[PPT] - Disproving Inductive Entailments in Separation Logic via Base Pair PowerPoint Presentation

SLIDE 1

Disproving Inductive Entailments in Separation Logic via Base Pair Approximation

James Brotherston1 Nikos Gorogiannis2

1UCL 2Middlesex University

TABLEAUX’15, Wroclaw, 23 Sept 2015

1/ 16

SLIDE 2

Disproof, in general

Disproof is the problem of showing that an entailment

A ⊢ B (in some undecidable logic) is not valid.

2/ 16

SLIDE 3

Disproof, in general

Disproof is the problem of showing that an entailment

A ⊢ B (in some undecidable logic) is not valid.

Application in proof search: backtrack from invalid

subgoals.

2/ 16

SLIDE 4

Disproof, in general

Disproof is the problem of showing that an entailment

A ⊢ B (in some undecidable logic) is not valid.

Application in proof search: backtrack from invalid

subgoals.

Application in lemma speculation and automated theory

exploration: filter out invalid “lemmas”.

2/ 16

SLIDE 5

Disproof, in general

Disproof is the problem of showing that an entailment

A ⊢ B (in some undecidable logic) is not valid.

Application in proof search: backtrack from invalid

subgoals.

Application in lemma speculation and automated theory

exploration: filter out invalid “lemmas”.

Precision usually costs.

2/ 16

SLIDE 6

Disproof, in general

Disproof is the problem of showing that an entailment

A ⊢ B (in some undecidable logic) is not valid.

Application in proof search: backtrack from invalid

subgoals.

Application in lemma speculation and automated theory

exploration: filter out invalid “lemmas”.

Precision usually costs.
Our setting: symbolic-heap separation logic with inductive

definitions, widely used in program verification.

2/ 16

SLIDE 7

Symbolic-heap separation logic

Terms t are either variables x, y, z . . . or the constant nil.

3/ 16

SLIDE 8

Symbolic-heap separation logic

Terms t are either variables x, y, z . . . or the constant nil.
Spatial formulas F and pure formulas π given by:

F ::= emp | x → t | Pt | F ∗ F π ::= t = t | t = t (where P a predicate symbol, t a tuple of terms).

→ (“points-to”) denotes an individual pointer to a record

in the heap.

∗ (“separating conjunction”) demarks domain-disjoint

heaps.

3/ 16

SLIDE 9

Symbolic-heap separation logic

Terms t are either variables x, y, z . . . or the constant nil.
Spatial formulas F and pure formulas π given by:

F ::= emp | x → t | Pt | F ∗ F π ::= t = t | t = t (where P a predicate symbol, t a tuple of terms).

→ (“points-to”) denotes an individual pointer to a record

in the heap.

∗ (“separating conjunction”) demarks domain-disjoint

heaps.

Symbolic heaps A given by ∃x. Π : F, for Π a set of pure

formulas.

3/ 16

SLIDE 10

Inductive definitions in separation logic

Inductive predicates defined by a set of rules of form:

A ⇒ Pt (We typically suppress the existential quantifiers in A.)

4/ 16

SLIDE 11

Inductive definitions in separation logic

Inductive predicates defined by a set of rules of form:

A ⇒ Pt (We typically suppress the existential quantifiers in A.)

E.g., linked list segments with root x and tail element y

given by: emp ⇒ ls x x x = nil : x → z ∗ ls z y ⇒ ls x y

4/ 16

SLIDE 12

Inductive definitions in separation logic

Inductive predicates defined by a set of rules of form:

A ⇒ Pt (We typically suppress the existential quantifiers in A.)

E.g., linked list segments with root x and tail element y

given by: emp ⇒ ls x x x = nil : x → z ∗ ls z y ⇒ ls x y

E.g., binary trees with root x given by:

x = nil : emp ⇒ bt x x = nil : x → (y, z) ∗ bt y ∗ bt z ⇒ bt x

4/ 16

SLIDE 13

Semantics

Models are stacks s : Var → Val paired with heaps

h : Loc ⇀fin Val. ◦ is union of domain-disjoint heaps; e is the empty heap; nil is a non-allocable value.

5/ 16

SLIDE 14

Semantics

Models are stacks s : Var → Val paired with heaps

h : Loc ⇀fin Val. ◦ is union of domain-disjoint heaps; e is the empty heap; nil is a non-allocable value.

Forcing relation s, h |

= A given by

s, h | =Φ t1 = (=)t2 ⇔ s(t1) = (=)s(t2) s, h | =Φ emp ⇔ h = e s, h | =Φ x → t ⇔ dom(h) = {s(x)} and h(s(x)) = s(t) s, h | =Φ Pit ⇔ (s(t), h) ∈ PiΦ s, h | =Φ F1 ∗ F2 ⇔ ∃h1, h2. h = h1 ◦ h2 and s, h1 | =Φ F1 and s, h2 | =Φ F2 s, h | =Φ ∃z. Π : F ⇔ ∃v ∈ Val|z|. s[z → v], h | =Φ π for all π ∈ Π and s[z → v], h | =Φ F

5/ 16

SLIDE 15

Disproof in our logic

Entailment is here undecidable [Antoupoulos et al.,

FOSSACS’14], although satisfiability is decidable [Brotherston et al., CSL-LICS’14].

6/ 16

SLIDE 16

Disproof in our logic

Entailment is here undecidable [Antoupoulos et al.,

FOSSACS’14], although satisfiability is decidable [Brotherston et al., CSL-LICS’14].

To disprove A ⊢ B, we need a countermodel (s, h) s.t.

s, h | =Φ A but s, h | =Φ B.

6/ 16

SLIDE 17

Disproof in our logic

Entailment is here undecidable [Antoupoulos et al.,

FOSSACS’14], although satisfiability is decidable [Brotherston et al., CSL-LICS’14].

To disprove A ⊢ B, we need a countermodel (s, h) s.t.

s, h | =Φ A but s, h | =Φ B.

Model checking has only very recently been shown

decidable, in fact EXPTIME-complete [Brotherston et al., submitted, 2015].

6/ 16

SLIDE 18

Disproof in our logic

Entailment is here undecidable [Antoupoulos et al.,

FOSSACS’14], although satisfiability is decidable [Brotherston et al., CSL-LICS’14].

To disprove A ⊢ B, we need a countermodel (s, h) s.t.

s, h | =Φ A but s, h | =Φ B.

Model checking has only very recently been shown

decidable, in fact EXPTIME-complete [Brotherston et al., submitted, 2015].

Enumerating and checking all possible counter-models is

complete, but complicated and, I suspect, ridiculously expensive.

6/ 16

SLIDE 19

Base pairs [Brotherston et al., CSL-LICS’14]

For any symbolic heap A, we can compute an
verapproximation, baseΦ(A).

7/ 16

SLIDE 20

Base pairs [Brotherston et al., CSL-LICS’14]

For any symbolic heap A, we can compute an
verapproximation, baseΦ(A). Each “base pair” records,

for each possible way of constructing a model of A,

1. the variables in FV (A) that must be allocated, and
2. the (dis)equalities over FV (A) ∪ {nil} that must hold.

7/ 16

SLIDE 21

Base pairs [Brotherston et al., CSL-LICS’14]

For any symbolic heap A, we can compute an
verapproximation, baseΦ(A). Each “base pair” records,

for each possible way of constructing a model of A,

1. the variables in FV (A) that must be allocated, and
2. the (dis)equalities over FV (A) ∪ {nil} that must hold.
E.g., recall linked list segment predicate ls:

emp ⇒ ls x x x = nil : x → z ∗ ls z y ⇒ ls x y

7/ 16

SLIDE 22

Base pairs [Brotherston et al., CSL-LICS’14]

For any symbolic heap A, we can compute an
verapproximation, baseΦ(A). Each “base pair” records,

for each possible way of constructing a model of A,

1. the variables in FV (A) that must be allocated, and
2. the (dis)equalities over FV (A) ∪ {nil} that must hold.
E.g., recall linked list segment predicate ls:

emp ⇒ ls x x x = nil : x → z ∗ ls z y ⇒ ls x y We obtain two base pairs: baseΦ(ls x y) = {(∅, {x = y}), ({x}, {x = nil})}

7/ 16

SLIDE 23

Connecting base pairs and models

Base pairs are formally related to models as follows.

8/ 16

SLIDE 24

Connecting base pairs and models

Base pairs are formally related to models as follows.

Lemma (1) Given (V, Π) ∈ baseΦ(A), a stack s s.t. s | = Π, and finite set W ⊂ Loc \ s(V ), then ∃h. s, h | =Φ A and W ∩ dom(h) = ∅.

8/ 16

SLIDE 25

Connecting base pairs and models

Base pairs are formally related to models as follows.

Lemma (1) Given (V, Π) ∈ baseΦ(A), a stack s s.t. s | = Π, and finite set W ⊂ Loc \ s(V ), then ∃h. s, h | =Φ A and W ∩ dom(h) = ∅. Lemma (2) If s, h | =Φ B, there is a base pair (V, Π) ∈ baseΦ(B) such that s(V ) ⊆ dom(h) and s | = Π.

8/ 16

SLIDE 26

Connecting base pairs and models

Base pairs are formally related to models as follows.

Lemma (1) Given (V, Π) ∈ baseΦ(A), a stack s s.t. s | = Π, and finite set W ⊂ Loc \ s(V ), then ∃h. s, h | =Φ A and W ∩ dom(h) = ∅. Lemma (2) If s, h | =Φ B, there is a base pair (V, Π) ∈ baseΦ(B) such that s(V ) ⊆ dom(h) and s | = Π.

Consequently, we can use Lemma 1 to construct a model of

A and then Lemma 2 to show it cannot be a model of B.

8/ 16

SLIDE 27

Disproof “game”

Game (1)

Given A ⊢ B. a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A);
a stack s such that s |

= Π; and

a finite set W ⊂ Loc \ s(X).

9/ 16

SLIDE 28

Disproof “game”

Game (1)

Given A ⊢ B. a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A);
a stack s such that s |

= Π; and

a finite set W ⊂ Loc \ s(X).
A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that s | = Θ and W ∩ s(Y ) = ∅.

9/ 16

SLIDE 29

Disproof “game”

Game (1)

Given A ⊢ B. a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A);
a stack s such that s |

= Π; and

a finite set W ⊂ Loc \ s(X).
A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that s | = Θ and W ∩ s(Y ) = ∅.

A move is winning if there is no possible response.

9/ 16

SLIDE 30

Disproof “game”

Game (1)

Given A ⊢ B. a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A);
a stack s such that s |

= Π; and

a finite set W ⊂ Loc \ s(X).
A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that s | = Θ and W ∩ s(Y ) = ∅.

A move is winning if there is no possible response.

Proposition If Player 1 has a winning move for A ⊢ B then it is invalid.

9/ 16

SLIDE 31

Refined disproof “game”

Game (2)

Given A ⊢ B, a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A), and
a partition σ of FV (A) ∪ FV (B) ∪ {nil} s.t. σ |

= Π.

10/ 16

SLIDE 32

Refined disproof “game”

Game (2)

Given A ⊢ B, a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A), and
a partition σ of FV (A) ∪ FV (B) ∪ {nil} s.t. σ |

= Π.

A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that σ | = Θ and ∀y ∈ Y \ X. ∃x ∈ X. y ≡σ x.

10/ 16

SLIDE 33

Refined disproof “game”

Game (2)

Given A ⊢ B, a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A), and
a partition σ of FV (A) ∪ FV (B) ∪ {nil} s.t. σ |

= Π.

A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that σ | = Θ and ∀y ∈ Y \ X. ∃x ∈ X. y ≡σ x.

A winning move is (still) a move with no response.

10/ 16

SLIDE 34

Refined disproof “game”

Game (2)

Given A ⊢ B, a move by Player 1 is a choice of:
a base pair (X, Π) ∈ baseΦ(A), and
a partition σ of FV (A) ∪ FV (B) ∪ {nil} s.t. σ |

= Π.

A response by Player 2 is a base pair (Y, Θ) ∈ baseΦ(B)

such that σ | = Θ and ∀y ∈ Y \ X. ∃x ∈ X. y ≡σ x.

A winning move is (still) a move with no response.

Theorem Games 1 and 2 are equivalent, and decidable.

10/ 16

SLIDE 35

An example

Consider bt x ⊢ ls x y (invalid).

11/ 16

SLIDE 36

An example

Consider bt x ⊢ ls x y (invalid).
We have base pair approximations:

baseΦ(bt x) = {(∅, {x = nil}), ({x}, {x = nil})} baseΦ(ls x y) = {(∅, {x = y}), ({x}, {x = nil})}

11/ 16

SLIDE 37

An example

Consider bt x ⊢ ls x y (invalid).
We have base pair approximations:

baseΦ(bt x) = {(∅, {x = nil}), ({x}, {x = nil})} baseΦ(ls x y) = {(∅, {x = y}), ({x}, {x = nil})}

Winning move: choose base pair (∅, {x = nil}) and any

partition σ s.t. x ≡σ nil and x ≡σ y.

11/ 16

SLIDE 38

An example

Consider bt x ⊢ ls x y (invalid).
We have base pair approximations:

baseΦ(bt x) = {(∅, {x = nil}), ({x}, {x = nil})} baseΦ(ls x y) = {(∅, {x = y}), ({x}, {x = nil})}

Winning move: choose base pair (∅, {x = nil}) and any

partition σ s.t. x ≡σ nil and x ≡σ y.

Now consider ls x y ⊢ bt x (also invalid).

11/ 16

SLIDE 39

An example

Consider bt x ⊢ ls x y (invalid).
We have base pair approximations:

baseΦ(bt x) = {(∅, {x = nil}), ({x}, {x = nil})} baseΦ(ls x y) = {(∅, {x = y}), ({x}, {x = nil})}

Winning move: choose base pair (∅, {x = nil}) and any

partition σ s.t. x ≡σ nil and x ≡σ y.

Now consider ls x y ⊢ bt x (also invalid).
Winning move: choose base pair (∅, {x = y}) and any

partition σ s.t. x ≡σ y and x ≡σ nil.

11/ 16

SLIDE 40

Limitations

Our method is terminating and therefore incomplete.

12/ 16

SLIDE 41

Limitations

Our method is terminating and therefore incomplete.
Most importantly, our base pair overapproximations are

essentially projections onto the free variables of entailments.

12/ 16

SLIDE 42

Limitations

Our method is terminating and therefore incomplete.
Most importantly, our base pair overapproximations are

essentially projections onto the free variables of entailments.

E.g., the entailment x → nil ⊢ emp is invalid, while

x → nil ⊢ ∃y. y → nil is valid but, since neither RHS has any free variables, baseΦ(emp) = baseΦ(∃y. y → nil) = {(∅, ∅)} so we can’t distinguish the two entailments.

12/ 16

SLIDE 43

Experimental evaluation (1)

We generated entailments of the form Px ⊢ Qy, where
P and Q are inductive predicates taken from pre-existing

benchmarks in SL-COMP competition (63 predicates total);

x is a tuple of distinct variables;
all variables in y appear in x.

13/ 16

SLIDE 44

Experimental evaluation (1)

We generated entailments of the form Px ⊢ Qy, where
P and Q are inductive predicates taken from pre-existing

benchmarks in SL-COMP competition (63 predicates total);

x is a tuple of distinct variables;
all variables in y appear in x.
This is typical of automated theory exploration. We get

818988 entailments; most will be invalid.

13/ 16

SLIDE 45

Experimental evaluation (1)

We generated entailments of the form Px ⊢ Qy, where
P and Q are inductive predicates taken from pre-existing

benchmarks in SL-COMP competition (63 predicates total);

x is a tuple of distinct variables;
all variables in y appear in x.
This is typical of automated theory exploration. We get

818988 entailments; most will be invalid.

Our technique disproves > 97% of the entailments in the

test set, taking at most 30ms for each.

13/ 16

SLIDE 46

Experimental evaluation (1)

We generated entailments of the form Px ⊢ Qy, where
P and Q are inductive predicates taken from pre-existing

benchmarks in SL-COMP competition (63 predicates total);

x is a tuple of distinct variables;
all variables in y appear in x.
This is typical of automated theory exploration. We get

818988 entailments; most will be invalid.

Our technique disproves > 97% of the entailments in the

test set, taking at most 30ms for each.

Of the remainder, we could prove about 250 valid.

13/ 16

SLIDE 47

Experimental evaluation (2)

SLL test suite (from SL-COMP competition) considers

entailments over acyclic list segments only: emp ⇒ als x x x = nil, x = y : x → z ∗ als z y ⇒ als x y

14/ 16

SLIDE 48

Experimental evaluation (2)

SLL test suite (from SL-COMP competition) considers

entailments over acyclic list segments only: emp ⇒ als x x x = nil, x = y : x → z ∗ als z y ⇒ als x y

Here, of 120 invalid sequents, we disprove only about 24%.

14/ 16

SLIDE 49

Experimental evaluation (2)

SLL test suite (from SL-COMP competition) considers

entailments over acyclic list segments only: emp ⇒ als x x x = nil, x = y : x → z ∗ als z y ⇒ als x y

Here, of 120 invalid sequents, we disprove only about 24%.
So we do (much) better in some situations than others.
In fact this sub-fragment is polynomially decidable anyway.

14/ 16

SLIDE 50

Conclusions / future work

We give a method for entailment disproof in separation

logic with user-defined inductive predicates.

Our method is incomplete, but terminating, and pretty

cheeeap.

Therefore, potentially useful for proof search and

automated theory exploration.

Future work: develop more precise disproving techniques

(e.g., by direct countermodel generation).

15/ 16

SLIDE 51

Thanks for listening!

Try our techniques within the Cyclist distribution: github.com/ngorogiannis/cyclist

16/ 16