Compositional Computational Reflection Gregory Malecha Adam - PowerPoint PPT Presentation

Compositional Computational Reflection Gregory Malecha Adam Chlipala Thomas Braibant gmalecha@cs.harvard.edu Harvard SEAS MIT CSAIL Inria July 17, 2014 MirrorShard (ITP’14) 1 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen HO Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen HO Sym Exec Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen HO Sym Exec HO Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen HO Sym Exec HO Entailment Bedrock MirrorShard (ITP’14) 2 / 13

Program Verification in Bedrock [Chl11] Imperative Program Hints / Theorems bfunction "length" ( "x" , "n" ) [ lengthS ] Def sll : list W → W → HProp := ... "n" ← 0;; [ ∀ ls , PRE [ V ] sll ls ( V "x" ) Thm nil_fwd : ∀ ls ( p : W ), p = 0 POST [ R ] ⌈ R = V "n" + length ls ⌉ → sll ls p ⊢ ⌈ ls = nil ⌉ . ∗ sll ls ( V "x" )] Proof . .. Qed . While (” x ” � = 0 ) { ” n ” ← ” n ” + 1 ; ; Thm cons_fwd : ∀ ls ( p : W ), p � = 0 ” x ” ← ” x ” + 4 ; ; → sll ls p ⊢ ” x ” ← ∗ ” x ” ∃ x , ∃ ls ’, ⌈ ls = x :: ls ’ ⌉ ∗ } ; ; ∃ p ’, p �→ ( x , p ’) ∗ sll ls ’ p ’. Return "n" Proof . .. Qed . Thm sllMOk : moduleOk sllM . Proof . vcgen ; abstract ( sep hints ; finish ). Qed . VC-gen HO Sym Exec HO Entailment Bedrock MirrorShard (ITP’14) 2 / 13

Ltac-based Symbolic Execution Coq’s tactic language Ltac Automation bfunction "length" ( "x" , "n" ) [ lengthS ] "n" ← 0;; [ ∀ ls , Ltac sym_eval := PRE [ V ] sll ls ( V "x" ) repeat first POST [ R ] ⌈ R = V "n" + length ls ⌉ ∗ sll ls ( V "x" )] [ eapply step_read ; side_condition While ( "x" � = 0) { | ... "n" ← "n" + 1;; "x" ← "x" + 4;; | autorewrite with lemmas ]. "x" ← ∗ "x" } ;; Return "n" P ′′′ ⊢ R { P ′′′ } c 4 { R } ... { P ′′ } c 3 ; c 4 { R } ... { P ′ } c 2 ; c 3 ; c 4 { R } ... { P } c 1 ; c 2 ; c 3 ; c 4 { R } Bedrock MirrorShard (ITP’14) 3 / 13

Ltac-based Symbolic Execution Ltac Automation bfunction "length" ( "x" , "n" ) [ lengthS ] "n" ← 0;; [ ∀ ls , Ltac sym_eval := PRE [ V ] sll ls ( V "x" ) repeat first POST [ R ] ⌈ R = V "n" + length ls ⌉ ∗ sll ls ( V "x" )] [ eapply step_read ; side_condition While ( "x" � = 0) { | ... "n" ← "n" + 1;; "x" ← "x" + 4;; | autorewrite with lemmas ]. "x" ← ∗ "x" } ;; Return "n" P ′′′ ⊢ R { P ′′′ } c 4 { R } ... { P ′′ } c 3 ; c 4 { R } ... { P ′ } c 2 ; c 3 ; c 4 { R } ... { P } c 1 ; c 2 ; c 3 ; c 4 { R } assume x � = 0 c 1 Bedrock MirrorShard (ITP’14) 3 / 13

Ltac-based Symbolic Execution Ltac Automation bfunction "length" ( "x" , "n" ) [ lengthS ] "n" ← 0;; [ ∀ ls , Ltac sym_eval := PRE [ V ] sll ls ( V "x" ) repeat first POST [ R ] ⌈ R = V "n" + length ls ⌉ ∗ sll ls ( V "x" )] [ eapply step_read ; side_condition While ( "x" � = 0) { | ... "n" ← "n" + 1;; "x" ← "x" + 4;; | autorewrite with lemmas ]. "x" ← ∗ "x" } ;; Return "n" P ′′′ ⊢ R { P ′′′ } c 4 { R } ... { P ′′ } c 3 ; c 4 { R } ... { P ′ } c 2 ; c 3 ; c 4 { R } ... { P } c 1 ; c 2 ; c 3 ; c 4 { R } assume x � = 0 n ← n + 1 c 1 c 2 Bedrock MirrorShard (ITP’14) 3 / 13

Ltac-based Symbolic Execution Ltac Automation bfunction "length" ( "x" , "n" ) [ lengthS ] "n" ← 0;; [ ∀ ls , Ltac sym_eval := PRE [ V ] sll ls ( V "x" ) repeat first POST [ R ] ⌈ R = V "n" + length ls ⌉ ∗ sll ls ( V "x" )] [ eapply step_read ; side_condition While ( "x" � = 0) { | ... "n" ← "n" + 1;; "x" ← "x" + 4;; | autorewrite with lemmas ]. "x" ← ∗ "x" } ;; Return "n" P ′′′ ⊢ R { P ′′′ } c 4 { R } ... { P ′′ } c 3 ; c 4 { R } ... { P ′ } c 2 ; c 3 ; c 4 { R } ... { P } c 1 ; c 2 ; c 3 ; c 4 { R } assume x � = 0 n ← n + 1 x ← x + 4 c 1 c 2 c 3 Bedrock MirrorShard (ITP’14) 3 / 13