Low-Level Code and High-Level Theorems Sascha Bhme Technische - - PowerPoint PPT Presentation

▶
low level code and high level theorems
SMART_READER_LITE
LIVE PREVIEW

Low-Level Code and High-Level Theorems Sascha Bhme Technische - - PowerPoint PPT Presentation

Aug 31, 2023 136 likes •717 views

Low-Level Code and High-Level Theorems Sascha Bhme Technische Universitt Mnchen, Germany Joint work with Eyad Alkassar 1 , Ernie Cohen 2 , Kurt Mehlhorn 3 and Christine Rizkallah 3 1 Universitt des Saarlandes, Germany 2 European Microsoft

slide-1
SLIDE 1

Low-Level Code and High-Level Theorems

Sascha Böhme

Technische Universität München, Germany

Joint work with Eyad Alkassar1, Ernie Cohen2, Kurt Mehlhorn3 and Christine Rizkallah3

1Universität des Saarlandes, Germany 2European Microsoft Innovation Center, Aachen, Germany 3Max-Planck-Institut für Informatik, Saarbrücken, Germany 1

slide-2
SLIDE 2

C code

2

slide-3
SLIDE 3

program verification C code

2

slide-4
SLIDE 4

program verification C code theorem

2

slide-5
SLIDE 5

program verification C code interactive theorem prover theorem

2

slide-6
SLIDE 6

program verification C code interactive theorem prover theorem

2

slide-7
SLIDE 7

program verification VCC C code interactive theorem prover Isabelle/HOL theorem

2

slide-8
SLIDE 8

VCC:

◮ assertional verifier for full C ◮ first-order logic as specification language ◮ fully automatic thanks to Boogie and Z3 ◮ specification by code annotations ◮ function contracts, object invariants ◮ ghost code, ghost functions

3

slide-9
SLIDE 9

VCC:

◮ assertional verifier for full C ◮ first-order logic as specification language ◮ fully automatic thanks to Boogie and Z3 ◮ specification by code annotations ◮ function contracts, object invariants ◮ ghost code, ghost functions

Isabelle/HOL:

◮ interactive theorem prover for higher-order logic ◮ rich set of formalized mathematics ◮ various automated provers

3

slide-10
SLIDE 10

program verification VCC C code interactive theorem prover Isabelle/HOL theorem

4

slide-11
SLIDE 11

program verification VCC C code LEDA graph algorithms interactive theorem prover Isabelle/HOL theorem

4

slide-12
SLIDE 12

LEDA graph algorithms

4

slide-13
SLIDE 13

5

slide-14
SLIDE 14

Programmers

5

slide-15
SLIDE 15

Social programmers

Graph

5

slide-16
SLIDE 16

Pair programming

Matching

5

slide-17
SLIDE 17

Optimal pair programming

Maximum cardinality matching

5

slide-18
SLIDE 18

Definitions

Matching:

◮ a graph ◮ no edge is incident to another edge

6

slide-19
SLIDE 19

Definitions

Matching:

◮ a graph ◮ no edge is incident to another edge

Odd-set cover:

◮ labeling of nodes ◮ every edge is incident to a node labeled 1 or connects

two nodes labeled i (with i ≥ 2)

6

slide-20
SLIDE 20

Optimal pair programming

Maximum cardinality matching

7

slide-21
SLIDE 21

Certificate

Odd-set cover 1 1 2 2 1 2

7

slide-22
SLIDE 22

Theorem

The maximum cardinality of a graph matching is n1 +

  • i≥2

⌊ni/2⌋

where ni is the number of nodes labeled i by an odd-set cover.

8

slide-23
SLIDE 23

LEDA graph algorithms

9

slide-24
SLIDE 24

program verification VCC C code LEDA graph algorithms interactive theorem prover Isabelle/HOL theorem

9

slide-25
SLIDE 25

program verification VCC C code LEDA graph algorithms

9

slide-26
SLIDE 26

Maximum Cardinality Matching Checker

C Code

10

slide-27
SLIDE 27

Maximum Cardinality Matching Checker

C Code

Given:

◮ graph G ◮ graph M (maximum cardinality matching) ◮ labeling OSC (odd-set cover)

10

slide-28
SLIDE 28

Maximum Cardinality Matching Checker

C Code

Given:

◮ graph G ◮ graph M (maximum cardinality matching) ◮ labeling OSC (odd-set cover)

Check:

◮ M is a matching ◮ M is a subset of G ◮ OSC is an odd-set cover of G ◮ M is maximal wrt. G and OSC

10

slide-29
SLIDE 29

Maximum Cardinality Matching Checker

C Code

Given:

◮ graph G ◮ graph M (maximum cardinality matching) ◮ labeling OSC (odd-set cover)

Check:

◮ M is a matching ◮ M is a subset of G ◮ OSC is an odd-set cover of G ◮ M is maximal wrt. G and OSC

Implementation:

◮ straightforward

10

slide-30
SLIDE 30

Maximum Cardinality Matching Checker

Specification

struct graph { edge * es; unsigned n_edges, n_nodes; }

11

slide-31
SLIDE 31

Maximum Cardinality Matching Checker

Specification

struct graph { edge * es; unsigned n_edges, n_nodes; invariant(∀(unsigned e; e < n_edges −

→

es[e].s < n_nodes ∧ es[e].t < n_nodes ∧ es[e].s = es[e].t)) }

11

slide-32
SLIDE 32

Maximum Cardinality Matching Checker

Specification

struct graph { edge * es; unsigned n_edges, n_nodes; invariant(∀(unsigned e; e < n_edges −

→

es[e].s < n_nodes ∧ es[e].t < n_nodes ∧ es[e].s = es[e].t)) } spec(bool spec_is_osc(graph * G, unsigned * osc) returns(... ∧

∀(unsigned e; e < G->n_edges − →

  • sc[G->es[e].s] = 1 ∨ osc[G->es[e].t] = 1 ∨

(osc[G->es[e].t] = osc[G->es[e].s] ∧

  • sc[G->es[e].t] > 1)));)

11

slide-33
SLIDE 33

What is proved?

check(G, M, osc) = true ←

→ |M| = n1 +

i≥2⌊ni/2⌋

12

slide-34
SLIDE 34

What is proved?

check(G, M, osc) = true ←

→ |M| = n1 +

i≥2⌊ni/2⌋

What is missing?

|M| = n1 +

i≥2⌊ni/2⌋ −

→

(∀ M’. is_matching(M’) ∧ is_subset(G,M’) −

→ |M’| ≤ |M|)

12

slide-35
SLIDE 35

What is proved?

check(G, M, osc) = true ←

→ |M| = n1 +

i≥2⌊ni/2⌋

What is missing?

|M| = n1 +

i≥2⌊ni/2⌋ −

→

(∀ M’. is_matching(M’) ∧ is_subset(G,M’) −

→ |M’| ≤ |M|)

VCC:

◮ good at low-level code verification ◮ not much support for high-level proofs

12

slide-36
SLIDE 36

What is proved?

check(G, M, osc) = true ←

→ |M| = n1 +

i≥2⌊ni/2⌋

What is missing?

|M| = n1 +

i≥2⌊ni/2⌋ −

→

(∀ M’. is_matching(M’) ∧ is_subset(G,M’) −

→ |M’| ≤ |M|)

VCC:

◮ good at low-level code verification ◮ not much support for high-level proofs

Requires abstraction!

12

slide-37
SLIDE 37

program verification VCC C code LEDA graph algorithms

13

slide-38
SLIDE 38

program verification VCC C code LEDA graph algorithms interactive theorem prover Isabelle/HOL theorem

13

slide-39
SLIDE 39

program verification VCC C code interactive theorem prover Isabelle/HOL theorem

13

slide-40
SLIDE 40

14

slide-41
SLIDE 41

Isabelle/HOL VCC

14

slide-42
SLIDE 42

Isabelle/HOL VCC

concrete property

assert(p(x));

14

slide-43
SLIDE 43

Isabelle/HOL VCC

concrete property abstract property

spec(bool P(X) returns(...);) assert(p(x));

14

slide-44
SLIDE 44

Isabelle/HOL VCC

concrete property abstract property

spec(bool P(X) returns(...);) spec(void P_equivalence(x) ensures(p(x) ⇐

⇒ P(abs(x)));)

assert(p(x));

14

slide-45
SLIDE 45

Isabelle/HOL VCC

concrete property abstract property

spec(bool P(X) returns(...);) spec(void P_holds(X) ensures(P(X));) spec(void P_equivalence(x) ensures(p(x) ⇐

⇒ P(abs(x)));)

assert(p(x));

14

slide-46
SLIDE 46

Isabelle/HOL VCC

concrete property abstract property formal proof

definition P where “P(X) = . . . ” theorem P_holds: “P(X)” proof spec(bool P(X) returns(...);) spec(void P_holds(X) ensures(P(X));) spec(void P_equivalence(x) ensures(p(x) ⇐

⇒ P(abs(x)));)

assert(p(x));

14

slide-47
SLIDE 47

Maximum Cardinality Matching Checker

VCC

15

slide-48
SLIDE 48

Maximum Cardinality Matching Checker

VCC

struct abs_graph { abs_edge es[mathint]; mathint n_edges, n_nodes; };

15

slide-49
SLIDE 49

Maximum Cardinality Matching Checker

VCC

struct abs_graph { abs_edge es[mathint]; mathint n_edges, n_nodes; }; spec(abs_graph abs_g(graph * G) ensures(...);)

15

slide-50
SLIDE 50

Maximum Cardinality Matching Checker

VCC

struct abs_graph { abs_edge es[mathint]; mathint n_edges, n_nodes; }; spec(abs_graph abs_g(graph * G) ensures(...);) spec(bool abs_is_osc(abs_graph G, abs_fun osc) ensures(...);)

15

slide-51
SLIDE 51

Maximum Cardinality Matching Checker

VCC

struct abs_graph { abs_edge es[mathint]; mathint n_edges, n_nodes; }; spec(abs_graph abs_g(graph * G) ensures(...);) spec(bool abs_is_osc(abs_graph G, abs_fun osc) ensures(...);) void is_osc_equivalence(graph * G, unsigned * osc) ensures( spec_is_osc(G, osc) ⇐

⇒

abs_is_osc(abs_g(G), abs_f(osc)));

15

slide-52
SLIDE 52

Maximum Cardinality Matching Checker

Isabelle/HOL

16

slide-53
SLIDE 53

Maximum Cardinality Matching Checker

Isabelle/HOL

record abs_graph = es :: int ⇒ abs_edge n_edges, n_nodes :: int

16

slide-54
SLIDE 54

Maximum Cardinality Matching Checker

Isabelle/HOL

record abs_graph = es :: int ⇒ abs_edge n_edges, n_nodes :: int definition abs_is_osc where “abs_is_osc G osc = (. . . ∧ (∀ e. 0 ≤ e ∧ e < n_edges G −

→

  • sc (s (es G e)) = 1 ∨ osc (t (es G e)) = 1 ∨

(osc (t (es G e)) = osc (s (es G e)) ∧ osc (t (es G e)) > 1)))”

16

slide-55
SLIDE 55

Maximum Cardinality Matching Checker

Isabelle/HOL

record abs_graph = es :: int ⇒ abs_edge n_edges, n_nodes :: int definition abs_is_osc where “abs_is_osc G osc = (. . . ∧ (∀ e. 0 ≤ e ∧ e < n_edges G −

→

  • sc (s (es G e)) = 1 ∨ osc (t (es G e)) = 1 ∨

(osc (t (es G e)) = osc (s (es G e)) ∧ osc (t (es G e)) > 1)))” theorem “|M| = n1 +

i≥2⌊ni/2⌋ −

→

(∀ M’. is_matching(M’) ∧ is_subset(G,M’) −

→ |M’| ≤ |M|)” proof

16

slide-56
SLIDE 56

Combination of VCC and Isabelle/HOL

◮ combines the best of both worlds ◮ low-level code verification with VCC ◮ high-level mathematical reasoning with Isabelle/HOL ◮ sound combination ◮ clean separation of concepts

17

slide-57
SLIDE 57

program verification VCC C code interactive theorem prover Isabelle/HOL theorem

18

slide-58
SLIDE 58

program verification VCC C code LEDA graph algorithms interactive theorem prover Isabelle/HOL theorem

18