1. Visual Tools for Temporal Reasoning G. Kutty, L.K. Dillon, L.E. Moser, P.M. Melliar-Smith, and Y.S. Ramakrishna

2. What is GIL?  GIL = Graphical Interval Logic  A way of specifying the behavior of concurrent systems  A visual, temporal logic  GIL Editor and toolkit  System designers use it to create graphical specifications of concurrent system behavior  Verify properties of those systems from the specs  Generate models that satisfy the spec

3. Temporal Logic  Used to describe systems that change with time  But people seem to prefer diagrams:  Timing diagrams  State-transition diagrams  Flow charts  Data flow diagrams  Etc.

4. Other diagrams  Pro:  Support intuition  Con:  Can’t be used in formal reasoning about the correctness and consistency of the specifications

5. Other representations  Harel’s State Charts  Milner’s CCS: IDCCS  Manna and Pneuli’s notation  Tecton

6. GIL  models computation as a linear sequence of states  user constructs time intervals  expresses properties that apply to those intervals  interval operator: limits scope of properties to that time interval  vertical dimension -> composition  intervals can be nested

7. Running example  Two concurrent processes that request exclusive use of a shared resource

8. Example 1  sig1 = process 1 signals for exclusive access to the shared resource  sig2 = process 2 signals for exclusive access to the shared resource   “not” : indicates that sig1 and sig2 are false  [-----------]  the interval symbol  left justification means that the conditions hold at the start of the interval

9. Example 2 turn1 = process 1 has priority turn2 = process 2 has priority indentation indicates that the formula holds at every state in the interval indicates that if process 1 has priority then process 2 does not, and vice versa

10. Example 2 [ - includes endpoint -) excludes endpoint

11. Example 3  cs1 = process 1 has exclusive permission to use the resource  if the process with higher priority requests the resource it must be granted permission to access the resource before it cancels the request

12. Example 3  -------  : the search operator; locates the next state at which the formula associated with the arrowhead is true  searches forward until turn1 and sig1 both hold  the interval includes the left endpoint, but excludes the right endpoint  interval ends when sig1 becomes false

13. Example 3  diamond shape means that cs1 holds at some state within the interval  indentation of formula to the right within the outer interval indicates that it holds over the outer interval (it is an invariant property)  if search fails, then interval formula is “vacuously true”

14. Example 4  if process 1 has access to the resource, it will eventually release the resource  when it does, turn2 is set to true, so the other process then has higher priority  double-headed arrow: strong search; asserts that the search operator does not fail, provided prior searches do not fail  right end of inner interval coincides with outer interval; arrow without formula indicates search to end of context

15. Example 5  if process 1 claims the resource and process 2 does not, then process 1 is permitted to enter the critical section

16. Example 6  if process 1 issues sig1 but later cancels sig1 before gaining access to the resource (it can do so when process 2 has priority and also wants access to the resource), it will reissue sig1 at a later time  guarantees that process 1 will keep issuing sig1 until it eventually gains access to the resource

17. Example 6  states in the formula are positioned so that states that correspond to the same points in time are aligned vertically

18. Intervals initial property: holds at the first state of the interval shown invariant property: holds at every state in the interval eventuality property: holds at some state within the interval

19. Intervals a recurring property

20. An interval formula left endpoint: the earliest state at which l-req holds right endpoint: the earliest state at which r-req holds formula asserts that local-req holds in the interval from the left endpoint up to but not including the right endpoint

21.  coming soon (tomorrow)  searches  operators  specifying properties …