Miquel Bertran

Transformation-Based Reactive Systems Development

Crucial notions on which Computer Science is based originated in Ramon Llull (a 13th-century philosopher from Majorca). Here we explore some of his original insights --and his plausible inspiration sources-and how these ideas have been available to us by way of Leibniz (and others). 1 I n t r o d u c t i o n Something unusual has happened to Ramon Llull (Raimundus Lullus, 12321316), the franciscan thinker from Majorca. He has been at the same time derided and hailed as a philosopher. He has been instrumental in creating our foundational insights as computer scientists and logicians, yet he occupies a very minor place in the histories of Philosophy, Mathematics or Logic. He was one of the first philosophers to claim a logical basis for religious belief yet he has been considered a source of alchemy, cabbalistics and mysticism. He is considered a conceited eccentric fool and jus t read Martin Gardners 1958 piece--a maze of confused thinking, but such indictment hardly squares with the undeniable fact that he had foresights which anticipated developments 700 years in the future. So, what is the t ruth? and what is the man? That Llull is really a marginal sidepiece in the history of Western Philosophy is clear--as it was to him. And, because he resented it, he innovated, and tried to convince the Parisian intellectuals that his innovative ideas had meri t to no avail. He was not understood at his first Sorbonne appearance in 1289. His combinatorics were definitely not the method to use for logical analysis (causal chaining was). When he came back in 1309-11 with a more accessible system he was greeted with a flurry of sympathy rather than real acceptation. Some found in him a firm advocate of basing faith solely on logic, and all understanding on reason (against the revelationists and the mystically-inclined). But after his death the sympathy faded out, a victim of the Inquisition and the dominicanfranciscan 14th-century struggle. In an ironic twist, Llull, who had always put logic before faith, and had done this by propounding innovative ideas, became a thinker derided by the first science pioneers (Bacon or Descartes, who had a lot to thank him for), while he became the hero of alchemists, cab balists and general mystics (thanks to being attributed authorship of esoteric apocrypha). The usual charge today (for Gardner, as it was for Descartes), that his thinking was actually confused, is not the whole reason for the misrepresentation of Llulls thought: confusion between religious faith, ethical motives, apologetics

An Input/Output Semantics for Distributed Program Equivalence Reasoning

A new notion of input/output equivalence of distributed imperative programs, with synchronous communications, is introduced. It preserves the input/output relation, encompassing both, initial/final state and communication channel values. For its mathematical justification, the semantic framework of Manna and Pnueli, based on finite transition systems and reduced behaviors, is extended with the notion of input/output behavior. A set of laws for the equivalence is overviewed. A deduction rule for the substitution of references to input/output equivalent procedures is defined and justified in the new semantics. The rule is applied to decompose distributed program simplification proofs, introduced in a prior work, which use the laws to establish the equivalence between a sequential and a parallel communicating program. They include communication elimination as one of their steps. An outline of one of such proofs, for a pipelined processor model, is included.

Communication and Parallelism Introduction and Elimination in Imperative Concurrent Programs

Transformation rules of imperative concurrent programs, based on congruence and refinement relations between statements, are presented. They introduce and/or eliminate synchronous communication statements and parallelism in these programs. The development is made within a subset of SPL, a good representative of imperative notations for concurrent and reactive programs introduced by Manna and Pnueli. The paper shows that no finite set of transformation rules suffices to eliminate synchronous communication statements from programs involving the concatenation and parallelism operators only. An infinite set is given to suit this purpose, which can be applied recursively. As an important complement for the applications, a collection of tactics, for the acceleration of broader transformations, is described. Tactics apply a sequence of rules to a program witha specific transformation objective. The transformation rules and the tactics could be used in formal design to derive new programs from verified ones, preserving their properties, and avoiding the repetition of verifications for the transformed programs. As an example, the formal parallelization of a non-trivial distributed fast Fourier transform algorithm is outlined.

Formal Sequentialization of Distributed Systems via Program Rewriting

Formal sequentialization is introduced as a rewriting process for the reduction of parallelism and internal communication statements of distributed imperative programs. It constructs an equivalence proof in an implicit way, via the application of equivalence laws as rewrite rules, thus generating a chain of equivalent programs. The variety of the possible sequentialization degrees which are attainable is illustrated with an example. The approach is static, thus avoiding the state explosion problem, has an impressive state-vector reduction in many cases, and could be combined, as a model simplification step, with model checking and interactive theorem proving in system verification. Prior grounding results needed in formal sequentialization are overviewed; more specifically, an algorithm for the automatic elimination of communications under the scope of sequential and parallel compositions, elimination laws which the algorithm applies, and a suitable equivalence criterion for the sequentialization process. The main contribution of this work is the extension of these results to encompass the formal elimination of both synchronous communications embedded within a subclass of selection statements, and of non-disjoint synchronous communication pairs. None of these cases has been treated in the literature before, and their solution considerably widens the application domain of formal sequentialization.

Communication Extended Abstract Types in the Refinement of Parallel Communicating Processes

A systematic refinement transformation of a program involving processes communicating through simple rendez-vous type connections is described. Both new connections and new processes are introduced in the refined program form. The refinement is based in the concept of Communications Extended Abstract Type (CAT), which is also covered, and it amounts to either selecting, or unhiding, a CAT implementation.

Formal communication elimination and sequentialization equivalence proofs for distributed system models

Equivalence reasoning with distributed system models, expressed directly as imperative programs with explicit parallelism, communication operations, storage variables and boolean conditions, remains virtually unexplored. Only reasoning with models expressed as process algebras has been amply dealt with in literature. However, these formalisms do not contemplate either storage variables or Boolean conditions as fundamental items, although these items become essential in most situations. This article develops the foundation of the until now non existent theory of equivalence reasoning with the aforementioned imperative notation and two novel equivalence proof techniques: communication elimination and sequentialization. The development is grounded on state systems and transition interleavings, as treated by Manna and Pnueli. Equivalence proofs safely transform a model via the application of a sequence of equivalence laws; aiming to obtain an equivalent model which is purely sequential, free from internal communication operations and parallelism, as a simplification of the initial model. After this, verification of the original model can be carried out, indirectly, in the simplified model, thus reducing complexity. Some of the presented novel notions are: (1) modular procedure for decomposition of both models and proofs, (2) interface behavior for statement semantics, (3) interface equivalence between behaviors, between statements and between procedures, (4) a set of communication elimination laws and (5) substitution rules of procedure references by their bodies or by references to equivalent procedures. An elimination proof construction algorithm is also presented; when it terminates, deadlock freedom of the original model can be decided. The main design lines of a computer aided equivalence reasoning tool are outlined as well. This is the foundation for a more widely applicable tool. As an illustration, the sequentialization proof of a simplified pipelined processor is overviewed. It is modeled as a distributed system with procedures and two levels of parallelism. The model obtained at the end of the equivalence proof is the sequential loop of a Von Neumann processor. This result establishes that the original model is deadlock-free, behaves as a processor and, as a consequence, the partition of processor functions among parallel processes is correct. The ratio of the upper bounds on the number of states of the final over the initial models,

FME '94: Industrial Benefit of Formal Methods

frac{final}{initial}

A static communication elimination algorithm for distributed system verification

finalinitial, is