parameterized systems ?
Pas alFontaineandE. Pas alGribomont
UniversityofLiege(Belgium)
fpfontain,gribomontgmontefio re.ul g.a .be
Abstra t. The ontrol part of many on urrent and distributed
pro-gramsredu estoaset=fp1;:::;pngofsymmetri pro esses
ontain-ingmainlyassignmentsandtestsonBooleanvariables.However,the
as-signments,theguardsandtheprograminvariants anbe-quanti ed,so
the orrespondingveri ation onditionsalsoinvolve-quanti ations.
We propose a systemati pro edure allowing the elimination of su h
quanti ations for a large lass of program invariants. At the ore of
this pro edure is a variant of the Herbrand Theorem for many-sorted
rst-orderlogi withequality.
1 Introdu tion
Attheheartof on urrentsoftwareare ontrol-intensive on urrentalgorithms,
whi h solve a large lass of problems, in luding mutual ex lusion,
termina-tiondete tion,reliable ommuni ationthroughunreliable hannels,syn hronous
ommuni ationthroughasyn hronous hannels,fault toleran e,leaderele tion,
Byzantine agreement, on urrentreading and writing, and so on. (See e.g.[8,
25℄formanyexamples,with ommentsandformalorinformalproofs).Manyof
thosesystemsare omposedofaparameterizednumberofidenti alpro essesor
nearlyidenti al pro esses 1
. Most variablesare Booleans orarraysofBooleans,
and operations on the remaining variables are elementary. The veri ation of
su hparameterized on urrentsystemsisthesubje tofmanyre entpapers[1,
4,7,11,17,23,24,31℄.
Requirementsofsu halgorithmsusuallyfallinsafetyproperties(\something
badneverhappens") andliveness properties(\somethinggoodeventually
hap-pens"). It is often possible to view a liveness property as the onjun tion of
a safety property and a fairness hypothesis (\progress is made") so, in
pra -ti e,theveri ationofsafetypropertiesisthemainpartofformalmethodsand
tools.The lassi alinvariantmethod allowsto redu e theveri ationof safety
propertiesto thevalidityproblemfor rst-orderlogi .It ouldhappenthatthe
?
Thisworkwas fundedbyagrantof the\Communautefran aisedeBelgique -
Di-re tiondelare her hes ienti que-A tionsdere her he on ertees"
1
burgerarithmeti ), butthisisrarelythe asebe auseBooleanarrays(modeled
by uninterpreted predi ates) are oftenused in these algorithms, together with
interpretedpredi ates 2
.
Quanti er-free rst-orderlogi satis ability he kingis de idableforavery
widerangeofformulaswithnon-interpretedandinterpretedpredi atesand
fun -tions.Thusde idabilityis oftenrea hed throughquanti erelimination.We
in-trodu e hereasimple quanti erelimination method for alarge lass of
veri - ation onditions. It is based on a many-sorted logi with equality variant of
theHerbrandTheoremwhi hallowstohavesomekindof nitemodelproperty
[12℄ even when somefun tions (interpreted or not) and interpreted predi ates
areusedin formulas.Wethengive riteriaforveri ation onditionstobene t
from thisproperty.Those riteriaallowtoeliminatequanti ersin theproofby
invariantofmanyrea tivealgorithms, andparti ularly forparameterized
algo-rithms,leadingtoapowerfulinvariantvalidationpro edure.Itallowstoredu e
theinvariantvalidationforasystemwith aparameterizednumberofpro esses
to the invariant validation for asystem with aknown number of pro essesn
0
(Theorem2).Ourmethod anbeseenasanextensionoftheinvariantvalidation
pro edure presentedin [3℄: ourapproa hdoesnotrestri t theuse offun tions
andpredi atestounaryones,andisnotrestri tedtobounded variables.
Ourimplementationhasgivengoodresultsonseveralalgorithms;in
parti -ular, it hasbeensu essful in provingallveri ation onditionsfora
parame-terizedrailroad rossingsystem[21℄usedasben hmarkforSTeP,whereasSTeP
itselfrequiresintera tiveveri ationforsomeofthem[6℄.
We rstpresentourvariantoftheHerbrandTheorem. Next,thisvariantis
usedtoeliminatethequanti ersinveri ation onditionsfrominvariant
valida-tionofparameterizedsystems.Last,twoexamplesarepresented.
2 Herbrand on many-sorted logi
In this se tion, Theorem 1 and its ontext is introdu ed. This theorem will
be used to eliminate quanti ers in veri ation onditions, whi h will lead to
Theorem2.
Amany-sorted rst-orderlanguage(amore ompleteintrodu tionto
many-sorted logi an befound in [13℄) is atuple L =hT;V;F;P;r;disu h that T
is a nite set of sorts (or types), V is the ( nite) union of disjoint nite sets
V
of variables of sort , F andP aresets of fun tion and predi ate symbols,
r (F[P !N) assigns an arityto ea h fun tion and predi atesymbol,and d
(F[P!T ?
)assignsasortinT r(f)+1
toea hfun tionsymbolf 2Fandasort
in T r(p)
to ea h predi ate symbol p 2P. Nullary predi ates are propositions,
andnullaryfun tionsare onstants.
Thesets of -termsonlanguageL ontainallvariablesinV
,andforevery
fun tion symbolf 2F of sort h
1 ;::: n ; i ,f(t 1 ;:::t n ) isa -termif t 1 ;:::t n are 1 ;::: n
-termsrespe tively.Sort(t)= ift isa -term.
Anatomi formulaiseithert=t wheretandt aretermsofthesamesort,or
apredi atesymbolappliedtoargumentsofappropriatesorts.Formulasarebuilt
(asusual)fromatomi formulas, onne tors(:,^,_,),),andquanti ers(8,
9). Theset of allvariablesused in formula isnotedVars(),and Free() is
thesetofallfreevariablesin.Aformulais losedifFree()=;.Aformula
is -universallyquanti edifitisoftheform8x withx avariableoftype .
A formula is in prenex form if it is of the form Q
1 x 1 :::Q n x n () where Q 1 ;:::Q n 2 f9;8g, x 1 ;:::x n
2 V, and is quanti er-free. A formula is in
Skolemformifitisinprenexformwithoutexistentialquanti er.
A(normal)interpretationofaformulaonamany-sorted rst-orderlanguage
L=hT;V;F;P;r;diisapairI=hD;Iiwhere
{ Dassignsanon-emptydomainD
(set)toea htype 2T.Thosesetsare
notne essarilydisjoint;
{ I assignsanelementin D
toea hvariable ofsort ;
{ I assignsafun tionD 1 :::D n !D
toea hfun tionsymbolf 2F of
sorth 1 ;::: n ; i ; { Iassignsafun tionD 1 :::D n
!f>;?gtoea hpredi atesymbolp2P
ofsorth
1 ;:::
n i ;
{ theidentityisassigned totheequalitysign(=).
I assigns avalue in D
to every -term t.This valueis notedI[t℄. Similarly,
interpretation I assigns a valuein f>;?g to everyformula , whi h is noted
I[℄. An interpretation I is amodel for formula if I[℄ =>. A formula is
satis ableifthereexists amodelforit.
Given aninterpretation I, the ongruen e C
I;= = f(t i ;t 0 i )jI[t i ℄=I[t 0 i ℄g
isare exive,symmetri andtransitiverelationonthesetof termsof language
L. Thisrelationisimportantfortheproofofthefollowingtheorem.
Theorem1. Given
{ a losedformula S inSkolemformon the languageL=hT;V;F;P;r;di;
{ 2T su hthatthereisnofun tion symbol f 2F of sorth
1 ;::: n ; iwith n>0, 1 ;::: n 2T; the set H
isthe set of onstant symbols of sort (H
=f 2 Fjd( ) = g).
If f 2Fjd( )= g=;, thenH
=fag,wherea isanarbitrary new onstant
symbol su hthata62F anda62V.
For everymodel I=hD;Iiof S,thereisamodel I 0 =hD 0 ;I 0 isu hthat { D 0
isthe quotientof the setH
by ongruen eC I;= ; { D 0 0 =D 0 for every 0 6= ; { I 0
[f℄=I[f℄ forevery fun tionsymbol f 2F ofsort h
1 ;::: n ; 0 isu hthat 1 6= ;::: n 6= ; 0 6= (n0); { I 0
[p℄ = I[p℄ for every fun tion symbol p 2 P of sort h
1 ;::: n i su h that 1 6= ;::: n 6= (n0). 0
{ forevery onstantsymbol ofsort in F,I [ ℄is the lassof inD
;
{ for everyfun tion symbol f 2 F of sort h
1 ;::: n ; 0 i (n > 0), and every d 0 1 2 D 0 1 ;:::d 0 n 2 D 0 n , I 0 [f℄(d 0 1 ;:::d 0 n ) = I[f℄(d 1 ;:::d n ) where d i = d 0 i if i 6= .If i = ,d i =I(d 00 i )whered 00 i
isanyelementofthe lassd 0
i 2D
;
{ for every predi ate symbol p 2 P of sort h
1 ;:::
n
i, and every elements
d 0 1 2 D 0 1 ;:::d 0 n 2 D 0 n , I 0 [p℄(d 0 1 ;:::d 0 n ) = I[p℄(d 1 ;:::d n ) where d i = d 0 i if i 6= .If i = ,d i =I(d 00 i )whered 00 i
isanyelementofthe lassd 0
i 2D
.
ItremainstoshowthatI 0
isamodelofS.Letus rstintrodu eanotation:
given aninterpretationJ =hD;Ji,theinterpretation J
x1=d1;:::xn=dn =hD;J 0 i (wherex 1 ;:::x n
arevariables)issu hthatJ 0 [x i ℄=d i foreveryx i 2fx 1 ;:::x n g andJ 0 [t℄=J[t℄ift62fx 1 ;:::x n g
FormulaSisoftheform8x
1 :::8x
n
().Thusforallelementsd 0 1 ;:::d 0 n su h that d 0 i belongstoD 0 0 ifx i isavariableofsort 0
,thefollowingequalityhold:
I 0 x 1 =d 0 1 ;:::x n =d 0 n [℄=I x 1 =d 1 ;:::x n =d n [℄ with d i =I[d 00 i ℄where d 00 i
isanyelement ofthe lass d 0 i 2D 0 ifx i is ofsort , d i =d 0 i otherwise.
InterpretationI isamodel offormulaS,that meansI
x1=d1;:::xn=dn
[℄=>
forallelementsd
1 ;:::d n whered i belongstoD 0 ifx i isavariableofsort 0 .It followsthatI 0 x1=d 0 1 ;:::xn=d 0 n
[℄=>forallelementsd 0 1 ;:::d 0 n su hthatd 0 i belongs toD 0 0 ifx i isavariableofsort 0 . SoI 0 isamodelofS. ut
Thistheoremisnotexa tlyanextensionoftheHerbrandtheoremto
many-sorted rst-orderlogi .ItisstrongerthantheHerbrandtheorem(seeforexample
[14℄ for thestandardHerbrandtheorem, or [16℄for aversionwith equality)in
thesense that the domaindoesnot ne essarilybe ome in nitein thepresen e
of fun tions. On the other hand, its restri tion to one-sorted rst-order logi
givesba ktheHerbrandtheorem,butrestri tedtothe niteHerbranduniverse
ase.Neverthelessthis aseis themostinterestingone:havinga nite domain
meansthatquanti ereliminationispossible.Considerthesimple(unsatis able)
formula
8i8j[f(i)>g( j)℄ ^ g(a)=3 ^ 9i[f(i)<4℄ (1)
where\<"and\>"aretheusualorderpredi atesonNN.Variablesiandj
and onstantsaandbareofsort 6=Nwhereasf andgarefun tionsfrom to
N.Inthis ontext,thepre edingtheoremstatesthatformula(1)issatis ableif
andonlyifformula
f(a)>g(a) ^ f(a)>g(b) ^ f(b)>g(a) ^
f(b)>g(b) ^ g(a)=3 ^ f(b)<4
is. Thislast formulabelongs to thede idable lass ofquanti er-free rst-order
logi withlineararithmeti sonN anduninterpretedfun tionsymbols.
Corollary 1. A -universally quanti ed formula 8x(x) verifying the
ondi-tionsofTheorem1issatis ableif andonly ifthe nite onjun tion V
2H ( )
A formula ontaininginterpreted predi ates and fun tions is satis able if and
onlyifithasamodelinarestri tedsubsetofallinterpretations,thatistheset
whereinterpretationsasso iatea xeddomaintogivensortsanda xedmeaning
tothoseinterpretedpredi atesandfun tions.InTheorem1,bothinterpretations
IandI 0
asso iatethesamedomaintoeverysortbut ,andgivethesame
mean-ingtoeverypredi ateandfun tion,providednoneoftheirargumentsisofsort .
Inotherwords,Theorem 1is ompatible withtheuseofinterpretedpredi ates
andfun tionsprovidednoneoftheirargumentsisofsort .Forinstan e,inthe
pre edingexample(i,jandaareofsort )theargumentsoftheorderpredi ates
(f(i),g(j),...)arenotofthesort .UsingTheorem1,interpretationI andI 0
are su h that I[<℄=I 0
[<℄and I[>℄=I 0
[>℄. Andthis allowsto eliminatethe
quanti ersonthesort inpresen eofinterpretedpredi ateswithnoargument
ofsort .
Butitisalsopossibletouseorder predi atesonthesortofquanti ed
vari-ables.Let'beaformulawith orderpredi ates(\",...)onsort , and be
the onjun tionoftheaxiomsoftotalordertheory,
= 8x(xx)
^8x8y( (xy^yx))x=y)
^8x8y8z((xy^yz))xz)
^8x8y( xy_yx)
withvariablesx;y;z ofsort .An interpretationisamodelof ^'ifandonly
ifitis amodelof'interpreting\",... astheusual orderpredi atesonD
.
Putting ^' in Skolem form does notintrodu e new Skolemfun tions. The
onditions of Theorem 1are met for ^' ifthey are met for '. Theorem 1
anbeapplied alsoifsome omparisonsaremadebetweentermsof thesortof
quanti edvariables 3
.
4 Quanti er elimination in invariant validation
In order to verify that the assertion H is an invariant of the transition
sys-temS,onehastovalidatetheHoaretriplefHgfHgforea htransition 4
2S.
This is rstredu edto rst-order logi proving,usingDijkstra [9℄weakest
pre- ondition (wp) operator:Hoare tripefHgfHg is valid ifand only if formula
H ) wp[;H℄ an be proved.Weakest pre ondition al ulus is easy, provided
3
Asin[3℄,\+1"and\1"fun tions ansometimesbeeliminatedwithoutintrodu ing
newSkolemfun tions,bynoti ingthath=i+1 !i<h^8j(ji_hj)and
h=i1 