Reasoning with Mutable Data Structures Tamara Rezk Javier Blanco F - - PowerPoint PPT Presentation

Reasoning with Mutable Data Structures

Tamara Rezk Javier Blanco FAMAF Universidad Nacional de Córdoba, Argentina

Reasoning with Mutable Data Structures– p. 1/16

This talk

Motivation: a problem (pointer variables aliasing) Reynolds’ Logic More problems (reasoning with the logic), more motivations Method to implement pointer-programs Case study Conclusions

Reasoning with Mutable Data Structures– p. 2/16

Aliasing everywhere

• ✁

• ✁

• ✁

• ✁

• ✠
• ✡

• ✠
• ✠
• ✡

Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ✁

• ✁

• ✁

• ✁

• ✠
• ✡

• ✠
• ✠
• ✡

• Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ✁

• ✁

• ✁

• ✁

• ✠
• ✡

• ✠
• ✡

• ☛
• Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ✁

• ✁

• ✁

• ✁

• ✠
• ✡

• ✠
• ✡

• ☛
• Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ✁

• ✁

• ✁

• ✁

• ✡

• ✠
• ✠
• ✡

• ☛
• Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ☛

• ✆

• ✡

• ✝
• ✝

• ✠
• ☛
• ✠
• ✠
• ✠
• ✟
• ✠
• ✠
• ☛
• Reasoning with Mutable Data Structures– p. 3/16

Aliasing everywhere

• ☛

• ✆

• ✡

• ✝
• ✝

• ✠
• ☛
• ✠
• ✠
• ✠
• ✟
• ✠
• ✠
• ☛
• Reasoning with Mutable Data Structures– p. 3/16

How to verify the program?

• ☛

• ✆

• ✡

• ✝
• ✝

Reasoning with Mutable Data Structures– p. 4/16

How to verify the program?

• ☛

• ✆

• ✡

• ✝
• ✝
• ✁

• ✡

• ✖

• Reasoning with Mutable Data Structures– p. 4/16

How to verify the program?

• ☛

• ✆

• ✡

• ✝
• ✝
• ✁

• ✡

• ✖

• Reasoning with Mutable Data Structures– p. 4/16

How to verify the program?

• ☛

• ✆

• ✡

• ✝
• ✝
• ✁

• ✡

• ✖

• ✟
• ✠
• ✡

• ✠
• ✠
• ✁

Reasoning with Mutable Data Structures– p. 4/16

How to verify the program?

• ☛

• ✆

• ✡

• ✝
• ✝
• ✁

• ✡

• ✖

• ✟
• ✠
• ✡

• ✠
• ✠
• ✍✁

Reasoning with Mutable Data Structures– p. 4/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• New ways of assertion (predicate ”points-to”

). Rules for heap manipulation commands Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• New ways of assertion (predicate ”points-to”

). Rules for heap manipulation commands Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• .

New ways of assertion (predicate ”points-to” ). Rules for heap manipulation commands. Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• .

New ways of assertion (predicate ”points-to” ). Rules for heap manipulation commands. Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• .

New ways of assertion (predicate ”points-to” ). Rules for heap manipulation commands. Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• .

New ways of assertion (predicate ”points-to” ). Rules for heap manipulation commands. Restrictions over expressions (no pointer references, due to variables substitution)

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

Extension of Hoare logic (J.Reynolds, P .O’Hearn). No need of using complex reachability predicates. Novel ”separating conjunction” :

• .

New ways of assertion (predicate ”points-to” ). Rules for heap manipulation commands. Restrictions over expressions (no pointer references, due to variables substitution).

Reasoning with Mutable Data Structures– p. 5/16

Separation Logic

• ✞

• ✜
• ✞

, is satisfied by:

• ✜
• ✁

• ✂

• Reasoning with Mutable Data Structures– p. 6/16

Separation Logic

• ✞

• ✜
• ✞

, is satisfied by:

• ✜
• ✁

• ✂

• Splitting the heap:

• ✜
• ✁

• ✚
• ✜
• ✂

• Reasoning with Mutable Data Structures– p. 6/16

Still a problem: reasoning with pointers

Reasoning with Mutable Data Structures– p. 7/16

Still a problem: reasoning with pointers

Solution: find a systematic way to obtain from an abstract specification of the program, a verified imperative pointer-algorithm.

Reasoning with Mutable Data Structures– p. 7/16

Still a problem: reasoning with pointers

Solution: find a systematic way to obtain from an abstract specification of the program, a verified imperative pointer-algorithm. Traditional method using abstraction functions doesn’t work (unless we use reachability conditions, but this causes loss of the abstract reasoning and complicates the proofs). We propose: to use ”abstraction predicates”, naturally incorporated into the programming logic.

Reasoning with Mutable Data Structures– p. 7/16

Method to obtain verified programs

Step 1: Defi nition of the tail recursive function

• ✞

• ✞

Reasoning with Mutable Data Structures– p. 8/16

Method to obtain verified programs

Step 1: Defi nition of the tail recursive function

• ✁✄✂

• ✁✄✡

Reasoning with Mutable Data Structures– p. 9/16

Method to obtain verified programs

Step 2: Find a representation invariant

State the relation between the abstract data type X, used in the initial specifi cation, and its pointer implementation with concrete type Y.

Reasoning with Mutable Data Structures– p. 10/16

Method to obtain verified programs

Step 2:Find a representation invariant

• ✁

State the relation between the abstract data type X, used in the initial specifi cation, and its pointer implementation with concrete type Y.

• ✁

Reasoning with Mutable Data Structures– p. 11/16

Method to obtain verified programs

Step 3: Defi ne b’,f’,g’ such that:

• ✟

• ✞

• ✟

• ✞

• ✟

Reasoning with Mutable Data Structures– p. 12/16

Method to obtain verified programs

Step 3:Defi ne b’,f’,g’

• ✁

• ✁

• ✁

• ✁

• ☎

• ✁

• ☎

• ✁

• ✁

• ✁✄✡

• ✁

• ✁

• ✁

Reasoning with Mutable Data Structures– p. 13/16

Method to obtain verified programs

Step 4: Obtain the verifi ed imperative pointer program

• ✁
• ✟

• ☛

Loop Invariant:

Reasoning with Mutable Data Structures– p. 14/16

Method to obtain verified programs

Step 4:Obtain the verifi ed imperative pointer program

• ✁

• ✁

• ✒

• ✁

Loop Invariant:

• ✁

• ✁✄✂

• ✁

• ✁

• ✒

Loop Invariant:

Reasoning with Mutable Data Structures– p. 15/16

Conclusions

The method provides: a way to reason abstractly when specifying the program. a modularization of the implementation the notion of ”abstraction predicates” to be used with the logic as representation invariants well defined proof obligations steps

Reasoning with Mutable Data Structures– p. 16/16