DOCSLIB.ORG

Model Checking and Logic Synthesis Using Spin (Lab)

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Model Checking and Logic Synthesis Using Spin (Lab) Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline The Spin Model • Spin model checker: modeling Checker concurrent systems and descr- Gerard J. Holzmann ibing system requirements in Addison-Wesley, 2003 Promela http://spinroot.com • Model-checking with Spin • Logic synthesis with Spin The process flow of model checking Efficient model checking tools automate the process: SPIN, nuSMV, TLC,... EECI, Mar 2013 Richard M. Murray, Caltech CDS 2 Spin Verification Models System design (behavior specification) process 1 Promela (Process Meta Language) is a non- g1 TS 1 • ; { } deterministic, guarded command language for s0: red s1: green specifying possible system behavior of a distributed system in Spin There are 3 types of objects in Spin verification • process 2 model TS - asynchronous processes g2 2 ; { } - global and local data objects s0: red s1: green - message channels System requirements (correctness claims) default properties Φ = g1 g2 • ⇤⌃ ^ ⇤⌃ absence of system deadlock - true - absence of unreachable code q0 A g g • assertions • fairness ¬ 2 ¬ 1 end-state labels never claim g2 g • • ¬ q1 q2 ¬ 1 • acceptance • LTL formulas • progress • trace assertions EECI, Mar 2013 Richard M. Murray, Caltech CDS 3 Running Spin model.pml system pan.c design -a (model gcc Spin checking compiler system code) requirements -i -t model.trail pan random interactive guided negative simulation simulation simulation (counter- result (executable example) verifier) Typical sequence of commands correctness proof $ spin -u100 model!# non-verbose simulation for 100 steps $ spin -a model!! # generate C code for analysis (pan.c) $ gcc -o pan pan.c!# generate executable verifier from pan.c $ ./pan -a -N P1!# perform verification of specification P1 $ spin -t -p model!# show error trail Note: spin -- and ./pan -- list available command-line and un-time options, resp. EECI, Mar 2013 Richard M. Murray, Caltech CDS 4 Account Setup Lab computer login How to edit and use files • Username: LAB22-0N\eeci • Edit files using ‘Notepad’ in the - NN = 1, 2, 3, ... dropbox folder on Windows • Password: P@ssw0rd - Remember to save after you make changes Connecting to Amazon - Wait a few seconds for sync’ing • Run “Putty” from the desktop • Run commands on Amazon • Double click on EECI saved session • Look at results on Amazon • Username: eeci13 • Password: pw4belgrade Using Amazon from your own laptop • See Ufuk or Richard to get IP address Finding the right folder on Amazon for appropriate Amazon instance • cd groupN/spin • Install Dropbox and then see Richard • ls!!!# list files or Ufuk to get sharing set up Open Dropbox folder for your group Installing Spin on your laptop • Double click on Dropbox icon (should • Install Spin from spinroot.com be on desktop) (requires local C compiler) • Open ‘groupN’ folder to see the same • Download sample files from course files web page (Computer Session 1) EECI, Mar 2013 Richard M. Murray, Caltech CDS 5 Example 1: traffic lights (property verified) System TS: composition of two traffic lights Specification P 1 : and a controller “The light are never green g1 simultaneously.” c2 q2,s1,c2 { } [](!(g1 && g2)) q1 s1 ↵ ↵ ↵ ↵ ↵ ↵ β β c1 q1,s1,c1 SPIN code: q s2 β β β β P1 2 ¬ g1 g2 A c3 q1,s2,c3 traffic traffic g2 { } { } controller light 1 light 2 = { } Property verified: TS P1 ltl P1 { [] (! (g1 && g2)) } spin -a lights_simple.pml lights_simple.pml ltl P2 { [] <> g1 } gcc -o pan pan.c ltl P3 { ./pan -a -N P1 lights_simple.pml (always (!(g1&&g2))) && ./pan -a -N P2 lights_simple.pml (always eventually g1) spin -t -p lights_simple.pml } EECI, Mar 2013 Richard M. Murray,6 Caltech CDS Promela: Process Modeling Language bit g1, g2;!!!/* light status */ Declarations bit alpha1, alpha2, beta1, beta2; Declare global variables (+ initialize) int c = 1;!!!/* control state */ • active proctype TL1() { • Types: bit, int, char, etc + arrays do :: alpha1 -> g1 = 1 Processes :: beta1 -> g1 = 0 Each process runs independently od • } • ‘active’ => process starts immediately active proctype TL2() { - Otherwise use ‘run’ command loop2: Process = sequence of statements alpha2 -> g2 = 1 • beta2 -> g2 = 0 • Statements = guard or assignment goto loop2 } Control flow active proctype control() { • ‘do’ loops: non-deterministic execution do ‘goto’ statements: jump to location :: c == 1 -> alpha1=1; beta1=0; c = 2; • :: c == 2 -> alpha1=0; beta1=1; c = 3; • guarded commands: ‘guard -> rule’ :: c == 3 -> alpha2=1; beta2=0; c = 4; :: c == 4 -> alpha2=0; beta2=1; c = 1; Specifications od LTL statement to be checked } • - These generate ‘never’ claims ltl P1 { [] <> g1 } internally to spin (will see later) ltl P2 { [] ! (g1 && g2) } EECI, Mar 2013 Richard M. Murray, Caltech CDS 7 Promela Objects: Processes • A keyword proctype is used to declare process behavior • 2 ways to instantiate a process - Add the prefix active to a proctype declaration. The process will be instantiated in the initial system state. - Use run operator to instantiate a process in any reachable system state # of processes to be instantiated in the initial system state proctype you run(byte x) active [2] proctype main() { printf("x = %d n", x) \ { prinf("hello world n") } \ init } { run you run(0); keyword for initial process run you run(1) declaration and instantiation } Extra process init needs to be created EECI, Mar 2013 Richard M. Murray, Caltech CDS 8 Promela Objects: Data Objects • 2 levels of scope: global and process local • No intermediate levels of scope • The default initial value of all data objects is zero • All objects must be declared before they can first be referenced • User-defined type can be declared using keyword typedef Type Typical Range Sample Declaration bit 0,1 bit turn = 1 bool false, true bool flag = true all elements byte 0 ...255 byte a[12] initialized to 0 chan 1 ...255 chan m mtype 1 ...255 mtype n pid 0 ...255 pid p 15 15 all elements short 2 ...2 1 short b[4] = 89 initialized to 89 int −231 ...231 − 1 int cnt = 67 unsigned 0−...2n 1 − unsigned w: 3=5 − unsigned stored in 3 bits (range 0...7) EECI, Mar 2013 Richard M. Murray, Caltech CDS 9 Basic Statements • Assignment valid assignment: if the right-hand side yields a value outside - c++, c--, c = c+1, c = c-1 the range of c, truncation can result - invalid assignment: ++c, --c • Expressions - must be side effect free - the only exception is the run operator, which can have a side effect • Print: printf("x = %d n", x) \ • Assertion:assert(x+y == z), assert(x <= y) - always executable and has no effect on the state of the system when executed - can be used to check safety property: Spin reports a error if the expression can evaluate to zero (false) int n; active proctype invariant() The assertion statement can be executed at any time. This can be used to check a { system invariant condition: it should hold no assert(n <= 3) matter when the assertion is checked. } send • message passing between processes (later, if time) • receive } EECI, Mar 2013 Richard M. Murray, Caltech CDS 10 Rules for Executability A statement in a Spin model is either executable or blocked • A statement is executable iff it evaluates to true or non-zero integer value 2<3 is always executable x < 27 executable i↵ x<27 3+x executable i↵ x =3 6 • print statements and assignments are always unconditionally executable • If a process reaches a point where there is no executable statements left to execute, it simply blocks while (a != b) a == b; block until a==b { skip; do nothing while waiting for a==b } do L: if :: (a == b) -> break :: (a == b) -> skip :: else -> skip :: else -> goto L od fi EECI, Mar 2013 Richard M. Murray, Caltech CDS 11 Nondeterminism 2 levels of nondeterminism • System level: processes execute concurrently and asynchronously - Process scheduling decisions are non-deterministic - Statement executions from different processes are arbitrarily interleaved in time - Basic statements execute atomically • Process level: local choice within processes can also be non-deterministic byte x = 2, y = 2; active proctype A() do { :: x = 3-x :: y = 3-y od At any point in an execution, any of these active} proctype B() statements can be executed do { :: x = 3-y :: y = 3-x od } EECI, Mar 2013 Richard M. Murray, Caltech CDS 12 Control Flow • Semicolons, gotos and labels swap the values of a and b • Atomic sequences: atomic ... atomic d step { } { { - Define an indivisible sequence of actions tmp = b; tmp = b; - No other process can execute statements from the moment b = a; b = a; that the first statement of this sequence begins to execute a = tmp a = tmp until the last one has completed } } • Deterministic steps: d step ... { } - Similar to atomic sequence but more restrictive, e.g., no nondeterminism, goto jumps, or unexecutable statements if are allowed :: (n % 2 != 0) -> n = 1 the else guard is executable • Nondeterministic selection: iff none of the other guards :: (n >= 0) -> n = n-2 if is executable. :: (n % 3 == 0) -> n = 3 :: guard1 -> stmnt11; stmnt12; ... :: else /* -> skip */ :: guard2 -> stmnt21; stmnt22; ... fi :: ... without the else clause, the if- fi statement would block until • Nondeterministic repetition: other guards becomes true. do :: guard1 -> stmnt11; stmnt12; ... do :: guard2 -> stmnt21; stmnt22; ... :: x++ :: ... :: x-- do :: break transfers control to the end of • Escape sequences: P unless E the loop { } { } od • Inline definitions: inline ... { } EECI, Mar 2013 Richard M. Murray, Caltech CDS 13 Nondeterministic Selection and Repetition if do :: guard1 -> stmnt11; stmnt12; ... :: guard1 -> stmnt11; stmnt12; ... :: guard2 -> stmnt21; stmnt22; ... :: guard2 -> stmnt21; stmnt22; ... :: ... :: ... fi do • If at least one guard is executable, the if/do statement is executable • If more than one guard is executable, one is selected non-deterministically • If none of the guard statements is executable, the if/do statement blocks • Any type of basic or compound statement can be used as a guard • ‘if’ statement checks once and continues; ‘do’ statement re-executes code until a break is reached EECI, Mar 2013 Richard M.
Load more

Recommended publications
  • Probabilistic Models for the Guarded Command Language
    Science of Computer Programming ELSEVIER Science of Computer Programming 28 (1997) 171-192 Probabilistic models for the guarded command language He Jifeng *, K. Seidel, A. McIver Oxford University Computing Laboratory, Programming Research Group, 11 Keble. Road, Oxford OXI 3QD, UK Abstract The two models presented in this paper provide two different semantics for an extension of Dijkstra’s language of guarded commands. The extended language has an additional operator, namely probabilistic choice, which makes it possible to express randomized algorithms. An earlier model by Claire Jones included probabilistic choice but not non-determinism, which meant that it could not be used for the development of algorithms from specifications. Our second model is built on top of Claire Jones’ model, using a general method of extending a probabilistic cpo to one which abo contains non-determinism. The first model was constructed from scratch, as it were, guided only by the desire for certain algebraic properties of the language constructs, which we found lacking in the second model. We compare and contrast the properties of the two models both by giving examples and by constructing mappings between them and the non-probabilistic model. On the basis of this comparison we argue that, in general, the first model is preferable to the second. @ 1997 Elsevier Science B.V. Keywords: Probabilistic programming language; Semantics; Algebraic laws 1. Introduction Dijkstra’s language of guarded commands with its weakest precondition semantics [l] put reasoning about sequential imperative programs on a secure footing. The aim of this paper is to extend this language, its semantics, and formal reasoning to sequential randomized algorithms.
    [Show full text]
  • An Efficient Implementation of Guard-Based Synchronization for an Object-Oriented Programming Language an Efficient Implementation of Guard-Based
    AN EFFICIENT IMPLEMENTATION OF GUARD-BASED SYNCHRONIZATION FOR AN OBJECT-ORIENTED PROGRAMMING LANGUAGE AN EFFICIENT IMPLEMENTATION OF GUARD-BASED SYNCHRONIZATION FOR AN OBJECT-ORIENTED PROGRAMMING LANGUAGE By SHUCAI YAO, M.Sc., B.Sc. A Thesis Submitted to the Department of Computing and Software and the School of Graduate Studies of McMaster University in Partial Fulfilment of the Requirements for the Degree of Doctor of Philosophy McMaster University c Copyright by Shucai Yao, July 2020 Doctor of Philosophy (2020) McMaster University (Computing and Software) Hamilton, Ontario, Canada TITLE: An Efficient Implementation of Guard-Based Synchro- nization for an Object-Oriented Programming Language AUTHOR: Shucai Yao M.Sc., (Computer Science) University of Science and Technology Beijing B.Sc., (Computer Science) University of Science and Technology Beijing SUPERVISOR: Dr. Emil Sekerinski, Dr. William M. Farmer NUMBER OF PAGES: xvii,167 ii To my beloved family Abstract Object-oriented programming has had a significant impact on software development because it provides programmers with a clear structure of a large system. It encap- sulates data and operations into objects, groups objects into classes and dynamically binds operations to program code. With the emergence of multi-core processors, application developers have to explore concurrent programming to take full advan- tage of multi-core technology. However, when it comes to concurrent programming, object-oriented programming remains elusive as a useful programming tool. Most object-oriented programming languages do have some extensions for con- currency, but concurrency is implemented independently of objects: for example, concurrency in Java is managed separately with the Thread object. We employ a programming model called Lime that combines action systems tightly with object- oriented programming and implements concurrency by extending classes with actions and guarded methods.
    [Show full text]
  • Computing the Stabilization Times of Self-Stabilizing Systems
    IEICE TRANS. FUNDAMENTALS, VOL.E83–A, NO.11 NOVEMBER 2000 2245 PAPER Special Section on Concurrent Systems Technology Computing the Stabilization Times of Self-Stabilizing Systems Tatsuhiro TSUCHIYA†, Regular Member, Yusuke TOKUDA†, Nonmember, and Tohru KIKUNO†, Regular Member SUMMARY A distributed system is said to be self- state very fast. Research in this direction includes [1], stabilizing if it converges to some legitimate state from an ar- [8], [16]. bitrary state in a finite number of steps. The number of steps In this paper, we propose an automated method required for convergence is usually referred to as the ×ØabiÐiÞaØiÓÒ for computing the worst stabilization time, aiming at ØiÑe, and its reduction is one of the main performance issues in the design of self-stabilizing systems. In this paper, we propose supporting algorithm designers. In [6], Dolev et al. pro- an automated method for computing the stabilization time. The posed a theoretical method, called the scheduler luck method uses Boolean functions to represent the state space in game, for stabilization time analysis. This method can order to assuage the state explosion problem, and computes the stabilization time by manipulating the Boolean functions. To deal with randomized algorithms only, and it is not au- demonstrate the usefulness of the method, we apply it to the tomated. Some work addresses the issues of automatic analysis of existing self-stabilizing algorithms. The results show verification of self-stabilizing systems (e.g., [11], [12], that the method can perform stabilization time analysis very fast, [14]). To the best of our knowledge, however, there has even when an underlying state space is very huge.
    [Show full text]
  • Beyond Structured Programming
    Beyond Structured Programming M.H. van Emden Technical Report DCS-359-IR Department of Computer Science University of Victoria Abstract The correctness of a structured program is, at best, plausible. Though this is a step forward compared to what came before, it falls short of verified correctness. To verify a structured program according to Hoare’s method one is faced with the problem of finding assertions to fit existing code. In 1971 this mode of verification was declared by Dijkstra as too hard to be of practical use—he advised that proof and code were to grow together. A method for doing this was independently published by Reynolds in 1978 and by van Emden in 1979. The latter was further developed to attain the form of matrix code. This form of code not only obviates the need of fitting assertions to existing code, but helps in discovering an algorithm that reaches a given postcondition from a fixed precondition. In this paper a keyboard-editable version of matrix code is presented that uses E.W. Dijkstra’s guarded commands as starting point. The result is reached by using Floyd’s method rather than Hoare’s as starting point. 1 Introduction Structured Programming is the name of a method introduced by E.W. Dijkstra in 1969 [6]. At the time the method was revolutionary: it advocated the elimination of the goto statement and the ex- clusive use of conditional, alternative, and repetitive clauses. In a few years structured programming evolved from controversy to orthodoxy. C.A.R. Hoare invented a logic-based verification method for structured programs [13].
    [Show full text]
  • Modelling and Analysis of Communicating Systems (Chapter 4)
    Chapter 4 Sequential processes In chapter 2 we described behaviour by labelled transition systems. If behaviour be- comes more complex this technique falls short and we need a higher level syntax to concisely describe larger labelled transition systems. In this chapter we describe pro- cesses using an extended process algebra. The building blocks of our process algebra are (multi-)actions with data. We provide operators to combine behaviour in both a sequential and nondeterministic way and allow it to be controlled by data parameters. Axioms are used to characterise the meaning of the various constructs. The language that we get allows to describe all reactive behaviour. In the next chapter we define operators to combine behaviour in a more complex way, especially using the parallel operator. But these operators do not add to the expressivity of the language. The sort of all processes defined in this and the next chapter is P. 4.1 Actions As in chapter 2, actions are the basic ingredients of processes. More precisely, every action is an elementary process. Actions can carry data. E.g., a receive action can carry a message, and an error action can carry a natural number, for instance indicating its severity. Actions can have any number of parameters. They are declared as follows: act timeout ; error : N; receive : B × N+; This declares parameterless action name timeout , action name error with a data pa- rameter of sort N (natural numbers), and action name receive with two parameters of sort B (booleans) and N+ (positive numbers) respectively. For the above action name declaration, timeout , error (0) and receive (false , 6) are valid actions.
    [Show full text]
  • Insight, Inspiration and Collaboration
    Chapter 1 Insight, inspiration and collaboration C. B. Jones, A. W. Roscoe Abstract Tony Hoare's many contributions to computing science are marked by insight that was grounded in practical programming. Many of his papers have had a profound impact on the evolution of our field; they have moreover provided a source of inspiration to several generations of researchers. We examine the development of his work through a review of the development of some of his most influential pieces of work such as Hoare logic, CSP and Unifying Theories. 1.1 Introduction To many who know Tony Hoare only through his publications, they must often look like polished gems that come from a mind that rarely makes false steps, nor even perhaps has to work at their creation. As so often, this impres- sion is a further compliment to someone who actually adds to very hard work and many discarded attempts the final polish that makes complex ideas rel- atively easy for the reader to comprehend. As indicated on page xi of [HJ89], his ideas typically go through many revisions. The two authors of the current paper each had the honour of Tony Hoare supervising their doctoral studies in Oxford. They know at first hand his kind and generous style and will count it as an achievement if this paper can convey something of the working style of someone big enough to eschew competition and point scoring. Indeed it will be apparent from the following sections how often, having started some new way of thinking or exciting ideas, he happily leaves their exploration and development to others.
    [Show full text]
  • Inseguendo Fagiani Selvatici: Partial Order Reduction for Guarded Command Languages Frank S
    Inseguendo Fagiani Selvatici: Partial Order Reduction for Guarded Command Languages Frank S. de Boer CWI, Amsterdam, the Netherlands [email protected] Einar Broch Johnsen Department of Informatics, University of Oslo, Oslo, Norway einarj@ifi.uio.no Rudolf Schlatte Department of Informatics, University of Oslo, Oslo, Norway rudi@ifi.uio.no S. Lizeth Tapia Tarifa Department of Informatics, University of Oslo, Oslo, Norway sltarifa@ifi.uio.no Lars Tveito Department of Informatics, University of Oslo, Oslo, Norway larstvei@ifi.uio.no Abstract This paper presents a method for testing whether objects in actor languages and active object languages exhibit locally deterministic behavior. We investigate such a method for a class of guarded command programs, abstracting from object-oriented features like method calls but focusing on cooperative scheduling of dynamically spawned processes executing in parallel. The proposed method can answer questions such as whether all permutations of an execution trace are equivalent, by generating candidate traces for testing which may lead to different final states. To prune the set of candidate traces, we employ partial order reduction. To further reduce the set, we introduce an analysis technique to decide whether a generated trace is schedulable. Schedulability cannot be decided for guarded commands using standard dependence and interference relations because guard enabledness is non-monotonic. To solve this problem, we use concolic execution to produce linearized symbolic traces of the executed program, which
    [Show full text]
  • This Thesis Has Been Submitted in Fulfilment of the Requirements for a Postgraduate Degree (E.G
    This thesis has been submitted in fulfilment of the requirements for a postgraduate degree (e.g. PhD, MPhil, DClinPsychol) at the University of Edinburgh. Please note the following terms and conditions of use: • This work is protected by copyright and other intellectual property rights, which are retained by the thesis author, unless otherwise stated. • A copy can be downloaded for personal non-commercial research or study, without prior permission or charge. • This thesis cannot be reproduced or quoted extensively from without first obtaining permission in writing from the author. • The content must not be changed in any way or sold commercially in any format or medium without the formal permission of the author. • When referring to this work, full bibliographic details including the author, title, awarding institution and date of the thesis must be given. AN OPERATIONAL APPROACH TO SEMANTICS AND TRANSLA7 FOR CONCURRENT PROGRAMMING LANGUAGES by Wei Li Doctor of Philosophy University of Edinburgh 1982 1 Abstract The problems of semantics and translation for concurrent programming languages are studied in this thesis. A structural operational approach is introduced to specify the semantics of parallelism and communication. Using this approach, semantics for the concurrent programming languages CSP (Hoare's Communicating Sequential Processes), multitasking and exception handling in Ada, Brinch-Hansen's Edison and CCS (Milner's Calculus of Communicating Systems) are defined and some of their properties are studied. An operational translation theory for concurrent programming languages is given. The concept of the correctness of a translation is formalised, the problem of composing transitions is studied and a composition theorem is proved.
    [Show full text]
  • Mechanizing the Probabilistic Guarded Command Language
    Introduction Formalizing pGCL Verification Conditions Current Work Summary Mechanizing the Probabilistic Guarded Command Language Joe Hurd Computing Laboratory University of Oxford IFIP Working Group 2.3 Tuesday 9 January 2007 Joint work with Carroll Morgan (UNSW), Annabelle McIver (Macquarie), Orieta Celiku (CMU) and Aaron Coble (Cambridge) Joe Hurd Mechanizing the Probabilistic Guarded Command Language 1 / 37 Introduction Formalizing pGCL Verification Conditions Current Work Summary Talk Plan 1 Introduction 2 Formalizing pGCL 3 Verification Conditions 4 Current Work 5 Summary Joe Hurd Mechanizing the Probabilistic Guarded Command Language 2 / 37 Introduction Formalizing pGCL Verification Conditions Current Work Summary Probabilistic Programs Giving programs access to a random number generator is useful for many applications: Symmetry breaking Rabin’s mutual exclusion algorithm Eliminating pathological cases Randomized quicksort Gain in (best known?) theoretical complexity Sorting nuts and bolts Solving a problem in an extremely simple way Finding minimal cuts Research goal: Apply formal methods to programs with probabilistic nondeterminism. Joe Hurd Mechanizing the Probabilistic Guarded Command Language 4 / 37 Introduction Formalizing pGCL Verification Conditions Current Work Summary Probabilistic Guarded Command Language pGCL stands for Probabilistic Guarded Command Language. It’s Dijkstra’s GCL extended with probabilistic choice c1 p ⊕ c2 Like GCL, the semantics is based on weakest preconditions. Important: retains nondeterministic choice c1 u c2 Developed by Morgan, McIver et al. in Oxford and then Sydney, 1994– Joe Hurd Mechanizing the Probabilistic Guarded Command Language 5 / 37 Introduction Formalizing pGCL Verification Conditions Current Work Summary The HOL4 Theorem Prover Developed by Mike Gordon’s Hardware Verification Group in Cambridge, first release was HOL88.
    [Show full text]
  • A Formal Methodology for Deriving Purely Functional Programs from Z Specifications Via the Intermediate Specification Language Funz
    Louisiana State University LSU Digital Commons LSU Historical Dissertations and Theses Graduate School 1995 A Formal Methodology for Deriving Purely Functional Programs From Z Specifications via the Intermediate Specification Language FunZ. Linda Bostwick Sherrell Louisiana State University and Agricultural & Mechanical College Follow this and additional works at: https://digitalcommons.lsu.edu/gradschool_disstheses Recommended Citation Sherrell, Linda Bostwick, "A Formal Methodology for Deriving Purely Functional Programs From Z Specifications via the Intermediate Specification Language FunZ." (1995). LSU Historical Dissertations and Theses. 5981. https://digitalcommons.lsu.edu/gradschool_disstheses/5981 This Dissertation is brought to you for free and open access by the Graduate School at LSU Digital Commons. It has been accepted for inclusion in LSU Historical Dissertations and Theses by an authorized administrator of LSU Digital Commons. For more information, please contact [email protected]. INFORMATION TO USERS This manuscript has been reproduced from the microfilm master. UMI films the text directly from the original or copy submitted. Thus, some thesis and dissertation copies are in typewriter face, while others may be from any type of computer printer. H ie quality of this reproduction is dependent upon the quality of the copy submitted. Broken or indistinct print, colored or poor quality illustrations and photographs, print bleedthrough, substandardm argins, and improper alignment can adversely affect reproduction. In the unlikely, event that the author did not send UMI a complete manuscript and there are missing pages, these will be noted. Also, if unauthorized copyright material had to be removed, a note will indicate the deletion. Oversize materials (e.g., maps, drawings, charts) are reproduced by sectioning the original, beginning at the upper left-hand comer and continuing from left to right in equal sections with small overlaps.
    [Show full text]
  • Specification-Based Design of Self-Stabilization
    1 Specification-based Design of Self-Stabilization Murat Demirbas, Member, IEEE, and Anish Arora, Member, IEEE Abstract—Research in system stabilization has traditionally reliedontheavailabilityofacompletesystemimplementation.Assuch,it would appear that the scalability and reusability of stabilization is limited in practice. To redress this perception, in this paper, we show for the first time that system stabilization may be designed knowing only the system specification but not the system implementation. We refer to stabilization designed thus as specification-based design of stabilization and identify “local everywhere specifications” and “convergence refinements” as being amenable to the specification-based design of stabilization. Using our approach, we present the design of Dijkstra’s 4-state stabilizing token-ring systemstartingfromanabstractfault-intoleranttoken-ringsystem. We also present an illustration of automated design of specification-based stabilization on a 3-state token-ring system. Index Terms—Self-stabilization, Fault-tolerance preserving refinements, Distributed systems. ✦ 1INTRODUCTION we show for the first time that system stabilization can be achieved without knowledge of implementation ELF-STABILIZATION research [7], [8], [10], [11], [12] details. We eschew “whitebox” knowledge—of system focuses on how systems deal with arbitrary state S implementation—in favor of “graybox” knowledge— corruption. A stabilizing system is such that every com- of system specification—for the design of stabilization. putation of the system, upon starting from an arbitrary Since specifications are typically more succinct than state, eventually reaches a state from where the compu- implementations, specification-based design of fault- tation is “correct”. The motivation for considering arbi- tolerance offers the promise of scalability when the trary state-corruption is to account for the unanticipated design effort for adding fault-tolerance is proportional faults that results from complex interactions of faults to the size of the specification.
    [Show full text]
  • LNCS 3167, Pp
    Refinement: An Overview Ana Cavalcanti1, Augusto Sampaio2, and Jim Woodcock1 1 Department of Computer Science University of York York, UK 2 Centro de Inform´atica Universitates Federal de Pernambuco Recife - PE, Brazil The purpose of this initial chapter is to introduce concepts and techniques assumed as general background in the remaining chapters of this book. The relevant notions are introduced using a simple and well-known programming notation: Dijkstra’s language of guarded commands [81], presented in Section 1. Three classical approaches to assigning semantic meaning to programs are then explored. In Section 2 we discuss the annotation of programs with assertions and the associated reasoning framework (Hoare Logic). Section 3 is dedicated to a calculational style where the behaviour of a program is defined in terms of a predicate transformer: its weakest precondition. Partial and total correctness of programs are contrasted in these two sections. The important notion of program refinement is introduced in Section 4. We start with some intuition and then we give a weakest precondition based definition, followed by an alternative (but equivalent) definition in terms of nondeterminism. In Section 5, we explore another approach to program semantics, known as refinement algebra, which is based on equations and inequations (laws) relating programming constructs; algebraic laws allow a term rewriting style of program transformation. We then show, in Section 6, how the programming constructs can be embedded into a more abstract space of specifications; we introduce Morgan’s specification statement and illustrate Morgan’s refinement calculus concerning both algorithmic and data refinement. In Section 7 we discuss how a programming (or specification) language with a refinement ordering can be regarded as a lattice.
    [Show full text]