Modular Termination Verification on VeriFast

໨࣍ VeriFast ֓ཁ ఀࢭੑݕࠪͱ͸Կ͔ VeriFast ʹΑΔఀࢭੑݕࠪ ﬁxpoint ͷఀࢭੑ C ݴޠؔ਺ͷఀࢭੑݕࠪ ύλʔϯผఀࢭੑݕূ
Modular Termination Veriﬁcation on VeriFast
@eldesh
https://twitter.com/eldesh
http://d.hatena.ne.jp/eldesh
੩తίʔυղੳͷձ ୈ 6 ճ
2018/01/20
2018/01/20 VeriFast Termination Checking 1 / 74

View Slide

໨࣍
1 VeriFast ֓ཁ
2 ఀࢭੑݕࠪͱ͸Կ͔
3 VeriFast ʹΑΔఀࢭੑݕࠪ
4 ﬁxpoint ͷఀࢭੑ
5 C ݴޠؔ਺ͷఀࢭੑݕࠪ
ଟॏू߹ͱ DW-Ordering
6 ύλʔϯผఀࢭੑݕূ
Upcalls Only ύλʔϯ
Static Recursion ύλʔϯ
Dynamic Binding ύλʔϯ
7 ࢀর

View Slide

What is this slide?
͜ͷεϥΠυͰ͸ VeriFast ʹΑΔ C ݴޠ͓Αͼ Java ϓϩάϥϜͷఀࢭੑݕ
ূͷجૅͱͳΔ֓೦ɺ͓ΑͼͦΕΛ༻͍ͨݕূํ਑ɺ࣮ࡍͷॲཧܥͰͷѻ
͍ʹ͍ͭͯઆ໌͠·͢ɻ
جૅͱͳΔ֓೦
ఀࢭੑূ໌ͷํ਑
࣮ࡍͷॲཧܥ্Ͱͷѻ͍

View Slide

૝ఆ/ର৅ௌऺ
ඞਢ
C ݴޠ͕෼͔Δ
๬·͍͠
ࣄલ/ࣄޙ৚݅ͷݕ͕ࠪͲΜͳ΋ͷͳͷ͔෼͔Δ

View Slide

VeriFast ͷೖ໳తΛઆ໌͢Δ

View Slide

ఀࢭੑݕࠪͱ͸
ϓϩάϥϜ͕ (༗ݶ࣌ؒ಺ʹ) ఀࢭ͢Δ͜ͱΛݕࠪ͢Δ͜ͱɻ

View Slide

VeriFast ͕ݕࠪ͢Δ͜ͱ
ͱ͜ΖͰɺVeriFast ͸ϓϩάϥϜ (ؔ਺) ͱɺͦͷࣄલ৚݅/ࣄޙ৚݅ͱͷҰ
؏ੑΛݕࠪ͢Δɻ

View Slide

VeriFast ͕ݕࠪ͢Δ͜ͱ
ͱ͜ΖͰɺVeriFast ͸ϓϩάϥϜ (ؔ਺) ͱɺͦͷࣄલ৚݅/ࣄޙ৚݅ͱͷҰ
؏ੑΛݕࠪ͢Δɻ
⇒ ͜Ε͸Կ͕ݕূग़དྷ͍ͯΔͷ͔ɻ

View Slide

VeriFast Ͱݕࠪͨؔ͠਺
ΤϯΩϡʔͷ࢓༷ͷྫ
void enqueue(struct queue *q, int x)
//@ requires queue(q, ?vs);
//@ ensures queue(q, iappend(vs , icons(x, inil )));
{
...
}

View Slide

Hoare triple
ؔ਺ͱɺͦͷࣄલ৚݅/ࣄޙ৚݅ 3 ͭΛ߹Θͤͯ Hoare triple ͱݺͿɻ
͜ΕΛܗࣜతʹѻ͏ࡍʹ͸ҎԼͷΑ͏ʹදه͢Δɻ
Hoare triple
⊢ {P} c {Q}

View Slide

Hoare triple ͷҙຯ
ؔ਺ͱɺͦͷࣄલ৚݅/ࣄޙ৚݅ 3 ͭΛ߹Θͤͯ Hoare triple ͱݺͿɻ
⊢ {P} c {Q} ⇔ ∀h, γ.Iﬁx , h |= P ∧ (h, c) ⇓ γ ⇒ γ |= Q
γ |= Q ͷҙຯ
Divergence |= Q
Iﬁx , h |= Q[v/res]
(n, v, h) |= Q
Divergence ͸ൃࢄͨ͠ঢ়ଶ (ແݶϧʔϓ) Λද͢ɻ

View Slide

Divergence |= Q
ͱ͍͏͜ͱ͸ɺແݶϧʔϓʹͳͬͨ৔߹͸ৗʹ Q ࣄޙ৚
͕݅੒Γཱͭͱݴ͍ͬͯΔɻ

View Slide

Divergence |= Q
ͱ͍͏͜ͱ͸ɺແݶϧʔϓʹͳͬͨ৔߹͸ৗʹ Q ࣄޙ৚
͕݅੒Γཱͭͱݴ͍ͬͯΔɻ
⇒VerifFast ͸ແݶϧʔϓʹͳΔ͔Ͳ͏͔͸ݕূ͠ͳ͍

View Slide

VeriFast ͸෦෼ਖ਼౰ੑ (partial correctness) Λ࣋ͭɻ
෦෼ਖ਼౰ੑ
ϓϩάϥϜͷ࣮ߦ݁Ռ͕ग़ͨ (=ਖ਼͘͠ऴྃͨ͠) ৔߹ʹ
ͦͷਖ਼͠͞Λอূ͢Δ
⇕
Partial Correctness
͜Εʹରͯ͠ɺৗʹϓϩάϥϜ͕ਖ਼͍݁͠ՌΛग़ྗ͢Δ৔߹ɺ͜ΕΛ׬શ
ਖ਼౰ੑ (Total Correctness) Λ࣋ͭ ͱ͍͏ɻ

View Slide

ఀࢭੑݕࠪͱ͸ (࠶)
࠶
ϓϩάϥϜ͕ (༗ݶ࣌ؒ಺ʹ) ఀࢭ͢Δ͜ͱΛݕࠪ͢Δ͜ͱɻ
ͱ͍͏͜ͱ͸. . .
(෦෼ਖ਼౰ੑʹՃ͑ͯ) ఀࢭੑΛݕূ͢Δ
⇕
VeriFast ʹ׬શਖ਼౰ੑΛ༩͑Δ
⇕
ϓϩάϥϜ͕ৗʹਖ਼͍͠౴͑Λฦ͢͜ͱΛอূͰ͖Δ

View Slide

ఀࢭੑݕࠪͷࢦఆ
ؔ਺ͷఀࢭੑΛݕࠪ͢Δʹ͸௨ৗͷࣄલ, ࣄޙ৚݅ͷଞʹ terminates Λࢦ
ఆ͢Δ.
Կ΋͠ͳ͍ؔ਺ͷݕূ
void empty_cmd (void)
//@ requires emp;
//@ ensures emp;
//@ terminates;
{
}

View Slide

ࣗ໌ʹఀࢭ͢Δྫ 1
ϓϦϛςΟϒͳԋࢉ͸ࣗ໌ʹఀࢭ͢Δɻ
less than ͷ࢓༷
bool compare (int x, int y)
//@ requires emp;
//@ ensures result == (x < y);
//@ terminates;
{
return x < y;
// ฦΓ஋͸େখൺֱͷ݁ՌʹҰக͢Δ
}

View Slide

if จ͸ɺͦΕͧΕͷઅ͕ఀࢭ͢ΔͳΒࣗ໌ʹఀࢭ͢Δɻ
if statement
int max_int (int x, int y)
//@ requires emp;
//@ ensures result == (x > y ? x : y);
//@ terminates;
{
if (x > y) {
return x;
} else {
return y;
}
}

View Slide

ఀࢭ͢Δؔ਺ΛݺͿؔ਺͕ɺͦͷؔ਺ΑΓϑΝΠϧதͰԼͰఆٛ͞Ε͍ͯ
Δ৔߹΋ఀࢭ͢Δ͜ͱ͕ࣗಈͰݕࠪͰ͖Δɻ
call function
int callee (int x)
//@ requires emp;
//@ ensures emp;
//@ terminates;
{
return 0;
}
void caller (void)
//@ requires emp;
//@ ensures emp;
//@ terminates;
{
callee (3);
}

View Slide

ϧʔϓ
ݕূʹৗʹඞཁͱͳΔϧʔϓΠϯόϦΞϯτʹՃ͑ͯɺdecreases ໋ྩͰݮ
গ͢ΔύϥϝʔλΛࢦఆ͢Δ͜ͱͰఀࢭੑΛݕࠪ͢Δ͜ͱ͕Ͱ͖Δɻ
while loop
void loop (int x)
//@ requires 0 < x;
//@ ensures emp;
//@ terminates;
{
int i = 0;
while (i < x)
//@ invariant i <= x;
//@ decreases x - i;
{
++i;
}
}

View Slide

ࣗ໌Ͱ͸ͳ͍ఀࢭ͢Δྫ
ΞοΧʔϚϯؔ਺
int ackermann(int m, int n)
{
if (m == 0) {
return n + 1;
} else {
if (n == 0) {
int r = ackermann(m - 1, 1);
return r;
} else {
return ackermann(m - 1,
ackermann(m, n - 1));
}
}
}
ఀࢭੑΛݕূͨ͠ίʔυ͸ examples/termination/ackermann.c Λࢀরɻ72 ߦ͋Δɻ

View Slide

جຊతͳൃ૝
શͯͷݺͼग़͠γʔέϯε͕༗ݶεςοϓ௕͔͠ͳ͍͜ͱΛࣔͤ͹ྑ͍ɻ
⇒ Ͳ͏͢Δ͔

View Slide

ﬁxpoint
ͱ͜ΖͰ VeriFast ͸໋୊தͷؔ਺Λ fixpoint ͱ͍͏ΩʔϫʔυͰهड़͢Δ
͜ͱ͕ग़དྷΔɻ
ﬁxpoint ؔ਺ͷྫ
fixpoint int length (list xs) {
switch (xs) {
case nil: return 0;
case cons(x, xs0): return 1 + length(xs0);
}
}

View Slide

ﬁxpoint
fixpoint ͸ඞͣఀࢭ͢Δɻ
switch (xs) {
case nil: return 0;
}
}

View Slide

ﬁxpoint
fixpoint ͸ͳͥඞͣఀࢭ͢Δͷ͔
switch (xs) {
case nil: return 0;
}
}

View Slide

ﬁxpoint ͷ੍ݶ
fixpoint ʹΑΔؔ਺ͷఆٛʹ͸ɺ೚ҙͷؔ਺͕هड़Ͱ͖ΔΘ͚Ͱ͸ͳ͘ز
੍͔ͭ໿͕൐͏ 1ɻ
ﬁxpoint ͷ੍ݶ
୯ಠͷ return ·ͨ͸ switch จͰ͋Δ͜ͱ
switch ʹ౉ͤΔͷ͸ inductive σʔλͷΈ
શͯͷίϯετϥΫλʹ͍ͭͯఆٛ͞Ε͍ͯΔ͜ͱ
࠶ؼ͢Δ৔߹͸ύλʔϯϚονͰऔΓग़ͨ͠σʔλʹ͍ͭͯࣗ਎Λݺ
ΜͰ͍Δ͜ͱ
Ҏ্ͷΑ͏ͳ੍ݶΛकΔ͜ͱͰɺ஋ʹґͬͯ͸ະఆٛ͋Δ͍͸ݕ͕ࠪࢭ·
Βͳ͘ͳΔΑ͏ͳ (͓͔͠ͳ) ࢓༷Λආ͚Δ͜ͱ͕Ͱ͖Δɻ
1ͦΕͧΕ VeriFast ͕ݕࠪ͢Δ

View Slide

ﬁxpoint ͷ੍ݶ
fixpoint ʹΑΔؔ਺ͷఆٛʹ͸ɺ೚ҙͷؔ਺͕هड़Ͱ͖ΔΘ͚Ͱ͸ͳ͘ز
੍͔ͭ໿͕൐͏ 1ɻ
ﬁxpoint ͷ੍ݶ
୯ಠͷ return ·ͨ͸ switch จͰ͋Δ͜ͱ
switch ʹ౉ͤΔͷ͸ inductive σʔλͷΈ
શͯͷίϯετϥΫλʹ͍ͭͯఆٛ͞Ε͍ͯΔ͜ͱ
࠶ؼ͢Δ৔߹͸ύλʔϯϚονͰऔΓग़ͨ͠σʔλʹ͍ͭͯࣗ਎Λݺ
ΜͰ͍Δ͜ͱ
Ҏ্ͷΑ͏ͳ੍ݶΛकΔ͜ͱͰɺ஋ʹґͬͯ͸ະఆٛ͋Δ͍͸ݕ͕ࠪࢭ·
Βͳ͘ͳΔΑ͏ͳ (͓͔͠ͳ) ࢓༷Λආ͚Δ͜ͱ͕Ͱ͖Δɻ
⇒fixpoint ؔ਺͸ඞͣఀࢭ͢Δ
1ͦΕͧΕ VeriFast ͕ݕࠪ͢Δ

View Slide

ﬁxpoint Ͱ͏·͍͘͘ཧ༝
fixpoint ͕ఀࢭ͢Δॏཁͳཧ༝͸ɺ
inductive σʔλ্ͷ࠶ؼͰ͋Δ
࠶ؼݺͼग़͠ຖʹίϯετϥΫλ͕Ұͭͣͭണ͕Ε͍ͯ͘ 2
2Inductive σʔλͱ͍͏ͷ͸ɺجఈͷσʔλʹίϯετϥΫλΛ༗ݶճద༻ͯ͠ಘΒΕΔ
σʔλͷ͜ͱ

View Slide

inductive ΑΓෳࡶͳ΋ͷ
fixpoint ͸ inductive σʔλ্ͷؔ਺ͩͬͨɻͰ͸ C ݴޠͰѻ͏σʔλߏ
଄Ͱ͸Ͳ͏ͩΖ͏ʁ

View Slide

॥؀͢Δσʔλߏ଄
typedef struct C {
int x;
struct C * t;
} C;
void consumer (C * c) {
...
consumer(c->t);
}
void producer (void) {
C * ones = malloc(sizeof(C));
ones ->x = 1;
ones ->t = ones;
consumer(ones );
}

View Slide

ྫ͑͹॥؀͢Δσʔλߏ଄্ͷؔ਺ͷ৔߹ɺ༩͑ΒΕͨσʔλͷҰ෦ʹͭ
͍ͯ࠶ؼݺͼग़͠ 3 ͍ͯͯ͠΋ؔ਺͕ఀࢭ͢Δͱ͸ݴ͑ͳ͍ɻ
॥؀͢Δσʔλߏ଄
void consumer (C * c) {
...
consumer(c->t);
}
void producer (void) {
C * ones = malloc(sizeof(C));
ones ->x = 1;
ones ->t = ones;
consumer(ones );
}
3fixpoint Ͱݕࠪ͢Δ಺༰ʹ૬౰͢Δ৚݅

View Slide

C ݴޠͰ͏·͍͔͘ͳ͍ཧ༝
C ݴޠͰ͸ఀࢭੑݕূ͸؆୯Ͱ͸ͳ͍ɻ
C ݴޠͰѻ͏σʔλ͸ inductive ͱ͸ݶΒͳ͍
෼͔Γ΍͘͢σʔλߏ଄͕খ͘͞ͳΒͳ͍
॥؀σʔλߏ଄
ڞ༗͞ΕͨมߋՄೳͳߏ଄

View Slide

C ݴޠͰ͏·͍͔͘ͳ͍ཧ༝
C ݴޠͰ͸ఀࢭੑݕূ͸؆୯Ͱ͸ͳ͍ɻ
C ݴޠͰѻ͏σʔλ͸ inductive ͱ͸ݶΒͳ͍
෼͔Γ΍͘͢σʔλߏ଄͕খ͘͞ͳΒͳ͍
॥؀σʔλߏ଄
ڞ༗͞ΕͨมߋՄೳͳߏ଄
inductive ͳσʔλΑΓҰൠతͳσʔλΛѻ͍͍ͨ

View Slide

੔ૅؔ܎
inductive σʔλ (ͷίϯετϥΫλ਺ͷେখؔ܎) ͷҰൠԽͱͯ͠੔ૅؔ
܎Λߟ͑Δɻ
͋Δू߹্ͷೋ߲ؔ܎ R ͕੔ૅؔ܎ Well-Founded Relation Ͱ͋Δͱ͸
੔ૅؔ܎
∀S ⊆ X, S ̸= ∅ → ∃m ∈ S, ∀s ∈ S, (s, m) /
∈ R
੔ૅؔ܎
ू߹ X ্ͷೋ߲ؔ܎ R ͕ɺۭͰͳ͍ू߹ S ⊂ X ͕ R ʹؔͯ͠ۃখݩΛ
࣋ͭ

View Slide

inductive σʔλ্ͷ੔ૅؔ܎
fixpoint ؔ਺ͷఀࢭੑ͸ɺҾ਺ͷίϯετϥΫλͷ਺͕ؔ਺ݺͼग़͠ͷ౓
ʹݮ͍ͬͯ͘͜ͱʹґ͍ͬͯͨɻ
ﬁxpoint ͷఀࢭੑ
ࣗવ਺ (ίϯετϥΫλͷ਺) ্ͷେখؔ܎͕੔ૅؔ܎Ͱ͋Δ͜ͱʹґͬͯ
͍Δɻ
੔ૅؔ܎ͷఆٛʹ౰ͯ͸Ίͯ֬ೝ͢Δɿ
੔ૅؔ܎
∀S ⊆ X, S ̸= ∅ → ∃m ∈ S, ∀s ∈ S, (s, m) /
∈ R
ࣗવ਺্ͷେখؔ܎
∀S ⊆ N, S ̸= ∅ → ∃m ∈ S, ∀s ∈ S, (s, m) /
∈ (2018/01/20 VeriFast Termination Checking 29 / 74

View Slide

੔ૅؔ܎ͷ௚؍
ΑΓ௚ײతʹ͸ɺ੔ૅؔ܎ͱ͸ɺू߹্ͷೋ߲ؔ܎ R ͕ແݶ߱Լྻ 4 Λ࣋
ͨͳ͍͜ͱΛݴ͏ɻ
͜Ε͸ܭࢉ͕ਐΉʹ࿈ΕͯԿ͔͕੔ૅؔ܎Ͱ͋Δେখؔ܎ʹԊͬͯݮগ͠
͍ͯ͘ͳΒ͹ɺͦͷܭࢉ͕༗ݶ࣌ؒͰఀࢭ͢Δ͜ͱʹରԠ͢Δɻ(ؾ͕͢Δ)
4ৗʹΑΓখ͍͞ݩ͕ଘࡏ͢Δ͜ͱ

View Slide

ݮগ͢ΔϞϊ
੔ૅؔ܎Λಋೖͯ͠ inductive σʔλ (্ͷେখؔ܎) ΑΓॊೈͳೋ߲ؔ܎
͕ѻ͑ΔΑ͏ʹͳͬͨɻͰ͸ C ݴޠͰ͸Կ͕ݮ͍ͬͯΔͱߟ͑Ε͹͍͍ͩ
Ζ͏ʁ

View Slide

ݮগ͢ΔϞϊ
੔ૅؔ܎Λಋೖͯ͠ inductive σʔλ (্ͷେখؔ܎) ΑΓॊೈͳೋ߲ؔ܎
͕ѻ͑ΔΑ͏ʹͳͬͨɻͰ͸ C ݴޠͰ͸Կ͕ݮ͍ͬͯΔͱߟ͑Ε͹͍͍ͩ
Ζ͏ʁ
ఏҊɿcall permission (ؔ਺ΛݺͿݖར)a
aʮpermissionʯͳͷͰʮڐ୚ʯͷํ͕ద੾͔΋

View Slide

call permission ͷಋೖ
ؔ਺ݺͼग़͠ʹ͸ඞͣ call permission ͱ͍͏ݖར͕ඞཁͱ͍͏͜ͱʹ
͢Δɻ
ؔ਺ f ΛݺͿͨΊʹ call_perm(f) ͕ (Ұͭ) ඞཁ
ؔ਺ f ΛݺͿ౓ʹ call_perm(f) ͕ (Ұͭ) ݮগ

View Slide

call permission ͷಋೖ
ؔ਺ݺͼग़͠ʹ͸ඞͣ call permission ͱ͍͏ݖར͕ඞཁͱ͍͏͜ͱʹ
͢Δɻ
ؔ਺ f ΛݺͿͨΊʹ call_perm(f) ͕ (Ұͭ) ඞཁ
ؔ਺ f ΛݺͿ౓ʹ call_perm(f) ͕ (Ұͭ) ݮগ
࠷ॳʹؔ਺ͦΕͧΕͷ༗ݶݸͷ call_perm ͷετοΫΛ༩͑Δ
ؔ਺͔Βݺͼग़͢શͯͷؔ਺ͷ call_perm Λࣄલ৚݅ʹཁٻ͢Δ
ݕূΛύεग़དྷΕ͹༗ݶճ͔ؔ͠਺ݺͼग़͠͸ແ͍ (ఀࢭ͢Δ) ͸ͣͰ
͋Δ

View Slide

call permission ͷ࣮૷
call permission ͷ௥੻͸طଘͷ predicate ͱಉ༷ͷ࢓૊ΈͰՄೳɻ
ඪ४ϥΠϒϥϦͰ೚ҙͷؔ਺ϙΠϯλ্ͷ૊ΈࠐΈͷ predicate ͱͯ͠ఏ
ڙ͞Εɺ࣮ମ͸Ϣʔβଆʹެ։͞Ε͍ͯͳ͍ɻ
call permission ͷ࣮૷
// prelude.h
predicate call_perm_(void *f;);
;(ηϛίϩϯ) ͕෇͍͍ͯΔͷͰɺಉ͡ϙΠϯλʹ͍ͭͯͷ call_perm_͸Ұ
ҙʹఆ·Δɻ

View Slide

call_perm_ͷ࢖༻
ؔ਺ f ΛݺͿͨΊʹ͸ call_perm_(f) ͕ඞཁͱ͞ΕΔ
call_perm_ͷ࢖༻ (pseudo)
void call (void)
//@ requires call_perm_(f);
//@ ensures emp;
//@ terminates;
{
f();
}

View Slide

call_perm_ͷ࢖༻
ؔ਺ f Λ 2 ճݺͿ͜ͱ͸Ͱ͖ͳ͍ɻ
call_perm_ͷ࢖༻ (pseudo)
void call (void)
//@ requires call_perm_(f);
//@ ensures emp;
//@ terminates;
{
f();
f(); // ~should_fail
}

View Slide

call_perm_ͷ࢖༻
ؔ਺ f Λ 2 ճݺͿͨΊʹ͸ call_perm_(f) ͕ 2 ͭඞཁ
call_perm_ͷ࢖༻
void call (void)
//@ requires [2] call_perm_(f);
//@ ensures emp;
//@ terminates;
{
f();
f();
}

View Slide

call_perm_ͷߏ੒
ؔ਺ΛݺͿͨΊʹ͸ call_perm_͕ඞཁ͕ͩɺcall_perm_ͱ͍͏໋୊ͷΠϯ
ελϯε͸௚઀ߏ੒Ͱ͖ͣɺ·ͣ call_below_perm_ͱ͍͏໋୊Λܦ༝͢Δ
ඞཁ͕͋Δɻ
call_below_perm
// prelude.h
predicate call_below_perm_ (void *f;);

View Slide

call_below_perm_ͷಋग़
call_below_perm_ΛಘΔʹ͸ɺproduce_call_below_perm_ͱ͍͏૊ΈࠐΈ໋
ྩ 5 Λ࢖͏ɻ
produce_call_below_perm
void func (void)
//@ requires emp;
//@ ensures call_below_perm_ (func );
{
//@ produce_call_below_perm_ ();
//@ assert( call_below_perm_ (func ));
}
͋Δؔ਺ func ͔Β produce_call_below_perm_ΛݺͿͱɺ
call_below_perm_(func) ͕ (Ұͭ) खʹೖΔɻ
5ΰʔετίϚϯυ (ghost command) ͱݺ͹ΕΔ

View Slide

call_perm_Λಋग़͢Δ
call_below_perm_(f) ͔Β͸ඪ४ϥΠϒϥϦͷఏڙ͞ΕΔิ୊ʹΑͬͯ
call_perm_(g)(ͨͩ͠ g < f ) ͕ಋग़Ͱ͖Δɻ
call_below_perm_͔Β call_perm_Λಋग़͢Δ
void g (void ); //@ terminates;
void f (void)
//@ requires emp;
//@ ensures emp;
//@ terminates;
{
//@ call_below_perm__elim (f);
//@ consume_call_perm_for (g);
g();
}

View Slide

call_below_perm_
call_below_perm_͸ఀࢭੑݕࠪͷϞδϡϥϦςΟΛߴΊΔͨΊʹಋೖ͞Ε
໋ͨ୊ 6 Ͱɺcall_perm_ͱͷؒʹҎԼͷΑ͏ͳؔ਺ͷେখؔ܎ 7 ʹجͮ͘େ
খؔ܎͕ఆٛ͞Ε͍ͯΔɻ
call_perm_ͱ call_below_perm_ͷେখؔ܎
∀f g, g < f →
call_perm_(g) < call_below_perm_(f ) < call_perm_(f )
6චऀͷ༧૝
7ؔ਺ͷେখؔ܎͸ޙड़

View Slide

call_below_perm_
call_below_perm_͸ఀࢭੑݕࠪͷϞδϡϥϦςΟΛߴΊΔͨΊʹಋೖ͞Ε
໋ͨ୊ 6 Ͱɺcall_perm_ͱͷؒʹҎԼͷΑ͏ͳؔ਺ͷେখؔ܎ 7 ʹجͮ͘େ
খؔ܎͕ఆٛ͞Ε͍ͯΔɻ
call_perm_ͱ call_below_perm_ͷେখؔ܎
ؔ਺ f ͷఆٛதͰߏ੒Ͱ͖Δ call_below_perm_(f) ͸ɺcall_perm_(f) ະຬ
Ͱ࠷େͷ call permssionɻ
6චऀͷ༧૝
7ؔ਺ͷେখؔ܎͸ޙड़

View Slide

call_perm ΛͲ͏΍ͬͯ༩͑Δ͔
call_perm_ͱ call_below_perm_Λ࢖͑͹ɺݕূ͢Δର৅ؔ਺ΑΓখ͍ؔ͞
਺Λܾ·ͬͨճ਺ݺͼग़͢έʔεʹ͍ͭͯ͸ݕূͰ͖ͦ͏ͩͬͨɻ

View Slide

ؔ਺ͷఀࢭੑΛݕূ͢Δʹ͸ҎԼͷखॱ͕ඞཁͩͬͨɻ
ͱ͜Ζ͕Ұൠʹɺݕূ͠Α͏ͱ͍ͯ͠Δؔ਺͕Ͳͷؔ਺ΛԿ౓ݺͿ͔ͳΜ
ͯ෼͔Βͳ͍. . .

View Slide

ؔ਺ͷఀࢭੑΛݕূ͢Δʹ͸ҎԼͷखॱ͕ඞཁͩͬͨɻ
ͱ͜Ζ͕Ұൠʹɺݕূ͠Α͏ͱ͍ͯ͠Δؔ਺͕Ͳͷؔ਺ΛԿ౓ݺͿ͔ͳΜ
ͯ෼͔Βͳ͍. . .
⇒ ଟॏू߹ (multiset,bag) ͱ DW-Ordering Λ࢖͏

View Slide

ଟॏू߹
ଟॏू߹ (multi set) ͸ɺཁૉͷॏෳΛڐ͢ू߹ɻ
ଟॏू߹ͷྫ
{[]}
{[1, 2, 3]}
{[1, 3, 3, 5, 5, 5, 6]}
ͦΕͧΕͷཁૉ਺Λଟॏ౓ͱݺͼɺҎԼͷΑ͏ʹදه͢Δɻ
ଟॏ౓
M = {[1, 3, 3, 5, 5, 5, 6]} ͷ࣌ɺ
M(0) = 0
M(3) = 2
M(5) = 3

View Slide

ଟॏू߹
ࠓճͷٞ࿦Ͱ͸݁߹ (join) ͱݺ͹ΕΔૢ࡞͕ඞཁʹͳΔ 8ɻ
ଟॏू߹ͷ݁߹ (join)
{[1, 2, 3]} ⊎ {[2, 3, 4]} = {[1, 2, 2, 3, 3, 4]}
8࣮૷͸୯ͳΔϦετͷ࿈݁

View Slide

ଟॏू߹্ͷॱংؔ܎
൒ॱংؔ܎ͷ͋Δཁૉ͔ΒͳΔଟॏू߹ʹҎԼͷΑ͏ͳॱংؔ܎Λ༩͑
Δ 9ɻ
Dershowitz–Manna ordering
ଟॏू߹ M,N ʹ͍ͭͯɺେখؔ܎ (M < N ≡ M ̸= N ∧ ∀y ∈ S, M(y) > N(y) → ∃x ∈ S, y < x ∧ M(x) < N(x)
͜ͷنଇʹै͑͹ྫ͑͹ {[0, 0, 1, 2, 2, 2]} < {[0, 0, 0, 3]} ͕੒Γཱͭɻ
9࿦จதͰཅʹݴٴ͕ແ͍͕ Dershowitz-Manna Ordering ͩͱࢥΘΕΔ

View Slide

ଟॏू߹্ͷॱংؔ܎
൒ॱংؔ܎ͷ͋Δཁૉ͔ΒͳΔଟॏू߹ʹҎԼͷΑ͏ͳॱংؔ܎Λ༩͑
Δ 9ɻ
Dershowitz–Manna ordering[1]
In order to descend down the multiset order starting from a multiset M, one
can replace any element of M with any number of lesser elements of X, any
number of times.
(খ͍͞ཁૉ͸زͭ͋ͬͯ΋ΑΓେ͖͍ཁૉ 1 ͭΑΓখ͍͞)
͜ͷنଇʹै͑͹ྫ͑͹ {[0, 0, 1, 2, 2, 2]} < {[0, 0, 0, 3]} ͕੒Γཱͭɻ
9࿦จதͰཅʹݴٴ͕ແ͍͕ Dershowitz-Manna Ordering ͩͱࢥΘΕΔ

View Slide

func_lt
ͱ͜Ζ͕ VeriFast ʹ͸೚ҙͷؔ਺ϙΠϯλΛେখൺֱͰ͖Δؔ਺͕͋Δɻ
ؔ਺ͷେখؔ܎
// prelude.h
fixpoint bool func_lt(void *f, void *g);

View Slide

func_lt
ͱ͜Ζ͕ VeriFast ʹ͸೚ҙͷؔ਺ϙΠϯλΛେখൺֱͰ͖Δؔ਺͕͋Δɻ
ؔ਺ͷେখؔ܎
// prelude.h
fixpoint bool func_lt(void *f, void *g);
⇒ ͲͷΑ͏ʹେখؔ܎Λఆٛ͢Δͷ͔ʁ

View Slide

func_lt
ιʔείʔυ্ͷ্Լؔ܎Λͦͷ··࢖͏ʂ
ؔ਺ͷେখؔ܎
void foo (void) //@ terminates;
{ }
void bar (void) //@ terminates;
{ }
void cmp (void) //@ terminates;
{
//@ assert func_lt(foo , bar) == true;
//@ assert func_lt(bar , foo) == false;
}
͜ͷେখؔ܎͸ VeriFast ͕ࣗಈͰಋग़ͯ͘͠ΕΔɻ

View Slide

DW-Ordering Λಋग़ͨ͠खॱ
͜Ε·ͰͰҎԼͷखॱͰଟॏू߹্ͷ੔ૅؔ܎͕खʹೖͬͨɻ
ؔ਺ʹେখؔ܎͕ಋೖ͞Εͨ (func_lt ͕࢖͑Δ)
call_perm_্ʹ΋ͦͷେখؔ܎Λͦͷ··࢖͏
call_perm_্ͷେখؔ܎͔Β Dershowitz-Manna ordering Ͱ੔ૅؔ܎Λ
ఆٛ͢Δ

View Slide

DW-Ordering Λಋग़ͨ͠खॱ
͜Ε·ͰͰҎԼͷखॱͰଟॏू߹্ͷ੔ૅؔ܎͕खʹೖͬͨɻ
͜ͷؔ܎Λ࢖͏ͱɺΑΓখ͍͞ call_perm_Λ೚ҙݸಋग़͢Δ͜ͱ͕ग़དྷΔɻ
derive permissions
void g (void) //@ requires call_perm ({h});
{
func_t * ff = f;
//@ call_perm_below (2);
//@ assert [2] call_perm_(f);
//@ consume_call_perm_for (f);
//@ consume_call_perm_for (f);
ff(); ff();
}
void f (void) //@ : func_t
{ }
void h (void)
{ }

View Slide

C ݴޠؔ਺ͷఀࢭੑݕࠪ·ͱΊ
call permission ͱ͍͏֓೦Λಋೖ
call_perm_ͷଟॏू߹্Ͱ੔ૅؔ܎Λఆٛ͢Δ
ఆٛͨ͠੔ૅؔ܎ʹΑͬͯɺΑΓখ͍͞ call_perm_͸೚ҙͷ਺͚ͩಋ
ग़Ͱ͖Δ

View Slide

C ݴޠؔ਺ͷఀࢭੑݕࠪ·ͱΊ
call permission ͱ͍͏֓೦Λಋೖ
call_perm_ͷଟॏू߹্Ͱ੔ૅؔ܎Λఆٛ͢Δ
ఆٛͨ͠੔ૅؔ܎ʹΑͬͯɺΑΓখ͍͞ call_perm_͸೚ҙͷ਺͚ͩಋ
ग़Ͱ͖Δ
ݕࠪର৅ʹؚ·ΕΔؔ਺ͷதͰɺ࠷େͷؔ਺ΛݺͿ͜ͱ͕ग़དྷΔ
call_perm_Λ༩͑Ε͹ɺଞ͸ͦͷ call_perm_͔Βಋग़͢Ε͹Α͍
ϓϩάϥϜશମΛݕূ͍ͨ͠৔߹͸ main ؔ਺ΛϑΝΠϧ຤ඌʹఆٛ
͠ɺcall_below_perm_(main) Λ࢖͏

View Slide

ύλʔϯผݕࠪํ๏
͜͜·ͰͰ VeriFast ʹΑΔఀࢭੑݕࠪͷ͓͓Αͦͷํ਑ͱཧ࿦తͳഎܠΛ
આ໌͖ͯͨ͠ɻ͜ΕҎ߱Ͱ͸ݕূ͢Δର৅ίʔυͷύλʔϯຖʹɺ஫ऍΛ
෇͚͍ͯ͘ํ๏ͱ࣮ࡍͷίʔυΛղઆ͢Δɻ

View Slide

ύλʔϯͷ෼ྨ
ղઆ͢Δύλʔϯͷ෼ྨ͸ҎԼͷΑ͏ʹ໊લ͕෇͍͍ͯΔ 10
10Jacobs(2015)[1] ͰఏҊ͞Ε͍ͯΔ΋ͷͱಉҰɻ

View Slide

Upcalls Only
ݺͼग़͞ΕΔؔ਺͕ɺશͯͦͷ࣌఺Ͱఆٛ͞Ε͓ͯΓɺ͔ͭ࠶ؼ͍ͯ͠ͳ
͍ύλʔϯɻ
͜ͷ৔߹ؔ਺ݺͼग़͕͠ৗʹࣗ෼ΑΓখ͍ؔ͞਺ͷݺͼग़͠ʹͳΔͨΊɺ
ࣗ໌ʹఀࢭ͢Δͱݴ͑Δɻ

View Slide

Upcalls Only
͜ͷ৔߹͸ࣗಈͰݕࠪͰ͖Δɻ
upcalls_only
void foo(void)
//@ requires emp; //@ ensures emp; //@ terminates;
{}
void bar(void)
{ foo (); }
void bazz(void)
{ bar (); }
͜ͷ৔߹ɺcall_perm_͸ূ໌ίϯςΩετதʹ໌ࣔతʹ͸ݱΕͳ͍ɻ

View Slide

Static Recursion
୯ҰϨΠϠ 11 ಺Ͱ૬ޓ࠶ؼ͍ͯ͠Δ৔߹ɺ͜ΕΛ static recursion ύλʔϯ
ͱݺͿɻ௚઀࠶ؼ͍ͯ͠Δύλʔϯ΋͜Εʹؚ·ΕΔɻ
11ಉҰϑΝΠϧ

View Slide

Static Recursion
యܕతͳྫͱͯ͠૬ޓ࠶ؼͨ͠ۮد൑ఆͷؔ਺Λѻ͏ɻ
bool isOdd (int x)
//@ requires 0 <= x; //@ ensures emp; //@ terminates;
{
if (x == 0)
return false;
return isEven(x -1);
}
bool isEven(int x)
{
if (x == 0)
return true;
return isOdd(x -1);
}

View Slide

Static Recursion
࠶ؼؔ਺Ͱ͸ɺfunc_lt ʹґΔେখؔ܎͕ٯస͢Δؔ਺ݺͼग़͠ 12 Λඞͣ
ؚΉͨΊɺ୯ʹؔ਺ͷେখΛൺֱ͢Δ͚ͩͰ͸ݕࠪͰ͖ͳ͍ɻ
bool isOdd (int x)
{
if (x == 0)
return false;
}
bool isEven(int x)
{
if (x == 0)
return true;
return isOdd(x -1);
}
12ؔ਺ͷݺग़ଆ͕ݺ͹ΕΔଆͷؔ਺ΑΓখ͍͞

View Slide

isEven/isOdd ͷݕূํ਑
isEven, isOdd ͷఀࢭੑΛݕূ͢Δʹ͸ɺͦΕͧΕͷҾ਺͕খ͘͞ͳ͍ͬͯ
͘ (༗ݶճͷݺͼग़͠Ͱ 0 ʹͳΔ) ͱ͍͏৘ใΛ࢖͍͍ͨɻ͜ͷͨΊʹ͸
predicate call_perm_level Λ࢖͏ɻ

View Slide

call_perm_level
call_perm_level ͸ call_perm_ͱɺ੔ૅؔ܎Λ࣋ͭ೚ҙͷܕ͔Βಋग़͞Ε
Δɺมܗͨ͠λϓϧɻ13
call_perms.gh
predicate call_perm_level (
// t ্ͷେখؔ܎ͱ t ܕͷ஋
pair level ,
// ؔ਺ϙΠϯλͷଟॏू߹
list fs;
);
13ؔ਺ؒͷେখؔ܎͸ॲཧܥఆٛͳͷͰෆཁ

View Slide

call_perm_level
σεΫτϥΫτ͢Ε͹ call_perm_͕ಘΒΕΔɻ
call_perms.gh
lemma void consume_call_perm_level_for ( void *f);
requires call_perm_level (? level , ?fs)
&*& mem(f, fs) == true;
ensures call_perm_(f);

View Slide

call_perm_level
DW-Ordering ʹΑΓɺλϓϧͷୈ 1 ཁૉ͕੔ૅؔ܎ͰΑΓখ͍͞஋ΛऔΔ
Α͏ͳ೚ҙݸͷ call_perm_level ʹஔ͖׵͑ͯΑ͍ɻσεΫτϥΫτͷ໋
୊ͱ߹ΘͤΔͱɺcall_perm_Λ૿΍͍ͤͯΔ͜ͱʹ஫ҙɻ
call_perms.gh
lemma void call_perm_level_weaken (
real frac0 , fixpoint(t, t, bool) lt , t level0 ,
list fs0 , real frac1 , t level1 );
requires [_]is_wf(lt) &*& lt(level1 , level0) == true
&*& 1 <= frac0 &*& 1 <= frac1
&*& [frac0]call_perm_level ( pair(lt , level0), fs0);
ensures
[frac1]call_perm_level ( pair(lt , level1), fs0);

View Slide

ࠓճͷྫͷݕূͰ͸ isOdd(খ͍ؔ͞਺) ͔Β isEven(େ͖͍ؔ਺) ΛݺͿ͜
ͱ͕ग़དྷͳ͍ͷ͕໰୊ͩͬͨɻ͜Ε͸ઌʹڍ͛ͨ call_perm_level Λ࢖͏
ͱҎԼͷΑ͏ʹճආग़དྷΔɻ
call_perm_level(pair(lt,x),{isEven}) ͔Β
call_perm_level(pair(lt,x-1),{isEven}) Λಋग़͢Δ
2 ͭ͋Δ call_perm_level ಺ͷҰ͔ͭΒ call_perm_(isEven) Λಋग़͢
Δ (ͱ isEven ΛݺͿ͜ͱ͕ग़དྷΔ)
isOdd ͷࣄલ৚݅Ͱ call_perm_level(pair(lt,x),{isEven}) Λཁٻ
͢Δ

View Slide

ࠓճͷྫͷݕূͰ͸ isOdd(খ͍ؔ͞਺) ͔Β isEven(େ͖͍ؔ਺) ΛݺͿ͜
ͱ͕ग़དྷͳ͍ͷ͕໰୊ͩͬͨɻ͜Ε͸ઌʹڍ͛ͨ call_perm_level Λ࢖͏
ͱҎԼͷΑ͏ʹճආग़དྷΔɻ
isOdd(஫ऍத)
bool isOdd (int x)
/*@ requires 0 <= x
&*& call_perm_level (pair(lt , x), {isEven }); @*/
{
if (0 == x) { return false; } else {
//@ is_wf_lt ();
//@ call_perm_level_weaken (1, lt , x, {isEven}, 2, x -1);
//@ consume_call_perm_level_for (isEven );
}
}
͜ΕͰओཁͳ໰୊͕ย෇͍ͨɻ͋ͱ͸ isOdd ͷࣄલ৚͕݅ຬͨͤΕ͹Α͍ɻ

View Slide

isEven ͷࣄલ৚݅
isOdd ͷࣄલ৚݅Ͱ call_perm_level(pair(lt,x),{isEven}) ͕ཁٻ͞Εͯ
͍Δ͕ɺ͜Ε͸ isEven ͷ࣮૷தʹಋग़͢Δ͜ͱ͸ग़དྷͳ͍ 13ɻ
13ؔ਺ f தͰ͸ɺΑΓখ͍͞ call_below_perm_(f) ͔͠ಋग़ग़དྷͳ͍

View Slide

͍Δ͕ɺ͜Ε͸ isEven ͷ࣮૷தʹಋग़͢Δ͜ͱ͸ग़དྷͳ͍ 13ɻ ͳͷͰɺ
isEven Ͱ΋ࣄલ৚݅ʹಉ͡΋ͷΛཁٻ͢Δɻ

View Slide

͍Δ͕ɺ͜Ε͸ isEven ͷ࣮૷தʹಋग़͢Δ͜ͱ͸ग़དྷͳ͍ 13ɻ
isEven(஫ऍத)
bool isEven(int x)
/*@ requires 0 <= x
{
if (0 == x) { return true; } else {
//@ is_wf_lt ();
//@ call_perm_level_weaken (1, lt , x, {isEven}, 1, x - 1);
return isOdd(x -1);
}
}
isOdd ͱҟͳΓΑΓখ͍ؔ͞਺Λݺͼग़ͨ͢Ίɺcall_perm_level Λ૿΍͢
ඞཁ͸ͳ͍ɻ

View Slide

isEven/isOdd ͷϥούʔ
͜ΕͰ isEven ͱ isOdd ͷఀࢭੑ͕ݕࠪͰ͖͕ͨɺͦΕͧΕͷࣄલ৚݅ʹ͜
Ε·Ͱ͸ඞཁͳ͔ͬͨ call_perm_level Λཁٻ͢ΔΑ͏ͳͬͯ͠·ͬͨɻ
͜Ε͸ isEven ΑΓେ͖͍ؔ਺ͱͯ͠ϥούʔΛఆٛ͢Ε͹؆୯ʹղܾ
͢Δɻ

View Slide

bool isOdd (int x)
/*@ requires 0 <= x
{ ... }
bool isEven(int x) { ... }
bool isOddWrapper (int x) //@ requires 0 <= x;
{
//@ call_below_perm__elim (isOddWrapper );
//@ call_perm_level (1, pair(lt , x), {isEven });
return isOdd(x);
}
bool isEvenWrapper (int x)
{ ... ͱಉ༷isOddWrapper }

View Slide

ϥούʔͷࣄલ৚݅ͱͯ͠ call_perm_level ͕ݱΕ͍ͯͳ͍͜ͱʹ΋஫໨ɻ
ϥούʔΛϔομ͔Βެ։͢Ε͹ɺϢʔβʹͱͬͯ͸ఀࢭੑݕࠪͷͨΊʹ
ࣄલ৚͕݅ෳࡶʹ੒ΒͣʹࡁΉɻ
bool isOddWrapper (int x)
//@ requires 0 <= x;
{
//@ call_below_perm__elim (isOddWrapper );
//@ call_perm_level (1, pair(lt , x), {isEven });
return isOdd(x);
}
bool isEvenWrapper (int x)
{ ... ͱಉ༷isOddWrapper }

View Slide

VeriFast ͷ੍ݶ
ݱঢ়ͷ VeriFast Ͱ͸࣮૷ͷ੍ݶͰ isOdd ͔Β௚઀ isEven ͷݺग़͠͸ग़དྷͳ
͍ɻ͜Ε͸ؔ਺ϙΠϯλΛܦ༝ͨ͠ݺͼग़͠ʹ͢Ε͹ճආग़དྷΔɻ
typedef bool is_even_fn(int x);
/*@ requires 0 <= x
bool isOdd (int x)
/*@ requires 0 <= x
{
if (0 == x) { return false; } else {
is_even_fn * evenp = isEven;
//@ is_wf_lt ();
//@ call_perm_level_weaken (1, lt , x, {isEven}, 2, x -1);
//@ consume_call_perm_level_for (isEven );
return evenp(x -1);
}
}

View Slide

Static Recursion ͷݕূखॱ
͜Ε·ͰͷखॱΛ·ͱΊΔɻ
ࣗ਎Ҏ্ͷؔ਺ͷݺͼग़͠Λؔ਺ϙΠϯλܦ༝ʹ͢Δ (ͨͩ͜͠Ε͸࣮
૷ͷ౎߹)
࠶ؼݺͼग़͠ͷ౓ʹݮগ͢Δύϥϝʔλͱ call_perm_ͷλϓϧ
(call_perm_level) Λ measure ͱ͢Δ
࠶ؼΛߏ੒͢Δશͯͷؔ਺ 14 ͷࣄલ৚݅ʹɺ࠶ؼΛߏ੒͢Δશͯͷؔ
਺ͷதͰ࠷େͷؔ਺ͷ call_perm_level Λ௥Ճ͢Δ
࠶ؼΛߏ੒͢Δؔ਺ΛϔομϑΝΠϧ͔Βެ։͢Δ৔߹͸ɺ͜ΕΛ௚
઀ެ։ͤͣϥούʔΛఏڙ͠ɺ͜ΕΛެ։͢ΔΑ͏ʹ͢Δ (͜ΕʹΑͬ
ͯࣄલ৚͕݅ෳࡶԽͤͣʹࡁΉ)
14͜͜Ͱ͸ isEven ͱ isOdd

View Slide

Dynamic Binding
ಈతʹଋറ͞Εͨؔ਺ݺͼग़͕͠ (Ұൠʹ͸) ૬ޓ࠶ؼ͢Δύλʔϯɻ
ؔ਺ϙΠϯλΛड͚औΓɺ͜ΕΛݺͼग़͢৔߹ɻؔ਺͕౉͞ΕΔͷ͔͸ಈ
తʹܾ·ΔͷͰ࢖༻ଆ (ϙΠϯλΛड͚औΔଆ) ʹ͸໌Β͔Ͱͳ͍ɻ
Java ͷ৔߹͸ந৅Խ͞ΕͨΠϯλʔϑΣʔεΦϒδΣΫτΛड͚औΓɺͦ
ͷެ։͢ΔϝιουΛ࢖༻͢Δ৔߹ʹ૬౰͢Δɻ

View Slide

Dynamic Binding ͷྫ
ྫͱͯ͠ࢀর࿦จதͷɺΦϒδΣΫτͷදࣜ͢ͷඍ෼Λܭࢉ͢ΔྫͷҰ෦
Λ࢖༻͢Δɻ
(pseudo)
interface RealFunc {
float apply(float x);
}
class Math {
static float derivative(RealFunc f, float x)
{ f.apply(x+1) - f.apply(x) }
}
class Identity implements RealFunc {
float apply(float x) { x }
}

View Slide

ΠϯλʔϑΣʔεఆٛ
ҎԼ͸ΠϯλʔϑΣʔεΛද͢ܕͷఆٛΛ͍ࣔͯ͠Δɻ
struct realfunc_obj {
real_func * invoke; // object method
//@ predicate(realfunc_obj *) RealFunc;
};
/*@
predicate realfunc_obj(realfunc_obj * object
, void * invoke
, predicate(realfunc_obj *) p) =
object ->invoke |-> invoke &*&
object ->RealFunc |-> p &*&
[_] is_real_func(invoke , p) &*&
p(object );
@*/

View Slide

ΠϯλʔϑΣʔεఆٛ
ҎԼ͸ΠϯλʔϑΣʔεΛද͢ܕͷఆٛΛ͍ࣔͯ͠Δɻ real_func ͸ύϥ
ϝʔλ෇͖ͷؔ਺ܕɻ
ΦϒδΣΫτϝιουͷγάωνϟ
typedef double
real_func /*@(predicate(realfunc_obj *) RealFunc)@*/
(realfunc_obj * object , double x);
//@ requires realfunc_obj(object , this , RealFunc );
//@ ensures realfunc_obj(object , this , RealFunc );

View Slide

Identity ΦϒδΣΫτͷߏங
realfunc_obj * create_identity (void)
//@ requires emp;
//@ ensures realfunc_obj(result , identity , @identity );
{
realfunc_obj * obj = malloc(sizeof(realfunc_obj ));
if (!obj) abort ();
obj ->invoke = identity;
//@ obj ->RealFunc = @identity;
/*@ produce_function_pointer_chunk real_func
(identity )( @identity )(object , x) { call (); } @*/
//@ close identity(obj);
return obj;
//@ close realfunc_obj(obj , identity , @identity );
}

View Slide

apply ϝιουͷ࣮૷
apply ͷ࣮૷
double realfunc_object_apply (realfunc_obj * obj , double x)
//@ requires realfunc_obj(obj , _, _);
//@ ensures realfunc_obj(obj , _, _);
{
//@ open realfunc_obj(obj , _, _);
real_func * invoke = obj ->invoke;
//@ close realfunc_obj(obj , invoke , _);
return invoke(obj , x);
}

View Slide

Start Termchecking
͜͜·Ͱ͖ࣔͯͨ͠ΦϒδΣΫτΛ࢖༻͢Δؔ਺ͷఀࢭੑΛݕূ͢Δɻ

View Slide

ΠϯόϦΞϯτΛ֦ு
ಉҰΠϯλʔϑΣʔεΛ͍࣋ͬͯͯ΋ΦϒδΣΫτຖʹ࣮૷͕ҟͳΓ͏Δ
ͨΊɺͦͷ call_perm_΋ͦΕͧΕҟͳΔɻ͜ΕΛอ࣋͢ΔͨΊɺΦϒδΣ
ΫτͷΠϯόϦΞϯτΛ֦ு͢Δɻ
struct realfunc_obj {
real_func * invoke; // object method
//@ predicate(realfunc_obj*, list ) RealFunc;
};
/*@
predicate realfunc_obj(realfunc_obj * object
, void * invoke
, predicate(realfunc_obj*, list ) p
, list d) =
object ->invoke |-> invoke &*&
object ->RealFunc |-> p &*&
[_] is_real_func(invoke , p) &*&
p(object , ?d_) &*&
bag_le(func_lt , cons(invoke , d_), d) == true; @*/

View Slide

ΠϯόϦΞϯτΛ֦ு
ݺͿؔ਺Λྻڍग़དྷΔΑ͏ʹ listΛࢦఆɻ͜ͷ૿΍ͨ͠ύϥϝʔλ
ͷ͜ͱΛ dynamic depth ͱݺͿɻ
typedef double
real_func /*@(predicate(realfunc_obj*, list ) p)@*/
(realfunc_obj * object , double x);
/*@ requires [?f]realfunc_obj(object , this , p, ?d)
&*& call_perm(d); @*/
//@ ensures [f] realfunc_obj(object , this , p, d);
//@ terminates;

View Slide

call permission ͷ্ք
֦ுͨ͠ΠϯόϦΞϯτʹ͸ɺग़དྷΔ͚ͩେ͖͍ call permission ͕࢖͑
ΔΑ͏ʹ͍ͨ͠ɻ
ίϯετϥΫλͷؔ਺ (ͷ call_perm) Λ্ݶͱ͢Δ
ݺͼ͍ͨؔ਺Λશͯ௥Ճ͢Δ

View Slide

ίϯετϥΫλͷ permission
Identity ΦϒδΣΫτͷίϯετϥΫλΛҎԼͷΑ͏ʹ֦ு͢Δɻ
realfunc_obj * create_identity (void)
/*@ requires call_perm_below (?d) &*&
func_bag_lt ({ create_identity }, d) == true; @*/
/*@ ensures realfunc_obj(result , identity ,
@identity , { create_identity }); @*/
//@ terminates;
{
//...
}

View Slide

Dynamic Binding ͷݕূखॱ
Dynamic Binding ύλʔϯͷݕূखॱΛ·ͱΊΔɻ
ΦϒδΣΫτͷΠϯόϦΞϯτΛ֦ு͠ɺdynamic depth ͱݺ͹ΕΔؔ
਺ϙΠϯλϦετΛ௥Ճ͢Δ
ग़དྷΔ͚ͩେ͖͍ call_perm Λࢦఆ͢ΔͨΊɺίϯετϥΫτͨؔ͠
਺ࣗ਎ͷ call_perm_Λ্ݶͱͯ͠࢖͏
ΦϒδΣΫτͷؔ਺಺ͰݺͿؔ਺ͷ call_perm_͸શͯ dynamic depth
ʹ join ͢Δ

View Slide

·ͱΊ
͜ͷষͰ͸ҎԼͷ 3 ͭͷύλʔϯʹ͍ͭͯఀࢭੑΛݕࠪ͢Δํ਑ͱ۩ମྫ
Λ͖ࣔͯͨ͠ɻ
ͲͷύλʔϯͰ΋ call_perm ͷେখؔ܎Ͱઆ໌ͱݕূ͕ग़དྷͨɻ

View Slide

ࢀߟࢿྉ
Bart Jacobs, Dragan Bosnacki, Ruurd Kuiper. Modular Termination
Veriﬁcation ECOOP 2015
http://www.cs.kuleuven.be/~bartj/ecoop2015.pdf
VeriFast oﬃcial web site
https://people.cs.kuleuven.be/~bart.jacobs/verifast/
VeriFast Tutorial(೔ຊޠ൛)
https://github.com/jverifast-ug/translate/

View Slide

Appendix
Ԡ༻
ఀࢭੑݕࠪ͸ఀࢭ͢Δ͜ͱҎ֎ͷݕূʹԠ༻ग़དྷΔݟࠐΈ͕͋Δɻ
ฒߦϓϩάϥϜ͕ఀࢭ͢Δͱ͍͏͜ͱ͔Β deadlock free Λূ໌͢Δ
ఀࢭ͠ͳ͍͜ͱΛड़΂Δ͜ͱͰ liveness Λূ໌͢Δ

View Slide

Modular Termination Verification on VeriFast

Modular Termination Verification on VeriFast

eldesh

More Decks by eldesh

Other Decks in Programming

Featured

Transcript