Automatic Cyclic Termination Proofs for Recursive Procedures in - PowerPoint PPT Presentation

Automatic Cyclic Termination Proofs for Recursive Procedures in Separation Logic Reuben Rowe, University of Kent, Canterbury James Brotherston, University College London CPP, Paris, France Monday 16 th January 2017

Automatically Proving Termination: Challenges proc shuffle(x) { if x != nil { y := *x; reverse(y); shuffle(y); } } heap manipulation intermediate procedures recursion 1/12

Automatically Proving Termination: Challenges proc shuffle(x) { if x != nil { y := *x; reverse(y); shuffle(y); } } heap manipulation intermediate procedures recursion 1/12

Automatically Proving Termination: Challenges proc shuffle(x) { if x != nil { y := *x; reverse(y); shuffle(y); } } heap manipulation intermediate procedures recursion 1/12

Automatically Proving Termination: Challenges proc shuffle(x) { if x != nil { y := *x; reverse(y); shuffle(y); } } heap manipulation intermediate procedures recursion 1/12

Automatically Proving Termination using Cyclic Proof . • We use the Cyclist framework for automation/certifjcation (Axiom) (Axiom) (Axiom) • Following the approach of Brotherston et al. (POPL ’08) (Inference) 2/12 . . . . . . . • • · • · · • . . . . . · • • • · · · φ ⊢ C

Automatically Proving Termination using Cyclic Proof (Inference) • We use the Cyclist framework for automation/certifjcation semantics total correctness (Axiom) (Axiom) (Axiom) • Following the approach of Brotherston et al. (POPL ’08) 2/12 . . . . . . . . • • · • · · • . . . . . · • • • · · · φ ⊢ C

Automatically Proving Termination using Cyclic Proof (Inference) • We use the Cyclist framework for automation/certifjcation semantics total correctness Separation Logic (Axiom) (Axiom) (Axiom) • Following the approach of Brotherston et al. (POPL ’08) 2/12 . . . . . . . . • • · • · · • . . . . . · • • • · · · φ ⊢ C

Automatically Proving Termination using Cyclic Proof (Inference) • We use the Cyclist framework for automation/certifjcation semantics total correctness Separation Logic (Axiom) • Following the approach of Brotherston et al. (POPL ’08) 2/12 . . . . . . . . • • · • · · • . . . . . · • • • · · · φ ⊢ C

Automatically Proving Termination using Cyclic Proof (Inference) • We use the Cyclist framework for automation/certifjcation semantics total correctness for data Inductive Predicates Separation Logic (Axiom) • Following the approach of Brotherston et al. (POPL ’08) 2/12 . . . . . . . . • • · • · · • . . . . . · • • • · · · φ ⊢ C

Automatically Proving Termination using Cyclic Proof (Inference) • We use the Cyclist framework for automation/certifjcation semantics total correctness for data Inductive Predicates Separation Logic (Axiom) • Following the approach of Brotherston et al. (POPL ’08) 2/12 . . . . . . . . • • · • · • . . . . . · · • • • · · · { φ } C { ψ }

Automatically Proving Termination using Cyclic Proof . • We use the Cyclist framework for automation/certifjcation (Axiom) • Following the approach of Brotherston et al. (POPL ’08) (Inference) . 2/12 . . . . . . • • · • · • . . . . . · · • • • · · · { φ } C { ψ }

Advantages of Using Cyclic Proof • Supports compositional reasoning • Naturally encapsulates inductive principles • Invariants can be discovered • Termination measures extracted automatically 3/12

Advantages of Using Cyclic Proof • Supports compositional reasoning • Naturally encapsulates inductive principles • Invariants can be discovered • Termination measures extracted automatically 3/12

Advantages of Using Cyclic Proof • Supports compositional reasoning • Naturally encapsulates inductive principles • Invariants can be discovered • Termination measures extracted automatically 3/12

Advantages of Using Cyclic Proof • Supports compositional reasoning • Naturally encapsulates inductive principles • Invariants can be discovered • Termination measures extracted automatically 3/12

y n is a single memory cell referenced by x x n describe specifjc structures Ingredients of Our Approach: Separation Logic x w v list z lseg x y nil z y e.g. lseg x y , list z • Symbolic heap syntax makes reasoning easier • Formulas of SL describe portions of the program memory • Predicates P x 1 pieces of memory B is the (separate) conjunction of two domain-disjoint • A y 1 • x • emp is the empty piece of memory 4/12

y n is a single memory cell referenced by x x n describe specifjc structures Ingredients of Our Approach: Separation Logic x w v list z lseg x y nil z y e.g. lseg x y , list z • Symbolic heap syntax makes reasoning easier • Formulas of SL describe portions of the program memory • Predicates P x 1 pieces of memory B is the (separate) conjunction of two domain-disjoint • A y 1 • x • emp is the empty piece of memory 4/12

x n describe specifjc structures Ingredients of Our Approach: Separation Logic x w v list z lseg x y nil z y • Symbolic heap syntax makes reasoning easier • Formulas of SL describe portions of the program memory e.g. lseg x y , list z • Predicates P x 1 pieces of memory B is the (separate) conjunction of two domain-disjoint • A • emp is the empty piece of memory 4/12 • x �→ ( y 1 , . . . , y n ) is a single memory cell referenced by x

x n describe specifjc structures Ingredients of Our Approach: Separation Logic y w v list z lseg x y nil z • Symbolic heap syntax makes reasoning easier x • Formulas of SL describe portions of the program memory e.g. lseg x y , list z • Predicates P x 1 pieces of memory • emp is the empty piece of memory 4/12 • x �→ ( y 1 , . . . , y n ) is a single memory cell referenced by x • A ∗ B is the (separate) conjunction of two domain-disjoint

Ingredients of Our Approach: Separation Logic y w v list z lseg x y nil z x • Formulas of SL describe portions of the program memory • Symbolic heap syntax makes reasoning easier pieces of memory • emp is the empty piece of memory 4/12 • x �→ ( y 1 , . . . , y n ) is a single memory cell referenced by x • A ∗ B is the (separate) conjunction of two domain-disjoint • Predicates P ( x 1 , . . . , x n ) describe specifjc structures e.g. lseg ( x , y ) , list ( z )

Ingredients of Our Approach: Separation Logic • Formulas of SL describe portions of the program memory • emp is the empty piece of memory pieces of memory • Symbolic heap syntax makes reasoning easier 4/12 • x �→ ( y 1 , . . . , y n ) is a single memory cell referenced by x • A ∗ B is the (separate) conjunction of two domain-disjoint • Predicates P ( x 1 , . . . , x n ) describe specifjc structures e.g. lseg ( x , y ) , list ( z ) x = y ∧ z � = nil ∧ lseg ( x , y ) ∗ list ( z ) ∗ v �→ w

Ingredients of our Approach: Symbolic Execution C proc ( x ) C ) (body proc C (proc) v x := * y ; C y ( x fresh) x v x y x v x x (load) 5/12 { φ } C { ψ } (free) : { φ ∗ x �→ y } free( x ); C { ψ }

(proc) Ingredients of our Approach: Symbolic Execution C (body proc C ) proc ( x ) 5/12 { φ } C { ψ } (free) : { φ ∗ x �→ y } free( x ); C { ψ } { x = v [ x ′ / x ] ∧ ( φ ∗ y �→ v )[ x ′ / x ] } C { ψ } (load) : ( x ′ fresh) { φ ∗ y �→ v } x := * y ; C { ψ }

Ingredients of our Approach: Symbolic Execution 5/12 { φ } C { ψ } (free) : { φ ∗ x �→ y } free( x ); C { ψ } { x = v [ x ′ / x ] ∧ ( φ ∗ y �→ v )[ x ′ / x ] } C { ψ } (load) : ( x ′ fresh) { φ ∗ y �→ v } x := * y ; C { ψ } { φ } C { ψ } (proc) : (body ( proc ) = C ) { φ } proc ( � x ) { ψ }

Ingredients of our Approach: Inductive Predicates emp C x list C x list y x C nil • We support user-defjned inductive predicates, e.g. x • A logical rule schema allows case split C x list • Predicate labels identify termination measures, e.g. 6/12 x = nil ∧ emp x �→ y ∗ list ( y ) list ( x ) list ( x )

Ingredients of our Approach: Inductive Predicates C C x list C x list y x emp • We support user-defjned inductive predicates, e.g. nil x • A logical rule schema allows case split • Predicate labels identify termination measures, e.g. 6/12 x = nil ∧ emp x �→ y ∗ list ( y ) list ( x ) list ( x ) { list α ( x ) ∗ φ } C { ψ }

Ingredients of our Approach: Inductive Predicates • We support user-defjned inductive predicates, e.g. • Predicate labels identify termination measures, e.g. • A logical rule schema allows case split 6/12 x = nil ∧ emp x �→ y ∗ list ( y ) list ( x ) list ( x ) { list α ( x ) ∗ φ } C { ψ } { ( x = nil ∧ emp ) ∗ φ } C { ψ } { ( β < α ∧ x �→ y ∗ list β ( x )) ∗ φ } C { ψ } { list α ( x ) ∗ φ } C { ψ }