Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work A Deep Embedding of a Decidable Fragment of Separation Logic in HOL Thomas Tuerk Mike Gordon ARG Lunch, 26th June 2006
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Overview Motivation Basic Definitions A Decision Procedure for Entailments HOL embedding Example Conclusions and Future Work
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Smallfoot • ”Smallfoot is an automatic verification tool which checks separation logic specifications of concurrent programs which manipulate dynamically-allocated recursive data structures.” (Smallfoot documentation) • developed by • Cristiano Calcagno • Josh Berdine • Peter O’Hearn
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Smallfoot II Example from list.sf list_copy(p) [list(p)] { local t; t = p; q = NULL; while(t != NULL) [list(q) * lseg(p,t) * list(t)] { sq = q; q = new(); q->tl = sq; t = t->tl; } } [list(p) * list(q)]
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Motivation • we deeply embedded the fragment of separation logic used by Smallfoot in HOL • a decision procedure for entailments has been implemented in HOL • this formalisation may increase the trust in Smallfoot • it may be used as a basis for non decidable fragments of separation logic and an interactive proof environment • it may be extended to a HOL implementation of Smallfoot
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Pure Formulae • an expression is either a constant or a variable • nil is a special constant • a stack is a variable assignment • pure formulae are inductively defined by • true • e 1 . = e 2 , e 1 � . = e 2 • pf 1 ∧ pf 2 • the semantics of pure formulae with respect to a stack are defined in the natural way
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae • a heap is finite map h : ( Values \ { nil } ) fin fin − → Fields − → Values • spatial formulae are inductively defined by • emp • e ֒ → [ t 1 : e 1 , . . . , t n : e n ] • sf 1 ∗ sf 2 • tree(( t 1 , . . . , t n ) , es , e ) • list segments and binary trees are defined as syntactic sugar • bin-tree( l , r , e ) := tree(( l , r ) , nil , e ) • ls( tl , e 1 , e 2 ) := tree( tl , e 2 , e 1 )
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l bin-tree( l , r , x 1 )
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l tree(( l , r ) , nil , x 1 )
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l ∃ e l , e r . x 1 ֒ → [ l : e l , r : e r ] ∗ tree(( l , r ) , nil , e l ) ∗ tree(( l , r ) , nil , e r )
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l x 1 ֒ → [ l : 2 , r : nil] ∗ tree(( l , r ) , nil , 2) ∗ tree(( l , r ) , nil , nil)
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l x 1 ֒ → [ l : 2 , r : nil] ∗ tree(( l , r ) , nil , 2) ∗ tree(( l , r ) , nil , nil)
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l x 1 ֒ → [ l : 2 , r : nil] ∗ 2 ֒ → [ l : nil , r : nil] ∗ tree(( l , r ) , nil , nil) ∗ tree(( l , r ) , nil , nil) ∗ tree(( l , r ) , nil , nil)
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Spatial Formulae II 1 r l s ( x i ) := i 2 h := [1 → [ l → 2 , r → nil ] , 2 → [ l → nil , r → nil ]] r l x 1 ֒ → [ l : 2 , r : nil] ∗ 2 ֒ → [ l : nil , r : nil] ∗ tree(( l , r ) , nil , nil) ∗ tree(( l , r ) , nil , nil) ∗ tree(( l , r ) , nil , nil)
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Entailments • entailments are important for Smallfoot • example from list.sf x 0 � . = nil , x 1 � . = nil , x 2 � . = nil , x 0 � . = x 3 , x 0 � . = x 2 , x 4 � . = x 5 , x 1 � . = x 3 , x 1 � . = x 2 , x 3 � . = x 2 , x 2 ֒ → [ hd : x 5 , tl : x 3 ] , ls( tl , x 3 , nil) , ls( tl , x 1 , x 0 ) , x 0 ֒ → [ tl , x 2 ] ⊢ ls( tl , x 1 , x 2 ) , x 2 ֒ → [ tl : x 3 ] , ls( tl , x 3 , nil) • entailments in this fragment of separation logic are decidable • inferences can be easily combined to form a decision procedure • inferences and decision procedure are presented in Josh Berdine, Cristiano Calcagno, and Peter W. O’Hearn. Symbolic Execution with Separation Logic. In K. Yi (Ed.): APLAS 2005, LNCS 3780, pp. 52-68, 2005.
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work RemoveTrivial RemoveTrivial-EQ-L Π , Σ ⊢ Π ′ , Σ ′ e . = e , Π , Σ ⊢ Π ′ , Σ ′ RemoveTrivial-EQ-R Π , Σ ⊢ Π ′ , Σ ′ Π , Σ ⊢ e . = e , Π ′ , Σ ′ RemoveTrivial-EmpTree-L Π , Σ ⊢ Π ′ , Σ ′ Π , tree(( t 1 , . . . , t k ) , e , e ) , Σ ⊢ Π ′ , Σ ′ RemoveTrivial-EmpTree-R Π , Σ ⊢ Π ′ , Σ ′ Π , Σ ⊢ Π ′ , tree(( t 1 , . . . , t k ) , e , e ) , Σ ′
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Hypothesis Hypothesis pf , Π , Σ ⊢ Π ′ , Σ ′ pf , Π , Σ ⊢ pf , Π ′ , Σ ′
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Axiom / Inconsistent Axiom Π ⊢ Inconsistent-unequal Inconsistent-pointsto-nil e � . = e , Π , Σ ⊢ Π ′ , Σ ′ → [ . . . ] , Σ ⊢ Π ′ , Σ ′ Π , nil ֒
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Frame Frame-base Π , Σ ⊢ Π ′ , Σ ′ Π , sf , Σ ⊢ Π ′ , sf , Σ ′ • problem: this is a real implication, information is lost • thus, order of inference application matters • example: e ֒ → [ f : e 1 ] , e ֒ → [ g : e 2 ] ⊢ e ֒ → [ f : e 1 ] • solution: add additional informations to entailments
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Frame II Frame-points to e , η, π, Π , Σ ⊢ Π ′ , Σ ′ = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = m ≤ n → [ t 1 : e 1 , . . . , t n : e n ] , Σ ⊢ Π ′ , e ֒ → [ t 1 : e 1 , . . . , t m : e m ] , Σ ′ η, π, Π , e ֒ Frame-tree η, ( e , es ) , π, Π , Σ ⊢ Π ′ , Σ ′ = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = η, π, Π , tree(( t 1 , . . . , t k ) , es , e ) , Σ ⊢ Π ′ , tree(( t 1 , . . . , t k ) , es , e ) , Σ ′ • all used inferences are equivalences • order of application does not matter • continued applications of inferences will terminate
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work Substitution Substitution η [ e / x ] , π [ e / x ] , Π[ e / x ] , Σ[ e / x ] ⊢ Π ′ [ e / x ] , Σ ′ [ e / x ] = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = η, x . = e , π, Π , Σ ⊢ Π ′ , Σ ′
Motivation Basic Definitions Entailments HOL embedding Example Conclusions and Future Work NIL-NOT-LVAL NIL-NOT-LVAL-pointsto η, π, e � . → [ . . . ] , Σ ⊢ Π ′ , Σ ′ = nil , Π , e ֒ = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = → [ . . . ] , Σ ⊢ Π ′ , Σ ′ η, π, Π , e ֒ NIL-NOT-LVAL-tree η, π, e � . = nil , e � . = es , Π , tree ( . . . , es , e ) , Σ ⊢ Π ′ , Σ ′ = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = η, π, e � . = es , Π , tree ( . . . , es , e ) , Σ ⊢ Π ′ , Σ ′ side condition In order to prevent looping only new facts are added.
Recommend
More recommend
