Volume III: Progress

Temporal Verification of Reactive Systems: Safety

Info iconThis preview shows pages 1–4. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: CS256/Winter 2007 — Lecture #16 Zohar Manna Announcements: • Last homework will be assigned on Thursday. References for further reading: • Volume III of Manna & Pnueli, Chapter 1 • Zohar Manna and Amir Pnueli. “Completing the Temporal Picture.” In Theoretical Computer Science Journal , 83(1), 1991, pp. 97–130. References are available from Zohar Manna’s web page, http://theory.stanford.edu/ ∼ zm/ ; look at the class web site for a link to the initial chapters of Volume III. 16-1 Volume III Progress Progress properties: Temporal logic plays a more prominent role and fairness becomes important. Property hierarchy: 16-2 Response under Justice (Chapter 1) Progress Properties We will consider deductive methods to prove response properties (which are also applicable to obligation and guarantee properties since these are subclasses) Response properties are those properties that can be expressed by a formula of the formula of the form 0 1 p for a past formula p . 16-3 Response formulas The verification rules presented assume that the response property is expressed by a response formula p ⇒ 1 q for past formulas p and q . Note: • Response formula expresses a response property because of the equivalence p ⇒ 1 q ∼ 0 1 (( ¬ p ) B q ) • Every response property can be expressed by a response formula due to the equivalence 0 1 q ∼ t ⇒ 1 q 16-4 Overview We consider the simple case where p , q are assertions. The proof of a response property p ⇒ 1 q often relies on the identification of one or more so-called helpful transitions . We consider three cases: 1. Rule resp-j (single-step response under justice) A single helpful transition τ h suffices to establish the property p q τ h 16-5 Overview (Cont’d) 2. Rule chain-j (chain rule under justice) A fixed number of helpful transitions (independent of the value of variables) suffices to establish the property τ h n τ h n- 1 q τ h 1 p ϕ n- 1 ϕ 1 16-6 Overview (Cont’d) 3. Rule well-j (well-founded response under justice) The number of helpful transitions required to estab- lish the property is unbounded q p 16-7 Overview (Cont’d) In all cases we will be able to use verification diagrams to represent the proof. In practice, verification diagrams are often the preferred way to prove progress properties, because they represent the temporal structure of the program relative to the property. 16-8 Single-step rule (Motivation) p ⇒ 1 q ϕ En ( τ h ) q τ h p Justice requirement: it is not the case that a just transi- tion is continuously enabled but never taken. 16-9 Single-step rule For assertions p , q , ϕ , and helpful transition τ h ∈ J , J1. p → q ∨ ϕ J2. { ϕ } T { q ∨ ϕ } J3. { ϕ } τ h { q } J4. ϕ → En ( τ h ) p ⇒ 1 q Premise J2 requires all transitions to preserve ϕ (or es- tablish q , in which case we are done)....
View Full Document

Page1 / 12

Volume III: Progress - CS256/Winter 2007 — Lecture #16...

This preview shows document pages 1 - 4. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online