Proving Correctness of a Garbage Collector via Local Reasoning - - PowerPoint PPT Presentation

▶
proving correctness of a garbage collector via local
SMART_READER_LITE
LIVE PREVIEW

Proving Correctness of a Garbage Collector via Local Reasoning - - PowerPoint PPT Presentation

Jan 11, 2024 249 likes •965 views

Proving Correctness of a Garbage Collector via Local Reasoning Lars Birkedal [birkedal@itu.dk], Noah Torp-Smith [noah@itu.dk] The IT University of Copenhagen Joint work with John C. Reynolds, Carnegie Mellon University Spatial Logic Workshop,

slide-1
SLIDE 1

Proving Correctness of a Garbage Collector via Local Reasoning

Lars Birkedal [birkedal@itu.dk], Noah Torp-Smith [noah@itu.dk] The IT University of Copenhagen Joint work with John C. Reynolds, Carnegie Mellon University

Spatial Logic Workshop, Nottingham, March 2003 – p.1/32

slide-2
SLIDE 2

Motivation

Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

slide-3
SLIDE 3

Motivation

  • Copying garbage collectors widely used, for example in

implementations of functional languages.

Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

slide-4
SLIDE 4

Motivation

  • Copying garbage collectors widely used, for example in

implementations of functional languages.

  • A “non-toy” example. Yang’s proof of the Schoor-Waite

algorithm is another such.

Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

slide-5
SLIDE 5

Motivation

  • Copying garbage collectors widely used, for example in

implementations of functional languages.

  • A “non-toy” example. Yang’s proof of the Schoor-Waite

algorithm is another such.

  • Proof Carrying Code theory assumes an underlying

memory allocator, but doesn’t treat it further.

Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

slide-6
SLIDE 6

Preliminaries (1)

Setup: A user language and an implemetation language, both standard while-languages, but with different memory interactions:

Cuser ::= · · · | x := cons(e1, e2) | x.i := e | x := y.i Cimpl ::= · · · | [e] := e | x := [e]

User language: No pointer arithmetic, “implicit type system”:

Vals = Ints ⊎ Ptr, heaps map pointers to pairs of values.

Implementation language: Pointer arithmetic, Heaps map lo- cations (a subset of integers) to integers.

Spatial Logic Workshop, Nottingham, March 2003 – p.3/32

slide-7
SLIDE 7

Preliminaries (2)

Interface (informal): The command cons(e1, e2) in the user language results in a call to alloc in implementation language. alloc(l,n1,n2) {

if (any_space_left) {

allocate 2 heap cells; store(n1, n2); return address;

} else {

Garbage collect; alloc(l,n1,n2);

} }

Spatial Logic Workshop, Nottingham, March 2003 – p.4/32

slide-8
SLIDE 8

Preliminaries (3)

  • All values allocated by the user language at runtime

(through cons-operations) are pairs of values, so the garbage collector only needs to deal with pairs of

  • locations. A pointer is a first component of such a pair.

Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

slide-9
SLIDE 9

Preliminaries (3)

  • All values allocated by the user language at runtime

(through cons-operations) are pairs of values, so the garbage collector only needs to deal with pairs of

  • locations. A pointer is a first component of such a pair.
  • Pointers are divisible by 8.

Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

slide-10
SLIDE 10

Preliminaries (3)

  • All values allocated by the user language at runtime

(through cons-operations) are pairs of values, so the garbage collector only needs to deal with pairs of

  • locations. A pointer is a first component of such a pair.
  • Pointers are divisible by 8.
  • A simplifying assumption: Only one pointer in user

language, call it root (more “root pointers” do not add anything interesting to the proof).

Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

slide-11
SLIDE 11

Preliminaries (4)

So a picture might look like this:

1 2 3 4 5 root 42

Spatial Logic Workshop, Nottingham, March 2003 – p.6/32

slide-12
SLIDE 12

Preliminaries (4)

So a picture might look like this:

1 2 3 4 5 root 42

Note that some cells cannot be “reached” from the root cell. These are ignored by copying collectors.

Spatial Logic Workshop, Nottingham, March 2003 – p.6/32

slide-13
SLIDE 13

Preliminaries (5)

  • A weak heap isomorphism ϕ : (s′, h′) ∼

= (s, h) is a

bijection ϕ : dom(h′) ∼

= dom(h) such that for all p ∈ dom(h′), h(ϕ(p)) = ϕ∗(h′(p)),

where ϕ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ(s′(root)) = s(root), we call ϕ a heap isomorphism.

Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

slide-14
SLIDE 14

Preliminaries (5)

  • A weak heap isomorphism ϕ : (s′, h′) ∼

= (s, h) is a

bijection ϕ : dom(h′) ∼

= dom(h) such that for all p ∈ dom(h′), h(ϕ(p)) = ϕ∗(h′(p)),

where ϕ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ(s′(root)) = s(root), we call ϕ a heap isomorphism.

  • (s, h) is a garbage collected version of (s′, h′), if there is

a heap isomorphism ϕ : prune(s, h) ∼

= prune(s′, h′). We

do not have to remove anything.

Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

slide-15
SLIDE 15

Preliminaries (5)

  • A weak heap isomorphism ϕ : (s′, h′) ∼

= (s, h) is a

bijection ϕ : dom(h′) ∼

= dom(h) such that for all p ∈ dom(h′), h(ϕ(p)) = ϕ∗(h′(p)),

where ϕ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ(s′(root)) = s(root), we call ϕ a heap isomorphism.

  • (s, h) is a garbage collected version of (s′, h′), if there is

a heap isomorphism ϕ : prune(s, h) ∼

= prune(s′, h′). We

do not have to remove anything.

  • So if GC is our garbage collector, and if GC, s, h s′, h′

the requirement is that (s′, h′) is a garbage collected version of (s, h).

Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

slide-16
SLIDE 16

Cheney’s Algorithm (1970)

Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

slide-17
SLIDE 17

Cheney’s Algorithm (1970)

Assumes 2 contigous “semi-spaces” of equal size,

OLD = [startOld, endOld[

and

NEW = [startNew, endNew[, s(root) ∈ OLD. ALIVE = {p | p is reachable}. Copies ALIVE to NEW in a “structure preserving way” and resumes allocation

there.

Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

slide-18
SLIDE 18

Cheney’s Algorithm (1970)

Assumes 2 contigous “semi-spaces” of equal size,

OLD = [startOld, endOld[

and

NEW = [startNew, endNew[, s(root) ∈ OLD. ALIVE = {p | p is reachable}. Copies ALIVE to NEW in a “structure preserving way” and resumes allocation

there. The example from before:

1 2 3 4 5 root OLD NEW

  • 2

3 5 1 2 3 4 5 free scan root

Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

slide-19
SLIDE 19

An Example

Initializing code: Copy the root cell and update the first component to point to the copy:

1 2 3 4 5 root scan free

Spatial Logic Workshop, Nottingham, March 2003 – p.9/32

slide-20
SLIDE 20

An Example (2)

Scanning a pointer-component (1): If the first component of the cell it points to is not a pointer into NEW, we just copy the cell and update its first component. Then we update the component we are scanning:

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.10/32

slide-21
SLIDE 21

An Example (3)

... and again:

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.11/32

slide-22
SLIDE 22

An Example (4)

Scanning a non-pointer component: Nothing happens.

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.12/32

slide-23
SLIDE 23

An Example (5)

Scanning two pointer components as before:

2 3 5 root 1 2 3 scan 4 5 free

Spatial Logic Workshop, Nottingham, March 2003 – p.13/32

slide-24
SLIDE 24

An Example (6)

Scanning a pointer-component (2): If the first component of the cell it points to is a pointer into NEW, we do not make another copy; we just update the component, we are scanning appropriately:

2 3 5 root 1 2 3 4 5 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.14/32

slide-25
SLIDE 25

An Example (7)

After this, nothing more interesting happens, and we update

root:

2 3 5 1 2 3 4 5 free scan root Spatial Logic Workshop, Nottingham, March 2003 – p.15/32

slide-26
SLIDE 26

An Example (7)

After this, nothing more interesting happens, and we update

root:

2 3 5 1 2 3 4 5 free scan root

...and we’re done!

Spatial Logic Workshop, Nottingham, March 2003 – p.15/32

slide-27
SLIDE 27

Extension of Separation Logic

To formalize our partition, we extend the term language with finite sets of pointers:

Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

slide-28
SLIDE 28

Extension of Separation Logic

To formalize our partition, we extend the term language with finite sets of pointers:

m ::= · · · | mfs ⊕ e | mfs ⊖ e | Itv(e, e) | · · ·

Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

slide-29
SLIDE 29

Extension of Separation Logic

To formalize our partition, we extend the term language with finite sets of pointers:

m ::= · · · | mfs ⊕ e | mfs ⊖ e | Itv(e, e) | · · ·

We will also need finite relations:

f ::= · · · | f ◦ g | f ⊚ g

Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

slide-30
SLIDE 30

Extension of Separation Logic

To formalize our partition, we extend the term language with finite sets of pointers:

m ::= · · · | mfs ⊕ e | mfs ⊖ e | Itv(e, e) | · · ·

We will also need finite relations:

f ::= · · · | f ◦ g | f ⊚ g

Semantics for ⊚: extension with identity on non-pointers:

[ [f ⊚ h] ] = {(p, n) | ((p, n) ∈ [ [h] ]s ∧ n ∈ Ptr)∨ (∃p′ ∈ Ptr.(p, p′) ∈ [ [h] ]s ∧ (p′, n) ∈ [ [f] ]s)}

Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

slide-31
SLIDE 31

Extension of Separation Logic (2)

We will also have new assertion forms. We mention some:

Spatial Logic Workshop, Nottingham, March 2003 – p.17/32

slide-32
SLIDE 32

Extension of Separation Logic (2)

We will also have new assertion forms. We mention some:

  • p ∈ m, m1 = m2, (x1, x2) ∈ f, iso(f, m1, m2), Tfun(f, m).

Semantics is straightforward.

Spatial Logic Workshop, Nottingham, March 2003 – p.17/32

slide-33
SLIDE 33

Extension of Separation Logic (2)

We will also have new assertion forms. We mention some:

  • p ∈ m, m1 = m2, (x1, x2) ∈ f, iso(f, m1, m2), Tfun(f, m).

Semantics is straightforward.

  • Iterated Separating Conjunction over a finite set:

∀∗p ∈ m. A(p)

Spatial Logic Workshop, Nottingham, March 2003 – p.17/32

slide-34
SLIDE 34

Extension of Separation Logic (2)

We will also have new assertion forms. We mention some:

  • p ∈ m, m1 = m2, (x1, x2) ∈ f, iso(f, m1, m2), Tfun(f, m).

Semantics is straightforward.

  • Iterated Separating Conjunction over a finite set:

∀∗p ∈ m. A(p)

Semantics:

s, h ∀∗p ∈ m. A(p) iff [ [m] ]s = ∅ implies s, h emp, and [ [m] ]s = {p1, . . . , pk} implies s, h A(p1) ∗ · · · ∗ A(pk)

Spatial Logic Workshop, Nottingham, March 2003 – p.17/32

slide-35
SLIDE 35

Interlude

Recall from Owicki, Gries: Let C be a command, and let AV be a set of variables that appear in C only in assignments

x := E, where x ∈ AV . Then AV is an auxiliary

variable set for C.

Spatial Logic Workshop, Nottingham, March 2003 – p.18/32

slide-36
SLIDE 36

Interlude

Recall from Owicki, Gries: Let C be a command, and let AV be a set of variables that appear in C only in assignments

x := E, where x ∈ AV . Then AV is an auxiliary

variable set for C. Let AV be an auxiliary variable set for C′, and P and Q assertions not containing free variables from AV . Let C be the command obtained from C′ by deleting all assignments to the variables in AV . Then

{P} C′ {Q} {P} C {Q}

Spatial Logic Workshop, Nottingham, March 2003 – p.18/32

slide-37
SLIDE 37

Local Reasoning

The most interesting part of the proof is when we copy a

  • cell. We prove a local specification and use the Frame Rule.

The local specification only mentions the “footprint” of the program fragment (x is cell pointed to by scan):

Spatial Logic Workshop, Nottingham, March 2003 – p.19/32

slide-38
SLIDE 38

Local Reasoning

The most interesting part of the proof is when we copy a

  • cell. We prove a local specification and use the Frame Rule.

The local specification only mentions the “footprint” of the program fragment (x is cell pointed to by scan):

{(∃q. (x, q) ∈ head ∧ x → q)∗ (∃q′. (x, q′) ∈ tail ∧ x + 4 → q′)∗ (scan → −) ∗ (free → −, −)} CopyCell {((x → free, −) ∗ (scan → free)∗ (free → t1, t2))∧ (x, t1) ∈ head ∧ (x, t2) ∈ tail}

2 3 4 5 root 1 2 free scan x

Spatial Logic Workshop, Nottingham, March 2003 – p.19/32

slide-39
SLIDE 39

Informal Analysis

At some stage of our example, we had the following situation:

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.20/32

slide-40
SLIDE 40

Informal Analysis

At some stage of our example, we had the following situation:

2 3 4 5 root 1 2 free scan

We will partition the cells into different “kinds”.

Spatial Logic Workshop, Nottingham, March 2003 – p.20/32

slide-41
SLIDE 41

Informal Analysis (2)

Sets of Pointers: Some cells in OLD have not yet been copied yet.

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.21/32

slide-42
SLIDE 42

Informal Analysis (2)

Sets of Pointers: Some cells in OLD have not yet been copied yet.

2 3 4 5 root 1 2 free scan

We call the set of these pointers UNFORW.

Spatial Logic Workshop, Nottingham, March 2003 – p.21/32

slide-43
SLIDE 43

Informal Analysis (3)

Sets of Pointers: Some cells in OLD have been copied, they’re marked with a “forward pointer” in the first component.

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.22/32

slide-44
SLIDE 44

Informal Analysis (3)

Sets of Pointers: Some cells in OLD have been copied, they’re marked with a “forward pointer” in the first component.

2 3 4 5 root 1 2 free scan

We call the set of these pointers FORW.

Spatial Logic Workshop, Nottingham, March 2003 – p.22/32

slide-45
SLIDE 45

Informal Analysis (4)

Sets of Pointers: Some cells in NEW have been copied and scanned, they will not be modified (or read) further.

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.23/32

slide-46
SLIDE 46

Informal Analysis (4)

Sets of Pointers: Some cells in NEW have been copied and scanned, they will not be modified (or read) further.

2 3 4 5 root 1 2 free scan

We call the set of these pointers FIN. FIN = [startNew, scan[.

Spatial Logic Workshop, Nottingham, March 2003 – p.23/32

slide-47
SLIDE 47

Informal Analysis (5)

Sets of Pointers: Some cells in NEW have been copied but not scanned.

2 3 4 5 root 1 2 free scan

Spatial Logic Workshop, Nottingham, March 2003 – p.24/32

slide-48
SLIDE 48

Informal Analysis (5)

Sets of Pointers: Some cells in NEW have been copied but not scanned.

2 3 4 5 root 1 2 free scan

We call the set of these pointers UNFIN. UNFIN = [scan, free[.

Spatial Logic Workshop, Nottingham, March 2003 – p.24/32

slide-49
SLIDE 49

Informal Analysis (5)

Sets of Pointers: Some cells in NEW have been copied but not scanned.

2 3 4 5 root 1 2 free scan

We call the set of these pointers UNFIN. UNFIN = [scan, free[. Finally, FREE = [free, endNew[ is “free for allocation”.

Spatial Logic Workshop, Nottingham, March 2003 – p.24/32

slide-50
SLIDE 50

The Proof

We will have

Spatial Logic Workshop, Nottingham, March 2003 – p.25/32

slide-51
SLIDE 51

The Proof

We will have

  • The sets mentioned before

Spatial Logic Workshop, Nottingham, March 2003 – p.25/32

slide-52
SLIDE 52

The Proof

We will have

  • The sets mentioned before
  • Relations head and tail that record the initial heap

Spatial Logic Workshop, Nottingham, March 2003 – p.25/32

slide-53
SLIDE 53

The Proof

We will have

  • The sets mentioned before
  • Relations head and tail that record the initial heap
  • ϕ, a bijection,

ϕ : FORW → BUSY = FIN ∪ UNFIN = [startNew, free[

Spatial Logic Workshop, Nottingham, March 2003 – p.25/32

slide-54
SLIDE 54

The Proof

We will have

  • The sets mentioned before
  • Relations head and tail that record the initial heap
  • ϕ, a bijection,

ϕ : FORW → BUSY = FIN ∪ UNFIN = [startNew, free[

These are all added to the program as auxiliary variables, and will be part of the proof.

Spatial Logic Workshop, Nottingham, March 2003 – p.25/32

slide-55
SLIDE 55

The Proof (2)

Analysis of each set:

Spatial Logic Workshop, Nottingham, March 2003 – p.26/32

slide-56
SLIDE 56

The Proof (2)

Analysis of each set:

  • UNFORW is not yet modified, so we can use head, tail.

AUf ≡ ∀∗p ∈ UNFORW. ((∃q.(p, q) ∈ head ∧ p → q)∗ (∃q′.(p, q′) ∈ tail ∧ p + 4 → q′))

Spatial Logic Workshop, Nottingham, March 2003 – p.26/32

slide-57
SLIDE 57

The Proof (2)

Analysis of each set:

  • UNFORW is not yet modified, so we can use head, tail.

AUf ≡ ∀∗p ∈ UNFORW. ((∃q.(p, q) ∈ head ∧ p → q)∗ (∃q′.(p, q′) ∈ tail ∧ p + 4 → q′))

  • FORW: First component points to cell determined by ϕ:

AFw ≡ ∀∗p ∈ FORW. (∃q.(p, q) ∈ ϕ ∧ p → q, −)

Spatial Logic Workshop, Nottingham, March 2003 – p.26/32

slide-58
SLIDE 58

The Proof (2)

Analysis of each set:

  • UNFORW is not yet modified, so we can use head, tail.

AUf ≡ ∀∗p ∈ UNFORW. ((∃q.(p, q) ∈ head ∧ p → q)∗ (∃q′.(p, q′) ∈ tail ∧ p + 4 → q′))

  • FORW: First component points to cell determined by ϕ:

AFw ≡ ∀∗p ∈ FORW. (∃q.(p, q) ∈ ϕ ∧ p → q, −)

  • FREE. Pointers here are in the domain of the heap:

AFr ≡ ∀∗p ∈ FREE. p → −, −

Spatial Logic Workshop, Nottingham, March 2003 – p.26/32

slide-59
SLIDE 59

The Proof (3)

Analysis of each set, ct’d:

  • UNFIN: Each cell is a copy of the cell in FORW that

points to it:

AUn ≡ ∀∗p ∈ UNFIN. ((∃q.(p, q) ∈ head ◦ ϕT ∧ p → q)∗ (∃q′.(p, q′) ∈ tail ◦ ϕT ∧ p + 4 → q′))

42 42 p

  • ✁
✂ ✄ ☎ ✆ ✝ ✞ ✟ ✠ ✄
  • ✁
✂ ✄ ☎ ✆ ✆

Spatial Logic Workshop, Nottingham, March 2003 – p.27/32

slide-60
SLIDE 60

The Proof (4)

  • FIN: scanned version of cells in UNFIN. Scanning

means updating component to ϕ-value (but only if the component is a pointer). This is captured by ⊚:

AFn ≡ ∀∗p ∈ UNFIN. ((∃q.(p, q) ∈ ϕ ⊚ (head ◦ ϕT) ∧ p → q)∗ (∃q′.(p, q′) ∈ ϕ ⊚ (tail ◦ ϕT) ∧ p + 4 → q′))

42 42 p

  • ✁
✂ ✄ ☎ ✆ ✝✟✞ ✠ ✡ ✄
  • ✁
✂ ✄ ☎ ✆ ✆
  • ✄
✝✟✞ ✠ ✡ ✄
  • ✁
✂ ✄ ☎ ✆ ✆ ✆ ☛ ☞ ✌ ✍ ✠ ✎✏ ✄
  • ✁
✂ ✄ ☎ ✆ ✆ ✌
  • ✑
✄ ✍ ✠ ✎✏ ✄
  • ✁
✂ ✄ ☎ ✆ ✆ ✆

Spatial Logic Workshop, Nottingham, March 2003 – p.28/32

slide-61
SLIDE 61

The Proof (5)

The Precondition:

InitAss ≡ Ptr(startNew) ∧ Ptr(endNew) ∧ Ptr(root) ∧ Disjoint(OLD, NEW)∧ SbSet(ALIVE, OLD) ∧ Reachable(ALIVE, root)∧ #NEW = #OLD ∧ PtrRg(head, ALIVE) ∧ PtrRg(tail, ALIVE)∧ Tfun(head, ALIVE) ∧ Tfun(tail, ALIVE)∧ ((∀∗p ∈ ALIVE. ((∃q. (p, q) ∈ head ∧ p → q)∗ (∃q. (p, q′) ∈ tail ∧ p + 4 → q′)))∗ (∀∗p ∈ NEW.p → −, −) ∗ T)

The T deals with “unreachable” cells (they are framed out).

Spatial Logic Workshop, Nottingham, March 2003 – p.29/32

slide-62
SLIDE 62

The Proof (6)

The Invariant:

I ≡ iso(ϕ, FORW, BUSY) ∧ isUnion(FORW, UNFORW, ALIVE)∧ #ALIVE ≤ #NEW ∧ root ∈ FORW ∧ scan ≤ free ∧ Disjoint(ALIVE, NEW) ∧ Ptr(free) ∧ Ptr(scan) ∧ Ptr(offset)∧ Ptr(maxFree) ∧ Reachable(ALIVE, root)∧ PtrRg(head, ALIVE) ∧ PtrRg(tail, ALIVE)∧ Tfun(head, ALIVE) ∧ Tfun(tail, ALIVE)∧ (AUf ∗ AFw ∗ AFn ∗ AUn ∗ AFn)

Spatial Logic Workshop, Nottingham, March 2003 – p.30/32

slide-63
SLIDE 63

The Proof (7)

Remarks about the Proof:

Spatial Logic Workshop, Nottingham, March 2003 – p.31/32

slide-64
SLIDE 64

The Proof (7)

Remarks about the Proof:

  • The proof of the specification is entirely formal: uses
  • nly proof-rules, not “semantical arguments”.

Spatial Logic Workshop, Nottingham, March 2003 – p.31/32

slide-65
SLIDE 65

The Proof (7)

Remarks about the Proof:

  • The proof of the specification is entirely formal: uses
  • nly proof-rules, not “semantical arguments”.
  • The proof that the invariant is strong enough to

conclude that there is a heap isomorphism, is almost logical: We prove logically that,

I ∧ scan = free → (p ∈ ALIVE ∧ (p, q) ∈ ϕ → (q ֒ → r ↔ (p, r) ∈ ϕ ⊚ head))

Recall equation for heap isos:

h′(ϕ(p)) = ϕ∗(h(p))

Spatial Logic Workshop, Nottingham, March 2003 – p.31/32

slide-66
SLIDE 66

Conclusion and Future Work

Spatial Logic Workshop, Nottingham, March 2003 – p.32/32

slide-67
SLIDE 67

Conclusion and Future Work

  • Formal proof of an algorithm that is used in practice.

Spatial Logic Workshop, Nottingham, March 2003 – p.32/32

slide-68
SLIDE 68

Conclusion and Future Work

  • Formal proof of an algorithm that is used in practice.
  • Method of finite sets and relations is believed to be

widely applicable, so further study is needed.

Spatial Logic Workshop, Nottingham, March 2003 – p.32/32

slide-69
SLIDE 69

Conclusion and Future Work

  • Formal proof of an algorithm that is used in practice.
  • Method of finite sets and relations is believed to be

widely applicable, so further study is needed.

  • A more precise formulation of interface issues is

needed.

Spatial Logic Workshop, Nottingham, March 2003 – p.32/32

slide-70
SLIDE 70

Conclusion and Future Work

  • Formal proof of an algorithm that is used in practice.
  • Method of finite sets and relations is believed to be

widely applicable, so further study is needed.

  • A more precise formulation of interface issues is

needed.

  • A technical report will be available soon.

Spatial Logic Workshop, Nottingham, March 2003 – p.32/32