DOCSLIB.ORG

Mechanized Semantics of Simple Imperative Programming Constructs*

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Mechanized Semantics of Simple Imperative Programming Constructs* App eared as technical rep ort UIB Universitat Ulm Fakultat fur Informatik Dec Mechanized Semantics of Simple Imp erative Programming Constructs H Pfeifer A Dold F W von Henke H Rue Abt Kunstliche Intelligenz Fakultat fur Informatik Universitat Ulm D Ulm verifixkiinformatikuniulmde Abstract In this pap er a uniform formalization in PVS of various kinds of semantics of imp er ative programming language constructs is presented Based on a comprehensivede velopment of xed p oint theory the denotational semantics of elementary constructs of imp erative programming languages are dened as state transformers These state transformers induce corresp onding predicate transformers providing a means to for mally derivebothaweakest lib eral precondition semantics and an axiomatic semantics in the style of Hoare Moreover algebraic laws as used in renement calculus pro ofs are validated at the level of predicate transformers Simple reformulations of the state transformer semantics yield b oth a continuationstyle semantics and rules similar to those used in Structural Op erational Semantics This formalization provides the foundations on which formal sp ecication of program ming languages and mechanical verication of compilation steps are carried out within the Verix pro ject This research has b een funded in part by the Deutsche Forschungsgemeinschaft DFG under pro ject Verix Contents Intro duction Related Work Overview A brief description of PVS Mechanizing Domain Theory Denotational Semantics for Statements State Transformers State Transformer Semantics Predicate Transformers Relating Various Styles of Semantics Weakest Lib eral Precondition Hoare Calculus Algebraic Laws Structural Op erational Semantics Continuations Intro ducing Variable Declarations Example A Simple Programming Language Conclusions App endix A Denotational Semantics State transformers A A Program State A State Transformer Semantics A Predicates A Predicate Transformers A Predicate Transformer Semantics i B Various Styles of Semantics B Weakest Precondition B Hoare Logic B Algebraic Laws B SOS B Continuation B Putting it Together C A Simple Programming Language C Simple Commands C Simple Declarations C The Language D Pro of of Lemma while strans adm ii Mechanized Semantics of Simple Imperative Programming Constructs Intro duction Formal verication of compiler implementations requires the semantics of the programming languages involved b e mo deled adequately in a formal system Dep ending on the asp ect of a programming language or its compilation one wants to describ e certain styles of semantics are more suitable than others A mathematically precise denition of a language for example would often b e accomplished using denotational semantics SS Ten Sto On the other hand if one is interested in developing a prototyp e implementation one might describ e the semantics of the language using an op erational style while an axiomatics semantics Flo Hoa would b e most useful if verication of programs is of concern In this pap er we present a generic mo delling in PVS of dierent kinds of semantics of the basic imp erative programming constructs Starting from a denotational semantics based on state transformers we show how to derive the characteristic rules of various semantic styles including weakest precondition semantics Hoare logic continuationstyle seman tics and structural op erational semantics The formalization is mo dular in the sense that there are separate PVS sp ecications for each programming construct In addition the comp onents of a programming language such as expressions statements and variable declarations are identied with their semantics Thus only the abstract struc ture of the languages comp onents is laid down and the formalization can hence b e applied to every programming language that consists of one or more of the constructs covered in this pap er The mathematical theory underlying the work presented here is well understo o d This pap er adds nothing new in this resp ect in fact most of the theorems can be found in standard textb o oks such as Win Sch Bes However we think that the main contribution of our work is a uniform treatment of dierentstyles of semantics in a formal system This allows for doing formal reasoning ab out b oth programs and their compilation within the same framework Moreover since manyinterchangeable forms of semantics are available the reasoning can b e carried out selecting that semantic formalism suiting b est All theorems presented here have b een proved within PVS Most of the theories are reprinted in the App endix The complete sp ecications and pro ofs are available from the authors up on request Related Work There havebeenseveral rep orts related to the mo delling of semantics of programming lan guages in a theorem prover including Sok Mas Cam HM and there are stan dard techniques for formalizing various styles of semantics For example our presentation regarding predicate transformers and algebraic semantics is comparable to a formalization in the HOL system of a guarded command language with weakest precondition semantics by BackandvWright BvW The work presented here is most closely related to that of Gordon Gor and Nipkow Nip since in contrast to the pap ers mentioned ab ove they deal with several forms of semantics Gordon uses the HOL system to mechanically derive the rules of Hoare logic of Mechanized Semantics of Simple Imperative Programming Constructs a simple whilelanguage from their denotational semantics Gor Furthermore he de scrib es how to apply HOL tactics to generate verication conditions based on the derived Hoare rules Nipkow Nip presents a formalization of the rst chapters of Winskels text book on programming language semantics Win in the theorem prover Isab elleHOL He denes op erational denotational and axiomatic semantics of a simple imp erative pro gramming language and proves their equivalence Additionally pro ofs of soundness and completeness of a verication condition generator are sketched In contrast to Nipkow we do not dene dierent forms of semantics for the same language but follow Gordon and showhowtoderivethecharacteristic rules of the various semantic formalisms from a denotational semantics This saves us from having to prove explicitly the equivalence of the dierent semantics Overview The remainder of the pap er is organized as follows after giving a brief overview of the sp ecication and verication system PVS in Section the remaining sections describ e the various PVS theories develop ed The overall structure of these theories is illustrated in Figure Each no de in this hierarchy graph represents one PVS theory and the edges represent imp orting relations Theories towards the b ottom are used imp orted bythose ab ovethem In order to b e able to dene the denotational semantics of lo ops and recursive pro cedures we have develop ed a rather comprehensive formalization of the theory of xed p oints in PVS This formalization is only briey summarized in Section a detailed description can b e found in a companion pap er BDvH Consequently the b ottom entry in Figure is to b e regarded as standing for a whole cluster of theories the concept of state transformers that Climbing up the hierarchy Section describ es are dened in theory srel Next the denotational semantics of imp erative programming language constructs based on state transformers is presented in Section The de nitions are split into several theories and are combined in theory statements Predicate transformers as dened in the theories ptrans and mpt are intro duced in Section State transformers and predicate transformers provide the basis for a uniform treatmentofvar ious styles of semantics such as weakest precondition semantics Hoarestyle semantics and algebraic laws see Section The corresp onding theories can b e found further up in the theory hierarchy and are comprised by the theory semantics The denitions in the theories mentioned so far abstract from the state on which programs op erate A concrete implementation of such a state is given in Section Finally as an example Section describ es how the formalizations can b e used to dene the semantics of a simple while language Mechanized Semantics of Simple Imperative Programming Constructs simple_program simple_commands simple_declarations semantics vardecl continuation_lems wp_hoare sos laws hoare_logic wp assert_assume continuation statements stmt_mpt state control_structures assignment mpt ptrans var_environment sequence skip expr location srel bexpr finsets relation deterministic (Fixed−Point Theory) Figure Hierarchy of PVS theories formalizing various kinds of semantics of simple con structs in imp erative
Load more

Recommended publications
  • Operational Semantics Page 1
    Operational Semantics Page 1 Operational Semantics Class notes for a lecture given by Mooly Sagiv Tel Aviv University 24/5/2007 By Roy Ganor and Uri Juhasz Reference Semantics with Applications, H. Nielson and F. Nielson, Chapter 2. http://www.daimi.au.dk/~bra8130/Wiley_book/wiley.html Introduction Semantics is the study of meaning of languages. Formal semantics for programming languages is the study of formalization of the practice of computer programming. A computer language consists of a (formal) syntax – describing the actual structure of programs and the semantics – which describes the meaning of programs. Many tools exist for programming languages (compilers, interpreters, verification tools, … ), the basis on which these tools can cooperate is the formal semantics of the language. Formal Semantics When designing a programming language, formal semantics gives an (hopefully) unambiguous definition of what a program written in the language should do. This definition has several uses: • People learning the language can understand the subtleties of its use • The model over which the semantics is defined (the semantic domain) can indicate what the requirements are for implementing the language (as a compiler/interpreter/…) • Global properties of any program written in the language, and any state occurring in such a program, can be understood from the formal semantics • Implementers of tools for the language (parsers, compilers, interpreters, debuggers etc) have a formal reference for their tool and a formal definition of its correctness/completeness
    [Show full text]
  • Denotational Semantics
    Denotational Semantics CS 6520, Spring 2006 1 Denotations So far in class, we have studied operational semantics in depth. In operational semantics, we define a language by describing the way that it behaves. In a sense, no attempt is made to attach a “meaning” to terms, outside the way that they are evaluated. For example, the symbol ’elephant doesn’t mean anything in particular within the language; it’s up to a programmer to mentally associate meaning to the symbol while defining a program useful for zookeeppers. Similarly, the definition of a sort function has no inherent meaning in the operational view outside of a particular program. Nevertheless, the programmer knows that sort manipulates lists in a useful way: it makes animals in a list easier for a zookeeper to find. In denotational semantics, we define a language by assigning a mathematical meaning to functions; i.e., we say that each expression denotes a particular mathematical object. We might say, for example, that a sort implementation denotes the mathematical sort function, which has certain properties independent of the programming language used to implement it. In other words, operational semantics defines evaluation by sourceExpression1 −→ sourceExpression2 whereas denotational semantics defines evaluation by means means sourceExpression1 → mathematicalEntity1 = mathematicalEntity2 ← sourceExpression2 One advantage of the denotational approach is that we can exploit existing theories by mapping source expressions to mathematical objects in the theory. The denotation of expressions in a language is typically defined using a structurally-recursive definition over expressions. By convention, if e is a source expression, then [[e]] means “the denotation of e”, or “the mathematical object represented by e”.
    [Show full text]
  • Quantum Weakest Preconditions
    Quantum Weakest Preconditions Ellie D’Hondt ∗ Prakash Panangaden †‡ Abstract We develop a notion of predicate transformer and, in particular, the weak- est precondition, appropriate for quantum computation. We show that there is a Stone-type duality between the usual state-transformer semantics and the weakest precondition semantics. Rather than trying to reduce quantum com- putation to probabilistic programming we develop a notion that is directly taken from concepts used in quantum computation. The proof that weak- est preconditions exist for completely positive maps follows from the Kraus representation theorem. As an example we give the semantics of Selinger’s language in terms of our weakest preconditions. 1 Introduction Quantum computation is a field of research that is rapidly acquiring a place as a significant topic in computer science. To be sure, there are still essential tech- nological and conceptual problems to overcome in building functional quantum computers. Nevertheless there are fundamental new insights into quantum com- putability [Deu85, DJ92], quantum algorithms [Gro96, Gro97, Sho94, Sho97] and into the nature of quantum mechanics itself [Per95], particularly with the emer- gence of quantum information theory [NC00]. These developments inspire one to consider the problems of programming full-fledged general purpose quantum computers. Much of the theoretical re- search is aimed at using the new tools available - superposition, entanglement and linearity - for algorithmic efficiency. However, the fact that quantum algorithms are currently done at a very low level only - comparable to classical computing 60 years ago - is a much less explored aspect of the field. The present paper is ∗Centrum Leo Apostel , Vrije Universiteit Brussel, Brussels, Belgium, [email protected].
    [Show full text]
  • Operational Semantics with Hierarchical Abstract Syntax Graphs*
    Operational Semantics with Hierarchical Abstract Syntax Graphs* Dan R. Ghica Huawei Research, Edinburgh University of Birmingham, UK This is a motivating tutorial introduction to a semantic analysis of programming languages using a graphical language as the representation of terms, and graph rewriting as a representation of reduc- tion rules. We show how the graphical language automatically incorporates desirable features, such as a-equivalence and how it can describe pure computation, imperative store, and control features in a uniform framework. The graph semantics combines some of the best features of structural oper- ational semantics and abstract machines, while offering powerful new methods for reasoning about contextual equivalence. All technical details are available in an extended technical report by Muroya and the author [11] and in Muroya’s doctoral dissertation [21]. 1 Hierarchical abstract syntax graphs Before proceeding with the business of analysing and transforming the source code of a program, a com- piler first parses the input text into a sequence of atoms, the lexemes, and then assembles them into a tree, the Abstract Syntax Tree (AST), which corresponds to its grammatical structure. The reason for preferring the AST to raw text or a sequence of lexemes is quite obvious. The structure of the AST incor- porates most of the information needed for the following stage of compilation, in particular identifying operations as nodes in the tree and operands as their branches. This makes the AST algorithmically well suited for its purpose. Conversely, the AST excludes irrelevant lexemes, such as separators (white-space, commas, semicolons) and aggregators (brackets, braces), by making them implicit in the tree-like struc- ture.
    [Show full text]
  • Making Classes Provable Through Contracts, Models and Frames
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by CiteSeerX DISS. ETH NO. 17610 Making classes provable through contracts, models and frames A dissertation submitted to the SWISS FEDERAL INSTITUTE OF TECHNOLOGY ZURICH (ETH Zurich)¨ for the degree of Doctor of Sciences presented by Bernd Schoeller Diplom-Informatiker, TU Berlin born April 5th, 1974 citizen of Federal Republic of Germany accepted on the recommendation of Prof. Dr. Bertrand Meyer, examiner Prof. Dr. Martin Odersky, co-examiner Prof. Dr. Jonathan S. Ostroff, co-examiner 2007 ABSTRACT Software correctness is a relation between code and a specification of the expected behavior of the software component. Without proper specifica- tions, correct software cannot be defined. The Design by Contract methodology is a way to tightly integrate spec- ifications into software development. It has proved to be a light-weight and at the same time powerful description technique that is accepted by software developers. In its more than 20 years of existence, it has demon- strated many uses: documentation, understanding object-oriented inheri- tance, runtime assertion checking, or fully automated testing. This thesis approaches the formal verification of contracted code. It conducts an analysis of Eiffel and how contracts are expressed in the lan- guage as it is now. It formalizes the programming language providing an operational semantics and a formal list of correctness conditions in terms of this operational semantics. It introduces the concept of axiomatic classes and provides a full library of axiomatic classes, called the mathematical model library to overcome prob- lems of contracts on unbounded data structures.
    [Show full text]
  • A Denotational Semantics Approach to Functional and Logic Programming
    A Denotational Semantics Approach to Functional and Logic Programming TR89-030 August, 1989 Frank S.K. Silbermann The University of North Carolina at Chapel Hill Department of Computer Science CB#3175, Sitterson Hall Chapel Hill, NC 27599-3175 UNC is an Equal OpportunityjAfflrmative Action Institution. A Denotational Semantics Approach to Functional and Logic Programming by FrankS. K. Silbermann A dissertation submitted to the faculty of the University of North Carolina at Chapel Hill in par­ tial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science. Chapel Hill 1989 @1989 Frank S. K. Silbermann ALL RIGHTS RESERVED 11 FRANK STEVEN KENT SILBERMANN. A Denotational Semantics Approach to Functional and Logic Programming (Under the direction of Bharat Jayaraman.) ABSTRACT This dissertation addresses the problem of incorporating into lazy higher-order functional programming the relational programming capability of Horn logic. The language design is based on set abstraction, a feature whose denotational semantics has until now not been rigorously defined. A novel approach is taken in constructing an operational semantics directly from the denotational description. The main results of this dissertation are: (i) Relative set abstraction can combine lazy higher-order functional program­ ming with not only first-order Horn logic, but also with a useful subset of higher­ order Horn logic. Sets, as well as functions, can be treated as first-class objects. (ii) Angelic powerdomains provide the semantic foundation for relative set ab­ straction. (iii) The computation rule appropriate for this language is a modified parallel­ outermost, rather than the more familiar left-most rule. (iv) Optimizations incorporating ideas from narrowing and resolution greatly improve the efficiency of the interpreter, while maintaining correctness.
    [Show full text]
  • Denotational Semantics
    Denotational Semantics 8–12 lectures for Part II CST 2010/11 Marcelo Fiore Course web page: http://www.cl.cam.ac.uk/teaching/1011/DenotSem/ 1 Lecture 1 Introduction 2 What is this course about? • General area. Formal methods: Mathematical techniques for the specification, development, and verification of software and hardware systems. • Specific area. Formal semantics: Mathematical theories for ascribing meanings to computer languages. 3 Why do we care? • Rigour. specification of programming languages . justification of program transformations • Insight. generalisations of notions computability . higher-order functions ... data structures 4 • Feedback into language design. continuations . monads • Reasoning principles. Scott induction . Logical relations . Co-induction 5 Styles of formal semantics Operational. Meanings for program phrases defined in terms of the steps of computation they can take during program execution. Axiomatic. Meanings for program phrases defined indirectly via the ax- ioms and rules of some logic of program properties. Denotational. Concerned with giving mathematical models of programming languages. Meanings for program phrases defined abstractly as elements of some suitable mathematical structure. 6 Basic idea of denotational semantics [[−]] Syntax −→ Semantics Recursive program → Partial recursive function Boolean circuit → Boolean function P → [[P ]] Concerns: • Abstract models (i.e. implementation/machine independent). Lectures 2, 3 and 4. • Compositionality. Lectures 5 and 6. • Relationship to computation (e.g. operational semantics). Lectures 7 and 8. 7 Characteristic features of a denotational semantics • Each phrase (= part of a program), P , is given a denotation, [[P ]] — a mathematical object representing the contribution of P to the meaning of any complete program in which it occurs. • The denotation of a phrase is determined just by the denotations of its subphrases (one says that the semantics is compositional).
    [Show full text]
  • Probabilistic Predicate Transformers
    Probabilistic Predicate Transformers CARROLL MORGAN, ANNABELLE McIVER, and KAREN SEIDEL Oxford University Probabilistic predicates generalize standard predicates over a state space; with probabilistic pred- icate transformers one thus reasons about imperative programs in terms of probabilistic pre- and postconditions. Probabilistic healthiness conditions generalize the standard ones, characterizing “real” probabilistic programs, and are based on a connection with an underlying relational model for probabilistic execution; in both contexts demonic nondeterminism coexists with probabilis- tic choice. With the healthiness conditions, the associated weakest-precondition calculus seems suitable for exploring the rigorous derivation of small probabilistic programs. Categories and Subject Descriptors: D.2.4 [Program Verification]: Correctness Proofs; D.3.1 [Programming Languages]: Formal Definitions and Theory; F.1.2 [Modes of Computation]: Probabilistic Computation; F.3.1 [Semantics of Programming Languages]: Specifying and Ver- ifying and Reasoning about Programs; G.3 [Probability and Statistics]: Probabilistic Algorithms General Terms: Verification, Theory, Algorithms, Languages Additional Key Words and Phrases: Galois connection, nondeterminism, predicate transformers, probability, program derivation, refinement, weakest preconditions 1. MOTIVATION AND INTRODUCTION The weakest-precondition approach of Dijkstra [1976] has been reasonably success- ful for rigorous derivation of small imperative programs, even (and especially) those involving demonic
    [Show full text]
  • Chapter 3 – Describing Syntax and Semantics CS-4337 Organization of Programming Languages
    !" # Chapter 3 – Describing Syntax and Semantics CS-4337 Organization of Programming Languages Dr. Chris Irwin Davis Email: [email protected] Phone: (972) 883-3574 Office: ECSS 4.705 Chapter 3 Topics • Introduction • The General Problem of Describing Syntax • Formal Methods of Describing Syntax • Attribute Grammars • Describing the Meanings of Programs: Dynamic Semantics 1-2 Introduction •Syntax: the form or structure of the expressions, statements, and program units •Semantics: the meaning of the expressions, statements, and program units •Syntax and semantics provide a language’s definition – Users of a language definition •Other language designers •Implementers •Programmers (the users of the language) 1-3 The General Problem of Describing Syntax: Terminology •A sentence is a string of characters over some alphabet •A language is a set of sentences •A lexeme is the lowest level syntactic unit of a language (e.g., *, sum, begin) •A token is a category of lexemes (e.g., identifier) 1-4 Example: Lexemes and Tokens index = 2 * count + 17 Lexemes Tokens index identifier = equal_sign 2 int_literal * mult_op count identifier + plus_op 17 int_literal ; semicolon Formal Definition of Languages • Recognizers – A recognition device reads input strings over the alphabet of the language and decides whether the input strings belong to the language – Example: syntax analysis part of a compiler - Detailed discussion of syntax analysis appears in Chapter 4 • Generators – A device that generates sentences of a language – One can determine if the syntax of a particular sentence is syntactically correct by comparing it to the structure of the generator 1-5 Formal Methods of Describing Syntax •Formal language-generation mechanisms, usually called grammars, are commonly used to describe the syntax of programming languages.
    [Show full text]
  • Small-Step Operational Semantics Lecture 2 Thursday, January 25, 2018
    Harvard School of Engineering and Applied Sciences — CS 152: Programming Languages Small-step Operational Semantics Lecture 2 Thursday, January 25, 2018 1 Small-step operational semantics At this point we have defined the syntax of our simple arithmetic language. We have some informal, intuitive notion of what programs in this language mean. For example, the program 7 + (4 × 2) should equal 15, and the program foo := 6 + 1; 2 × 3 × foo should equal 42. We would like now to define formal semantics for this language. Operational semantics describe how a program would execute on an abstract machine. A small-step opera- tional semantics describe how such an execution in terms of successive reductions of an expression, until we reach a number, which represents the result of the computation. The state of the abstract machine is usually referred to as a configuration, and for our language it must include two pieces of information: • a store (also called an environment or state), which assigns integer values to variables. During program execution, we will refer to the store to determine the values associated with variables, and also update the store to reflect assignment of new values to variables. • the expression left to evaluate. Thus, the domain of stores is functions from Var to Int (written Var ! Int), and the domain of configu- rations is pairs of expressions and stores. Config = Exp × Store Store = Var ! Int We will denote configurations using angle brackets. For instance, h(foo + 2) × (bar + 1); σi, where σ is a store and (foo + 2) × (bar + 1) is an expression that uses two variables, foo and bar.
    [Show full text]
  • 1 a Denotational Semantics for IMP
    CS 4110 – Programming Languages and Logics .. Lecture #8: Denotational Semantics . We have now seen two operational models for programming languages: small-step and large-step. In this lecture, we consider a different semantic model, called denotational semantics. The idea in denotational semantics is to express the meaning of a program as the mathematical function that expresses what the program computes. We can think of an IMP program c as a function from stores to stores: given an an initial store, the program produces a nal store. For example, the program foo := bar+1 0 can be thought of as a function that when given an input store σ, produces a nal store σ that is identical 0 to σ except that it maps foo to the integer σ(bar) + 1; that is, σ = σ[foo 7! σ(bar) + 1]. We will model programs as functions from input stores to output stores. As opposed to operational models, which tell us how programs execute, the denotational model shows us what programs compute. 1 A Denotational Semantics for IMP For each program c, we write C[[c]] for the denotation of c, that is, the mathematical function that c represents: C[[c]] : Store * Store: Note that C[[c]] is actually a partial function (as opposed to a total function), both because the store may not be dened on the free variables of the program and because program may not terminate for certain input stores. The function C[[c]] is not dened for non-terminating programs as they have no corresponding output stores. We will write C[[c]]σ for the result of applying the function C[[c]] to the store σ.
    [Show full text]
  • Chapter 1 Introduction
    Chapter Intro duction A language is a systematic means of communicating ideas or feelings among people by the use of conventionalized signs In contrast a programming lan guage can be thought of as a syntactic formalism which provides ameans for the communication of computations among p eople and abstract machines Elements of a programming language are often called programs They are formed according to formal rules which dene the relations between the var ious comp onents of the language Examples of programming languages are conventional languages likePascal or C and also the more the oretical languages such as the calculus or CCS A programming language can b e interpreted on the basis of our intuitive con cept of computation However an informal and vague interpretation of a pro gramming language may cause inconsistency and ambiguity As a consequence dierent implementations maybegiven for the same language p ossibly leading to dierent sets of computations for the same program Had the language in terpretation b een dened in a formal way the implementation could b e proved or disproved correct There are dierent reasons why a formal interpretation of a programming language is desirable to give programmers unambiguous and p erhaps informative answers ab out the language in order to write correct programs to give implementers a precise denition of the language and to develop an abstract but intuitive mo del of the language in order to reason ab out programs and to aid program development from sp ecications Mathematics often emphasizes
    [Show full text]