comm p||q = q||p • unit p||I = p = I||p (also ;)

  7. Reversibility • assoc p;(q;r) = (p;q);r (also ||) • comm p||q = q||p • unit p||I = p = I||p (also ;) • swapping the order of operands of ; (or of ||) translates each axiom into itself.

  8. Duality • Metatheorem: (theorems for free) When a theorem is translated by reversing the operands of all ;s (or of all ||s), the result is also a theorem. • Many laws of physics are also reversible in the direction of time

  9. Comparison: p => q • Example: refinement • every trace described by p is also described by q • Example: definement (Scott ⊑) • if the trace p is defined it is equal to the trace q

  10. Axiom • => is a partial order • reflexive p => p • transitive if p => q & q => r then p => r • swapping the operands of => translates each axiom into itself • justifies duality by order reversal

  11. Monotonicity • Definition: an operator  is monotonic if • p => q implies pr => qr & rp => rq • Axiom: ; and || are monotonic • justifies replacement of any component of a term by one that is more refined/defined

  12. Monotonicity • Metatheorem : Let F be a formula containing p. Let F’ be a translation of F that replaces an occurrence of p by q Let p => q be a theorem -------------------------------------------------------- Then F(p) => F’(q) is also a theorem

  13. Exchange Axiom • (p||q) ; (p’||q’) => (p;p’) || (q;q’) • Theorem (frame): (p||q) ; q’ => p||(q;q’) • Proof: substitute  for p’ in exchange axiom • Theorem: p;q => p*q • This axiom is self-dual by time-reversal

  14. 2. Applications

  15. The laws are useful • for proof of correctness of programs/designs • by means of Hoare logic • extended by concurrent separation logic. • for design/proof of implementations • using Milner transitions • extended by sequential composition.

  16. The Hoare triple • Definition: {p} q {r} = p;q => r • If p describes what has happened so far • and q is then executed to completion, • the overall result will satisfy r.

  17. The rule of composition • Definition: {p} q {r} = p;q => r • Theorem: {p} q {s} {s} q’ {r} {p} q;q’ {r}

  18. Proof • Definition: {p} q {r} = p;q => r • expanding the definition: p;q => s s;q’ => r p;q;q’ => r because ; is monotonic and associative

  19. Modularity rule for || • in concurrent separation logic {p} q {r} {p’} q’ {r’} {p||p’} q||q’ {r||r’} • permits modular proof of concurrent programs. • it is equivalent to the exchange law

  20. Modularity rule impliesExchange law • By reflexivity: p;q => p;q and p’;q’ => p’;q’ • Exchange is the conclusion of modularity rule (p||p’) ; (q||q’) => (p;q) || (p’;q’)

  21. Exchange law implies modularity • Assume: p;q => r and p’;q’ => r’ • monotonicity of || gives (p;q) || (p’;q’) => r|| r’ • the Exchange law says (p||p’) ; (q||q’) => (p;q) || (p’;q’) • by transitivity: (p||p’) ; (q||q’) => r||r’ which is the conclusion of the modularity rule

  22. Frame Rules {p} q {r} {p||f} q {r||f} • adapts a triple to a concurrent environment f • proof: from frame theorem {p} q {r}__ {f;p} q {f;r} • proof: mon, assoc of ;

  23. The Milner triple: r - q -> p • defined as q;p=> r • the time reversal of {p} q {r} • r may be executed by first executing q • with p as continuation for later execution. • maybe there are other ways of executing r • Tautology: (q ; p) – q -> p • Proof: from reflexivity: q;p => q;p

  24. Technical Objection • Originally, Hoare restricted q to be a program, and p , r to be state descriptions • Originally, Milner restricted p and r to be programs, and q to be an atomic action. • These restrictions are useful in application. • And so is their removal • (provided that the axioms are still consistent).

  25. Sequential composition {p} q {s} {s} q’ {r} {p} q;q’ {r} r –q-> s s –q’-> p r –(q;q’)-> p Proof: by reversal of the Hoare rule

  26. Concurrency in CCS r –p-> q r’ -p’-> q’ (r||r’) -(p||p’)-> (q||q’) • provided p||p’ = τ • where τ is the unobserved atomic transition, which occurs (in CCS) when p and p’ are an input and an output on the same channel. • Proof: by reversal of the modularity rule

  27. Frame Rules r –q-> p (r||f) –q-> (p||f) • a step q possible for a single thread r is still possible when r is executed concurrently with f r –q-> p (r;f) –q->(p;f) • operational definition of ;

  28. The internal step • r -> p = def. p => r • (the order dual of refinement) • the implementation may make a refinement step • reducing the range of subsequent behaviours

  29. Rule of consequence • p => p’ {p’} q {r’} r’ => r {p} q {r} • r -> r’ r’ –q-> p’ p’ -> p r –q-> p • Proof: ; is monotonic and associative, • => is transitive. • Each rule is the dual of the other • by order reversal and time reversal

  30. Additional operators • p \/ q describes all traces of p and all of q • describes options in design • choice (non-determinism) in execution • p /\ q describes all traces of both p and q • conjunction of requirements (aspects) in design • lock-step concurrency in execution

  31. Axioms • /\ is the disjunction and \/ is the conjunction of a Boolean Algebra (even with negation). • Axiom: ; and || distribute through \/ • which validates reasoning by cases • and implementation by non-deterministic selection

  32. Choice • {p} q {r} {p} q’ {r} {p} (q \/ q’) {r} • both choices must be correct • proof: distribution of ; through \/ ___r –q-> p____ (r \/ r’) –q-> p • only one of the alternatives is executed • proof: r => r \/ r’

  33. Axioms proved from calculi from Hoare from Milner (p\/q) ; r => (p;r) \/ (q;r) p;q \/ p;r => p ; (q\/r) • p ; (q\/r) => p;q \/ p;r • p;r \/ q;r => (p\/q) ; r • from both • p ; (q;r) => (p;q) ; r • (p;q) ; r => p ; (q;r) • exchange law

  34. Message • Both the Hoare and Milner rules are derived from the same algebra of programming. • The algebra is simpler than each of the calculi, • and stronger than both of them combined. • They are mutually consistent, provided the laws are true

  35. 3. The laws are true

  36. The laws are true of… • specifications, designs, implementations of • programs • hardware • networks • hybrid systems • the real world of events occurring in space and time

  37. Happens before () • Let e, f, g є Ev(a set of event occurrences). • Let e  f mean (your choice of) : • ‘the occurrence e was/will be an immediate and necessary cause of the occurrence f ’ • ‘the occurrence f directly depends (depended) on the occurrence e ’ • ‘e happens before f ’ ‘f happens after e ’

  38. Example: hardware • a rising edge  next falling edge on same wire • a rising edge rising edge on another wire

  39. Example: Petri nets e  f , f’  g e f , f’  g f’ g e f

  40. Message sequence charts net app sql

  41. Examples: software • nth output  nth input(on reliable channel) • nthV  nth P (on an exclusion semaphore) • nthassignment  read of nthvalue (of a variable in memory) • read of nth value  (n + 1)stassignment (in strong memory)

  42. Precedes • Define <as ()* • the reflexive transitive closure • Define >as< • the converse of < • Examples: • allocation of a resource < any use of it • disposal of a resource > any use of it

  43. Interpretations • e <f & f < e means • e and f are (part of) the same atomic action • or there is deadlock • not e < f & not f < e means • e and f are independent of each other • their executions may overlap in time, • or one may complete before the other starts

  44. Cartesian product • Let p, q, r Ev • traces of execution • Define p × q = {(e,f) | e  p & f  q } • cartesian product • Theorem: p × (q  r) = p×q  p×r (q  r) × p = q×p r×p

  45. Composition • Let p, q, r Ev (traces of execution) • Let seqEv×Ev (arbitrary relation) • Define p;q = p qif p × q seq & p, q are defined • and is undefined otherwise Theorem: ; is monotonic • with respect to definement ordering

  46. Theorem: (p ; q) ; r = p ; (q ; r) • Proof: when they are both defined, each side is equal to ( p  q  r ). LHS is defined (by definition of ;) p × q seq & (p  q) × r seq (by ×distrib)  p × q seq & p × r seq & q × r seq p ×(q  r) seq & q × r seq  RHS is defined

  47. Sequential composition • Define seq = < • Then p;q is strong sequential composition • means that p must finish before q starts • all events in p precede all events in q • Example: Ev is NN • {1, 7, 19} ; {21, 32} = {1, 7, 19, 21, 32} • {1, 7, 19} ; {19, 32} is undefined

  48. Sequential composition • Define seq = not > • Then p;q is weak sequential composition • means that p may finish before q begins • note that q may start before p finishes • with events that are independent of p • just as in your computer today

  49. ConcurrentComposition Define par = seqseq Note: seqpar = par Define p||q = p  q if p × q par and p, q defined Theorem: || is associative and commutative. Strong || is interleaving. Weak || avoids deadlocks

  50. (q || q’) ; (r || r’)=> (q ; r ) || (q’ ; r’) • Proof: when LHS is defined, it equals RHS LHS defined  q ×q’ par & r × r’ par & (q  q’) × (r r’) seq  q × q’  r × r’par & q’ × r’ q × r  q’ ×r  q × r’ seq q’ ×r’ seq&q× r seq & (q  r) × (q’  r’)  par  RHS defined.

More Related