FIFO RTA: Coq Proof of Soundness

This folder provides the formal proof of soundness discussed in Section IV of the paper and instructions for checking its correctness. The proof is a part of the Prosa open-source library, a snapshot of which is included in this package.


Table of Contents:


Folder Contents

This folder provides the following instructions:


The Prosa folder includes a snapshot of the Prosa open-source library:


Finally, we provide two scripts for running the experiments within a Docker container in the Docker directory:

Step 0 — Setup and Preliminaries

Environment

The following instructions have been tested on macOS 12.4 “Monterey”. They are also expected to work on recent mainstream Linux distributions such as Ubuntu 22.04 LTS.

NB: Microsoft Windows is not supported.

The following standard software is required and assumed to already be in place:

Installing OPAM

OPAM is the OCaml Package Manager, which we will use to obtain a working installation of the Coq toolchain. Users who already have a working OPAM setup can skip this step.

The OPAM project provides comprehensive installation instructions, including a downloadable auto-installation script:

bash -c "sh <(curl -fsSL https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh)"

However, on most recent Linux distributions, OPAM can be easily installed via the package manager. For example, in the case of Ubuntu 22.04 LTS, a sufficiently recent version of OPAM can be installed simply via apt:

apt install opam

On macOS, the best way to install OPAM is via either the Homebrew or MacPorts package manager.

Homebrew (➔ homepage):

brew install opam

MacPorts (➔ homepage):

port install opam

Initializing OPAM

After installing OPAM, run the following command to initialize its dot-file directory ~/.opam.

opam init 

Installing Coq

We will now install a clean Coq toolchain suitable for Prosa using OPAM’s “switch” functionality. To this end, run the following commands:

opam switch create Coq-8.15-for-Prosa 4.13.1 
eval $(opam env --switch=Coq-8.15-for-Prosa)
opam update
opam install -y 'coq=8.15.2'

This will take a while, but has the advantage of not disturbing any other OPAM switches or Coq versions that may already be installed.

The following steps all assume that the above-created OPAM switch is activated in the current shell session. If in doubt, first run the following command in your terminal before any of the other commands:

eval $(opam env --switch=Coq-8.15-for-Prosa)

Installing Prosa’s Dependencies

Prosa depends on some Coq libraries, most notably ssreflect. These can be easily installed with OPAM as follows:

opam repo add coq-released https://coq.inria.fr/opam/released
opam update
opam install -y 'coq-mathcomp-ssreflect=1.15.0' 'coq-mathcomp-zify'

Overview of the Remaining Steps

As described in the paper, the Coq compiler coqc converts human-readable .v files into low-level .vo files. The resulting .vo files can then be checked with the coqchk proof checker.

The first step is hence to compile Prosa, followed by a second verification step. Finally, a third step will render the libraries specification as a set of hyperlinked HTML pages for easier reading and exploration.

As an aside, it is interesting to note that the compiler coqc actually already checks the correctness of the proofs, but coqchk is much simpler and has a much smaller TCB. It is hence desirable and customary to have a separate verification step that does not involve the compiler per se.

Step 1 — Compile Prosa

Compiling Prosa is a two-step process.

First, generate a Makefile by running the following script in the Prosa folder:

./create_makefile.sh --without-classic --without-refinements

The two switches --without-classic and --without-refinements disable parts of Prosa irrelevant to the FIFO RTA (which helps to reduce the compile time and avoids some dependencies).

Second, compile Prosa by issuing the following command in the Prosa folder:

make

Alternatively, if you have a machine with plenty of RAM (8+GiB), you can also parallelize the compilation with make’s -j flag:

make -j NUMBER-OF-CORES-TO-USE

Step 2 — Verify the Proofs

To (double-)check that all proofs are indeed correct with coqchk, and that no non-standard axioms are being assumed, run the following command in the Prosa folder:

make validate

This will take a few minutes of computation and should finally generate the following output:

CONTEXT SUMMARY
===============

* Theory: Set is predicative
  
* Axioms: <none>
  
* Constants/Inductives relying on type-in-type: <none>
  
* Constants/Inductives relying on unsafe (co)fixpoints: <none>
  
* Inductives whose positivity is assumed: <none>

This validation result indicates a “clean sheet” — all proofs are correct (i.e., all proof terms type-check) and the library is not doing anything unusual. In particular, the second bullet point indicates the absence of nonstandard axioms: that is, all claimed results follow from Coq’s foundational logic and Prosa’s semantics.

Step 3 — Generate the Documentation

As the name suggests, a hallmark of Prosa and a key design goal is the readability of the entire library. To this end, all files are heavily commented such that the coqdoc utility can extract an attractive rendering of the specification.

To obtain a hyperlinked, easy-to-read rendering of the entire Prosa library, run the following command in the Prosa/ folder:

make htmlpretty

The resulting documentation can then be found in the folder Prosa/html. For instance, the library’s table of contents is a good starting point for exploration. (NB: The link will work only after make htmlpretty has finished.)

Alternative: Steps 0–3 in Docker

For your convenience, we provide a script to execute Steps 0–3 completely automatically within an ephemeral Docker container.

Assuming the docker binary is in your shell’s $PATH, run the following command to execute the above steps:

Docker/compile-and-check-in-Docker.sh

Docker will download an official Coq image and then execute the above steps one by one. This may take a few minutes, but should complete within about one hour, depending on the system.

The script will provide progress updates as it completes the steps.

Step 4 — Inspect the Formal Development

As mentioned above, the proof of soundness of the proposed RTA for FIFO scheduling is located in the file Prosa/results/fifo/rta.v. The corresponding HTML file rendered in Step 3 is:

We recommend to read the formal specification, claims, and the accompanying comments in this file top-to-bottom. In parallel, we suggest to refer to Sections III and IV of the paper. The hyperlinked nature of the HTML-rendered specification should make it easy to explore the definitions and semantics upon which the formal proof rests.

To find specific definitions, it can also be helpful to consult the library’s global index of all symbols, which (after Step 3) is provided in the file Prosa/html/index.html. While the full index may seem overwhelming at first, by using the browser’s builtin search functionality, it is usually possible to quickly locate any symbol.