statically proving behavioural properties in the €-calculus - sqig

Click here to load reader

Post on 09-Feb-2022

0 views

Category:

Documents

0 download

Embed Size (px)

TRANSCRIPT

Maxime Emile Gamboni
Thesis specifically prepared to obtain the PhD Degree in Mathematics
Draft
Nome Maxime Gamboni
Doutoramento em Matematica
Orientador Antonio Ravara
Co-orientador Carlos Caleiro
Resumo Nesta tese apresento um mecanismo semantico generico e um sistema de tipos provado
correcto para analisar propriedades comportamentais do calculo-π. Alem de propriedades de an-
imacao tais como actividade (uma generalisacao da receptividade), alcance e terminacao, o mecanismo
tambem suporta a analise de propriedades de seguranca tais como determinismo e isolamento.
A analise de dependencias e uma parte central deste mecanismo, funcionando com declaracoes
de dependencias descrevendo propriedades de um processo condicionadas por recursos esperado de
processos exteriores. As declaracoes de dependencia sao usadas como partes elementares de declaracoes
comportamentais, declaracoes logicas descrevendo a negociacao de recursos entre um processo e o
seu ambiente. A analise de dependencias traz uma poderosa propriedade de composicionalidade:
compondo elementos pre-analisados (tipados), o tipo do processo resultante pode ser directamente
obtido a partir dos tipos dos elementos, sem precisar de uma analise separada do processo completo.
As declaracoes comportamentais tambem integram primitivas para seleccao (escolhas feitas por um
processo) e ramificacao (escolhas oferecidas por um processo).
O sistema de tipos, parameterizado com regras elementares dando a essencia das propriedades
pretendidas e de tipos de canais dando o protocolo esperado em canais de comunicacao, constroi uma
declaracao comportamental automaticamente, analisando os processos.
Palavras-chave calculo-π, propriedades de animacao, propriedades de seguranca, sistemas de tipo genericos, actividade, codificacoes, escolha.
iv
v
Title Statically Proving Behavioural Properties in the π-calculus via Dependency Analysis
Abstract In this thesis I present a generic semantic framework and sound type system suited for
analysing a wide variety of behavioural properties in π-calculus processes, both liveness properties such
as activeness (a generalisation of receptiveness), termination and reachability, and safety properties
such as determinism and isolation.
Dependency analysis is a central ingredient of this framework, implemented by dependency state-
ments describing process properties conditional on some resources to be provided by third-party pro-
cesses. Dependency statements are used as elementary ingredients of behavioural statements, logical
statements that precisely characterise negotiation of resources between a process and its environment.
Dependency analysis provides this framework with powerful compositionality : when arranging pre-
analysed (typed) components together, the resulting process’ type can be directly derived from those
of the components, with no need to re-analyse the entire process. Behavioural statements also inte-
grate primitives for describing selection (choices made by a process) and branching (choices offered
by a process).
The type system, parametrised with elementary rules giving the essence of the desired properties
and channel types giving communication protocols to be used on communication channels, automati-
cally constructs a behavioural statement by automatically analysing processes.
Keywords π-calculus, liveness properties, safety properties, generic type systems, activeness, en- codings, choice.
vi
Acknowledgements
I wish to thank Antonio, Uwe, Kohei, Nobuko, Lucia for their continued and repeated help, advice and support.
Thank you to my parents for financially supporting most of my expenses during my studies.
“This work is partially supported by SQIG — Instituto de Telecomunicacoes and IST, Portugal, by Fundacao para a Ciencia e a Tecnologia, as well as the EU FET-GC project Sensoria (IST-2005-16004).”
Contents
1.3 Behavioural Properties . . . . . . . . . . . . . . . . . . . . . . . . 3
1.5 Choice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.8 Proof-Carrying Behavioural Statements . . . . . . . . . . . . . . 9
2 Processes and Operational Semantics 11
2.1 Polyadic π-Calculus, Guarded Sums, Replication . . . . . . . . . 11
2.2 Operational Semantics . . . . . . . . . . . . . . . . . . . . . . . . 12
3 Simple Types 15
3.1 Parameter types . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4 Process Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.6 Behavioural Statements . . . . . . . . . . . . . . . . . . . . . . . 19
3.7 Typed Transitions . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.10 Channel Instantiation . . . . . . . . . . . . . . . . . . . . . . . . 26
3.11 Transition Operator . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.12 Simple Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
4 Universal Properties 31
4.2 Universal Type Algebra . . . . . . . . . . . . . . . . . . . . . . . 32
4.3 Universal Semantics . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.5 Verifying Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.8 Responsiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
viii CONTENTS
5 Existential Properties 45 5.1 Existential Type Algebra . . . . . . . . . . . . . . . . . . . . . . 46 5.2 Existential Semantics . . . . . . . . . . . . . . . . . . . . . . . . . 48 5.3 Existential Type System . . . . . . . . . . . . . . . . . . . . . . . 53 5.4 Events and Non-Transitive Dependencies . . . . . . . . . . . . . . 55 5.5 Delayed Dependencies and Self-Name Passing . . . . . . . . . . . 56 5.6 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6 Activeness 59 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 6.2 Branching Algebra . . . . . . . . . . . . . . . . . . . . . . . . . . 63 6.3 Activeness Semantics . . . . . . . . . . . . . . . . . . . . . . . . . 64 6.4 A Typing Example . . . . . . . . . . . . . . . . . . . . . . . . . . 67 6.5 Distributed Properties and τ -Activeness . . . . . . . . . . . . . . 69
7 Structural Analysis 71 7.1 Strategies and Annotated Process Types . . . . . . . . . . . . . . 72 7.2 Structural Semantics: Consistency . . . . . . . . . . . . . . . . . 76 7.3 Structural Semantics: Completeness . . . . . . . . . . . . . . . . 81 7.4 Annotated Labelled Transition System . . . . . . . . . . . . . . . 82 7.5 Annotated Type System . . . . . . . . . . . . . . . . . . . . . . . 87 7.6 Overall Soundness Proof (Proposition 5.6.4) . . . . . . . . . . . . 91 7.7 Structural Analysis for Process-Level Properties . . . . . . . . . . 92
8 Applications 93 8.1 Isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 8.2 Determinism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 8.3 Reachability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 8.4 Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 8.5 Deadlock-Freedom . . . . . . . . . . . . . . . . . . . . . . . . . . 100
9 Further Reading 103 9.1 Activeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
9.1.1 Sangiorgi: The Name Discipline of Uniform Receptiveness 103 9.1.2 Pierce, Sangiorgi: Typing and Subtyping for Mobile Pro-
cesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 9.1.3 Kobayashi, Pierce, Turner: Linearity and the π-calculus . 104 9.1.4 Amadio et al.: The Receptive Distributed π-calculus . . . 104 9.1.5 Acciai, Boreale: Responsiveness in process calculi . . . . . 105 9.1.6 Kobayashi: TyPiCal . . . . . . . . . . . . . . . . . . . . . 107 9.1.7 Kobayashi: Type Systems for Concurrent Programs . . . 109 9.1.8 Kobayashi and Sangiorgi: A Hybrid Type System for
Lock-Freedom of Mobile Processes . . . . . . . . . . . . . 109 9.2 Other Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
9.2.1 Deng and Sangiorgi: Ensuring Termination by Typability 110 9.2.2 On Determinacy and Nondeterminacy in Concurrent Pro-
gramming . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 9.3 Generic Type Systems . . . . . . . . . . . . . . . . . . . . . . . . 110
9.3.1 Acciai and Boreale: Spatial and Behavioral Types in the Pi-Calculus . . . . . . . . . . . . . . . . . . . . . . . . . . 110
CONTENTS ix
9.3.2 Igarashi and Kobayashi: A generic type system for the Pi-calculus . . . . . . . . . . . . . . . . . . . . . . . . . . 111
9.3.3 Caires and Vieira: Spatial Logic Model Checker . . . . . . 111 9.4 Structural Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 112
9.4.1 Bodei, Degano et al: Control Flow Analysis for the π-cal- culus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
10 Conclusion 113
A Proofs 121 A.1 Proofs for section 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . 121
A.1.1 Normal Form (Lemmas 3.6.6 and 3.6.7) . . . . . . . . . . 121 A.1.2 Composition of Disjoint Statements (Lemma 5.1.2) . . . . 121 A.1.3 Closure Uniqueness (Lemma 4.2.4) . . . . . . . . . . . . . 123 A.1.4 Composition Properties (Lemma 3.9.4) . . . . . . . . . . . 125
A.2 Proofs for Sections 3.12 and 5.2 . . . . . . . . . . . . . . . . . . . 127 A.2.1 Safety and Structural Equivalence (Lemma 3.12.2) . . . . 127 A.2.2 Bisimulation and Type Equivalence (Lemma 5.2.7) . . . . 127
A.3 Auxiliary Lemmas . . . . . . . . . . . . . . . . . . . . . . . . . . 128 A.4 Subject Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . 130
A.4.1 τ -Reductions . . . . . . . . . . . . . . . . . . . . . . . . . 131 A.4.2 Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 A.4.3 Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 A.4.4 Replication . . . . . . . . . . . . . . . . . . . . . . . . . . 140
A.5 Simple Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . 143 A.6 Proofs of Section 7 . . . . . . . . . . . . . . . . . . . . . . . . . . 145
A.6.1 Subject Transitions (Lemma 7.4.5) . . . . . . . . . . . . . 145 A.6.2 Completeness of Strategies (Lemma 7.4.6) . . . . . . . . . 149 A.6.3 Runnability Safety (Lemma 7.4.8) . . . . . . . . . . . . . 151 A.6.4 Strategy Application (Lemma 7.4.9) . . . . . . . . . . . . 154 A.6.5 Completeness Soundness (Lemma 7.4.10) . . . . . . . . . 155 A.6.6 Reduction and Composition Preserve consistency (Lem-
mas 7.5.6, 7.5.7) . . . . . . . . . . . . . . . . . . . . . . . 155 A.6.7 Closure Completes (Lemma 7.5.10) . . . . . . . . . . . . . 156 A.6.8 Annotated Type System Soundness (Lemma 7.5.13) . . . 157
B Notation Index 159 B.1 Meta-variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 B.2 Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 B.3 Multiplicities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 B.4 Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 B.5 Types and Behavioural Statements . . . . . . . . . . . . . . . . . 161 B.6 Type Algebra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 B.7 Judgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 B.8 Annotated typed Processes . . . . . . . . . . . . . . . . . . . . . 162
x CONTENTS
Chapter 1
Introduction
This thesis is about the use of dependency analysis to study the behaviour of mobile processes.
1.1 Mobile Processes
Similarly to the λ-calculus being a foundational framework to study sequen- tial functional programming, process calculi are formalisms providing theory to reason about open, concurrent, distributed and mobile systems. A distributed algorithm is one spanning many information systems like sensor networks, (phys- ically) mobile agents, computers in a peer-to-peer network, or just processes in a single computer. In order to precisely describe distributed processes, one needs a parallel composition connective “|”, which, when applied to a number of pro- cesses, indicates that they can run independently of each other. For instance P1 |P2 |P3 |P4 represents a process with four independent components that may be running on four different systems.
As the components may be located in different places, they can’t share in- formation (like two threads of a program may access a common memory heap, or like two of a computer would share a common memory), but must instead rely on explicit communication to exchange information. Some calculi such as Linda [CG90] use a broadcast model in which all participants of an algorithm may access a common “tuple space” that serves as a unique communication medium. Nominal calculi such as the Calculus of Communicating Systems or CCS [Mil80] use named channels. In this thesis we will focus on nominal calculi.
Communication is implemented with two primitives, input a and output a, where a is the name of the communication channel. The prefix or sequence connective “.” is used for synchronisation: a.P is a program that waits for a signal on channel a, then executes P , and a.P is a program that sends a signal on channel a, then whenever it is received, proceeds with P . It should be noted that a message can only be received by a single receiver, so a.P | a.Q | a is a program that non-deterministically runs one of P and Q, leaving the other one deadlocked (assuming a doesn’t appear elsewhere in P or Q).
The π-calculus [MPW92, SW01] goes beyond synchronisation and permits explicit information transfer by letting outputs carry values (ax1, x2, . . .), ab- breviated ax, and inputs carry variables (a(y1, y2, . . . )), much like function
1
calls and function declarations in many programming languages. Many extensions and variants of process…