Top Banner
90

Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

Jul 22, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response �

Chapter �

Response

In the preceding chapters we discussed methods for proving safety properties�While the class of safety properties is very important� and normally occupies alarge portion of a speci�cation� it must be complemented by properties in theother classes�

It is interesting to note that the expression of safety properties and their ver�i�cation use relatively little temporal logic� The main emphasis there is directedtowards �nding assertions that are invariant over the computation of a program�Most of the veri�cation e�orts are concentrated on showing that the assertionsare inductive� This requires proving a set of veri�cation conditions� which are ex�pressed by nontemporal state formulas� Temporal logic is used mainly for statingthe �nal result of invariance of the assertion� It is true that� when consideringprecedence properties� we extensively use the past part of temporal logic� But aswe commented there� an equivalent� though sometimes less elegant� state formu�lation of these properties can be managed through auxiliary or history variables�

It is only when we enter the realm of more general properties� that temporallogic becomes an essential and irreplaceable tool� Thus if� for some reason� one iswilling to restrict himself to the study of safety properties of reactive programs�he does not need the full power of temporal logic�

A related observation is that� only when we go beyond safety properties doesfairness become meaningful� Recall the de�nition of a run as a state sequencethat satis�es the requirements of initiation and consecution but not necessarilyany of the fairness requirements� It can be shown that a safety formula holds overall runs of a program if and only if it holds over all computations� i�e�� fair runs�Thus� safety properties cannot distinguish between fair and unfair runs�

This is no longer the case with progress �nonsafety� properties� Note� forexample� that the in�nite sequence s�� s�� � � � is a legal run of any program P �provided s� q � This run is generated by continuously taking the idling transition�I� There are very few progress properties that hold over this run�

Page 2: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Consequently� while safety properties do not depend on the fairness require�ments for their validity� progress properties do� In Chapters �� we concentrateon the important class of response properties� which is one of the progress classes�This class contains properties that can be expressed by a formula of the form

� � p�

for a past formula p� In these chapters� we introduce a family of rules for responseproperties that rely on the di�erent fairness requirements� Chapters � presentrules that rely on justice� while Chapter � presents rules that rely on �justice and�compassion�

Chapter � completes the picture by presenting rules for the highest progressclass� that of reactivity�

Chapter deals with response properties that rely on the just transitions ofthe system for their validity� Chapter � generalizes the treatment to propertiesthat rely on both justice and compassion for their validity�

In Section � we consider a single�step rule that relies on the activation of asingle just transition�

Section � shows how to combine several applications of the single�step ruleinto a rule that relies on a �xed number of activations of just transitions�

Section �� generalizes the rule to the case that the number of just activationsnecessary to achieve the goal is not �xed and may depend� for example� on aninput parameter�

In Section ��� we extend all the above methods to prove properties expressedby response formulas that contain past subformulas�

Section �� deals with the class of guarantee formulas� treating them as aspecial case of response properties�

In a similar way� Section �� considers the class of obligation properties�Again� their veri�cation is based on their consideration as a special case of theresponse class�

��� Response Rule

Even though there are several di�erent classes of progress properties� their veri��cation is almost always based on the establishment of a single construct � theresponse formula

p � � q�

for past formulas p and q� This formula states that any position in the computa�tion which satis�es p must be followed by a later position which satis�es q� Since

Page 3: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Response Rule �

the canonical response formula � � q is equivalent to T � � q� it follows thatevery response property can be expressed by a formula of the form p� � q�

A general response property allows p and q to be general past formulas� InSections ���� we consider the simpler case that p and q are assertions� InSection �� we will generalize the treatment to the case that p and q are pastformulas�

A Single�Step Rule

A single�step rule� relying on justice� is provided by rule RESP�J presented inFig� ��

For assertions p� q� �� and transition �h � J �

J� p � q � �

J � f�g T fq � �g

J�� f�g �h fqg

J�� � � En��h�

p � � q

Fig� �� Rule RESP�J �single�step response under justice��

The rule calls for the identi�cation of an intermediate assertion � and a justtransition �h � J � to which we refer as the helpful transition�

Premise J of the rule states that� in any position satisfying p� either the goalformula q already holds� or the intermediate formula �� bridging the passage fromp to q� holds� The q�disjunct of this premise covers the case that the distancebetween the p�position and the q�position is �� The ��disjunct and the otherpremises cover the case that the distance between these two positions is positive�

Premise J requires that every transition leads from a ��position to a positionthat satis�es q � �� That is� either a position satisfying the goal formula q isattained or� if not� then at least the intermediate � is maintained�

Premise J� requires that the helpful transition �h always leads from a ��position to a q�position�

Premise J� requires that the helpful transition �h is enabled at every ��position�

Page 4: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Justi�cation To justify the rule� consider a computation � which satis�es thefour premises of the rule� Assume that p holds at position k� k � �� We wish toshow that q holds at some position i� i � k� Assume� to the contrary� that it doesnot� That means that for all i� i � k� q does not hold at i� By J� � holds atposition k� By J � every successor of a ��state is a �q � ���state�

Since we assumed that q never occurs beyond k� it follows that � holds con�tinuously beyond k� By J�� the just transition �h must be continuously enabled�However� �h is never taken beyond k� This is because if �h were taken� it wouldhave been taken from a ��position� and by J� the next position would have sat�is�ed q� Thus we have that �h is continuously enabled� but never taken beyondk� It follows that the sequence � is not just with respect to �h� and is� therefore�not a computation�

This shows that� for all computations� there must exist an i� i � k such thatq holds at i�

In applications of the rule� it is su�cient to establish premise J for all � �� �h�since J for � � �h is implied by J�� It is also unnecessary to check premise J for � � �

I� the idling transition� since f�g �

If�g is trivially state valid�

Example �program ANY�Y�

Program ANY�Y of Fig� � illustrates a simple program consisting of two processescommunicating by the shared variable x� initially set to �� Process P� keepsincrementing variable y as long as x � �� Process P� has only one statement�which sets x to � Obviously� once x is set to � process P� terminates� and sometime later so does P�� as soon as it observes that x �� ��

local x� y� integer where x � y � �

P� ��

������ while x � � do

��� y �� y �

���

��� P� ��

�m�� x ��

m��

Fig� � � Program ANY�Y�

We illustrate the use of rule RESP�J for proving the response property

at�m� � � �x � �

for program ANY�Y�

Page 5: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Response Rule �

As the helpful transition �h we take m�� As the intermediate assertion � wetake p� at�m�� Premise J assumes the form

at�m� z �p

� � � �z�q

� at�m� z ��

which is obviously valid� Premise J is established by showing that all transitions�excluding m�� preserve �� at�m�� which is clearly the case�

Premise J� requires showing that m� leads from any ��state to a q�state�expressed by

� � � x� � z ��m�

� � �z��

� x� � z �q�

which is obviously valid� Finally� J� requires

at�m� z ��

� at�m� z �En�m��

which is also valid� This establishes that the property speci�ed by the responseformula at�m� � � �x � � is valid over program ANY�Y�

Combining Response Properties

Rule RESP�J by itself is not a very strong rule� and is su�cient only for proving one�step response properties� i�e�� properties that can be achieved by a single activationof a helpful transition� For example� while program ANY�Y always terminates� itstermination cannot be proven by a single aplication of rule RESP�J�

In general� most response properties of the form p � � q require severalhelpful steps in order to get from a p�position to a q�position�

To establish such properties we may use several rules that enable us to com�bine response properties� each established by a single application of rule RESP�J�These rules are based on general properties of response formulas that allow usto form these combinations� We list some of these properties as proof rules� Allof these rules can be established as derived rules� using the standard deductivesystem for temporal logic� �

Monotonicity

An important property of response formulas is the monotonicity of both the an�tecedent and the consequent� This can be summarized in the form of the �mono�tonicity� rule MON�R� presented in Fig� ���

� For example� the one presented in Chapter � of Volume I�

Page 6: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response

p � q q � � r r � t

p � � t

Fig� ��� Rule MON�R �monotonicity of response�

Rule MON�R enables us to strengthen the antecedent and weaken the conse�quent� Thus� if we managed to prove the response formula

at��� � � �x � ��

we can infer from it� using rule MON�R� the formula

at��� � � �x � ���

Reexivity

Property RFLX�R of Fig� �� states that the � operator is re�exive�

p � � p

Fig� ��� Property RFLX�R �re�exivity of response�

We may use this property to prove simple response formulas such as

x � � � � �x � ���

Transitivity

The transitivity property of response formulas is expressed by the �transitivity�rule TRNS�R� presented in Fig� ���

p � � q q � � r

p � � r

Fig� ��� Rule TRNS�R �transitivity of response�

Page 7: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Response Rule

Thus� if we managed to prove for program ANY�Y the two response formulas

at��� at�m� x � � � �at��� at�m� x � �

at��� at�m� x � � � �at��� at�m���

we may use rule TRNS�R to conclude

at��� at�m� x � � � �at��� at�m���

The soundness of rule TRNS�R is obvious� Consider a computation � such thatthe �rst two premises are valid over �� Let i be a position satisfying p� By the�rst premise� there exists a position j� j � i� satisfying q� By the second premise�there exists a position k� k � j� satisfying r� Thus� we are ensured of a positionk� k � i� satisfying r� which establishes p� � r�

Proof by Cases

Another useful property of response formulas is that it is amenable to proof bycases� This possibility is presented by rule CASES�R of Fig� ���

p � � r q � � r

�p � q� � � r

Fig� ��� Rule CASES�R �case analysis for response�

Assume� for example� that we have proved for program ANY�Y the two fol�lowing reponse formulas�

at��� at�m� x � � � �at��� at�m��

at��� at�m� x � � � �at��� at�m���

Then� we may use rule CASES�R to conclude

�at��� at�m� x � � � �at��� at�m� x � � �

� �at��� at�m���

from which� by rule MON�R� we can infer

at����� at�m� x � � � �at��� at�m���

Example �program ANY�Y�

We will illustrate the use of these rules by proving termination of program ANY�Y�This property can be expressed by the response formula

Page 8: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

� � �at��� at�m���

where

� � f���m�g x � � y � �

is the initial condition of program ANY�Y�

The proof consists of the following steps�

� at��� at�m� x � � � � �at����� at�m� x � �by rule RESP�J� taking �h� m� and �� at����� at�m� x � �

� at��� at�m� x � � � �at��� at�m��by rule RESP�J� taking �h� �� and �� at��� at�m� x �

�� at��� at�m� x � � � �at��� at�m� x � �by rule RESP�J� taking �h� �� and �� at��� at�m� x �

�� at��� at�m� x � � � �at��� at�m��by rule TRNS�R� applied to � and

�� �at��� at�m� x � � � �at��� at�m� x � � �� �at��� at�m��

by rule CASES�R� applied to and �

�� at����� at�m� x � ��at��� at�m� x � � � �at��� at�m� x � �

an assertional validity

�� at����� at�m� x � � � �at��� at�m��by rule MON�R� using � and �

�� at��� at�m� x � � � � �at��� at�m��by rule TRNS�R� applied to and �

�� � at��� at�m� x � � an assertional validity

�� � � �at��� at�m�� by rule MON�R� applied to � and ��

��� Chain Rule

The proof of the last example follows a very speci�c pattern that occurs oftenin proofs of response properties� According to this pattern� to establish p �� q� we identify a sequence of intermediate situations described by assertions�m� �m��� � � � � �� such that p implies one of �m� � � � � ��� and q is identical with

Page 9: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Rule �

�� �or is implied by ���� We then show that for every i � �� being at �i impliesthat eventually we must reach �j for some j i�

We can interpret the index i of the intermediate formula �i as a measure ofthe distance of the current state from a state that satis�es the goal q� Thus� thelower the index� the closer we are to achieving the goal q� For a position j� let �ibe the intermediate formula with the smallest i s�t� �i holds at j� We refer to theindex i as the rank of position j�

This proof pattern is summarized in rule CHAIN�J �Fig� ����

For assertions p and q � ��� ��� � � � � �m andtransitions ��� � � � � �m � J

J� p �m�j�

�j

J � f�ig T

�j�i

�j

J�� f�ig �i

�j�i

�j

�J�� �i � En��i�

�����������������for i � � � � � �m

p � � q

Fig� ��� Rule CHAIN�J �chain rule under justice��

According to premise J� p implies that one of the intermediate formulas �i�possibly �� implying q� holds� Premise J requires that taking any transitionfrom a �i�position results in a next position which satis�es �j � for some j i�Premise J� requires that taking the helpful transition �i from a �i�position resultsin a next position which satis�es �j for j i� We can view premise J as statingthat the rank never increases� while premise J� states that the helpful transitionguarantees that the rank decreases� Premise J� claims that the helpful transition�i is enabled at every �i�position�

Justi�cation Assume that all four premises are P �state valid� Consider aP �computation � and a position t that satis�es p� We wish to prove that some

Page 10: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

later position satis�es q� Assume to the contrary that all positions later than t�including t itself� do not satisfy q� By J� position t satis�es �j for some j � ��Index j cannot be � because �� � q and we assumed that no position beyond tsatis�es q� Thus� position t satis�es �j � for some j � �� By J � position t � satis�es some �k� k j� Again� k � � due to �� � q� Continuing in this manner�it follows that every position beyond t satis�es some �j for j � �� to which werefer as the rank of the position�

By J � the rank of the position can either decrease or remain the same� Itfollows that there must exist some position k � t� beyond which the rank neverdecreases�

Assume that i is the rank of the state at position k� Since q is never satis�edand the rank never decreases beyond position k� it follows �by J � that �i holdscontinually beyond k� By J�� �i cannot be taken beyond k� because that wouldhave led to a rank decrease� By J�� �i is continually enabled beyond k yet� by theargument above� it is never taken� This violates the requirement of justice for �i�

It follows that if all the premises of the rule are P �state valid then the con�clusion p� � q is P �valid�

Note that since premise J� implies premise J for � � �i� it is su�cient tocheck premise J for a given i � � � � � �m� only for � �� �i� Also� it is unnecessaryto check premise J for � � �

I� since f�ig �I f�ig trivially holds�

Example �Reproving termination of program ANY�Y�

Let us show how termination of program ANY�Y can be proved �again� by a singleapplication of rule CHAIN�J�

The property we wish to prove is

at��� at�m� x � � y � � z �p

� � at��� at�m� z �q

Inspired by our previous proof of this property� we choose four assertions andcorresponding helpful transitions as follows�

��� at����� at�m� x � � ��� m�

��� at��� at�m� x � ��� ��

��� at��� at�m� x � ��� ��

�� � q� at��� at�m��

Let us consider each of the premises of rule CHAIN�J�

� Premise J

This premise calls for proving

Page 11: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Rule ��

p ���

j�

�j �

We will prove p� ��� which amounts to

at��� at�m� x � � y � � z �p

� at����� at�m� x � � z ���

which obviously holds�

� Premises J �J� for i � �� �

We list below the premises that are proven for each i� i � �� � �

Assertion ��� at����� at�m� x � �nat����� at�m� x � � z �

��

o�nat����� at�m� x � � z �

��

ofor each � �� m�

nat����� at�m� x � � z �

��

om�

���������at��� at�m� x � z �

��

at��� at�m� x � z ���

���������at����� at�m� x � � z �

��

� at�m� z �En�m��

Assertion ��� at��� at�m� x � nat��� at�m� x � z �

��

o�nat��� at�m� x � z �

��

ofor every � �� ��n

at��� at�m� x � z ���

o��

nat��� at�m� x � z �

��

ohat��� at�m� x � z �

��

i� at��� z �

En����

Assertion ��� at��� at�m� x � nat��� at�m� x � z �

��

o�nat��� at�m� x � z �

��

ofor every � �� ��

Page 12: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

nat��� at�m� x � z �

��

o��

nat��� at�m� z �

��

oat��� at�m� x � z �

��

� at��� z �En����

All of these implications and veri�cation conditions are obviously state valid�which establishes the conclusion

� � �at��� at�m���

Relation to rule NWAIT

There is a strong resemblance between the premises of rule CHAIN�J and those ofrule NWAIT �Fig� ��� on page �� of the SAFETY book�� This is not surprising�since in both cases we wish to establish the evolution from p to q �q� in the caseof NWAIT� by successively passing through �m� �m��� � � � � ��� ���

The main di�erence is that� in rule NWAIT� we are quite satis�ed if� from acertain point on� we stay forever within �j for some j � �� This is unacceptablein a response rule� where we are anxious to establish eventual arrival at ��� Thisdi�erence is expressed in premise J� which requires that activation of the helpfultransition �i takes us out of a �i�state� and premise J� which requires that �i isenabled on all �i�states� These premises have no counterparts in rule NWAIT� Thisexcludes computations that consist of states whose rank� from a certain point on�never decreases below some j � ��

Another di�erence is that� in rule NWAIT� we allow a transition to lead from

�i� i � �� back to �i� This is expressed by the disjunction��j�i

�j � appearing in

the postcondition of premise N�� Rule CHAIN�J allows this in premise J for allbut the helpful transition� which is required in J� to lead to a position with astrictly lower rank�

In spite of these di�erences� many of the approaches used in the study ofprecedence properties are also applicable to the analysis of response properties�One of these useful approaches is that of veri�cation diagrams introduced inSection ��� of the SAFETY book�

��� Chain Diagrams

As observed in the previous example �program ANY�Y�� in many cases it su�cesto specify the intermediate assertions ��� ��� � � � � �m and to identify the helpfultransitions ��� � � � � �m� The proofs of the actual veri�cation conditions is a detail

Page 13: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

that can be left to skeptical readers� and eventually to an automated system�Only some of the veri�cation conditions raise interesting questions� and those areusually elaborated in a presentation of a proof� However� the main structure of theproof is adequately represented by the list of assertions and their correspondinghelpful transitions�

A concise visual summary of this information� and some additional details� isprovided by veri�cation diagrams� Veri�cation diagrams were already introducedin Section ��� of the SAFETY book to represent proofs using rule NWAIT� However�we give here an independent description of the diagrams that support proofs ofresponse properties by rule CHAIN�J�

Veri�cation Diagrams

A veri�cation diagram is a directed labeled graph constructed as follows�

� Nodes in the graph are labeled by assertions� We will often refer to a nodeby the assertion labeling it�

� Edges in the graph represent transitions between assertions� The diagramspresenting proofs by rule CHAIN�J allow edges of two types� represented graph�ically by single ��lined� and double ��lined� arrows� Each edge of either typedeparts from one assertion� connects to another� and is labeled by the nameof a transition� We refer to an edge labeled by � as a � �edge�

� One of the nodes may be designated as a terminal node ��goal� node�� Inthe graphical representation� this node is distinguished by having a boldfaceboundary� No edges depart from a terminal node� Terminal nodes correspondto �goal� assertions such as �� in rule CHAIN�J�

Chain Diagrams

A veri�cation diagram is said to be a chain diagram if its nodes are labeled byassertions ��� � � � � �m� with �� being the terminal node� and if it satis�es thefollowing requirements�

� If a single ��line� edge connects node �i to node �j � then i � j�

� If a double ��line� edge connects node �i to node �j � then i � j�

� Every node �i� i � �� has a double edge departing from it� This identi�esthe transition labeling such an edge as helpful for assertion �i� All helpfultransitions must be just�

The �rst two requirements ensure that the diagram is weakly acyclic in the sensede�ned in Section ��� of the SAFETY book for WAIT diagrams� That is� the terminalnode is labeled by �� and whenever node �i is connected by an edge �single ordouble� to node �j � then j i� The stronger second requirement ensures thatthe subgraph based on the double edges is acyclic� forbidding self�connections by

Page 14: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

double edges� The third requirement demands that every nonterminal assertion�i�e�� �i for i � �� has at least one helpful transition associated with it�

Veri�cation Conditions for CHAIN Diagrams

The assertions labeling nodes in a diagram are intended to represent the inter�mediate assertions appearing in a CHAIN�J proof� A � �labeled edge connectingnode �i to node �j implies that it is possible for a �i�state to have a � �successorsatisfying �j � A double edge departing from node � and labeled by transition� identi�es � as helpful for assertion �� Consequently� we associate veri�cationconditions with nodes and the edges departing from them� These conditions�expressed by implications� represent premises J �J� of rule CHAIN�J�

For a node �i and transition � � connecting �i to �j � we say that �j is a� �successor of �i� Let � be a nonterminal node and ��� � � � � �k� k � �� be the� �successors of ��

V� If all the edges connecting � to its � �successors are single ��lined�� then weassociate with � and � the veri�cation condition

f�g � f� � �� � � � � � �kg�

Transition � � labeling only single edges� is identi�ed as unhelpful for �� Thiscondition� similar to premise J � allows � to lead from a ��state back to a��state� recording no progress�

The case of a transition � that does not label any edges departing from �is interpreted as though � labels k � � single�lined edges departing from ��That is� with such a transition we associate the veri�cation condition

f�g � f�g�

V � If some edge departing from � is double �hence k � ��� we associate with �and � the veri�cation condition

f�g � f�� � � � � � �kg�

This condition corresponds to premise J�� requiring a transition � � identi�edas helpful� to lead away from ��

V�� If � labels some double edge departing from �� we require

� � En�� ��

This condition corresponds to premise J�� requiring that a transition helpfulfor � is enabled on all ��states� We refer to this requirement as the enabling

requirement �

Valid CHAIN Diagrams

A CHAIN diagram is said to be valid over a program P �P �valid for short� if allthe veri�cation conditions associated with nodes of the diagram are P �state valid�

Page 15: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

The consequences of having a P �valid CHAIN diagram are stated by the fol�lowing claim�

Claim � �CHAIN diagrams�

A P �valid CHAIN diagram establishes that the response formula

m�j�

�j � � ��

is P �valid�

If� in addition� we can establish the P �state validity of the following implica�tions�

�J� p �m�j�

�j and �J�� �� � q

then� we can conclude the P �validity of

p � � q�

Justi�cation First� we show the �rst part of the claim� stating the P �validityof

m�j�

�j � � ���

We use rule CHAIN�J with p�Wmj� �j � q � �� and� for each i � � � � � �m� we

take �i �the helpful transition for �i� to be the transition labeling the double edgedeparting from �i�

For our choice of p and q� premise J of rule CHAIN�J assumes the form

�J�m�j�

�j �m�j�

�j �

which is trivially state�valid� We proceed to show that the P �state validity ofpremises J �J� follows from the P �validity of the diagram� for each i � � � � � �m�

Premise J requires showing

�J � �� �i � ��� � ��� � � � � � ��i�

for each � � T � Let �i� � � � � � �ik be the � �successors of �i in the P �valid diagram�for � � T � f�i� �Ig� By the requirement of weak acyclicity i� i� � � � � ik i�Since � �� �i� all the � �edges departing from node � are single�line edges and thefollowing veri�cation condition holds�

V� �� �i � ��i � ��i� � � � � � ��ik �

Page 16: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Since ij i for each j � � � � � � k� the disjunction on the right�hand side of V istaken over a subset of the assertions appearing on the right�hand side of premiseJ � It follow that J is state�valid for assertion �i and transition � � For � � �

I�

premise J holds trivially since ��I

implies ��i � �i� For � � �i� premise J isimplied by J��

Premise J� requires

�J�� ��i �i � ��� � ��� � � � � � ��i���

Let �i� � � � � � �ik be the �i�successors of �i in the P �valid diagram� Since all �i�edges departing from �i are double� ij i for j � � � � � � k and the followingveri�cation condition holds�

V � �� �i � ��i� � � � � � ��ik �

Repeating the subset argument� this implies the state validity of premise J��

Premise J� is identical to condition V� for every �i and �i� i � � � � � �m�

Next� we consider the more general case of p and q which are not identical toWmj� �j and ��� respectively� but satisfy the implications J and J�� Applying

rule MON�R to p�Wmj� �j � ��� and q �standing for p� q� r� and t in MON�R�� we

obtain the conclusion p � � q�

Note that chain diagrams and their notion of validity are a conservativeextension of the WAIT diagrams� introduced in Section ��� of the SAFETY book�The additional requirements that disallow a self�connecting edge all refer to doubleedges which are not present in WAIT diagrams� It follows that a P �valid CHAIN

diagram is also P �valid for proving the nested waiting�for formula

m�j�

�j � �m W �m�� � � ��� W ���

Example �program ANY�Y�

Consider again program ANY�Y �Fig� � �� The CHAIN diagram of Fig� �� providesa graphical representation for the proof of the response property

at��� at�m� x � � z �p

� ��at��� at�m� z �

q��

��

for program ANY�Y�

The diagram identi�es ��� � � � � �� as the intermediate assertions and m�� ��� ��as their corresponding helpful transitions� This CHAIN diagram is valid over pro�gram ANY�Y� which establishes the P �validity of

Page 17: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams �

��

����� at����� at�m� x � �

m�

m�

��

��

����� at��� at�m� x �

��

���

����� at��� at�m� x �

��

���

����� at��� at�m�

Fig� ��� CHAIN diagram for termination�

��j�

�j � � �at��� at�m��

over this program� Since �as shown above� � ��� the second part of Claim �establishes the P �validity of the termination property

� � �at��� at�m���

The Advantages of Diagrams

One of the advantages of the presentation of a CHAIN�J proof sketch by a CHAIN

diagram� over its presentation by a list of assertions and their correspondinghelpful transitions is that the diagram provides a stronger �and more detailed�version of premises J and J� than is standardly provided by rule CHAIN�J and alist of the assertions and helpful transitions�

Consider� for example� the proof presented in Fig� ��� Both the diagramand the textual proof identify �� as at��� at�m� x � and �� as its helpfultransition�

However� while rule CHAIN�J suggests that we prove for premise J� the veri��cation condition

f��g �� f�� � ��g�

the diagram claims that the even stronger condition

f��g �� f��g

Page 18: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

is P �state valid� This results from the fact that there is no ���edge connecting ��to ���

Encapsulation Conventions

There are several encapsulation conventions that lead to more structured hierar�chical diagrams and improve the readability and manageability of large complexdiagrams� These conventions were introduced in Section ��� of the SAFETY bookand we reproduce them here brie�y� to make the presentation self contained� Thebasic construct of encapsulation is that of a compound node that may containseveral internal nodes� The encapsulation conventions attribute to a compoundnode aspects and relations that are common to all of their contained nodes� Werefer to the contained nodes as descendants of the compound node� Nodes thatare not compound are called basic nodes� We use three encapsulation conventions�

� Departing edges

An edge departing from a compound node is interpreted as though it departedfrom each of its descendants� This is represented by the graphical equivalenceof Fig� ���

������

������

C

DE

F

�������

������

������

C

DE

F

�����

j

Fig� ��� Departing edges�

� Arriving edges

In a similar way� an edge arriving at a compound node is interpreted as thoughit arrived at each of its descendants� This is represented in the graphicalequivalence of Fig� ���

� Common factors

An assertion � labeling a compound node is interpreted as though it were aconjunct added to each of the labels of its descendants� This is representedby the graphical equivalence of Fig� �� We refer to � as a common factor

of the two nodes�

Page 19: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

������

������

C

DE

F

����

���

������

������

C

DE

F

�����

��

q�

Fig� ��� Arriving edges�

����� ��

����� ��

C

DE

F

������

������

C

DE

F�

Fig� �� Common factors�

Example In Fig� � we present a veri�cation diagram which is the encapsu�lated version of the veri�cation diagram of Fig� ���

This encapsulation uses the arriving edge convention to denote by a singlearrow the two edges connecting �� to �� and to ��� It uses the common factorconvention to simplify the presentation of �� and ���

Additional Examples

Let us consider a few more examples for the application of rule CHAIN�J and CHAIN

diagrams� illustrating the encapsulation conventions�

Example �Peterson�s Algorithm � version �

For the next example� we return to program MUX�PET�� Peterson�s algorithm formutual exclusion �Fig� ���� This program was previously studied in Section ��of the SAFETY book� where we established for it the following invariants�

��� s � � s �

��� y� � at������

Page 20: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

��

����� at����� at�m� x � �

m�

� C

DE

Fat�m� x � ��

����� at���

��

���

����� at���

��

�� ���� at��� at�m�

Fig� � � Encapsulated version of CHAIN diagram for termination�

��� y� � at�m�����

We wish to prove for this program the response property of accessibility�given by

at��� z �p

� � at��� z �q

To use rule CHAIN�J or its diagram representation� we have to identify in�termediate assertions that characterize the intermediate situations between thestarting assertion p� at��� and the goal assertion q� at���� It is obvious that the�rst helpful step in the progress from �� to �� is process P� moving from �� to��� Consequently� we can safely take �m to be at��� and the helpful transition�m to be ��� We cannot yet determine the value of m because it depends on thenumber of helpful steps necessary to get from �� to ��� We can now concentrateon showing how to get from �� to ���

Similar to the heuristics employed in the application of rule NWAIT �Sec�tion ��� of the SAFETY book�� it is often useful to work backwards from the goalassertion at���� Consequently� we take �� to be at����

For the previous intermediate assertion ��� we look for situations that areonly one helpful step away from ��� Clearly� the only transition that can accom�plish �� in one step is ��� If we choose the helpful transition �� to be ��� then

Page 21: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

local y�� y�� boolean where y� � y� � F

s � integer where s �

P� ��

����������

��� loop forever do���������� noncritical

��� �y�� s� �� �T� �

��� await �y� � s ��

��� critical

��� y� �� F

�������

����������

P� ��

����������

m�� loop forever do�������m�� noncritical

m�� �y�� s� �� �T� �

m�� await �y� � s ��

m�� critical

m�� y� �� F

�������

����������Fig� ��� Program MUX�PET� �Peterson�s algorithm� � version �

the appropriate �� is the assertion characterizing all the states on which �� isenabled� Therefore� as �� we take the enabling condition of ��

��� at��� ��y� � s �� ��

Assertion �� does not yet cover all the accessible states satsifying at����Consequently� we cannot take m to be � and must search for additional assertions�characterizing states that satisfy at��� and that are one helpful step away from��� Therefore� we look for transitions of P� that may change the disjunction�y� � s � from F to T� The only candidate transition is m�� which sets y� to F�Consequently� we take

��� at��� at�m� y� s � �

The conjunct y� s � can be safely added to �� since all the states satisfyingat��� ��y� � s �� � are already covered by ���

Looking for �at��� y� s � ��states that are one helpful step away from��� we easily identify

��� at��� at�m� y� s � �

Page 22: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

In a similar way� we can identify the preceding assertion as

��� at��� at�m� y� s � �

Note that m�� which is the helpful transition for ��� is enabled on all statessatisfying ���

At this point� we �nd out that the disjunction �� � � � ���� covers the rangeof all accessible �at�����states� This is because P� must be in one of the locationsm�� � � � �m�� Due to ��� the range m���� is covered by �� under the �y� disjunct�Locations m� � � � �m� for s �� are covered by �� under the disjunct s �� � whilethe same locations for the case that s � are covered by assertions ��� ��� ���respectively�

In Fig� �� we present a CHAIN diagram using the intermediate assertionsconstructed through the preceding analysis�

Note that we have grouped under �� many possible states of P�� and havenot represented the movement of P� through them� This is justi�ed by the factthat �� is enabled on all of these states and is the transition declared as helpfulfor ��� In contrast� we separated m�� m�� and m�� because the helpful transitionsthere changed from one of these states to the next�

In Problem �� the reader is requested to establish accessibility for anotheralgorithm for mutual exclusion�

Example �Peterson�s Algorithm � Version �

Consider the re�ned program MUX�PET�� version of Peterson�s algorithm� pre�sented in Fig� ���

In Section �� of the SAFETY book� we established the following invariants forthis program�

�� s � � s �

�� y� � at�����

�� y� � at�m��� �

We intend to verify the property of accessibility for program MUX�PET�� whichcan be expressed by the response formula

at��� z �p

� � at��� z �q

The construction of the appropriate veri�cation diagram starts in a similarway to the diagram for program MUX�PET� of the previous example� We take �mto be at���� From ��� process P� can proceed at its own pace to ��� which wetake as �m��� The next step taken by P� leads into �� where a more detailedanalysis is necessary�

Page 23: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

��

����� at���

��

� C

DE

Fat���� y�C

DE

Fy�� s � ��

����� at�m�

m�

���

����� at�m�

m�

���

����� at�m�

m�

���

����� �y� � s ��

��

�� ���� at���

Fig� ��� CHAIN diagram for program MUX�PET��

To perform this detailed analysis we take �� to be the goal assertion at����What should we take as ��� In the preceding case� we characterized �� as beingone helpful step away from ��� This characterization is not su�cient here� An�other requirement is that if s� is a successor of a ���state� then s� should satisfyeither �� or ��� at���� This shows that we cannot take �� to be� as before� theassertion at��� ��y� � s �� �� This is because the accessible state

s��� f���m�g� y��T� y�� F� s�

�satis�es the candidate assertion at��� ��y� � s �� � but has an m��successor

Page 24: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

local y�� y�� boolean where y� � y� � F

s � integer where s �

P� ��

������������������

��� loop forever do���������������

��� noncritical

��� y� �� T

��� s ��

���

����a�� await �y�or

�b�� await s ��

������ critical

� � y� �� F

���������������

������������������

P� ��

������������������

m�� loop forever do���������������

m�� noncritical

m�� y� �� T

m�� s ��

m��

���ma�� await �y�or

mb�� await s ��

���m�� critical

m � y� �� F

���������������

������������������Fig� ��� Program MUX�PET� �Peterson�s algorithm� � version �

given by

s���� f���m�g� y��T� y��T� s�

�which satis�es neither the candidate assertion nor ���

We observe that the cause for this problem is the disjunct �y� which can befalsi�ed �changed from T to F� by transition m� of P�� There is no such problemwith the disjunct s �� which cannot be falsi�ed by P�� Consequently� we take

��� at��� s �� �

Page 25: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

The only transition that can lead from a ����state to a ���state is m��Therefore� we take �� to be

��� at��� at�m� s � �

We also realize that the transition leading into �� is m� which changes y�from F to T and preserves the value of s� Consequently� we take �� to be

��� at�m���� �y� s � �

By now� we have covered all the states satisfying at��� ��y��s �� �� Fromnow on� the analysis proceeds as it did for program MUX�PET�� The �nal CHAINdiagram is presented in Fig� ���

This diagram partitions the range m���� into three regions� The region m�����represented by ��� guarantees the enableness of �a� �but not the enableness ofm� which is therefore drawn as a single edge�� However it may evolve into ���where no transition of P� is guaranteed to be enabled� Being at ��� m� is thehelpful transition which eventually leads into ��� In ��� �b� is enabled� and since

P� cannot falsify s �� � eventually �b� is taken and leads to ���

The edge labeled �a� connecting node �� to node �� represents the possibilitythat �a� may be enabled on a state satisfying s �� � A more careful analysis showsthat �� in this diagram can be strenghened to the assertionb��� at�m� s �� y��

and then this edge is unnecessary�

In Problem ��� the reader is requested to verify accessibility for a familyof mutual exclusion algorithms� known as the bakery algorithms�

Example �Dekker�s algorithm�

Dekker�s algorithm for solving the mutual exclusion problem is presented in pro�gram MUX�DEK of Fig� ���

In comparison to Peterson�s algorithm� Dekker�s algorithm has a relativelysimple safety proof but rather elaborate proof of accessibility�

� Invariants

In Section �� of the SAFETY book we derived the following invariants forprogram MUX�DEK�

�� t � � t �

�� y� � �at�������������

�� y� � �at�m�����������

These are the invariants we needed to prove the mutual exclusion property� i�e��the invariance of

Page 26: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

��

����� at���

��

���

����� at���

��� C

DE

Fat���� y�C

DE

Fy�� s � ��

��� � at�m�

mb�

���

����� at�m�

m�

���

����� at�m

m

���

����� at�m���� �y� s �

m�

�a��

��

����� at�m� s �

m�

���

����� s ��

�b�

�a��

��� ���� at���

Fig� ��� CHAIN diagram for program MUX�PET��

Page 27: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams �

local y�� y�� boolean where y� � F� y� � F

t � integer where t �

P� ��

���������������������

��� loop forever do������������������

��� noncritical

��� y� �� T

��� while y� do

��� if t �

then

����� y� �� F

� � await t �

��� y� �� T

����� critical

��� t ��

���� y� �� F

������������������

���������������������

P� ��

���������������������

m�� loop forever do������������������

m�� noncritical

m�� y� �� T

m�� while y� do

m�� if t �

then

��m�� y� �� F

m � await t �

m�� y� �� T

��m�� critical

m�� t ��

m��� y� �� F

������������������

���������������������Fig� ��� Program MUX�DEK �Dekker�s algorithm

for mutual exclusion��

�� ��at������� at�m�������

As we will see� additional invariants are needed for the support of the responseproperty� We will develop them as they are needed�

� Response

Page 28: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

The main response property of this algorithm is� of course� that of accessi�bility� It is stated by

�� at��� � � at����

We partition the proof of the accessibility property into three lemmas� provingrespectively�

Lemma A at��� � ���at��� t � � � �at������ t � � � at���

�Lemma B at��� t � � � �at������ t � �

Lemma C at������ t � � � at����

Obviously� the di�cult part of the protocol is the loop at ������ Being withinthis loop� P� is considered to have a higher priority when t � � Lemma A claimsthat if P� is just starting its journey towards the critical section� then it will eitherreach �� with a lower priority� or get to ����� with a higher priority� or reach ���Lemma B claims that if P� is at �� with a low priority it will stay within the loopand eventually gain a high priority� Lemma C shows that if P� is within this loopand has a higher priority� then it will eventually get to ���

Clearly� by combining these three response properties� using the transitivityof response rule TRNS�R we obtain the required accessibility property�

Proof of Lemma A

The proof of the response property

at��� � ��

�at��� t � � � �at������ t � � � at���

�is presented in the CHAIN diagram of Fig� ���

It is easy to follow P� from �� to ��� If t � on entry to ��� then we arealready at the goal at������ t � � Otherwise� we enter �� with t � � settingy� to T� Here we examine the possible locations of P�� Assertions ��� ��� and ��cover all the possibilities� The possible motions of P� within these three assertionsconsist of taking m�� setting t to � which raises the priority of P� and attainsthe goal at������ t � � The other possible movements are from �� to ��� andthen to ��� Being at m��� with y� � T and t � � P� cannot move elsewhere�Transition mode �T� is enabled on �� and �� states� while mode �F� is enabled on��� Both are helpful since they lead to at��� t � and at���� respectively�

Proof of Lemma B

The proof of the response property

at��� t � � � �at������ t � �

Page 29: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

��

����� at���

��

���

C

DE

Fat���� y�� t � ��

����� at�m������� y�

�T��

m��m��

m�

��

����� at�m����� �� �y��F��

��

m��m�

���

����� at�m��� y�

�T��

� �

������

��at��� t �

����at���

��

��at������ t �

Fig� ��� CHAIN diagram for Lemma A�

is presented in the CHAIN diagram of Fig� ���

From ��� P� proceeds to �� since t � � and then to � while resetting y� toF� While being at ����� P� may still set t to by performing m�� which leads tothe goal at������ t � �

However� once P� enters � � it stays at � waiting for t to change to � Atthat point we have to inspect where P� may currently be� We consider as possiblelocations of P� all of m��m�� tracing their possible �ow under the relatively stablesituation of t � � y� � F� We see that all transitions are enabled and lead to m�which eventually sets t to as required�

A tacit assumption made in this diagram is the exclusion of m��� m�� andm�� as possible locations while P� is at � with y� � F and t � � This assumptionmust hold for the program� if we believe Lemma B to be valid� Indeed� considerthe situation that P� is waiting at � with y� � F and t � � while P� is at m��

Page 30: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

C

DE

Ft � C

DE

Fy� ��

������ at���

�����

����� at���

��

m�

��

C

DE

Fat�� � �y� ��

����� at�m�

m�

���

����� at�m

m ���

����� at�m�

m��

��

��� � at�m�

m��

��

����� at�m�

m�

���

����� at�m�

m����

����� at�m�

m�

���

����� at�m�

m�

�� ���� at������ t �

Fig� ��� CHAIN diagram for Lemma B�

Since P� is allowed to stay at the noncritical section forever� this would lead to adeadlock� denying accessibility from P��

We must therefore conclude that if the algorithm is correct� and guaranteesaccessibility to both processes� then the following assertion must be invariant

Page 31: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

at�� t � � at�m�����

This invariance follows from the stronger invariant

�� at����� t � � at�m����

which we will prove�

By symmetry one can also require the invariance of

� at�m��� t � � at�������

Proof of invariant � hh Exercise� ii

Clearly�

� � � at��� � � � z �

� at����� t � � at�m���� z � �

holds�

Let us check the veri�cation conditions for assertion �� which are of theform

at��� at�m� �y� �y� t � z �

at����� t � � at�m���� z � �

at ������ t� � � at ��m���� z � �

There are three transitions that may potentially falsify assertion ��

Transition m�

Sets t to which makes t� � false and hence preserves the assertion�

Transition ��

Leads to at���� which makes at ������ false�

�T� while t �

This is possible only if y� � T which� by �� implies at�m���� � at�m������and therefore at�m������ This almost gives us at�m����� with the exceptionof m��� We thus need additional information that will exclude the possibilityof P� being at m�� while t � �

Clearly� while entering m�� from m�� P� sets t to � Can P� change it back to �while P� is still at m��� The answer is no� because m��� as we see in �� is stilla part of the critical section and is therefore exclusive of ��� the only statementcapable of changing t to �

This suggests the invariant

�� at�m�� � t �

Page 32: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

and its symmetric counterpart

�� at���� � t � �

To prove �� we should inspect two transitions�

Transition m�

Sets t to �

�� while at�m��

Impossible due to ��

This establishes � and similarly �� Having � we can use it to show that the lasttransition considered in the proof of �� namely �T� while t � � implies at�m�����which establishes ��

Proof of Lemma C

Lemma C states that if P� is within the waiting loop ����� with higher priority�i�e�� t � � then eventually it will reach ��� It is stated by

at������ t � � � at����

The proof is presented in the CHAIN diagram of Fig� � ��

Note our e�orts to minimize the number of assertions by grouping togethersituations with di�erent control con�gurations� wherever possible� Thus for all thestates where y� � T and P� is either at �� or at ��� we do not distinguish betweenthese two possibilities� but partition the diagram according to the location of P��This is because� in this general situation� it is P� which is the helpful process andwe have to trace its progress� On the other hand� when y� � F� P� becomes thehelpful process and we start distinguishing between the cases of at��� and at����while lumping together the locations of P� into two groups� m������ and m � Thesetwo groups must be distinguished because it is possible �though not guaranteed�to exit the �rst group into a situation where y� � T� but it is impossible to exitm into such a situation� This is because when P� is at m with t � � it cannotprogress until t is changed to �

InProblem ��� the reader is requested to prove accessibility for two variantsof Dekker�s algorithm�

Case Splitting According to the Helpful Transitions

In the preceding examples� the main reason for using rule CHAIN�J with m � intermediate assertions has been that the program requires m helpful steps toreach the goal� In most of these applications there always was a worst casecomputation that actually visited each of the assertions� starting with �m andproceeding through �m��� �m��� � � � up to �� � q�

Page 33: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Chain Diagrams ��

C

DE

Ft �

�� ������ at����� ��� ������ at��

� ��� ������ at���

��� C

DE

Fat������ y�

C

DE

Fy��� ������ at�m�m� ��� ����� at�m�

m� ��� ����� at�m��

m��

� C

DE

Fat�m������� �y� �� ����� at����� ��� ��� � at���

���

��

m��m�

C

DE

Fy��� ����� at�m�m� ��� ����� at�m�

m� ��� ����� at�m�

m�

� C

DE

Fat�m � �y� �� ����� at����� ��� ����� at���

��

�� ���� at���

Fig� � �� CHAIN diagram for Lemma C�

Page 34: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

This is not the only motivation for using several intermediate assertions�Another good reason for wishing to partition the state space lying between p andq into several assertions is that di�erent states in that space may require di�erenthelpful transitions for getting them closer to the goal�

Example �maximum�

Consider� for example� program MAX presented in Fig� � � This program placesin output variable z the maximum of inputs x and y� The program consists oftwo parallel statements that compare the values of x and y�

in x� y� integerout z � integer

����� if x � y then

��� z �� x���

�� ��m�� if x y thenm�� z �� y

m��

��Fig� � � Program MAX �maximum��

The response statement we would like to prove for this program is

at��� at�m� z �p

� � maximal�z� x� y� z �q

where maximal�z� x� y� stands for the formula

maximal�z� x� y�� �z � x � z � y� z � x z � y�

claiming that z is the maximum of x and y�

Clearly� the goal of this response property is achieved in the helpful stepswhich are either �� and �� or m� and m�� Perhaps one would expect a proof ofthis property by rule RESP�J that only uses one intermediate assertion ��

However� no such proof exists� The reason for this is that we cannot identifya single transition that is helpful for all the states satisfying p� at��� at�m��Clearly� for all states satisfying p x � y� �� is the helpful transition� while forstates satisfying px y� m� is the helpful transition� Consequently� we need atleast four intermediate assertions in a proof of this property by rule CHAIN�J�

We choose the following assertions and helpful transitions

��� at�m� x y ��� m�

��� at��� x � y ��� ��

Page 35: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

��� at�m� x y ��� m�

��� at��� x � y ��� ��

��� q�

It is straightforward to verify that all the premises of rule CHAIN�J are satis�ed bythis choice�

In Fig� � � we present a CHAIN diagram for the proof of the consideredresponse property�

C

DE

Fx � y��

����� at���

��

���

����� at���

��

C

DE

Fx y��

����� at�m�

m�

���

����� at�m�

m�

��� ���� maximal �z� x� y�

Fig� � � CHAIN diagram for program MAX�

Assertions �� and �� partition �non�exclusively� the situation at���at�m�

into states for which �� is helpful and has not been taken yet� and states for whichm� is helpful and has not been taken yet�

It is not di�cult to verify that taking �� from a ���state� as well as takingm� from a ���state� leads to �� and ��� respectively� Choosing �� to rank above�� is quite arbitrary� In particular� we do not have a computation that goes from���states to ���states� Every computation follows either the ��� �� route or the��� �� route�

��� Well�Founded Rule

In rule CHAIN�J we treated each of the participating assertions ��� � � � � �m asseparate entities� and made no attempt to �nd a uniform representation for �j as

Page 36: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

a single formula involving j� This approach is adequate for response propertieswhich require a bounded number of steps for their achievement� e�g�� at most �vein the case of program MUX�PET� �Fig� ���� The bound must be uniform andindependent of the initial state�

There are many cases� however� in which no such bound can be given apriori� To deal with these cases� we must generalize the induction over a �xed�nite subrange of the integers� such as �� � � � � �m in rule CHAIN�J� into an explicitinduction over an arbitrary well�founded relation�

Well�Founded Domains

We de�ne a well�founded domain �A��� to consist of a set A and a well�founded

order relation � on A� A binary relation � is called an order if it is

� transitive� a � b and b � c imply a � c� and

� irre�exive� a � a for no a � A�

The relation� is called well�founded if there does not exist an in�nitely descendingsequence a�� a�� � � � of elements of A such that

a� � a� � � � � �

A typical example of a well�founded domain is �N� ��� where N are the nat�ural numbers �including �� and � is the greater�than relation� Clearly� � iswell�founded over the natural numbers� because there cannot exist an in�nitelydescending sequence of natural numbers

n� � n� � n� � � � � �

For an arbitrary order relation � on A� we de�ne its re�exive extension �

to hold between a� a� � A� written a� a�� if either a � a� or a � a��

The Lexicographic Product

Given two well�founded domains� �A����� and �A������ we can form their lexi�

cographical product �A���� where

A is de�ned as A� �A�� i�e�� the set of all pairs �a�� a��� such that a� � A�

and a� � A��

� is an order de�ned for �a�� a��� �b�� b�� � A by

�a�� a�� � �b�� b�� i� a� �� b� or a� � b� a� �� b��

Thus� in comparing the two pairs �a�� a�� and �b�� b��� we �rst compare a� againstb�� If a� �� b�� then this determines the relation between the pairs to be �a�� a�� ��b�� b��� If a� � b�� we compare a� with b�� and the result of this comparisondetermines the relation between the pairs�

Page 37: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule �

The order � is called lexicographic� which implies that� as when searchingin a dictionary� we locate the position of a word by checking the �rst letter �rstand only after locating the place where the �rst letter matches� do we continuematching the subsequent letters�

The importance of the lexicographic product follows from the following claim�

Claim �lexicographic product�

If the domains �A����� and �A����� are well�founded� then so is their lexi�cographic product �A����

Clearly� by the above� the domain �N����� where � is the lexicographic orderbetween pairs of natural numbers� is well�founded� This order is de�ned by

�n�� n�� � �m��m�� i� n� � m� or n� � m� n� � m��

According to this de�nition

��� �� � ��� �� �� �� � ��� ��� �� �� � �� ���

New well�founded domains can be constructed by taking lexicographic prod�ucts of more than two well�founded domains� Applying this construction to thedomain �N� �� of natural numbers� we obtain the domain �Nk���� for k � �where � is the lexicographic order between k�tuples of natural numbers� Theorder � is de�ned by

�n�� � � � � nk� � �m�� � � � �mk� i� n� � m�� � � � � ni�� � mi��� ni � mi

for some i� i k�

For example� for k � �

��� � � � ��� �� ����

It is easy to show that the domain �Nk��� is well�founded�

The Rule

Let �A��� be a well�founded domain� As in rule CHAIN�J� we use several inter�mediate assertions ��� � � � � �m to describe the evolution from p to q � ��� RuleCHAIN�J uses the index of the assertion as a measure of the distance from thegoal q� The rule presented here associates an explicit ranking function �i witheach assertion �i� i � �� � � � � k� The function �i maps states into the set A andis intended to measure the distance of the current state to a state satisfying thegoal q�

We refer to the value of �i in a �i�state as a rank of the state� The well�founded rule WELL for response properties is given in Fig� � �� Premise W states

Page 38: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

that every p�position satis�es one of ��� � � � � �m� Premise W states that every�i�position with positive i and rank u is eventually followed by a position whichsatis�es some �j � with a rank lower than u�

For assertions p and q � ��� ��� � � � � �m�a well�founded domain �A���� andranking functions ��� � � � � �m� � �� A

W� p �m�i�

�i

W � �i �i � u � �� m�j�

��j u � �j

��for i � � � � � �m

p � � q

Fig� � �� Rule WELL �well�founded response��

Justi�cation It is straightforward to justify rule WELL� Consider a computation� that satis�es premises W� W � and let t� be a position in � which satis�es p�By W� some �i is satis�ed at t�� If it is �� � q� we are done� Otherwise� let �i� �i� � �� be the assertion holding at t� and let u� denote the rank of the state atposition t�� By W � there exists a position t�� t� � t�� such that some �j holdsat t� with a rank u� � A� such that u� � u�� If j � �� we are done� Otherwise�we proceed to locate a position t� � t��

In this way we construct a sequence of positions

t� t� t� � � � �

and a corresponding sequence of elements from A �ranks�

u� � u� � u� � � � � �

such that either the sequence is of length k and q � �� holds at the positiontk� or the sequence is in�nite and some �j � j � �� holds at each ti with rank�j � ui there� The later case is impossible since that would lead to an in�nitelydescending sequence of elements of A� in contrast to the well�foundedness of �over A� It follows that for some tk � t�� q � �� holds at tk� which shows that� q holds at t��

Example �factorial�

Page 39: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

Consider program FACT of Fig� � �� This program computes in z the factorial ofa nonnegative integer x� We wish to prove for this program the response property

at��� x � � y � x z � z �p

� � at��� z � x z �q��

in x� integer where x � �local y � integer where y � xout z � integer where z �

������ while y � � do

��� �y� z� �� �y � � z � y�

���

���Fig� � �� Program FACT �factorial��

Intending to use rule WELL with m � � it only remains to choose the assertion��� and the ranking functions �� and ��� This necessitates the identi�cation ofa well�founded domain �A���� where A serves as the range of �i� Obviously� ��should describe the intermediate stage in the process of getting from p to q� and�� should measure the distance of this intermediate stage from the goal q � ���Premise W ensures that steps in the computation always bring us closer to thegoal�

For program FACT� a good measure of the distance from termination is thevalue of y� This is because when we are at ��� there are y more iterations ofthe while loop before the program terminates� We therefore choose �N� �� as ourwell�founded domain and jyj as the ranking function� Thus�

�A� �� � �N� ��� ��� �� and ��� jyj� �

The choice of �� � � is natural because� being at a ���state� we are alreadyat the goal� and the distance to the goal can therefore be taken as ��

The intermediate assertion �� should represent the progress the computationhas made� so that when y � �� we can infer that z � x � Clearly� the way theprogram operates is that it accumulates in z the product of the terms x��x�� � � � �In an intermediate stage� z contains the product x � �x� � � � � �y � �� which canalso be expressed as x �y � provided � y x�

We thus arrive at the intermediate assertion

�� at��� � y x z � x �y �

Page 40: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

It only remains to show that premises W�W are satis�ed by these choices�

Premise W

This premise requires

at��� x � � y � x z � z �p

� � �z���

� at��� � y x z � x �y z ���

This implication is obviously valid�

Premise W

This premise requires showing

at��� � y x z � x �y z ���

jyj� � n �

�BBBBBB�

at��� z � x z ���

n � �z��

at��� � y x z � x �y z ���

n � jyj� z ��

CCCCCCA�

Since �� jyj � � n implies that n � �� it is su�cient to prove thisimplication for every n � �� As �� implies y � �� we may replace jyj by y�

Case n � �

For this value of n� we prove

at��� � y x z � x �y z ���

y � � �

��at��� z � x z �

��

� ���

which simpli�es to

at��� z � x y � � � � �at��� z � x � �

This� of course� can be proven by a single application of rule RESP�J� observingthat� under the situation described by the antecedent� only transition �� isenabled� and taking it leads to at��� z � x �

Case n � �

In this case� we will prove

Page 41: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

at��� � y x z � x �y z ���

y � � n � �

��at��� � y x z � x �y z �

��

n � y � ��

This can be proven by rule CHAIN�J using three assertions� ��� ��� and ���

The top assertion �� corresponds to �� y � � n� Assertion �� describesthe intermediate state� after passing the test of the while statement� andbeing at ��� The �nal assertion �� implies �� y � � n � n� anddescribes the situation after performing the assignment �� and arriving backat ��� The veri�cation diagram in Fig� � � describes this proof�

C

DE

F� y x� z � x �y

C

DE

Fy � � n � ��

����� at���

��

���

����� at���

��

�� ���� at��� y � � n �

Fig� � �� Veri�cation diagram for case n � �

Thus� by treating separately the cases n � and n � � we conclude that premiseW holds for every n � � This establishes that the conclusion

at��� x � � y � x z � z �p

� � at��� z � x z �q

of rule WELL is valid�

A Rule with Nontemporal Premises

Page 42: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

Rule WELL� used for proving response formulas� has as its premise W � anotherresponse formula� This allows a recursive use of the rule� by which the temporalpremise W is proved either by the simpler rule RESP�J� or by rule WELL again�only applied to simpler assertions� As a matter of fact� if we closely examine theproof of the previous example� we can identify there the use of those two options�For proving W for n � � we used rule RESP�J� since the response property forthis case is accomplished in one step� On the other hand� the case of n � accomplishes W in two steps� and we therefore had to use rule CHAIN�J�

However� in many cases� we do not need the recursive application of the rule�which means that premise W is proved directly by rule RESP�J� In these cases itis advantageous to replace the temporal premise W by the nontemporal premisesof rule RESP�J� which are necessary for its derivation� This leads to a �combined�form of the rule in which all premises are nontemporal� Such a form is oftenmore satisfactory because it explicitly manifests the power of the rule to derivetemporal statements from nontemporal ones�

This leads to rule WELL�J �Fig� � ���

For assertions p and q � ��� ��� � � � � �m�transitions ��� � � � � �m � J �a well�founded domain �A���� andranking functions ��� � � � � �m� � �� A

JW� p �m�j�

�j

JW � �� �i �

����m�j�

���j �i � ��j �

� ���i �i � ��i�

����for every � � T

JW�� ��i �i �m�j�

���j �i � ��j�

JW�� �i � En��i�

�����������������������������for i � � � � � �m

p � � q

Fig� � �� Rule WELL�J �well�founded response under justice��

Page 43: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

The rule requires �nding auxiliary assertions �i and transitions �i� i �� � � � �m� a well�founded domain �A���� and ranking functions �i� � �� A� Eachassertion �i� i � � is associated with the transition �i that is helpful at positionssatisfying �i� and with its own ranking function �i�

Premise JW requires that every p�position satis�es one of ��� � � � � �m�

Premises JW �JW� impose three requirements for each i � � � � � �m�

Premise JW requires that� taking any transition from a �i�position k� alwaysleads to a successor position k� � k � � such that

� either some �j � j � �� � � � �m� holds at k� with a rank ��j lower than �i at k�or

� �i holds at k� with a rank ��i equal to the rank �i at k�

The main implication of premise JW is that if the situation has not improvedin any noticeable way in going from k to k�� i�e�� the new rank still equals theold rank� at least we have not lost the identity of the helpful transition and thetransition that was helpful in k is also helpful at k��

Premise JW� requires that transition �i� which is helpful for �i� always leadsfrom a �i�position k to a next position which satis�es some �j and has a ranklower than that of k� i�e�� �i � ��j �

Premise JW� requires that the helpful transition �i is enabled at every �i�position�

Justi�cation To justify the rule� assume a computation such that p holds atposition k� and no later position i � k� satis�es q � ��� By this assumption andJW� some �j � j � �� must hold at position k� Let �i� be the formula holdingat k� and denote the rank �i� at k by u�� By JW�� transition �i� is enabled atposition k�

Consider the transition � taken at position k� leading into position k� � ByJW and JW�� either position k � has a lower rank u�� u��u�� or it has thesame rank� but then �i� is still the helpful transition at k� and is enabled there�In the case that the rank is still u�� we can continue the argument from k � to k � � k � �� etc� However� we cannot have all positions i � k with the samerank� To see this� assume that all positions beyond k do have the same rank�By JW and JW�� this implies that �i� is continuously helpful and enabled� ByJW�� �i� is not taken beyond k because taking it would have led to a state witha rank lower than u�� Thus� our assumption that all positions beyond k have thesame rank leads to the situation that �i� is continuously enabled and not taken�violating the justice requirement for �i� �

Thus� eventually� we must reach a position k�� k� � k� with lower rank u��where u��u�� In a similar way we can establish the existence of a positionk� � k�� with rank u� where u�� u�� Continuing in this manner� we construct

Page 44: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

an in�nitely descending sequence u� � u� � u� � � � � of elements of A� This isimpossible� due to the well�foundedness of � on A�

We conclude that every p�position must be followed by a q�position� estab�lishing the consequence of the rule�

Note that since premise JW� implies premise JW for � � �i� it is su�cientto check premise JW only for � �� �i�

Rule CHAIN�J can be viewed as a special case of rule WELL�J which uses �i � i�for i � �� � � � �m� as ranking functions� It is not di�cult to see that the premisesJ � J�� and J� of rule CHAIN�J correspond precisely to premises JW � JW�� andJW� of rule WELL�J� The well�founded domain used in this special case is the�nite segment !���m" of the natural numbers ordered by ��

Example �factorial�

We use rule WELL�J to prove that program FACT of Fig� � � satis�es the responseproperty of total correctness

at��� x � � y � x z � z �p

� � at��� z � x z �q��

Obviously� except for the terminating state� execution of program FACT al�ternates between states satisfying at��� in which �� is the helpful transition� andstates satisfying at��� in which �� is helpful�

Consequently� we take m � and use the following intermediate assertions�

��� at��� � y x z � x �y

��� at��� y x z � x �y

��� at��� z � x �

Note that when control is at ��� y is required to be greater than or equal to �

It remains to determine the ranking functions �i� i � �� � � Our previousanalysis of the considered response property for program FACT �using rule WELL�identi�ed jyj as a good measure of progress over �N� ��� Variable y keeps decreas�ing as the program gets closer to termination� Unfortunately� premise JW� of ruleWELL�J requires that � decreases on each activation of a helpful transition� As wesee� not every helpful transition causes jyj to decrease� In particular� �� does notchange jyj� Consequently� we have to supplement jyj by an additional componentthat will decrease when jyj stays the same� This leads to the following choice�

����jyj�

����

�jyj�

����

��� �

��

Page 45: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

The corresponding well�founded domain is�N�f� g� �

�� where � is the lexico�

graphical order between pairs of integers�

In the previous proof of this property� we used the measure jyj� to ensurethat the rank decreases also on the transition from �� to ��� Since the use of pairsguarantees such a decrease by a decreasing second component� we can omit the� increment and take the �rst component to be simply jyj�

We may view the ranking function �i� �jyj� i� as consisting of a major and aminor measures of progress� Function jyj measures large steps of progress� suchas one full iteration of the loop at ��� The minor component i measures smallersteps of progress� Observe that transition �� actually causes the minor measure ito increase from to � but at the same time it decreases the major measure jyj�

Let us consider the premises of rule WELL�J� Since both �i�s imply y � �� wemay replace jyj by y�

� Premise JW

We prove JW by showing

at��� x � � y � x z � z �p

� � � � at��� � y x z � x �y z ���

which is obviously valid�

� Premises JW � JW� for i �

For i � we will show

�� at��� � y x z � x �y z ���

�BBBBBBB�

at ���� z � x z ���

�y� � z ��

� �y�� �� z ��

at ���� y� x z� � x �y� z ���

�y� � z ��

� �y�� � z ��

CCCCCCCA�

for each transition � � f��� ��g� not necessarily the helpful one� Obviously� this willsatisfy both JW and JW�� Since at��� implies that transition �� is disabled� theleft�hand side of the implication for � � �� is false and the implication is triviallytrue�

For � � ��� we prove the implication by separately considering the casesy � � and y �� ��

Page 46: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Case y � ��

In this case ��� implies at ����� y� � y � �� and z� � z� Since z � x �y andy � � imply z � x � it follows that the left�hand side implies ��� ��� � ���� ���

Case y �� ��

In this case �� implies that y � �� which together with ��� � implies at �����y� � y� and z� � z� Assertion �� implies y x z � x �y which togetherwith y � � establishes ���� The rank decrease �y� � � �y� � is obvious�

� Premises JW � JW� for i �

For i � we will show

�� at��� y x z � x �y z ���

� � � ��at ���� � y� x z� � x �y� z �

��

�y� � z ��

� �y�� � z ��

��

for each transition � � f��� ��g� not necessarily the helpful one� Obviously� this willsatisfy both JW and JW�� Since at��� implies that transition �� is disabled� theleft�hand side of the implication for � � �� is false and the implication is triviallytrue�

For � � ��� we observe that ��� implies at ����� y� � y � � and z� � z � y�Substituting these expressions in the right�hand side of the implication reducesthe conjunction to

� y � x z � y � x ��y � � �y� � � �y � � ��

all of which are either obviously valid or are implied by ���

� Premises JW�

The helpful transitions for �� and �� are �� and ��� with enabling conditionsat��� and at���� respectively� Obviously� they satisfy

at��� � � � z ���

� at��� z �En����

at��� � � � z ���

� at��� z �En����

as required by premise JW��

This establishes the four premises of rule WELL�J� proving the response prop�erty of total correctness for program FACT

at��� x � � y � x z � � � �at��� z � x ��

Page 47: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule �

A Condensed Representation of Ranking Functions

Many of our proofs consider ranking functions that consist of lexicographic pairsof natural numbers� i�e��

� � �d�� d���

Such a function decreases over a transition even if d� increases� provided d� de�creases at the same time� Lexicographic order implies that even a small decreasein d� outweights an arbitrarily large increase in d�� In some cases there exists abound M � M � �� which is larger than any possible increase in d�� In these caseswe may use the ranking functionb� � M � d� � d��

which ranges over N� instead of the original � � �d�� d�� which ranges over N�N�

We refer to b� as a condensed representation ranking function�

In Problem �� the reader is requested to prove that in such cases�b� � M � d� � d� � b� � � M � d�� � d�� i� �� �d�� d�� � ��� �d��� d����

For example� in the above proof of program FACT� we used the ranking func�tions

�i� �jyj� i��

Since the maximal increase in the value of i is which is smaller than � we couldhave used instead the condensed ranking functionb�i� � jyj � i�

Example �up down�

Consider program UP�DOWN presented in Fig� � �� This program can be viewedas an extension of program ANY�Y of Fig� � � Process P� increments y� countingup in ��� ��� as long as x � �� Once P� �nds that x is di�erent from �� it proceedsto ��� ��� where y is decremented until it becomes �� Process P��s single action isto set x to � Obviously� due to justice� x will eventually be set to � However�one cannot predict the number of helpful steps required for P� to terminate� Thelonger P� waits before performing m�� the higher the value y will attain on themove to ��� It is this value of y which determines the number of remaining stepsto termination�

In fact� for every n � �� we can construct a computation requiring more than�n helpful steps to achieve y � �� This computation allows P� to increase y upto n� and only then activates m�� At least n more steps of P� are needed todecrement y back to ��

Consequently� we need rule WELL�J to prove the response property

Page 48: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

local x� y� integer where x � y � �

P� ��

���������� while x � � do

��� y �� y �

��� while y � � do

��� y �� y �

���

������� P� ��

�m�� x ��

m��

Fig� � �� Program UP�DOWN�

at��� at�m� x � y � � z �p

� � at��� at�m� z �q

for program UP�DOWN�

In order to construct the intermediate assertions and the ranking functions�i� we observe that there are three distinct phases in the achievement of at��� at�m�� The �rst phase waits for P� to perform m�� This phase terminates whenm� is executed� In the second phase� P� senses that x has been set to and movesto ��� In the third phase� P� is within ���� and decrements y until y reaches � andP� moves to ���

Consequently� it seems advisable to use the well�founded domain �N���� oflexicographic triples �n�� n�� n��� whose �rst element n� identi�es the phase� andwhose remaining elements� n� and n�� identify progress within the phase� Recallthat lexicographic ordering on triples of natural numbers is de�ned by

�n�� n�� n�� � �m�� m�� m�� i�

�����n� � m� or

n� � m�� n� � m� or

n� � m�� n� � m�� n� � m��

Obviously� this ordering is a well�founded relation on N��

Consider the remaining elements needed to measure progress within a phase�The �rst phase terminates after one helpful step� m�� The second phase terminatesin two helpful steps� �� followed by ��� The last phase has y measuring coarseprogress� and it takes two steps to decrement y� �� followed by ���

Consequently� we de�ne the following assertions� helpful transitions and rank�ing functions�

��� at����� at�m� x � � y � � ��� m� ��� � � �� ��

��� at��� at�m� x � y � � ��� �� ��� �� �� �

Page 49: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

��� at��� at�m� x � y � � ��� �� ��� �� �� ��

��� at��� at�m� x � y � � ��� �� ��� ��� jyj� �

��� at��� at�m� x � y � � ��� �� ��� ��� jyj� �

��� at��� at�m� ��� ��� �� ���

Note that progress within the second phase is measured by the third component�which moves from to � on execution of ��� Progress within the third phase ismeasured by the pair �y� � at���� which decreases on execution of both �� and���

hh Exercise�ii

Let us show that all premises of rule WELL�J are satis�ed by these choices�

� Premise JW

For this premise we have to show the implication

at��� at�m� x � y � � z �p

� � � � at����� at�m� x � � y � � z ���

which is obvious�

� Premise JW for ��

It is su�cient to show the following for each � �� m�

�� at����� at�m� x � � y � � z ���

� � � ��at ������ at ��m� x� � � y� � � z �

��

� � �� �� z ��

� � � �� �� z ��

��

The only transitions � �� m� enabled on ���states are �� and ��� For each of them��� implies at ������� x� � x � �� and y� � y � �� Consequently� the implication isvalid�

� Premise JW� for ��

We show

�m� at����� at�m� x � � y � � z �

��

Page 50: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response���������

at ���� at ��m� x� � y� � � z ���

� � �� �� z ��

� �� �� � z ��

at ���� at ��m� x� � y� � � z ���

� � �� �� z ��

� �� �� �� z ��

����������

Clearly� �m�implies x� � � y� � y� at ��m� and at ���i � at��i for i � �� � By

��� either at��� or at��� holds� In the case that at��� � T� the second disjunctis implied� In the case that at��� � T� the �rst disjunct is implied� The decreasein rank is obvious in both cases�

� Premises JW � JW� for ��

Since �� is the only transition enabled on ���states� the following implicationestablishes both JW and JW� for ���

��� at��� at�m� x � y � � z ���

� � � ��at ���� at ��m� x� � y� � � z �

��

�� �� � z ��

� �� �� �� z ��

��

Transition relation ��� implies at ����� at ��m� � at�m�� x� � x� and y� � y� By��� it follows that ��� holds� and the decrease in rank is obvious�

� Premises JW � JW� for ��

Since �� is the only transition enabled on ���states� the following implicationestablishes both JW and JW� for ��

��� at��� at�m� x � y � � z ���

� � � ��at ���� at ��m� x� � y� � � z �

��

�� �� �� z ��

� ��� jy�j� � z ��

Transition relation ��� under x � implies at���� and at ��m� � at�m�� It alsoimplies x� � x and y� � y� The rank decrease �� �� �� � ��� jy�j� � is obvious� since� the �rst component of the left�hand side� is larger than �� the �rst componentof the right�hand side�

� Premises JW � JW� for ��

Since �� is the only transition enabled on ���states� the following implicationestablishes both JW and JW� for ��

Page 51: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Well�Founded Rule ��

��� at��� at�m� x � y � � z ���

�BBBBBBB�

at ���� at ��m� z ���

��� jyj� � z ��

� ��� �� �� z ��

at ���� at ��m� x� � y� � � z ���

��� jyj� � z ��

� ��� jy�j� � z ��

CCCCCCCA�

We distinguish between two cases�

Case y � ��

In this case� ��� implies at ����� y� � y � �� and at ��m� � at�m�� Since ��implies at�m� � T� the left�hand side of this veri�cation condition impliesthe right�hand side disjunct ��� ��� jyj� � � ��� �� ���

Case y �� ��

By ��� it follows that y � �� In this case� ��� implies at ����� at ��m� � at�m��x� � x� and y� � y � �� Together with ��� these imply ���� To show the rankdecrease� we observe that jyj � jy�j and � �

� Premises JW � JW� for ��

Since �� is the only transition enabled on ���states� the following implicationestablishes both JW and JW� for ��

��� at��� at�m� x � y � z ���

� � � ��at ���� at ��m� x� � y� � � z �

��

��� jyj� � z ��

� ��� jy�j� � z ��

��

Transition relation ��� implies at ����� at ��m� � at�m�� x� � x� and y� � y � �By the clause y � � in �� we have y� � y � � �� The decrease in rank followsfrom y � � and ��� jyj� � � ��� y� � � ��� y � � � � ��� jy�j� ��

� Premise JW�

This premise requires showing the following implication for each i � � � � � � ��

�i � En��i��

By inspecting �i for each i � � � � � � �� we see that this is indeed the case�

This concludes the proof�

Page 52: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

Persistence of the Helpful Transitions

Premise JW of rule WELL�J requires that� in the case that a transition does notattain a lower rank in the next state� it must maintain the rank and lead to astate that still satis�es �i� and therefore maintain �i as the helpful transition� Werefer to this clause as a requirement for the persistence of helpful transitions� Onemay wonder how essential this requirement is� and whether it would be possibleto relax this requirement� In Problem � � we request the reader to consider aversion of rule WELL�J in which premise JW has been relaxed to allow the helpfultransition to change without rank decrease� The problem shows that the resultingrule is unsound�

��� Rank Diagrams

To represent by diagrams proofs of response properties that require the use ofwell�founded ranking� we have to add some more components to the labels ofnodes�

A veri�cation diagram is said to be a RANK diagram if its nodes are labeledby assertions ��� � � � � �m� with �� being the terminal node� and ranking func�tions ��� � � � � �m� where each �i maps states into A� and it satis�es the followingrequirement�

� Every node �i� i � �� has a double edge departing from it� This identi�esthe transition labeling such an edge as helpful for assertion �i� All helpfultransitions must be just�

Note that� unlike CHAIN diagrams� we allow node �i to be connected to �j forj � i�

Veri�cation and Enabling Conditions for RANK Diagrams

Consider a nonterminal node labeled by assertion � and ranking function �� andlet ��� � � � � �k� k � �� be the � �successors of � and ��� � � � � �k be their respectiveranking functions�

� If transition � is unhelpful for �� i�e�� labels only single edges departing fromthe node� then we associate with � and � the following veri�cation conditionn� � � u

o�n

�� u� �� � ��� u � ��� � � � � � ��k u � �k�o�

� If � is helpful for � �labels double edges�� we associate with � and � thefollowing veri�cation conditionn

� � � uo

�n

��� u � ��� � � � � � ��k u � �k�o�

Page 53: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Rank Diagrams ��

� For every nonterminal node � and a transition � labeling a double edgedeparting from �� we require

� � En�� ��

Note that in the case of an unhelpful transition� we allow a � �successor with arank equal to that of �� provided it satis�es the same assertion ��

Valid RANK Diagrams

A RANK diagram is said to be valid over program P �P �valid for short� if allthe veri�cation and enabling conditions associated with the diagram are P �statevalid�

The consequences of having a valid RANK diagram are stated in the followingclaim�

Claim �� �RANK diagrams�

A P �valid RANK diagram establishes that the response formula

m�j�

�j � � ��

is P �valid�

If� in addition� we can establish the P �state validity of the following implica�tions�

p �m�j�

�j and �� � q

then� we can conclude the validity of

p � � q�

Justi�cation It is not di�cult to see that a valid RANK diagram establishes thepremises of rule WELL�J with p�

Wmj� �j � q� ��� and �i the transition helpful for

�i being the transition labeling the double edge departing from �i in the diagram�This establishes the P �validity of

m�j�

�j � � ���

Given assertions p and q� satisfying the implications

p �m�j�

�j and �� � q�

we can use rule MON�R of Fig� �� to infer

Page 54: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

p � � q�

Example �factorial�

The diagram of Fig� � � presents a valid RANK diagram that establishes totalcorrectness for program FACT �Fig� � ���

C

DE

Fy x� z � x �y

��

��� at��� � y

��� �jyj� �

��

���

��

��� at��� y

��� �jyj� �

���

��

���� at��� z � x �y

��� �jyj� ��

Fig� � �� RANK diagram for total correctness of program FACT�

This diagram contains a connection from�� to �� which is disallowed in chaindiagrams� However� the validity of the implied veri�cation conditions ensuresthat� whenever a transition is taken from a ���state s� to a ���state s�� the rankdecreases� i�e�� ���s�� � ���s���

Distributing the Ranking Functions

To make RANK diagrams more readable� we introduce additional encapsulationconventions�

One of the useful conventions is that compound nodes may be labeled by alist of assertions� Such labeling indicates that the full assertion associated with abasic �noncompound� node ni is a conjunction of the assertion labeling the nodeitself and all the assertions labeling compound nodes that contain ni�

Page 55: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Rank Diagrams ��

Thus� while the label of node �� in the diagram of Fig� � � is at��� � y�the full assertion associated with this node is

at��� � y y x z � x �y �

We can view this representation as distribution of the full assertion into the partat��� � y labeling the node itself and the part y x z � x �y labeling theenclosing node� which is common to both �� and ���

In a similar way� we introduce a convention for distribution of ranking func�tions� The convention allows us to label a compound node by

�� f �

where f is some ranking function mapping states into a well�founded domain A�In most of our examples� the domains are either �N� �� or lexicographic productsof this domain�

Consider a basic node ni labeled by assertion �i and local ranking functionfb� Assume that node ni is contained in a nested sequence of compound nodesthat are labeled by ranking labels �� f�� � � � � �� fm� as we go from the outermostcompound node towards ni� This situation is depicted in Fig� � �� Then the fullranking function associated with the node �i is given by the tuple

�i � �f�� � � � � fm� fb��

That is� we consider the outermost ranking f� to be the most signi�cant compo�nent in �i� and the local ranking fb to be the least signi�cant component�

C

DE

F�� f� rrrC

DE

F�� fm rrr �

��

�i� � � �

�� fbni rrrrrr

Fig� � �� Encapsulated sequence of nodes�

Page 56: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Example �factorial�

In Fig� ���� we present a version of the RANK diagram of Fig� � �� in whicha common component of the ranking function appears as a ranking label of theenclosing compound state�

C

DE

Fy x� z � x �y

�� jyj

��

��� at��� � y

��

��

���

��

��� at��� y

��

���

��

���� at��� z � x �y

�� �jyj� ��

Fig� ���� RANK diagram with distributed ranking functions�

The full ranking functions associated with the nodes in the RANK diagram ofFig� ��� are identical to those appearing in Fig� � ��

Another rank distribution convention allows one to omit the local rank label�ing a node �i altogether� This is interpreted as if the node were labeled with theranking function �� i� where i is the index of the node �and the assertion labelingit�� In Fig� ��� we present another version of the RANK diagram for programFACT� using this convention�

The full ranking functions associated with the nodes in this diagram are�

��� �jyj� �� ��� �jyj� �� and ��� ��

This raises the question of how to compare lexicographic tuples of unequallengths such as ��� �jyj� � and ��� ��

Since all our examples will be based on tuples of non�negative integers� weagree that the relation holding between �a�� � � � � ai� and �b�� � � � � bk� for i k is de�termined by lexicographically comparing �a�� � � � � ai� �� � � � � �� to �b�� � � � � bi� bi���

Page 57: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Rank Diagrams �

C

DE

Fy x� z � x �y

�� jyj

����� at��� � y

��

���

����� at��� y���

��

���� at��� z � x �y

Fig� ��� RANK diagram with default local ranking�

� � � � bk�� That is� we pad the shorter tuple by zeros on the right until it assumesthe length of the longer tuple�

According to this de�nition� �jyj� � � �� since �jyj� � � ��� ���

Example �up�down�

In Fig� �� we present a valid RANK diagram which implies� by monotonicity� theproperty of termination for program UP�DOWN �Fig� � ���

at��� at�m� x � y � � z �p

� � at��� at�m� z ���

The diagram provides a detailed description of the progress of the computa�tion from �� to ��� It shows that progress from �� to �� is due to a CHAIN�likereasoning� Then� the progress from �� and �� to �� requires a well�founded ar�gument with the measure jyj for coarse progress� and the index j � � of �j formeasuring �ne progress�

The ranking functions appearing in this diagram are somewhat di�erent fromthe ones used originally� When padded to the maximumlength of �� they are givenby

��� ��� �� ��

��� ��� �� ��

Page 58: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

C

DE

Fy � � ��

����� at����� at�m� x � �

m�

� � ��� �� ��

C

DE

Fat�m�� x � ��

����� at���

��

� � ��� �� ��

��

����� at���

��

� � ��� �� ��

C

DE

Fat�m�� x � ��� � jyj

���

����� at���

��

���

� � � � jyj� �

��

����� at��� y � ����

��

� � � � jyj� �

� ���� at��� at�m� � � ��� �� ��

Fig� �� � RANK diagram for termination of UP�DOWN�

��� ��� �� ��

��� � � jyj� �

��� � � jyj� �

��� ��� �� ���

Note that the diagram contains a connection from �� to ��� This is allowedbecause �� decrements y and leads to a decrease in rank� stated by

Page 59: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Response with Past Subformulas ��

� � jyj� � � � � jy � j� ��

In Problems ������ the reader is requested to prove total correctness ofseveral programs�

�� Response with Past Subformulas

In this section we generalize the methods and proof rules presented in the pre�ceding sections to handle response formulas p � � q� where p and q are pastformulas�

The generalization is straightforward� It involves the following systematicmodi�cations and replacements�

� Wherever a rule calls for one or more intermediate assertions� the past�versionof the rule requires �nding past formulas�

� Each premise of the form � � �� for assertions � and �� is replaced by anentailment b�� b� for corresponding past formulas b� and b��

� A veri�cation condition fpg � fqg� for past formulas p and q and transition� � is interpreted as the entailment �� p � q�� where the primed version ofa past formula is calculated as in Section �� of the SAFETY book�

For example� in Fig� ���� we present the past version of rule WELL�J�

Similar past versions can be derived for rules RESP�J and CHAIN�J�

Example Let us illustrate the use of the past version of rule WELL�J for provingthe response property

� n y � � �y � n Q �at��� y � n��

for program UP�DOWN of Fig� � ��

This property states that any position i at which y is greater or equal to somen � �� is followed by a position j at which y � n and such that� at a precedingposition k j� y equaled n while control was at ��� This property characterizesa feature of program UP�DOWN by which a computation that achieves y � n atsome state� has at least two occurrences of states in which y � n� One occurrencehas control at �� while the other occurrence has control at ���

In our proof� we use the following invariants for program UP�DOWN

�� y � �

�� �at����� at�m� x � �� � �at������ at�m� x � �

�� at��� � y � �

�� y n � Q �at��� y � n��

Page 60: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response

For past formulas p and q � ��� ��� � � � � �m�transitions ��� � � � � �m � J �a well�founded domain �A���� andranking functions ��� � � � � �m� � �� A

JW� p �m�j�

�j

JW � �� �i �

����m�j�

���j �i � ��j �

� ���i �i � ��i�

����for every � � T

JW�� ��i �i �m�j�

���j �j � ��j �

JW�� �i � En��i�

�����������������������������for i � � � � � �m

p � � q

Fig� ���� Past version of rule WELL�J�

State invariants �� �� and � are derived and proven in the usual way�

Proving the Invariance of �

Formula � is a past invariant� and can be proven by rule P�INV� taking� � �� y n � Q �at��� y � n�� Premise P of rule P�INV is trivial since� � �� Premise P requires

� � �at��� y � � � � � z �

� y n � �at��� y � n� z ���

As n � �� we consider two cases� If n � � then y � � implies y n� If n � �then at��� y � � implies at��� y � n�

Finally� premise P requires showing

�� y n � Q �at��� y � n� z ��

Page 61: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Response with Past Subformulas �

y� n � �at ���� y� � n� � Q �at��� y � n� z ���

This can be shown by temporal instantiation of the implication

�� �y n � p� ��y� n � �at ���� y� � n� � p

��

Obviously if p � T the implication is trivially valid� It therefore remains to showthat the following holds�

�� y n � y� n � �at ���� y� � n��

This implication can be potentially falsi�ed only by a transition that cantransform a state satisfying y n into a next state satisfying ��y� n�� i�e��y� � n� The only candidate transition is ��� Therefore� we consider

� � � at ���� y� � y � z ���

y n � y� n � �at ���� y� � n��

As y n� we consider two cases� If y n � then y� � y � n� If y � n � then at���� y� � y � implies at ���� y� � n�

This concludes the proof of past invariant ��

Proving the Response Formula

To prove the response formula

� n y z �p

� � y � n Q �at��� y � n� z �q

we use the past version of rule WELL�J as presented in Fig� ����

The choice of intermediate past formulas������ helpful transitions and rank�ing functions is presented in the veri�cation diagram of Fig� ����

Note that each of ��� � � � � �� is a past formula� For example� the full formula�� is given by

��� at��� at�m� x � y � n � � Q �at��� y � n��

Let us consider some of the premises required by rule WELL�J� Premise JWrequires the following implication

� n y �

Q �at��� y � n� �y � n � y � n

�B�at����� at�m� x � �

at������ at�m� x �

CA� z �

�� � ��� � ��

Page 62: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

C

DE

Fy � n � �� Q �at��� y � n���

����� at����� at�m� x � �

m�

� C

DE

Fat�m�� x � ��

����� at���

��

���

����� at���

��

� C

DE

Fat�m�� x � ��� � jyj

���

����� at���

��

���

��

����� at��� y � ����

��

� ���� y � n Q �at��� y � n�

Fig� ���� RANK diagram for �� n y� � � �y � n Q �at��� y � n���

It is not di�cult to see that this entailment follows from invariants �� ��

Observe that each �i� i � �� � � � � � can be written in the form

�i � Q �at��� y � n� b�i�where b�i is a state formula�

Consequently� premise JW can be written as follows

�� b�i Q �at��� y � n� �

Page 63: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Compositional Veri�cation of Response Properties �

�Q �at��� y � n���

�b��� ���

j�

�b��j �i � ��j� � �b�i �i � ��i�

��

Since Q �at��� y � n� entails�Q �at��� y � n�

��� which expands to the

disjunction �Q �at��� y � n���

� �at ���� y� � n� � Q �at��� y � n��

it only remains to establish the following state entailment

�� b�i � b��� ���

j�

�b��j �i � ��j� � �b�i �i � ��i��

This entailment can be proven in a way similar to the proof of the veri�cationconditions in the RANK diagram of Fig� �� � whose ranking functions are identicalto those of Fig� ����

The past conjunct Q �at��� y � n� can be similarly factored out also forpremise JW��

This concludes the proof that property

� n y � � �n � y Q �at��� y � n��

for program UP�DOWN�

�� Compositional Veri�cation of ResponseProperties

Compositional veri�cation is a method intended to reduce the complexity of ver�ifying properties of large programs� The method infers properties of the wholesystem from properties of its components� which are proven separately for eachcomponent�

We apply compositional veri�cation to programs that can be decomposedinto several top�level processes� called components� which communicate by sharedvariables and such that every variable of the program can be modi�ed by at mostone of these components� A variable which is modi�ed by component Pi is saidto be owned by Pi�

Modular Computations

Let P ��!declarations#

!P� �� !���� S�"k � � �kPk �� !�k� � Sk "

""be a program� and

Pi be a component of P � Denote by V � fg � Y the set of system variables ofP � and let Yi � Y be the set of variables owned by Pi� Let Li denote the set oflocations of process Pi�

Page 64: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Assume that we have constructed the fair transition system �FTS� SP

� hV��T �J � Ci corresponding to P � We assume that the initial condition has the form

� � f���� � � � � �k�g

#y�Y

py�y��

where� for each y � Y � py�y� is an assertion constraining the initial values ofvariable y� Obviously� py�y� is derived from one of the where clauses in thedeclarations of variables in P � If there is no where clause constaining y� thenpy�y� � T� Let Ti denote the transitions of S

Passociated with the statements of

Pi�

Based on the FTS SP

and process Pi� we construct a new FTS SMPi

� hVi�i� Ti�

Ji� Cii called the modular FTS corresponding to Pi� The FTS SMPi

is intended to

capture the possible behavior of process Pi in any context �not necessarily thatof P � which respects the ownership of Yi by Pi� That is� we are ready to considerany context whose only restriction is that it cannot modify any variable ownedby Pi� The constituents of SM

Pi

ar given by�

� Vi� V

The system variables of SMPi

are identical to the system variables of the com�

plete FTS SP

� i�� � Li � f�i�g

#y�Yi

py�y�

The initial condition of SMPi

requires that� initially� the only Li�location con�

tained in is �i� and all the variables owned by Pi satisfy their initial con�straints as speci�ed in the where clauses of the program declarations� Exceptfor � nothing is required by i concerning the system variables not ownedby Pi�

� Ti � Ti � f�Eg

The transitions of SMPi

include all transitions associated with statements of

Pi �Ti� and a special environment transition �E

� Transition �E

is intendedto represent the actions of an arbitrary context which respects the ownershipof Yi by Pi� For each � � Ti� the transition relation SM

Pi

associates with � is

�� � the transition relation SP

associates with � � The transition relation for�E

is given by

�E

� �� � Li � � Li� press�Yi��

This transition relation guarantees the preservation of the Li�part of andpreservation of the values of all variables owned by Pi� The special treatmentof can be described by saying that� in addition to owning the variables inYi� Pi also owns the Li�part of �projection of on Li��

Page 65: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Compositional Veri�cation of Response Properties �

� Ji � J � Ti

The just transitions of SMPi

are the just transitions among Ti�

� Ci � C � Ti

The compassionate transitions of SMPi

are the compassionate transitions

among Ti�

There is no need to include the idling transition �I

in Ti because the e�ect of �I�

a transition that changes no system variable� can be obtained as a special case of�E

We refer to each computation of FTS SMPi

as a modular computation of process

Pi� As previously explained� any such computation represents a possible behaviorof process Pi when put in an arbitrary context which is only required to respectthe ownership rights of Pi�

Example �program KEEPING�UP�

Consider program KEEPING�UP presented in Fig� ���� Top�level process P� ownsvariable x and the ������part of � We use ����� as abbreviation for f��� ��� ��g� Wecan construct SM

P�

� the modular FTS corresponding to process P� as follows�

local x� y� integer where x � y � �

P� ��

������� loop forever do$

��� await x y �

��� x �� x �

%���� P� ��

����m�� loop forever do$

m�� await y x�

m�� y �� y �

%����Fig� ���� Program KEEPING�UP�

� V�� f� x� yg

� ��� � ����� � f��g

� x � �

� T�� f��� � ��� � ��� � �Eg

with the following transition relations �after some simpli�cations��

��� � move���� ��� pres�x� y�

��� � move���� ��� x y � pres�x� y�

��� � move���� ��� x� � x � pres�y�

Page 66: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response

�E

� �� � ����� � � ������ pres�x�

In this relations� we used the following abbreviation�

move��i� �j�� at��i � �� � f�ig

�� f�jg

� J�� f��� � ��� � ���g

� C�� �

The following is a modular computation of process P��b���� f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� �E���� f���m�g� x� �� y��

� ������ f���m�g� x� � y��

�� � � �

In a similar way� we can construct SMP�

� the modular FTS corresponding to

process P��

The following claim establishes a connection between computations of theentire program and modular computations of its processes�

Claim �� �computations of programs and modular computations�

Every computation of a program is a modular computation of each of itstop�level processes�

Thus� the set of computations of the entire program is a subset of the set ofmodular computations of each of its top�level processes�

Example Consider� for example� the following computation of program KEE�

PING�UP

���� f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� m����� f���m�g� x� �� y� �

� ������ f���m�g� x� � y� �

� m����� f���m�g� x� � y� �

� m����� f���m�g� x� � y�

� ������ f���m�g� x� � y�

�� � � �

Viewed as a modular computation of process P�� this computation can be pre�sented as�

Page 67: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Compositional Veri�cation of Response Properties

����� f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� ������ f���m�g� x� �� y� �

� �E���� f���m�g� x� �� y� �

� ������ f���m�g� x� � y� �

� �E���� f���m�g� x� � y� �

� �E���

� f���m�g� x� � y� � ����

�� f���m�g� x� � y�

�� � � �

Viewed as a modular computation of process P�� this computation can be pre�sented as�

����� f���m�g� x� �� y� �

� �E���� f���m�g� x� �� y� �

� �E���

� f���m�g� x� �� y� �� m���

�� f���m�g� x� �� y� �

� �E���

� f���m�g� x� � y� �� m���

�� f���m�g� x� � y� �

� m����� f���m�g� x� � y�

� �E���� f���m�g� x� � y�

�� � � �

This illustrates that a computation of a program is a modular computationof each of its top�level processes�

The weak converse of Claim �� is not true� There are modular computationsof process Pi which do not correspond to computations of the entire program� Thisis illustrated by b� the previously presented modular computation of process P�in program KEEPING�UP� This computation contains a state with y � � as a�E

�successor of a state with y � �� No such state can occur in a computation ofKEEPING�UP� This shows that the de�nition of modular computations of processPi allows more general contexts than the actual context provided by the programcontaining Pi� The actual context of P� within program KEEPING�UP is processP� which can never change y from a value of � to a value of ��

On the other hand� the strong converse of Claim �� is true� Let � be amodel �in�nite state sequence� such that the interpretation of is a subset of thelocations of P � The valid converse of Claim �� states that if � is simultaneouslya modular computation of every top�level process of P then � is a computationof P � In Problem ��� we request the reader to prove this fact�

Modular Validity and a Basic Compositionality Rule

For a top�level process Pi within program P � we say that formula � is modularly

valid over Pi� denoted

Pi qm

��

if � holds over all modular computations of Pi� For example� the formula � �x �x��� stating that x never decreases� is modularly valid over process P� of programKEEPING�UP �Fig� �� �� while � �y � y�� is modularly valid over process P� ofthe same program� �

� x� and y� denote the values of x and y in the preceding state�

Page 68: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Rule COMP�B� presented in Fig� ���� infers the P �validity of a formula � fromthe premise that � is modularly valid over some top�level process of P �

For a program p� Pi a top�level process of P � and � a tempo�ral formula

Pi qm �

P q �

Fig� ���� Rule COMP�B �basic compositionality��

Soundness

Let P be a program and Pi be a top�level process of P � Assume that formula �is modularly valid over Pi� i�e� Pi qm �� This means that � holds over all modularcomputations of Pi� By Claim ��� every computation of P is also a modularcomputation of Pi� It follows that all computations of P satisfy � and� hence� �is P �valid�

Rule COMP�B can be used to reduce the goal of establishing P q � into thesubgoals of establishing several modular validities �not necessarily of the sameformula �� In Problem � the reader is requested to establish this fact�

A Compositional Rule for Safety Properties

In theory� rule COMP�B is adequate for compositional veri�cation of any temporalformula� In practice� however� its application often proves inconvenient and callsfor additional temporal reasoning� Therefore� it is advantageous to derive morespeci�c rules� each of which is tailored to deal with temporal formulas of particularclasses�

In Fig� ��� we present rule COMP�S which can be used for compositionalveri�cation of safety formulas�

Premise CS states that is an invariant of the entire program P � PremiseCS states that the entailment � � p is modularly valid over some top�levelprocess Pi� From these two assumptions� the rule infers that p is an invariant ofP �

Justi�cation Assume that premises CS and CS hold and let � be a compu�tation of program P � By premise CS� formula holds at all positions of �� Since

Page 69: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Compositional Veri�cation of Response Properties �

For Pi� a top�level process of program P � and past formulas � p�

CS� P q �

CS � Pi qm� � p

P q � p

Fig� ���� Rule COMP�S �compositional veri�cation of safety properties��

every computation of P is also a modular computation of Pi� premise CS impliesthat the formula � � p holds at all positions of ��

Consider an arbitrary position j � � of �� By D� holds at all positionsk j and� therefore � holds at j� By CS � � � p holds at j and� therefore�so does p�

We conclude that p holds at all positions of ��

Rule COMP�S is often used in an incremental style� As a �rst step we take � T and prove Pi qm � p�� From this the rule infers

P q � p��

Next� we take � p� and prove Pi qm � p� � p�� This leads to

P q � p��

which may be followed by additional steps�

The advantage of this proof pattern is that in each step we concentrate onproving a modular validity over a single process Pi� If Pi is only a small partof the program� each compositional veri�cation step has to consider only a smallfraction of the transitions in the complete program�

We illustrate the use of rule COMP�S on a simple example�

Example �program KEEPING�UP�

Consider program KEEPING�UP presented in Fig� ���� Process P� in this programrepeatedly increments x� provided x does not exceed y � � In a symmetric way�process P� repeatedly increments y� provided y does not exceed x � �

We wish to prove for this program the invariance of the assertion jx�yj �i�e��

� jx� yj z �p

Page 70: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response

claiming that the di�erence between x and y never exceeds in absolute value�

We prove this property by compositional veri�cation� using rules INV�P andCOMP�S� We �rst show the P �validities

P q � �x � x�� and P q � �y � y���

and then the P �validities

P q � �x y � � and P q � �y x � ��

The invariants x y � and y x � imply the desired P �validity

P q � �jx� yj ��

For more details of this proof� we refer the reader to Section ��� of the SAFETYbook�

A Compositional Rule for Response Properties

Next� we present a rule that can support compositional veri�cation of responseproperties and illustrate its use� This is rule COMP�R� presented in Fig� ����

For Pi� a top�level process of program P � and past formulas � p� and q�

CR� P q �

CR � Pi qm p � � �q � � �

P q p � � q

Fig� ���� Rule COMP�R �compositional veri�cation of response properties��

Justi�cation Assume that premises CR and CR hold and let � be a com�putation of program P � By premise CR� formula holds at all positions of ��Since every computation of P is also a modular computation of Pi� premise MR implies that the formula p � � �q � � � holds at all positions of �� Let j be ap�position of �� By MR � there exists a position k � j such that either q holdsat k or is false at k� The second alternative is impossible� due to CR� Weconclude that every p�position is followed by a q�position and� therefore� p� � qis valid over P �

Example �program PING�PONG�

Page 71: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Compositional Veri�cation of Response Properties �

local x� y� z� integer where x � y � z � �

P� ��

�������own out x� z

��� x ��

��� await y � �

��� z ��

���

������� P� ��

�����own out y

m�� await x � �

m�� y ��

m��

�����Fig� ���� Program PING�PONG�

We illustrate the use of rule COMP�R for compositional veri�cation of responseproperties on an example� In Fig� ���� we present program PING�PONG�

The two processes of this program maintain a coordination protocol� Theprotocol starts by P� setting x to at statement ��� This is sensed by P� at m��and is responded to by setting y to at statement m�� This is sensed by P� at��� and is responded to by setting z to at ���

We wish to establish for this program the response property

� � �z � ��

We start by proving� using rule P�INV� the modular invariance

P� qm� �x � x���

This is easy to prove since the local formula x � x� is inductive over themodular FTS corresponding to process P��

By rule COMP�B we can infer

P q � �x � x���

In a similar way� we establish P� qm� �y � y��� leading to

P q � �y � y���

Now� we use rule RESP�J to prove

P� qm z�p

� � x � � z �q

As the intermediate assertion and helpful transition� we take �� at��� and�h� ���

Using rule COMP�R with � T� we conclude

P q � � �x � ���

Page 72: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Next� we intend to establish

P� qm

x � � � � �y � � � x x���

As a �rst step� we use rule INV to prove

P� qm� at�m��� � y � � z �

��

Having established the modular invariance of �� over P�� the following veri�cationdiagram proves that x � � � � �y � � � x x�� is modularly valid over P��

����at�m�m� �����at�m�m� ��

��

�x � � �E��� �y � � � x x�

Note that the diagram allows the possibility that the environment changesx from a positive value to a nonpositive one� However� such a change leads to aposition satisfying x x��

Now� use rule COMP�R with � x � x�� p� x � �� and q� y � �� to conclude

P q x � � � � �y � ���

Next� we plan to establish

P� qm y � � � � �z � � y y���

As a �rst step� we use rule INV to prove

P� qm� �at������ � z � ��

Having established this modular invariant� the following veri�cation diagramproves that y � � � � �z � � y y�� is modularly valid over P��

����at����� �����at����� �����at����� ��

��

�y � � �E��� �z � � y y�

Now� use rule COMP�R with � y � y� � p� y � �� and q� z � � to conclude

P q y � � � � �z � ��

Thus� we have shown that the three response properties � � �x � ���x � � � � �y � ��� and y � � � � �z � � are all valid over program PING�PONG�Using rule TRNS�R� we conclude

Page 73: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Guarantee Properties �

� � �z � ��

��� Guarantee Properties

In this and the following section we consider methods for proving properties be�longing to the guarantee and obligation classes� Our approach to these classes isto consider them as special cases of the response class� and to use response ruleswith some simpli�cations for their veri�cation�

As de�ned in Section ��� of the SAFETY book� guarantee properties are prop�erties that can be speci�ed by a formula of the form

� r

for some past formula r�

Clearly� guarantee properties are a special case of response properties� p �� r� where the antecedent p refers to the beginning of the computation� Conse�quently� an obvious rule for proving guarantee properties� is rule GUAR �Fig� �����

For past formula r

�rst � � r

� r

Fig� ���� Rule GUAR �proving guarantee properties��

The rule requires as a premise a response property by which the initial con�dition of the program guarantees the eventual realization of r�

Example Consider system INC�� presented in Fig� ���

We wish to establish the guarantee property

� �x � � Q �x � ���

for system INC�� using rule GUAR� The premise of rule GUAR requires the responseproperty

pz � �rst x � � z �

� ��x � � Q �x � �� z �

r

��

This response property can be proven by rule WELL�J� using the intermediatepast formula

Page 74: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

V � fx� integerg

� x � �

T � f�I� �g where �� � x� � x�

J � f�g

C� �

Fig� ��� System INC��

�� even�x� � x � �x � � � Q �x � ��

��

the helpful transition � � and the ranking function �� j �� xj�

Let us establish premise JW of rule WELL�J� It requires showing

� � � x � � z �p

� � � � � even�x� � x � �x � � � Q �x � ��

� z ��

Clearly� x � � entails all three conjuncts comprising �� Note that� in this case�we do not use the conjunct �rst which is part of p�

By rule GUAR� we conclude that property

� �x � � Q �x � ���

is valid over system INC��

The premise of rule GUAR contains �rst as part of the antecedent� Its purposeis to ensure that we only consider at the beginning of the computation� Asillustrated in the last example� in many cases we do not use this conjunct andsimply prove � � p� There are� however� some cases in which this conjunct isnecessary� as illustrated below�

Example Consider the simple program

local x� integer where x �

��� loop forever do !��� skip# ��� x �� �x"�

We consider the guarantee property

�� � �at��� � �x � ���

This property states that every computation of the program contains a posi�tion j satisfying at���� and such that x � at all positions i j�

Page 75: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Guarantee Properties �

This property is certainly valid for the program� To prove it� we have toestablish the response property

�rst at��� x � � � �at��� � �x � ���

Note� however� that the �rst conjunct is essential in this case� since the formula

at��� x � � � �at��� � �x � ��

is not valid over the program�

Consider position i in the computation� corresponding to the third visit to��� At this position x � � but there exist earlier positions in which x � ��Therefore� there exists no position later than i� at which at���� �x � � holds�It follows that the implication at��� x � � � �at��� � �x � �

�does not

hold at i�

To prove that the full premise

�rst at��� x � z �p

� ��at��� � �x � � z �

r

��

is valid� we may use rule CHAIN�J �Fig� ��� with the following intermediate pastformulas and helpful transitions�

��� at��� � �x � � ��� ��

��� at��� � �x � � ��� ��

�� � r� at��� � �x � � ��� ���

Premise J requires showing

�rst at��� x � z �p

� � � � � at��� � �x � � z ���

Clearly� the antecedent implies at���� To see that it also implies � �x � ��we observe that under �rst � any past formula p is congruent to �p��� the initialversion of p� Since the initial version of � �x � � is�� �x � �

�� � �x � ��

the right�hand side simpli�es to at��� x � which is entailed by the left�handside�

Another premise that has to be checked is J� for transition ���

��� at��� � �x � � z ���

� � � � � at ���� x� � � �x � � z ���

Since ��� implies at ���� and x� � x� and � �x � � implies x � � the entailmentis valid�

Page 76: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Chapter �� Response

The rest of the premises are proven in a similar way� This establishes thevalidity of � �at��� � �x � �

��

Completeness of Rule GUAR

Rule GUAR is obviously sound� which means that the P �validity of the premise�rst � � r implies the P �validity of the conclusion � r�

The rule is also complete� which means that the P �validity of the conclusionimplies the P �validity of the premise� Consider �� an arbitrary computation ofprogram P � By the assumption that � r is P �valid� there exists a position k atwhich r holds� For � to satisfy the premise we have to show that every positioni � �� satisfying �rst � is followed by a position j� j � i� satisfying r� Since �is the only position satisfying �rst � we can take j to be k�

Completeness of rule GUAR is important because it tells us that the rule isadequate for proving all P �valid guarantee formulas�

�� Obligation Properties

Before studying the class of obligation properties� we introduce a special class ofresponse formulas�

Escape Formulas

Some response properties are naturally expressed by formulas of the form

p � � q � � r�

for past formulas p� q� and r�

This formula claims that� following a p�state� either q will hold forever or reventually occurs� We may view such a formula as stating that� following p� qshould hold continually unless we escape to a state that eventually leads to r�Consequently� we refer to formulas of this form as escape formulas�

To see that this formula speci�es a response property� observe that it isequivalent to

�q ��r� � �p �r� � � r�

In this form� the formula states that every �q�position preceded by a p�positionsuch that no r has occured since� must be followed by an r�position�

While� in principle� it is possible to use the general response rules to establishescape formulas� it is more convenient to use a special rule� presented in Fig� �� �

Page 77: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Obligation Properties

For past formulas p� q� r� and �

E� p � q W �

E � � � � r

p � � q � � r

Fig� �� � Rule ESC �escape��

Rule ESC uses an auxiliary past formula �� Premise E requires that� follow�ing a p�position� either q will hold forever or q will hold until an occurrence of ��Premise E requires that every ��position is followed by an r�position� Typically�we prove E by rule P�WAIT� a past version of rule WAIT �Fig� ��� of the SAFETY

book�� and E by appropriate response rules�

Example Consider program MAY�HALT of Fig� ���� This trivial program hasa nondeterministic choice at �� between getting deadlocked at �� or� taking the�a� branch� proceeding to ��� Consequently� the program has some computationsthat reach �� and stay there forever� and some computations that never halt�

��� loop forever do�����������

����a�� skip

or

�b�� skip# ��� halt

������ skip

��� skip

��������Fig� ���� Program MAY�HALT �possible deadlock��

We use rule ESC to prove the property

��� at����� z �p

� � at������ z �q

� � at��� z �r

for this program�

Take

Page 78: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

�� at����

Consider the two premises of rule ESC�

� Premise E

This premise requires

at����� z �p

� at������ z �q

W at��� z ��

It is straightforward to derive this property by rule WAIT�

� Premise E

at��� z ��

� � at��� z �r

A single application of rule RESP�J establishes this property�

This establishes the considered escape property�

From Escape to Obligation

The �simple� obligation class includes all the properties that can be speci�ed bya formula of the form

� q � � r�

for past formulas q and r�

We observe that such a formula can be rewritten as

�rst z �p

� � q � � r�

which represents it as a special case of an escape formula�

This observation inspires rule OBL �Fig� ���� for proving obligation proper�

Page 79: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Obligation Properties �

For past formulas q� r� and ��

O� �rst � q W �

O � � � � r

� q � � r

Fig� ���� Rule OBL �proving obligation properties��

ties�

Premise O requires that� from the beginning of the computation� q holdscontinuously and can be interrupted only at a position satisfying �� Premise O states that � guarantees an eventual r� Consequently� q can be interrupted onlywhen r is guaranteed� It follows that qW �� r� is valid� By properties of thewaiting�for operator� we may deduce � q � � r�

Example �incrementor�decrementor�

Consider Program INC�DEC presented in Fig� ���� which nondeterministically in�crements or decrements an integer variable y�

local x� boolean where x � T

y � integer where y � �

��� loop forever do

���

��������a�� hwhen x do y �� y � i

or

�b�� hwhen x do x �� Fi

or

�c�� hwhen �x do y �� y � i

�������Fig� ���� Program INC�DEC �nondeterministic

incrementor�decrementor��

We wish to prove for this program the obligation property

� y � � z �q

� � y � � z �r

Page 80: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

Intending to apply rule OBL� it only remains to identify the intermediate formula�� The main characterization of � is that it describes the event whose occurrenceguarantees the eventual realization of r�

Examining the program� we see that the �rst moment we realize that y � �is going to happen is when x becomes false� Consequently we take

�� �x y � ��

The premises that have to be veri�ed are as follows�

Premise O

To establish this premise it su�ces to prove

� � � z �bp � y � � z �bqq W �x y � � z �br� �

To prove this we use rule WAIT �Fig� ��� of the SAFETY book� with the intermediateassertion b�� x y � ��

The three premises of rule WAIT require

W� at��� x y � � z �bp � x y � � z �b� � � � � �

which is obviously state valid�

W � x y � � z �b� � y � � z �bq �

which is trivially state valid�

W�� �� x y � � z �b� � x� y� � � z �b��

� �x� y� � � z �br�

for all transitions � in the program� It is not di�cult to see that all three require�ments are valid�

Premise O

To establish this premise we have to prove

�x y � � z ��

� � y � � z �r

This is proven by the RANK veri�cation diagram presented in Fig� ����

This concludes the proof of

� �y � �� � � �y � ���

Page 81: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

��� Obligation Properties ��

��

����� at���

��

���

����� at���

�c�

�c����

��

��x� y � ��� y

��

����� y � �

Fig� ���� Veri�cation diagram for �x y � � � � �y � ���

A general obligation property is a conjunction of the form

n#i�

�� qi � � ri��

Consequently� to prove the validity of such a formula� it is su�cient �and neces�sary� to prove the validity of each conjunct� which is a simple obligation property�

Completeness of rule OBL

Rule OBL is complete for proving �simple� obligation properties� This means that�whenever � q�� r is P �valid� we can �nd a past formula �� such that premisesO and O are also P �valid� The choice we can always make is taking

�� r � ��q � �r��We will show that� if the property � q � � r is P �valid� then the two premisesof rule OBL are also P �valid for this choice of ��

Premise O

For premise O it su�ces to show that

q W r � ��q � �r� z ��

is P �valid�

This formula states that either q holds forever� or it is interrupted by an r� or

Page 82: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

it is interrupted by a �q�position which is not preceded by any r�position� Thisformula is valid in general so� in particular� it holds over all computations�

Premise O

This premise requires

r � ��q � �r� z ��

� � r�

for which it is su�cient to show

�q � �r � � r�

Assume to the contrary� that there exists a computation � and a position i suchthat �q � �r holds at i� but r does not hold at any position j � i� Since�q � r holds at i� r does not occur at any position j i� Therefore � does notsatisfy � r� On the other hand� since �q at i� � also does not satisfy � q� Thiscontradicts our assumption that � q � � r is P �valid�

Consequently� premise O is also P �valid�

As we continuously remind the reader� the auxiliary formula � constructedduring a proof of completeness is not necessarily the one we recommend for actualuse� In practice� we can almost always �nd better assertions�

Problems

Problem � �three values� page

Prove accessibility for process P� of program MUX�VAL�� of Fig� ���� This programuses the shared integer variables y� and y�� Obviously� these variables can onlyassume one of the values f�� �� g�

Accessibility for P� is stated by the response formula

at��� � � at����

Problem �� �bakery algorithms� page �

�a� Prove accessibility for process P� of program MUX�BAK�A of Fig� ���� Notethat the two processes are not exactly symmetric due to the di�erence betweenstatements �b� and mb

��

The algorithm is called the bakery algorithm� since it is based on the ideathat customers� as they enter� pick numbers which form an ascending sequence�Then� a customer with a lower number has higher priority in accessing its criticalsection� Statements �� and m� ensure that the number assigned to yi� i � � � isgreater than the current value of yj � j �� i�

Page 83: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Problems ��

local y�� y�� integer where y� � y� � �

���������������

��� loop forever do������������

��� noncritical

���

&if y� � �

then y� �� �

else y� ��

'

��� await y� �� y�

��� critical

��� y� �� �

������������

���������������

���������������

m�� loop forever do������������

m�� noncritical

m��

&if y� � �

then y� ��

else y� �� �

'

m�� await y� �� �y�m�� critical

m�� y� �� �

������������

���������������Fig� ���� Program MUX�VAL���

local y�� y�� integer where y� � y� � �����������������

��� loop forever do�������������

��� noncritical

��� y� �� y� �

���

����a�� await y� � �

or

�b�� await y� y�

������ critical

��� y� �� �

�������������

����������������

����������������

m�� loop forever do�������������

m�� noncritical

m�� y� �� y� �

m��

���ma� � await y� � �

or

mb�� await y� y�

���m�� critical

m�� y� �� �

�������������

����������������Fig� ���� Program MUX�BAK�A�

�b� Program MUX�BAK�A does not obey the LCR restriction� In particular� state�ments �� and m� each contain two critical references� to y� and to y�� To correctthis situation� we propose program MUX�BAK�C of Fig� ���� This LCR�programcontains two additional await statements that ensure that processes do not waittoo long at locations �� or m�� Show that program MUX�BAK�C guarantees acces�sibility for process P��

Problem �� �variants of Dekker�s algorithm�� page �

Page 84: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

local y�� y�� t�� t�� integer where y� � y� � �x�� x� � integer where x� � x� � �

�������������������������

��� loop forever do����������������������

��� noncritical

��� x� ��

��� t� �� y� �

��� y� �� t���� x� �� �

� � await x� � �

���

���await y� � �

or

await y� y�

������ critical

��� y� �� �

����������������������

�������������������������

�������������������������

m�� loop forever do����������������������

m�� noncritical

m�� x� ��

m�� t� �� y� �

m�� y� �� t�m�� x� �� �

m � await x� � �

m��

���await y� � �

or

await y� y�

���m�� critical

m�� y� �� �

����������������������

�������������������������Fig� ���� Program MUX�BAK�C�

�a� Prove accessibility for process P� of program MUX�DEK�A of Fig� ���� Thatis� show that the response formula

at��� � � at���

is valid over MUX�DEK�A�

�b� Prove accessibility for process P� of program MUX�DEK�B of Fig� ��� Thatis� show that the response formula

at��� � � at���

is valid over MUX�DEK�B�

Problem �� �condensed form of ranking functions� page ��

In the text� it was suggested that a ranking function � � �d�� d��� where d� andd� M are natural numbers� can always be replaced by the ranking functionb� � M � d� � d�� Show that if both d� M and d�� M � then

b� � M � d� � d� � b�� � M � d�� � d�� i� �� �d�� d�� � ��� �d��� d����

Problem � �rule with relaxed premise JW � page �

Page 85: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Problems ��

local y�� y�� t� integer where y� � y� � �� t � ��������������������������

��� loop forever do�����������������������

��� noncritical

��� y� ��

��� while y� � do����������� y� ��

���

���await t �

or

await y� � �

���� � y� ��

����������� critical

��� t ��

��� y� �� �

�����������������������

��������������������������

�������������������������

m�� loop forever do����������������������

m�� noncritical

m�� y� ��

m�� while y� � do��������m�� y� ��

m��

���await t �

or

await y� � �

���m � y� ��

��������m�� critical

m�� t ��

m�� y� �� �

����������������������

�������������������������Fig� ���� Program MUX�DEK�A �a variant of Dekker�s algorithm��

Consider a version of rule WELL�J in which premise JW has been replaced by theweaker premise

dJW � �� �i � q� �k�

j�

���j �i � ��j ��

where �i� ��j stands for ��i � ��j � � ��i � ��j�� This premise requires that either

q is achieved by � � or the rank does not increase and some assertion �j �notnecessarily �i� holds after the transition�

Show that the resulting rule is unsound� That is� show a property thatsatis�es premises JW� dJW � JW�� and JW�� over a given program� and yet isinvalid� This will show that persistence of helpful transitions is essential�

Problem �� �integer division� page ��

Program IDIV of Fig� �� accepts two positive integers in variables x and y andplaces in variable z their integer quotient x div y� and in variable w the remainderof their division xmod y� Prove total correctness of program IDIV� which can bespeci�ed by the response formula

� � �at��� x � z � y � w � w y��

Page 86: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

local y�� y�� t� integer where y� � �� y� � �� t � ��������������������������

��� loop forever do�����������������������

��� noncritical

��� y� ��

��� while y� � do��������� if t � then������ y� ��

� � await t �

��� y� ��

���������

��� critical

��� t ��

���� await y� ��

���� y� �� �

�����������������������

��������������������������

��������������������������

m�� loop forever do�����������������������

m�� noncritical

m�� y� ��

m�� while y� � do������m�� if t � then���m�� y� ��

m � await t �

m�� y� ��

���������

m�� critical

m�� t ��

m��� await y� ��

m��� y� �� �

�����������������������

��������������������������Fig� ��� Program MUX�DEK�B�

This formula states that every computation of program IDIV terminates �i�e��reaches the terminal location ��� with values of z� w satisfying x � z � y � wand � w y�

in x� y � integer where x � �� y � �local t � integerout z� w � integer where z � w � �

��� t �� x

��� while t � � do

��� if w � � y

then ��� �z� w� t� �� �z � � �� t� �

else ��� �z� w� t� �� �z� w � � t � �

���

Fig� �� � Program IDIV �integer division��

Page 87: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Problems �

Problem �� �greatest common divisor� page ��

Program GCDM of Fig� ��� accepts two positive integers in variables x� and x��It computes in z the greatest common divisor �gcd � of x� and x�� and in variablesw� and w� two integers which express z as a linear combination of the inputs x�and x�� Prove total correctness of program GCDM� which can be stated by theresponse formula

� � �at�� z � gcd�x�� x�� z � w� � x� � w� � x���

in x�� x� � integer where x� � �� x� � �local y�� y�� t�� t�� t�� t�� u � integerout z� w � integer

��� �y�� y�� t�� t�� t�� t�� �� �x�� x�� � �� �� �

��� �y�� y�� u� �� �y�mod y�� y�� y� div y��

��� while y� �� � do$��� �t�� t�� t�� t�� �� �t� � u � t�� t�� t� � u � t�� t��

��� �y�� y�� u� �� �y�mod y�� y�� y� div y��

%��� �z� w�� w�� �� �y�� t�� t��

� �

Fig� ���� Program GCDM�greatest common divisor with multipliers��

The program uses the operation div of integer division and the operation mod

which computes the remainder of an integer division� In your proof you may usethe following properties of the gcd function which hold for every nonzero integersm and n �possibly negative��

gcd�m�n� � gcd �m � n� n� for every m �� n

gcd�m�m� � jmj�

Problem �� �computing the gcd and lcm� page ��

Program GCDLCM of Fig� ��� accepts two positive integers in variables x� andx�� It computes in variable z their greatest common divisor and in variable wtheir least common multiple� Prove total correctness of program GCDLCM� whichcan be stated by the response formula

� � �at��� z � gcd�x�� x�� w � lcm�x�� x����

Page 88: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

�� Chapter �� Response

in x�� x� � integer where x� � �� x� � �local y�� y�� y�� y� � integerout z� w � integer

��� �y�� y�� y�� y�� �� �x�� x�� x�� ��

��� while y� �� y� do�������� if y� � y� then

��� �y�� y�� �� �y� � y�� y� � y��

��� if y� y� then

��� �y�� y�� �� �y� � y�� y� � y��

������ � �z� w� �� �y�� y� � y��

���

Fig� ���� Program GCDLCM �computing the gcd and lcm��

In your proof you may use the properties of the gcd function listed in Prob�lem ��� and the following property of the lcm function�

lcm�m�n� � m � n�gcd�m�n��

Problem �� �set partitioning� page ��

Consider program EXCH presented in Fig� ���� The program accepts as input twosets of natural numbers S and T � whose initial values are S� and T�� respectively�

Process P� repeatedly identi�es and removes the maximal element in S andsends it to P� which places it in T � Symmetrically� P� identi�es and removes theminimal element in T and sends it to P� which places it in S� The processes usethe operations max�S� and min�T � which �nd� respectively� the maximal elementin the set S and the minimal element in the set T � Show total correctness ofprogram EXCH� which can be speci�ed by the response formula

� � �at��� at�m� jSj � jS�j jT j � jT�j S T ��

This formula states that the program terminates and on termination� sets S andT have preserved their initial sizes and that every element in S is smaller than orequal to every element in T �

Problem �� �converse of Claim ��� page ��

Let P �� !P� �� S�k � � �kPk �� Sk " be a program whose top�level processes commu�nicate by shared variables and such that every program variable is owned by one

Page 89: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

Problems ��

in S�� T�� set of natural where S� �� �� T� �� �out S� T � set of natural where S � S�� T � T�local �� � � channel of integer

P� ��

����������������������

local x� mx� integer

��� x �� �

��� mx �� max�S�

��� while x mx do���������� �� mx

��� S �� S � fmxg

��� � � x

� � S �� S � fxg

��� mx �� max�S�

���������� ���

���

����������������������

P� ��

����������������

local y� mn� integer

m�� �� y

m�� while y � � do�������m�� T �� T � fyg

m�� mn �� min�T �

m�� � � mn

m�� T �� T � fmng

m � �� y

�������m��

����������������

Fig� ���� Program EXCH �partitioning two sets��

of the top�level processes� Let � be a model such that the interpretation of isa subset of the locations of P and � is simultaneously a modular computation ofevery Pi� i � � � � � � k� Show that � is a computation of P �

Problem � �completeness of rule COMP�B� page ��

Let P �� !P� �� S�k � � �kPk �� Sk " be a program whose top�level processescommunicate by shared variables and such that every program variable is ownedby one of the top�level processes� Let � be a P �valid formula� Show that theP �validity of � can be compositionally inferred from modular validities� usingrule COMP�B and temporal reasoning� This establishes the completeness of ruleCOMP�B for compositional veri�cation�

A solution to this problem can be organized as follows�

� For each top�level process Pi� i � � � � � � k� construct a formula �i capturingthe temporal modular semantics of Pi� That is� a model � satis�es �i i� �is a modular computation of Pi� Argue semantically that

Pi qm �i�

for each i � � � � � � k�

� Use rule COMP�B and temporal reasoning to infer

Page 90: Z Manna and A Pnszabolcs/CompSys/apch1.pdf · y prop erties do not dep end on the fairness require men ts for their v alidit y progress prop erties do In Chapters ... tains prop erties

c� Z� Manna and A� Pnueli� �� Aug� ��� Not for Distribution

� Chapter �� Response

P q �� � � � �k�

� Argue semantically that a model � satis�es ��� � ��k i� � is a computationof the entire program P � Therefore� if � is P �valid� then the following generalvalidity holds�

q �� � � � �k � ��

� Apply temporal reasoning to P q �� � � � �k and q �� � � � �k � � toinfer

P q ��