Citation Context

...of formulas of some logic. Properties are derived from the program text by special proof rules, and from other properties by reasoning within the logic. Hoare's popular method for sequential programs =-=[Hoa69]-=- uses an Algol-like programming language and a logic of Hoare triples. A program logic expresses both programs and properties with a single language. Program # satisfies property P if and only if # # ...

Citation Context

...tended version of the simplest form of temporal logic. Formulas can be built from elementary formulas using only logical operators (, #, . . . ) and the one temporal operator #, which means "fore=-=ver" [Pnu77]-=-. There are two types of elementary formulas: ones of the form [A], where A is an action, and state predicates. An action is a boolean-valued expression containing primed and unprimed variables, such ...

Citation Context

...s, which assert that something bad does not happen, and liveness properties, which assert that something good eventually does happen. (Safety and liveness are defined formally by Alpern and Schneider =-=[AS85]-=-.) Although the proofs of both types of properties can be carried out in the same temporal logic of actions, they use di#erent styles of reasoning. 4.1 Safety Properties Assertional methods for provin...

Citation Context

... use di#erent styles of reasoning. 4.1 Safety Properties Assertional methods for proving safety properties, including Floyd's method for sequential programs, and the Ashcroft [Ash75] and Owicki-Gries =-=[OG76]-=- 12 methods for concurrent programs, all have the same logical basis: the Invariance Rule is used to prove a formula |= # # #P , for some predicate P . We give two simple examples of how such proofs a...

Citation Context

...oare triples. A program logic expresses both programs and properties with a single language. Program # satisfies property P if and only if # # P is a valid formula of the logic. Pratt's dynamic logic =-=[Pra76]-=- is a well-known program logic. The temporal logic of actions is a new logic for expressing concurrent programs and their properties. It is a slightly extended version of the simplest form of temporal...

Citation Context

...ple, a simple calculation shows that this action equals y # - y = x # + x # y # - y = 3x - x # + 2. The actions used to describe a program bear a striking resemblance to statements in a Unity program =-=[CM88]-=-. It is easy to translate a Unity program into a formula in the temporal logic of actions. The translation in the other direction would also be easy, except that the logic permits a 1 We take # to hav...

Citation Context

...t existing "assertional" proof methods are adequate: safety properties are proved by invariance arguments [LS84, OG76], and liveness properties are proved by counting-down arguments or proof=-= lattices [OL82]-=-. The logic just provides a convenient way of formalizing the proofs. Since these proof methods are not new, there is no need for realistic examples. We illustrate the logic with the simple program of...

Citation Context

... logic of actions, with quantification over state variables, can serve as the logical foundation for the transition-axiom method---a hierarchical method of specifying and verifying concurrent systems =-=[Lam89]-=-. 19 6 Conclusion Pnueli [Pnu77] introduced a temporal logic for reasoning about programs that was based on predicates, logical operators, and the single temporal operators#. It was soon recognized th...

Citation Context

...al logic of actions, they use di#erent styles of reasoning. 4.1 Safety Properties Assertional methods for proving safety properties, including Floyd's method for sequential programs, and the Ashcroft =-=[Ash75]-=- and Owicki-Gries [OG76] 12 methods for concurrent programs, all have the same logical basis: the Invariance Rule is used to prove a formula |= # # #P , for some predicate P . We give two simple examp...

Citation Context

...which are not easily expressed with Unity. Giving up any pretense of having a "real" programming language allows us to merge program and logic. Our logic may be viewed as a generalization of=-= Hehner's [Heh84]-=-. While Hehner's logic deals only with partial correctness, the temporal logic of actions can express invariance properties, which generalize partial correctness, and simple fairness properties that g...

Citation Context

...seem adequate for proving invariance and leads-to properties. Martn Abadi has developed a complete proof system for the propositional case, where predicates and actions are just uninterpreted symbols =-=[Aba90]-=-. The style of reasoning used in the simple logic can be extended to the general temporal logic of actions. In the absence of quantification over state variables (hiding of internal variables), such r...

Citation Context

... {P}A{Q} and P # A # R # for {P}A{R}, since Q # R implies Q # # R # . 3 Language-based proof rules, such as Hoare's "Rule of Iteration" for a while statement, are replaced by the "Decom=-=position Rule" [LS84]-=- |= {P} A # B {Q} = {P} A {Q} # {P} B {Q} (4) which follows from the definition of a Hoare triple as an action. 2.3 Temporal Logic 2.3.1 Behaviors A behavior is an infinite sequence of states; the set...

Citation Context

...uting device has stopped when it no longer changes state.) Remember that S # contains all sequences of states; most of them do not represent executions of any program. In a linear-time temporal logic =-=[Lam80]-=-, the meaning of a formula is a boolean-valued function on the set S # of behaviors. The meaning of a logical combination of temporal formulas is defined in the obvious way---for example, [[F ]](#) # ...

Citation Context

... WF, and SF rules; some rules relating [A] u and [A] v for di#erent u and v; and simple temporal reasoning. The general logic is completed by adding quantification over state variables, as defined in =-=[AL88]-=-. Intuitively, if formula # represents a program with a variable w, then #w : # represents the same program except with w hidden (made internal). In our example, the formula #sem, pc 1 , pc 2 : # desc...