Page 1

Modeling Systems in CLP with Coinductive Tabling

JOXAN JAFFAR, ANDREW E. SANTOSA, AND R˘ AZVAN VOICU

School of Computing

National University of Singapore

{joxan,andrews,razvan}@comp.nus.edu.sg

Abstract. We present a methodology for the modelling of complex program be-

havior in CLP. The first part of this paper is an informal description about how

to represent a system in CLP. At its basic level, this representation captures the

precise trace semantics of concurrent programs, or even high-level specifications,

in the form of a predicate transformer. Based on traces, the method can also cap-

ture properties of the underlying runtime system such as the scheduler and the

microarchitecture, so as to provide a foundation for reasoning about resources

such as time and space.

The second part of this paper presents a formal and compositional proof

method for reasoning about safety properties of the underlying system. The idea

is that a safety property is simply a CLP goal, and is proof established by exe-

cuting the goal by a CLP interpreter. However, a traditional CLP interpreter does

not suffice. We thus introduce a technique of coinductive tabling to CLP. Essen-

tially, this extends CLP so that it can inductively use proof obligations that are

assumed but not yet proven, and it can generate new proof obligations assertions

dynamically.

1 Introduction

Constraint Logic Programming (CLP) [11] has been successful as a framework for

executable specifi cations, and several CLP systems have been successfully deployed

widely in application areas such as artifi cial intelligence and combinatorial optimiza-

tion (see eg. [14]). Its competitive advantage is expressive power coupled with a pow-

erful inference method. In this paper, we present a systematic application of CLP to

reasoning about complex program behavior.

We start with an informal but broad coverage of how to model various aspects of

the operation semantics of programs. Starting with the basic concepts of strongest-

postcondition and weakest-precondition, we then consider sequential and concurrent

systems, including perpetual processes, and various synchronization mechanisms. Our

modeling of these operational concepts is exact in the sense that the trace semantics of

the underlying program is represented in the CLP model. Going further, we show how

also to model the machine in which the program executes, focusing in particular, on the

scheduler for nondeterministic actions (such as the choice of which process to execute

next) and on the microarchitecture, which is often critical in determining the cost of

execution. We thus cover reasoning not only about the values of program variables, but

alsoaboutresources.At theendofthissection,weshowthata safetyproofofa program

Page 2

is established by executinga particulargoal against the CLP modelof the program,thus

providing a generic and compositional methodology for program reasoning with CLP.

However, basic CLP is not quite suffi cient for this purpose.

The second part of this paper contains the main technical contribution: extending

basic CLP with coinductive tabling. Essentially, this extends CLP so that it can induc-

tively use proof obligations that are assumed but not yet proven, and it can generate

new proof obligations assertions dynamically. This technique is akin to the notion of

tabling in logic programming systems (see eg. [18]) in that the main purpose is to ob-

tain termination when dealing with recursion. In standard tabling, procedure calls and

their answers are tabled so as not to repeatthem. In our tabling,the main differencesare

fi rst that the setting is CLP and not just logic programming, and more importantly, that

proof obligationsand notjust calls are tabled.(We donot table answers.)Terminationis

obtained by applying a principle of coinduction (see eg: Appendix B of [15]), that is: a

recursiveproofobligationmaybe provedby assuming that a precedingproofobligation

is true.

Finally, we briefly discuss some important extensions that are not covered in this

paper. The most important extension concerns the use of abstraction, in the manner

of abstract interpretation [4]. We shall just explain that our proof method may be aug-

mented by a liberally applying a notion of abstraction to a goal in a proof, preserving

correctness. The advantage of abstraction is, of course, to enhance the process of ter-

mination. Another important extension is to deal with liveness or progress. Here, we

discuss briefly how to include a notion of well-founded induction. Finally, we mention

how to deal with an unboundednumber of processes, ie: parameterized systems.

1.1 Related Work on CLP and Program Reasoning

There has been some recent work on using logic programs to describe concurrent pro-

grams, and which employ a systematic algorithm. Work based on the XSB and XMC

systems [17] used assertions based on the µ-calculus and executed the logic program

representations of programs and assertions using a tabling mechanism. Delzanno and

Podelski [6] showed that a transition system and its CTL-based verifi cation conditions

can be translated into a CLP program in way that the symbolic CLP fi xpoint opera-

tions can be used in the proof process. There are other works using CLP to describe

program behavior, eg. that by Flanagan [8] for imperative programs, and that by Gupta

and Pontelli [9] for timed automata, but these do not describe a systematic CLP-based

algorithm.

2 CLP Preliminaries

We fi rst briefly overview CLP [11]. The universe of discourse is a set of terms, inte-

gers, and arrays of integers. A constraint is written using a language of functions and

relations. They are used in two ways, in the base programminglanguageto describe ex-

pressions and conditionals, and in user assertions, defi ned below. In this paper, we will

not defi ne the constraint language explicitly, but invent them on demand in accordance

Page 3

with our examples. Thus the terms of our CLP programs include the function symbols

of the constraint language.

An atom, is as usual, of the form p(˜ t) where p is a user-defi ned predicate symbol

and the ˜ t a tuple of terms. A rule is of the form A:-˜B,φ where the atom A is the head

of the rule, and the sequence of atoms˜B and the constraint φ constitute the body of the

rule. A goal G has exactly the same format as the body of a rule. We say that a rule is

a (constrained) fact if˜B is the empty sequence. A ground instance of a constraint, atom

and rule is defi ned in the obvious way.

Let G = (B1,··· ,Bn,φ) and P denote a goal and program respectively. Let R =

A:-C1,··· ,Cm,φ1denote a rule in P, written so that none of its variables appear in

G. Let A = B, where A and B are atoms, be shorthand for equations between their

corresponding arguments. A reduct of G using R is of the form

(B1,··· ,Bi−1,C1,··· ,Cm,Bi+1,··· ,Bn,Bi= A∧φ∧φ1)

provided Bi= A∧φ∧φ1is satisfi able.

A derivation sequence is a possibly infi nite sequence of goals G0,G1,··· where

Gi,i > 0 is a reduct of Gi−1. If there is a last goal Gnwith no atoms, notationally (?,φ)

and called a terminal goal, we say that the derivation is successful and that the answer

constraint is φ. A derivation is ground if every reduction therein is ground.

In what follows, we shall only be concerned with goals that contain at most one

atom. Thus the reduct of a goal is deterministic on the rule that is employed.

Definition 1 (Unfold). Given a program P and a goal G which contains one atom.

Then unfold(G) is the set of reducts obtainedby using all the rules. An unfoldoperation

on G results in a subset of unfold(G); we say the operation is complete if it returns

all of unfold(G). An unfold tree of G (sometimes also called a proof tree) is a tree of

goals obtainedby successively applyingunfold operationson G, and then on the results

of the previous operation, etc. We say that the unfold tree is complete if all the unfold

operations used in its construction were complete1.

3 Modeling in CLP

We start by modeling the program P with variables˜X as a predicate transformer [7]

by fi rst identifying target variables˜Xtcorrespondingto˜X, and then establishing a con-

straint on˜X and˜Xt.

3.1 The Logical Basis of CLP Modeling

To outline the predicate transformer aspect of a (possibly nondeterministic) program,

weexpressitssemanticsasasetofCLPclausesthatdefi nethepredicatestate(PP,˜X,˜Xt),

where the logic variables˜X and˜Xtrepresent values of program variables at program

point PP, and at a target program point, respectively. The state predicate realizes the

followingrelation: if˜X are values of variablesat programpointPP, then˜Xtare possible

values of the program variables at the target program point. There are two alternatives

1Thus a complete tree is not necessarily one where unfold operations have been exhaustively

performed; rather, it is where each unfold operation used was complete.

Page 4

forimplementingsuch a relation:bottomup, usingstrongestpostconditionpropagation,

and top-down,using weakest preconditionpropagation.We introducethese conceptsby

example.

Consider the simple program <0> x := x + 1 <1> where 0 denotes the entry

point and 1 denotes the exit point. The bottom-up CLP model of this program is:

state(0, X, Xt) :- state(1, X + 1, Xt).

state(1, X, X).

Runningagoalsuchas ?- state(0, X, Xt), X > 5,wouldreturnXt > 6,thestrongest

postcondition of P when run with input x > 5. Similarly, the top-down CLP model:

state(1, X, Xt) :- state(0, X - 1, Xt).

state(0, X, X).

capturestheweakestpreconditionofP.Running ?- state(1, X, Xt), X > 5,would

return Xt > 4.

This simple idea is reminiscent of Hoare-like specifi cations of programs, such as

{x > 5} x := x + 1 {x > 6} or {x > 4} x := x + 1 {x > 5}, using the above

examples. However, our approach is more powerful, in the sense that it can represent

properties of nonterminating programs. Consider for example the program <0> while

(true) x := x + 1 <1> endwhile <2> where the program points 0, 1 and 2 are

displayed. The bottom-up CLP model:

state(0, X, Xt) :- state(1, X + 1, Xt).

state(1, X, Xt) :- state(1, X + 1, Xt).

state(1, X, X).

captures in Xt all the values of X that can appear at program point 1. That is, the goal

?- state(0, X, Xt), X > 5, for example, has as solutions: Xt > N for all N > 6.

Figure 1 shows a while program and both its top-down and bottom-up CLP mod-

els. The target program points are 3, for the bottom-up model, and 0 for the top-down

model.We notethatfortop-downmodels,targetvariablesare requiredonlybythecom-

positional nature of our modeling. While this is an important feature, it is not the topic

of interest in many of our examples; thus, for clarity, we remove the target variables

from such examples.

We note that we could enhance the CLP model of a program such that the target

program point become a parameter of the state predicate. The major benefi t of this

approach is that the CLP model of the program at hand allows queries on multiple

target program points. Moreover, it is rather obvious that such a CLP model could be

automatically derived for any program. While this approach is of practical importance,

and has a straightforward implementation, it would unnecessarily complicate our ex-

amples. To illustrate our points, we shall rather use specialized, manually derived CLP

models in our examples.

3.2Concurrency

Consider our next example user program shown in Figure 2, a two-process Bakery mu-

tual exclusion algorithm. Note that the point ?2? indicates the critical section. Initially,

t1= t2= 0. The CLP model is shown in Figure 3. Note that we now use a pair of pro-

gram points, instead of just one. Note also that we consider “blocking” concurrency

Page 5

?0? while (i < n) do

?1?

?2? end ?3?

i := i + 1

Top-Down Model

state(0,I,N,I,N) :- I=0, N≥0.

state(1,I,N,It,Nt) :- I<N, state(0,I,N,It,Nt).

state(1,I,N,It,Nt) :- I<N, state(2,I,N,It,Nt).

state(2,I+1,N,It,Nt) :- state(1,I,N,It,Nt).

state(3,I,N,It,Nt) :- I≥N, state(0,I,N,It,Nt).

state(3,I,N,It,Nt) :- I≥N, state(2,I,N,It,Nt).

Bottom-Up Model

state(0,I,N,It,Nt) :- I≥N, state(3,I,N,It,Nt).

state(0,I,N,It,Nt) :- I<N, state(1,I,N,It,Nt).

state(1,I,N,It,Nt) :- state(2,I+1,N,It,Nt).

state(2,I,N,It,Nt) :- I<N, state(3,I,N,It,Nt).

state(2,I,N,It,Nt) :- I≥N, state(3,I,N,It,Nt).

state(3,I,N,I,N).

Fig.1. Simple While Program

while (true) do

t1 := t2 + 1

await (t1<t2 ∨ t2=0)

t1 := 0

end

?0?

?1?

?2?

while (true) do

t2 := t1 + 1

await (t2<t1 ∨ t1=0)

t2 := 0

end

?0?

?1?

?2?

Fig.2. Bakery-2

here, that is, we have an “await” statement, which is modelled to block until the speci-

fi ed condition holds. The safety property of interest, mutual exclusion, can be obtained

by proving that ?- state([2,2], T1, T2) has no solutions.

In this example, we adopted an asynchronous composition (instructions interleav-

ing) of processes. Our frameworkis also flexible enoughto model synchronouscompo-

sition, as exemplifi ed in [13]. It is also possible to replace the awaits with busy loops,

obtaining non-blocking concurrent programs.

3.3 High-Level Specifications

Consider a timed automaton [1] in Figure 4 describing a daily schedule of a worker. In

this example,the variabley is nota clock,buta simplecontinuous(realorrational)vari-

able. Constraints involving both clocks and dynamically changing variables, as shown,

cannot be handled by current timed automata model checkers. This is because the stan-

dard algorithms depend on an analysis of clock regions, which use a more restrictive

class of real constraints. Here, we may query if a worker can be out of the house for

more than 20 hours, for example, by showing that ?- state(0,X,Y,Z) implies Y ≤

20.

We show our top-down CLP model in Figure 5. See [13] for more details and ex-

amples of CLP modeling of timed automata.