A Methodology for the Formal Analysis of Asynchronous Micropipelines

Formal models of communicating and concurrent systems are one of the most important topics in formal methods, and process calculus is one of the most successful formal models of communicating and concurrent systems. In the previous works, the author systematically studied topology in process calculus, probabilistic process calculus and pi-calculus with noisy channels in order to describe approximate behaviors of communicating and concurrent systems as well as randomness and noise in them. This article is a brief survey of these works.

Alain Martin has developed a design method for asynchronous circuits whereby a specification is refined through a series of distinct stages to a gate implementation. The Circal system is able to check equivalence between terms of the Circal process algebra. The system can be used to verify the results of some of Martin's refinements and the gate implementations. It can also be used to analyse the operator network for the necessity of isochronic forks.

We introduce the first process algebra with non-blocking reading actions for modelling concurrent asynchronous systems. We study the impact this new kind of actions has on fairness, liveness and the timing of systems, using as application Dekker’s mutual exclusion algorithm we already considered in [4]. Regarding some actions as reading, this algorithm satisfies MUTEX liveness already under the assumption of fairness of actions. We demonstrate an interesting correspondence between liveness and the catastrophic cycles that we introduced in [6] when studying the performance of pipelining. Finally, our previous result on the correspondence between timing and fairness [4] scales up to the extended language.

Process algebra provides abstract and rigorous means for studying communicating concurrent systems. Coordination languages also provide abstract means for the specifying and programming communication of components. Hence, the two fields seem to have very much in common and the link between these two research areas have been established formally by means of several translations, mainly from coordination languages to process algebras. There have also been proposals of process algebras whose communication policy is inspired by the one underlying coordination languages. The aim of this workshop was to push the state of the art in the study of the connections between process algebra and coordination languages by bringing together experts as well as young researchers from the two fields to communicate their ideas and findings. It includes both contributed and invited papers that have been presented during the one day meeting on Process Algebra and Coordination (PACO 2011) which took place on June 9, 2011 in Reykjavik, Iceland.

Reversible debuggers help programmers to find the causes of misbehaviours in concurrent programs more quickly, by executing a program backwards from the point where a misbehaviour was observed, and looking for the bug(s) that caused it. Reversible debuggers can be founded on the well-studied theory of causal-consistent reversibility, which only allows one to undo an action provided that its consequences, if any, are undone beforehand. Causal-consistent reversibility yields more efficient debugging by reducing the number of states to be explored when looking backwards. Till now, causal-consistent reversibility has never considered time, which is a key aspect in real-world applications. Here, we study the interplay between reversibility and time in concurrent systems via a process algebra. The Temporal Process Language (TPL) by Hennessy and Regan is a well-understood extension of CCS with discrete-time and a timeout operator. We define revTPL, a reversible extension of TPL, and we show that it satisfies the properties expected from a causal-consistent reversible calculus. We show that, alternatively, revTPL can be interpreted as an extension of reversible CCS with time.

Modern day computer architectures offer ever-increasing support for parallel processing, still it turns out to be quite difficult for programmers and therefore programs to tap into these parallel resources. To benefit from real general-purpose parallel computing we claim that it is likely that a paradigm shift is needed in the way we think about programming. This change of thought in turn will need to be reflected in future programming languages as well. We think that the field of process algebra provides thorough insight in how to reason about the construction of software for concurrent systems and will be one of the enabling technologies supporting this transition. The wish to connect process algebra, a mathematical theory, to the world of computer-readable and executable specifications led to the development of PSF (Process Specification Formalism). PSF is an implementation of the process algebra ACP (Algebra of Communicating Processes) integrating ASF (Algebraic Specification Formalism) to specify algebraic data types. One of the first publications on PSF appeared in Fundamenta Informaticae in 1990. Here we stated as the first sentence of the abstract: "Traditional methods for programming sequential machines are inadequate for specifying parallel systems". Unfortunately, though some advancements have been made since 1990, we can still uphold this statement 20 years later. This current report documents the developments that lead to the construction of PSF and the 1990 publication and moreover it also documents how PSF and its tools have evolved since 1990 taking the conclusion and the outlook for future work from the original article as a reference point. Using the knowledge gained both in constructing tools for PSF and in using PSF to specify concurrent systems, we will judge, discuss and criticise the design decisions taken and show paths for future developments.

Process algebra provides essential tools for studying concurrent systems. An important branch of process algebra is value passing CCS. However, value passing CCS lacks not only action refinement, which is an essential operation in the design of concurrent systems, but also non-interleaving semantics, which is appropriate to specify the partial order and equivalence relations. In this paper, we will define action refinement and non-interleaving semantics by valued stable event structures and valued labeled configuration structures in which special valued actions will be executed. The refinement operation and semantics are useful for the hierarchical design methodology in value passing CCS, e.g. top-down system design.

Recent advances in deep learning have enabled data-driven controller design for autonomous systems. However, verifying safety of such controllers, which are often hard-to-analyze neural networks, remains a challenge. Inspired by compositional strategies for program verification, we propose a framework for compositional learning and verification of neural network controllers. Our approach is to decompose the task (e.g., car navigation) into a sequence of subtasks (e.g., segments of the track), each corresponding to a different mode of the system (e.g., go straight or turn). Then, we learn a separate controller for each mode, and verify correctness by proving that (i) each controller is correct within its mode, and (ii) transitions between modes are correct. This compositional strategy not only improves scalability of both learning and verification, but also enables our approach to verify correctness for arbitrary compositions of the subtasks. To handle partial observability (e.g., LiDAR), we additionally learn and verify a mode predictor that predicts which controller to use. Finally, our framework also incorporates an algorithm that, given a set of controllers, automatically synthesizes the pre- and postconditions required by our verification procedure. We validate our approach in a case study on a simulation model of the F1/10 autonomous car, a system that poses challenges for existing verification tools due to both its reliance on LiDAR observations, as well as the need to prove safety for complex track geometries. We leverage our framework to learn and verify a controller that safely completes any track consisting of an arbitrary sequence of five kinds of track segments.

The open calculus of constructions integrates key features of Martin-Löf's type theory, the calculus of constructions, membership equational logic, and rewriting logic into a single uniform language. The two key ingredients are dependent function types and conditional rewriting modulo equational theories. We explore the open calculus of constructions as a uniform framework for programming, specification and interactive verification in an equational higher-order style. By having equational logic and rewriting logic as executable sublogics we preserve the advantages of a first-order semantic and logical framework and we provide a foundation for a broad spectrum of applications ranging from what could be called executable mathematics, involving symbolic computations and logical proofs, to software and system engineering applications, involving symbolic execution and analysis of nondeterministic and concurrent systems.

Quantum cryptographic systems have been commercially available, with a striking advantage over classical systems that their security and ability to detect the presence of eavesdropping are provable based on the principles of quantum mechanics. On the other hand, quantum protocol designers may commit much more faults than classical protocol designers since human intuition is much better adapted to the classical world than the quantum world. To offer formal techniques for modeling and verification of quantum protocols, several quantum extensions of process algebra have been proposed. One of the most serious issues in quantum process algebra is to discover a quantum generalization of the notion of bisimulation, which lies in a central position in process algebra, preserved by parallel composition in the presence of quantum entanglement, which has no counterpart in classical computation. Quite a few versions of bisimulation have been defined for quantum processes in the literature, but in the best case they are only proved to be preserved by parallel composition of purely quantum processes where no classical communications are involved. Many quantum cryptographic protocols, however, employ the LOCC (Local Operations and Classical Communications) scheme, where classical communications must be explicitly specified. So, a notion of bisimulation preserved by parallel composition in the circumstance of both classical and quantum communications is crucial for process algebra approach to verification of quantum cryptographic protocols. In this paper we introduce a novel notion of bisimulation for quantum processes and prove that it is congruent with respect to various process algebra combinators including parallel composition even when both classical and quantum communications are present. We also establish some basic algebraic laws for this bisimulation. In particular, we prove uniqueness of the solutions to recursive equations of quantum processes, which provides a powerful proof technique for verifying complex quantum protocols.

Mutual exclusion is one of the most commonly used techniques to handle contention in concurrent systems. Traditionally, mutual exclusion algorithms have been designed under the assumption that a process does not fail while acquiring/releasing a lock or while executing its critical section. However, failures do occur in real life, potentially leaving the lock in an inconsistent state. This gives rise to the problem of recoverable mutual exclusion (RME) , which involves designing a mutual exclusion (ME) algorithm that can tolerate failures while maintaining required safety and liveness properties. In this work, we present a framework that transforms any algorithm that solves the RME problem into an algorithm that can also simultaneously adapt to (i) the number of processes concurrently competing for the lock, as well as (ii) the number of unresolved failures in the system, while maintaining the correctness properties and performance characteristics of the underlying RME algorithm. Additionally, the algorithm constructed as a result of this transformation adds certain desirable properties such as bounded recovery and fairness. One of the important performance measures of any ME algorithm, including an RME algorithm, is the number of remote memory references (RMRs) made by a process—to acquire and release a lock, as well as to recover the lock structure after a failure. Let R(n) denote the RMR complexity of a critical section request in the underlying RME algorithm, where n denotes the number of processes in the system. Then, our framework yields an RME algorithm for which the RMR complexity of a critical section request is given by \(\mathcal {O}(\min \lbrace \ddot{c},\sqrt {F+1},\ R(n) \rbrace)\) , where \(\ddot{c}\) denotes the point contention of the request and F denotes the failure-density of the request. We further extend our framework by presenting a novel memory reclamation algorithm to bound the space complexity of the RME algorithm. Our memory reclamation algorithm maintains the correctness, performance, and fairness properties of our transformation. Our approach is general enough that it may also be used to bound the space complexity of other RME algorithms. In addition to read and write instructions, our algorithm uses compare-and-swap ( CAS ) and fetch-and-store ( FAS ) hardware instructions, both of which are commonly available in most modern processors.

This paper proposes a method of transformation of time Petri net into Promela in order to verify their behavioral properties of the timed systems. The concurrent systems, with time attributes on transactions, are typically written in time Petri net. For quantitative and qualitative analysis of their properties, these time Petri net would be transformed into Promela beforehand. We also propose the linear temporal formula to specify the correctness properties. The proposed transforming method copes with the representation of both Petri net structure and its dynamic behavior. The token flows in time Petri net are modelled into Promela code, hence the implicit dynamic behavior would be practically described in the model. The resulting Promela code is simulated and verified by SPIN tool and reveals that not only the time related behaviors would be evaluated, but also the qualitative properties, such as safety and liveness.

Modern radio telescopes, like the proposed Square Kilometre Array (SKA), are extremely sensitive and the faint signals they receive can easily be contaminated irreversibly by stray radio frequency interference (RFI). Understanding how radio telescope performance is degraded by RFI is important. In this paper we describe an RFI simulation framework that can be used to generate test stimulus and verify a telescope’s performance. The framework can be used during design to investigate the impact of various RFI scenarios and develop mitigation strategies. As well, it can be used to exercise and test hardware firmware after a system is installed. A prototype of the framework was implemented in the Python computer language to demonstrate the key concepts. Additionally, we outline the framework requirements, describe a suitable software structure and discuss a prototype implementation. As well, we present measurements made to verify the software generates correct test stimulus, for RFI from aircraft distance measuring equipment (DME). The work described was carried out to evaluate the impact of RFI on the Square Kilometre Array, an international effort to build the largest most sensitive radio telescope.

With the rapid evolution of mobile communication technology, the short message service (SMS) is the most important and essential operating business. The Pi calculus is a process algebra that describes the concurrent, dynamic and mobile systems. This paper depicts the behaviors of SMS service based on Pi calculus, including the formal description of fixed and mobile area. The formal model for SMS service is introduced and the storage-transmit mechanisms are discussed. The mobility features are represented with Pi calculus that the mobile process is controlled by switching the channel and the moving user still accurately receives any message. The formalizations can be used as a basis for future research on other mobile computing or wireless communication.

We develop a logic-based framework for formal specification and algorithmic verification of homogeneous and dynamic concurrent multi-agent transition systems. Homogeneity means that all agents have the same available actions at any given state and the actions have the same effects regardless of which agents perform them. The state transitions are therefore determined only by the vector of numbers of agents performing each action and are specified symbolically, by means of conditions on these numbers definable in Presburger arithmetic. The agents are divided into controllable (by the system supervisor/controller) and uncontrollable, representing the environment or adversary. Dynamicity means that the numbers of controllable and uncontrollable agents may vary throughout the system evolution, possibly at every transition. As a language for formal specification we use a suitably extended version of Alternating-time Temporal Logic, where one can specify properties of the type “a coalition of (at least) n controllable agents can ensure against (at most) m uncontrollable agents that any possible evolution of the system satisfies a given objective gamma″, where gamma is specified again as a formula of that language and each of n and m is either a fixed number or a variable that can be quantified over. We provide formal semantics to our logic {mathcal {L}}_{textsc {hdmas}} and define normal form of its formulae. We then prove that every formula in {mathcal {L}}_{textsc {hdmas}} is equivalent in the finite to one in a normal form and develop an algorithm for global model checking of formulae in normal form in finite HDMAS models, which invokes model checking truth of Presburger formulae. We establish worst case complexity estimates for the model checking algorithm and illustrate it on a running example.