Reasoning about Relaxed ProgramsMichael Carbin

Deokhwan Kim, Sasa Misailovic, and Martin Rinard

Research Focus

• Non-Traditional Program Transformation– Program Repair• Eliminate memory leaks• Eliminate memory errors (buffer overflows, segfaults)• Escape from infinite loops

– Accuracy-Aware Program Optimization• Trade accuracy of result for performance

Traditional Program Transformation

Transformation

≡

.c .c

Non-Traditional Program Transformation

≅

Transformation

.c .c

Loop Perforation of Motion Estimation in x264 (Misailovic, etal)

ReferenceFrame

CurrentFrame

?

Loop Perforationint motion_estimation(block_t[] blocks, int n) { int idx = 0, best = INT_MAX, num_iters = 0, i = 0; while (i < n) { int cur = compute_distance(blocks[i]); if (cur < best) { idx = i; best = cur; } num_iters = num_iters + 1;

i = i + 1; } assert (0 <= idx < n); return idx; }

Loop Perforationint motion_estimation(block_t[] blocks, int n) { int idx = 0, best = INT_MAX, num_iters = 0, i = 0; while (i < n) { int cur = compute_distance(blocks[i]); if (cur < best) { idx = i; best = cur; } num_iters = num_iters + 1;

i = i + 2; } assert (0 <= idx < n); return idx; }

Loop Perforationint motion_estimation(block_t[] blocks, int n) { int idx = 0, best = INT_MAX, num_iters = 0, i = 0; while (i < n) { int cur = compute_distance(blocks[i]); if (cur < best) { idx = i; best = cur; } num_iters = num_iters + 1;

i = i + 4; } assert (0 <= idx < n); return idx; }

Quality of Service Profiling

• Automatically explore alternate versionsQoS model

Program

Input(s)

Time Profiler

Subcomputation

Transformation

Quality of Service profiler

timing info performance vs QoS info

TransformationEvaluation

Research Questions

Is it possible to write an implementation and specify flexibility at the same time?

Or write program and later relax its semantics?

What can we say about the correctness of the resulting program?

Loop Perforation Exampleint motion_estimation(block_t[] blocks, int n) { int idx = 0, best = INT_MAX, step = 1, num_iters = 0, i = 0; while (i < n) { int cur = compute_distance(blocks[i]); if (cur < best) { idx = i; best = cur; } num_iters = num_iters + 1; relax (step) st step == 1 || step == 2; i = i + step; } assert (0 <= idx < n); accept (num_iters<o> / 2 <= num_iters<r>); return idx; }

Relaxed Program

• Single Program Text, Two Semantics– One interpretation with the original semantics

(ignore relax statements)– One interpretation with the relaxed semantics

(include relax statements)

Two semantics are related by nondeterministic transformations of the program state:

relax (step) st step == 1 || step == 2;

Relaxed Programming Assertions

• accept (P*)– Relational assertion – relates both semantics.

• assert (P)– Non-relational assertion - holds for individually.

• assume (P)– Non-relational assumption - like admit in Coq.

assert (0 <= idx < n);

Program Semantics Formalization

• Dynamic Semantics – One for original semantics : original execution.– One for relaxed semantics : relaxed execution.

• Axiomatic Semantics for Verification– Variant of Relational Hoare Logic.

Axiomatic Semantics

≅ accept (num_iters<o> / 2 <= num_iters<r>);

Input

Original Execution Relaxed Execution

Verification Guarantees

• Acceptability– An original execution and relaxed execution on the

same input satisfy accept statements.

• Non-interference with assert and assume– Still valid for relaxed executions.

Coq Development

• About 6000 lines of code and proof.• Some automation, but mostly manual.• Coq instructed the proof strategy.– Chose big-step dynamic semantics.– Small-step proofs were very complicated.• More difficult in general, but amplified by Coq.

• Majority of work in relational assertion logic.– Substitution lemmas, etc.

Coq Experience

“Most complicated system I’ve ever seen.”

“Very powerful – you can express anything you want.”

“Difficult to navigate multiple layers of abstractions/automations.”

Conclusion

• Relaxed Programming in Coq– Work in progress (in submission).– Ask me after class if you have more questions.

• Is Coq useful?– A natural discussion if you bring up Coq.– Utility = benefit / cost

Conclusion (cont.)

• A lot of research on lowering costs– Better abstractions– More Automation

• But less research on benefits– Correctness... but, software can always be better.– Is there a system we can build with Coq that is

impossible to build with traditional methods?

The End