Lecture 8/9 : Separation Logic Overview Assertion Logic - PowerPoint PPT Presentation

CS6202: Advanced Topics in Programming Languages and Systems Lecture 8/9 : Separation Logic • Overview • Assertion Logic • Semantic Model • Hoare-style Inference Rules • Specification and Annotations • Linked List and Segments • Trees and Instuitionistic Logic • (above from John Reynold’s mini-course) • Automated Verification CS6202 Separation Logic 1

Motivation Motivation Program reasoning is important for: correctness of software safety (fewer or no bugs) performance guarantee optimization CS6202 Separation Logic 2

Hoare Logic Hoare Logic Can handle reasoning of imperative programs well. Notation : {P} code {Q} {P} precondition before executing code {Q} postcondition after executing code Some examples : {x=1} x:=x+1 {x=2} {x=x 0 } x:=x+1 {x=x 0 +1} {Q[x+1/x]} x:=x+1 {Q} {P} x:=x+1 { � x 1 . P[x 1 /x] � x=x 1 +1} CS6202 Separation Logic 3

Problem Problem Hoare logic can handle program variables but not heap objects well due to aliasing problems. Consider an in-place list reversal algorithm [i] denotes a heap location at address i CS6202 Separation Logic 4

Loop Invariant Loop Invariant Loop invariant is a statement that holds at the beginning of each iteration of the loop. heap predicate relates a list of elements and a pointer CS6202 Separation Logic 5

Loop Invariant Loop Invariant in separation logic : CS6202 Separation Logic 6

Basics of Separation Logic Basics of Separation Logic CS6202 Separation Logic 7

Simple Language with Heap Store Simple Language with Heap Store CS6202 Separation Logic 8

Memory Faults Memory Faults Can be caused by out of range look up of memory. CS6202 Separation Logic 9

Assertion Language Assertion Language CS6202 Separation Logic 10

Semantic Model Semantic Model CS6202 Separation Logic 11

Semantic Model Semantic Model CS6202 Separation Logic 12

Separation Conjunction - - Examples Examples Separation Conjunction CS6202 Separation Logic 13

Conjunction - - Examples Examples Conjunction Conjunction describes the same heap space. CS6202 Separation Logic 14

Separation Implication - - Examples Examples Separation Implication CS6202 Separation Logic 15

Inference Rules Inference Rules Reasoning with normalization, weakening and strengthening. CS6202 Separation Logic 16

Pure Assertion Pure Assertion Axiom schematic guided by pure formulae CS6202 Separation Logic 17

Two Unsound Axiom Schemata Two Unsound Axiom Schemata Structural logic without contraction and weakening. CS6202 Separation Logic 18

Partial Correctness Specification Partial Correctness Specification CS6202 Separation Logic 19

Total Correctness Specification Total Correctness Specification CS6202 Separation Logic 20

Examples of Valid Specifications Examples of Valid Specifications CS6202 Separation Logic 21

Hoare Inference Rules Hoare Inference Rules CS6202 Separation Logic 22

Hoare Inference Rules Hoare Inference Rules Structural rules are applicable to any commands. CS6202 Separation Logic 23

Partial Correctness of While Loop Partial Correctness of While Loop CS6202 Separation Logic 24

Total Correctness of While Loop Total Correctness of While Loop CS6202 Separation Logic 25

Hoare Inference Rules Hoare Inference Rules CS6202 Separation Logic 26

Hoare Inference Rules Hoare Inference Rules CS6202 Separation Logic 27

Annotated Specifications Annotated Specifications In annotated specifications, additional assertions called annotations are placed in command in such a way that it assist proof construction process. Examples : CS6202 Separation Logic 28

Minimal Annotated Specifications Minimal Annotated Specifications Should attempt to minimise annotations where possible. Restrict to pre/post of methods and invariant of loops. Further advances : (i) intraprocedural inference (ii) interprocedural inference. CS6202 Separation Logic 29

Structural Inference Rules Structural Inference Rules CS6202 Separation Logic 30

Structural Inference Rules Structural Inference Rules CS6202 Separation Logic 31

Structural Inference Rules Structural Inference Rules CS6202 Separation Logic 32

Rule of Constancy from Hoare Logic Rule of Constancy from Hoare Logic CS6202 Separation Logic 33

Frame Rule of Separation Logic Frame Rule of Separation Logic This facilitates local reasoning and specification CS6202 Separation Logic 34

Local Specifications Local Specifications CS6202 Separation Logic 35

Inference Rules for Mutation Inference Rules for Mutation CS6202 Separation Logic 36

Inference Rules for Deallocation Deallocation Inference Rules for CS6202 Separation Logic 37

Inference Rules for Noninterfering Noninterfering Allocation Allocation Inference Rules for CS6202 Separation Logic 38

Inference Rules for Lookup Inference Rules for Lookup CS6202 Separation Logic 39

Notation for Sequences Notation for Sequences CS6202 Separation Logic 40

Singly Linked List Singly Linked List What is the default property (invariant) of this predicate? CS6202 Separation Logic 41

Singly Linked List Segment Singly Linked List Segment CS6202 Separation Logic 42

Singly Linked List Segment Singly Linked List Segment Properties CS6202 Separation Logic 43

Non- -Touching Linked List Segment Touching Linked List Segment Non Easier test for emptiness CS6202 Separation Logic 44

Braced List Segment Braced List Segment CS6202 Separation Logic 45

Bornat List List Bornat CS6202 Separation Logic 46

Doubly Linked List Doubly Linked List CS6202 Separation Logic 47

XOR- -Linked List Segment Linked List Segment XOR CS6202 Separation Logic 48

Array Allocation Array Allocation Inference rule : CS6202 Separation Logic 49

Trees Trees CS6202 Separation Logic 50

DAGs DAGs CS6202 Separation Logic 51

Intuitionistic Separation Logic Separation Logic Intuitionistic Supports justification rather than truth. Things that no longer hold include: law of excluded middle (P � � P) double negation ( � � P = P) Pierce’s law (((P � Q) � P) � P) Formulae valid in intuitionistic separation logic but not the classical one. x � 1,y � emp x � 1,y * y � , nil � x � 1,_ CS6202 Separation Logic 52

Intuitionistic Assertion Assertion Intuitionistic CS6202 Separation Logic 53

Inference for Procedures Inference for Procedures CS6202 Separation Logic 54

Copying Tree Copying Tree CS6202 Separation Logic 55

Copying Tree (Proof) Copying Tree (Proof) CS6202 Separation Logic 56

Copying Tree (Proof) Copying Tree (Proof) CS6202 Separation Logic 57

Automated Verification Automated Verification Modular Verification (i) Given pre/post conditions for each method and loop (ii) Determine each postcondition is sound for method body. (iii) Each precondition is satisfied for each call site. Why Verification? (i) can handle more complex examples (ii) can be used to check inference algorithm (iii) grand challenge of verifiable software CS6202 Separation Logic 58

Core Imperative Language Core Imperative Language CS6202 Separation Logic 59

Data Nodes and Notation Data Nodes and Notation CS6202 Separation Logic 60

Shape Predicates Shape Predicates Linked-list with size Double linked-list (right traversal) with size Sorted linked-list with size, min, max CS6202 Separation Logic 61

Insertion Sort Algorithm Insertion Sort Algorithm CS6202 Separation Logic 62

Prime Notation Prime Notation Prime notation is used to capture the latest values of each program variable. This allows a state transition to be expressed since the unprimed form denotes original values. CS6202 Separation Logic 63

Prime Notation Prime Notation Example : {x’=x � y’=y} x:=x+1 {x’=x+1 � y’=y} x:=x+y {x’=x+1+y � y’=y} y:=2 {x’=x+1+y � y’=2} CS6202 Separation Logic 64

Forward Verification Forward Verification Given � 1 , infer � 2 : � { � 1 } e { � 2 } CS6202 Separation Logic 65

Forward Verification Forward Verification CS6202 Separation Logic 66

Separation Constraint Normalization Rules Separation Constraint Normalization Rules Target : CS6202 Separation Logic 67

Separation Constraint Approximation Separation Constraint Approximation XPure n ( � ) returns a sound approximation of the form : non-null symbolic addresses Normalization : CS6202 Separation Logic 68

Translating to Pure Form Translating to Pure Form CS6202 Separation Logic 69

Deriving Shape Invariant Deriving Shape Invariant From each pure invariant, such as (n � 0) for ll<n> We use Inv 1 (..) to obtain a more precise invariant : CS6202 Separation Logic 70

Separation Constraint Entailment Separation Constraint Entailment denotes CS6202 Separation Logic 71