rob van glabbeek (sydney) marc voorhoeve (tue)
DESCRIPTION
Rob van Glabbeek (Sydney) Marc Voorhoeve (TUE). Liveness, Fairness and Impossible Futures. Contents. Motivation IF equivalence Results. IF. contrasim. weak bisim. fair testing. weak+div. trace. strong bisim. failure. ready simulation. Context. Why yet another equivalence relation?. - PowerPoint PPT PresentationTRANSCRIPT
1 of 21 department of mathematics and computer science
Rob van Glabbeek (Sydney)
Marc Voorhoeve (TUE)
Liveness, Fairnessand Impossible
Futures
2 of 21 department of mathematics and computer science
1. Motivation2. IF equivalence3. Results
Contents
3 of 21 department of mathematics and computer science
Context
Why yet another equivalence relation?
trace
fair testing
IF contrasimweak bisim
strong bisim
failure ready simulation
weak+div
4 of 21 department of mathematics and computer science
Motivation
System development:model-based vs. requirement-based.Combination often preferable.
Non-bisim equivalence:compositional when congruenceincreases implementer’s freedom.
Equivalence implementation – model:branching/weak bisimilarity?Advantages: compositional,
preservation of any requirement.Disadvantage: restrictive.
5 of 21 department of mathematics and computer science
Compositional verification
t ok c
nokf
t c
f
t c
tf tcft
coktfnokt
coktfnokt
nokok
*).(
).*)..((
.*)..(
},{
abstraction
reduction (contrasim)
6 of 21 department of mathematics and computer science
Too much freedom!
t
s
t
c
s
t
s
f f
f
v w
Processes v,w :failures/ready simulation equivalent!
Corrupted state u : action c impossible. u reachable from w not v.
uLegend:t: tryc: connectf: fails: stop
corrupted states
hiddenvisible
7 of 21 department of mathematics and computer science
Motivation (conclusion)
Non-bisim equivalences:more freedom for implementer.Needed:knowledge about preservation of properties.
IF (impossible future) equivalencepreserves AGEF properties.
8 of 21 department of mathematics and computer science
1. Motivation2. IF Equivalence3. Results
Contents
• Preliminary notions• Definition• Properties preserved• Connection with liveness and fairness
9 of 21 department of mathematics and computer science
Transition systems
t
s
t
c
s
t
s
f f
f
gsmspec gsmimpl
Legend:t: tryc: connectf: fails: stop
Process: state in labeled transition system (LTS)
v w
10 of 21 department of mathematics and computer science
LTS: pair ,S a set (of states) :ternary transition relation
),( S
SAS }){(
v
c
t
bs
ff
d ec
v = gsmspecSet A of visible actions: Special hidden action A
Transition relations
SAS * trace relation
.,
,,
bvvf
fccvsf
t
.,
,,
bvfv
cvvvtfst
t
11 of 21 department of mathematics and computer science
Impossible futures equivalence
}'::
:':'|),{(
:)(
pB
pppB
pIF
ftfst dddv
vIFftfst
)(}),{,(
fst
ct
ffv
ccv
ct ddv
vIFcfst
)(}),{,(
)()( qIFpIF
qp IF
IF: decorated trace
IF equivalence: same IFs
)(
)(
yxxyx
yxaayax
IF
IF
Congruence with root condition:
v
c
t
bs
ff
d ec
12 of 21 department of mathematics and computer science
Properties preserved by IF
Having observed it is possible to continuewith a trace from B.calculus: T B
CTL:(AGEF property)
}'::
:':'|),{(
:)(
pB
pppB
pIF
)'::(:':'
)(),(
pBppp
pIFB
T)T (Not IF preserved(not AGEF):
)(EFAG B
13 of 21 department of mathematics and computer science
Some AGEF properties
No deadlock/livelock: TT*T
Soundness: *T*T √Delivery (d) possible after order (o):
T*T*T*T do
Order that is not confirmed (c) can be aborted (a):
T*T**T aco )(An order that can be confirmed, can be aborted(at the same time): T)T*T*T aco ( Not AGEF:
)()())( acocboboacobo IF
14 of 21 department of mathematics and computer science
t
s
t
c
s
t
s
f f
f
Legend:t: tryc: connectf: fails: stop
GSM example
v w
Corrupted state u:no connection possible.Corrupted state reachable from w not v.
TTT cf **
(AGEF properties)
f
calculus predicates
Paths terminating with f,can continue with tc
Paths terminating with f,can eventually do c
TT tcf*
u
testable
non-testable
15 of 21 department of mathematics and computer science
Liveness
Infinite tf-sequence impossible: XtfX ][
t
s
t
c
s
t
s
f f
f
v w
CTL: ))((AFAG *},{ scft
Verify AGEF instead of liveness!
Implies liveness combined with AGEF property(fairness assumption)
16 of 21 department of mathematics and computer science
1. Motivation2. IF Equivalence3. Results
Contents
• Preservation• Fair testing• Proof method
17 of 21 department of mathematics and computer science
Preservation results
1. IF congruence preservesall AGEF properties.
2. Any congruence preservingany non-testable AGEF propertyis at least as fine as IF.
3. Any congruence at least as coarse asweak bisim, satisfying RSP and preservingany nontrivial AGEF propertyis at least as fine as IF.
18 of 21 department of mathematics and computer science
Fair testing (FT)
FT preserves all testable AGEF propertiesand (assuming fairness) all AGAF properties
)( bybxaabyabx FT but different IF’s
FT does not satisfy RSP:two processes satisfy :abaXX FT
a a b a
a
a
a b
19 of 21 department of mathematics and computer science
Proof method
Suppose ~ is a congruence w.r.t. CCS compositionand there exist ,B,p,q with p ~ q such that
)(\)(),( qIFpIFB
AcqactpactAaa n ),()(,1Let
and set AUXXC \)|()( 0 with
Bn
iii
ccU
niccUaU
)(
)1()(1
20 of 21 department of mathematics and computer science
Context C
)(\)(),( qIFpIFB
AUXXC \)|()( 0
_a2
c
_an
_a1
c
c
i
))((\))((}){,( qCIFpCIFcc
0U nU
)'::(:':' pBppp
ccn
ccn
n
AUqqC
AUp
AUppC
\)|'()(
\)|'(
\)|'()(
21 of 21 department of mathematics and computer science
Conclusions
1. Many system safety and livenessproperties are of AGEF kind.
AGAF liveness: AGEF + fairness.
2. IF and FT: compositional verificationof AGEF properties.
3. FT: only testable AGEF properties,RSP cannot be used.
Thank you for your attention
22 of 21 department of mathematics and computer science
C3 C2
a
_b
c
d_d
_d
_e
e
D1 D2 c_e _
ff
_d
D1 D2C1
Composition
}{\)|(
},{\)||(
211
321
fDDC
edCCC
Systems built fromcomponents
23 of 21 department of mathematics and computer science
Verification
a
b
c
Possible: prove e.g.abaS wc *)(}{
Disadvantage: cumbersome, restrictive.Alternative:Non-bisim equivalence that is congruencew.r.t. composition and preserves requirements!
Advantage:compositionality.
Verify property, e.g.:b may eventuallyoccur after a
T*T*T ba
Simplify components