Local Reasoning for Global Graph Properties

Abstract

Separation logics are widely used for verifying programs that manipulate complex heap-based data structures. These logics build on so-called separation algebras, which allow expressing properties of heap regions such that modifications to a region do not invalidate properties stated about the remainder of the heap. This concept is key to enabling modular reasoning and also extends to concurrency. While heaps are naturally related to mathematical graphs, many ubiquitous graph properties are non-local in character, such as reachability between nodes, path lengths, acyclicity and other structural invariants, as well as data invariants which combine with these notions. Reasoning modularly about such graph properties remains notoriously difficult, since a local modification can have side-effects on a global property that cannot be easily confined to a small region. In this paper, we address the question: What separation algebra can be used to avoid proof arguments reverting back to tedious global reasoning in such cases? To this end, we consider a general class of global graph properties expressed as fixpoints of algebraic equations over graphs. We present mathematical foundations for reasoning about this class of properties, imposing minimal requirements on the underlying theory that allow us to define a suitable separation algebra. Building on this theory we develop a general proof technique for modular reasoning about global graph properties over program heaps, in a way which can be integrated with existing separation logics. To demonstrate our approach, we present local proofs for two challenging examples: a priority inheritance protocol and the non-blocking concurrent Harris list. S. Krishna et al. 1 method acquire(p: Node, r: Node) { 2 if (r.next == null) { 3 r.next := p; update(p, -1, r.curr_prio) 4 } else { 5 p.next := r; update(r, -1, p.curr_prio) 6 } 7 } 8 method update(n: Node, from: Int, to: Int) { 9 n.prios := n.prios \ {from} 10 if (to >= 0) n.prios := n.prios ∪ {to} 11 from := n.curr_prio 12 n.curr_prio := max(n.prios ∪ {n.def_prio}) 13 to := n.curr_prio; 14 if (from != to && n.next != null) { 15 update(n.next, from, to) 16 } 17 }

Fact-driven Logical Reasoning

“…Logical Reasoning in MRC There are two main kinds of features in language data that would be the necessary basis for logical reasoning: 1) knowledge: global facts that keep consistency regardless of the context, such as commonsense, mostly derived from named entities; 2) non-knowledge: local facts or events that may be sensitive to the context, mostly derived from linguistics. Existing works have made progress in improving logical reasoning ability [4,5,6,7,8,30], however, these approaches are barely satisfactory as they mostly focus on the global facts such as typical entity or sentence-level relations and use ad-hoc graphs to model them, which are obviously not sufficient. In this work, we strengthen the basis for logical reasoning by unifying both types of the features as facts.…”

“…pre-training. An increasing interest is using graph networks to model the entity-aware relationships in the passages [4,5,6,7]. However, these methods only consider global knowledge components that are related to entity-aware commonsense, without local perception of complete facts or events.…”

Verifying concurrent multicopy search structures

“…A straightforward attempt to prove that a template algorithm preserves Invariant 2 would thus need to reason about the entire graph after every modification (for example, by performing an explicit induction over the full graph). We solve this challenge using the flow framework [Krishna et al 2020b].…”

“…Technically, this kind of reasoning is enabled by the separation algebra structure of flow graphs (in particular the definition of flow graph composition), which extends the composition of partial graphs in standard separation logic so that the frame rule also preserves flow values of nodes in the frame. Instead of performing an explicit induction over the entire graph structure to prove that contents-in-reach values continue to satisfy desired invariants, the necessary induction is hidden away inside the definition of flow graph composition (for more details see [Krishna et al 2020b]). Note that since search does not modify the multicopy structure, it trivially maintains the flow interface of the nodes it operates on, and hence any flow-based invariants.…”

“…We have mechanized both the proof relating client-level and template-level specifications as well as the verification of our template algorithms in the Coq-based interactive proof mode of the concurrent separation logic Iris Krebbers et al , 2017. Similar to [Krishna et al 2020a], our formalization uses the flow framework [Krishna et al 2018[Krishna et al , 2020b to enable local reasoning about inductive invariants of a general multicopy structure graph. In order to obtain a concrete multicopy structure, we have instantiated the node-level operations assumed by the LSM template for the LSM tree and verified their implementations in the automated separation logic verifier GRASShopper [Piskac et al 2014] (ğ8).…”