Howdo we specify a program’srunningtime? Option 1: as an upper bound on the wall-clock time. Useful for embedded systems, but not realistic for commodity hardware. Option 2: as a number of cycles for an idealized machine model. Knuth: “Merge sort runs in . [This bound] can be re- duced to at the expense of a somewhat longer program.” Option 3: as a number of function calls in a high-level language. More abstract, but still has modularity issues. 11/40
Howdo we specify a program’srunningtime? Option 1: as an upper bound on the wall-clock time. Useful for embedded systems, but not realistic for commodity hardware. Option 2: as a number of cycles for an idealized machine model. Knuth: Option 3: as a number of function calls in a high-level language. More abstract, but still has modularity issues. 11/40 “Merge sort runs in 10 N log N ` 4 . 92 N . [This bound] can be re- duced to 9 N log N at the expense of a somewhat longer program.”
Howdo we specify a program’srunningtime? Option 1: as an upper bound on the wall-clock time. Useful for embedded systems, but not realistic for commodity hardware. Option 2: as a number of cycles for an idealized machine model. Knuth: Option 3: as a number of function calls in a high-level language. More abstract, but still has modularity issues. 11/40 “Merge sort runs in 10 N log N ` 4 . 92 N . [This bound] can be re- duced to 9 N log N at the expense of a somewhat longer program.”
Howdo we specify a program’srunningtime? Describe the “order of growth” of the running time as inputs grow large Less precise, but informative enough in many cases. 11/40 Option 4: specify the running time using asymptotic complexity. e.g. O p log n q , O p n q , O p n log n q , O p n 2 q , ….
Advantagesof asymptotic complexityspecifjcations Specifjcations capturing asymptotic costs: algorithms; the implementation; 12/40 • have been widely applied to a large class of programs and • are independent of the machine, runtime system and the details of • allow modular reasoning . Abstract over implementation details.
A step forward for the verifjcation of the correctnessandcomplexity of at a reasonable cost . Inthis thesis Goal: specify and prove that programs compute a correct result with a bounded asymptotic runtime. Proofs should be: Contribution: imperative,higher-order programs with subtle invariantsandanalysis , 13/40 • static; • machine-checked; • hardware- and runtime- independent; • modular.
Inthis thesis Goal: specify and prove that programs compute a correct result with a bounded asymptotic runtime. Proofs should be: Contribution: imperative,higher-order programs with subtle invariantsand analysis , 13/40 • static; • machine-checked; • hardware- and runtime- independent; • modular. A step forward for the verifjcation of the correctnessand complexity of at a reasonable cost .
Details of the contribution 1. A formal account of O () Existing: Contributed: with lemmas useful for program analysis 14/40 single-variate O (math, programs), multi-variate O on paper Coq library for single and multi-variate O ,
Contributions 2. A methodology for complexity proofs Existing: Contributed: (Separation Logic framework in Coq) 15/40 • manual verifjcation without O pq abstraction • automated analysis restricted to polynomial bounds • general asymptotic bounds • with semi-automated cost inference • implemented as an extension of CFML
Contributions 3. Case studies Existing: polynomial or logarithmic bounds, simple algorithms (quicksort), or Contributed: several algorithms, including a state-of-the-art graph algorithm with nontrivial correctness and complexity 16/40 interactive verifjcation without O
Outline of the rest of the talk Reasoning with abstract cost functions Semi-automatic inference of cost functions Separation Logic with Time Credits Case study—an Incremental Cycle Detection Algorithm 17/40
Reasoningwith abstractcost functions
18/40 1 …but which statement are we proving? . : • . : • : By induction on Proof: Claim: 8 7 6 5 4 3 2 Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j
18/40 . • 8 1 7 : 6 5 Proof: • 4 : 3 . 2 …but which statement are we proving? Claim: Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j By induction on j ´ i :
18/40 8 …but which statement are we proving? 2 . 3 : 4 • 5 Proof: 6 Claim: 7 1 Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j By induction on j ´ i : • j ´ i ď 0 : O p 1 q .
18/40 5 …but which statement are we proving? Proof: Claim: 8 1 6 7 4 2 3 Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j By induction on j ´ i : • j ´ i ď 0 : O p 1 q . • j ´ i ą 0 : O p 1 q ` O p 1 q ` O p 1 q “ O p 1 q .
18/40 7 …but which statement are we proving? 2 Where is the catch? 3 Proof: 4 Claim: 5 8 6 1 Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j By induction on j ´ i : • j ´ i ď 0 : O p 1 q . • j ´ i ą 0 : O p 1 q ` O p 1 q ` O p 1 q “ O p 1 q .
18/40 5 …but which statement are we proving? Proof: Claim: 8 1 6 7 4 2 3 Informal reasoningprincipleson O canbe abused let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = a.(k) then k else if x < a.(k) then bsearch a x i j costs O p 1 q . bsearch a x i k else bsearch a x (k+1) j By induction on j ´ i : • j ´ i ď 0 : O p 1 q . • j ´ i ą 0 : O p 1 q ` O p 1 q ` O p 1 q “ O p 1 q .
bsearch a x i j ” performs at most function calls What we just proved: What “ ” means: 19/40 Meaningof O p 1 q @ i j , D c , “ bsearch a x i j ” performs at most c function calls
What we just proved: 19/40 Meaningof O p 1 q @ i j , D c , “ bsearch a x i j ” performs at most c function calls What “ O p 1 q ” means: D c , @ i j , “ bsearch a x i j ” performs at most c function calls
• for every a , x , i , j , “ bsearch a x i j ” performs at most Meaning: there exists a cost function such that, function calls • . 20/40 Meaningof O p log n q Informal specifjcation: “ bsearch a x i j ” runs in O p log p j ´ i qq .
20/40 function calls Meaningof O p log n q Informal specifjcation: “ bsearch a x i j ” runs in O p log p j ´ i qq . Meaning: there exists a cost function f such that, • for every a , x , i , j , “ bsearch a x i j ” performs at most f p j ´ i q • f P O p λn. log n q .
Construction of the cost function Option 2: Semi-automatically construct the cost function as the proof progresses. Option 3: The cost function is automatically inferred by some clever algorithm... Restricted to specifjc classes of programs. 21/40 Option 1: The user somehow guesses a suitable cost function. Here, “ λn. 3 log n ` 4 ” works.
Construction of the cost function Option 2: Semi-automatically construct the cost function as the proof progresses. Option 3: The cost function is automatically inferred by some clever algorithm... Restricted to specifjc classes of programs. 21/40 Option 1: The user somehow guesses a suitable cost function. Here, “ λn. 3 log n ` 4 ” works.
Construction of the cost function Option 2: Semi-automatically construct the cost function as the proof progresses. Option 3: The cost function is automatically inferred by some clever algorithm... Restricted to specifjc classes of programs. 21/40 Option 1: The user somehow guesses a suitable cost function. Here, “ λn. 3 log n ` 4 ” works.
Semi-automatic synthesis of cost functions
Ourapproachto this problem Part 1: Part 2: 22/40 • Synthesize a cost function with the same structure as the code • For recursive functions, recurrence equations are synthesized • Accounting details are automatically synthesized • User input is requested when some over-approximation is required • In a second step, prove a O pq bound for the inferred cost function
Constraintinferredon the cost functionf 23/40 let rec bsearch a x i j = if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f n >= 1 + ( where n = j-i if n <= 0 then 0 else 0 + 1 + max 0 ( 1 + max (f (n/2)) (f (n - n/2 - 1)) ) )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + … a hole (“ … ”) is implemented as an evar in Coq
24/40 Interactive construction of the cost functionf if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + (if j <= i then … else …)
24/40 Interactive construction of the cost functionf if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + (if j <= i then … else …)
24/40 Interactive construction of the cost functionf if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + (if (j-i) <= 0 then … else …)
24/40 Interactive construction of the cost functionf if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + (if (j-i) <= 0 then 0 else …)
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + … )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + … )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max … … )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max 0 … )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max 0 (1 + …) )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max 0 (1 + max … …) )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max 0 ( 1 + max (f ((j-i)/2)) … ) )
24/40 Interactive construction of the cost functionf if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f (j-i) >= 1 + ( if (j-i) <= 0 then 0 else 0 + 1 + max 0 ( 1 + max (f ((j-i)/2)) (f ((j-i) - (j-i)/2 - 1)) ) )
Interactive construction of the cost functionf 24/40 if j <= i then -1 else let k = i + (j - i) / 2 in if x = Array.get a k then k else if x < Array.get a k then bsearch a x i k else bsearch a x (k+1) j f n >= 1 + ( if n <= 0 then 0 else 0 + 1 + max 0 ( 1 + max (f (n/2)) (f (n - n/2 - 1)) ) )
• Use the “Master Theorem”, when applicable • Substitution method: guess that there is a solution of the form Fromcost equation to asymptotic bound (available in Isabelle/HOL, not yet in Coq) , inject it and resolve. 25/40 For bsearch , there remains to fjnd a f P O p λn. log n q such that: # 0 if n ď 0 @ n. f p n q ě 1 ` 1 ` max p 0 , 1 ` max p f p n 2 q , f p n ´ n 2 ´ 1 qqq
(available in Isabelle/HOL, not yet in Coq) Fromcost equation to asymptotic bound 25/40 For bsearch , there remains to fjnd a f P O p λn. log n q such that: # 0 if n ď 0 @ n. f p n q ě 1 ` 1 ` max p 0 , 1 ` max p f p n 2 q , f p n ´ n 2 ´ 1 qqq • Use the “Master Theorem”, when applicable • Substitution method: guess that there is a solution of the form a log n ` b , inject it and resolve.
Can be solved automatically. The substitution method in action The user does not have to manually provide values for , , and . 26/40 D f : Z Ñ Z . # 0 if n ď 0 @ n. f p n q ě 1 ` 1 ` max p 0 , 1 ` max p f p n 2 q , f p n ´ n 2 ´ 1 qqq ^ f P O p λn. log n q
Can be solved automatically. The substitution method in action The user does not have to manually provide values for , , and . 26/40 D f : Z Ñ Z . monotonic f ^ @ n. f p n q ě 0 ^ @ n. n ď 0 ù ñ f p n q ě 1 ^ @ n. n ě 1 ù ñ f p n q ě f p n 2 q ` 3 ^ f P O p λn. log n q
The substitution method in action Can be solved automatically. The user does not have to manually provide values for , , and . 26/40 D a b : Z . f p n q “ a log n ` b ^ monotonic f ^ @ n. f p n q ě 0 ^ @ n. n ď 0 ù ñ f p n q ě 1 ^ @ n. n ě 1 ù ñ f p n q ě f p n 2 q ` 3 ^ f P O p λn. log n q
Can be solved automatically. The substitution method in action The user does not have to manually provide values for , , and . 26/40 D a b : Z . f p n q “ a log n ` b (issue when n “ 0 ) ^ monotonic f ^ @ n. f p n q ě 0 ^ @ n. n ď 0 ù ñ f p n q ě 1 ^ @ n. n ě 1 ù ñ f p n q ě f p n 2 q ` 3 ^ f P O p λn. log n q
The substitution method in action Can be solved automatically. The user does not have to manually provide values for , , and . 26/40 D a b c : Z . f p n q “ if n ą 0 then a log n ` b else c ^ monotonic f ^ @ n. f p n q ě 0 ^ @ n. n ď 0 ù ñ f p n q ě 1 ^ @ n. n ě 1 ù ñ f p n q ě f p n 2 q ` 3 ^ f P O p λn. log n q
The substitution method in action Can be solved automatically. The user does not have to manually provide values for , , and . 26/40 D a b c : Z . f p n q “ if n ą 0 then a log n ` b else c ^ monotonic f ^ @ n. f p n q ě 0 ^ @ n. n ď 0 ù ñ f p n q ě 1 ^ @ n. n ě 1 ù ñ f p n q ě f p n 2 q ` 3 ^ True
Can be solved automatically. The substitution method in action The user does not have to manually provide values for , , and . 26/40 D a b c : Z . f p n q “ if n ą 0 then a log n ` b else c ^ a ě 0 ^ b ě c ^ b ě 0 ^ c ě 0 ^ c ě 1 ^ b ě c ` 3 ^ a ě 3 ^ True
The substitution method in action Can be solved automatically. The user does not have to manually provide values for , , and . 26/40 D a b c : Z . ^ a ě 0 ^ b ě c ^ b ě 0 ^ c ě 0 ^ c ě 1 ^ b ě c ` 3 ^ a ě 3 ^ True
The substitution method in action Can be solved automatically. 26/40 D a b c : Z . ^ a ě 0 ^ b ě c ^ b ě 0 ^ c ě 0 ^ c ě 1 ^ b ě c ` 3 ^ a ě 3 ^ True The user does not have to manually provide values for a , b , and c .
SeparationLogic with Time Credits
Linking code to cost assertions Program specifjcations using Separation Logic precondition program postcondition time credits 27/40 t P u t t Q u
Linking code to cost assertions Program specifjcations using Separation Logic with Time Credits precondition program postcondition time credits 27/40 t $ n ‹ P u t t Q u
Linking code to cost assertions Program specifjcations using Separation Logic with Time Credits precondition program postcondition time credits 27/40 t $ n ‹ P u t t Q u
• Credits are not duplicable: • Enable amortized complexity analysis Time Credits: resourcesin separationlogic 28/40 $ n • $ n describes the right to perform n function calls or loop iterations • $ p n ` m q “ $ n ‹ $ m • $0 “ emp
28/40 Time Credits: resourcesin separationlogic $ n • $ n describes the right to perform n function calls or loop iterations • $ p n ` m q “ $ n ‹ $ m • $0 “ emp • Credits are not duplicable: $1 ù ñ { $1 ‹ $1 • Enable amortized complexity analysis
29/40 Using time creditsin the specifjcationof bsearch Specifjcation of the complexity of bsearch using time credits: D f : Z Ñ Z . # f P O p λn. log n q @ a x i j. t $ p f p j ´ i qq ‹ . . . u p bsearch a x i j q t ... u
Contribution: PossiblyNegative Time Credits Corollary: 30/40 Separation Logic with Time Credits in N : $0 ” emp @ m n P N . $ p m ` n q ” $ m ‹ $ n @ n P N . $ n , emp My extension: Possibly Negative Time Credits in Z : $0 ” emp @ m n P Z . $ p m ` n q ” $ m ‹ $ n @ n P Z . $ n ‹ r n ě 0 s , emp $ n ” $ m ‹ $ p n ´ m q
index_of index_of index_of index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *)
index_of index_of index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u
index_of index_of index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u
index_of index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu
index_of index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu
index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu @ a. let k : “ min t i | a. p i q “ v u in t $ p k ` 1 qu index_of v a t λi. r i “ k su
index_of Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu @ a. let k : “ min t i | a. p i q “ v u in t $ p k ` 1 qu index_of v a t λi. r i “ k su
Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu @ a. let k : “ min t i | a. p i q “ v u in t $ p k ` 1 qu index_of v a t λi. r i “ k su @ a. t emp u index_of v a t λi. $ p´ i ´ 1 qu
Possibly Negative Time Creditsenable simpler specifjcations (too coarse) (restrictive?) (too complicated) 31/40 let index_of (v: ’ a) (a: ’ a array ): int = (* returns the index of the first occurrence of v in a *) @ a. t $ p| a | ` 1 qu index_of v a t λi. emp u @ a. t $ p| a | ` 1 qu index_of v a t λi. $ p| a | ´ i qu @ a. let k : “ min t i | a. p i q “ v u in t $ p k ` 1 qu index_of v a t λi. r i “ k su @ a. t emp u index_of v a t λi. $ p´ i ´ 1 qu
(when the cost depends on the result) (can accumulate debts and pay them off once at the end) (no need to justify that a number of credits is positive at each step) 32/40 Time Creditsin Z : benefjts • Simpler specifjcations • Signifjcant reduction of the number of intermediate side-conditions • Simpler loop invariants
Case Study: anIncremental Cycle DetectionAlgorithm
Ourmain case study Verifjcation of a state-of-the-art incremental cycle detection algorithm due to Bender, Fineman, Gilbert and Tarjan (2016). The problem: checking for acyclicity of a dynamically constructed graph 33/40
Recommend
More recommend
