A relational modal logic for higher-order stateful ADTs

Dreyer, Derek; Neis, Georg; Rossberg, Andreas; Birkedal, Lars

doi:10.1145/1706299.1706323

Cited by 44 publications

(35 citation statements)

References 49 publications

(60 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other end of the spectrum, there has been work on encoding binary logical relations in a concurrent separation logic [13,30,22,21]. These encodings are relying on a base logic that already includes a plethora of high-level concepts, such as weakest preconditions and view shifts.…”

Section: Related Workmentioning

confidence: 99%

The Essence of Higher-Order Concurrent Separation Logic

Krebbers

Jung

Bizjak

et al. 2017

Programming Languages and Systems

Self Cite

102

View full text Add to dashboard Cite

Abstract. Concurrent separation logics (CSLs) have come of age, and with age they have accumulated a great deal of complexity. Previous work on the Iris logic attempted to reduce the complex logical mechanisms of modern CSLs to two orthogonal concepts: partial commutative monoids (PCMs) and invariants. However, the realization of these concepts in Iris still bakes in several complex mechanisms-such as weakest preconditions and mask-changing view shifts-as primitive notions.In this paper, we take the Iris story to its (so to speak) logical conclusion, applying the reductionist methodology of Iris to Iris itself. Specifically, we define a small, resourceful base logic, which distills the essence of Iris: it comprises only the assertion layer of vanilla separation logic, plus a handful of simple modalities. We then show how the much fancier logical mechanisms of Iris-in particular, its entire program specification layer-can be understood as merely derived forms in our base logic. This approach helps to explain the meaning of Iris's program specifications at a much higher level of abstraction than was previously possible. We also show that the step-indexed "later" modality of Iris is an essential source of complexity, in that removing it leads to a logical inconsistency. All our results are fully formalized in the Coq proof assistant. IntroductionIn his paper The Next 700 Separation Logics, Parkinson [26] observed that "separation logic has brought great advances in the world of verification. However, there is a disturbing trend for each new library or concurrency primitive to require a new separation logic." He argued that what is needed is a general logic for concurrent reasoning, into which a variety of useful specifications can be encoded via the abstraction facilities of the logic. "By finding the right core logic," he wrote, "we can concentrate on the difficult problems."The logic he suggested as a potential candidate for such a core concurrency logic was deny-guarantee [12]. Deny-guarantee was indeed groundbreaking in its support for "fictional separation"-the idea that even if threads are concurrently manipulating the same shared piece of physical state, one can view them as operating on logically disjoint pieces of it and use separation logic to reason modularly about those pieces. It was, however, far from the last word on the subject. Rather, 2 Krebbers, Jung, Bizjak, Jourdan, Dreyer, Birkedal it spawned a new breed of logics with ever more powerful fictional-separation mechanisms for reasoning modularly about interference [11,16,29,9,30,27]. Several of these also incorporated support for impredicative invariants [28,18,17,4], which are needed if one aims to verify code in languages with semantically cyclic features (such as ML or Rust, which support higher-order state).Although exciting, the progress in this area has come at a cost: as these new separation logics become ever more expressive, each one accumulates increasingly baroque and bespoke proof rules, which are primitive in the sense that their sou...

show abstract

Section: Related Workmentioning

confidence: 99%

The Essence of Higher-Order Concurrent Separation Logic

Krebbers

Jung

Bizjak

et al. 2017

Programming Languages and Systems

Self Cite

102

View full text Add to dashboard Cite

show abstract

“…We assume a standard one-step relation step : P(Config × Config) on configurations by induction, following the usual presentation of such relations by means of inference rules (see, e.g., the online appendix to [13]). For simplicity, allocation is deterministic: when allocating a new reference cell, we choose the smallest location not already in the store.…”

Section: Operational Semanticsmentioning

confidence: 99%

“…One point of passing from this tripos to the topos S is that it gives us a wider collection of types (variable sets rather than only constant sets), which makes it possible also to have mixed-variance recursively defined types. 3 Dreyer et al developed an extension of LSLR called LADR for reasoning about stepindexed models of the programming language F µ,ref with higher-order store [13]. LADR is a specialized logic where much of the world structure used for reasoning efficiently about local state is hidden by the model of the logic; here we are proposing a general logic that can be used to construct many step-indexed models, including the one used to model LADR.…”

mentioning

confidence: 99%

First steps in synthetic guarded domain theory: step-indexing in the topos of trees

Birkedal¹,

Møgelberg²,

Schwinghammer³

et al. 2012

Logical Methods in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We present the topos S of trees as a model of guarded recursion. We study the internal dependently-typed higher-order logic of S and show that S models two modal operators, on predicates and types, which serve as guards in recursive definitions of terms, predicates, and types. In particular, we show how to solve recursive type equations involving dependent types. We propose that the internal logic of S provides the right setting for the synthetic construction of abstract versions of step-indexed models of programming languages and program logics. As an example, we show how to construct a model of a programming language with higher-order store and recursive types entirely inside the internal logic of S. Moreover, we give an axiomatic categorical treatment of models of synthetic guarded domain theory and prove that, for any complete Heyting algebra A with a wellfounded basis, the topos of sheaves over A forms a model of synthetic guarded domain theory, generalizing the results for S.

show abstract

“…We believe that the work presented here makes an important first step toward logical step-indexed logical relations for effectful programs. Indeed, since publication of our original LICS paper [14], a promising variant/extension of LSLR (called LADR) has been developed [16], which enables abstract relational reasoning about a step-indexed model of F µ! (an extension of F µ with general references).…”

Section: Related Work and Conclusionmentioning

confidence: 99%

Logical Step-Indexed Logical Relations

Dreyer

Ahmed

Birkedal

2011

Logical Methods in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Appel and McAllester's "step-indexed" logical relations have proven to be a simple and effective technique for reasoning about programs in languages with semantically interesting types, such as general recursive types and general reference types. However, proofs using step-indexed models typically involve tedious, error-prone, and proofobscuring step-index arithmetic, so it is important to develop clean, high-level, equational proof principles that avoid mention of step indices.In this paper, we show how to reason about binary step-indexed logical relations in an abstract and elegant way. Specifically, we define a logic LSLR, which is inspired by Plotkin and Abadi's logic for parametricity, but also supports recursively defined relations by means of the modal "later" operator from Appel, Melliès, Richards, and Vouillon's "very modal model" paper. We encode in LSLR a logical relation for reasoning relationally about programs in call-by-value System F extended with general recursive types. Using this logical relation, we derive a set of useful rules with which we can prove contextual equivalence and approximation results without counting steps.

show abstract

A relational modal logic for higher-order stateful ADTs

Cited by 44 publications

References 49 publications

The Essence of Higher-Order Concurrent Separation Logic

The Essence of Higher-Order Concurrent Separation Logic

First steps in synthetic guarded domain theory: step-indexing in the topos of trees

Logical Step-Indexed Logical Relations

Contact Info

Product

Resources

About