3 research outputs found
Incorrectness Logic for Graph Programs
Program logics typically reason about an over-approximation of program
behaviour to prove the absence of bugs. Recently, program logics have been
proposed that instead prove the presence of bugs by means of under-approximate
reasoning, which has the promise of better scalability. In this paper, we
present an under-approximate program logic for a nondeterministic graph
programming language, and show how it can be used to reason deductively about
program incorrectness, whether defined by the presence of forbidden graph
structure or by finitely failing executions. We prove this incorrectness logic
to be sound and complete, and speculate on some possible future applications of
it.Comment: Accepted by the 14th International Conference on Graph Transformation
(ICGT 2021
Hyper Hoare Logic: (Dis-)Proving Program Hyperproperties (extended version)
Hoare logics are proof systems that allow one to formally establish
properties of computer programs. Traditional Hoare logics prove properties of
individual program executions (so-called trace properties, such as functional
correctness). Hoare logic has been generalized to prove also properties of
multiple executions of a program (so-called hyperproperties, such as
determinism or non-interference). These program logics prove the absence of
(bad combinations of) executions. On the other hand, program logics similar to
Hoare logic have been proposed to disprove program properties (e.g.,
Incorrectness Logic), by proving the existence of (bad combinations of)
executions. All of these logics have in common that they specify program
properties using assertions over a fixed number of states, for instance, a
single pre- and post-state for functional properties or pairs of pre- and
post-states for non-interference.
In this paper, we present Hyper Hoare Logic, a generalization of Hoare logic
that lifts assertions to properties of arbitrary sets of states. The resulting
logic is simple yet expressive: its judgments can express arbitrary trace- and
hyperproperties over the terminating executions of a program. By allowing
assertions to reason about sets of states, Hyper Hoare Logic can reason about
both the absence and the existence of (combinations of) executions, and,
thereby, supports both proving and disproving program (hyper-)properties within
the same logic. In fact, we prove that Hyper Hoare Logic subsumes the
properties handled by numerous existing correctness and incorrectness logics,
and can express hyperproperties that no existing Hoare logic can. We also prove
that Hyper Hoare Logic is sound and complete, and admits powerful
compositionality rules. All our technical results have been proved in
Isabelle/HOL