algebra of concurrent programming
DESCRIPTION
Algebra of Concurrent Programming. Tony Hoare Cambridge 2011. With ideas from. Ian Wehrman John Wickerson Stephan van Staden Peter O’Hearn Bernhard Moeller Georg Struth Rasmus Petersen …and others. Subject matter: designs. - PowerPoint PPT PresentationTRANSCRIPT
Algebra of Concurrent Programming
Tony Hoare
Cambridge 2011
With ideas from
• Ian Wehrman• John Wickerson• Stephan van Staden• Peter O’Hearn• Bernhard Moeller• Georg Struth• Rasmus Petersen• …and others
Subject matter: designs
• variables (p, q, r) stand for computer programs, designs, specifications,…
• they all describe what happens inside/around a computer that executes a given program.
• The program itself is the most precise.• The specification is the most abstract.• Designs come in between.
Examples
• Postcondition:– execution ends with array A sorted
• Conditional correctness:– if execution ends, it ends with A sorted
• Precondition: – execution starts with x even
• Program: x := x+1 – the final value of x one greater than the initial
Examples
• Safety:– There are no buffer overflows
• Termination:– execution is finite (ie., always ends)
• Liveness:– no infinite internal activity (livelock)
• Fairness:– a response is always given to each request
• Probability:– the ration of a’s to b’s tends to 1 with time
Unification
• Same laws apply to programs, designs, specifications
• Same laws apply to many forms of correctness.
• Tools based on the laws serve many purposes.• Distinctions can be drawn later– when the need for them is apparent
Refinement: p ⊑ q• Everything described by pis also described by q , e.g.,– spec p implies spec q– prog p satisfies spec q– prog p more determinate than prog q
• stepwise development of a spec is– spec ⊒ design ⊒ program
• stepwise analysis of a program is– program ⊑ design ⊑ spec
Various terminologyp ⊑ q
• below• lesser• stronger• lower bound• more precise• …deterministic• included in • antecedent =>
• above• greater• weaker• upper bound• more abstract• ...non-deterministic• containing (sets)• consequent (pred)
Law: ⊑ is a partial order
•⊑ is transitive• p ⊑ r if p ⊑ q and q ⊑ r• needed for stepwise development/analysis
• ⊑ is antisymmetric • p = r if p ⊑ r and r ⊑ p• needed for abstraction
•⊑ is reflexive– p ⊑ p•for convenience
Binary operator: p ; q
• sequential composition of p and q•each execution of p;q consists of– all events x from an execution of p – and all events y from an execution of q•subject to ordering constraint, either– strong -- weak– interruptible -- inhibited
alternative constraints on p;q •strong sequence: – all x from p must precede all y from q•weak sequence: – no y from q can precede any x from p•interruptible: – other threads may interfere between x and y•separated: – updates to private variables are protected.• all our algebraic laws will apply to each alternative
Hoare triple: {p} q {r} • defined as p;q ⊑ r – starting in the final state of an execution of p,
q ends in the final state of some execution of r– p and r may be arbitrary designs.
•example: {..x+1 ≤ n} x:= x + 1 {..x ≤ n} • where ..b (finally b) describes all executions that
end in a state satisfying a single-state predicate b .
monotonicity
• Law: ( ; is monotonic wrto ⊑) :– p;q ⊑ p’;q if p ⊑ p’ – p;q ⊑ p;q’ if q ⊑ q’– compare: addition of numbers
• Rule (of consequence):– p’ ⊑ p & {p} q {r} & r ⊑ r’ implies {p’} q {r’}
• Rule is interprovable with first law
associativity
• Law (; is associative) :– (p;q);q’ = p;(q;q’)
• Rule (sequential composition):– {p} q {s} & {s} q’ {r} implies {p} q;q’
{r}
• half the law interprovable from rule
Unit(skip):
• a program that does nothing• Law ( is the unit of ;):– p; = p = ;p
• Rule (nullity)– {p} {p}
• a quarter of the law is interprovable from Rule
concurrent composition: p | q
• each execution of (p|q) consists of – all events x of an execution of p,– and all events y of an execution of q
• same laws apply to alternatives:– interleaving: x precedes or follows y– true concurrency: x neither precedes nor
follows y.– separation: x and y independent
• Laws: | is associative, commutative and monotonic
Separation Logic• Law (locality of ; wrto |):– (s|p) ; q ⊑ s |(p;q) (left locality )– p ; (q|s) ⊑ (p;q) | s (right locality)
• Rule (frame) :– {p} q {r} implies {p|s} q {r|s}
• Rule interprovable with left locality
Concurrency law• Law (; exchanges with *)– (p|q) ; (p’|q’) ⊑ (p;p’) | (q;q’)– like exchange law of category theory
• Rule (| compositional)– {p} q {r} & {p’} q’ {r’} implies
{p|p’} q|q’ {r|r’}
• Rule interprovable with the law
p|q ; p’|q’
p p’q’q
by columns
p|q ; p’|q’ ⊑
p p’q’q p;p’ | q;q’
by rows
Regular language model
• p, q, r,… are languages– descriptions of execution of fsm.
• p ⊑ q is inclusion of languages• p;q is (lifted) concatenation of strings– i.e., {st| s ∊ p & t ∊ q}
• p|q is (lifted) interleaving of strings• = {< >} (only the empty string)• “c” = {<c>} (only the string “c”)
Left locality
•Theorem: (s|p) ; q ⊑ s | (p;q)•Proof:
in lhs: s interleaves with just p , and all of q comes at the end.in rhs: s interleaves with all of p;q
so lhs is a special case of rhs
• p s s ; q q q ⊑ p s q s q q
Exchange
• Theorem: (p|q) ; (p’|q’) ⊑ (p;p’) | (q;q’)– in lhs: all of p and q comes before
all of p’ and q’ .– in rhs: end of p may interleave with q’
or start of p’ with qthe lhs is a special case of the rhs.
p q p ; q’ p’ q’ ⊑ p q q’ p p’ q’
Conclusion
• regular expressions satisfy all our laws for ⊑ , ; , and |
• and for other operators introduced later
Part 2. More Program Control Structures
• Non-determinism, intersection• Iteration, recursion, fixed points• Subroutines, contracts, transactions• Basic commands
Subject matter
• variables (p, q, r) stand for programs, designs, specifications,…
• they are all descriptions of what happens inside and around a computer that is executing a program.
• the differences between programs and specs are often defined from their syntax.
Specification syntax includes
• disjunction (or, ⊔) to express abstraction, or to keep options open
– ‘it may be painted green or blue’• conjunction (and, ⊓) combines requirements– it must be cheaper than x and faster than y
• negation (not) for safety and security– it must not explode
• implication (contracts)– if the user observes the protocol, so will the system
Program syntax excludes
• disjunction– non-deterministic programs difficult to test
• conjunction– inefficient to find a computation satisfying both
• negation– incomputable
• implication– which side of contract?
programs include
• sequential composition (;)• concurrent composition (|)• interrupts• iteration, recursion• contracts (declarations)• transactions• assignments, inputs, outputs, jumps,…
• So include these in our specifications!
Bottom
•An unimplementable specification – like the false predicate•A program that has no execution– the compiler stops it from running•Define as least solution of: _ ⊑ _ • Theorem: ⊑ r– satisfies every spec, – but cannot be run (Dijkstra’s miracle)
Algebra of
• Law ( is the zero of ;) :– ; p = = p ;
• Theorem : {p} {q}• Quarter of law provable from
theorem
Top ⊤• a vacuous specification,– satisfied by anything, – like the predicate true
• a program with an error– for which the programmer is responsible– e.g., subscript error, violation of
contract…• define ⊤ as greatest solution of: _ ⊑ _
Algebra of ⊤• Law: none• Theorem: none– you can’t prove a program with this
error– it might admit a virus!
• A debugging implementation may supply useful laws for ⊤
Non-determinism (or): p ⊔ q• describes all executions that either
satisfy p or satisfy q .• The choice is not (yet) determined.• It may be determined later– in development of the design– or in writing the program– or by the compiler – or even at run time
lub (join): ⊔• Define p⊔q as least solution of
p ⊑ _ & q ⊑ _• Theorem– p ⊑ r & q ⊑ r iff p⊔q ⊑ r
• Theorem– ⊔ is associative, commutative,
monotonic, idempotent and increasing– it has unit ⊥ and zero ⊤
glb (meet): ⊓• Define p⊓q as greatest solution of
_ ⊑ p & _ ⊑ q
Distribution
• Law ( ; distributive through ⊔ )– p ; (q⊔q’) = p;q ⊔ p;q’– (q⊔q’) ; p = q;p ⊔ q’;p
• Rule (non-determinism)– {p} q {r} & {p} q’ {r} implies {p}
q⊔q’ {r}– i.e., to prove something of q⊔q’ prove the same thing of both q and q’
• quarter of law interprovable with rule
Conditional: p if b else p’• Define p ⊰b⊱ p’ as
b.. ⊓ p ⊔ not(b).. ⊓ p’– where b.. describes all executions that
begin in a state satisfying b .• Theorem. p ⊰b⊱ p’ is associative,
idempotent, distributive, and– p ⊰b⊱ q = q ⊰not(b)⊱ p (skew
symm)– (p ⊰b⊱ p’ ) ⊰c⊱ (q ⊰b⊱ q’) = (p
⊰c⊱ q) ⊰b⊱ (p’ ⊰c⊱ q’) (exchange)
Transaction
• Defined as (p ⊓..b) ⊔ (q ⊓..c)– where ..b describes all executions that
end satisfying single-state predicate b .• Implementation:– execute p first– test the condition b afterwards– terminate if b is true– backtrack on failure of b– and try alternative q with condition c.
Transaction (realistic)
• Let r describe the non-failing executions of a transaction t .– r is known when execution of t is complete.– any successful execution of t is committed – a single failed execution of t is undone, – and q is done instead.
• Define: (t if r else q) = t if t ⊑ r = (t ⊓ r) ⊔ q otherwise
Contracts
• Let q be the body of a subroutine• Let s be its specification• Let (q .. s) assert that q meets s• Programmer error (⊤) if not so • Caller of subroutine may assume
that s describes all its calls• Implementation may just execute q
Least upper bound
• Let S be an arbitrary set of designs•Define ⊔S as least solution of
∀s∊ S . s ⊑ _ – ( ∀s∊ S . s ⊑ r ) ⇒ ⊔S ⊑ r (all r)
• everything is an upper bound of { } , so ⊔ { } = – a case where ⊔S ∉ S
similarly
• ⊓S is greatest lower bound of S• ⊓ { } = ⊤
Subroutine with contract: q .. s
• Define (q..s) as glb of the setq ⊑ _ & _ ⊑ s
• Theorem: (q.. s) = q if q ⊑ s = ⊤ otherwise
Iteration (Kleene *)
• q* is least solution of – (ɛ ⊔ (q; _) ) ⊑ _
• q* =def ⊔{s| (ɛ ⊔ q; s) ⊑ s} – ɛ ⊔ q; q* ⊑ q* – ɛ ⊔ q; q’ ⊑ q’ implies q* ⊑ q’– q* = ⊔ {qⁿ | n ∊ Nat} (continuity)
• Rule (invariance):– {p}q*{p} if {p}q{p}
Infinite replication
• !p is the greatest solution of _ ⊑ p|_– as in the pi calculus
• all executions of !p are infinite– or possibly empty
Recursion
• Let F(_) be a monotonic function between programs.
• Theorem: all functions defined by monotonic operators are monotonic.
• μF is strongest solution of F(_) ⊑ _• νF is weakest solution of _ ⊑ F(_)• Theorem (Knaster-Tarski): These
solutions exist.
Basic statements/assertions
• skip • bottom • top ⊤• assignment: x := e(x)• assertion: assert b• assumption: assume b• finally ..b• initially b..
more
• assign thru pointer: [a] := e• output: c!e• input: c?x• points to: a|-> e– a |-> _ =def exists v . a|-> v
• throw, catch• alloc, dispose
Laws(examples)
• assume b =def b..⊓• assert b =def b..⊓ ⊔ not(b).. • x:=e(x) ; x:=f(x) = x :=
f(e(x))– in a sequential language
more
• (p|-> _ ); [p] := e ⊑ p|-> e– in separation logic
• c!e | c?x = x := e– in CSP but not in CCS or Pi
• throw x ; (catch x; p) = p
Part 3Unifying Semantic Theories
• Six familiar semantic definition styles. • Their derivation from the algebra• and vice versa.
operational rules
algebraic laws
deduction rules
Hoare Triple
• a method for program verification• {p} q {r} ≝ p;q ⊑ r– one way of achieving r is by first doing p and then doing q
• Theorem (sequential composition):– {p} q {s} & {s} q’ {r} implies {p}
q;q’ {r}– proved by associativity
Plotkin reduction
• a method for program execution• <p , q> -> r =def p ; q ⊒ r– if p describes state before execution of q
then r describes a possible final state, eg.–<..(x2 = 18) , x := x+1> -> ..(x = 37)
• Theorem (sequential composition):• <p, q> -> s & <s, q’> -> r
implies <p, q;q’> r
Milner transition
• method of execution for processes• p – q -> r ≝ p ⊒ q;r– one of the ways of executing p is by first
executing q and then executing r .– e.g., (x := x+3) –(x:=x+1)-> (x:=x+2)
• Theorem (sequential composition):– p –q-> s & s –q’-> r => p –(q;q’)-> r(big-step rule for ; )
partial correctness
• describes what may happen• p[q]r =def p ⊑ q;r– if p describes a state before execution of
q, then execution of q may achieve r• Theorem (sequential composition):• p [q] s & s [q’] r implies p [q;q’] r• useful if r describes error states, and q
describes initial states from which a test execution of q may end in error.
Summary
• {p} q {r} =def p;q ⊑ r– Hoare triple
• <p,q>->r =def p;q ⊒ r– Plotkin reduction
• p –q->r =def p ⊒ q;r–Milner transition
• p [q] r =defp ⊑ q;r– test generation
Sequential composition
• Law: ; is associative• Theorem: sequence rule is valid for all four
triples.
• the Law is provable from the conjunction of all of them
Skip
• Law: p ; = p = ; p
• Theorems: {p} {p} p [] p
p − → p <p, > –>p
• Law follows from conjunction of all four theorems
Left distribution ; through ⊔• Law: p;(q ⊔ q’) = p;q ⊔ p;q’ • Theorems:– {p} (q⊔q’) {r} if {p}q{r} and {p}q’{r} – <p,q⊔q’>-> r if <p,q>-> r or <p, q’>-> r – p [q⊔q’] r if p [q] r or p [q’] r – p -(q⊔q’)-> r if p –q->r and p -q’->r(not used in CCS)
• law provable from either and rule together with either or rule.
locality and frame
• left locality (s|p) ; q ⊑ s | (p;q)• Hoare frame: {p} q {r} ⇒ {s|p} q {s|r}
• right locality p ; (q|s) ⊑ (p;q) | s• Milner frame: p -q-> r ⇒(p|s) - q-> (r|s)
• Full locality requires both frame rules
Separation logic
•Exchange law: – (p | p’) ; (q| q’) (p ; q) | (p’;q’)•Theorems– {p} q {r} & {p’} q’ {r’} ⇒ {p|p’} q|q’ {r|
r’}– p -q -> r & p’–q’-> r’ => p|p’ –q|q’-> r|r’
• the law is provable from either theorem• For the other two triples, the rules are
equivalent to the converse exchange law.
usual restrictions on triples
• in {p} q {r} , p and r are of form ..b, ..c
• in p [q] r , p and r are of form b.., c..• in <p,q>->r, p and r are of form ..b, ..c• in p –q->r, p and r are programs • in p –q->r (small step), q is atomic • (in all cases, q is a program)
• all laws are valid without these restrictions
Weakest precondition (-;)•(q -; r) =def
the weakest solution of ( _ ;q ⊆ r)– the same as Dijkstra’s wp(q, r)– for backward development of programs
Weakest precondition (-;)
• Law (-; adjoint to ;)– p ⊑ q -; r iff p;q ⊑ r (galois)
• Theorem– (q -; r) ; q ⊑ r– p ⊑ q -; (p ; q)
• Law provable from the theorems– cf. (r div q) q ≤ r– r ≤ (rq) div q
Theorems
• q’ ⊑ q & r ⊑ r’ => q-;r ⊑ q’-;r’• (q;q’)-;r ⊑ q-;(q’-;r)• q-;r ⊑ (q;s) -; (r;s)
Specification statement (;-)
•(p ;- r) =def the weakest solution of ( p ; _ ⊆ r)
– Back/Morgan’s specification statement– for stepwise refinement of designs– same as p⇝r in RGSep– same as (requires p; ensures r) in VCC
Law of consequence
Frame laws
Part 4Denotational Models
A model is a mathematical structure that satisfies the axioms of an algebra, and realistically describes a useful application, for example, program execution.
Modelsdenotational models
algebraic laws
Some Standard Models:
• Boolean algebra( {0,1}, ≤, , , (1 - _) )
• predicate algebra (Frege, Heyting)– (ℙS,├, , , (S - _), => , ∃, ∀)
• regular expressions (Kleene):– (ℙA*, ⊆, ∪, ; , ɛ , {<a>} , | )
• binary relations (Tarski):– (ℙ(SS), ⊆, ∪, ∩, ; , Id , not(_), converse(_))
• algebra of designs is a superset of these
Model: (EV, EX, PR)
• EV is an underlying set of events (x, y, ..) that can occur in any execution of any program
• EX are executions (e, f,…), modelled as sets of events
• PR are designs (p, q, r,…), modelled as sets of executions.
Set concepts
• ⊑ is (set inclusion)• ⊔ is (set union) • ⊓ is (intersection of sets)• is { } (the empty set)• ⊤ is EV (the universal set)
With (|)
• p | q = {e ∪ f | e ε p & f ε q & e∩f = { } }
– each execution of p|q is the disjoint union of an execution of p and an execution of q
– p|q contains all such disjoint unions• | generalises many binary operators
Introducing time
• TIM is a set of times for events– partially ordered by ≤
•Let when : EV -> TIM – map each event to its time of occurrence.
Definition of <
•x < y =def not(when(y) ≤ when(x))– x < y & y < x means that x and y occur ‘in
true concurrency’.• e < f =def ∀x,y . x∊e & y∊f => x < y– no event of f occurs before an event of e– hence e<f implies ef = { }
•If ≤ is a total order, – there is no concurrency, – executions are time-ordered strings
Sequential composition (then)
• p ; q = {ef | e∊p & f∊q & e<f}
• special case: if ≤ is a total order, – e < f means that ef is concatenation
(e⋅f) of strings– ; is the composition of regular
expressions
Theorems
• These definitions of ; and | satisfy the locality and exchange laws.
•(s|p) ; q ⊑ s |(p;q)•(p|q) ; (p’|q’) ⊑ (p;p’) | (q;q’)– Proof: the lhs describes fewer
interleavings than the rhs.
• special case: regular expressions satisfy all our laws for ⊑ , ⊔ , ; , and |
Disjoint concurrency (||)
• p||q =def (p ; q) (q ; p)– all events of p concurrent with all of q .– no interaction is possible between them.
• Theorems: (p||q) ; r p || (q ; r) (p||q) ; (p’||q’) (p;p’) || (q;q’)
– Proof: the rhs has more disjointness constraints than the lhs .
– the wrong way round!• So make the programmer responsible for
disjointness, using interfaces!
Interfaces
• Let q be the body of a subroutine• Let s be its specification• Let (q .. s) assert that q is correct • Caller may assume s• Implementer may execute q
Solution
• p*q =def (p|q .. p||q) = p|q if p|q ⊑ p||q ⊤ otherwise
– programmer is responsible for absence of interaction between p and q .
• Theorem: ; and * satisfy locality and exchange.– Proof: in cases where lhs ≠ rhs, rhs = ⊤
Problem
• ; is almost useless in the presence of arbitrary interleaving (interference).
• It is hard to prove disjointness of p||q• We need a more complex model– which constrains the places at which a
program may make changes.
Separation
• PL is the set of places at which an event can occur
• each place is ‘owned’ by one thread,– no other thread can act there.
• Let where:EV -> PL map each event to its place of occurrence.
• where(e) =def {where(x) | x ∊ e }
Separation principle
• events at different places are concurrent
• events at the same place are totally ordered in time
• ∀x,y ∊ EV . where(x) = where(y) iff x≤y or y≤x
Picture
time
space
Theorem
• p || q = {ef | e ∊ p & f ∊ q& where(e) where(f) = { }
}• proved from separation principle
Convexity Principle
• Each execution contains every event that occurs between any of its events.
• ∀e ∊ EX , y ∊ EV. ∀x, z ∊ e .when(x) ≤ when(y) ≤ when(z) => y ∊ e – no event from elsewhere can interfere
between any two events of an execution
A convex execution of p;q
time
space
p q
A non-convex ‘execution’ of p;q
time
space
p q
Conclusion:in Praise of Algebra
• Reusable• Modular• Incremental• Unifying
• Discriminative• Computational• Comprehensible• Abstract
• Beautiful!
Algebra likes pairs
• Algebra chooses as primitives– operators with two operands + , – predicates with two places = , – laws with two operators & v , + – algebras with two components rings
Tuples
• Tuples are defined in terms of pairs.– Hoare triples– Plotkin triples– Jones quintuples – seventeentuples …
Semantic Links
deductions transitions
denotations
algebra
Increments
algebra
Filling the gaps
algebra