This folder provides the formal proof of soundness discussed in Section IV of the paper and instructions for checking its correctness. The proof is a part of the Prosa open-source library, a snapshot of which is included in this package.
Table of Contents:
This folder provides the following instructions:
README.md
— the Markdown source of this file.README.html
— this file.The Prosa
folder includes a snapshot of the Prosa open-source library:
Prosa/results
contains the high-level results verified in Prosa, including all RTAs.
Prosa/results/fifo/rta.v
contains the FIFO RTA’s proof of soundness discussed in Section IV of the paper.Prosa/behavior
contains Prosa’s trace semantics.Prosa/model
collects Prosa’s task and system model definitions.
Prosa/model/priority/fifo.v
contains the definition of the FIFO priority policy.Prosa/analysis
contains a sizable library of intermediate results and auxiliary lemmas used to establish the high-level results provided in Prosa/results
.Prosa/util
provides misc. definitions and supporting lemmas not specific to real-time systems.Prosa/classic
is an older version of Prosa that is of no relevance to this paper.Prosa/implementation
is not relevant to the FIFO RTA’s proof of correctness and may be ignored.Prosa/scripts
— continuous integration supportcoq-prosa.opam
— OPAM package manifestpackage.json
— esy
package manifestProsa/_CoqProject
and Prosa/create_makefile.sh
are required to compile the library and verify the proofs, as discussed in Step 1 below.Finally, we provide two scripts for running the experiments within a Docker container in the Docker
directory:
Docker/compile-and-check-in-Docker.sh
— a simple wrapper script to compile and check the proof in an ephemeral Docker container.Docker/steps-in-Docker.sh
— an executable summary of the steps described next, for execution within the Docker container launched by compile-and-check-in-Docker.sh
.The following instructions have been tested on macOS 12.4 “Monterey”. They are also expected to work on recent mainstream Linux distributions such as Ubuntu 22.04 LTS.
NB: Microsoft Windows is not supported.
The following standard software is required and assumed to already be in place:
OPAM is the OCaml Package Manager, which we will use to obtain a working installation of the Coq toolchain. Users who already have a working OPAM setup can skip this step.
The OPAM project provides comprehensive installation instructions, including a downloadable auto-installation script:
bash -c "sh <(curl -fsSL https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh)"
However, on most recent Linux distributions, OPAM can be easily installed via the package manager. For example, in the case of Ubuntu 22.04 LTS, a sufficiently recent version of OPAM can be installed simply via apt
:
apt install opam
On macOS, the best way to install OPAM is via either the Homebrew or MacPorts package manager.
Homebrew (➔ homepage):
brew install opam
MacPorts (➔ homepage):
port install opam
After installing OPAM, run the following command to initialize its dot-file directory ~/.opam
.
opam init
We will now install a clean Coq toolchain suitable for Prosa using OPAM’s “switch” functionality. To this end, run the following commands:
opam switch create Coq-8.15-for-Prosa 4.13.1
eval $(opam env --switch=Coq-8.15-for-Prosa)
opam update
opam install -y 'coq=8.15.2'
This will take a while, but has the advantage of not disturbing any other OPAM switches or Coq versions that may already be installed.
The following steps all assume that the above-created OPAM switch is activated in the current shell session. If in doubt, first run the following command in your terminal before any of the other commands:
eval $(opam env --switch=Coq-8.15-for-Prosa)
Prosa depends on some Coq libraries, most notably ssreflect
. These can be easily installed with OPAM as follows:
opam repo add coq-released https://coq.inria.fr/opam/released
opam update
opam install -y 'coq-mathcomp-ssreflect=1.15.0' 'coq-mathcomp-zify'
As described in the paper, the Coq compiler coqc
converts human-readable .v
files into low-level .vo
files. The resulting .vo
files can then be checked with the coqchk
proof checker.
The first step is hence to compile Prosa, followed by a second verification step. Finally, a third step will render the libraries specification as a set of hyperlinked HTML pages for easier reading and exploration.
As an aside, it is interesting to note that the compiler coqc
actually already checks the correctness of the proofs, but coqchk
is much simpler and has a much smaller TCB. It is hence desirable and customary to have a separate verification step that does not involve the compiler per se.
Compiling Prosa is a two-step process.
First, generate a Makefile
by running the following script in the Prosa
folder:
./create_makefile.sh --without-classic --without-refinements
The two switches --without-classic
and --without-refinements
disable parts of Prosa irrelevant to the FIFO RTA (which helps to reduce the compile time and avoids some dependencies).
Second, compile Prosa by issuing the following command in the Prosa
folder:
make
Alternatively, if you have a machine with plenty of RAM (8+GiB), you can also parallelize the compilation with make
’s -j
flag:
make -j NUMBER-OF-CORES-TO-USE
To (double-)check that all proofs are indeed correct with coqchk
, and that no non-standard axioms are being assumed, run the following command in the Prosa
folder:
make validate
This will take a few minutes of computation and should finally generate the following output:
CONTEXT SUMMARY
===============
* Theory: Set is predicative
* Axioms: <none>
* Constants/Inductives relying on type-in-type: <none>
* Constants/Inductives relying on unsafe (co)fixpoints: <none>
* Inductives whose positivity is assumed: <none>
This validation result indicates a “clean sheet” — all proofs are correct (i.e., all proof terms type-check) and the library is not doing anything unusual. In particular, the second bullet point indicates the absence of nonstandard axioms: that is, all claimed results follow from Coq’s foundational logic and Prosa’s semantics.
As the name suggests, a hallmark of Prosa and a key design goal is the readability of the entire library. To this end, all files are heavily commented such that the coqdoc
utility can extract an attractive rendering of the specification.
To obtain a hyperlinked, easy-to-read rendering of the entire Prosa library, run the following command in the Prosa/
folder:
make htmlpretty
The resulting documentation can then be found in the folder Prosa/html
. For instance, the library’s table of contents is a good starting point for exploration. (NB: The link will work only after make htmlpretty
has finished.)
For your convenience, we provide a script to execute Steps 0–3 completely automatically within an ephemeral Docker container.
Assuming the docker
binary is in your shell’s $PATH
, run the following command to execute the above steps:
Docker/compile-and-check-in-Docker.sh
Docker will download an official Coq image and then execute the above steps one by one. This may take a few minutes, but should complete within about one hour, depending on the system.
The script will provide progress updates as it completes the steps.
As mentioned above, the proof of soundness of the proposed RTA for FIFO scheduling is located in the file Prosa/results/fifo/rta.v
. The corresponding HTML file rendered in Step 3 is:
Prosa/html/prosa.results.fifo.rta.html
. (NB: The link will work only after Step 3.)We recommend to read the formal specification, claims, and the accompanying comments in this file top-to-bottom. In parallel, we suggest to refer to Sections III and IV of the paper. The hyperlinked nature of the HTML-rendered specification should make it easy to explore the definitions and semantics upon which the formal proof rests.
To find specific definitions, it can also be helpful to consult the library’s global index of all symbols, which (after Step 3) is provided in the file Prosa/html/index.html. While the full index may seem overwhelming at first, by using the browser’s builtin search functionality, it is usually possible to quickly locate any symbol.