## Formal Verification of Concurrent Programs Based on Type Theory (1998)

Citations: | 3 - 0 self |

### BibTeX

@TECHREPORT{Yu98formalverification,

author = {Shen-Wei Yu},

title = {Formal Verification of Concurrent Programs Based on Type Theory},

institution = {},

year = {1998}

}

### OpenURL

### Abstract

Interactive theorem proving provides a general approach to modeling and verification of both finite-state and infinite-state systems but requires significant human efforts to deal with many tedious proofs. On the other hand, modelchecking is limited to some application domain with small finite-state space. A natural thought for this problem is to integrate these two approaches. To keep the consistency of the integration and ensure the correctness of verification, we suggest to use type theory based theorem provers (e.g. Lego) as the platform for the integration and build a model-checker to do parts of the verification automatically. We formalise a verification system of both CCS and an imperative language in the proof development system Lego which can be used to verify both finite-state and infinite-state problems. Then a model-checker, LegoMC, is implemented to generate Lego proof terms for finite-state problems automatically. Therefore people can use Lego to verify a general problem ...

### Citations

3506 | Communication sequential processes
- Hoare
- 1985
(Show Context)
Citation Context ... hand, has its own set of local variables y 1 ; : : : ; y n for each process that cannot be accessed by other processes. All interprocess communication is performed by message passing primitives. CSP =-=[Hoa85]-=- and CCS [Mil89] are best examples of this model. We use CCS to model message passing systems. 4.2 CCS: Calculus of Communicating System In this thesis, we consider pure CCS, which does not involve va... |

3280 |
Communication and Concurrency
- Milner
- 1989
(Show Context)
Citation Context ...1.1: The system structure of LegoMC We have implemented both message-passing and shared-memory models of concurrent systems. For the message-passing model, the Calculus of Communicating Systems (CCS) =-=[Mil89]-=- is used. We also define a simple imperative and concurrent programming language to model the shared-memory systems. We use the propositional -calculus [Koz83] to express temporal properties and speci... |

3030 | Graph-based algorithms for boolean function manipulation
- Bryant
- 1986
(Show Context)
Citation Context ...ions formed by substituting the variable to be true or false, respectively. The increase of efficiency of BDDs actually comes from techniques of variable ordering [Lee59, Ake78] and variable reducing =-=[Bry86]-=- . Variable reducing is using directed acyclic graphs to share common subexpressions in the diagram. Variable ordering is choosing a better ordering of the variables to reduce the size of the BDDs pro... |

1546 |
Pnuelli "The temporal logic of reactive and concurrent systems
- Manna, A
(Show Context)
Citation Context ... other temporal logics as abbreviations of -calculus. Propositional Linear Temporal Logic The Propositional Linear Temporal Logic (PLTL) is one of linear temporal logics advocated by Manna and Pneuli =-=[MP92]. The basic temporal operators in PLTL a-=-re 3\Phi ("eventually \Phi"), 2\Phi ("always \Phi"), fl\Phi ("next \Phi") and \PhiU \Psi ("\Phi until \Psi"). The syntax of PLTL formulas can be defined by the ... |

1422 | An axiomatic basis for computer programming - Hoare - 1969 |

1208 | Automatic verification of finite-state concurrent systems using temporal logic specifications - Clarke, Emerson, et al. - 1986 |

908 | Symbolic boolean manipulation with ordered binary-decision diagrams
- Bryant
- 1992
(Show Context)
Citation Context ...lled symbolic approach is to represent implicitly rather than explicitly the states and transition relations of systems [BCM + 92]. The usual implicit representation is Binary Decision Diagrams(BDDs) =-=[Bry92]-=- so that the temporal formulas can be modelchecked directly on the BDD representation, without ever building an explicit representation of the state space. Although the improvement in efficiency has s... |

707 | A framework for defining logics
- Harper, Honsel, et al.
- 1987
(Show Context)
Citation Context ...cification. Lego is an interactive proof development system designed and implemented by Randy Pollack in Edinburgh [LP92]. It implements several related type systems-- the Edinburgh Logical Framework =-=[HHP92]-=-, the calculus of constructions [CH88], the Extended Calculus of Constructions [Luo94], and UTT [Luo94]. Lego is a powerful tool for interactive proof development in the natural deduction style and su... |

672 | Concurrency and automata on infinite sequences - Park - 1981 |

637 | Model checking and abstraction - Clarke, Grumberg, et al. - 1994 |

586 | Assigning meanings to programs - Floyd - 1967 |

550 | PVS: A Prototype Verification System
- Owre, Rushby, et al.
(Show Context)
Citation Context ...suitable for their verification target. The rich build-in library can also simplify their task. Most of the theorem-provers are called LCF-style theorem provers [GMW79], these include HOL [GM93], PVS =-=[ORS92]-=-, Nurpl [C + 86], Coq [D + 91], Lego [LP92], etc. Edinburgh LCF was developed by Robin Milner and his colleagues around 1977 [GMW79]. Edinburgh LCF was programmable. The user could write programmable ... |

485 |
The calculus of constructions
- Coquand, Huet
- 1988
(Show Context)
Citation Context ...f development system designed and implemented by Randy Pollack in Edinburgh [LP92]. It implements several related type systems-- the Edinburgh Logical Framework [HHP92], the calculus of constructions =-=[CH88]-=-, the Extended Calculus of Constructions [Luo94], and UTT [Luo94]. Lego is a powerful tool for interactive proof development in the natural deduction style and supports refinement proof as a basic ope... |

452 |
The formulae-as-types notion of construction
- Howard
- 1980
(Show Context)
Citation Context ... are the proof objects in type theory. Logical formulas or propositions and logical inference in type theory are achieved by the idea of propositions--as--types, discovered by Curry [CF58] and Howard =-=[How80]-=-. This idea states that any proposition P corresponds to a type Prf(P ), the type 20 of its proofs, and a proof of P corresponds to an object of type Prf(P ). To assert that a proposition is true, one... |

423 |
Computer-aided Verification of Coordinating Processes
- Kurshan
- 1994
(Show Context)
Citation Context ...h contain uninterpreted constants as lemmas which are verified by Voss model-checker. Kurshan and Lamport [KL93] proved a multiplier where the 8-bit multiplier can be verified by COSPAN model-checker =-=[Kur94]-=- and the n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover [EGL92]. In principle, these approaches are to divide the whole 9 problem to separated sub-problems and ... |

381 |
Binary decision diagrams
- Akers
- 1978
(Show Context)
Citation Context ... branches which represent the expressions formed by substituting the variable to be true or false, respectively. The increase of efficiency of BDDs actually comes from techniques of variable ordering =-=[Lee59, Ake78]-=- and variable reducing [Bry86] . Variable reducing is using directed acyclic graphs to share common subexpressions in the diagram. Variable ordering is choosing a better ordering of the variables to r... |

370 | Model-checking for real-time systems - Alur, Courcoubetis, et al. - 1990 |

321 | Calculi for synchrony and asynchrony - Milner - 1983 |

310 | Lambda Calculus Notation with Nameless Dummies, A Tool for Automatic Formula Manipulation, with Application to the Church-Rosser Theorem
- Bruijn
- 1972
(Show Context)
Citation Context ...ld be [rec : (Process\Gamma ? Process)\Gamma ? Process]: However, Lego does not allow this sort of expressions since in general they could introduce paradox [Luo94]. Instead, we use de Bruijn's index =-=[dB72]-=- to deal with variable binding. Since de Bruijn's index is complicated and difficult for general users to use and understand, we have implemented an interface in LegoMC where the user does not use de ... |

259 |
Results on the propositional mu-calculus
- Kozen
- 1983
(Show Context)
Citation Context ... Calculus of Communicating Systems (CCS) [Mil89] is used. We also define a simple imperative and concurrent programming language to model the shared-memory systems. We use the propositional -calculus =-=[Koz83]-=- to express temporal properties and specifications and define other temporal logics, CTL and LTL, as syntax abbreviation of -calculus formulas. CCS, the imperative language and propositional -calculus... |

229 | Efficient model checking in fragments of the propositional μ-calculus - EMERSON, LEI - 1986 |

210 | Real-Time Logics: Complexity and Expressiveness - Alur, Henzinger - 1990 |

153 |
Myths about the mutual exclusion problem
- Peterson
- 1981
(Show Context)
Citation Context ...can prove that under both initial conditions (turn=1 or turn=2), Knuth's algorithm satisfies mutual exclusion, deadlockfree, weak fair114 ness and strong fairness. 7.2.5 Peterson's Algorithm Peterson =-=[Pet81]-=- gave an elegant and simple solution to mutual exclusion problem. The variables flag1, flag2 and turn are the same as Dekker's algorithm. (* Peterson's Algorithm for 2 process mutual exclusion *) (* T... |

150 |
LEGO proof development system: User’s manual
- Luo, Pollack
- 1992
(Show Context)
Citation Context ...rich build-in library can also simplify their task. Most of the theorem-provers are called LCF-style theorem provers [GMW79], these include HOL [GM93], PVS [ORS92], Nurpl [C + 86], Coq [D + 91], Lego =-=[LP92]-=-, etc. Edinburgh LCF was developed by Robin Milner and his colleagues around 1977 [GMW79]. Edinburgh LCF was programmable. The user could write programmable meta-language (called ML) functions to proc... |

125 | Characterizing correctness properties of parallel programs using fixpoints - Emerson, Clarke |

111 | Another look at LTL model checking - Clarke, Grumberg, et al. - 1994 |

109 |
Computation and reasoning: a type theory for computer science
- Luo
- 1994
(Show Context)
Citation Context ...y Randy Pollack in Edinburgh [LP92]. It implements several related type systems-- the Edinburgh Logical Framework [HHP92], the calculus of constructions [CH88], the Extended Calculus of Constructions =-=[Luo94]-=-, and UTT [Luo94]. Lego is a powerful tool for interactive proof development in the natural deduction style and supports refinement proof as a basic operation and a definitional mechanism to introduce... |

105 | A structural induction theorem for processes
- Kurshan, McMillan
(Show Context)
Citation Context ...lusion problem is fairly complicated to verify. To be used in practice, it is necessary to borrow some automatic techniques, e.g. model-checking. Wolper and Lovinfosse [WL89] and Kurshan and McMillan =-=[KM89]-=- extended model-checking for inductive proofs by using an invariant to capture the induction hypothesis in the inductive step. Joyce and Seger [JS93] used HOL theorem prover to verify formulas which c... |

104 | Representation of switching circuits by binary-decision programs - Lee - 1959 |

92 |
sometimes" and "not never" revisited: on branching versus linear time temporal logic
- Emerson, Halpern
- 1983
(Show Context)
Citation Context ... of formulas: state formulas and path formulas, CTL permits an arbitrary formula of linear time logic to follow a path quantifier. It was proposed as an unifying framework subsuming both CTL and PLTL =-=[EH86]-=-. state--formula(\Phi) ::= Aj\Phis\Phij:\PhijE\Psi path--formula(\Psi) ::= \Phij?j\Psis\Psij:\PsijX\Psij\PsiU\Psi where A ranges over atomic assertions. The other operators are defined as syntax abbre... |

91 | Tableau-based model checking in the propositional mu-calculus - Cleaveland - 1990 |

90 |
Edinburgh LCF: A Mechanised Logic
- Gordon, Milner, et al.
- 1979
(Show Context)
Citation Context ...erent reasoning methods which are more suitable for their verification target. The rich build-in library can also simplify their task. Most of the theorem-provers are called LCF-style theorem provers =-=[GMW79]-=-, these include HOL [GM93], PVS [ORS92], Nurpl [C + 86], Coq [D + 91], Lego [LP92], etc. Edinburgh LCF was developed by Robin Milner and his colleagues around 1977 [GMW79]. Edinburgh LCF was programma... |

83 | Model Checking and Boolean Graphs - Andersen - 1994 |

63 | Explicit-clock temporal logic - Harel, Lichtenstein, et al. - 1990 |

61 | M.: Markov decision processes and regular events (extended abstract - Courcoubetis, Yannakakis - 1990 |

55 | Mathematical Theory of Programming Correctness - Bakker - 1980 |

55 | The mutual exclusion problem part ii: Statement and solutions
- Lamport
- 1986
(Show Context)
Citation Context ...both initial conditions (turn=1 or turn=2), Peterson's algorithm satisfies mutual exclusion, deadlockfree, weak fairness and strong fairness. 116 7.2.6 Lamport's Algorithm Lamport's one-bit algorithm =-=[Lam86]-=- uses only one variable for each process. The variables flag1 and flag2 are the same as Dekker' algorithm. (* Lamport's Algorithm for 2 process mutual exclusion *) (* flag1,flag2 : boolean with false ... |

54 | Mechanical Verification of Concurrent Systems with TLA
- Engberg, Groenning, et al.
- 1992
(Show Context)
Citation Context ...rt [KL93] proved a multiplier where the 8-bit multiplier can be verified by COSPAN model-checker [Kur94] and the n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover =-=[EGL92]-=-. In principle, these approaches are to divide the whole 9 problem to separated sub-problems and then use different tools to solve individual problems. Their works based on paper and pencils are the e... |

47 | Combining model checking and deduction for I/Oautomata
- Muller, Nipkow
- 1995
(Show Context)
Citation Context ... works based on paper and pencils are the early attempts of combining theorem proving and model-checking. However, the integration of these two approaches is still not tight enough. Muller and Nipkow =-=[MN95]-=- used HOL theorem prover to reduce the alternating bit protocol expressed in I/O automata to a finite state one to be verified by their own model-checker. PVS proof checker [ORS92] even includes a mod... |

44 |
Introduction to HOL: A Theorem-Proving Environment for Higher-Order Logic
- Gordon, Melham
- 1993
(Show Context)
Citation Context ...ch are more suitable for their verification target. The rich build-in library can also simplify their task. Most of the theorem-provers are called LCF-style theorem provers [GMW79], these include HOL =-=[GM93]-=-, PVS [ORS92], Nurpl [C + 86], Coq [D + 91], Lego [LP92], etc. Edinburgh LCF was developed by Robin Milner and his colleagues around 1977 [GMW79]. Edinburgh LCF was programmable. The user could write ... |

43 | Formally Verifying a Microprocessor using a Simulation Methodology
- Derek, Bryant
- 1994
(Show Context)
Citation Context ...-checkers. The improvement in efficiency has successfully extended the application to more large-scale and complicated systems such as circuits with 10 20 states [BCM + 92] and PDP-11 sized processor =-=[BB94]-=-. It has been extended to probabilistic [Var85, 4 PZ86, CY90] and real time programs and logics [ACD90, AH90, HLP90]. The basic idea is to determine whether or not a system satisfies a property typica... |

40 |
The concurrency workbench: A semantics-based verification tool for finite-state systems
- Cleaveland, Parrow, et al.
- 1989
(Show Context)
Citation Context ...s Lamport Yes Yes Yes Yes/No* Table 7.1: Verification results of mutual exclusion algorithms Compared with Walker's analysis [Wal89] of mutual exclusion algorithms using CCS and Concurrency Workbench =-=[CPS93]-=-, the modeling in ICPL is much simpler and the ICPL presentation is clearer than CCS presentation. Further simplification can be made by creating syntax abbreviation for repeat ...until and for loop s... |

40 |
Additional comments on a problem in concurrent programming control
- Knuth
- 1966
(Show Context)
Citation Context ...rn=2), Hyman's algorithm does not satisfy mutual exclusion but does satisfy deadlockfree. Hyman's algorithm can satisfy weak fairness but not strong fairness. 7.2.4 Knuth's Algorithm Knuth's protocol =-=[Knu66]-=- was the first strong fair solution. The variable flag1, flag2 and turn are the same as Dijkstra's algorithm. (* Knuth's Algorithm for 2 process mutual exclusion *) (* The formulation here is taken fr... |

39 | Tracing protocols - Holzmann - 1985 |

36 |
Heuristics to Compute Variable Orderings for Efficient Manipulation of Ordered Binary Decision 46 47 Diagrams
- Butler, Ross, et al.
- 1991
(Show Context)
Citation Context ...iable ordering is choosing a better ordering of the variables to reduce the size of the BDDs produced. Some heuristics on variable ordering can be found on the paper by Bulter, Ross, Kapur and Mercer =-=[BRKM91]-=-. Such structures are formally called as reduced ordered binary decision diagrams (ROBDDs) but are usually called BDDs for short. The construction of a BDD from a boolean expression proceeds as follow... |

36 | and Branching Structures in the Semantics and Logic of Reactive Systems - Linear - 1985 |

35 |
Linking BDD-based symbolic evaluation to interactive theorem-proving
- Joyce, Seger
- 1993
(Show Context)
Citation Context ...per and Lovinfosse [WL89] and Kurshan and McMillan [KM89] extended model-checking for inductive proofs by using an invariant to capture the induction hypothesis in the inductive step. Joyce and Seger =-=[JS93]-=- used HOL theorem prover to verify formulas which contain uninterpreted constants as lemmas which are verified by Voss model-checker. Kurshan and Lamport [KL93] proved a multiplier where the 8-bit mul... |

35 | Verification of a multiplier: 64 bits and beyond
- Kurshan, Lamport
- 1993
(Show Context)
Citation Context ... in the inductive step. Joyce and Seger [JS93] used HOL theorem prover to verify formulas which contain uninterpreted constants as lemmas which are verified by Voss model-checker. Kurshan and Lamport =-=[KL93]-=- proved a multiplier where the 8-bit multiplier can be verified by COSPAN model-checker [Kur94] and the n-bit multiplier composed from 8-bit multipliers can be verified by TLP theorem prover [EGL92]. ... |

34 | A tool for symbolic program verification and abstraction - Loiseaux - 1993 |

34 |
PartialOrder Methods for Temporal Verification
- Wolper, Godefroid
- 1993
(Show Context)
Citation Context ...state space of the system, while still maintaining the ability to check the properties of interest. Partialorder techniques attempt to avoid the wasteful representation of concurrency by interleaving =-=[GW93]-=-. Abstraction techniques replace the system to be checked by a simpler one in which the details irrelevant for the property to be checked have been suppressed [Kur94, CGL92, GL93]. Another direction c... |