12 research outputs found
Relational Parametricity and Separation Logic
Separation logic is a recent extension of Hoare logic for reasoning about
programs with references to shared mutable data structures. In this paper, we
provide a new interpretation of the logic for a programming language with
higher types. Our interpretation is based on Reynolds's relational
parametricity, and it provides a formal connection between separation logic and
data abstraction
A Realizability Model for Impredicative Hoare Type Theory
We present a denotational model of impredicative Hoare Type Theory, a very expressive dependent type theory in which one can specify and reason about mutable abstract data types.
The model ensures soundness of the extension of Hoare Type Theory with impredicative polymorphism; makes the connections to separation logic clear, and provides a basis for investigation of further sound extensions of the theory, in particular equations between computations and types.Engineering and Applied Science
Relational Logic with Framing and Hypotheses
Relational properties arise in many settings: relating two versions of a program that use different data representations, noninterference properties for security, etc. The main ingredient of relational verification, relating aligned pairs of intermediate steps, has been used in numerous guises, but existing relational program logics are narrow in scope. This paper introduces a logic based on novel syntax that weaves together product programs to express alignment of control flow points at which relational formulas are asserted. Correctness judgments feature hypotheses with relational specifications, discharged by a rule for the linking of procedure implementations. The logic supports reasoning about program-pairs containing both similar and dissimilar control and data structures. Reasoning about dynamically allocated objects is supported by a frame rule based on frame conditions amenable to SMT provers. We prove soundness and sketch how the logic can be used for data abstraction, loop optimizations, and secure information flow
Footprints in Local Reasoning
Local reasoning about programs exploits the natural local behaviour common in
programs by focussing on the footprint - that part of the resource accessed by
the program. We address the problem of formally characterising and analysing
the footprint notion for abstract local functions introduced by Calcagno, O
Hearn and Yang. With our definition, we prove that the footprints are the only
essential elements required for a complete specification of a local function.
We formalise the notion of small specifications in local reasoning and show
that for well-founded resource models, a smallest specification always exists
that only includes the footprints, and also present results for the
non-well-founded case. Finally, we use this theory of footprints to investigate
the conditions under which the footprints correspond to the smallest safe
states. We present a new model of RAM in which, unlike the standard model, the
footprints of every program correspond to the smallest safe states, and we also
identify a general condition on the primitive commands of a programming
language which guarantees this property for arbitrary models.Comment: LMCS 2009 (FOSSACS 2008 special issue
A decidable class of verification conditions for programs with higher order store
Recent years have seen a surge in techniques and tools for automatic and
semi-automatic static checking of imperative heap-manipulating programs. At the
heart of such tools are algorithms for automatic logical reasoning, using heap
description formalisms such as separation logic. In this paper we work towards
extending these static checking techniques to languages with procedures as first
class citizens. To do this, we first identify a class of entailment problems which arise naturally as verification conditions during the static checking of higher order heap-manipulating programs. We then present a decision procedure
for this class and prove its correctness. Entailments in our class combine
simple symbolic heaps, which are descriptions of the heap using a subset of
separation logic, with (limited use of) nested Hoare triples to specify
properties of higher order procedures
Two for the Price of One: Lifting Separation Logic Assertions
Recently, data abstraction has been studied in the context of separation
logic, with noticeable practical successes: the developed logics have enabled
clean proofs of tricky challenging programs, such as subject-observer patterns,
and they have become the basis of efficient verification tools for Java
(jStar), C (VeriFast) and Hoare Type Theory (Ynot). In this paper, we give a
new semantic analysis of such logic-based approaches using Reynolds's
relational parametricity. The core of the analysis is our lifting theorems,
which give a sound and complete condition for when a true implication between
assertions in the standard interpretation entails that the same implication
holds in a relational interpretation. Using these theorems, we provide an
algorithm for identifying abstraction-respecting client-side proofs; the proofs
ensure that clients cannot distinguish two appropriately-related module
implementations
Modular Denotational Semantics for Effects with Guarded Interaction Trees
We present guarded interaction trees -- a structure and a fully formalized
framework for representing higher-order computations with higher-order effects
in Coq, inspired by domain theory and the recently proposed interaction trees.
We also present an accompanying separation logic for reasoning about guarded
interaction trees. To demonstrate that guarded interaction trees provide a
convenient domain for interpreting higher-order languages with effects, we
define an interpretation of a PCF-like language with effects and show that this
interpretation is sound and computationally adequate; we prove the latter using
a logical relation defined using the separation logic. Guarded interaction
trees also allow us to combine different effects and reason about them
modularly. To illustrate this point, we give a modular proof of type soundness
of cross-language interactions for safe interoperability of different
higher-order languages with different effects. All results in the paper are
formalized in Coq using the Iris logic over guarded type theory.Comment: 30 pages; accepted for POPL2
Nested Hoare Triples and Frame Rules for Higher-order Store
Separation logic is a Hoare-style logic for reasoning about programs with
heap-allocated mutable data structures. As a step toward extending separation
logic to high-level languages with ML-style general (higher-order) storage, we
investigate the compatibility of nested Hoare triples with several variations
of higher-order frame rules. The interaction of nested triples and frame rules
can be subtle, and the inclusion of certain frame rules is in fact unsound. A
particular combination of rules can be shown consistent by means of a Kripke
model where worlds live in a recursively defined ultrametric space. The
resulting logic allows us to elegantly prove programs involving stored code. In
particular, using recursively defined assertions, it leads to natural
specifications and proofs of invariants required for dealing with recursion
through the store.Comment: 42 page
Refactoring and representation independence for class hierarchies
AbstractRefactoring transformations are important for productivity and quality in software evolution. Modular reasoning about semantics preserving transformations is difficult even in typed class-based languages because transformations can change the internal representations for multiple interdependent classes and because encapsulation can be violated by pointers to mutable objects. In this paper, an existing theory of representation independence for a single class, based on a simple notion of ownership confinement, is generalized to a hierarchy of classes and used to prove refactoring rules that embody transformations of complete class trees. This allows us to formalize refactorings that inherently involve class inheritance, such as Pull Up or Push Down Field; moreover, this makes it possible to generalize refactorings previously restricted to change of data representation of private attributes (like Extract Class and Encapsulate Field) to address data refinement of protected attributes, dealing with the impact that the corresponding transformations may cause in the subclasses. The utility of the proposed rules is shown in a relatively extensive case study. Shortcomings of the theory are described as a challenge to other approaches to heap encapsulation and relational reasoning for classes