文章目录
Separation logic
Adding the heap
- memory writes , [ E 1 ] : = E 2 [E_1]:=E_2 [E1]:=E2
- memory reads, x : = [ E ] x:=[E] x:=[E]
- memory allocation, x : = c o n s ( E 1 , ⋯ , E n ) x:=cons(E_1,\cdots,E_n) x:=cons(E1,⋯,En)
- memory deallocation,
d
i
s
o
p
o
s
e
E
disopose\ E
disopose E
s t a c k : v a r − > v a l u e stack :var->value stack:var−>value
h e a p : l o c − > v a l u e heap :loc->value heap:loc−>value
l o c ⊆ v a l u e loc \subseteq value loc⊆value
Operational semantics
E
/
s
→
v
x
:
=
E
/
(
s
,
h
)
→
s
k
i
p
/
(
s
[
x
:
=
v
]
,
h
)
{E/s \to v \over x:=E/(s,h) \to skip/(s[x:=v],h)}
x:=E/(s,h)→skip/(s[x:=v],h)E/s→v
E
/
s
→
v
x
:
=
[
E
]
/
(
s
,
h
)
→
s
k
i
p
/
(
s
[
x
:
h
(
v
)
]
,
h
)
{E/s \to v \over x:=[E]/(s,h) \to skip/(s[x:h(v)],h) }
x:=[E]/(s,h)→skip/(s[x:h(v)],h)E/s→v
E
1
/
s
→
v
1
E
2
/
s
→
v
[
E
1
]
:
=
E
2
/
(
s
,
h
)
→
s
k
i
p
/
(
s
,
h
[
v
1
:
=
v
2
)
]
)
{E_1/s \to v_1 \ E_2/s \to v \over [E_1]:=E_2/(s,h)\to skip /(s,h[v1:=v2)])}
[E1]:=E2/(s,h)→skip/(s,h[v1:=v2)])E1/s→v1 E2/s→v
E
1
/
s
→
v
1
⋯
E
n
/
s
→
v
n
v
⋯
v
+
(
n
−
1
)
∉
d
o
m
(
h
)
x
:
c
o
n
s
(
E
1
,
⋯
,
E
n
)
/
(
s
,
h
)
→
s
k
i
p
/
(
s
[
x
:
v
]
,
h
⊕
v
:
=
v
1
,
⋯
v
+
(
n
−
1
)
:
=
v
n
{E_1/s \to v_1 \ \cdots E_n/s \to v_n \ \ \ \ v \cdots v+(n-1)\notin dom(h) \over x:cons(E_1,\cdots,E_n)/(s,h)\rightarrow skip/(s[x:v],h\oplus \ v:=v1,\cdots v+(n-1):=v_n}
x:cons(E1,⋯,En)/(s,h)→skip/(s[x:v],h⊕ v:=v1,⋯v+(n−1):=vnE1/s→v1 ⋯En/s→vn v⋯v+(n−1)∈/dom(h)
E
/
s
→
v
d
i
s
p
o
s
e
E
/
(
s
,
h
)
→
s
k
i
p
/
(
s
,
h
\
v
)
{E/s \to v \over dispose E/(s,h) \to skip /(s,h\backslash v)}
disposeE/(s,h)→skip/(s,h\v)E/s→v
R
e
m
a
r
k
:
h
[
v
:
v
′
]
a
n
d
h
\
v
a
r
e
d
e
f
i
n
e
d
o
n
l
y
i
f
v
∈
d
o
m
(
h
)
\bm {Remark}: h[v:v'] \ and \ h\backslash v are defined only if v \in dom(h)
Remark:h[v:v′] and h\varedefinedonlyifv∈dom(h)
Frame
{ P } C { Q } { R ∗ P } C { Q ∗ R } \{P\}C\{Q\} \over \{R*P\}C\{Q*R\} {R∗P}C{Q∗R}{P}C{Q}
statements of separation logic
P
,
Q
:
:
=
T
t
r
u
e
∣
¬
P
∣
P
∧
Q
∣
P
∨
Q
∣
S
∣
P
∗
Q
∣
E
1
↦
E
2
∣
e
m
p
t
y
P,Q :: =T \ \ \ true \\ | \lnot P \ \ \ \ \ \\ | P \land Q\\ | P \lor Q \\ | S \ \ \ \ \ \ \ \ \\ \\ | P*Q\\ | E_1\mapsto E_2\\ | empty
P,Q::=T true∣¬P ∣P∧Q∣P∨Q∣S ∣P∗Q∣E1↦E2∣empty
(
s
,
h
)
⊨
e
m
p
t
y
i
f
f
d
o
m
(
h
)
=
∅
(s,h) \vDash empty\ iff \ dom(h) = \varnothing
(s,h)⊨empty iff dom(h)=∅
(
s
,
h
)
⊨
E
1
↦
E
2
i
f
f
E
1
/
s
→
v
1
∧
E
2
/
s
→
v
2
∧
d
o
m
(
h
)
=
v
1
∧
h
(
v
1
)
=
v
2
(
s
,
h
)
⊨
P
∗
Q
i
f
f
∃
h
1
,
h
2
.
d
o
m
(
h
1
)
∩
d
o
m
(
h
2
)
=
∅
∧
h
1
⊕
h
2
=
h
∧
(
s
,
h
1
)
⊨
P
∧
(
s
,
h
2
)
⊨
Q
(s,h) \vDash E_1 \mapsto E_2 \ iff \ E_1/s \to v_1 \land E_2/s \to v_2 \land dom(h) = v_1 \land h(v_1)=v_2 \\ (s,h) \vDash P*Q \ iff \\ \exists h_1,h_2.dom(h_1) \cap dom(h_2) = \varnothing \land h_1 \oplus h_2 =h \land (s,h_1) \vDash P \land (s,h_2) \vDash Q
(s,h)⊨E1↦E2 iff E1/s→v1∧E2/s→v2∧dom(h)=v1∧h(v1)=v2(s,h)⊨P∗Q iff∃h1,h2.dom(h1)∩dom(h2)=∅∧h1⊕h2=h∧(s,h1)⊨P∧(s,h2)⊨Q
Date types:list
- l i s t [ ] x ≡ e m p t y ∧ x = n i l list \ []\ x \equiv empty \land x = nil list [] x≡empty∧x=nil
- l i s t v 1 : : α x ≡ ∃ j . x ↦ v 1 ( X + 1 ↦ j ) ∗ l i s t α j list \ v_1:: \alpha \ x \equiv \exists j.x \mapsto v_1(X+1 \mapsto j)*list \ \alpha \ j list v1::α x≡∃j.x↦v1(X+1↦j)∗list α j
Data types :list segment
- l s e g [ ] ( x , y ) ≡ e m p t y ∧ x = y lseg \ []\ (x,y) \equiv empty \land x=y lseg [] (x,y)≡empty∧x=y
- l s e g v : : α ( x , y ) ≡ ∃ j . x ↦ v ∗ ( x + 1 ↦ j ) ∗ l s e g α ( j , y ) lseg \ v::\alpha(x,y) \equiv \exists j.x \mapsto v*(x+1\mapsto j)* lseg \ \alpha(j,y) lseg v::α(x,y)≡∃j.x↦v∗(x+1↦j)∗lseg α(j,y)
Exercise: prove,by structural induction on α \alpha α,that:
l s e g α ⋅ β ⟺ ∃ j . l s e g α ( x , y ) ∗ l s e g β ( j , y ) lseg \ \alpha \cdot \beta \iff \ \exists\ j.lseg \ \alpha(x,y)*lseg\ \beta(j,y) lseg α⋅β⟺ ∃ j.lseg α(x,y)∗lseg β(j,y)
(Local)axioms
- write : { E ↦ _ } [ E ] = E ′ { E ↦ E ′ } \{E \mapsto \_ \} [E] =E'\{E \mapsto E'\} {E↦_}[E]=E′{E↦E′}
- dispose: { E ↦ _ } d i s p o s e ( E ) { e m p t y } \{E \mapsto \_\}dispose(E)\{empty\} {E↦_}dispose(E){empty}
- alloc: { e m p t y } x = c o n s ( E 1 , … , E n ) { x ↦ E 1 ∗ x + 1 ↦ E 2 ∗ … x + ( n − 1 ) ↦ e n } \{empty\}x =cons(E_1,\ldots,E_n)\{x \mapsto E_1 *x+1 \mapsto E_2* \ldots x +\\(n-1) \mapsto e_n\} {empty}x=cons(E1,…,En){x↦E1∗x+1↦E2∗…x+(n−1)↦en}
Exercises:prove that:
{
l
s
e
g
α
(
i
,
j
)
∗
j
↦
a
,
k
}
k
:
c
o
n
s
(
a
,
i
)
;
i
:
=
k
{
l
s
e
g
a
⋅
α
(
i
,
j
)
}
{
l
s
e
g
α
(
i
,
j
)
∗
j
↦
a
,
k
}
l
:
=
c
o
n
s
(
b
,
k
)
;
[
j
+
1
]
=
l
{
l
s
e
g
α
⋅
a
⋅
b
(
i
,
k
)
}
{
l
s
e
g
a
⋅
α
(
i
,
k
)
}
j
:
=
[
i
+
1
]
;
d
i
s
p
o
s
e
i
;
d
i
s
p
o
s
e
i
+
1
;
i
:
=
j
{
l
s
e
g
α
(
i
,
k
)
}
\{lseg \ \alpha(i,j)*j \mapsto a,k\}k:cons(a,i);i:=k \{ lseg \ a \cdot \alpha(i,j)\} \\ \{lseg \ \alpha(i,j)*j \mapsto a,k\}l:=cons(b,k);[j+1]=l \{ lseg \ \alpha \cdot a \cdot b(i,k)\} \\ \{lseg \ a \cdot \alpha(i,k)\} j:=[i+1];dispose \ i ; dispose \ i+1; i:=j \ \{lseg \ \alpha(i,k)\}
{lseg α(i,j)∗j↦a,k}k:cons(a,i);i:=k{lseg a⋅α(i,j)}{lseg α(i,j)∗j↦a,k}l:=cons(b,k);[j+1]=l{lseg α⋅a⋅b(i,k)}{lseg a⋅α(i,k)}j:=[i+1];dispose i;dispose i+1;i:=j {lseg α(i,k)}
Remember:
l
s
e
g
[
]
(
x
,
y
)
≡
e
m
p
t
y
∧
x
=
y
lseg \ [] \ (x,y) \equiv empty \land x=y
lseg [] (x,y)≡empty∧x=y
l
s
e
g
v
:
:
α
(
x
,
y
)
≡
∃
j
.
x
↦
v
∗
(
x
+
1
↦
j
)
∗
l
s
e
g
α
(
j
,
y
)
lseg \ v::\alpha(x,y) \equiv \exists j.x \mapsto v*(x+1 \mapsto j)* lseg \ \alpha(j,y)
lseg v::α(x,y)≡∃j.x↦v∗(x+1↦j)∗lseg α(j,y)
Notation :
j
↦
a
,
k
j \mapsto a,k
j↦a,k stands for
j
↦
a
∗
j
+
1
↦
k
j \mapsto a*j+1 \mapsto k
j↦a∗j+1↦k
1279
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
