The Ramify Rule of Separation Logic Compositional Reasoning for - PowerPoint PPT Presentation

The Ramify Rule of Separation Logic Compositional Reasoning for Sharing Jules Villard 1 Joint work with Aquinas Hobor 2 1 University College London 2 National University of Singapore

Programs with Sharing in the Wild Graphs Acyclic graphs (DAGs) Overlaid data structures (threaded tree) Sharing  ④ 

Programs with Sharing ✌ Everywhere ✌ Many variations over a few core principles (traversal, marking, copying, . . . ) ✌ Short programs, intricate reasoning ✌ Lots of pointer swinging (tree rotation, Schorr-Waite, . . . ) ✌ Challenge for compositionality Sharing  ④ 

Compositional Formal Verification ✌ Reasoning about a system by reasoning about its parts in isolation ✌ System = Program ✌ Parts = Functions ✌ Reasoning = t P ✉ c t Q ✉ Sharing  ④ 

t ✉ t ✉ ✏ t ✉ t ✉ Compositionality for Pointer Programs Success: Separation Logic ✌ The frame rule provides compositional reasoning: Frame t P ✉ c t Q ✉ t P ✎ F ✉ c t Q ✎ F ✉ ✌ Data structures without sharing (lists, trees, . . . ) ✌ Compositionality based on disjointness of memory accesses An answer to the frame problem : “Describing what does not change as a result of an action” Sharing  ④ 

Compositionality for Pointer Programs Success: Separation Logic ✌ The frame rule provides compositional reasoning: t ✉ c t ✉ Frame t P ✉ c t Q ✉ F ✏ t ✉ c t ✉ t P ✎ F ✉ c t Q ✎ F ✉ ✌ Data structures without sharing (lists, trees, . . . ) ✌ Compositionality based on disjointness of memory accesses An answer to the frame problem : “Describing what does not change as a result of an action” Sharing  ④ 

✌ ✌ ✌ Framing vs Data Structures with Sharing Frame t ✉ c t ✉ F ✏ t ✉ c t ✉ Sharing  ④ 

✌ ✌ ✌ Framing vs Data Structures with Sharing Frame t ✉ c t ✉ F ✏ t ✉ c t ✉ Sharing  ④ 

Framing vs Data Structures with Sharing Frame t ✉ c t ✉ F ✏ t ✉ c t ✉ Previous Attempts ✌ Contrived predicates that circumvent the sharing ✌ Leads to compositional, but ad-hoc reasoning ✌ No general solution Sharing  ④ 

This Talk: Ramification Ramification Problem in AI: “The ramification problem is concerned with indirect consequences of an action.” Ramification Rule of Separation Logic ✌ Embrace sharing ✌ Concise, compositional proofs ✌ Expose and resolve global effects of local actions uniformly ✌ All within vanilla separation logic Sharing  ④ 

Separation, Frame, and Trees

The Frame Rule of Separation Logic Frame t P ✉ c t Q ✉ t P ✎ F ✉ c t Q ✎ F ✉ ✌ σ 1 ✌ σ 2 is the disjoint union of σ 1 and σ 2 ✌ σ ✭ P 1 ✎ P 2 iff ❉ σ 1 , σ 2 . σ ✏ σ 1 ✌ σ 2 & σ 1 ✭ P 1 & σ 2 ✭ P 2 ô P 1 ✎ P 2 P 1 P 2 Separation, Frame, and Trees  ④ 

The Frame Rule of Separation Logic Frame t P ✉ c t Q ✉ c P � Q t P ✎ F ✉ c t Q ✎ F ✉ ✌ σ 1 ✌ σ 2 is the disjoint union of σ 1 and σ 2 ✌ σ ✭ P 1 ✎ P 2 iff ❉ σ 1 , σ 2 . σ ✏ σ 1 ✌ σ 2 & σ 1 ✭ P 1 & σ 2 ✭ P 2 ô P 1 ✎ P 2 P 1 P 2 Separation, Frame, and Trees  ④ 

The Frame Rule of Separation Logic Frame t P ✉ c t Q ✉ c P F � Q F t P ✎ F ✉ c t Q ✎ F ✉ ✌ σ 1 ✌ σ 2 is the disjoint union of σ 1 and σ 2 ✌ σ ✭ P 1 ✎ P 2 iff ❉ σ 1 , σ 2 . σ ✏ σ 1 ✌ σ 2 & σ 1 ✭ P 1 & σ 2 ✭ P 2 ô P 1 ✎ P 2 P 1 P 2 Separation, Frame, and Trees  ④ 

Binary Trees in SL def tree ♣ x , τ q ✏ ♣ x ✏ 0 ❫ emp ❫ τ ✏ ❍q ❍ ❴ ❉ L , R , M , τ L , τ R . x ÞÑ m : M , ℓ : L , r : R ✎ tree ♣ L , τ L q ✎ tree ♣ R , τ R q ❫ τ ✏ node ♣ x , M , τ L , τ R q Separation, Frame, and Trees  ④ 

✧ t ÞÑ ♠ r ✎ ♣ ❧ q ✎ ♣ r q ✯ ❧ r ❫ ✏ ♣ q ✧ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r q ✯ ❧ r ❫ ✏ ♣ q ✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q ✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q Marking a Tree 1 str✉❝t ♥♦❞❡ ④s❤♦rt ♠❀ str✉❝t ♥♦❞❡ ✯❧✱✯r❀⑥❀ 2 3 ✈♦✐❞ ♠❛r❦❴tr❡❡✭ str✉❝t ♥♦❞❡ ✯t✮ ④ ✴✴ t tree ♣ t , τ q✉ ✐❢ ✭✦t ⑤⑤ t✲❃♠✮ r❡t✉r♥❀ 4 str✉❝t ♥♦❞❡ ✯❧ ❂ t✲❃❧✱ ✯r ❂ t✲❃r❀ 5 6 ✴✴ ♠❛r❦❴tr❡❡✭❧✮❀ 7 8 ✴✴ ♠❛r❦❴tr❡❡✭r✮❀ 9 10 ✴✴ t✲❃♠ ❂ ✶❀ 11 12 ✴✴ 13 ⑥ ✴✴ t tree ♣ t , m ♣ τ qq✉ Separation, Frame, and Trees  ④ 

✧ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r q ✯ ❧ r ❫ ✏ ♣ q ✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q ✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q Marking a Tree 1 str✉❝t ♥♦❞❡ ④s❤♦rt ♠❀ str✉❝t ♥♦❞❡ ✯❧✱✯r❀⑥❀ 2 3 ✈♦✐❞ ♠❛r❦❴tr❡❡✭ str✉❝t ♥♦❞❡ ✯t✮ ④ ✴✴ t tree ♣ t , τ q✉ ✐❢ ✭✦t ⑤⑤ t✲❃♠✮ r❡t✉r♥❀ 4 str✉❝t ♥♦❞❡ ✯❧ ❂ t✲❃❧✱ ✯r ❂ t✲❃r❀ 5 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , τ ℓ q ✎ tree ♣ r , τ r q ✯ 6 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭❧✮❀ 7 8 ✴✴ ♠❛r❦❴tr❡❡✭r✮❀ 9 10 ✴✴ t✲❃♠ ❂ ✶❀ 11 12 ✴✴ 13 ⑥ ✴✴ t tree ♣ t , m ♣ τ qq✉ Separation, Frame, and Trees  ④ 

✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q ✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q Marking a Tree 1 str✉❝t ♥♦❞❡ ④s❤♦rt ♠❀ str✉❝t ♥♦❞❡ ✯❧✱✯r❀⑥❀ 2 3 ✈♦✐❞ ♠❛r❦❴tr❡❡✭ str✉❝t ♥♦❞❡ ✯t✮ ④ ✴✴ t tree ♣ t , τ q✉ ✐❢ ✭✦t ⑤⑤ t✲❃♠✮ r❡t✉r♥❀ 4 str✉❝t ♥♦❞❡ ✯❧ ❂ t✲❃❧✱ ✯r ❂ t✲❃r❀ 5 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , τ ℓ q ✎ tree ♣ r , τ r q ✯ 6 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭❧✮❀ 7 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , τ r q ✯ 8 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭r✮❀ 9 10 ✴✴ t✲❃♠ ❂ ✶❀ 11 12 ✴✴ 13 ⑥ ✴✴ t tree ♣ t , m ♣ τ qq✉ Separation, Frame, and Trees  ④ 

✧ ✯ t ÞÑ ♠ r ✎ ♣ ❧ ♣ qq ✎ ♣ r ♣ qq ❧ r ❫ ✏ ♣ q Marking a Tree 1 str✉❝t ♥♦❞❡ ④s❤♦rt ♠❀ str✉❝t ♥♦❞❡ ✯❧✱✯r❀⑥❀ 2 3 ✈♦✐❞ ♠❛r❦❴tr❡❡✭ str✉❝t ♥♦❞❡ ✯t✮ ④ ✴✴ t tree ♣ t , τ q✉ ✐❢ ✭✦t ⑤⑤ t✲❃♠✮ r❡t✉r♥❀ 4 str✉❝t ♥♦❞❡ ✯❧ ❂ t✲❃❧✱ ✯r ❂ t✲❃r❀ 5 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , τ ℓ q ✎ tree ♣ r , τ r q ✯ 6 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭❧✮❀ 7 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , τ r q ✯ 8 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭r✮❀ 9 ✧ ✯ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , m ♣ τ r qq 10 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q t✲❃♠ ❂ ✶❀ 11 12 ✴✴ 13 ⑥ ✴✴ t tree ♣ t , m ♣ τ qq✉ Separation, Frame, and Trees  ④ 

Marking a Tree 1 str✉❝t ♥♦❞❡ ④s❤♦rt ♠❀ str✉❝t ♥♦❞❡ ✯❧✱✯r❀⑥❀ 2 3 ✈♦✐❞ ♠❛r❦❴tr❡❡✭ str✉❝t ♥♦❞❡ ✯t✮ ④ ✴✴ t tree ♣ t , τ q✉ ✐❢ ✭✦t ⑤⑤ t✲❃♠✮ r❡t✉r♥❀ 4 str✉❝t ♥♦❞❡ ✯❧ ❂ t✲❃❧✱ ✯r ❂ t✲❃r❀ 5 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , τ ℓ q ✎ tree ♣ r , τ r q ✯ 6 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭❧✮❀ 7 ✧ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , τ r q ✯ 8 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q ♠❛r❦❴tr❡❡✭r✮❀ 9 ✧ ✯ t ÞÑ ♠ : 0 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , m ♣ τ r qq 10 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q t✲❃♠ ❂ ✶❀ 11 ✧ ✯ t ÞÑ ♠ : 1 , ℓ : ❧ , r : r ✎ tree ♣ ❧ , m ♣ τ ℓ qq ✎ tree ♣ r , m ♣ τ r qq 12 ✴✴ ❫ τ ✏ node ♣ 0 , τ ℓ , τ r q 13 ⑥ ✴✴ t tree ♣ t , m ♣ τ qq✉ Separation, Frame, and Trees  ④ 

Program Proofs without Sharing 1. Define inductive predicates for recursive data structures 2. Express pre- and post-conditions of the program 3. Apply logic rules to the program Separation, Frame, and Trees  ④ 

Overlap, Ramification, and DAGs