1 Introduction
Total Page:16
File Type:pdf, Size:1020Kb
Toward an Op erational Semantics of PROMELAinACL2 William R. Bevier Computational Logic, Inc. 1717 West 6th Street, Suite 290 Austin, Texas 78703-4776 b [email protected] 1 Intro duction PROMELA is a language for mo deling concurrentsystems,develop ed sp eci cally for de- scribing communication proto cols. Analysis of some prop erties of PROMELA mo dels is automated by the SPIN mo del checker [Hol91]. Currently, the semantics of PROMELA is most completely and accurately de ned by the C implementation of SPIN. It would b e preferable to have a formal de nition of PROMELA semantics indep endent of this implementation. This rep ort describ es an op erational semantic de nition for most of PROMELA in the logic of ACL2 [KM94]. It should b e considered a preliminary version, which can b e re ned in resp onse to public scrutiny. Natara jan and Holzmann have describ ed an op erational semantics for a smaller subset of PROMELA. Their semantics is based on lab eled transition systems [NH96]. The semantic de nition presented here was created indep endently and do es not re ect the structure of their de nition, although there are many similarities. This de nition complements their work and o ers several advantages. First, ACL2 p er- forms some useful error checking on the de nition. The numb er of arguments and results of each functionischecked for consistent usage. The termination of each function is proved at the time it is accepted. The primitiveACL2 typ e of the result of each function is automati- cally deduced. It is p ossible to use ACL2 to check prop erties of the de nition. The semantic de nition is complex, and it is helpful to verify some of its exp ected prop erties to avoid errors. Each function can b e adorned with guards, which describ e pre-conditions on function arguments. Guard pro ofs can b e checked in ACL2. A useful thing to do, whichwehave only b egun, is to de ne the predicate that characterizes a legal PROMELA state and showthatitisan invariant of the semantic function. ACL2 includes an automatic re-play facility. Once a semantic de nition is completed, mo di cations to it can b e re-played. Only events which fail to get accepted by the theorem prover need attention from the user. The re-play facility can help to make sure that imp or- tantinvariants of the mo del are preserved after mo di cations have b een made. In general, prop osed changes to the language can b e analyzed with pro of-checking supp ort. A second b ene t of this style of mo del is that it is executable. We can simulate PROMELA mo dels directly in this de nition. The ability to \debug" the mo del via execution is very helpful. Wehave chosen to make the mo del executable; ACL2 do es not limit one to building 1 executable mo dels. Because of this choice, a numb er of concepts are not mo deled as generally as one would like. Finally, a mo del such as this op ens up p ossibilities in the combined use of theorem proving and mo del checking for analysis. Approaches to pro of-based veri cation for notations like TLA [Lam91] and Unity [CM88] exist. The techniques develop ed for these notations can b e adapted for proving prop erties of PROMELA programs. This can b e another way around the state explosion problem. Can this de nition (or some mo di cation of it) serve as a reference mo del for PROMELA semantics? Can the the de nition ful ll some purp ose in addition to do cumentation? In the near future we hop e to make the de nition publicly available for exp erimentation to help answer these questions. This pap er should b e considered a rep ort on work in progress, not a p olished result. The purp ose of this pap er is to announce the presence of this mo del, and to see if there is interest in its use. Any errors are due to the author's misunderstanding of PROMELA semantics. Section 2 presents the language that we handle, and gives an example program. Section 3 gives a sketch of the semantic mo del for this language. In the future, a full technical rep ort will contain the details. Section 4 o ers a comparison of the structures of the PROMELA ACL2 mo del and the semantic de nition in [NH96]. Section5 discusses the state of the formal semantics as a software system. Section 6 provides a brief intro duction to ACL2, and can b e used as a reference for various constructs presented in the pap er. 2 The Language For the sake of simplicity, Natara jan and Holzmann have excluded the following issues from their semantic de nition. 1. arrayvariables 2. assert statements 3. never claims 4. correctness prop erties expressed by progress and accept lab els 5. multiple arguments on run statements 6. multiple elds in a message 7. comp ound statements, including control ow statements 8. other \uninteresting" statements like printf and skip Our de nition handles all of the ab ove except 3 and 4. We also mo del the dynamic creation of variables and channels in a style di erent from [NH96]. We do not mo del deterministic steps or pro cess priorities. 2 This de nition includes one ma jor simpli cation, which is merely an exp ediency. All primitivenumeric data typ es are unb ounded integers. Wehave not yet extended ACL2 with a nite arithmetic library,sowe rely on the unb ounded arithmetic built in to ACL2. Fixing this is just a matter of time and energy. Section 2.1 gives the grammar of the language we handle. Section 2.2 shows an example program. 2.1 Grammar We present a grammar for the forms directly read in bythePROMELA semantic function, which adopts the syntactic conventions of Common Lisp. Using lex and yacc we can easily build a front end that will let us parse the C-syntax of PROMELA and generate programs in this form. Lower case symb ols in this grammar are non-terminals. Upp er case symb ols are terminals. Parentheses are not meta-symb ols; they app ear where they are syntactically required. Toplevel Forms start ::= unit+ unit ::= define | proctype | init | one-decl | mtype define ::= (DEFINE name expr) proctype ::= (PROCTYPE name decl-list body)) init ::= (INIT body)) mtype ::= (MTYPE name+) Declarations decl-list ::= one-decl* one-decl ::= (typesymbol ivar+) ivar ::= var-decl | (ASSIGN var-decl initializer) initializer ::= expr | ch-init ch-init ::= (OF cap-spec (typesymbol+)) cap-spec ::= natural | symbol var-decl ::= name | (name natural) Statements body ::= stmt stmt ::= structured-stmt | elementary-stmt | (label @ stmt) label ::= (symbol+) structured-stmt ::= atomic | selection | repetition | sequence atomic ::= (ATOMIC stmt*) selection ::= (IF option+) repetition ::= (DO option+) sequence ::= (SEQ stmt*) option ::= (OPTION stmt*) 3 elementary-stmt ::= assertion | assignment | break | end | expr | goto | one-decl | printf | receive | send | skip assertion ::= (ASSERT expr) assignment ::= (ASSIGN var-ref expr) break ::= (BREAK) end ::= (END) goto ::= (GOTO label) printf ::= (PRINTF string expr*) receive ::= (RECEIVE var-ref convar*) send ::= (SEND var-ref expr*) skip ::= (SKIP) Typ es and Expressions typesymbol ::= BIT | BOOL | BYTE | SHORT | INT | CHAN convar ::= symbol name ::= symbol expr ::= constant | var-ref | opr-application constant ::= integer var-ref ::= name | (NTH expr name) opr-application ::= (== expr expr) | (+ expr expr) | (- expr expr) | (* expr expr) | (/ expr expr) | (% expr expr) | (NEG expr) | (AND expr expr) | (OR expr expr) | (NOT expr) | (IMP expr expr) | (IFF expr expr) | (XOR expr expr) | (< expr expr) | (<= expr expr) | (> expr expr) | (>= expr expr) | (LEN expr) | (? expr (* expr)) | (TIMEOUT) | (RUN (name (* expr))) | (NTH expr expr) 2.2 An Example Program Here is the PROMELA factorial program as presented in [Hol91]. proctype fact(int n; chan p) { int result; if :: (n <= 1) -> p!1; :: (n >= 2) -> chan child = [1] of { int}; run fact(n-1, child); child?result; p!n*result fi } 4 init { int result; chan child = [1] of {int }; run fact(5, child); child?result; printf("result: %d\n", result) } The internal representation of this program accepted by our grammar, and pro cessed by our interpreter app ears as follows. (proctype fact ((int n) (chan p)) (seq (int result) (if (option (<=n1) (send p 1)) (option (>=n2) (chan (assign child (of 1 ( int )))) (run (fact (- n 1) child)) (receive child result) (send p (* n result)))) (end))) (init (seq (int result) (chan (assign child (of 1 ( int )))) (run (fact 5 child)) (receive child result) (printf "~%result: ~d" result) (end))) Here is a formatted display of the initial state of factorial program as created bytheACL2 PROMELA interpreter. The details of system state are intro duced in Section 3.2. However, we can see that initially no system error is recorded, no pro cess is executing atomically,and there are no global variables or channels. There is a single pro cess, the initial pro cess. It is active, and its program counter p oints to the toplevel of the init program b o dy.At the start of the computation, there are no lo cal variables in the initial pro cess. Error: NIL Atomic: NIL Globals: Channels: Process 0 (INIT): Active: T; PC: NIL; Locals: After three steps, the rst three statements in the toplevel sequential comp osition form in init have b een executed. First, the lo cal variable result is allo cated in init with default initial value of 0. Second, the channel child is allo cated. An emptychannel with capacity 1 is created in channel space, and a lo cal variable child is allo cated in init whose value is 5 the address of the new channel.