Program certification with computational effects Burak Ekici ˜ j.w.w. Jean-Guillaume Dumas ˜ , Dominique Duval ˜ , Damien Pous y ˜ LJK, University Joseph Fourier, Grenoble y LIP, ENS-Lyon November 5, 2014 JNCF’14, Marseille-France B. Ekici (LJK) Effect certification November 5, 2014 1 / 30
Contents 1 Dynamic evaluation through exceptions 2 Proofs with side effects 3 Coq in play B. Ekici (LJK) Effect certification November 5, 2014 2 / 30
Contents 1 Dynamic evaluation through exceptions 2 Proofs with side effects 3 Coq in play B. Ekici (LJK) Effect certification November 5, 2014 3 / 30
Dynamic evaluation Dynamic evaluation := automatic case distinction process... B. Ekici (LJK) Effect certification November 5, 2014 4 / 30
Dynamic evaluation Dynamic evaluation := automatic case distinction process... Code re-usability: B. Ekici (LJK) Effect certification November 5, 2014 4 / 30
Dynamic evaluation Dynamic evaluation := automatic case distinction process... Code re-usability: E.g. Reusing codes made for fields over rings . B. Ekici (LJK) Effect certification November 5, 2014 4 / 30
Dynamic evaluation Dynamic evaluation := automatic case distinction process... Code re-usability: E.g. Reusing codes made for fields over rings . Gaussian elimination modulo prime p for Gaussian elimination modulo composite m . B. Ekici (LJK) Effect certification November 5, 2014 4 / 30
Dynamic evaluation for modular Gaussian Elimination pivoting ( ¸ ): not only non-zero but also invertible if any ¸ is non-zero but non-invertible then SPLIT the computation for modulo m 1 and m 2 by gcd computation. [ m = m 1 ´ m 2 ] & [ m 1 and m 2 are gcd-free] [ ¸ is invertible modulo m 1 ] & [ ¸ is zero modulo m 2 ] 1 Gaussian elimination modulo m 1 Gaussian elimination modulo m 2 2 B. Ekici (LJK) Effect certification November 5, 2014 5 / 30
Dynamic evaluation for modular Gaussian Elimination B. Ekici (LJK) Effect certification November 5, 2014 6 / 30
Dynamic evaluation via exceptions 1/2 arithmetic level exception: preventing zero divisors also i n l i n e I n t e g e r invmod ( const I n t e g e r& a , const I n t e g e r& m) { I n t e g e r gcd , u , v ; E x t e n d e d E u c l i d e a n A l g o r i t h m ( gcd , u , v , a ,m) ; i f ( gcd != 1) throw ZmzInvByZero ( gcd ) ; r e t u r n v>0?v : v=+ m; } exception at split location t r y { i n v p i v = zmz ( 1 ) /A [ k ] [ k ] ; } catch ( ZmzInvByZero e ) { throw G a u s s N o n I n v P i v o t ( e . getGcd ( ) , k , c u r r e n t r a n k ) ; } B. Ekici (LJK) Effect certification November 5, 2014 7 / 30
Dynamic evaluation via exceptions 2/2 deal with split: recursive continuation t r y { // i n p l a c e m o d i f i c a t i o n s o f l o w er n ` k p a r t o f m a t r i x A i n t r a n k = g a u s s r a n k (A , k ) ; cout < < r a n k : < < r a n k + u p p e r r a n k < < modulo < < m; } ( G a u s s N o n I n v P i v o t e ) { catch // r e c u r s i v e c o n t i n u a t i o n modulo m1 AND modulo m2 // a t c u r r e n t s t e p } B. Ekici (LJK) Effect certification November 5, 2014 8 / 30
Contents 1 Dynamic evaluation through exceptions 2 Proofs with side effects 3 Coq in play B. Ekici (LJK) Effect certification November 5, 2014 9 / 30
Programs with side effects 1/2 Side effect := the mismatch between syntax and semantics... E.g. The exceptions effect: Considering the exception thrower : f l o a t f u n c t i o n ( i n t a ) throw ( E x c e p t i o n ) { . . . } ; ) Syntactically; function: int ! float ) w.r.t. an interpretation (denotational semantics); function: int ! float + Exception B. Ekici (LJK) Effect certification November 5, 2014 10 / 30
Programs with side effects 2/2 E.g. The state effect: Considering the state modifier : S { c l a s s method ( i n t a ) { . . . } ; f l o a t } . . . S t ; t . method ( 1 0 ) ; ) Syntactically; method: int ! float ) w.r.t. an interpretation (denotational semantics); method: int ˆ S ! float ˆ S B. Ekici (LJK) Effect certification November 5, 2014 11 / 30
Decorated logic [Dominguez & Duval’08] tools for modeling computations with effects: monads : [Moggi’91] decorated logic : based on the framework by [Dominguez & Duval’08] ◮ provides equivalence proofs among programs with effects B. Ekici (LJK) Effect certification November 5, 2014 12 / 30
Decorated logic [Dominguez & Duval’08] tools for modeling computations with effects: monads : [Moggi’91] decorated logic : based on the framework by [Dominguez & Duval’08] ◮ provides equivalence proofs among programs with effects ) Equivalence proofs are aimed to be verified by Coq. B. Ekici (LJK) Effect certification November 5, 2014 12 / 30
Decorated logic: exceptions 1/2 f ( 0 ) : X ! Y pure f ( 1 ) : X ! Y thrower = propagator f ( 2 ) X ! Y : catcher specify explain the decoration % & the decoration : X ! Y f f : X ! Y f : X ! Y + E : X + E ! Y + E f ) Ease of composition: exceptional behaviors are kept implicit. I.e., Given f ( 2 ) : X ! Y and g ( 1 ) : Y ! Z , ( g ‹ f ) ( 2 ) : X ! Z B. Ekici (LJK) Effect certification November 5, 2014 13 / 30
Decorated logic: exceptions 2/2 strong equality (on ordinary and exceptional arguments) f ” g weak equality (on ordinary arguments only) f ‰ g f ” g : X ! Y f ‰ g : X ! Y specify explain the decoration % & the decoration f = g : X + E ! Y + E f = g : X ! Y f ‹ inl X = g ‹ inl X X ! Y + E : [ inl X is the inclusion of X into X + E ] ) More precise equational proofs of programs: w.r.t. effects and ordinary cases. B. Ekici (LJK) Effect certification November 5, 2014 14 / 30
� Core exceptional operations: tag/untag : P t ! 0 tag t untag t : 0 ! P t ordinary value exceptional value (normal) (abrupt) tag t � a a t untag t a a t ) throwing and catching exceptions := core operations + pattern matching. B. Ekici (LJK) Effect certification November 5, 2014 15 / 30
throwing & handling exceptions ) Throwing an exception := tag t and some glue for the continuation. ( 1 ) ( 0 ) ( 1 ) t : P t ! 0 ! 0 + Y ‰ throw t,Y := [ ] ‹ tag = Y : P t ! Y Y ) Exception handling := untag t with pattern matching. Considering the handler g ( 1 ) : P t ! Y : ( 0 ) ( 2 ) catch ( t ) g ) ( 2 ) := [ id j g ( 1 ) ‹ untag : Y + 0 ‰ = Y ! Y t ] Y B. Ekici (LJK) Effect certification November 5, 2014 16 / 30
try-catch block ) try ` catch block can be expressed by compositions of decorated terms: For any f ( 1 ) : X ! Y : try f f g catch ( t ) g ) ( 1 ) := ( 0 ) ( 2 ) j g ( 1 ) ‹ untag t ] ‹ f ( 1 ) ) : X ! Y ‰ = Y + 0 ‰ # ([ id = Y ! Y Y ) try bounds the scope of catch B. Ekici (LJK) Effect certification November 5, 2014 17 / 30
Decorated logic: exceptions - rules The given logic is enriched with some number of rules: Conversion rules f ( d ) ” g ( d 0 ) f ( d ) ‰ g ( d 0 ) f ( 0 ) f ( 1 ) if max ( d ; d 0 ) » 1 f ( 1 ) f ( 2 ) f ‰ g f ” g Equivalence rules Rules on monadic equational logic Categorical coproduct rules Observational properties: tag & untag t : Excn t ; r : Excn t 6 = r ( ax 1 ) ( ax 2 ) ( 2 ) ( 1 ) ( 2 ) ( 1 ) ( 0 ) ( 1 ) ‰ id P t ( 0 ) ‹ tag ‹ tag ‰ [ ] P r ‹ tag untag untag r t t t t B. Ekici (LJK) Effect certification November 5, 2014 18 / 30
Soundness of the inference system Axioms/rules allow us to prove: propagator propagates: g ( 1 ) ‹ [ ] ( 0 ) ( 0 ) ” [ ] 1 X Y ( 1 ) ( 2 ) ( 0 ) 2 annihilation untag-tag: tag ‹ untag ” id t t ✵ annihilation catch-raise: try f f g catch ( t ) throw t ; Y ) ( 1 ) ” f ( 1 ) 3 commutation untag-untag: given s 6 = t 4 ( 2 ) ( 0 ) ( 2 ) ( 0 ) ( 2 ) ( 2 ) s ) ‹ untag ” ( id s ) ‹ untag ( untag t + id t + untag s t 5 commutation catch-catch: given s 6 = t try f f g catch ( t ) g j s ) h ) ( 1 ) ” try f f g catch ( s ) h j t ) g ) ( 1 ) B. Ekici (LJK) Effect certification November 5, 2014 19 / 30
Contents 1 Dynamic evaluation through exceptions 2 Proofs with side effects 3 Coq in play B. Ekici (LJK) Effect certification November 5, 2014 20 / 30
Coq in one slide Coq: proof assistant strongly typed , purely functional programming language ◮ not Turing complete: non-termination avoided B. Ekici (LJK) Effect certification November 5, 2014 21 / 30
Coq in one slide Coq: proof assistant strongly typed , purely functional programming language ◮ not Turing complete: non-termination avoided ) Underlying type theory: Calculus of Inductive Constructions (CIC) [Coquand et al’89]. B. Ekici (LJK) Effect certification November 5, 2014 21 / 30
Coq in one slide Coq: proof assistant strongly typed , purely functional programming language ◮ not Turing complete: non-termination avoided ) Underlying type theory: Calculus of Inductive Constructions (CIC) [Coquand et al’89]. CIC: extension to simply typed lambda calculus with ◮ polymorphism: terms depending on types ◮ type operators: types depending on types ◮ dependent types: types depending on terms ◮ inductive definitions Type predicativity (hierarchy): to avoid Russell-like paradoxes. B. Ekici (LJK) Effect certification November 5, 2014 21 / 30
Recommend
More recommend
