DOCSLIB.ORG

A Separation Logic Framework for HOL

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Separation Logic Framework for HOL UCAM-CL-TR-799 Technical Report ISSN 1476-2986 Number 799 Computer Laboratory A separation logic framework for HOL Thomas Tuerk June 2011 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2011 Thomas Tuerk This technical report is based on a dissertation submitted December 2010 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Downing College. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 A Separation Logic Framework for HOL Thomas Tuerk Summary Separation logic is an extension of Hoare logic due to O’Hearn and Reynolds. It was designed for reasoning about mutable data structures. Because separation logic supports local reasoning, it scales better than classical Hoare logic and can easily be used to reason about concurrency. There are automated separation logic tools as well as several formal- isations in interactive theorem provers. Typically, the automated separation logic tools are able to reason about shallow properties of large programs. They usually consider just the shape of datastructures, not their data-content. The formalisations inside theorem provers can be used to prove interesting, deep properties. However, they typically lack automation. Another shortcomming is that there are a lot of slightly different separa- tion logics. For each programming language and each interesting property a new kind of separation logic seems to be invented. In this thesis, a general framework for separation logic is developed inside the HOL4 theorem prover. This framework is based on Abstract Separation Logic, an abstract, high level variant of separation logic. Abstract Separation Logic is a general separation logic such that many other separation logics can be based on it. This framework is instantiatiated in a first step to support a stack with read and write permissions following ideas of Parkinson, Bornat and Calcagno. Finally, the framework is further instantiated to build a separation logic tool called Holfoot. It is similar to the tool Smallfoot, but extends it from reasoning about shape properties to fully functional specifications. To my knowledge this work presents the first formalisation of Abstract Separation Logic inside a theorem prover. By building Holfoot on top of this formalisation, I could demon- strate that Abstract Separation Logic can be used as a basis for realistic separation logic tools. Moreover, this work demonstrates that it is feasable to implement such separation logic tools inside a theorem prover. Holfoot is highly automated. It can verify Small- foot examples automatically inside HOL4. Moreover, Holfoot can use the full power of HOL4. This allows Holfoot to verify fully functional specifications. Simple fully func- tional specifications can be handled automatically using HOL4’s tools and libraries or external SMT solvers. More complicated ones can be handled using interactive proofs inside HOL4. In contrast, most other separation logic tools can reason just about the shape of data structures. Others reason only about data properties that can be solved using SMT solvers. 3 Contents 1 Introduction 11 1.1 IntroductionofSeparationLogic. ..... 11 1.2 Smallfoot .................................... 12 1.3 Shortoverview ofSeparationLogicTools . ...... 13 1.4 Contributionsofthiswork . .. 14 1.4.1 Generaloverview ............................ 14 1.4.2 CapabilitiesofHolfoot . 14 1.4.3 ContributionsinDetail. 15 1.4.4 ContributionstoHOL4. 17 1.5 Structureofthethesis ............................ 17 2 Holfoot 19 2.1 InputLanguage................................. 19 2.1.1 States .................................. 20 2.1.2 PureExpressions ............................ 21 2.1.3 Predicates ................................ 22 2.1.4 Statements ............................... 26 2.1.5 Conditions................................ 27 2.1.6 HOL4Syntax .............................. 27 2.1.7 Programs ................................ 28 2.1.8 Specifications .............................. 28 2.2 IntroductoryExamples . 29 2.2.1 Recursive Implementation of List-Length . ..... 29 2.2.1.1 Localreasoning. 30 2.2.1.2 Read/WritePermissions . 30 2.2.1.3 InternalRepresentation . 31 2.2.1.4 Fully-Functional Specifications . 32 4 2.2.2 Pointer Transferring Buffer Example . .. 32 2.3 AnnotatingWhile-Loops . 33 2.3.1 LoopInvariants ............................. 33 2.3.2 LoopSpecifications . .. .. .. 34 2.3.3 Examples ................................ 35 2.3.3.1 Array Increment Example . 36 2.3.3.2 ListFilteringExample . 37 2.3.3.3 ListCopyExample. 38 2.3.3.4 PartialDatastructures . 39 2.3.4 UnrollingLoops............................. 41 2.4 AdditionalConstructs . .. .. .. 42 2.4.1 assume/assert ............................. 43 2.4.2 diverge,fail ............................... 43 2.4.3 BlockSpecifications. .. .. .. 44 2.4.4 AnnotatingMemoryAllocation . 45 2.4.5 AssumingProcedures. 45 2.4.6 GlobalSpecificationVariables . .. 46 2.5 InteractiveProofs............................... 47 2.5.1 GeneralOverview............................ 47 2.5.2 Sum and Maximal Element of an Array Example . 48 2.5.3 ListRemoveExample . .. .. 49 2.5.4 MergesortExample . .. .. .. 50 2.5.5 CircularListExample . 52 2.5.6 BinarySearchTreeExample. 53 2.5.7 Insertion into Red-Black Tree Example . ... 55 2.6 ExtendingHolfoot ............................... 56 2.6.1 AmortisedQueueExample. 57 2.7 Conclusion.................................... 58 3 Theoretical Foundation and Implementation 59 3.1 Notations .................................... 60 3.1.1 Sets ................................... 60 3.1.2 FiniteMaps ............................... 60 3.1.3 Multisets ................................ 61 3.1.4 Lists ................................... 61 3.2 AbstractSeparationLogic . .. 61 3.2.1 StatesandPredicatesonStates . 61 3.2.1.1 SeparationCombinators . 62 3.2.1.2 Predicates........................... 62 3.2.1.3 SeparationAlgebras . 63 3.2.1.4 ProductSeparationCombinators . 64 3.2.2 Actions ................................. 65 3.2.2.1 SemanticHoaretriples . 65 3.2.2.2 CommonActions. 66 3.2.2.3 LocalActions......................... 67 3.2.2.4 TotalLatticeofLocalActions . 68 3.2.2.5 BestLocalAction . 69 3.2.2.6 Semaphore operations / Precise Predicates . .. 70 3.2.2.7 QuantifiedBestLocalAction . 71 3.2.2.8 assume ............................ 71 3.2.3 Programs ................................ 72 3.2.3.1 Programs,ProtoTraces,Traces... 73 3.2.3.2 Semantics of Programs, Proto Traces, Traces ... ... 75 3.2.3.3 CommentsonSemantics . 76 3.2.4 CommonProgrammingConstructs . 77 3.2.4.1 SequentialComposition . 77 3.2.4.2 Nondeterministic Choice . 78 3.2.4.3 Conditional Execution / While Loops . 78 3.2.4.4 ConditionalCriticalRegions. 78 3.2.4.5 Infinite Nondeterministic Choice . 79 3.2.5 InferenceRules ............................. 79 3.2.5.1 FrameRule .......................... 80 3.2.5.2 StructuralRules . 80 3.2.5.3 Basiccommands . .. .. 81 3.2.5.4 BasicProgramCompositions . 82 3.2.5.5 ControlStructures . 82 3.2.5.6 SymbolicExecution . 83 3.2.5.7 assume ............................ 84 3.2.6 ProgramAbstraction . 85 3.2.7 RecursiveProcedures. 88 3.2.8 Summary ................................ 89 3.3 VariablesasResource. .. .. .. 89 3.3.1 Stacks with Read / Write Permissions . 90 3.3.2 Expressions ............................... 92 3.3.3 Predicates ................................ 93 3.3.3.1 Stack-Imprecise Predicates . 93 3.3.3.2 PurePredicates. 95 3.3.3.3 SeparatingConjunctiononLists . 96 3.3.4 NormalForms.............................. 97 3.3.5 InferenceRules .............................101 3.3.6 ProgramConstructs . .102 3.3.6.1 Assume ............................103 3.3.6.2 ControlStructures . 104 3.3.6.3 SemaphoreOperations . 105 3.3.6.4 ProcedureCalls. .105 3.3.6.5 Assignments . .. .. .107 3.3.6.6 LocalVariables . .109 3.3.6.7 QuantifiedBestLocalActions . 110 3.3.7 FrameInference.............................110 3.3.7.1 InformalDiscussion . 110 3.3.7.2 BasicDefinitions . .111 3.3.7.3 InferenceRules . .113 3.3.7.4 Solving Frame Inference Predicates . 114 3.3.7.5 FrameInferenceAlgorithm . 114 3.3.8 ImplicitInformation . .115 3.4 Holfoot......................................116 3.4.1 States ..................................116 3.4.2 Predicates ................................117 3.4.2.1 Points-To ...........................118 3.4.2.2 Singly-LinkedLists . 118 3.4.2.3 Trees .............................119 3.4.2.4 Arrays.............................120 3.4.3 ProgramConstructs . .121 3.4.3.1 MemoryAllocation. 122 3.4.3.2 MemoryDeallocation . 122 3.4.3.3 HeapLookup .........................123 3.4.3.4 HeapAssignment. .124 3.4.4 ImplicitInformation . .124 3.4.5 FrameInference.............................126 3.5 HolfootImplementation . 129 3.5.1 Overview ................................129 3.5.2 Consequence Conversions . 130 3.5.3 QuantifierHeuristics . .131 4 Conclusion 133 4.1 Summary ....................................133 4.2 Conclusion....................................134 4.3 FutureWork...................................135 Bibliography 137 A Holfoot Installation 141 A.1 InstallationofHOL4 .............................. 141 A.2 InstallationofHolfoot . 142 A.3 TestingHolfoot .................................143 B Example Specifications 145 B.1 AutomaticExamples ..............................145 B.1.1 GeneralListExample . .145 B.1.2 ListLength ...............................146 B.1.3 ListReverse...............................147
Load more

Recommended publications
  • A Systematic Study of Groebner Basis Methods
    A Systematic Study of Gr¨obner Basis Methods Vom Fachbereich Informatik der Technischen Universit¨at Kaiserslautern genehmigte Habilitationsschrift von Dr. Birgit Reinert Datum der Einreichung: 6. Januar 2003 Datum des wissenschaftlichen Vortrags: 9. Februar 2004 arXiv:0903.2462v2 [math.RA] 29 Mar 2009 Dekan: Prof. Dr. Hans Hagen Habilitationskommission: Vorsitzender: Prof. Dr. Otto Mayer Berichterstatter: Prof. Dr. Klaus E. Madlener Prof. Dr. Teo Mora Prof. Dr. Volker Weispfenning Vorwort Die vorliegende Arbeit ist die Quintessenz meiner Ideen und Erfahrungen, die ich in den letzten Jahren bei meiner Forschung auf dem Gebiet der Gr¨obnerbasen gemacht habe. Meine geistige Heimat war dabei die Arbeitsgruppe von Profes- sor Klaus Madlener an der Technischen Universit¨at Kaiserslautern. Hier habe ich bereits im Studium Bekanntschaft mit der Theorie der Gr¨obnerbasen gemacht und mich w¨ahrend meiner Promotion mit dem Spezialfall dieser Theorie f¨ur Monoid- und Gruppenringe besch¨aftigt. Nach der Promotion konnte ich im Rahmen eines DFG-Forschungsstipendiums zus¨atzlich Problemstellungen und Denkweisen an- derer Arbeitsgruppen kennenlernen - die Arbeitsgruppe von Professor Joachim Neub¨user in Aachen und die Arbeitsgruppe von Professor Theo Mora in Genua. Meine Aufenthalte in diesen Arbeitsgruppen haben meinen Blickwinkel f¨ur weit- ergehende Fragestellungen erweitert. An dieser Stelle m¨ochte ich mich bei allen jenen bedanken, die mich in dieser Zeit begleitet haben und so zum Entstehen und Gelingen dieser Arbeit beigetragen haben. Mein besonderer Dank gilt meinem akademischen Lehrer Professor Klaus Madlener, der meine akademische Ausbildung schon seit dem Grundstudium be- gleitet und meine Denk- und Arbeitsweise wesentlich gepr¨agt hat. Durch ihn habe ich gelernt, mich intensiv mit diesem Thema zu besch¨aftigen und mich dabei nie auf nur einen Blickwinkel zu beschr¨anken.
    [Show full text]
  • Recursion Theory Notes, Fall 2011 0.1 Introduction
    Recursion Theory Notes, Fall 2011 Lecturer: Lou van den Dries 0.1 Introduction Recursion theory (or: theory of computability) is a branch of mathematical logic studying the notion of computability from a rather theoretical point of view. This includes giving a lot of attention to what is not computable, or what is computable relative to any given, not necessarily computable, function. The subject is interesting on philosophical-scientific grounds because of the Church- Turing Thesis and its role in computer science, and because of the intriguing concept of Kolmogorov complexity. This course tries to keep touch with how recursion theory actually impacts mathematics and computer science. This impact is small, but it does exist. Accordingly, the first chapter of the course covers the basics: primitive recur- sion, partial recursive functions and the Church-Turing Thesis, arithmetization and the theorems of Kleene, the halting problem and Rice's theorem, recur- sively enumerable sets, selections and reductions, recursive inseparability, and index systems. (Turing machines are briefly discussed, but the arithmetization is based on a numerical coding of combinators.) The second chapter is devoted to the remarkable negative solution (but with positive aspects) of Hilbert's 10th Problem. This uses only the most basic notions of recursion theory, plus some elementary number theory that is worth knowing in any case; the coding aspects of natural numbers are combined here ingeniously with the arithmetic of the semiring of natural numbers. The last chapter is on Kolmogorov complexity, where concepts of recursion theory are used to define and study notions of randomness and information content.
    [Show full text]
  • Mathematical Society
    Notices of the American Mathematical Society November 1983, Issue 229 Volume 30, Number 7, Pages 713-840 Providence, Rhode Island USA ISSN 0002-9920 Calendar of AMS Meetings THIS CALENDAR lists all meetings which have been approved by the Council prior to the date this issue of the Notices was sent to press. The summer and annual meetings are joint meetings of the Mathematical Association of America and the Ameri· can Mathematical Society. The meeting dates which fall rather far in the future are subject to change; this is particularly true of meetings to which no numbers have yet been assigned. Programs of the meetings will appear in the issues indicated below. First and second announcements of the meetings will have appeared in earlier issues. ABSTRACTS OF PAPERS presented at a meeting of the Society are published in the journal Abstracts of papers presented to the American Mathematical Society in the issue corresponding to that of the Notices which contains the program of the meet­ ing. Abstracts should be submitted on special forms which are available in many departments of mathematics and from the office of the Society in Providence. Abstracts of papers to be presented at the meeting must be received at the headquarters of the Society in Providence, Rhode Island, on or before the deadline given below for the meeting. Note that the deadline for ab­ stracts submitted for consideration for presentation at special sessions is usually three weeks earlier than that specified below. For additional information consult the meeting announcement and the list of organizers of special sessions.
    [Show full text]
  • Part IV: Turing Machines and Undecidability
    Part IV: Turing Machines and Undecidability We are about to begin our exploration of the two outer circles of the language hierarchy, as well as the background, the area outside all of the circles. Up until now, we have been placing limitations on what we could do in order that we could discover simple solutions when they exist. Now we are going to tear down all the barriers and explore the full power of formal computation. We will discover a whole range of problems that become solvable once we do that. We will also discover that there are fundamental limitations on what we can compute, regardless of the specific model with which we choose to work. Part IV 264 Turing Machines and Undecidability 17 Turing Machines We need a new kind of automaton that has two properties: • It must be powerful enough to describe all computable things. In this respect, it should be like real computers and unlike FSMs and PDAs. • It must be simple enough that we can reason formally about it. In this respect, it should be like FSMs and PDAs and unlike real computers. 17.1 Definition, Notation and Examples In our discussion of pushdown automata, it became clear that a finite state controller augmented by a single stack was not powerful enough to be able to execute even some very simple programs. What else must be added in order to acquire the necessary power? One answer is a second stack. We will explore that idea in Section 17.5.2. 17.1.1 What Is a Turing Machine? A more straightforward approach is to eliminate the stack and replace it by a more flexible form of infinite storage, a writeable tape.
    [Show full text]
  • Computing the Maximum Using (Min,+) Formulas∗
    Electronic Colloquium on Computational Complexity, Report No. 20 (2018) Computing the maximum using (min,+) formulas∗ Meena Mahajan1, Prajakta Nimbhorkar2, and Anuj Tawari1 1The Institute of Mathematical Sciences, HBNI, Chennai, India , fmeena,[email protected] 2Chennai Mathematical Institute, India , [email protected] January 23, 2018 Abstract We study computation by formulas over (min; +). We consider the computation of maxfx1; : : : ; xng over N as a difference of (min; +) formulas, and show that size n + n log n is sufficient and nec- essary. Our proof also shows that any (min; +) formula computing the minimum of all sums of n − 1 out of n variables must have n log n leaves; this too is tight. Our proofs use a complex- ity measure for (min; +) functions based on minterm-like behaviour and on the entropy of an associated graph. 1 Introduction A (min; +) circuit is a directed acyclic graph (DAG) in which the leaves are labeled by variables or constants. The internal nodes are gates labeled by either min or +. A min gate computes the minimum value among its inputs while a + gate simply adds the values computed by its inputs. If the underlying DAG is a tree, then the circuit is a (min; +) formula. Such formulas can compute any function expressible as the minimum over several linear polynomials with non- negative integer coefficients. That is, they can compute any polynomial over the the tropical − semirings Min = (N; min; +; 1; 0) and Min = (Z; min; +; 1; 0). In this work, we consider the following setting. Suppose we are given n input variables x1; x2; : : : ; xn and we want to find a formula which computes the maximum value taken by these variables, max(x1; x2; : : : ; xn).
    [Show full text]
  • Server Administration Webfocus Reporting Server Release 8205 Datamigrator Server Release 7709
    Server Administration WebFOCUS Reporting Server Release 8205 DataMigrator Server Release 7709 May 20, 2019 Active Technologies, EDA, EDA/SQL, FIDEL, FOCUS, Information Builders, the Information Builders logo, iWay, iWay Software, Parlay, PC/FOCUS, RStat, Table Talk, Web390, WebFOCUS, WebFOCUS Active Technologies, and WebFOCUS Magnify are registered trademarks, and DataMigrator and Hyperstage are trademarks of Information Builders, Inc. Adobe, the Adobe logo, Acrobat, Adobe Reader, Flash, Adobe Flash Builder, Flex, and PostScript are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Due to the nature of this material, this document refers to numerous hardware and software products by their trademarks. In most, if not all cases, these designations are claimed as trademarks or registered trademarks by their respective companies. It is not this publisher's intent to use any of these names generically. The reader is therefore cautioned to investigate all claimed trademark rights before using any of these names other than to refer to the product described. Copyright © 2019, by Information Builders, Inc. and iWay Software. All rights reserved. Patent Pending. This manual, or parts thereof, may not be reproduced in any form without the written permission of Information Builders, Inc. Contents Preface ........................................................................ 15 Conventions ........................................................................16 Related Publications
    [Show full text]
  • Proofs, Computability, Undecidability, Complexity, and the Lambda Calculus an Introduction
    Proofs, Computability, Undecidability, Complexity, And the Lambda Calculus An Introduction Jean Gallier and Jocelyn Quaintance Department of Computer and Information Science University of Pennsylvania Philadelphia, PA 19104, USA e-mail: [email protected] c Jean Gallier Please, do not reproduce without permission of the author April 28, 2020 2 Preface The main goal of this book is to present a mix of material dealing with 1. Proof systems. 2. Computability and undecidability. 3. The Lambda Calculus. 4. Some aspects of complexity theory. Historically, the theory of computability and undecidability arose from Hilbert's efforts to completely formalize mathematics and from G¨odel'sfirst incompleteness theorem that showed that such a program was doomed to fail. People realized that to carry out both Hilbert's program and G¨odel'swork it was necessary to define precisely what is the notion of a computable function and the notion of a mechanically checkable proof. The first definition given around 1934 was that of the class of computable function in the sense of Herbrand{ G¨odel{Kleene. The second definition given by Church in 1935-1936 was the notion of a function definable in the λ-calculus. The equivalence of these two definitions was shown by Kleene in 1936. Shortly after in 1936, Turing introduced a third definition, that of a Turing- computable function. Turing proved the equivalence of his definition with the Herbrand{ G¨odel{Kleenedefinition in 1937 (his proofs are rather sketchy compared to Kleene's proofs). All these historical papers can be found in a fascinating book edited by Martin Davis [25].
    [Show full text]
  • Author Index
    Author Index Alagic, S. 104 -Eukasiewics 172 Arbib, M. A. 104 McCuIloch, Warren 126 Boden, Margaret 43 De Morgan, Augustus 11 Boole, George 3 Newman, James R. 178 Cantor, Georg 161 Nilsson, N. J. 126 Descartes, Rene 5 Peano, Giuseppe 34 Euclid 4 Peterson, G. R. 126 Euler, Leonhard 178 Pitts, WaIter 126 Fibonacci 96 Stone, MarshaIl 160 Hill, F. J. 126 Vacroux, A. G. 124 Leonardo of Pisa 96 Venn, John 7 Notation Index .- 1 An 19 xdiv y 2 A~B 19, 160 xmody 2 g·f 20 Z 2 A 20,41 N 3 /\ 47,112 XEA 3 1\ 156 x$A 3 XA 21 PA 3, 111 Q 23 cp 3 .1 23, 158 AcB 3 Pfn[A, B] 23 D 5 ..:... 23 AxB 5 ~ 25 R 5 R 25 2A 6 Ixl 29 IAI 6, 160, 161 n! 35 &l'A 6 (J 38,48,177 AuB 7,43,201 X* 41 AnB 8 In 41 A-B 8 A·B 43,201 Al + ... + An 8 A* 43,44,201 V 47,113 8 U Ai 155 l'5.is.n V 15 48 A 9 qo 48 rnn 12 15* 49,204 f(A) 16 T(M) 50 f:A -+ B 16 v-+w l lw 2 1···IWn 55 a Hf(a) 16 =• 55 n 19 = 55 212 Notation Index .. - 59 O'(n) 115 X* 60 $m 115 e 60 plq 122 {} 63 NAND 122 T 65 NAND-gate 122 ISATOM 66 NOR 123 HEAD 67 L 123 TAIL 67 (P L q) 123 CONS 68 NOR-gate 127 CAR 68 COND 129 CDR 68 A=> B 132 EQ 68 = 133 EQUAL 68 p => q 135 COND 68 (Vx) 141 LxJ 78 (3x) 141 P(n, r) 82 R:A~A 146 nPr 82 ~A 146 nCr 83 n : n' mod m 146 (~) 83 id A 146 T 111 [a] 147 F 111 A modulo: 149 NOT 112 AI: 149 AND 112 :=:; 150 OR 112 Pfo 151 $ 112 (A, v, A) 157 15 112 T 158 -,p 112 ~o 162 NOT-gate 114 ScopeT(v) 169 AND-gate 114 v(w) 169 OR-gate 114 nn 170 max 114 c5 w 171 min 114 0'0 177 Zm 115 0'1 177 n mod m 115 T(M) 200 Subject Index A axiomatization 138 complete 140 absolute value 29 sound 139
    [Show full text]
  • CSCE 355 — Foundations of Computation
    CSCE 355 | Foundations of Computation Stephen A. Fenner January 7, 2020 Abstract These notes are based on two lectures per week. Sections beginning test test with a star (*) are optional. The date above is the date of this document's most recent modification. 1 Contents 1 Lecture 1 5 1.0.1 Biconditionals . 6 1.1 Methods of proof . 7 1.1.1 Direct proofs . 7 2 Lecture 2 8 2.0.1 Proof by cases . 8 2.0.2 Proof by induction . 8 2.0.3 Proof by contradiction . 11 3 Lecture 3 12 3.1 Strong induction and the well-ordering principle . 12 3.1.1 * Equivalencep of strong induction and the well-ordering principle . 12 3.2 Proof that 2 is irrational . 13 4 Lecture 4 14 4.1 Describing sets . 14 4.1.1 Listing the elements of a set . 14 4.1.2 Set formers . 15 4.1.3 Don't confuse a set with its members! . 16 4.2 Subsets and the empty set . 16 4.2.1 Proving two sets equal . 17 4.3 Boolean set operations . 17 4.4 Sets of sets, ordered pairs, Cartesian product . 19 4.4.1 * Ordered pairs as sets . 20 4.5 Relations and functions . 21 4.6 The pigeonhole principle . 21 5 Lecture 5 22 5.1 Alphabets, strings, and languages . 22 5.1.1 The concatenation operator . 23 5.1.2 The empty string . 23 5.1.3 Languages . 23 5.1.4 Languages as decision problems . 24 6 Lecture 6 25 6.1 Finite automata .
    [Show full text]
  • A Framework for Automated Concurrency Verification
    A Framework for Automated Concurrency Verification Matthew Bernard Windsor Ph.D University of York Computer Science April 2019 Abstract Reasoning systems based on Concurrent Separation Logic make verifying complex concurrent algorithms readily possible. Such algorithms contain subtle protocols of permission and resource transfer between threads; to cope with these intricacies, modern concurrent separation logics contain many moving parts and integrate many bespoke logical components. Verifying concurrent algorithms by hand consumes much time, effort, and expertise. As a result, computer-assisted verification is a fertile research topic, and fully automated verification is a popular research goal. Unfortunately, the complexity of modern concurrent separation logics makes them hard to automate, and the proliferation and fast turnover of such logics causes a downward pressure against building tools for new logics. As a result, many such logics lack tooling. This dissertation proposes Starling: a scheme for creating concurrent pro- gram logics that are automatable by construction. Starling adapts the existing Concurrent Views Framework for sound concurrent reasoning systems, overlay- ing a framework for reducing concurrent proof outlines to verification conditions in existing theories (such as those accepted by off-the-shelf sequential solvers). This dissertation describes Starling in a bottom-up, modular manner. First, it shows the derivation of a series of general concurrency proof rules from the Views framework. Next, it shows how one such rule leads to the Starling framework itself. From there, it outlines a series of increasingly elaborate frontends: ways of decomposing individual Hoare triples over atomic actions into verification conditions suitable for encoding into backend theories. Each frontend leads to a concurrent program logic.
    [Show full text]
  • Provenance for Aggregate Queries
    Provenance for Aggregate Queries Yael Amsterdamer Daniel Deutch Val Tannen University of Pennsylvania University of Pennsylvania University of Pennsylvania and Tel Aviv University and Ben Gurion University ABSTRACT R We study in this paper provenance information for queries EmpId Dept Sal with aggregation. Provenance information was studied in the 1 d1 20 p1 Dept context of various query languages that do not allow for ag- 2 d1 10 p2 d1 p1 + p2 + p3 gregation, and recent work has suggested to capture prove- 3 d1 15 p3 d2 r1 + r2 nance by annotating the different database tuples with ele- 4 d2 10 r1 ments of a commutative semiring and propagating the anno- 5 d2 15 r2 (b) tations through query evaluation. We show that aggregate queries pose novel challenges rendering this approach inap- (a) plicable. Consequently, we propose a new approach, where we annotate with provenance information not just tuples but Figure 1: Projection on annotated relations also the individual values within tuples, using provenance to ate the polynomials in the security semiring, and propagate describe the values computation. We realize this approach the security annotations through query evaluation (see Sec- in a concrete construction, first for “simple” queries where tion 2.1), assigning security levels to query results. the aggregation operator is the last one applied, and then for Let us briefly illustrate deletion propagation as an appli- arbitrary (positive) relational algebra queries with aggrega- cation of provenance. Consider a simple example of an em- tion; the latter queries are shown to be more challenging in ployee/department/salary relation R shown in Figure 1(a).
    [Show full text]
  • Programming and Symbolic Computation in Maude
    Programming and Symbolic Computation in Maude Francisco Dur´ana, Steven Ekerb, Santiago Escobarc, Narciso Mart´ı-Olietd, Jos´eMeseguere, Rub´enRubiod, Carolyn Talcottb aUniversidad de M´alaga,Spain. bSRI International, CA, USA. cUniversitat Polit`ecnica de Val`encia,Spain. dUniversidad Complutense de Madrid, Spain. eUniversity of Illinois at Urbana-Champaign, IL, USA. Abstract Rewriting logic is both a flexible semantic framework within which widely dif- ferent concurrent systems can be naturally specified and a logical framework in which widely different logics can be specified. Maude programs are exactly rewrite theories. Maude has also a formal environment of verification tools. Symbolic computation is a powerful technique for reasoning about the correct- ness of concurrent systems and for increasing the power of formal tools. We present several new symbolic features of Maude that enhance formal reasoning about Maude programs and the effectiveness of formal tools. They include: (i) very general unification modulo user-definable equational theories, and (ii) symbolic reachability analysis of concurrent systems using narrowing. The pa- per does not focus just on symbolic features: it also describes several other new Maude features, including: (iii) Maude's strategy language for controlling rewriting, and (iv) external objects that allow flexible interaction of Maude object-based concurrent systems with the external world. In particular, meta- interpreters are external objects encapsulating Maude interpreters that can in- teract with many other objects. To make the paper self-contained and give a reasonably complete language overview, we also review the basic Maude features for equational rewriting and rewriting with rules, Maude programming of con- current object systems, and reflection.
    [Show full text]