640 N. Zhang et al. / Theoretical Computer Science 609 (2016) 639–657
system satisfies the property amounts to proving that S → P is a theorem within the proof system of the logic. Some
famous theorem provers are PVS [16], ACL2 [4], Coq [2], Isab ella [17], HOL [11] and so on.
Verification
of multi-core parallel programs raises a great challenge for theorem proving since it requires that the logic
for modeling multi-core systems and specifying the expected properties has a powerful expressiveness. However, the widely
used Propositional Linear Temporal Logic (PLTL) and Computational Tree Logic (CTL) are not powerful enough. In fact, they
are not full regular. Although Quantified Linear time Temporal Logic (QLTL) [19], Extended Temporal Logic (ETL) [22] and
linear μ-calculus [21] have full regular expressiveness, these logics are not intuitive to use in practice. Propositional Projec-
tion
Temporal Logic (PPTL) [6] allows us to specify ω full regular properties [20]. Further, a decision procedure [9,8] and a
complete proof system for PPTL [10] have been established. A model checker based on SPIN [7] and a theorem prover based
on PVS have also been developed. Cylinder Computation Model (CCM) [23] is a concurrent semantic model which is defined
based on PPTL and has been implemented in the interpreter of MSVL (Modeling, Simulation and Verification Language) [6],
which is an executable subset of Projection Temporal Logic. CCM can be employed to model multi-core parallel programs
since the sequence expressions in it have the nature of regular expressions. With CCM, the autonomy and parallelism of
the processes occupying different cores on one chip can be described neatly and concisely. In [10], we have proposed an
axiom system for PPTL, and proved its soundness and completeness. To specify and verify multi-core parallel programs in
a uniform framework, this paper proposes an axiom system for CCM–PPTL which extends that of PPTL by including trans-
formation
rules for sequence expressions and axioms as well as inference rules on the CCM construct. Furthermore, the
soundness and completeness of the extended axiom system are also proved.
The
paper is organized as follows: in the next section, the underlying logic PPTL and CCM are reviewed. Based on PPTL,
CCM–PPTL is introduced in Section 3, including the syntax, semantics and some logical laws regarding the CCM construct.
In Section 4, an axiom system for CCM–PPTL is formalized. In particular, the axioms, inference rules and the proofs of the
soundness and completeness are given in detail. In Section 5, an example is given to illustrate how to use CCM and its proof
system to model and verify practical algorithms. Finally, conclusions are drawn in Section 6.
2. Preliminaries
Our underlying logic is Propositional Projection Temporal Logic (PPTL), which is an interval-based temporal logic with ω
full regular expressiveness. For more details on PPTL, refer to [6,10].
2.1. Propositional projection temporal logic
2.1.1. Syntax
The
formula P of PPTL can be defined by the following grammar,
P ::= p |P |¬P | P
1
∨ P
2
| (P
1
,...,P
m
) prj P
| (P
1
,...,(P
i
,...,P
l
)
⊕
,...,P
m
) prj P
where p ∈ Prop, P
1
, ..., P
i
, ..., P
l
, ..., P
m
(1 ≤ i ≤ l ≤ m, i, l, m ∈ N
0
) and P are all well-formed PPTL formulas, and , prj
and
prj⊕ (projection-plus) are primitive temporal operators. A formula is called a state formula if it contains no temporal
operators, otherwise it is called a temporal formula.
2.1.2.
Semantics
We
define a state s over Prop to be a mapping from Prop to B.
s : Prop → B
We use s[p] to denote the valuation of p at state s.
An
interval σ is a non-empty sequence of states, which can be finite or infinite. The length, |σ |, of σ is ω if σ is infinite,
and the number of states minus 1 if σ is finite. We consider the set N
0
of non-negative integers and ω, N
ω
= N
0
∪{ω} and
extend the comparison operators, =, <, ≤, to N
ω
by considering ω = ω, and for all i ∈ N
0
, i < ω. Furthermore, we define
as ≤−{(ω, ω)}. To simplify definitions, we will denote σ as s
0
, ..., s
|σ |
, where s
|σ |
is undefined if σ is infinite. With
such a notation, σ
(i... j)
(0 ≤ i j ≤|σ |) denotes the sub-interval s
i
, ..., s
j
and σ
i
(0 ≤ i ≤|σ |) denotes the prefix interval
s
0
, ..., s
i
. The concatenation of a finite σ with another interval (or empty string) σ
is denoted by σ • σ
(not sharing any
states). Let σ =s
0
, s
1
, ..., s
|σ |
be an interval and r
1
, ..., r
h
be integers (h ≥ 1) such that 0 ≤ r
1
≤ r
2
≤ ... ≤ r
h
|σ |. The
projection of σ onto r
1
, ..., r
h
is the interval (called projected interval)
σ ↓ (r
1
,...,r
h
) =s
t
1
, s
t
2
,...,s
t
l
where t
1
, ..., t
l
are obtained from r
1
, ..., r
h
by deleting all duplicates. That is, t
1
, ..., t
l
is the longest strictly increasing
subsequence of r
1
, ..., r
h
.
An
interpretation is a triple I = (σ , k, j), where σ is an interval, k an integer, and j an integer or ω such that 0 ≤ k
j ≤|σ |. We use the notation (σ , k, j) | P to indicate that some formula P is interpreted and satisfied over the subinterval
s
k
, ..., s
j
of σ with the current state being s
k
. The satisfaction relation (| ) is inductively defined in Table 1.