permissions and concurrency a breakthrough and a grand
play

Permissions and concurrency: a breakthrough and a Grand Challenge - PowerPoint PPT Presentation

Dec 01, 2022 •12 likes •1.77k views

Permissions and concurrency: a breakthrough and a Grand Challenge Richard Bornat (Middlesex, UK) 22nd Oct 2004 1 Typing one of the things that formalism has given us; 2 Typing one of the things that formalism has given us; a

  1. Separation logic ◮ Just a bastard child of BI (Pym, O’Hearn). ◮ E �→ E ′ (points to) is permission to read/write/dispose cell at heap address E with contents E ′ . ◮ �→ can also be read as ownership and/or a heap predicate. ◮ emp is no permission. ◮ A ⋆ B (star) is separation of resource. ◮ A ∧ B (and) is identity of resource. 7

  2. Separation logic ◮ Just a bastard child of BI (Pym, O’Hearn). ◮ E �→ E ′ (points to) is permission to read/write/dispose cell at heap address E with contents E ′ . ◮ �→ can also be read as ownership and/or a heap predicate. ◮ emp is no permission. ◮ A ⋆ B (star) is separation of resource. ◮ A ∧ B (and) is identity of resource. ◮ A ∧ ( B ⋆ true) is all A , partly B . 7

  3. Framing, hence small axioms blank 8

  4. Framing, hence small axioms { Q } C { R } ( modifies C ∩ vars P = ∅ ) { P ⋆ Q } C { P ⋆ R } blank 8

  5. Framing, hence small axioms { Q } C { R } ( modifies C ∩ vars P = ∅ ) { P ⋆ Q } C { P ⋆ R } blank { R x E } x := E { R } { x �→ } [ x ]:= E { x �→ E } { E ′ �→ E } { E ′ �→ E ∧ x = E } ( x not free in E , E ′ ) x :=[ E ′ ] { emp } x := new ( E ) { x �→ E } { E �→ } dispose E { emp } 8

  6. Concurrency rules blank blank 9

  7. Concurrency rules { Q 1 } C 1 { R 1 } · · · { Q n } C n { R n } (non-interference-of-variables) { Q 1 ⋆ · · · ⋆ Q n } ( C 1 � · · · � C n ) { R 1 ⋆ · · · ⋆ R n } blank blank 9

  8. Concurrency rules { Q 1 } C 1 { R 1 } · · · { Q n } C n { R n } (non-interference-of-variables) { Q 1 ⋆ · · · ⋆ Q n } ( C 1 � · · · � C n ) { R 1 ⋆ · · · ⋆ R n } blank { ( Q ⋆ I r ) ∧ B } C { R ⋆ I r } { Q } with r when B do C od { R } blank 9

  9. Concurrency rules { Q 1 } C 1 { R 1 } · · · { Q n } C n { R n } (non-interference-of-variables) { Q 1 ⋆ · · · ⋆ Q n } ( C 1 � · · · � C n ) { R 1 ⋆ · · · ⋆ R n } blank { ( Q ⋆ I r ) ∧ B } C { R ⋆ I r } { Q } with r when B do C od { R } blank ◮ Both proved sound by Brookes. 9

  10. Concurrency rules { Q 1 } C 1 { R 1 } · · · { Q n } C n { R n } (non-interference-of-variables) { Q 1 ⋆ · · · ⋆ Q n } ( C 1 � · · · � C n ) { R 1 ⋆ · · · ⋆ R n } blank { ( Q ⋆ I r ) ∧ B } C { R ⋆ I r } { Q } with r when B do C od { R } blank ◮ Both proved sound by Brookes. ◮ A version of the CCR rule covers semaphores, in which C is either m := m + 1 or m := m − 1. 9

  11. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  12. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  13. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  14. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  15. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  16. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  17. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  18. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  19. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  20. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  21. The ownership trick (O’Hearn 2002) resource-bundle r : Vars full , b ; full := false; Invariant ( full ∧ b �→ ) ∨ ( ¬ full ∧ emp ) blank   { emp } { emp } x := new (); with r when full do     { x �→ } { full ∧ b �→ ⋆ emp }     with r when ¬ full do y := b ;     {¬ full ∧ emp ⋆ x �→ } { full ∧ b �→ ⋆ emp ∧ y = b }     b := x ; full := false     {¬ full ∧ emp ⋆ x �→ ∧ b = x } {¬ full ∧ emp ⋆ y �→ }     full := true od;     { full ∧ b �→ ⋆ emp } { y �→ }      od  dispose y   { emp } { emp } 10

  22. Passivity 11

  23. Passivity ◮ Passivity is a property of a program and a resource: the program doesn’t change the contents of the resource. 11

  24. Passivity ◮ Passivity is a property of a program and a resource: the program doesn’t change the contents of the resource. ◮ We want to specify passivity by specifying a read-only resource. 11

  25. Passivity ◮ Passivity is a property of a program and a resource: the program doesn’t change the contents of the resource. ◮ We want to specify passivity by specifying a read-only resource. ◮ We require that a program, given a read-only resource, cannot change its contents. 11

  26. Splitting and sharing 12

  27. Splitting and sharing ◮ Since Dijkstra, we have known that we can safely share read-only resources. 12

  28. Splitting and sharing ◮ Since Dijkstra, we have known that we can safely share read-only resources. ◮ Total permission E �→ E ′ , given by new, allows read/write/dispose. 12

  29. Splitting and sharing ◮ Since Dijkstra, we have known that we can safely share read-only resources. ◮ Total permission E �→ E ′ , given by new, allows read/write/dispose. ◮ Concurrent read permissions must be ( ⋆ ) separable, because of the concurrency rule. 12

  30. Accounting 13

  31. Accounting ◮ Splitting into multiple read permissions is easy. 13

  32. Accounting ◮ Splitting into multiple read permissions is easy. ◮ To write or dispose we have to know when we have all the read permissions back. 13

  33. Accounting ◮ Splitting into multiple read permissions is easy. ◮ To write or dispose we have to know when we have all the read permissions back. ◮ A program which doesn’t keep account leaks resource. 13

  34. Boyland’s suggestion: 1 2 + 1 2 = 1 14

  35. Boyland’s suggestion: 1 2 + 1 2 = 1 ◮ Boyland (Wisconsin) developed a means of permission accounting in disjoint concurrency, dealing with variables and heap locations. 14

  36. Boyland’s suggestion: 1 2 + 1 2 = 1 ◮ Boyland (Wisconsin) developed a means of permission accounting in disjoint concurrency, dealing with variables and heap locations. ◮ He associates a number z with each permission: z = 1 total; 0 < z < 1 read-only. 14

  37. Boyland’s suggestion: 1 2 + 1 2 = 1 ◮ Boyland (Wisconsin) developed a means of permission accounting in disjoint concurrency, dealing with variables and heap locations. ◮ He associates a number z with each permission: z = 1 total; 0 < z < 1 read-only. ◮ Fractional permissions are specification-only (cf. types). 14

  38. Boyland’s suggestion: 1 2 + 1 2 = 1 ◮ Boyland (Wisconsin) developed a means of permission accounting in disjoint concurrency, dealing with variables and heap locations. ◮ He associates a number z with each permission: z = 1 total; 0 < z < 1 read-only. ◮ Fractional permissions are specification-only (cf. types). ◮ In practice the arithmetic is very easy: fractions are simpler to use than (e.g.) sets of binary trees. 14

  39. Boyland’s suggestion: 1 2 + 1 2 = 1 ◮ Boyland (Wisconsin) developed a means of permission accounting in disjoint concurrency, dealing with variables and heap locations. ◮ He associates a number z with each permission: z = 1 total; 0 < z < 1 read-only. ◮ Fractional permissions are specification-only (cf. types). ◮ In practice the arithmetic is very easy: fractions are simpler to use than (e.g.) sets of binary trees. ◮ The magnitude of non-integral fractions doesn’t matter, except as a matter of accounting. 14

  40. A fractional model (Calcagno, O’Hearn) 15

  41. A fractional model (Calcagno, O’Hearn) ◮ Heaps are partial maps from Nat to (int, fraction). (Previously Nat to int.) 15

  42. A fractional model (Calcagno, O’Hearn) ◮ Heaps are partial maps from Nat to (int, fraction). (Previously Nat to int.) ◮ A simpler model – just read / total permissions – fails to account and doesn’t have the frame property. 15

  43. Proof theory blank 16

  44. Proof theory E �− → z E ′ ⇒ 0 < z ≤ 1 z + z ′ E ′ ∧ z > 0 ∧ z ′ > 0 ⇐ z E ′ ⋆ E �− E �− − − − → ⇒ E �− → − → z ′ E ′ blank 16

  45. Proof theory E �− → z E ′ ⇒ 0 < z ≤ 1 z + z ′ E ′ ∧ z > 0 ∧ z ′ > 0 ⇐ z E ′ ⋆ E �− E �− − − − → ⇒ E �− → − → z ′ E ′ blank { R x E } x := E { R } { E ′ �− { E ′ �− → } [ E ′ ]:= E → 1 E } 1 { E ′ �− { E ′ �− → z E } x :=[ E ′ ] → z E ∧ x = E } ( x not free in E , E ′ ) { emp } x := new ( E ) { x �− → 1 E } { E �− → } dispose E { emp } 1 16

  46. Proof theory E �− → z E ′ ⇒ 0 < z ≤ 1 z + z ′ E ′ ∧ z > 0 ∧ z ′ > 0 ⇐ z E ′ ⋆ E �− E �− − − − → ⇒ E �− → − → z ′ E ′ blank { R x E } x := E { R } { E ′ �− { E ′ �− → } [ E ′ ]:= E → 1 E } 1 { E ′ �− { E ′ �− → z E } x :=[ E ′ ] → z E ∧ x = E } ( x not free in E , E ′ ) { emp } x := new ( E ) { x �− → 1 E } { E �− → } dispose E { emp } 1 ◮ Not (yet) proved sound by Brookes. (But surely ...) 16

  47. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  48. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  49. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  50. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  51. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  52. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  53. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  54. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  55. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } 17

  56. Proof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ] z := [ x ] + 1  ;    { x �− − 0 . 5 1 ∧ y = 1 } − → { x �− − 0 . 5 1 ∧ z = 2 } − → { ( x �− − 0 . 5 1 ∧ y = 1 ) ⋆ ( x �− − → − 0 . 5 1 ∧ z = 2 ) } ∴ { x �− − → → 1 1 ∧ y = 1 ∧ z = 2 } dispose x { emp ∧ y = 1 ∧ z = 2 } ◮ That is exactly how hard it is to use fractional permissions. 17

  57. UnProof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ]; [ x ] := 2 ;     { x �− − 0 . 5 1 ∧ y = 1 } − → { ?? }      z := [ x ] + 1  dispose x   { ?? } { ?? } { ?? } [ x ] := y + z 18

  58. UnProof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ]; [ x ] := 2 ;     { x �− − 0 . 5 1 ∧ y = 1 } − → { ?? }      z := [ x ] + 1  dispose x   { ?? } { ?? } { ?? } [ x ] := y + z 18

  59. UnProof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ]; [ x ] := 2 ;     { x �− − 0 . 5 1 ∧ y = 1 } − → { ?? }      z := [ x ] + 1  dispose x   { ?? } { ?? } { ?? } [ x ] := y + z 18

  60. UnProof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ]; [ x ] := 2 ;     { x �− − 0 . 5 1 ∧ y = 1 } − → { ?? }      z := [ x ] + 1  dispose x   { ?? } { ?? } { ?? } [ x ] := y + z 18

  61. UnProof { emp } x := new (); { x �− → } 1 [ x ] := 1 ; { x �− → 1 1 } ∴ { x �− − 0 . 5 1 ⋆ x �− − → − 0 . 5 1 } − →   { x �− − 0 . 5 1 } − → { x �− − 0 . 5 1 } − → y := [ x ]; [ x ] := 2 ;     { x �− − 0 . 5 1 ∧ y = 1 } − → { ?? }      z := [ x ] + 1  dispose x   { ?? } { ?? } { ?? } [ x ] := y + z 18

  62. Passivity and fractions Termination Monotonicity: if C must terminate normally in h and h ⋆ h ′ is defined, then C must terminate normally in h ⋆ h ′ . 19

  63. Passivity and fractions Termination Monotonicity: if C must terminate normally in h and h ⋆ h ′ is defined, then C must terminate normally in h ⋆ h ′ . ◮ We can prove termination monotonicity for all commands in our language. 19

  64. Passivity and fractions Termination Monotonicity: if C must terminate normally in h and h ⋆ h ′ is defined, then C must terminate normally in h ⋆ h ′ . ◮ We can prove termination monotonicity for all commands in our language. ◮ Suppose { 10 �− − 0 . 5 N } C { 10 �− − → − 0 . 5 N + 1 } , and it terminates. − → 19

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Research Agenda 2 Breakthrough Commercialization Post-breakthrough Pre-Breakthrough

Research Agenda 2 Breakthrough Commercialization Post-breakthrough Pre-Breakthrough

6/11/12 Emergence of Creative Breakthroughs using 1 Author-ity database Sen Chai Harvard Business School UIUC Workshop on Disambiguation June 2012 Research Agenda 2 Breakthrough Commercialization Post-breakthrough

359 views • 13 slides
COMP 2718: Permissions: Part 2 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne

COMP 2718: Permissions: Part 2 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne

COMP 2718: Permissions: Part 2 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne Outline Permissions: Part 2 umask - Set Default Permissions Special Permissions Changing Identities su - Run a New Shell as Another

288 views • 11 slides
Teaching Acknowledgement &amp; Permissions Acknowledgement &amp; Permissions Reading/Language

Teaching Acknowledgement &amp; Permissions Acknowledgement &amp; Permissions Reading/Language

Teaching Acknowledgement &amp; Permissions Acknowledgement &amp; Permissions Reading/Language Arts to Several of the slides used in this presentation All Students were originally created by one or more of the following individuals and are

526 views • 26 slides
10. The breakthrough #influencer @simongharris @burlington_ips Breakthrough! i. Surprised by

10. The breakthrough #influencer @simongharris @burlington_ips Breakthrough! i. Surprised by

10. The breakthrough #influencer @simongharris @burlington_ips Breakthrough! i. Surprised by what it looks like Genesis 41:39-40 Then Pharaoh said to Joseph, You shall be in charge of my palace, and all my people are to submit to your

427 views • 11 slides
Concurrency What is concurrency? In computer science, concurrency is a property of systems which

Concurrency What is concurrency? In computer science, concurrency is a property of systems which

C Concurrency and Synchronization Concurrency What is concurrency? In computer science, concurrency is a property of systems which consist of computations that execute overlapped in time, and which may permit the sharing of common resources

621 views • 34 slides
Abstract Read Permissions Fractional Permissions without the Fractions Alex Summers ETH Zurich

Abstract Read Permissions Fractional Permissions without the Fractions Alex Summers ETH Zurich

Abstract Read Permissions Fractional Permissions without the Fractions Alex Summers ETH Zurich Joint work with : Stefan Heule, Rustan Leino, Peter Mller ETH Zurich Microsoft Research ETH Zurich Overview Verification of

436 views • 42 slides
Asynchronous Programming Model for Concurrency concurrency Concurrency is when two or more tasks

Asynchronous Programming Model for Concurrency concurrency Concurrency is when two or more tasks

Asynchronous Programming Model for Concurrency concurrency Concurrency is when two or more tasks can start, run, and complete in overlapping time periods. It doesn't necessarily mean they'll ever both be running at the same instant. For

915 views • 24 slides
All About Apps Well cover... Whats an app? What are app permissions? What do

All About Apps Well cover... Whats an app? What are app permissions? What do

All About Apps Well cover... Whats an app? What are app permissions? What do companies gain by getting your permission? Typical permissions requested by apps How to check up on apps already on your phone App safety

134 views • 11 slides
Breakthrough Change Breakthrough Change Recommendations Recommendations Part 2 Part 2 Jim

Breakthrough Change Breakthrough Change Recommendations Recommendations Part 2 Part 2 Jim

Breakthrough Change Breakthrough Change Recommendations Recommendations Part 2 Part 2 Jim Walton Jim Walton ZZZZZZZZZZZZZZZZZZZZZZZZZ Hey! Someone, wake up Its a Workin Day Why Breakthrough Change? Structural Deficit The Growing

535 views • 51 slides
Concurrency Control Ensuring Isolation 354 Concurrency control Concurrency To increase

Concurrency Control Ensuring Isolation 354 Concurrency control Concurrency To increase

Concurrency Control Ensuring Isolation 354 Concurrency control Concurrency To increase throughput and response time, a DBMS will execute multiple trans- actions at the same time. Concurrency control ensures that transactions have the same e ff

628 views • 29 slides
pNFS Access Permissions Check draft-faibish-nfsv4-pnfs-access-permissions-check-03.txt IETF 78

pNFS Access Permissions Check draft-faibish-nfsv4-pnfs-access-permissions-check-03.txt IETF 78

pNFS Access Permissions Check draft-faibish-nfsv4-pnfs-access-permissions-check-03.txt IETF 78 NFSv4 WG Meeting, July 28, 2010 Sorin Faibish sfaibish@emc.com David Black - EMC Mike Eisler - NetApp Jason Glasgow - Google Problem Statement

376 views • 6 slides
What were going to talk about Breakthrough (the brand) DaJie (the business)

What were going to talk about Breakthrough (the brand) DaJie (the business)

BREAKTHROUGH growing positive behaviours Rob Han Lina Bartuseviciute Liisa Yu Betty Tian Derrie Guan Tony Won What were going to talk about Breakthrough (the brand) DaJie (the business) Business model Action

860 views • 53 slides
Filesystem Hierarchy and Permissions Linux Prepared by Steven Gordon on 19 April 2017

Filesystem Hierarchy and Permissions Linux Prepared by Steven Gordon on 19 April 2017

Linux Filesystem Hierarchy inodes Permissions Filesystem Hierarchy and Permissions Linux Prepared by Steven Gordon on 19 April 2017 Common/Reports/linux-file-permissions.tex, r1417 1/15 Linux Multiuser and Server Operating System

195 views • 15 slides
Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Concurrency arises

Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Concurrency arises

Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Concurrency arises in 3 different contexts: Multiple applications Multiprogramming: time slicing Structured applications Develop a single application

1.09k views • 62 slides
Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Multiple

Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Multiple

2/24/10 Concurrency: Mutual Exclusion and Synchronization Chapter 5 1 Concurrency Multiple applications Structured applications Operating system structure 2 1 2/24/10 Concurrency 3 Difficulties of Concurrency Sharing of

217 views • 11 slides
COMP 2718: Permissions: Part 1 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne

COMP 2718: Permissions: Part 1 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne

COMP 2718: Permissions: Part 1 By: Dr. Andrew Vardy Adapted from the notes of Dr. Rod Byrne Outline Permissions Owners, Group Members, and Everyone Else Read, Writing, and Executing Digression: Number Systems chmod - Change

280 views • 14 slides
CISC 124: Introduction To Computing Science II instructor: Margaret Lamb course web site:

CISC 124: Introduction To Computing Science II instructor: Margaret Lamb course web site:

CISC 124: Introduction To Computing Science II instructor: Margaret Lamb course web site: www.cs.queensu.ca/home/cisc124 office : Goodwin 554 office hour this week : Monday 12-1 Wednesday 2-3 Friday 1-2 vote on Moodle for office hours for rest

290 views • 15 slides
Systems Programming 1. Basic C Programming Guillaume Pierre Fall 2007 http://www.cs.vu.nl/

Systems Programming 1. Basic C Programming Guillaume Pierre Fall 2007 http://www.cs.vu.nl/

0 Systems Programming 1. Basic C Programming Guillaume Pierre Fall 2007 http://www.cs.vu.nl/ gpierre/courses/sysprog/ 1 Table of contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . 2 2. Data types . . . .

439 views • 24 slides
Type Types A type is a collection of computable values that share some structural property.

Type Types A type is a collection of computable values that share some structural property.

CS 242 Type Types A type is a collection of computable values that share some structural property. Examples Non-examples Integers { 3, true, x.x } John Mitchell Strings Even integers int bool {

576 views • 5 slides
Program Correctness Assert formal correctness statements about

Program Correctness Assert formal correctness statements about

Program Correctness Assert formal correctness statements about cri4cal parts of a program and reason effec4vely A program is intended to carry out a

1.01k views • 57 slides
Programming in C Spring Semester 2016 Programming and Data Structure 55 Sample C program #1

Programming in C Spring Semester 2016 Programming and Data Structure 55 Sample C program #1

1/13/2016 Programming in C Spring Semester 2016 Programming and Data Structure 55 Sample C program #1 #include &lt;stdio.h&gt; main() main() { printf (\n Our first look at a C program \n); } Spring Semester 2016 Programming and

192 views • 17 slides
An Algorithm for Suffix Stripping Evaluation Algorithm Porter (1980) Notations Rules Further

An Algorithm for Suffix Stripping Evaluation Algorithm Porter (1980) Notations Rules Further

Suffix Stripping Sabrina Galasso &amp; Eyal Schejter Introduction Information Retrieval Suffix Stripping An Algorithm for Suffix Stripping Evaluation Algorithm Porter (1980) Notations Rules Further Issues References Sabrina Galasso

757 views • 47 slides
Chapter 1: Compilation Phases Aarne Ranta Slides for the book Implementing Programming

Chapter 1: Compilation Phases Aarne Ranta Slides for the book Implementing Programming

Chapter 1: Compilation Phases Aarne Ranta Slides for the book Implementing Programming Languages. An Introduction to Compilers and Interpreters, College Publications, 2012. Compilation Phases Phases on the way from source code to machine

533 views • 31 slides
A brief history of Unix Emanuele Rocca Berlin Unix Appreciation Society BUAS Berlin Unix

A brief history of Unix Emanuele Rocca Berlin Unix Appreciation Society BUAS Berlin Unix

A brief history of Unix Emanuele Rocca Berlin Unix Appreciation Society BUAS Berlin Unix Appreciation Society! whoami ema Debian Developer since 2003 Member of the Italian Linux Society Lead DevOps Engineer at ZenMate Outline

575 views • 44 slides

More recommend