*This preview shows
pages
1–11. Sign up
to
view the full content.*

This
** preview**
has intentionally

**sections.**

*blurred***to view the full version.**

*Sign up*This
** preview**
has intentionally

**sections.**

*blurred***to view the full version.**

*Sign up*This
** preview**
has intentionally

**sections.**

*blurred***to view the full version.**

*Sign up*This
** preview**
has intentionally

**sections.**

*blurred***to view the full version.**

*Sign up*This
** preview**
has intentionally

**sections.**

*blurred***to view the full version.**

*Sign up*
**Unformatted text preview: **CS256/Winter 2007 — Lecture #16 Zohar Manna Announcements: • Last homework will be assigned on Thursday. References for further reading: • Volume III of Manna & Pnueli, Chapter 1 • Zohar Manna and Amir Pnueli. “Completing the Temporal Picture.” In Theoretical Computer Science Journal , 83(1), 1991, pp. 97–130. References are available from Zohar Manna’s web page, http://theory.stanford.edu/ ∼ zm/ ; look at the class web site for a link to the initial chapters of Volume III. 16-1 Volume III Progress Progress properties: Temporal logic plays a more prominent role and fairness becomes important. Property hierarchy: 16-2 Response under Justice (Chapter 1) Progress Properties We will consider deductive methods to prove response properties (which are also applicable to obligation and guarantee properties since these are subclasses) Response properties are those properties that can be expressed by a formula of the formula of the form 0 1 p for a past formula p . 16-3 Response formulas The verification rules presented assume that the response property is expressed by a response formula p ⇒ 1 q for past formulas p and q . Note: • Response formula expresses a response property because of the equivalence p ⇒ 1 q ∼ 0 1 (( ¬ p ) B q ) • Every response property can be expressed by a response formula due to the equivalence 0 1 q ∼ t ⇒ 1 q 16-4 Overview We consider the simple case where p , q are assertions. The proof of a response property p ⇒ 1 q often relies on the identification of one or more so-called helpful transitions . We consider three cases: 1. Rule resp-j (single-step response under justice) A single helpful transition τ h suffices to establish the property p q τ h 16-5 Overview (Cont’d) 2. Rule chain-j (chain rule under justice) A fixed number of helpful transitions (independent of the value of variables) suffices to establish the property τ h n τ h n- 1 q τ h 1 p ϕ n- 1 ϕ 1 16-6 Overview (Cont’d) 3. Rule well-j (well-founded response under justice) The number of helpful transitions required to estab- lish the property is unbounded q p 16-7 Overview (Cont’d) In all cases we will be able to use verification diagrams to represent the proof. In practice, verification diagrams are often the preferred way to prove progress properties, because they represent the temporal structure of the program relative to the property. 16-8 Single-step rule (Motivation) p ⇒ 1 q ϕ En ( τ h ) q τ h p Justice requirement: it is not the case that a just transi- tion is continuously enabled but never taken. 16-9 Single-step rule For assertions p , q , ϕ , and helpful transition τ h ∈ J , J1. p → q ∨ ϕ J2. { ϕ } T { q ∨ ϕ } J3. { ϕ } τ h { q } J4. ϕ → En ( τ h ) p ⇒ 1 q Premise J2 requires all transitions to preserve ϕ (or es- tablish q , in which case we are done)....

View
Full
Document