The report presents a decision procedure for assertions in an extension of the mu-calculus about finite-control pi-calculus agents. The procedure is based on the classical cut-free sequent calculus and associated techniques of automatic theorem proving

Franzén, Torkel

English

Digitala Vetenskapliga Arkivet - Academic Archive On-line

A theorem-proving approach to deciding properties of finite control agents

RISE – Research Institutes of Sweden

Software institutes' Online Digital Archive

1A theorem-proving approach to deciding
properties of finite-control agents
Extended abstract
Torkel Franzen
Swedish Institute of Computer Science
Box 1263
S-164 28 Kista
Sweden
1 Introduction
In an effort to make this abstract more readable, the subject matter, the
work done and the tentative conclusions drawn will first be presented in
informal or semi-formal terms, in sections 1-3. The essentials of the formal
details are then given in sections 4-8.
This report is concerned with deciding the validity of sequents of the form
(1)                         c -A:φ
where c is a conjunction of equalities and inequalities between names, A is a
finite control Π-calculus agent, and φ is an extended µ-calculus assertion
about A. These notions will be formally defined below. For the moment we
just note that A is a description of a more or less complicated system of
communicating processes, for which we have a formally defined notion of
how it can change and evolve through acts of communication, including
the passing around of communication channels (names), and that φ is a
more or less complex assertion about the behavior of this system, e.g. that
nothing bad can happen in the future (such as deadlock or loss or jumbling
of data) or that something good is bound to happen eventually (such as the
orderly emission of input data). That a sequent of the form (1) is valid
2means that for any decision about which names are and which are not equal
that conforms to the condition c, A has the property expressed by φ.
As established in [1], for finite control agents A, there are essentially only
finitely many agents and names that can appear in the course of a series of
transitions from A, and the validity of (1) can be mechanically decided, at
least in principle, through an exhaustive search procedure. Here we will
present one possible route to making this decidability more of a practical
proposition. Of course we shouldn't expect too much, in view of the
computational complexity of the problem of deciding sequents of the form
(1). Whatever the inherent complexity of this problem may be, we can be
pretty confident from experience and general reflection that no even
remotely efficient general decision procedure is to be expected.
 2 The approach
It is a fairly obvious approach, since φ is a logical formula, to make use of
known logical inference systems to devise a system of rules for proving
assertions of the form (1), and apply an automatic theorem proving
technique to decide the validity of such assertions. Thus the tableau system
of [2], from which an automatic model checker for finite-state CCS agents has
been derived. When we consider the more complicated case of sequents of
the form (1), some further technical problems arise, which is why the
algorithm given in [1] proceeds by brute computation rather than by
symbolic reasoning. The contribution of the work presented here consists in
extending the automatic theorem-proving approach to this case.
The logical formalism on which the inference system is based is that of the
classical cut-free sequent calculus. This means that we extend the class of
sequents to those of the form
(2)                         c - Γ
where Γ is a finite sequence, interpreted as a disjunction, of assertions of the
form A:φ. That we have no cut rule entails that the system has the
subformula property, i.e. the formulas φ occurring in the premisses of a rule
are subformulas of the formulas occurring in the conclusion. This in turn
means that there is an obvious mechanical bottom-up procedure in which
3one looks for a proof of a sequent by constructing and trying to prove
premisses from which the sequent follows by one of the rules. Improving
the efficiency of such a procedure, particularly by finding and eliminating
unnecessary backtracking and dead ends, characterizes much work on
automatic theorem proving in such systems. This is in contrast to
approaches based on trying to make intelligent guesses or combinations.
The rules of the system fall naturally into four classes: logical rules, agent
rules, fixpoint rules, and structural rules. In the formulations given here,
the rules have been brought fairly close to the implementation, but they
should be easily understandable once one has grasped the semantics of the
Π-calculus and the µ-calculus (as presented e.g. in [1]).
The decision procedure requires a rather lengthy explanation if it is to be
given in full. Below only the essentials will be presented. To arrive at a basic
algorithm (lacking optimizations) two basic problems must be solved: how
to handle existential quantification in a bottom-up procedure, and how to
ensure termination. The first of these problems is handled using methods
adapted from [3], which involve the introduction of metalogical variables
(taking names as values) and a suspension mechanism. The second problem
concerns the fixpoint rules and the rule for using existential formulas. Since
the underlying logic is classical, the latter rule requires contraction, i.e. the
existential formula must sometimes occur not only in the conclusion but as
part of the disjunction in the premiss, which means that a bottom-up
procedure may loop. The fixpoint rules involve folding and unfolding of
fixpoint formulas, and hence yield potential loops in the procedure. The
contraction loops can be handled rather simply, but the checking for loops in
the fixpoint rules requires a lot of syntactic examination and comparison, as
well as checking logical relations between name conditions.
 
3 Performance and prospects
A basic version of the algorithm has been implemented in SICStus Prolog
and tested on a set of examples on a Sparc 5 workstation. The results give, I
think, a pretty good idea of what can be expected from this approach. The
algoritm handles small examples well. To give an idea of the sort of
formulas used, consider the example below.
4(max L).(all([co(o)]).sigma(z).L and [tau].L and
all([i]).all(z).(L and (max O.[x]).((min
M.[v]).(some({co(o)}).sigma(w).(w=v or M.[v]) or <tau>.M.[v]
or some({i}).some(w).(w#v and M.[v])).[x] and
all([i]).all(w).O.[x] and all([co(o)]).sigma(w).(w=x or
O.[x]) and [tau].O.[x]).[z]))
This is a fairly complicated formula (concocted by Joachim Parrow). What
it says is that a certain property L holds invariantly, i.e. throughout all
possible transitions of the agent at issue, and furthermore, whenever a
value a is input to the agent, a condition which we may designate
notlost(a) holds for this value. The meaning of notlost(a) is that
throughout the future evolution of the agent, as long as a has not been
output, a condition possreach(a) will hold. This condition possreach(a)
in turn states that there is some possible sequence of transitions leading to a
being output without previously having been input. Thus the meaning of L
is that in a certain weak sense, no input is ever lost: as long as an input has
not been output, there is always a possible future sequence of transitions
leading to it being output.
Now, testing for this property works well with small recursively defined
agents, such as a 3-element buffer with around 30 states. (It also works well
with non-recursive agents having around 100 states.) That is, the property is
checked for within a time span of 1-15 seconds, which is bearable. But when
we come to more complicated recursive agents, having around 100 states,
the performance of the algorithm is unacceptable.
So the algorithm is satisfactory in being able to handle complicated
properties, albeit only for simple agents. But the difficulties experienced by
the algorithm in attacking complicated properties for bigger agents are not
compensated for by any ease of handling simple properties of bigger agents.
For the very general procedure of the algorithm, when set e.g. merely to
traverse every state of a big recursive agent, entails a lot of overhead. Thus
for example checking big agents for deadlocks using the general algorithm is
very inefficient.
Of course the above comments are based on a vanilla version of the
algorithm, and there are many more or less obvious optimizations. If we
consider how and why the algorithm as sketched below has an edge over
brute search, there are just two main points: laziness and clumping together
5of cases. (The laziness derives from the suspension mechanism, the
clumping together from the symbolic treatment of universal quantification.)
By various methods, such as basing the logical part of the algorithm on a
static analysis of the agent to be investigated, the performance of the
algorithm can be expected to improve considerably. However, the following
conclusions seem fairly safe. The algorithm in its full generality can not be
expected to be practically useful in any industrial sense. It can however be
developed into an attractive pedagogical and experimental tool for gaining
familiarity with the Π and µ-calculi, and for testing ideas on small examples.
Possibly, stripped-down or specialized versions of the algorithm can be
devised that can be useful in the verification of specific properties of large
systems, but this remains to be decided.
4 Agents
We presuppose an infinite set of names x,y,.. each with its coname co(x),
co(y),.... An action α,β,.. is either a name or a coname or the silent action τ.
If α is a coname co(x), n(α) is x, otherwise n(α) is α. 
Recursive actions and formulas are implemented as infinite (rational)
trees, and at least the agents may as well be defined as such from the outset.
An agent is either a process, an abstraction, or a concretion. To define
these classes, we consider the class of rational trees with nodes annotated
with 0 (no successor) or + or | (two successors) or cond([x=y]) (two successors)
or one of (λx), (νx), [x], α. for some name x or action α (one successor), and
invoke an inductive definition given by the following clauses:
a process is 0, or P+Q, or P|Q, or (νx)P, where P and Q are processes, or α.A
where A is an agent;
an abstraction is (λx)A, where A is a process or an abstraction;
a concretion is [x]A, where A is a process or a concretion;
and finally cond(x=y,A,B) is an agent of the same type as A and B,
provided A and B have the same type.
6These clauses are to be understood as defining the maximal fixpoint of
the corresponding monotone operator (details omitted). Thus e.g. C is a
process if C=u.(C|C).
The set of free names occurring in an agent is defined in the obvious way,
given that the name-binding constructs are (λx) and (νx). For technical
reasons, we restrict the set of agents further, stipulating that an agent C
occurs in (i.e. as a proper subtree of) itself only within the scope of an event,
i.e. as a proper or improper subtree of A, where α.A occurs in C.
We will use a syntactic equivalence relation between agents which is a
kind of remnant of the ordinary Π-calculus congruence relation: A and B are
syntactically equivalent if A is obtainable from B by the operations of alpha-
conversion and the replacing of (νx)C by C, where x does not occur free in C.
The result B[y/x] of substituting y for every free occurrence of x in the
agent B is defined in the obvious way, with alpha-conversion used if
necessary.
If A is an abstraction (λx)B, the application Ay of A to y is defined as B[y/x].
Application is not defined for an A that is not an abstraction.
5 The commitment relation
The commitment relation A>cα.B is defined using the same rules as in [1],
with some minor adjustments. These adjustments, which have been made
to allow us to make the corresponding formal rules very specific,  can be
described as follows.
We first define A>α.B for the case where α is not τ. This is done in the
standard way, and does not involve c.
Next we define A>Uτ.B, where U is a set which is either empty (in which
case we also write A>τ.B) or contains exactly two syntactically different
names x,y. This relation is again specified in the ordinary way (with the
argument U just being carried along), except for the following rule (and its
trivial variants):
7                             A1>x.B1     A2>co(y).B2
                             ________________
                              A1 | A2 >{x,y}τ.(B1.B2)
Here x,y are two syntactically different names, and (B1.B2) is as usual the
pseudo-application of B1 to B2.
Finally we define  A>cα.B to hold if either A>α.B or A>{x,y}α.B where
c=x=y.
6 Formulas
Formulas, also implemented as rational trees, are more easily described as
finite trees. We presuppose an infinite supply of set variables X,Y..., each
with a specific arity. A preformula is either
a literal x=y or x≠y, where x and y are names, or
an application app(X,x), where X is an n-place set variable and x a sequence
of n names,  or
a conjunction (φ&ϕ) or disjunction (φ∨ϕ), or
a universal or existential quantification ∀xφ or ∃xφ, or
a projection Σxφ, or
a fixpoint formula (max X)φ or (min X)φ.
A formula is now defined as a preformula in which every set variable X
occurs in within the scope of a binding operator (max X) or (min X).
The name-binding constructs are here the logical quantifiers and Σx.
87 Rules
The inference rules fall into four groups: logical rules, agent rules, fixpoint
rules, and structural rules.
Logical rules
Axioms
c -A:φ,Γ        if c - φ, where φ is a literal.
=-rules
 x≠y ∧ c - Γ
_ _ _ _ _ _ _ _
c  - A:x=y,Γ
 x=y ∧ c - Γ
_ _ _ _ _ _ _ _
c  - A:x≠y,Γ
∨-rule
c - A:φ1,A:φ2,Γ
_ _ _ _ _ _ _ _ _ _
c - A:φ1∨φ2,Γ
&-rule
c - A:φ1,Γ     c - A:φ2,Γ
____________________
       c - A:φ1&φ2,Γ
9∀-rule
 c - Aw:φ[w/x],Γ
_______________
     c - A:∀xφ,Γ
where w is new, i.e. does not occur in c, A, φ, Γ.
∃-rule 
c - Aw:φ[w/x],[A:∃xφ],Γ
_____________________
            c - A:∃xφ,Γ
where the brackets around [A:∃xφ] indicate that this expression is optional.
cond-rules
                   c -A:φ,Γ  
       _________________                if c = x=y
         c -cond(x=y,A,B):φ,Γ
                  c -B:φ,Γ  
       _________________                if c = x≠y
         c -cond(x=y,A,B):φ,Γ
            c∧x=y -A:φ,Γ         c∧x≠y -B:φ,Γ 
            ___________________________               if c does not decide x=y
                c -cond(x=y,A,B):φ,Γ
10
Agent rules
Σ-rules
 c - A:φ[x/y],Γ
_____________
c - [x]A:(Σy)φ,Γ
c∧∧w≠z for all old z - A[w/x]:φ[w/y],Γ
___________________________________
                  c - (νx)[x]A:(Σy)φ,Γ
where "old z" means a name z that occurs in c,A,φ,Γ.
diamond rule
       c -B:φ,Γ
  ____________
    c -A:<α>φ,Γ
where either α is not τ, A>β.B and c = α=β, or α and β are τ and A>cτ.B.
square rule
   c' -B:φ,Γ   for all c',B satisfying the conditions below
__________________________________________________
                                c -A:[α]φ,Γ
Here, if α is not τ, c' is consistent, α and β are both names or both co-
names, c' is c∧n(α)=n(β) and A>β.B or c' is c and A>α.B.  If α is τ, c' is
consistent and c' is c∧x=y where A>{x,y}τ.B or c' is c and A>τ.B.
11
Fixpoint rules
For the fixpoint rules, we follow [2] and introduce a sequence U1,U2,.. of
special constants to keep track of fixpoints. Each special contant occurring in
a proof is associated with a fixpoint formula as indicated below. This
association has been left out of the notation.
Unfold
 c -A:app(U,x),Γ
_______________
   c -A:(m X)φ,Γ
where U is a special constant associated with the fixpoint formula in the
conclusion, and x is the sequence of names that occur free in φ.
Fold
        c -A:φ[w/y,U/X],Γ
   _____________________
        c -A:app(U,w),Γ
where U is associated with (m X)φ(X). Here, if m is max, we are allowed to
discharge any assumption above this conclusion of the form
c' -A:app(U,w),Γ',Γ.
Structural rules
Thinning
     c - Γ
_________________
   c -A:φ,Γ
12
Equivalence
 c -A:φ,Γ
________
 c -A:φ,Γ
if A and A' are syntactically equivalent
Names
 c' - Γ
______
 c - Γ
if ∃zc' is equivalent, in the infinite set of names, to ∃zc, where z are the
variables in c,c' that do not occur in Γ.
8 The algorithm
The algorithm is, as stated, a bottom-up procedure whereby we start with
the sequent whose validity is to be decided and apply the rules from
conclusion to premisses, looking for a proof. In dealing with the quantifier
rules, the same method is used as in [3]. That is to say, in applying the ∀-rule
to the conclusion c - A:∀xφ,Γ, we introduce a new name x(i), called a
parameter, and attempt to prove the premiss c - Ax(i):φ[x(i)/x],Γ. The
parameter is annotated with an index i which is incremented after each
application of the rule. In applying the ∃-rule to the conclusion  c - A:∃xφ,Γ ,
we introduce a variable X(i), annotated with the current index. At various
points we attempt to unify this variable with a name in such a way as to
obtain a proof. To ensure that the unification respects the restriction on the
name used in the ∀-rule, X(i) can be unified with a parameter x(j) only if i>j.
The other mechanism taken over from [3] is that of suspension. This
mechanism is invoked in two situations. First, in trying to prove a sequent
c - X≠Y,Γ where at least one of X,Y is an unbound variable (i.e. one that
has not been unified with a name). In this case we simply suspend the
sequent and go on with the next sequent, if any, that has to be proved.
13
Second,  when trying to prove  c -A:[X]φ,Γ or c -A:[τ]φ,Γ, certain premisses
may be suspended. Thus e.g. in the case of the first sequent, if X is a name or
an unbound variable, any A>Y.A', where the value of at least one of X,Y is a
variable, and the values of X and Y are not the same variable, yields a
suspended sequent. Suspended sequents are awakened whenever a variable
that has justified the suspension becomes bound in a call to the unification
algorithm. If no proof of the suspended sequents can be found, the
unification will fail.
Looping is avoided in the algorithm through two mechanisms. First,
contraction is applied whenever an existential formula is encountered (that
is, the formula is duplicated in the premiss sequent), but the duplicate will
be used in the continued search for a proof only if new information has
appeared on the left hand side of the sequent (in the form of equations or
inequations) since the duplication was made. Otherwise that branch of the
attempted proof fails. Second, a record is kept of all applications of the
fixpoint rules. When the fold rule is applied (from conclusion to premiss)
with the same maximal fixpoint formula and an "essentially identical"
agent, the branch succeeds. Here "essentially identical" is a somewhat
weaker relation than syntactical equivalence. In the case of minimal
fixpoints, a more involved comparison is needed, by which it is established
that if a minimal fixpoint problem is reduced to one that is at least as general
as the original, no proof exists.
References
[1] M. Dam. "Model Checking Mobile Processes". SICS Research Report
R94:01. Preliminary version published as "Model Checking Mobile
Processes", Lecture Notes in Computer Science 715 (1993) pp. 22-36.
[2] C. Stirling and D. Walker. "Local model checking in the modal mu-
calculus." Theoretical COmputer Science, 89:161-177, 1991.
[3] Dan Sahlin, Torkel Franzén, Seif Haridi. "An Intuitionistic Predicate
Logic Theorem Prover." J. Logic Computat., Vol. 2 No. 5, pp. 619-656 1992.


Swedish Institute of Computer Science Publications Database

Local model checking in the modal mucalculus.&quot;

Model Checking Mobile Processes&quot;. SICS Research Report R94:01. Preliminary version published as &quot;Model Checking Mobile Processes&quot;,

Torkel Franzén, Seif Haridi. &quot;An Intuitionistic Predicate Logic Theorem Prover.&quot;

http://soda.swedish-ict.se/2232/1/SICS-T--96-02--SE.ps.Z

A theorem-proving approach to deciding properties of finite control agents

Abstract

Similar works

Full text

Available Versions

Digitala Vetenskapliga Arkivet - Academic Archive On-line

RISE – Research Institutes of Sweden

Software institutes' Online Digital Archive

Swedish Institute of Computer Science Publications Database