## Program Logics for Sequential Higher-Order Control

Citations: | 5 - 3 self |

### BibTeX

@MISC{Berger_programlogics,

author = {Martin Berger},

title = {Program Logics for Sequential Higher-Order Control },

year = {}

}

### OpenURL

### Abstract

We introduce a Hoare logic for higher-order functional languages with control operators such as callcc. The key idea is to build the assertion language and proof rules on the basis of types that generalise the standard types for control operators (for ’jumping-to’) with dual types (for ’being-jumped-to’). This enables the assertion language to capture precisely the intensional and extensional effects of jumps by internalising rely/guarantee reasoning, leading to simple proof rules for call-by-value PCF with callcc and/or name-abstraction. All new operators come with powerful associated axioms. We show that the logic allows specification and reasoning about non-trivial examples of using callcc. The logic matches exactly with the operational semantics of the target language (observational completeness), is relatively complete in Cook’s sense and allows efficient generation of characteristic formulae.

### Citations

760 |
Types and Programming Languages
- Pierce
- 2002
(Show Context)
Citation Context ...ve types follow this pattern. Polymorphic types can also be included [16, 5]. α ::= ... | List(α) M ::= ε | M::N | case M of {ε⊲N | x::y⊲N ′ } The new constructs have the expected types and behaviour =-=[27]-=-. The logical expressions need two new syntactic forms. e ::= ... | nil | e::e ′ Here nil has type List(α) and if Γ ⊢ e : α and Γ ⊢ e : List(α) then Γ ⊢ e::e ′ : List(α). We have two new rules of infe... |

340 |
Lambda-mu-calculus: An algorithmic interpretation of classical natural deduction
- Parigot
- 1992
(Show Context)
Citation Context ...F can be done easily with the help of content quantification [16]. Related Work. The present work builds upon a large body of preceding work on the semantics of control, including, but not limited to =-=[12, 21, 22, 29, 26, 25, 17, 28]-=-. As mentioned, the investigation of logics for control manipulation was started by Clint and Hoare [11]. It has been revived by [2, 3, 4, 8, 24, 30, 33], see [5] for a more comprehensive discussion. ... |

218 |
On Full Abstraction for PCF
- Hyland, Ong
- 2000
(Show Context)
Citation Context ...of the corresponding rule in [16], but forwarding all jumps to the recursion variable g directly to the recursive function at a. This forwarding corresponds to “copy-cat strategies” in game-semantics =-=[1, 19]-=-, here realising the feedback loop of jumps to f into a that enables recursion by using tensor. The forwarder formula fwxy ⊢ x : ( ˜α) !,y : ( ˜α) ? def is given by fwxy = x( ˜v)y〈 ˜v〉. [REC] implies ... |

205 | Full abstraction for PCF
- Abramsky, Jagadeesan, et al.
(Show Context)
Citation Context ...of the corresponding rule in [16], but forwarding all jumps to the recursion variable g directly to the recursive function at a. This forwarding corresponds to “copy-cat strategies” in game-semantics =-=[1, 19]-=-, here realising the feedback loop of jumps to f into a that enables recursion by using tensor. The forwarder formula fwxy ⊢ x : ( ˜α) !,y : ( ˜α) ? def is given by fwxy = x( ˜v)y〈 ˜v〉. [REC] implies ... |

174 |
Specification and design of (parallel) programs
- Jones
- 1983
(Show Context)
Citation Context ... type and all ξ ′ that agree with ξ on shared variables, such that (ξ ′ ,Q) |= A we have: P|Q ⇓ R and (ξ ∪ ξ ′ ,R) |= B. The construction shows that rely/guarantee corresponds to parallel composition =-=[15]-=-. By straightforward induction we prove the following [4]. Theorem 2. All axioms and rules are sound. Descriptive Completeness. It desirable for a language that its axiomatic and operational descripti... |

169 | Anytime, anywhere: Modal logics for mobile ambients
- Cardelli, Gordon
- 2000
(Show Context)
Citation Context ...oning was introduced in [20]. Internalising rely/guarantee reasoning into the program logic itself by way of rely/guarantee formulae was first proposed in [31, 32] and has been used in Ambient Logics =-=[10]-=- and in expressive typing systems [9]. The use of tensor is also found in [31, 32], and has been advocated by Winskel [35]. In all cases the context is concurrency, not sequential control. A prelimina... |

80 | A Uniform Type Structure for Secure Information Flow
- Honda, Yoshida
- 2002
(Show Context)
Citation Context ... are those for the logic. Modes, ranged over by φ,φ ′ ,..., are O and I. Typing judgements are of the form ⊢φ P⊲A. Here A maps free names in P to types. The typing rules are those of [13], but affine =-=[11]-=-. A process ⊢φ P ⊲ A is semi-closed is x ∈ fn(P) implies md(A(x)) =?. We write → for the transitive closure of ≡ ∪ ↘. P is a value if P → Q implies P ≡ Q, in this case we write P ⇓ Q. We write ∼ = for... |

80 | A Curry-Howard foundation for functional computation with control
- Ong, Stewart
- 1997
(Show Context)
Citation Context ...nt rules for PCF + . Finally we give an axiomatisation for the logic. This logic will be used to axiomatise the semantics of PCF + and extensions of PCF with the jumping constructs of the λµ-calculus =-=[18]-=-. Types of the logic are given by the following grammar. α ::= N | B | Unit | X | µX.α | ( ˜α) ? | ( ˜α) ! Note that we remove function spaces form the PCF + types and add a being-jumpedto type. A typ... |

57 |
Certified assembly programming with embedded code pointers
- Ni, Shao
- 2006
(Show Context)
Citation Context ...ulation starts with [11], where a simple, imperative firstorder low-level language with goto is investigated. Recently, this research tradition was revived by a sequence of works on similar languages =-=[2, 3, 4, 8, 24, 30, 33]-=-. None of those investigates the interplay between advanced control constructs and higher-order features. The present paper fills this gap and proposes a logic for ML-like functional languages with ad... |

39 | An observationally complete program logic for imperative higher-order functions
- Honda, Yoshida, et al.
- 2005
(Show Context)
Citation Context ...tem. We believe that a slight generalisation of the logic presented here can easily account for exceptions. Related Work. The present work adds a new member to a family of logics for MLlike languages =-=[5, 12, 14, 22]-=-, and integrates in a strong sense: e.g. all rules and axioms from [12] are, adapting the syntax, also valid for PCF + and µPCF. Moreover, thesProgram Logics for Sequential Higher-Order Control 15 CPS... |

36 | A compositional logic for control flow - TAN, APPEL - 2006 |

32 |
Program proving: jumps and functions
- Hoare
- 1972
(Show Context)
Citation Context ... program logics at other levels of abstraction. Unfortunately, satisfactory axiomatic semantics of control manipulation have been put forward only for simple jumps in first-order imperative languages =-=[7]-=-. A reason for this omission maybe that program logics are traditionally based on abstracting behaviour into input/output relations. This is a powerful abstraction for simple languages but does not ca... |

32 | A semantic analysis of control
- Laird
- 1999
(Show Context)
Citation Context ...f ≡ ∪ ↘. P is a value if P → Q implies P ≡ Q, in this case we write P ⇓ Q. We write ∼ = for the canonical typed congruence. We can use this calculus to give fully abstract encodings of PCF + and µPCF =-=[13, 16]-=-. Translation is straightforward and we show some key cases. def def [[λx.M]]u = u(a)!a(xm).[[M]]m [[callcc ]]u = u(a)!a(xm).x〈mm〉 def [[throw M N]]u = (νm)([[M]]m|!m(a).(νn)([[N]]n|!n(b).a〈b〉))sProgr... |

30 | Control in the π-calculus
- Honda, Yoshida, et al.
- 2004
(Show Context)
Citation Context ...ere. Moreover, π-calculus semantics for sequential languages with non-trivial control is substantially simpler and less ad-hoc than the original operational semantics, especially for λµ-style jumping =-=[13]-=-. In addition, (typed) labelled transitions are a powerful reasoning tool for π-calculus processes that currently has no match in the world of sequential control. A further reason is that the types us... |

29 | A logic for bytecode
- Bannwart, Müller
- 2005
(Show Context)
Citation Context ...ault port instead. Hence we can specify not only values returning at the default port but also those that do not. The assertion above about throw k 5 can be used to infer {T} 3 + throw k 5 :u {k〈5〉}. =-=(2)-=- Using the rules in [12] for functional abstraction, easily adapted, we infer from (2): {T} λk.3 + throw k 5 :m {m(b)∀ku.b • 〈ku〉k〈5〉}. (3) Here x( ˜y)A is short for ∃ ˜y.(x〈 ˜y〉∧A). Hence (3) says: t... |

27 | A compositional logic for polymorphic higher-order functions
- Honda, Yoshida
- 2004
(Show Context)
Citation Context ...tor which says that a program jumps to x carrying values ˜e. This formula is dual to the evaluation formulae x • 〈 ˜e〉A which mean: jumps to x carrying values ˜e lead to a program state where A holds =-=[12]-=-. The special case where ˜e contains a return address r and A specifies jumps to r only, recovers input/output behaviour. This duality between jumping and beingjumped-to is made precise with types. We... |

22 | A typed, compositional logic for a stack-based abstract machine
- Benton
- 2005
(Show Context)
Citation Context ... throw k 5 can be used to infer {T} 3 + throw k 5 :u {k〈5〉}. (2) Using the rules in [12] for functional abstraction, easily adapted, we infer from (2): {T} λk.3 + throw k 5 :m {m(b)∀ku.b • 〈ku〉k〈5〉}. =-=(3)-=- Here x( ˜y)A is short for ∃ ˜y.(x〈 ˜y〉∧A). Hence (3) says: the program returns a value named b at the default port m. This value, every time it is jumped to with one argument named k, has default por... |

19 | A program logic for resource verification
- Aspinall, Beringer, et al.
(Show Context)
Citation Context ...ve. From now on we assume all occurring programs to be well-typed. Informal Explanation of Our Approach. To understand callcc and throw, consider a typical program: M def = callcc λk.(3 + throw k 5). =-=(1)-=- Here callcc captures the current continuation, the code that is passed the result of evaluating the argument to callcc ; throw takes two arguments, jumping to the first of those, carrying the second ... |

19 | When is a functional program not a functional program
- Longley
- 1999
(Show Context)
Citation Context ...F can be done easily with the help of content quantification [16]. Related Work. The present work builds upon a large body of preceding work on the semantics of control, including, but not limited to =-=[12, 21, 22, 29, 26, 25, 17, 28]-=-. As mentioned, the investigation of logics for control manipulation was started by Clint and Hoare [11]. It has been revived by [2, 3, 4, 8, 24, 30, 33], see [5] for a more comprehensive discussion. ... |

18 | Descriptive and relative completeness of logics for higher-order functions
- Honda, Berger, et al.
- 2006
(Show Context)
Citation Context ...mply substitutes k, the continuation to be used next, for V ’s default port. We know that V converges at its default port because it is a value. Finally [APP] follows that treatment of application in =-=[10]-=- by essentially requiring in the precondition the effect to be achieved by application. This is possible because the function f and its argument x are both variables about which we cannot infer anythi... |

15 | A compositional natural semantics and Hoare logic for low-level languages, Theor - Saabas, Uustalu |

13 | Logical reasoning for higher-order functions with local state
- YOSHIDA, HONDA, et al.
- 2008
(Show Context)
Citation Context ...tem. We believe that a slight generalisation of the logic presented here can easily account for exceptions. Related Work. The present work adds a new member to a family of logics for MLlike languages =-=[5, 12, 14, 22]-=-, and integrates in a strong sense: e.g. all rules and axioms from [12] are, adapting the syntax, also valid for PCF + and µPCF. Moreover, thesProgram Logics for Sequential Higher-Order Control 15 CPS... |

13 | Spatial-behavioral types, distributed services, and resources
- Caires
(Show Context)
Citation Context ...ising rely/guarantee reasoning into the program logic itself by way of rely/guarantee formulae was first proposed in [31, 32] and has been used in Ambient Logics [10] and in expressive typing systems =-=[9]-=-. The use of tensor is also found in [31, 32], and has been advocated by Winskel [35]. In all cases the context is concurrency, not sequential control. A preliminary version of the present work was fi... |

13 | Logical full abstraction and PCF
- Longley, Plotkin
(Show Context)
Citation Context ... rules and axioms from [16] are, adapting the syntax, also valid for PCF + and µPCF. We believe that all common CPS-transforms between PCF, PCF + and µPCF are logically fully abstract in the sense of =-=[23]-=-. This coherence between programming languages, their operational and axiomatic semantics, and compilations between each other paves the way for a comprehensive proofcompilation infrastructure for ML-... |

9 |
A logical analysis of aliasing for higher-order imperative functions
- Berger, Honda, et al.
- 2005
(Show Context)
Citation Context ...onds exactly to that of callcc N. To see the rule in action, let us return to M from (1) above, and reason as follows. 1 {T} λk.3 + throw k 5 :m {m(a)a(km)k〈5〉} 2 {T} λk.3 + throw k 5 :m {{m(a)a〈uu〉}u=-=(5)-=-} XCHANGE, 1 3 {T} M :m {u〈5〉} Rule (4) above, 2 Assuming that inference (2) is valid, rule (4) gives the expected result. The key idea behind inference (2) is simple: If a program makes a jump x (for... |

8 | Typed exceptions and continuations cannot macro-express each other
- Riecke, Thielecke
- 1999
(Show Context)
Citation Context ...l-known example [9] of such behaviour is argfc def = callcc λk.(throw k λx.(throw k λy.x)).s10 Martin Berger This function distinguishes λ-terms that would be equated in the absence of continuations. =-=[19]-=- shows that (λx.(x1);(x2)) argfc = 1 and (λxy.(x1);(y2)) argfc argfc = 2. Our logic can easily specify and reason about such advanced continuation usage and we now show that: {T} (λx.(x1);(x2)) argfc ... |

7 | Completeness and Logical Full Abstraction in Modal Logics for Typed Mobile Processes
- Berger, Yoshida, et al.
- 2008
(Show Context)
Citation Context ...A preliminary version of the present work was finished in 2007, and its key ideas, in particular rely/guarantee formulae and the tensor have since lead to a Hennessy-Milner logic for typed π-calculus =-=[7]-=-. Neither proof-rules nor axioms for higher-order control are investigated in [7]. Clarifying the relationship between the present logic and that of [7] is an interesting research question. References... |

6 |
A bytecode logic for JML and types
- Beringer, Hofmann
- 2006
(Show Context)
Citation Context ... using rely/guarantee formulae is vital for this style for reasoning. The implication (5) generalises to value-passing jumps, free or bound. x( ˜y)A ⊃ {x( ˜y){A}B}∃ ˜y.B x〈 ˜e〉 ⊃ {x( ˜v)A}A[ ˜e/ ˜v]. =-=(6)-=- Applying this to the postcondition of Line 1 in the inference above we get m(a)a(km)k〈5〉 � �� � A Now we apply the same reasoning to a〈uu〉. ⊃ {m(a){A}u〈5〉}u〈5〉. (7) a〈uu〉 ⊃ {a(km)k〈5〉}u〈5〉 (8)sProgra... |

3 |
Operational interpretations of an extension of Fω with control operators
- Harper, Lillibridge
- 1996
(Show Context)
Citation Context ...xy]} M[z/xy] :m {B[z/xy]} One peculiarity of continuations that sets them apart form other control constructs like goto is that the can be used non-linearly, i.e. more than once. A well-known example =-=[9]-=- of such behaviour is argfc def = callcc λk.(throw k λx.(throw k λy.x)).s10 Martin Berger This function distinguishes λ-terms that would be equated in the absence of continuations. [19] shows that (λx... |

1 | Processes and games
- Honda
(Show Context)
Citation Context ...he typed processes that interpret PCF + or λµ-programs are up to bisimilarity exactly the morphisms (strategies) in the control categories [21] that give fully abstractmodels to PCF + or λµ-calculus =-=[14]-=-. Hence the present choice of model gives a direct link with game-based analysis of control. Processes. The grammar below defines Processes, with expressions e as above, cf. [17] for details. P ::= 0 ... |

1 |
the λ-Calculus. TCS, Γ,x : α ⊢ x : α VAR Γ,x : α ⊢ M : β Γ ⊢ λx α .M : α → β ABS Γ ⊢ M : B Γ ⊢ Ni : α i = 1,2 Γ ⊢ if M then N1 else N2 : α IF Γ ⊢ Mi : αi Γ ⊢ inj α1+α2 i (Mi
- Call-By-Name
(Show Context)
Citation Context ...F can be done easily with the help of content quantification [16]. Related Work. The present work builds upon a large body of preceding work on the semantics of control, including, but not limited to =-=[12, 21, 22, 29, 26, 25, 17, 28]-=-. As mentioned, the investigation of logics for control manipulation was started by Clint and Hoare [11]. It has been revived by [2, 3, 4, 8, 24, 30, 33], see [5] for a more comprehensive discussion. ... |