lecture 8/9 : separation logic
TRANSCRIPT
CS6202 Separation Logic 1
CS6202: Advanced Topics in ProgrammingLanguages and Systems
Lecture 8/9 : Separation Logic
• Overview• Assertion Logic• Semantic Model• Hoare-style Inference Rules• Specification and Annotations• Linked List and Segments• Trees and Instuitionistic Logic• (above from John Reynold’s mini-course)• Automated Verification
CS6202 Separation Logic 2
MotivationMotivation
Program reasoning is important for:
correctness of software
safety (fewer or no bugs)
performance guarantee
optimization
CS6202 Separation Logic 3
Hoare LogicHoare Logic
Can handle reasoning of imperative programs well.
Notation : {P} code {Q}{P} precondition before executing code{Q} postcondition after executing code
Some examples : {x=1} x:=x+1 {x=2}
{x=x0} x:=x+1 {x=x0+1}
{Q[x+1/x]} x:=x+1 {Q}
{P} x:=x+1 {� x1. P[x1/x] A x=x1+1}
CS6202 Separation Logic 4
ProblemProblem
Hoare logic can handle program variables but not heapobjects well due to aliasing problems.
Consider an in-place list reversal algorithm
[i] denotes a heap location at address i
CS6202 Separation Logic 5
Loop InvariantLoop Invariant
Loop invariant is a statement that holds at the beginning ofeach iteration of the loop.
heap predicate relates a listof elements and a pointer
CS6202 Separation Logic 6
Loop InvariantLoop Invariant
in separation logic :
CS6202 Separation Logic 7
Ba sics of Separation LogicBa sics of Separation Logic
CS6202 Separation Logic 8
Simple Language with Heap StoreSimple Language with Heap Store
CS6202 Separation Logic 9
Memory FaultsMemory Faults
Can be caused by out of range look up of memory.
CS6202 Separation Logic 10
Assertion LanguageAssertion Language
CS6202 Separation Logic 11
Semantic ModelSemantic Model
CS6202 Separation Logic 12
Semantic ModelSemantic Model
CS6202 Separation Logic 13
Separation ConjunctionSeparation Conjunction -- ExamplesExamples
CS6202 Separation Logic 14
ConjunctionConjunction -- ExamplesExamples
Conjunction describes the same heap space.
CS6202 Separation Logic 15
Separation ImplicationSeparation Implication -- ExamplesExamples
CS6202 Separation Logic 16
Inference RulesInference RulesReasoning with normalization, weakening and strengthening.
CS6202 Separation Logic 17
Pure AssertionPure Assertion
Axiom schematic guided by pure formulae
CS6202 Separation Logic 18
Two Unsound Axiom SchemataTwo Unsound Axiom Schemata
Structural logic without contraction and weakening.
CS6202 Separation Logic 19
Partial Correctness SpecificationPartial Correctness Specification
CS6202 Separation Logic 20
Total Correctness SpecificationTotal Correctness Specification
CS6202 Separation Logic 21
Examples of Valid SpecificationsExamples of Valid Specifications
CS6202 Separation Logic 22
Hoare Inference RulesHoare Inference Rules
CS6202 Separation Logic 23
Hoare Inference RulesHoare Inference Rules
Structural rules are applicable to any commands.
CS6202 Separation Logic 24
Partial Correctness of While LoopPartial Correctness of While Loop
CS6202 Separation Logic 25
Total Correctness of While LoopTotal Correctness of While Loop
CS6202 Separation Logic 26
Hoare Inference RulesHoare Inference Rules
CS6202 Separation Logic 27
Hoare Inference RulesHoare Inference Rules
CS6202 Separation Logic 28
Annotated SpecificationsAnnotated Specifications
In annotated specifications, additional assertions calledannotations are placed in command in such a way that itassist proof construction process.Examples :
CS6202 Separation Logic 29
Minimal Annotated SpecificationsMinimal Annotated Specifications
Should attempt to minimise annotations where possible.
Restrict to pre/post of methods and invariant of loops.
Further advances : (i) intraprocedural inference(ii) interprocedural inference.
CS6202 Separation Logic 30
Structural Inference RulesStructural Inference Rules
CS6202 Separation Logic 31
Structural Inference RulesStructural Inference Rules
CS6202 Separation Logic 32
Structural Inference RulesStructural Inference Rules
CS6202 Separation Logic 33
Rule of Constancy from Hoare LogicRule of Constancy from Hoare Logic
CS6202 Separation Logic 34
Frame Rule of Separation LogicFrame Rule of Separation Logic
This facilitates local reasoning and specification
CS6202 Separation Logic 35
Local SpecificationsLocal Specifications
CS6202 Separation Logic 36
Inference Rules for MutationInference Rules for Mutation
CS6202 Separation Logic 37
Inference Rules forInference Rules for DeallocationDeallocation
CS6202 Separation Logic 38
Inference Rules forInference Rules for NoninterferingNoninterfering AllocationAllocation
CS6202 Separation Logic 39
Inference Rules for LookupInference Rules for Lookup
CS6202 Separation Logic 40
Notation for SequencesNotation for Sequences
CS6202 Separation Logic 41
Singly Linked ListSingly Linked List
What is the default property (invariant) of this predicate?
CS6202 Separation Logic 42
Singly Linked List SegmentSingly Linked List Segment
CS6202 Separation Logic 43
Singly Linked List SegmentSingly Linked List Segment
Properties
CS6202 Separation Logic 44
NonNon-- Touching Linked List SegmentTouching Linked List Segment
Easier test for emptiness
CS6202 Separation Logic 45
Braced List SegmentBraced List Segment
CS6202 Separation Logic 46
BornatBornat ListList
CS6202 Separation Logic 47
Doubly Linked ListDoubly Linked List
CS6202 Separation Logic 48
XORXOR-- Linked List SegmentLinked List Segment
CS6202 Separation Logic 49
Array AllocationArray Allocation
Inference rule :
CS6202 Separation Logic 50
TreesTrees
CS6202 Separation Logic 51
DAGsDAGs
CS6202 Separation Logic 52
IntuitionisticIntuitionistic Separation LogicSeparation Logic
Supports justification rather than truth.
Things that no longer hold include:law of excluded middle (P B � P)double negation (� � P = P)Pierce’s law (((P � Q) � P) � P)
Formulae valid in intuitionistic separation logic but not theclassical one.
x � 1,y � empx � 1,y * y � ,nil � x � 1,_
CS6202 Separation Logic 53
IntuitionisticIntuitionistic AssertionAssertion
CS6202 Separation Logic 54
Inference for ProceduresInference for Procedures
CS6202 Separation Logic 55
Copying TreeCopying Tree
CS6202 Separation Logic 56
Copying Tree (Proof)Copying Tree (Proof)
CS6202 Separation Logic 57
Copying Tree (Proof)Copying Tree (Proof)
CS6202 Separation Logic 58
Automated VerificationAutomated Verification
Modular Verification (i) Given pre/post conditions for each method and loop(ii) Determine each postcondition is sound for method body.(iii) Each precondition is satisfied for each call site.
Why Verification?(i) can handle more complex examples(ii) can be used to check inference algorithm(iii) grand challenge of verifiable software
CS6202 Separation Logic 59
Core Imperative LanguageCore Imperative Language
CS6202 Separation Logic 60
Data Nodes and NotationData Nodes and Notation
CS6202 Separation Logic 61
Shape PredicatesShape Predicates
Linked-list with size
Double linked-list (right traversal) with size
Sorted linked-list with size, min, max
CS6202 Separation Logic 62
Insertion Sort AlgorithmInsertion Sort Algorithm
CS6202 Separation Logic 63
Prime NotationPrime Notation
Prime notation is used to capture the latest valuesof each program variable. This allows a statetransition to be expressed since the unprimed
form denotes original values.
CS6202 Separation Logic 64
Prime NotationPrime Notation
Example :
{x’=x A y’=y}x:=x+1
{x’=x+1 A y’=y}x:=x+y{x’=x+1+y A y’=y}y:=2{x’=x+1+y A y’=2}
CS6202 Separation Logic 65
Forward VerificationForward Verification
Given '1, infer ' 2 :
C {'1} e {'2}
CS6202 Separation Logic 66
Forward VerificationForward Verification
CS6202 Separation Logic 67
Separation Constraint Normalization RulesSeparation Constraint Normalization Rules
Target :
CS6202 Separation Logic 68
Separation Constraint ApproximationSeparation Constraint Approximation
XPuren()) returns a sound approximation of theform :
non-null symbolic addresses
Normalization :
CS6202 Separation Logic 69
Translating to Pure FormTranslating to Pure Form
CS6202 Separation Logic 70
Deriving Shape InvariantDeriving Shape Invariant
From each pure invariant, such as (n z 0) for ll<n>
We use Inv1(..) to obtain a more precise invariant :
CS6202 Separation Logic 71
Separation Constraint EntailmentSeparation Constraint Entailment
denotes
CS6202 Separation Logic 72
Separation Constraint EntailmentSeparation Constraint Entailment
CS6202 Separation Logic 73
Unfolding Predicate in AntecedentUnfolding Predicate in Antecedent
CS6202 Separation Logic 74
Folding a Predicate in ConsequentFolding a Predicate in Consequent
Folding is recursively applied until x::ll<n> matcheswith the two data nodes in the antecedent, resulting in :
Effect of folding is not the same as unfolding a predicateIn consequent as values of derived variable may be lost!
CS6202 Separation Logic 75
Folding a Predicate in ConsequentFolding a Predicate in Consequent
CS6202 Separation Logic 76
Soundness of EntailmentSoundness of Entailment