4.2 Interactive Verification of SGAs for LTL
4.2.3 Basic Rules
More complex rules, which are already defined in Section 4.1, are usable too: Definition 27 (AllCases).
{(Gt {(enter((G, L)) ⇒ assume. (x)=τ)},L) |= ϕ | τ ∈ Values(x)} (G, L) |= ϕW AllCases(x)
Instead of proving a single proof goal representing all possible values of a variablex. One may prove several proof goals each representing one of the possible values of x.
Definition 28 (Cases).
check(V
i=0...nσi) = 1
{(Gt {(enter((G, L)) ⇒ assume. (x)=σi)}, L) |= ϕ | i ∈ {0 . . . n}}
(G, L) |= ϕW Cases([σ0, . . . , σn])
Instead of proving a single proof goal representing all possible values of a variablex. One may prove several proof goals each representing possible values of x.
Substitution of Variables
The given guarded actions are equations that can be used for rewriting: (true ⇒x = τ) ∈ G ∧ (G,L) |= [ϕ]xτ
(G, L) |= ϕW ReWrite(x)
Another possibility is the introduction of an equation in the assumption to define the relation between a variable and its behavior:
(true ⇒x = τ) ∈ G ∧ (G,L) |= x = τ → ϕ (G, L) |= ϕW DefOf(x)
4.2 Interactive Verification of SGAs for LTL 85
Unrolling of Temporal Operators
In the literature, like [Schn03], some recursion laws for the until operators are given: [ψ U γ] = γ ∨ ψ ∧ X [ψ U γ] [ψ Uγ] = γ ∨ ψ ∧ X [ψ U γ]
[ψ←−U γ] = γ ∨ ψ ∧←X [ψ− ←U γ]− [ψ←U γ] = γ ∨ ψ ∧− ←X [ψ− ←U γ]−
These rules transform the specification into a part that must be satisfied in the current state and a part containing further temporal operators. The advantage is that using these rules and the decomposition rules it is possible to decompose a proof goal to Boolean goals. Following this, we define the following rules:
Definition 29 (Unrolling Specifications). Given a proof goal (G, L) |= ϕ, the rules to unroll a specification are defined as:
(G, L) |= γ ∨ ψ ∧ X [ψ U γ] (G, L) |= [ψ U γ]W NextWUntil() (G, L) |= γ ∨ ψ ∧ X [ψ U γ] (G, L) |= [ψ U γ]W NextSUntil() (G, L) |= γ ∨ ψ ∧←X [ψ− ←U γ]− (G, L) |= [ψ←U γ] W NextPWUntil()− (G, L) |= γ ∨ ψ ∧←X [ψ− ←U γ]− (G, L) |= [ψ←U γ] W NextPSUntil()− (G, L) |= ¬γ ∧ ψ ∨←X [ψ− ←B γ]− (G, L) |= [ψ←B γ] W NextPWBefore()− (G, L) |= ¬γ ∧ ψ ∨←X [ψ− ←B γ]− (G, L) |= [ψ←−B γ] W NextPSBefore()
Hence, unrolling E |= G(ϕ) leads to E |= ϕ ∧ XG(ϕ), and for E |= Fϕ the result is E |= ϕ ∨ XF(ϕ). Obviously, the generated proof goal for the F-operator is satisfiable either by showing that ϕ holds in the current step or XFϕ holds in the current step, which means that the next step satisfies Fϕ.
Correctness
The correctness of the rewriting and unrolling rules for LTL specifications are easily provable by the Quartz module given in Figure 4.11 (seewww.Averest.org/examples/Verification/ TheoremProving/LTL), where Aϕ is the original specification and Aψ the result of the rule application.
86 4 Interactive Verification based on an Intermediate Representation
module CheckLTLFacts (bool a,b,c,d,...) {
nothing;
} satisfies {
spec : assert A (ϕ ↔ ψ) }
Fig. 4.11: Module to Verify LTL Decomposition Rules
Inital Point of Time
Additionally, proof goals (G, L) |=0ϕ representing the initial point of time (InitGoals) are
introduced as a special case of a proof goal that allow one to handle past operators efficiently. Note that proof goals referring to arbitrary points of time (GenGoals) are not allowed to refer to the initialization equations, and proof goals that refer to the initial point of time are moreover allowed to make use of additional proof rules like those for eliminating past temporal operators.
The following two rules concerning the initial point of time: (G, L) |=0ϕ ∧ (G, L) |= Xϕ
(G, L) |= ϕW TimeCases()
This rule splits a proof goal into one goal referring to the initial point of time and all other points in time.
(G, L) |= ϕ
(G, L) |=0ϕ W InitToGen()
This rule translates an InitGoal to an GenGoal.
Induction
Now it is possible to define two different induction rules, both require an always operator as outermost operator in the specification. Then the following two rules split the proof goal in an induction hypothesis and a step case.
(G, L) |= ϕ ∧ (G, L) |= ϕ → Xϕ (G, L) |= GϕW Induction() (G, L) |=0ϕ ∧ (G, L) |= ϕ → Xϕ
(G, L) |= GϕW InitInduction()
Elimination of Past Temporal Operators for InitGoals
Definition 30 (Past Operator Elimination). Given a proof goal (G, L) |= ϕ, the rules to eliminate past temporal operators are defined as:
(G, L) |=0γ ∨ ψ
(G, L) |=0[ψ
←−
4.2 Interactive Verification of SGAs for LTL 87 (G, L) |=0γ (G, L) |=0[ψ ←− U γ] W InitPSUntil() (G, L) |=0¬γ (G, L) |=0[ψ ←− B γ] W InitPWBefore() (G, L) |=0¬γ ∨ ψ (G, L) |=0[ψ ←− B γ] W InitPSBefore()
The first two rules remove the past-until operators by requiring that the second operand (γ) holds in the initial state. The weak variant allows additionally that only the first operand holds (ψ). In the next two rules the same circumstances are described for the past-before operators.
Example
In this section the specifications of theABRO example are verified.
Proof of Specificationss1 and s2
The specificationss1 and s2 are provable by substitution of o in the specification. The result of applying the substitution ons1 and introducing the definition for the other variables leads to:
next(init) = False ∧
next(wb) = ¬r∧wb∧¬b ∨ r∧(wr∨wa∨wb) ∨ init ∧ next(wa) = ¬r∧wa∧¬a ∨ r∧(wr∨wa∨wb) ∨ init ∧
next(wr) = ¬r∧(wr ∨ a∧wa∧b∧wb ∨ ¬wa∧b∧wb ∨ ¬wb∧a∧wa) |= ¬r∧a∧wa∧b∧wb ∨ ¬r∧¬wa∧b∧wb ∨ ¬r∧¬wb∧a∧wa →
¬(
¬next(r)∧next(a)∧next(wa)∧next(b)∧next(wb) ∨ ¬next(r)∧¬next(wa)∧next(b)∧next(wb) ∨
¬next(r)∧¬next(wb)∧next(a)∧next(wa) )
A case distinction for the left hand side of the implication leads to the following three sub goals that prove the property:
¬r∧a∧wa∧b∧wb∧¬next(wa)∧¬next(wb)∧next(wr)|= ¬False ¬r∧¬wa∧b∧wb∧¬next(wa)∧¬next(wb)∧next(wr)|= ¬False ¬r∧¬wb∧a∧wa∧¬next(wa)∧¬next(wb)∧next(wr)|= ¬False
88 4 Interactive Verification based on an Intermediate Representation
Proof of an Example Lemma
It is possible to prove the following lemma:
• Lemma0: (G, L) |= G(wa →←X [¬− a←U (− r ∨ init)])
The first step is the application of the InitInduction rule. The base case is trivial sincewa is false at the initial point of time. In the induction step one has to show:
(G, L) |= (wa→←X−[¬a←U−(r∨init)]) → (next(wa)→←X−[¬next(a)←U−(next(r)∨next(init))]). Moving←X inwards, where− ←X next− (v) = v for all variables v ∈ V holds:
(G, L) |= (wa →←−X [¬a←U (− r ∨ init)]) → (next(wa) → [¬a←U (− r ∨ init)]) Afterwards, a substitution of next(wa) and a simplification step are done to get:
(G, L) |= (wa →←X [¬− a←U (− r∨init)])∧(¬r∧wa∧¬a∨r∧(wr∨wa∨wb)∨init) → [¬a←U (− r ∨ init)] Applying NextPWUntil and discharge the generated left-hand side of the disjunction and simplify the result leads to:
(G, L) |=
wa →←X [¬− a←U (− r ∨ init)])∧ (¬r ∧wa ∧ ¬a ∨ r ∧ (wr ∨wa ∨wb) ∨ init)∧
¬r ∧ ¬init → (¬a ∧ ←− X [¬a←U (− r ∨ init)])
This is further simplified to:
(G, L) |= (wa ∧ ¬r ∧ ¬init ∧ ¬a ∧←X [¬− a←U (− r ∨ init)]) → (¬a ∧←X [¬− a←U (− r ∨ init)]) Hence, the lemma holds.
Proof for Specification s3
The following lemmata are proven to ease the proof of Specifications3: • Lemma1: (G, L) |= G(wa ∧ ¬wb →←X [−b←B−r])
• Lemma2: (G, L) |= G(wb ∧ ¬wa →←X [−a←B−r])
In the following, only the proof of Lemma1 is presented, because the proof for Lemma2 is completely symmetric. The first step is again the application of the InitInduction rule, to obtain the trivial base case (sincewa does not at the initial point of time) and the following induction step:
(G, L) |= (wa ∧ ¬wb →←X [−b←B−r]) → (next(wa) ∧ ¬next(wb) →←X [next− (b)←B next− (r)]) The result after driving←X inwards:−
(G, L) |= (wa ∧ ¬wb →←X [−b←B−r]) → (next(wa) ∧ ¬next(wb) → [b←B−r]) A rewrite step of next(wa) and next(wb) leads to:
4.2 Interactive Verification of SGAs for LTL 89 (G, L) |= wa ∧ ¬wb →←X [−b←B−r]∧ ¬r ∧wb ∧ ¬b ∨ r ∧ (wr ∨wa ∨wb) ∨ init∧ ¬r ∧wa ∧ ¬a ∨ r ∧ (wr ∨wa ∨wb) ∨ init
→ [b
←− B r])
After a case distinction on init the case init=false remains:
(G, L) |= ¬init ∧wa ∧ ¬wb →←X [−b←B−r]∧ ¬r ∧wb ∧ ¬b ∨ r ∧ (wr ∨wa ∨wb)∧
¬r ∧wa ∧ ¬a ∨ r ∧ (wr ∨wa ∨wb) → [b
←− B r])
Another case distinction on r allows us to eliminate the case r=true, because it contains contradicting assumptions (wr ∨wa ∨wb) and ¬(wr ∨wa ∨wb). The case r=true is:
(G, L) |= ¬init ∧ ¬r ∧wa ∧ ¬a ∧ ¬(wb ∧ ¬b)∧ ¬wb →←X [−b←B−r]
!
→ [b←B−r])
Then, an unrolling of the past-before operator gives:
(G, L) |= ¬init ∧ ¬r ∧wa ∧ ¬a ∧ ¬(wb ∧ ¬b)∧ ¬wb →←X [−b←B−r]
!
→ (¬r ∧ (b ∨←X [−b←B−r])))
Since, ¬r is contained in the assumptions, the following is left to prove after a discharge step of b:
(G, L) |= ¬init ∧ ¬r ∧wa ∧ ¬a ∧ ¬b ∧ ¬(wb ∧ ¬b)∧ ¬wb →←X [−b←B−r]
!
→←X [−b←B−r])
Another case distinction proves the lemma: The case ¬wb proves the sub goal and the case wb leads to the contradicting assumptions b and ¬b.
The prove of Specifications3 is quite simple with the help of the above lemmas: (G, L) |= G(o → ([a←B−r] ∧ [b←B−r]))
After decomposing the conjunction the following two sub goals are created: (G, L) |= G(o → [a←B−r])
(G, L) |= G(o → [b←B−r])
In the following only the first sub-goal is considered further, because the second is provable analogously. Rewriting the variableo and several case distinctions leads to:
(G, L) |= G(¬init ∧wa ∧wb ∧ ¬r ∧ a ∧ b → [a←−Br]) (G, L) |= G(¬init ∧ ¬wa ∧wb ∧ ¬r ∧ a → [a←−Br]) (G, L) |= G(¬init ∧wa ∧ ¬wb ∧ ¬r ∧ b → [a←−Br])
The application of the rule NextPWBefore to all sub-goals that immediately remove the conjunct ¬r solves the first and the last sub-goal. The second sub-goal is reduced to:
(G, L) |= G(¬init ∧ ¬wa ∧wb ∧ ¬r ∧ a ∧ ¬b →←X [−a←B−r])
This allows us to use the above proven lemma (Lemma1) to solve it. In the dual case, Lemma2 must be used for the same purpose. Hence, this specification holds.
90 4 Interactive Verification based on an Intermediate Representation
Conclusion
This chapter presented two approaches to interactively verify synchronous systems represented by guarded actions. The first approach is used to prove that the assertions contained in the AIF file are valid in each state of the system and the second approach is used to show that given LTL specifications are satisfied by the system. The presented results allow to implement an interactive verification tool based on a preliminary set of basic rules that could be extended by demand. Such an extension will be shown in the next chapter, where rules for module calls and preemption statements are given.
Chapter 5
Modular Verification by Decomposition of Synchronous
Programs
This chapter describes rules for a special purpose – the specialization to modular verification of synchronous programs and was published in [GeSc13a, GeMS13]. In particular, techniques that allow us to reuse verification results done for modules without knowing the environment are presented. To this end, two major problems have to be solved: First, a module call may replace the formal input parameters by expressions which corresponds with a substitution of variables in the symbolic transition relation. In particular, this affects the starting point and contained pre-emption conditions of the module and can therefore dramatically affect the behavior of the module. For this reason, the temporal specifications have to be modified accordingly. A proof shows that this transformation defines a simulation preorder modulo substitution. Second, if a synchronous module is verified without its later context, outputs may not be completely determined (since the calling module may add further actions on the outputs of the called module). It is not difficult to see that the open system obtained by modular compilation simulates the closed system obtained by the linker, and therefore, all universal temporal properties are preserved. Furthermore, the behavior of synchronous modules may be temporarily suspended or finally aborted due to requests of their environment/calling module. Hence, if a temporal logic specification has already been verified for a synchronous module, then the available verification result can typically only be used if neither suspension nor abortion will take place. Therefore transformations on temporal logic specifications to lift available verification results for synchronous modules without suspension or abortion to refined temporal logic specifications are defined that take care of these pre-emption statements. In particular, the impact of a pre-emption statement of a contained module S is described. It is clear that temporal properties that hold for S may no longer be valid for the entire statement. It will be explained how to reuse available verification results for the statement S, which leads to the central question answered by this chapter: ‘What is deducible for(weak) abort S when(σ) or (weak) suspend S when(σ), when S satisfies a temporal property ϕ?’. Therefore transformations are defined to map a temporal logic formula ϕ to modified temporal logic formulas Θwkab(ϕ, σ), Θabst(ϕ, σ), Θspwk(ϕ, σ), Θstsp(ϕ, σ) such that these formulas hold for weak abort S when(σ), abort S when(σ), weak suspend S when(σ), and suspend S when(σ), respectively, provided that S satisfies ϕ. It is clear that these formulas are equivalent to ϕ if σ is false, and that ‘as much as possible’ of ϕ should be retained. This way, one can establish modular verification of synchronous modules in contexts where pre-emptions are used.
92 5 Modular Verification by Decomposition of Synchronous Programs
The results finally determine proof rules for the verification of module calls in imperative synchronous programming languages like Esterel and Quartz.