27,601 research outputs found
A synchronous program algebra: a basis for reasoning about shared-memory and event-based concurrency
This research started with an algebra for reasoning about rely/guarantee
concurrency for a shared memory model. The approach taken led to a more
abstract algebra of atomic steps, in which atomic steps synchronise (rather
than interleave) when composed in parallel. The algebra of rely/guarantee
concurrency then becomes an instantiation of the more abstract algebra. Many of
the core properties needed for rely/guarantee reasoning can be shown to hold in
the abstract algebra where their proofs are simpler and hence allow a higher
degree of automation. The algebra has been encoded in Isabelle/HOL to provide a
basis for tool support for program verification.
In rely/guarantee concurrency, programs are specified to guarantee certain
behaviours until assumptions about the behaviour of their environment are
violated. When assumptions are violated, program behaviour is unconstrained
(aborting), and guarantees need no longer hold. To support these guarantees a
second synchronous operator, weak conjunction, was introduced: both processes
in a weak conjunction must agree to take each atomic step, unless one aborts in
which case the whole aborts. In developing the laws for parallel and weak
conjunction we found many properties were shared by the operators and that the
proofs of many laws were essentially the same. This insight led to the idea of
generalising synchronisation to an abstract operator with only the axioms that
are shared by the parallel and weak conjunction operator, so that those two
operators can be viewed as instantiations of the abstract synchronisation
operator. The main differences between parallel and weak conjunction are how
they combine individual atomic steps; that is left open in the axioms for the
abstract operator.Comment: Extended version of a Formal Methods 2016 paper, "An algebra of
synchronous atomic steps
A synchronous program algebra: a basis for reasoning about shared-memory and event-based concurrency
This research started with an algebra for reasoning about rely/guarantee
concurrency for a shared memory model. The approach taken led to a more
abstract algebra of atomic steps, in which atomic steps synchronise (rather
than interleave) when composed in parallel. The algebra of rely/guarantee
concurrency then becomes an instantiation of the more abstract algebra. Many of
the core properties needed for rely/guarantee reasoning can be shown to hold in
the abstract algebra where their proofs are simpler and hence allow a higher
degree of automation. The algebra has been encoded in Isabelle/HOL to provide a
basis for tool support for program verification.
In rely/guarantee concurrency, programs are specified to guarantee certain
behaviours until assumptions about the behaviour of their environment are
violated. When assumptions are violated, program behaviour is unconstrained
(aborting), and guarantees need no longer hold. To support these guarantees a
second synchronous operator, weak conjunction, was introduced: both processes
in a weak conjunction must agree to take each atomic step, unless one aborts in
which case the whole aborts. In developing the laws for parallel and weak
conjunction we found many properties were shared by the operators and that the
proofs of many laws were essentially the same. This insight led to the idea of
generalising synchronisation to an abstract operator with only the axioms that
are shared by the parallel and weak conjunction operator, so that those two
operators can be viewed as instantiations of the abstract synchronisation
operator. The main differences between parallel and weak conjunction are how
they combine individual atomic steps; that is left open in the axioms for the
abstract operator.Comment: Extended version of a Formal Methods 2016 paper, "An algebra of
synchronous atomic steps
An Algebra of Synchronous Scheduling Interfaces
In this paper we propose an algebra of synchronous scheduling interfaces
which combines the expressiveness of Boolean algebra for logical and functional
behaviour with the min-max-plus arithmetic for quantifying the non-functional
aspects of synchronous interfaces. The interface theory arises from a
realisability interpretation of intuitionistic modal logic (also known as
Curry-Howard-Isomorphism or propositions-as-types principle). The resulting
algebra of interface types aims to provide a general setting for specifying
type-directed and compositional analyses of worst-case scheduling bounds. It
covers synchronous control flow under concurrent, multi-processing or
multi-threading execution and permits precise statements about exactness and
coverage of the analyses supporting a variety of abstractions. The paper
illustrates the expressiveness of the algebra by way of some examples taken
from network flow problems, shortest-path, task scheduling and worst-case
reaction times in synchronous programming.Comment: In Proceedings FIT 2010, arXiv:1101.426
Feasible reactivity in a synchronous pi-calculus
Reactivity is an essential property of a synchronous program. Informally, it
guarantees that at each instant the program fed with an input will `react'
producing an output. In the present work, we consider a refined property that
we call ` feasible reactivity'. Beyond reactivity, this property guarantees
that at each instant both the size of the program and its reaction time are
bounded by a polynomial in the size of the parameters at the beginning of the
computation and the size of the largest input. We propose a method to annotate
programs and we develop related static analysis techniques that guarantee
feasible reactivity for programs expressed in the S-pi-calculus. The latter is
a synchronous version of the pi-calculus based on the SL synchronous
programming model
Verifying the Safety of a Flight-Critical System
This paper describes our work on demonstrating verification technologies on a
flight-critical system of realistic functionality, size, and complexity. Our
work targeted a commercial aircraft control system named Transport Class Model
(TCM), and involved several stages: formalizing and disambiguating requirements
in collaboration with do- main experts; processing models for their use by
formal verification tools; applying compositional techniques at the
architectural and component level to scale verification. Performed in the
context of a major NASA milestone, this study of formal verification in
practice is one of the most challenging that our group has performed, and it
took several person months to complete it. This paper describes the methodology
that we followed and the lessons that we learned.Comment: 17 pages, 5 figure
Network algebra for synchronous dataflow
We develop an algebraic theory of synchronous dataflow networks. First, a
basic algebraic theory of networks, called BNA (Basic Network Algebra), is
introduced. This theory captures the basic algebraic properties of networks.
For synchronous dataflow networks, it is subsequently extended with additional
constants for the branching connections that occur between the cells of
synchronous dataflow networks and axioms for these additional constants. We
also give two models of the resulting theory, the one based on stream
transformers and the other based on processes as considered in process algebra.Comment: 24 page
Reactive concurrent programming revisited
In this note we revisit the so-called reactive programming style, which
evolves from the synchronous programming model of the Esterel language by
weakening the assumption that the absence of an event can be detected
instantaneously. We review some research directions that have been explored
since the emergence of the reactive model ten years ago. We shall also outline
some questions that remain to be investigated
A Static Analyzer for Large Safety-Critical Software
We show that abstract interpretation-based static program analysis can be
made efficient and precise enough to formally verify a class of properties for
a family of large programs with few or no false alarms. This is achieved by
refinement of a general purpose static analyzer and later adaptation to
particular programs of the family by the end-user through parametrization. This
is applied to the proof of soundness of data manipulation operations at the
machine level for periodic synchronous safety critical embedded software. The
main novelties are the design principle of static analyzers by refinement and
adaptation through parametrization, the symbolic manipulation of expressions to
improve the precision of abstract transfer functions, the octagon, ellipsoid,
and decision tree abstract domains, all with sound handling of rounding errors
in floating point computations, widening strategies (with thresholds, delayed)
and the automatic determination of the parameters (parametrized packing)
- …