Modular Verification via Separation Logic

1. Modular Verification via Separation Logic Wei-Ngan Chin National University of Singapore ( joint work with Cristian, Cristina, Le Binh, Huu Hai, Shengchao)

2. Quote “Trust but Verify.” by Ronald Reagan. “The Goliath of totalitarianism will be brought down by the David of the microchip.” by Ronald Reagan.

3. Paraphrase “The reputation of corporations can be brought down by software and other bugs.”

8. MAS near accident Aug 2005 Boeing 777-200 Software took readings from a faulty accelerometer when a second one failed

10. Proposition Design and build software that are correct by construction. Use tools to find bugs early.

11. Background • 2000’s : impressive practical advances in automatic program verification • SLAM : verified safety protocol properties of device drivers in Windows (now as a library in Windows 7) • ASTREE : no runtime errors in Airbus • Missing Link : • ASTREE : no dynamic pointer allocation • SLAM : assumes memory safety • Many important programs make serious use of heap .. but heap verification is hard.

12. Challenges • Aliasing, heap/memory and recursion. • Complex data structures with invariants. Our Search for Solution Types  Separation Logic

13. Outline • Introducing Separation Logic • Modularity 1 : Leveraging Pure Provers • Modularity 2 : Structured Specs • Modularity 3 : OO Verification • Conclusion

14. Separation Logic • Extension to Hoare logic to reason about shared mutable data structures. • Foundations • O’Hearn and Pym, “The Logic of Bunched Implications”, Bulletin of Symbolic Logic 1999 • Reynolds, “Separation Logic: A Logic for Shared Mutable Data Structures”, LICS 2002

15. Separation Logic Formula : x  y  y  x x y Heap :

16. Separation Logic Formula : x  y x y Heap :

17. Separation Logic Formula : y  x x y Heap :

18. 10 20 x=10 y=20 20 10 Separation Logic Formula : x  y  y  x x y Heap :

19. Separation Logic Formula : x  y x y Heap : 10 x=10 y=20 20

20. Separation Logic Formula : y  x x y Heap : 20 x=10 y=20 10

21. Separation Logic Formula : x  y  y  x x y Heap :

22. not multiply! Formula for Heaplet • Add to Classical Logic • emp // heaplet is empty • x  y // heaplet has exactly one cell • A * B // heaplet is divided so that A holds in // one partition, while B the other • Add inductive definitions, lemmas and other fancy operators.

23. No duplication A ` A * A (10  2) ` (10  2) * (10  2) No Loss A * B ` A A Substructural Logic • Logic for resources (i.e. memory) unless we use intuitionistic logic (10  2) * (20  3) ` (10  2)

24. 10 10 2 2 An Inconsistency • Trying to be two places at same time! (x  2) * (x  2) (x  2) * (x  2) ` false

25. Alternative View More generally : x  y (x  _) * (y  _) `

26. unchanged frame Using frame rule : { x  _ } [x]:=7 { x  7 } Reasoning over Heap Update { (x  _) * R } [x]:=7 { (x  7) * R } { true } [x]:=7 { ??}

27. Deallocation/Allocation { x  _ } dispose(x) { emp } { true } dispose(x) { ?? } { emp } x=cons(a,b) { x  a,b }

28. Sequential Composition Intermediate state • Intermediate state computed in a forward manner.

29. footprint Frame Rule • Memory footprint captures the heap state that is accessed by a given code.

30. With Separation Logic { list(x) } deleteNodes(x) { emp } Before Separation Logic Example : to dispose all nodes in a linked list. { list(x) Æ reach(p,n) } deleteNodes(x) { : allocated(n) }

31. Outline • Introducing Separation Logic • Modularity 1 : Leveraging Pure Provers • Modularity 2 : Structured Specs • Modularity 3 : OO Verification • Conclusion

32. range of pure provers … Overall System Predicates Lemmas Code Pre/Post separation logic prover (SLEEK) code verifier (HIP) Omega, MONA, Coq, SMT, Redlog

33. x::lsegy x y::lsegx y Inductive Predicates root::lsegp  root=p  9 r . root::node_,r  r::lsegp x::lsegy * y::lseg x

34. y::lsegx,2 … with Size root::lsegp,n  root=p Æ n=0  9 r . root::node_,r  r::lsegp,n-1 inv n ¸ 0 x::lsegy,3 x y

35. … with Size & Bag root::lsegp,n,S  root=p Æ n=0 Æ S={}  9 r . root::nodev, r  r::lsegp,n-1,S1 Æ S={v} [ S1 inv n ¸ 0 & n=|S|

36. .. with Sortedness root::lsortp,S  root=p Æ S={}  9 r . root::nodev, r  r::lsortp,S1 Æ S={v} [ S1 Æ8 x 2 S1. v · x

37. .. with AVL balancing root::avlh root = null Æ h = 0 Ç root::nodeh_, p, qi p::avlhh1i q::avlhh2i Æ-1 · h1-h2 · 1Æ h=1+max(h1,h2) inv h¸0

38. Lemmas • Used to relate predicates x::lsortp,S ) x::lseg<p,n,S> Æ n=|S| Philosophy : Lemmas invented by users but automatically proven and applied by our system.

39. Example of Code Specification node insert(node x, node vn) requiresx::lsortnull,Svn::nodev,_Æxnullensuresres::lsortnull,S [ {v} {if (vn.val≤x.val) then { vn.next = x; return vn; } else if (x.next=null) then { x.next = vn; vn.next = null; return x; } else {x.next = insert(x.next, vn); return x; } }

40. Separation Logic Entailment 1`2 3 • 1 must “subsumes” all heap nodes in 2. antecedent consequent residual • Residual nodes are then kept in 3. • ALGORITHM : Ensure all nodes in 2 are subsumed by 1, then convert to an arithmetic implication check.

41. Features • Unfold/Fold Transformation. • Supports Existential Instantiation • Supports Proof Search (with Lemmas) • Approximation to Pure Provers

42. Approximation to Pure Form • Entailment is reduced to implication of pure constraints when the consequent’s heap is empty. • Each predicate is approximated by a pure constraint (based on its invariant).

43. XPure0(x::lseghnull,ni) = n ¸ 0 too weak more info Approximation XPuren(x::nodehi y::nodehi) = (ex i. x=i Æ i>0)  (ex j. y=j Æ j>0) = i,j. (x=i Æ i>0 Æ y=j Æ j>0 Æ ij) XPure1(x::lseghnull,ni) = i. (x=0 Æ n=0 Ç x=i Æ i>0 Æ n-1¸0)

44. Outline • Introducing Separation Logic • Modularity 1 : Leveraging Pure Provers • Modularity 2 : Structured Specs • Modularity 3 : OO Verification • Conclusion

45. disjunctive normal form pure logic heap logic Flat Specification Simple but less readable and less modular.

46. Example with Original Spec root::avlh,n,S,b root=null Æ h=n=b=0 Æ S={ } Ç root::nodehv, p, qi p::avlhh1,n1,S1,b1i  q::avlhh2,n2,S2,b2iÆh1=h2 Æ b=0Æ D Ç root::nodehv, p, qi p::avlhh1,n1,S1,b1i  q::avlhh2,n2,S2,b2iÆ1+h1=h2 Æ b=-1Æ D Ç root::nodehv, p, qi p::avlhh1,n1,S1,b1i  q::avlhh2,n2,S2,b2iÆh1=1+h2 Æ b=1Æ D inv h¸0 Æ n ¸ 0 Æ -1· b· 1 D = (n=1+n1+n2 Æ S={v} [ S1 [ S2 Æ 8 x 2 S1. x · v Æ8 x 2 S2 x ¸ v)

47. case analysis staged formula with Structured Spec root::avlh,n,S,b case root=null! h=n=b=0 Æ S={ } root null! root::nodehv, p, qip::avlhh1,n1,S1,b1i  q::avlhh2,n2,S2,b2iÆ n=1+n1+n2 Æ S={v}[S1 [S2 Æ8 x2S1.x · v Æ8 x2S2.x ¸ v case h1=h2! b=0 1+h1=h2! b=-1 h1=1+h2! b=1 inv h¸0 Æ n ¸ 0 Æ -1· b· 1

48. Structured Spec • More readable. • Better sharing. • More precise ‘cos of case analysis. • Better scalability

49. Experiment

50. Better Scalability • Explicitly break into smaller proofs. • Modularity allows down-sized formula. Important when pure provers are unscalable. • AVL example : 987 sec  76 sec.