Upload
vala
View
52
Download
0
Embed Size (px)
DESCRIPTION
Program Analysis and Verification 0368- 4479 http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html. Noam Rinetzky Lecture 3: Program Semantics. Slides credit: Roman Manevich , Mooly Sagiv , Eran Yahav. Good manners. Mobiles. Admin. Grades - PowerPoint PPT Presentation
Citation preview
Program Analysis and Verification
0368-4479http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html
Noam Rinetzky
Lecture 3: Program Semantics
Slides credit: Roman Manevich, Mooly Sagiv, Eran Yahav
2
Good manners
• Mobiles
3
Admin
• Grades– First home assignment will be published on Tuesday.
• Due lesson 5
Scribes (this week)? Scribes (next week)
4
Today
• Operational semantics– Advanced features
• Traces semantics
• Denotational Semantics
5
What do we mean?
שלום
syntax semantics
6
What do we mean?
Psyntax semantics
P: x7
7
Why formal semantics?
• Implementation-independent definition of a programming language
• Automatically generating interpreters (and some day maybe full fledged compilers)
• Verification and debugging– if you don’t know what it does, how do you know
its incorrect?
8
Programming Languages
• Syntax • “how do I write a program?”
– BNF– “Parsing”
• Semantics • “What does my program mean?”
– …
9
Program semantics
• State-transformer– Set-of-states transformer– Trace transformer
• Predicate-transformer• Functions• …
10
What semantics do we want?
• Captures the aspects of computations we care about– “adequate”
• Hides irrelevant details– “fully abstract”
• Compositional
11
A simple imperative language: WhileAbstract syntax:
a ::= n | x | a1 + a2 | a1 a2 | a1 – a2
b ::= true | false| a1 = a2 | a1 a2 | b | b1 b2
S ::= x := a | skip | S1; S2| if b then S1 else S2
| while b do S
12
Syntactic categories
n Num numeralsx Var program variablesa Aexp arithmetic expressionsb Bexp boolean expressionsS Stm statements
13
Semantic categories
Z Integers {0, 1, -1, 2, -2, …}TTruth values {ff, tt}State Var Z
Example state: s=[x5, y7, z0]Lookup: s x = 5Update: s[x6] = [x6, y7, z0]
14
Semantics of expressions
• Arithmetic expressions are side-effect free– Semantic function A Aexp : State Z– Defined by induction on the syntax tree
A n s = nA x s = s xA a1 + a2 s = A a1 s + A a2 sA a1 - a2 s = A a1 s - A a2 sA a1 * a2 s = A a1 s A a2 s A (a1) s = A a1 s --- not neededA - a s = 0 - A a1 s
– Compositional– Properties can be proved by structural induction
• Similarly for Boolean expressions
Operational Semantics
(Recap)
Operational Semantics
The meaning of a program in the language is explained in terms of a hypothetical computer which performs the set of actions which constitute the elaboration of that program.
[Algol68, Section 2]
Operational Semantics
It is all very well to aim for a more ‘abstract’ and a ‘cleaner’ approach to semantics, but if the plan is to be any good, the operational aspects cannot be completely ignored.
[Scott70]
18
Operational semantics
• Concerned with how to execute programs– How statements modify state– Define transition relation between configurations
• Two flavors– Structural operational semantics: describes how
the individual steps of a computations take place• So-called “small-step” semantics
– Natural semantics: describes how the overall results of executions are obtained• So-called “big-step” semantics
19
Structural operating semantics (SOS)
• aka “Small-step semantics”
S, s S’, s’
first step
20
Structural operational semantics• Developed by Gordon Plotkin [TR 1981]• Configurations: has one of two forms:
S, s Statement S is about to execute on state ss Terminal (final) state
• Transitions S, s = S’, s’ Execution of S from s is not completed and
remaining computation proceeds from intermediate configuration
= s’ Execution of S from s has terminated and the final state is s’
• S, s is stuck if there is no such that S, s
first step
21
Structural semantics for While x:=a, s s[xAas][asssos]
skip, s s[skipsos]
S1, s S1’, s’ S1; S2, s S1’; S2, s’ [comp1
sos]
if b then S1 else S2, s S1, s if B b s = tt[ifttsos]
if b then S1 else S2, s S2, s if B b s = ff[ifffsos]
S1, s s’ S1; S2, s S2, s’ [comp2
sos]
22
Derivation sequences• A derivation sequence of a statement S starting in state s is either• A finite sequence 0, 1, 2 …, k such that
1. 0 = S, s2. i i+1
3. k is either stuck configuration or a final state
• An infinite sequence 0, 1, 2, … such that1. 0 = S, s2. i i+1
• Notations:– 0 k k 0 derives k in k steps– 0 * 0 derives in a finite number of steps
23
Natural operating semantics (NS)
• aka “Large-step semantics”
S, s s’
all steps
24
Natural operating semantics
• Developed by Gilles Kahn [STACS 1987]• Configurations
S, s Statement S is about to execute on state ss Terminal (final) state
• TransitionsS, s s’ Execution of S from s will terminate
with the result state s’– Ignores non-terminating computations
25
Natural operating semantics
• defined by rules of the form
• The meaning of compound statements is defined using the meaning immediate constituent statements
S1, s1 s1’, … , Sn, sn sn’
S, s s’
if…
premise
conclusion
side condition
26
Natural semantics for While x := a, s s[x Aas][assns]
skip, s s[skipns]
S1, s s’, S2, s’ s’’S1; S2, s s’’ [compns]
S1, s s’ if b then S1 else S2, s s’
if B b s = tt[ifttns]
S2, s s’ if b then S1 else S2, s s’
if B b s = ff[ifffns]
axioms
27
Derivation trees
• Using axioms and rules to derive a transition S, s s’ gives a derivation tree– Root: S, s s’– Leaves: axioms– Internal nodes: conclusions of rules• Immediate children: matching rule premises
28
Evaluation via derivation sequences
• For any While statement S and state s it is always possible to find at least one derivation sequence from S, s– Apply axioms and rules forever or until a terminal
or stuck configuration is reached• Proposition: there are no stuck configurations
in While
29
The semantic function Ssos
• The meaning of a statement S is defined as a partial function from State to State
Ssos: Stm (State State)
• Examples:Ssos skip s = sSsos x:=1 s = s [x 1]Ssos while true do skip s = undefined
Ssos S s = s’ if S, s * s’ undefined otherwise
S: What a statement S means to the context: P[S]• S1 = x:=x+2• S2 = x:=x+1 ; x:=x+1• P[S] = z:=x; S; y:=x;
30
The semantic function Sns
• The meaning of a statement S is defined as a partial function from State to State
Sns: Stm (State State)
• Examples:Sns skips = sSns x:=1s = s [x 1]Sns while true do skips = undefined
Sns S s = s’ if S, s s’ undefined otherwise
31
An equivalence result
• S1 and S2 are semantically equivalent if for all s and s’ S1, s s’ if and only if S2, s s’– Same semantics
• SOS and NS– For every statement in While Sns S = Ssos S– Proof in pages 40-43
32
While in WHILE
33
Semantic equivalence
• S1 and S2 are semantically equivalent if for all s and s’ S1, s s’ if and only if S2, s s’
• Simple examplewhile b do Sis semantically equivalent to:if b then (S; while b do S) else skip– Read proof in pages 26-27
34
Structural semantics for while
while b do S, s if b then
S; while b do S) else
skip, s
[whilesos]
35
Natural semantics for While
S, s s’, while b do S, s’ s’’while b do S, s s’’
if B b s = tt[whilettns]
while b do S, s s if B b s = ff[whileffns]
Non-compositional
Comparing semanticsStructuralsemantics
Naturalsemantics
Statement
abortabort; S
skip; S
if x = 0 then abort else y := y / x
• The natural semantics cannot describe looping executions‒ Every execution is represented by a finite derivation tree
• The structural operational semantics can describe both• Looping executions have infinite derivation sequences
• Every step in the derivation sequence is justified by a finite derivation tree
• Terminating executions have a finite one
37
What is a semantics good for?
• Allows to “evaluate” a program
• Properties of programming language semantics holds for all programs …
38
What is a semantics good for?
• Allows to “evaluate” a program
• Properties of programming language semantics holds for all programs …
• NS: more abstract– Fewer rules, top-down interpreter, simpler proofs
• SOS: more “accurate”– Order of evaluation, non-termination
Operational Semantics
(paceR)
Operational Semantics
(Extended language)
41
Language Extensions
• abort statement (like C’s exit w/o return value)• Non-determinism• Parallelism• Local Variables• Procedures– Static Scope– Dynamic scope
42
While + abort
• Abstract syntaxS ::= x := a | skip | S1; S2
| if b then S1 else S2
| while b do S| abort
• Abort terminates the execution– In “skip; S” the statement S executes– In “abort; S” the statement S should never execute
• Natural semantics rules: …?• Structural semantics rules: …?
Comparing semanticsStructuralsemantics
Naturalsemantics
Statement
abortabort; S
skip; S
while true do skipif x = 0 then abort else y := y / x
• The natural semantics cannot distinguish between looping and abnormal termination‒ Unless we add a special error state
• The structural operational semantics can distinguish• looping is reflected by infinite derivations and abnormal
termination is reflected by stuck configuration
44
While + non-determinism
• Abstract syntaxS ::= x := a | skip | S1; S2
| if b then S1 else S2
| while b do S| S1 or S2
• Either S1 is executed or S2 is executed• Example: x:=1 or (x:=2; x:=x+2)– Possible outcomes for x: 1 and 4
45
While + non-determinism:natural semantics
S1, s s’S1 or S2, s s’[or1
ns]
S2, s s’S1 or S2, s s’[or2
ns]
46
While + non-determinism:structural semantics
?[or1sos]
?[or2sos]
47
While + non-determinism
• What about the definitions of the semantic functions?– Sns S1 or S2 s
– Ssos S1 or S2 s
Comparing semanticsStructuralsemantics
Naturalsemantics
Statement
x:=1 or (x:=2; x:=x+2)
(while true do skip) or (x:=2; x:=x+2)
• In the natural semantics non-determinism will suppress non-termination (looping) if possible
• In the structural operational semantics non-determinism does not suppress non-terminating statements
49
While + parallelism
Abstract syntaxS ::= x := a | skip | S1; S2| if b then S1 else S2
| while b do S| S1 S2
• All the interleaving of S1 and S2 are executed• Example: x:=1 (x:=2; x:=x+2)– Possible outcomes for x: 1, 3, 4
50
While + parallelism:structural semantics
S1, s S1’, s’ S1S2, s S1’S2, s’ [par1
sos]
S1, s s’ S1S2, s S2, s’ [par2
sos]
S2, s S2’, s’ S1S2, s S1S2’, s’ [par3
sos]
S2, s s’ S1S2, s S1, s’ [par4
sos]
51
While + parallelism:natural semantics
Challenge problem:Give a formal proof that this is in fact impossible.
Idea: try to prove on a restricted version of While without loops/conditions
52
Example: derivation sequencesof a parallel statement
x:=1 (x:=2; x:=x+2), s
53
While + Local Variables
• S ::= …| Let x := a in S
54
Conclusion
• In the structural operational semantics we concentrate on small steps so interleaving of computations can be easily expressed
• In the natural semantics immediate constituent is an atomic entity so we cannot express interleaving of computations
55
While + memory
Abstract syntaxS ::= x := a | skip | S1; S2| if b then S1 else S2
| while b do S| x := malloc(a)| x := [y]|[x] := y
State : Var Z State : Stack HeapStack : Var ZHeap : Z Z
Integers as memory addresses
56
From states to traces
57
Trace semantics
• Low-level (conceptual) semantics• Add program counter (pc) with states– = State + pc
• The meaning of a program is a relation Stm
• Execution is a finite/infinite sequence of states• A useful concept in defining static analysis as
we will see later
58
Example
1: y := 1;
while 2: (x=1) do (
3: y := y * x;
4: x := x - 1
)
5:
59
Traces1: y := 1;
while 2: (x=1) do (
3: y := y * x;
4: x := x - 1
)
5:
{x2,y3},1 [y:=1] {x2,y1},2 [(x=1)] {x2,y1},3 [y:=y*x] {x2,y2},4 [x:=x-1] {x1,y2},2 [(x=1)] {x1,y2},5
{x3,y3},1 [y:=1] {x3,y1},2 [(x=1)] {x3,y1},3 [y:=y*x] {x3,y3},4 [x:=x-1] {x2,y3},2 [(x=1)] {x2,y3},3 [y:=y*x] {x2,y6},4 [x:=x-1] {x1,y6},2 [(x=1)] {x1,y6},5
…
Set of traces is infinite therefore trace semantics is incomputable in general
60
Operational semantics summary• SOS is powerful enough to describe imperative
programs– Can define the set of traces– Can represent program counter implicitly– Handle goto statements and other non-trivial control
constructs (e.g., exceptions)• Natural operational semantics is an abstraction• Different semantics may be used to justify different
behaviors• Thinking in concrete semantics is essential for a
analysis writer
Denotational Semantics
Based on a lecture by Martin Abadi
62
Denotational Semantics• A “mathematical” semantics– S is a mathematical object– A fair amount of mathematics is involved
• Compositional• More abstract and canonical than Op. Sem.– No notion of “execution”
• Merely definitions– No small step vs. big step
63
Denotational Semantics• Denotational semantics is also called– Fixed point semantics– Mathematical semantics– Scott-Strachey semantics
64
Plan
• Denotational semantics of While (1st attempt)• Math– Complete partial orders– Montonicity– Continuity
• Denotational semantics of While
65
Denotational semantics• A: Aexp (N)• B: Bexp (T)• S: Stm ()• Defined by structural induction
66
Denotational semantics• A: Aexp (N)• B: Bexp (T)• S: Stm ()• Defined by structural induction
A a , B b , Sns S , Ssos S
67
Denotational semantics of Aexp• A: Aexp (N)• A n = {(, n) | }• A X = {(, X) | }• A a0+a1 = {(, n0+n1) | (, n0)Aa0, (,n1)Aa1}• A a0-a1 = {(, n0-n1) | (, n0)Aa0, (,n1)Aa1}• A a0a1 = {(, n0 n1) | (, n0)Aa0, (,n1)Aa1}
Lemma: A a is a functionFunctions represented as sets of pairs
68
Denotational semantics of Aexp with
• A: Aexp (N)• A n = .n• A X = .(X)• A a0+a1 = .(A a0+Aa1)• A a0-a1 = .(A a0-Aa1)• A a0a1 = .(A a0 Aa1)
69
Denotational semantics of Bexp• B: Bexp (T)• B true = {(, true) | }• B false = {(, false) | }• B a0=a1 = {(, true) | & Aa0=Aa1 }
{(, false) | & Aa0Aa1 }• B a0a1 = {(, true) | & Aa0 Aa1 }
{(, false) | & Aa0Aa1 }• B b = {(, T t) | , (, t) Bb} • B b0b1 = {(, t0 Tt1) | , (, t0) Bb0, (, t1) Bb1 }• B b0b1 = {(, t0 Tt1) | , (, t0) Bb0, (, t1) Bb1 }
Lemma: Bb is a function
70
Denotational semantics of statements?
• Intuition:–Running a statement s starting from a
state yields another state ’• Can we define S s as a function
that maps to ‘ ? –S .: Stm ( )
71
Denotational semantics of commands?
• Problem: running a statement might not yield anything if the statement does not terminate
• We introduce the special element to denote a special outcome that stands for non-termination
• For any set X, we write X for X {}
• Convention:– whenever f X X we extend f to X X
“strictly” so that f() =
72
Denotational semantics of statements?
• We try:– S . : Stm ( )
• S skip=
• S s0 ; s1 = S s1 (S s0 )
• S if b then s0 else s1 =
if Bb then S s0 else S s1
73
Examples
• S X:= 2; X:=1= [X1]• S if true then X:=2; X:=1 else … = [X1] • The semantics does not care about
intermediate states• So far, we did not explicitly need
74
Denotational semantics of loops?
• S while b do s = ?
75
Denotational semantics of statements?• Abbreviation W=S while b do s• Idea: we rely on the equivalence
while b do s if b then (s; while b do s) else skip
• We may try using unwinding equationW() = if Bb then W(Ss ) else
• Unacceptable solution– Defines W in terms of itself– It not evident that a suitable W exists– It may not describe W uniquely
(e.g., for while true do skip)
76
Introduction to Domain Theory
• We will solve the unwinding equation through a general theory of recursive equations
• Think of programs as processors of streams of bits (streams of 0’s and 1’s, possibly terminated by $)What properties can we expect?
input output
77
Motivation• Let “isone” be a function that must return “1$” when
the input string has at least a 1 and “0$” otherwise– isone(00…0$) = 0$– isone(xx…1…$) =1$– isone(0…0) =?
• Monotonicity : Output is never retracted– More information about the input is reflected in
more information about the output• How do we express monotonicity precisely?
78
Montonicity
• Define a partial orderx y– A partial order is reflexive, transitive, and anti-symmetric– y is a refinement of x
• “more precise”
• For streams of bits x y when x is a prefix of y• For programs, a typical order is:– No output (yet) some output
79
Montonicity
• A set equipped with a partial order is a poset• Definition: – D and E are postes– A function f: D E is monotonic if
x, y D: x D y f(x) E f(y) – The semantics of the program ought to be a
monotonic function• More information about the input leads to more
information about the output
80
Montonicity Example• Consider our “isone” function with the prefix
ordering• Notation:– 0k is the stream with k consecutive 0’s– 0 is the infinite stream with only 0’s
• Question (revisited): what is isone(0k )?– By definition, isone(0k$) = 0$ and isone(0k1$) = 1$– But 0k 0k$ and 0k 0 k1$– “isone” must be monotone, so:
• isone( 0k ) isone( 0k$) = 0$• isone( 0k ) isone( 0k1$) = 1$
– Therefore, monotonicity requires that isone(0k ) is a common prefix of 0$ and 1$, namely
81
Motivation• Are there other constraints on “isone”?• Define “isone” to satisfy the equations– isone()=– isone(1s)=1$– isone(0s)=isone(s)– isone($)=0$
• What about 0?• Continuity: finite output depends only on finite input
(no infinite lookahead)
82
Chains• A chain is a countable increasing sequence
<xi> = {xi X | x0 x1 … }• An upper bound of a set if an element “bigger” than
all elements in the set• The least upper bound is the “smallest” among upper
bounds:– xi <xi> for all i N– <xi> y for all upper bounds y of <xi>
and it is unique if it exists
83
Complete Partial Orders
• Not every poset has an upper bound– with n and nn for all n N– {1, 2} does not have an upper bound
• Sometimes chains have no upper bound
0 1 2…
210
The chain 0 12…
does not have an upper bound
84
Complete Partial Orders• It is convenient to work with posets where every
chain (not necessarily every set) has a least upper bound
• A partial order P is complete if every chain in P has a least upper bound also in P
• We say that P is a complete partial order (cpo)• A cpo with a least (“bottom”) element is a pointed
cpo (pcpo)
85
Examples of cpo’s• Any set P with the order
x y if and only if x = y is a cpoIt is discrete or flat
• If we add so that x for all x P, we get a flat pointed cpo• The set N with is a poset with a bottom, but not a complete
one• The set N { } with n is a pointed cpo• The set N with is a cpo without bottom• Let S be a set and P(S) denotes the set of all subsets of S
ordered by set inclusion– P(S) is a pointed cpo
86
The End