Abstract

There is a high demand for correctness for safety critical systems, often requiring the use of formal verification. Simple, well-understood scheduling strategies ease verification but are often very inefficient. In contrast, efficient concurrent schedulers are often complex and hard to reason about. This paper will show how the TLA logic can be used to verify schedulers of concurrent components. TLA allows us to prove that one program preserves the behaviour of another program, in particular that an efficient scheduling strategy preserves the behaviour of a simpler one. For an arbitrary program we can use the simpler scheduler for correctness verification, knowing that the properties also hold in the more efficient one, which we then implement. This approach is illustrated with the Hume programming language, which is based on concurrent rich automata. We show an efficient extension to the Hume scheduler, and prove that this extension preserves the behaviour of the standard Hume scheduler.

Citations