Proving an Asynchronous Message Passing Program Correct

Transcription

1 Available at the COMP3151 website. Proving an Asynchronous Message Passing Program Correct Kai Engelhardt Revision: 1.4 This note demonstrates how to construct a correctness proof for a program that uses asynchronous message passing. Because we do not have a tailor-made proof method for such programs, we translate the program faithfully into a synchronous transition diagram, i.e., a representation for which we do have a proof method. Of the available proof methods we shall explore three: (a) Floyd s method applied in a brute-force fashion to the product transition diagram, (b) the Levin & Gries method which applies directly to synchronous transition diagrams without the need to calculate the product diagram, and (c) the compositional method, also applied to the synchronous transition diagram. Contents 1. Problem Statement: Sequence Transmission Specification Task Programming Task Verification Task Specification 2 3. C + MPI Program 2 4. Verification Asynchronous Transition Diagram P async Synchronous Transition Diagram P sync Ellipsis: A Brute Force Proof Assertion Network Proof Obligations Proving Partial Correctness with Levin & Gries First Attempt Second Attempt Proving Partial Correctness with the Compositional Method Three Compositionally-Inductive Assertion Networks Proving Termination φ k (a[k] = eof)-convergence Deadlock-Freedom A. Floyd s Method 10 B. Levin & Gries s Method 10 1

2 1. Problem Statement: Sequence Transmission Develop a program that transmits the content of a file from one node in a network to another Specification Task Formalise the informal requirements. The safety aspects should be acaptured in pre- and postconditions φ and ψ in a suitable assertion language such as predicate logic Programming Task Write a C + MPI program P C+MPI that implements the specification Verification Task Show that the program is correct w.r.t. the informal requirements. More precisely, this amounts to the following tasks: 1. Faithfully translate the program into an asynchronous transition system P async. 2. Translate P async into a synchronous transition system P sync. 3. Prove { φ P sync { ψ. 4. Prove termination: a) Find a precondition φ and prove φ -convergence of P sync. b) Prove deadlock-freedom of P sync. 2. Specification Suppose the input file is an eof-terminated sequence a of items that is to be copied to the sequence b by program P. The safety aspects of this can be captured by the following Hoare triple. {true P { i ( k i (b[k] = a[k] (a[k] = eof k = i))) (1) The liveness aspect would be that P is ( k (a[k] = eof))-convergent and deadlock-free. 3. C + MPI Program / MPI program to transmit a sequence of values from one process to another Compilation: mpicc Wall transmit. mpi.c o transmit. mpi Synopsis: mpirun n 2 transmit. mpi [ infile [ outfile ]] / #include <mpi.h> #include <stdio.h> #include < stdlib.h> int main ( int argc, char argv []) { int myid, otherid, size ; int tag = 1; MPI_Status status ; / initialize MPI and get own id (rank) / MPI_Init (&argc, &argv); 2 Id: asyncproofexample.tex,v /10/06 01:53:53 kaie Exp

3 MPI_Comm_rank (MPI_COMM_WORLD, &myid); MPI_Comm_size (MPI_COMM_WORLD, &size); if ( size!= 2) { fprintf ( stderr, "Error : use exactly two processes\ n" ); exit (EXIT_FAILURE); otherid = 1 myid; if (myid == 0) { / sender / / sort out where to read from / FILE infilep = stdin ; if (argc > 1) { if (( infilep = fopen (argv [1], "r" )) == NULL) { fprintf ( stderr, "Error : Couldn t open %s\n", argv [1]); exit (EXIT_FAILURE); int ci ; do { ci = fgetc ( infilep ); printf (" process %d sending %c to process %d\n", myid, (char) ci, otherid ); MPI_Send (&ci, 1, MPI_INT, otherid, tag, MPI_COMM_WORLD); while ( ci!= EOF); fclose ( infilep ); else { / receiver / / sort out where to write to / FILE outfilep = stdout ; if (argc > 2) { if (( outfilep = fopen (argv [2], "w")) == NULL) { fprintf ( stderr, "Error : Couldn t open %s\n", argv [2]); exit (EXIT_FAILURE); int co; do { MPI_Recv (&co, 1, MPI_INT, MPI_ANY_SOURCE, MPI_ANY_TAG, MPI_COMM_WORLD, &status); printf (" process %d received a %c\n", myid, (char) co); while (co!= EOF && fputc (co, outfilep )!= EOF); fclose ( outfilep ); MPI_Finalize (); return EXIT_SUCCESS; Translating the program to Promela is not really feasible because there are no unbounded asynchronous channels in Promela. Nevertheless, it may make sense to do so. #define f(x) 20 x #define CHANSIZE 5 #define EOF 1 chan C = [CHANSIZE] of { short active proctype P0 () { short i = 0; do LATEXed on October 6,

4 :: C! f( i ) if :: f( i ) == EOF > break :: else > fi i = i+1 od active proctype P1 () { short x; do :: C? x if :: x == EOF > break :: else > fi od This code can be used in a variety of ways. We can simulate it randomly, verify that f values are transmitted in order, verify that termination of both processes follows from having an i such that f (i) = EOF, or verify that any number of values transmitted by P0 is actually received by P1 even if there s no i with f (i) = EOF. 4. Verification 4.1. Asynchronous Transition Diagram P async Fig. 4.1 contains our faithful model of the program as an asynchronous transition diagram. (In quotes because we ve never really defined such a thing. Suffices to say that it s syntactically indistinguishable from a synchronous one, only the semantics assumes asynchronous message passing, i.e., channels modeled as FIFO queues, non-bocking sends and blocking receives.) a[i] EOF; C!a[i] i := i+1 C?b[j] j := j+1 s a[i] = EOF; C!a[i] i := i+1 s' j > 0 b[j-1] = EOF t t' Figure 1: Asynchronous transition diagram P async Synchronous Transition Diagram P sync Fig. 4.2 contains the translation of P async into a synchronous transition diagram P sync. Observe that the two processes did not change at all except for renaming one half of the channel. A third process was added to act as the asynchronous channel. We adapt the partial correctness claim one should prove to { i = 0 j = 0 q = [ ] Psync { b[0.. j 1] = a[0..i 1] a[i 1] = eof (2) to accommodate the initialisations of the local variables of the processes. 4 Id: asyncproofexample.tex,v /10/06 01:53:53 kaie Exp

5 a[i] EOF; C!a[i] i := i+1 D?b[j] j := j+1 C?x q := (q:x) s s' a[i] = EOF; C!a[i] i := i+1 s q q = [EOF]; D!EOF q := [ ] t q j > 0 b[j-1] = EOF t q = (x:q') [EOF]; D!x q := q' t' Figure 2: Synchronous transition diagram P sync with an explicit buffer process. Remark 1 This is harmless and could be avoided by having one extra location and transition in each process to initialise the variables but doing would add nothing of interest to the task. Second, one should prove that P sync is (i = 0 j = 0 q = [ ] k (a[k] = eof))-convergent and deadlock-free. 5. Ellipsis: A Brute Force Proof Instead of using one of the more sophisticated proof methods (Levin & Gries or AFR), we calculate the product transition system. This is feasible because the resulting transition diagram is still relatively small. It has at most 8 states (2 2 2). A casual inspection of the three processes reveals that half of these 8 states are unreachable. See Fig. 5 for the remaining transition diagram P Floyd. a[i] EOF i,q := i+1,(q:a[i]) q = (x:q') [EOF] q,b[j],j := q',x,j+1 s,s q,s' a[i] = EOF q,i := (q:a[i]),i+1 t,t q,t' j > 0 b[j-1] = EOF t,s q,s' q = [EOF] q,b[j],j := [ ],EOF,j+1 t,t q,s' q = (x:q') [EOF] q,b[j],j := q',x,j+1 Figure 3: Product transition diagram P Floyd Assertion Network As usual, all our assertions share an invariant I = i 0 j 0 a[0..i 1] = b[0.. j 1] ++ q Q s,sq,s = I (i > 0 a[i 1] eof) Q t,sq,s = I i > 0 a[i 1] = eof Q t,tq,s = I i > 0 a[i 1] = eof q = [ ] LATEXed on October 6,

6 Q t,tq,t = I i > 0 a[i 1] = eof q = [ ] 5.2. Proof Obligations Each of the six transitions gives rise to one proof obligation. = Q s,sq,s a[i] eof (Q s,s q,s ) (i, q := i + 1, (q : a[i])) (3) = Q s,sq,s q = (x : q ) [eof] (Q s,sq,s ) (q, b[j], j := q, x, j + 1) (4) = Q s,sq,s a[i] = eof (Q t,s q,s ) (i, q := i + 1, (q : a[i])) (5) = Q t,sq,s q = (x : q ) [eof] (Q t,sq,s ) (q, b[j], j := q, x, j + 1) (6) = Q t,sq,s q = [eof] (Q t,t q,s ) (q, b[j], j := [ ], eof, j + 1) (7) = Q t,tq,s j > 0 b[j 1] = eof Q t,t q,t (8) Besides these proof obligations, we also must show that pre-, resp., postcondition relate to the initial, resp., final assertion. = i = 0 j = 0 q = [ ] Q s,sq,s (9) = Q t,tq,s b[0.. j 1] = a[0..i 1] a[i 1] = eof (10) 6. Proving Partial Correctness with Levin & Gries Let us return to Fig According to Levin & Gries, we may need to augment the synchronous transition diagram with auxiliary variables before being able to express the assertions First Attempt As demonstrated in class, it suffices to add a single history variable h for recording communication, similar in nature to the one we ve met when we discussed the open semantics. We write h {X for the sequence of values recorded in h for communications along channel X. Let #s denote the length of sequence s. a[i] EOF; C!a[i] i,h := i+1,h D?b[j] j := j+1 C?x q := (q:x) s s' a[i] = EOF; C!a[i] i,h := i+1,h s q q = [EOF]; D!EOF q,h := [ ],h t q j > 0 b[j-1] = EOF t q = (x:q') [EOF]; D!x q,h := q',h t' Figure 4: Synchronous transition diagram P sync. Q s = i 0 a[0..i 1] = h {C eof a[0..i 1] Q t = i > 0 a[0..i 1] = h {C eof a[0..i 2] a[i 1] = eof Q sq = h {D ++ q = h {C eof h {C [0..#(h {C ) 2] Q tq = h [ ] q = [ ] h {D = h {C eof h {C [0..#(h {C ) 2] h {C [#(h {C ) 1] = eof Q s = j 0 b[0.. j 1] = h {D eof b[0.. j 2] Q t = j > 0 b[0.. j 1] = h {D eof b[0.. j 2] b[j 1] = eof In retrospect, using a single auxiliary variable complicates notation. 6 Id: asyncproofexample.tex,v /10/06 01:53:53 kaie Exp

7 6.2. Second Attempt We now move to two separate auxiliary variables h for channel C and h for channel D. a[i] EOF; C!a[i] i,h := i+1,h D?b[j] j := j+1 C?x q := (q:x) s s' a[i] = EOF; C!a[i] i,h := i+1,h s q q = [EOF]; D!EOF q,h' := [ ],h' t q j > 0 b[j-1] = EOF t q = (x:q') [EOF]; D!x q,h' := q',h' t' Figure 5: Augmented synchronous transition diagram P sync. We propose the following assertion network in accordance with point 2 of Levin & Gries s method (see Appendix B). Q s = i 0 a[0..i 1] = h eof a[0..i 1] Q t = i > 0 a[0..i 1] = h eof a[0..i 2] a[i 1] = eof Q sq = h ++ q = h eof h[0..#h 2] Q tq = h [ ] q = [ ] h = h eof h[0..#h 2] h[#h 1] = eof Q s = j 0 b[0.. j 1] = h eof b[0.. j 2] Q t = Q s j > 0 b[j 1] = eof For local correctness (point 3 of Levin & Gries) we note that there s only a single internal transition, from s to t in P 3. The resulting proof obligation, = Q s j > 0 b[j 1] = eof Q s j > 0 b[j 1] = eof is immediate. There are four syntactically matching pairs of I/O-transitions. Each one of them gives rise to a proof obligation. = Q s Q sq a[i] eof (Q s Q sq ) (i, h := i + 1, h ++ [a[i]]) (q := (q : x)) (x := a[i]) (11) = Q s Q sq a[i] = eof (Q t Q sq ) (i, h := i + 1, h ++ [a[i]]) (q := (q : x)) (x := a[i]) (12) = Q sq Q s q = (x : q ) [eof] (Q sq Q s ) (q, h := q, h ++ [x]) ( j := j + 1) (b[j] := x) (13) = Q sq Q s q = [eof] [eof] (Q tq Q s ) (q, h := [ ], h ++ [x]) ( j := j + 1) (b[j] := x) (14) All these should be checked, preferably by a machine. To demonstrate how this would be done on paper, we pick just one, say, (13). We begin on the RHS (right-hand side) of the implication and work our way backwards through a sequence of (or ) steps until we reach the LHS. The reason for proceeding right-to-left is that here, the RHS has more structure with its three occurrences of. Let σ be a state. σ = (Q sq Q s ) (q, h := q, h ++ [x]) ( j := j + 1) (b[j] := x) translating the update functions into substitutions (see Remark 2 below) σ = (Q sq Q s )[ q,h ++[x] / q,h ][ j+1 / j ][ (b:j x) / b ] def s of the assertions ( h σ = ++ q = h eof h[0..#h 2] j 0 b[0.. j 1] = h eof b[0.. j 2] performing the substitutions ) [ q,h ++[x] / q,h ][ j+1 / j ][ (b:j x) / b ] LATEXed on October 6,

8 σ = σ = h ++ [x] ++ q = h eof h[0..#h 2] j (b : j x)[0.. j + 1 1] = h ++ [x] eof (b : j x)[0.. j + 1 2] logic (see Remark 3 below) h ++ q = h eof h[0..#h 2] j 0 b[0.. j 1] = h eof b[0.. j 2] q = (x : q ) [eof] def s of the assertions σ = Q sq Q s q = (x : q ) [eof] Remark 2 Note that in the first step the order of the substitutions is relevant because we re first receiving into the array cell b[j] and then update j. In Hoare logic, we could express the entire proof obligation as { Qsq Q s q = (x : q ) [eof] b[j] := x; j := j + 1; q, h := q, h ++ [x] { Q sq Q s Using the sequential composition rule and the assignment axioms of Hoare logic we obtain that the substitutions need to be applied in the opposite order of the execution of the assignment statements. Remark 3 The step justified by logic above is the only interesting one. If in doubt, one ought to spend a few more words on justifying why this is a valid implication. Observe that, by our choice of auxiliary variables, all interference freedom tests (point 4 of Levin & Gries) are trivially satisfied because the only processes referring to a history variable are those two using the channel associated with that history variable. The state transformer f in point 5 could be just (h, h := [ ], [ ]). The last two points of Levin & Gries are then obvious. 7. Proving Partial Correctness with the Compositional Method With the compositional method, we prove properties of the three processes in Fig. 4.2 independently and then combine the properties using the parallel composition rule. Observe that the auxiliary variable h introduced explicitly in our first attempt using Levin & Gries in Section 6.1 is implicitly maintained in the compositional method. We therefore begin with the assertion network defined in that section Three Compositionally-Inductive Assertion Networks Let us call the three processes of the synchronous transition diagram presented in Fig. 4.2 S (for sender), A (for asychronous channel), and R (for receiver). The sender s assertion network is just Q s = (i 0 a[0..i 1] = h {C eof a[0..i 1]) Q t = (i > 0 a[0..i 1] = h {C eof a[0..i 2] a[i 1] = eof) followed by A s assertion network Q sq = (h {D ++ q = h {C eof h {C [0..#(h {C ) 2]) Q tq and, finally, R s. = (h [ ] q = [ ] h {D = h {C eof h {C [0..#(h {C ) 2] h {C [#(h {C ) 1] = eof) Q s = ( j 0 b[0.. j 1] = h {D eof b[0.. j 2]) Q t = ( j > 0 b[0.. j 1] = h {D eof b[0.. j 2] b[j 1] = eof) To prove that these are compositionally-inductive, we discharge seven proof obligations one for each transition. ( ) i 0 a[0..i 1] = h {C = eof a[0..i 1] a[i] eof (15) (i 0 a[0..i 1] = h {C eof a[0..i 1]) ([i := i + 1] [h := h ++ [(C, a[i])]]) 8 Id: asyncproofexample.tex,v /10/06 01:53:53 kaie Exp

9 = i 0 a[0..i 1] = h {C eof a[0..i 1] a[i] = eof (i > 0 a[0..i 1] = h {C eof a[0..i 2] a[i 1] = eof) ([i := i + 1] [h := h ++ [(C, a[i])]]) = h {D ( ++ q = h {C eof h {C [0..#(h {C ) 2] ) (h {D x ++ q = h {C eof h {C [0..#(h {C ) 2]) ([q := q ++ [x]] [h := h ++ [(C, x)]]) ( h {D = ++ q = h {C eof h {C [0..#(h {C ) 2] q = ([v] ++ q ) ) [eof] (h {D ++ q = h {C eof h {C [0..#(h {C ) 2]) ([q := q ] [h := h ++ [(D, v)]]) = h {D ++ q = h {C eof h {C [0..#(h {C ) 2] q = [eof] (h [ ] q = [ ] h {D = h {C eof h {C [0..#(h {C ) 2] h {C [#(h {C ) 1] = eof) ([q := [ ]] [h := h ++ [(D, eof)]]) = j 0 ( b[0.. j 1] = h {D eof b[0.. j 2] ) ( j 0 b[0.. j 1] = h {D b[j] eof b[0.. j 2]) ([j := j + 1] [h := h ++ [(D, b[j])]]) ( j 0 b[0.. j 1] = h {D = eof b[0.. j 2] j > 0 b[j 1] = eof j > 0 b[0.. j 1] = h {D eof b[0.. j 2] b[j 1] = eof By the diagram rule, discharging all these by proof establishes three triples. {Q s S {Q t { { Qsq A Qtq {Q s S {Q t Using the parallel composition rule twice, we arrive at: { { Qs Q sq Q s S A R Qt Q tq Q t Next we use the consequence rule with the additional premises to establish i = 0 j = 0 q = [ ] h = [ ] Q s Q sq Q s (26) Q t Q tq Q t b[0.. j 1] = a[0..i 1] a[i 1] = eof (27) {i = 0 j = 0 q = [ ] h = [ ] S A R {b[0.. j 1] = a[0..i 1] a[i 1] = eof (28) Finally, an application of the initialization rule yields as desired. {i = 0 j = 0 q = [ ] S A R {b[0.. j 1] = a[0..i 1] a[i 1] = eof ) (16) (17) (18) (19) (20) (21) (22) (23) (24) (25) 8. Proving Termination 8.1. φ k (a[k] = eof)-convergence Let k 0 be the smallest k such that a[k] = eof. The ranking functions are: ρ s = k 0 i + 2 ρ t = ρ tq = ρ t = 0 ρ sq = 2k 0 (#h + #h ) + 3 ρ s = Deadlock-Freedom Each one of the seven global locations (i.e., triples consisting of one location for each of our three processes) different from the terminal one, (t, t q, t ), is live, that is, for location (l 1, l 2, l 3 ), if the three assertions Q l1, Q l2, and Q l3 are satisfied, then there exists an enabled internal transition (or a matching pair of enabled I/O-transitions) leaving from either of these locations. LATEXed on October 6,

10 A. Floyd s Method To prove {φ P {ψ for a transition diagram P = (L, T, s, t) proceed as follows: 1. Choose an assertion network (Q l ) l L. 2. For every transition l = Q l b Q l f. 3. Prove = φ Q s. 4. Prove = Q t ψ. b f l T prove: B. Levin & Gries s Method To prove {φ P {ψ for a synchronous transition diagram P = P 1... P n, where the P i = (L i, T i, s i, t i ) are such that the processes location sets L i are pairwise disjoint and the processes variable sets are pairwise disjoint, we proceed as follows: 1. Augment each of the P i by introducing (shared) auxiliary variables z, which should occur in neither P, nor φ, nor ψ. Every I/O transition α f is extended to α f g, where g is a state transformation such that its write variables are amongst the elements of the vector z. This leads to an augmented synchronous transition diagram P = P 1... P n with transition relations T 1,... T n. 2. Choose an assertion network (Q l ) l ni=1 L i such that assertions for locations of process P i involve only program variables of P i and and auxiliary variables. 3. Prove (local correctness) for every P i : for every internal transition l b f l T i prove: = Q l b Q l f. For all i j and matching pairs of I/O transitions l i = Q li Q lj b b (Q l i Q l j ) f g (x := e). b;c!e f l i T i and l j b ;C?x g l j T j show that b i ;C!e f i 4. Prove interference freedom for matching pairs l i l i T i and l j of process P m, m i, j: = Q li Q lj Q lm b i b j Q lm f i f j (x := e) b j ;C?x f j l j T j, and location l m 5. Prove = φ ( n i=1 Q si ) f for some state transformation f whose write variables are auxiliary. 6. Prove = n i=1 Q ti ψ. 10 Id: asyncproofexample.tex,v /10/06 01:53:53 kaie Exp