Modular Termination Verification Bart Jacobs 1 Dragan Bosnacki 2 - - PowerPoint PPT Presentation

▶
modular termination verification
SMART_READER_LITE
LIVE PREVIEW

Modular Termination Verification Bart Jacobs 1 Dragan Bosnacki 2 - - PowerPoint PPT Presentation

Sep 14, 2022 547 likes •1.46k views

Modular Termination Verification Bart Jacobs 1 Dragan Bosnacki 2 Ruurd Kuiper 2 1 DistriNet, KU Leuven 2 Eindhoven University of Technology ECOOP 2015 Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification Disclaimer This

slide-1
SLIDE 1

Modular Termination Verification

Bart Jacobs 1 Dragan Bosnacki 2 Ruurd Kuiper 2

1DistriNet, KU Leuven 2Eindhoven University of Technology

ECOOP 2015

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-2
SLIDE 2

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed.

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-3
SLIDE 3

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly.

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-4
SLIDE 4

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-5
SLIDE 5

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules,

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-6
SLIDE 6

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-7
SLIDE 7

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-8
SLIDE 8

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-9
SLIDE 9

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Main contribution:

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-10
SLIDE 10

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Main contribution:

an approach for writing module specifications

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-11
SLIDE 11

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Main contribution:

an approach for writing module specifications that are sufficiently expressive to allow verification of client code

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-12
SLIDE 12

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Main contribution:

an approach for writing module specifications that are sufficiently expressive to allow verification of client code and sufficiently abstract to allow module implementation evolution

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-13
SLIDE 13

Disclaimer

This paper is NOT about termination analysis. No algorithms are proposed. We propose an approach for doing pencil-and-paper proofs of termination of programs modularly. I.e., we propose a notion of module correctness such that

if one succeeds in producing a paper-and-pencil proof of the correctness of each of a program’s modules, then the program terminates.

Module correctness means the module satisfies its specification

assuming that the modules it imports satisfy theirs.

Main contribution:

an approach for writing module specifications that are sufficiently expressive to allow verification of client code and sufficiently abstract to allow module implementation evolution

any modification that does not break clients should be allowed

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-14
SLIDE 14

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-15
SLIDE 15

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-16
SLIDE 16

Whole-Program Verification

num sqrt(num x) { (1 + x)/2 } num vectorSize(num x, num y) { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-17
SLIDE 17

Whole-Program Verification

num sqrt(num x) num y := (1 + x)/2; (y + x/y)/2

  • num vectorSize(num x, num y)

{ sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-18
SLIDE 18

Modular Verification

num sqrt(num x) { (1 + x)/2 } num vectorSize(num x, num y) { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-19
SLIDE 19

Modular Verification

num sqrt(num x) req 0 ≤ x ens 0 ≤ result { (1 + x)/2 } num vectorSize(num x, num y) ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-20
SLIDE 20

Modular Verification

? ? ? num sqrt(num x) req 0 ≤ x ens 0 ≤ result { (1 + x)/2 } num vectorSize(num x, num y) ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-21
SLIDE 21

Modular Verification

  • ?

? num sqrt(num x) req 0 ≤ x ens 0 ≤ result { (1 + x)/2 } num vectorSize(num x, num y) ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-22
SLIDE 22

Modular Verification

  • ?

num sqrt(num x) req 0 ≤ x ens 0 ≤ result { (1 + x)/2 } num vectorSize(num x, num y) ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-23
SLIDE 23

Modular Verification

  • num sqrt(num x)

req 0 ≤ x ens 0 ≤ result { (1 + x)/2 } num vectorSize(num x, num y) ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-24
SLIDE 24

Modular Verification

?

  • num sqrt(num x)

req 0 ≤ x ens 0 ≤ result num y := (1 + x)/2; (y + x/y)/2

  • num vectorSize(num x, num y)

ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-25
SLIDE 25

Modular Verification

  • num sqrt(num x)

req 0 ≤ x ens 0 ≤ result num y := (1 + x)/2; (y + x/y)/2

  • num vectorSize(num x, num y)

ens 0 ≤ result { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-26
SLIDE 26

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-27
SLIDE 27

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-28
SLIDE 28

Termination Verification

num sqrt(num x) { (1 + x)/2 } num vectorSize(num x, num y) { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-29
SLIDE 29

Modular Termination Verification

num sqrt(num x) level ? { (1 + x)/2 } num vectorSize(num x, num y) level ? { sqrt(x · x + y · y) } void main() level ? { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-30
SLIDE 30

Modular Termination Verification

num sqrt(num x) level 0 { (1 + x)/2 } num vectorSize(num x, num y) level 1 { sqrt(x · x + y · y) } void main() level 2 { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-31
SLIDE 31

Modular Termination Verification

num average(num x, num y) level 0 { (x + y)/2 } num sqrt(num x) level 0 { average(1, x) } num vectorSize(num x, num y) level 1 { sqrt(x · x + y · y) } void main() level 2 { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-32
SLIDE 32

Modular Termination Verification

num sqrt(num x) { (1 + x)/2 } num vectorSize(num x, num y) { sqrt(x · x + y · y) } void main() { assert 0 ≤ vectorSize(3, 4) }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-33
SLIDE 33

Classes

class Math static num sqrt(num x) { (1 + x)/2 }

  • class Util

static num vectorSize(num x, num y) { sqrt(x · x + y · y) }

  • class Main

   static void main() { assert 0 ≤ vectorSize(3, 4) }   

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-34
SLIDE 34

Import Relation

class Math static num sqrt(num x) { (1 + x)/2 }

  • class Util import Math

static num vectorSize(num x, num y) { sqrt(x · x + y · y) }

  • class Main import Util

   static void main() { assert 0 ≤ vectorSize(3, 4) }   

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-35
SLIDE 35

Levels: Method Names

class Math    static num sqrt(num x) level Math.sqrt { (1 + x)/2 }    class Util import Math    static num vectorSize(num x, num y) level Util.vectorSize { sqrt(x · x + y · y) }    class Main import Util    static void main() level Main.main { assert 0 ≤ vectorSize(3, 4) }   

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-36
SLIDE 36

Levels: Method Names

class Math    static num sqrt(num x) level sqrt { (1 + x)/2 }    class Util import Math    static num vectorSize(num x, num y) level vectorSize { sqrt(x · x + y · y) }    class Main import Util    static void main() level main { assert 0 ≤ vectorSize(3, 4) }   

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-37
SLIDE 37

Levels: Method Names

class Math                    static num average(num x, num y) level average { (x + y)/2 } static num sqrt(num x) level sqrt { average(1, x) }                    class Util import Math    static num vectorSize(num x, num y) level vectorSize { sqrt(x · x + y · y) }    class Main import Util    static void main() level main { assert 0 ≤ vectorSize(3, 4) }   

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-38
SLIDE 38

Specification Pattern

Specification Pattern · · · m(· · · ) level m { · · · } Reason Allows arbitrary upcalls.

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-39
SLIDE 39

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-40
SLIDE 40

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-41
SLIDE 41

Dynamic Binding

interface Function { num apply(num x) } class Util { static num derivative(Function f, num x) { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-42
SLIDE 42

Dynamic Binding

interface Function { num apply(num x) level ? } class Util { static num derivative(Function f, num x) level ? { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level ? { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-43
SLIDE 43

Dynamic Binding

interface Function { num apply(num x) level ? } class Util { static num derivative(Function f, num x) level ? { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-44
SLIDE 44

Dynamic Binding

interface Function { num apply(num x) level classOf(this).apply } class Util { static num derivative(Function f, num x) level ? { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-45
SLIDE 45

Dynamic Binding

interface Function { num apply(num x) level this.apply } class Util { static num derivative(Function f, num x) level ? { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-46
SLIDE 46

Dynamic Binding

interface Function { num apply(num x) level this.apply } class Util { static num derivative(Function f, num x) level derivative { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-47
SLIDE 47

Dynamic Binding

interface Function { num apply(num x) level this.apply } class Util { static num derivative(Function f, num x) level f.apply { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-48
SLIDE 48

Dynamic Binding

interface Function { num apply(num x) level this.apply } class Util { static num derivativeHelper(Function f, num x) level f.apply { f.apply(x + 1) − f.apply(x) } static num derivative(Function f, num x) level f.apply { derivativeHelper(f, x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level main { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-49
SLIDE 49

Dynamic Binding: Multiset Order

interface Function { num apply(num x) level { [this.apply] } } class Util { static num derivativeHelper(Function f, num x) level { [derivativeHelper, f.apply] } { f.apply(x + 1) − f.apply(x) } static num derivative(Function f, num x) level { [derivative, f.apply] } { derivativeHelper(f, x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Main imports Util, ZeroFunc { void main() level { [main] } { derivative(new ZeroFunc(), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-50
SLIDE 50

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-51
SLIDE 51

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-52
SLIDE 52

Complex Objects

interface Function { num apply(num x) } class Util { static num derivative(Function f, num x) { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Plus1Func(Function f) implements Function { num apply(num x) { f.apply(x) + 1 } } class Main imports Util, ZeroFunc, Plus1Func { void main() { derivative(new Plus1Func(new ZeroFunc()), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-53
SLIDE 53

Complex Objects

interface Function { num apply(num x) level { [this.apply] } } class Util { static num derivative(Function f, num x) level { [derivative, f.apply] } { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Plus1Func(Function f) implements Function { num apply(num x) { f.apply(x) + 1 } } class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { derivative(new Plus1Func(new ZeroFunc()), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-54
SLIDE 54

Complex Objects

interface Function { num apply(num x) level { [this.apply, this.f.apply] } } class Util { static num derivative(Function f, num x) level { [derivative, f.apply] } { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Plus1Func(Function f) implements Function { num apply(num x) { f.apply(x) + 1 } } class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { derivative(new Plus1Func(new ZeroFunc()), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-55
SLIDE 55

Complex Objects

interface Function { num apply(num x) level if this instanceof Plus1Func then { [this.apply, this.f.apply] } else { [this.apply] } } class Util { static num derivative(Function f, num x) level { [derivative, f.apply] } { f.apply(x + 1) − f.apply(x) } } class ZeroFunc implements Function { num apply(num x) { 0 } } class Plus1Func(Function f) implements Function { num apply(num x) { f.apply(x) + 1 } } class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { derivative(new Plus1Func(new ZeroFunc()), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-56
SLIDE 56

Complex Objects: Predicate Families, Dynamic Depths

interface Function { predicate valid(MethodBag depth) num apply(num x) req this.valid(d) level d }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-57
SLIDE 57

Complex Objects: Predicate Families, Dynamic Depths

interface Function { predicate valid(MethodBag depth) num apply(num x) req this.valid(d) level d } class ZeroFunc implements Function { predicate valid(MethodBag depth) = (depth = { [this.apply] }) num apply(num x) { 0 } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-58
SLIDE 58

Complex Objects: Predicate Families, Dynamic Depths

interface Function { predicate valid(MethodBag depth) num apply(num x) req this.valid(d) level d } class ZeroFunc implements Function { predicate valid(MethodBag depth) = (depth = { [this.apply] }) num apply(num x) { 0 } } class Plus1Func(Function f) implements Function { predicate valid(MethodBag depth) = (∃df. f.valid(df) ∧ depth = { [this.apply] } ⊎ df) num apply(num x) { f.apply(x) + 1 } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-59
SLIDE 59

Predicate Families: Inductive Interpretation

ZeroFuncValid

classOf(o) = ZeroFunc depth = { [o.apply] }

  • .valid(depth)

Plus1FuncValid

classOf(o) = Plus1Func

  • .f.valid(df)

depth = { [o.apply] } ⊎ df

  • .valid(depth)

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-60
SLIDE 60

Predicate Families: Inductive Interpretation

[Parkinson and Bierman, POPL 2005]

ZeroFuncValid

classOf(o) = ZeroFunc depth = { [o.apply] }

  • .valid(depth)

Plus1FuncValid

classOf(o) = Plus1Func

  • .f.valid(df)

depth = { [o.apply] } ⊎ df

  • .valid(depth)

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-61
SLIDE 61

Complex Objects: Predicate Families, Dynamic Depths

interface Function { predicate valid(MethodBag depth) num apply(num x) req this.valid(d) level d } class Util { static num derivative(Function f, num x) req f.valid(d) level { [derivative] } ⊎ d { f.apply(x + 1) − f.apply(x) } } class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { derivative(new Plus1Func(new ZeroFunc()), 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-62
SLIDE 62

Complex Objects: Predicate Families, Dynamic Depths

class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { Function f1 := new ZeroFunc(); {f1.valid({ [ZeroFunc.apply] })} Function f2 := new Plus1Func(f1); {f2.valid({ [Plus1Func.apply, ZeroFunc.apply] })} {{ [derivative, Plus1Func.apply, ZeroFunc.apply] } < { [main] }} derivative(f2, 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-63
SLIDE 63

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-64
SLIDE 64

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-65
SLIDE 65

Abstract Object Construction

class ZeroFunc implements Function { predicate valid(MethodBag depth) = (depth = { [this.apply] }) num apply(num x) { 0 } static create() level { [create] } ens ∃d. result.valid(d) ∧ d < { [create] } { new ZeroFunc() } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-66
SLIDE 66

Abstract Object Construction

class Plus1Func(Function f) implements Function { predicate valid(MethodBag depth) = (∃d. f.valid(d) ∧ depth = { [this.apply] } ⊎ d) num apply(num x) { f.apply(x) + 1 } static create(Function f) req f.valid(df) level { [create] } ⊎ df ens ∃d. result.valid(d) ∧ d < { [create] } ⊎ df { new Plus1Func(df) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-67
SLIDE 67

Abstract Object Construction

class Main imports Util, ZeroFunc, Plus1Func { void main() level { [main] } { Function f1 := ZeroFunc.create(); {f1.valid(d1) ∧ d1 < { [ZeroFunc] }} Function f2 := Plus1Func.create(f1); {f2.valid(d2) ∧ d2 < { [Plus1Func, ZeroFunc] })} {{ [derivative] } ⊎ d2 < { [main] }} derivative(f2, 0) } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-68
SLIDE 68

Proposed Specification Style

Proposed Specification Style

interface I { predicate valid(MethodBag depth) τ m(· · · ) req this.valid(d) level d } static τ m(I o) req o.valid(d) level { [m] } ⊎ d class C(I f ) implements I { predicate valid(MethodBag depth) = (f .valid(df) ∧ depth = { [this.m] } ⊎ df) τ m(· · · ) { · · · } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-69
SLIDE 69

Proposed Specification Style

Proposed Specification Style

interface I { predicate valid(MethodBag depth) τ m(· · · ) req this.valid(d) level d } class C(I f ) implements I { predicate valid(MethodBag depth) static I create(I f ) req f .valid(df) level { [create] } ⊎ df ens ∃d. result.valid(d) ∧ d < { [create] } ⊎ df { · · · } }

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-70
SLIDE 70

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-71
SLIDE 71

Contents

1

Modular Verification

2

Modular Termination Verification: Upcalls Only

3

Modular Termination Verification: Dynamic Binding

4

Modular Termination Verification: Complex Objects

5

Modular Termination Verification: Abstract Object Construction

6

Conclusion

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-72
SLIDE 72

Conclusion

Contribution:

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-73
SLIDE 73

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-74
SLIDE 74

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-75
SLIDE 75

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-76
SLIDE 76

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual)

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-77
SLIDE 77

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-78
SLIDE 78

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-79
SLIDE 79

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-80
SLIDE 80

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-81
SLIDE 81

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-82
SLIDE 82

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Combine with deadlock-freedom approach [Leino, M¨ uller, Smans, ESOP 2010] to verify termination of concurrent programs

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-83
SLIDE 83

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Combine with deadlock-freedom approach [Leino, M¨ uller, Smans, ESOP 2010] to verify termination of concurrent programs Use levels as wait levels to allow transparent private locks

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-84
SLIDE 84

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Combine with deadlock-freedom approach [Leino, M¨ uller, Smans, ESOP 2010] to verify termination of concurrent programs Use levels as wait levels to allow transparent private locks Prove termination of compare-and-swap loops

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-85
SLIDE 85

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Combine with deadlock-freedom approach [Leino, M¨ uller, Smans, ESOP 2010] to verify termination of concurrent programs Use levels as wait levels to allow transparent private locks Prove termination of compare-and-swap loops Prove liveness of non-terminating programs

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-86
SLIDE 86

Conclusion

Validation: Examples in the paper

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-87
SLIDE 87

Conclusion

Validation: Examples in the paper Implemented in VeriFast tool; verified some examples

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-88
SLIDE 88

Conclusion

Validation: Examples in the paper Implemented in VeriFast tool; verified some examples More experimentation needed: are all programming patterns supported?

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification

slide-89
SLIDE 89

Conclusion

Contribution:

First approach for modular verification of termination of OO programs

Extras in the paper:

Methods taking multiple objects as arguments Recursion (direct & mutual) Variant based on separation logic

with first-class call permissions can be hidden in predicates: useful for continuation-passing style programs can be passed between threads

Extras in the TR:

Combine with deadlock-freedom approach [Leino, M¨ uller, Smans, ESOP 2010] to verify termination of concurrent programs Use levels as wait levels to allow transparent private locks Prove termination of compare-and-swap loops Prove liveness of non-terminating programs

Bart Jacobs , Dragan Bosnacki , Ruurd Kuiper Modular Termination Verification