Definability in Boolean bunched logic

Transcription

1 Definability in Boolean bunched logic James Brotherston Programming Principles, Logic and Verification Group Dept. of Computer Science University College London, UK Logic Summer School, ANU, 11 December / 20

2 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: 2/ 20

3 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: weaker languages cannot capture interesting properties, 2/ 20

4 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: weaker languages cannot capture interesting properties, but richer languages have higher complexity, may lack sensible proof theories and may be unavoidably incomplete (cf. Gödel). 2/ 20

5 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: weaker languages cannot capture interesting properties, but richer languages have higher complexity, may lack sensible proof theories and may be unavoidably incomplete (cf. Gödel). Incompleteness manifests as a gap between two key concepts: 2/ 20

6 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: weaker languages cannot capture interesting properties, but richer languages have higher complexity, may lack sensible proof theories and may be unavoidably incomplete (cf. Gödel). Incompleteness manifests as a gap between two key concepts: provability in some formal system for the logic (which corresponds to validity in some class of models); 2/ 20

7 Introduction In mathematical logic, there is usually a trade-off between expressivity and complexity of a logical language: weaker languages cannot capture interesting properties, but richer languages have higher complexity, may lack sensible proof theories and may be unavoidably incomplete (cf. Gödel). Incompleteness manifests as a gap between two key concepts: provability in some formal system for the logic (which corresponds to validity in some class of models); and validity in a (class of) intended model(s) of the logic. 2/ 20

8 Introduction (contd.) Thus, given a logical language L, and an intended class C of models for that language, there are at least two natural questions: 3/ 20

9 Introduction (contd.) Thus, given a logical language L, and an intended class C of models for that language, there are at least two natural questions: 1. Is the class C finitely axiomatisable, a.k.a. definable in L? 3/ 20

10 Introduction (contd.) Thus, given a logical language L, and an intended class C of models for that language, there are at least two natural questions: 1. Is the class C finitely axiomatisable, a.k.a. definable in L? 2. Is there a complete proof system for L w.r.t. validity in C? 3/ 20

11 Introduction (contd.) Thus, given a logical language L, and an intended class C of models for that language, there are at least two natural questions: 1. Is the class C finitely axiomatisable, a.k.a. definable in L? 2. Is there a complete proof system for L w.r.t. validity in C? In the case of BBI, we are often interested in properties of the heap models used in separation logic. 3/ 20

12 BBI, proof-theoretically Recall: Provability in BBI is given by extending a Hilbert system for propositional classical logic by A B B A A A I A (B C) (A B) C A I A A 1 B 1 A 2 B 2 A 1 A 2 B 1 B 2 A B C A B C A B C A B C 4/ 20

13 BBI, semantically (1) Recall: A BBI-model is given by W,, E, where W is a set (of worlds ), is a binary function W W P(W ); we extend to P(W ) P(W ) P(W ) by def W 1 W 2 = w 1 W 1,w 2 W 2 w 1 w 2 is commutative and associative; the set of units E W satisfies w E = {w} for all w W. A valuation for BBI-model M = W,, E is a function ρ from propositional variables to P(W ). 5/ 20

14 BBI, semantically (2) Given M, ρ, and w W, we define the forcing relation w = ρ A by induction on formula A: w = ρ P w ρ(p ) w = ρ A B w = ρ A implies w = ρ B. w = ρ I w E w = ρ A B w w 1 w 2 and w 1 = ρ A and w 2 = ρ B w = ρ A B w, w W. if w w w and w = ρ A then w = ρ B A is valid in M iff w = ρ A for all ρ and w W. 6/ 20

15 Definable properties A property P of BBI-models is said to be definable if there exists a formula A such that for all BBI-models M, A is valid in M M P. 7/ 20

16 Definable properties A property P of BBI-models is said to be definable if there exists a formula A such that for all BBI-models M, A is valid in M M P. We ll consider properties that feature in various models of separation logic. 7/ 20

17 Definable properties A property P of BBI-models is said to be definable if there exists a formula A such that for all BBI-models M, A is valid in M M P. We ll consider properties that feature in various models of separation logic. To show a property is definable, just exhibit the defining formula! 7/ 20

18 Definable properties A property P of BBI-models is said to be definable if there exists a formula A such that for all BBI-models M, A is valid in M M P. We ll consider properties that feature in various models of separation logic. To show a property is definable, just exhibit the defining formula! To show a property is not definable, we show it is not preserved by some validity-preserving model construction. 7/ 20

19 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; 8/ 20

20 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; 8/ 20

21 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; Single unit: w, w E implies w = w ; 8/ 20

22 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; Single unit: w, w E implies w = w ; Indivisible units: (w w ) E implies w E; 8/ 20

23 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; Single unit: w, w E implies w = w ; Indivisible units: (w w ) E implies w E; Disjointness: w w implies w E; 8/ 20

24 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; Single unit: w, w E implies w = w ; Indivisible units: (w w ) E implies w E; Disjointness: w w implies w E; Divisibility: for every w E there are w 1, w 2 / E such that w w 1 w 2 ; 8/ 20

25 Properties of (some) BBI-models Partial functionality: w, w w 1 w 2 implies w = w ; Cancellativity: (w w 1 ) (w w 2 ) implies w 1 = w 2 ; Single unit: w, w E implies w = w ; Indivisible units: (w w ) E implies w E; Disjointness: w w implies w E; Divisibility: for every w E there are w 1, w 2 / E such that w w 1 w 2 ; Cross-split property: whenever (a b) (c d), there exist ac, ad, bc, bd such that a ac ad, b bc bd, c ac bc and d ad bd. a b c ac bc d ad bd 8/ 20

26 Two definable properties Proposition The following two properties are BBI-definable: Indivisible units: (w w ) E implies w E I (A B) A Divisibility: w E. w 1, w 2 / E such that w w 1 w 2 I I I 9/ 20

27 Disjoint unions of BBI-models Definition If M 1 = W 1, 1, E 1 and M 2 = W 2, 2, E 2 are BBI-models and W 1, W 2 are disjoint then their disjoint union is given by def M 1 M 2 = W 1 W 2, 1 2, E 1 E 2 (where 1 2 is lifted to W 1 W 2 in the obvious way) 10/ 20

28 Disjoint unions of BBI-models Definition If M 1 = W 1, 1, E 1 and M 2 = W 2, 2, E 2 are BBI-models and W 1, W 2 are disjoint then their disjoint union is given by def M 1 M 2 = W 1 W 2, 1 2, E 1 E 2 (where 1 2 is lifted to W 1 W 2 in the obvious way) Proposition If A is valid in M 1 and in M 2, and M 1 M 2 is defined, then it is also valid in M 1 M 2. 10/ 20

29 Disjoint unions of BBI-models Definition If M 1 = W 1, 1, E 1 and M 2 = W 2, 2, E 2 are BBI-models and W 1, W 2 are disjoint then their disjoint union is given by def M 1 M 2 = W 1 W 2, 1 2, E 1 E 2 (where 1 2 is lifted to W 1 W 2 in the obvious way) Proposition If A is valid in M 1 and in M 2, and M 1 M 2 is defined, then it is also valid in M 1 M 2. Proof. Structural induction on A. 10/ 20

30 Undefinability of single-unit property Lemma Suppose that there exist BBI-models M 1 and M 2 such that M 1, M 2 P but M 1 M 2 P. Then P is not BBI-definable. 11/ 20

31 Undefinability of single-unit property Lemma Suppose that there exist BBI-models M 1 and M 2 such that M 1, M 2 P but M 1 M 2 P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M 1 and M 2 but not in M 1 M 2, contradicting previous Proposition. 11/ 20

32 Undefinability of single-unit property Lemma Suppose that there exist BBI-models M 1 and M 2 such that M 1, M 2 P but M 1 M 2 P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M 1 and M 2 but not in M 1 M 2, contradicting previous Proposition. Theorem The single unit property is not BBI-definable. 11/ 20

33 Undefinability of single-unit property Lemma Suppose that there exist BBI-models M 1 and M 2 such that M 1, M 2 P but M 1 M 2 P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M 1 and M 2 but not in M 1 M 2, contradicting previous Proposition. Theorem The single unit property is not BBI-definable. Proof. The disjoint union of any two single-unit BBI-models (e.g. two copies of N under addition) is not a single-unit model, so we are done by the above Lemma. 11/ 20

34 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. 12/ 20

35 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. A bounded morphism from M to M is a function f : W W s.t.: 1. w E iff f(w) E ; 12/ 20

36 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. A bounded morphism from M to M is a function f : W W s.t.: 1. w E iff f(w) E ; 2. w w 1 w 2 implies f(w) f(w 1 ) f(w 2 ); 12/ 20

37 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. A bounded morphism from M to M is a function f : W W s.t.: 1. w E iff f(w) E ; 2. w w 1 w 2 implies f(w) f(w 1 ) f(w 2 ); 3. f(w) w 1 w 2 implies w 1, w 2 W. w w 1 w 2 and f(w 1 ) = w 1 and f(w 2) = w 2 ; 12/ 20

38 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. A bounded morphism from M to M is a function f : W W s.t.: 1. w E iff f(w) E ; 2. w w 1 w 2 implies f(w) f(w 1 ) f(w 2 ); 3. f(w) w 1 w 2 implies w 1, w 2 W. w w 1 w 2 and f(w 1 ) = w 1 and f(w 2) = w 2 ; 4. w 2 f(w) w 1 implies w 1, w 2 W. w 2 w w 1 and f(w 1 ) = w 1 and f(w 2) = w 2. 12/ 20

39 Bounded morphisms on BBI-models Definition Let M = W,, E and M = W,, E be BBI-models. A bounded morphism from M to M is a function f : W W s.t.: 1. w E iff f(w) E ; 2. w w 1 w 2 implies f(w) f(w 1 ) f(w 2 ); 3. f(w) w 1 w 2 implies w 1, w 2 W. w w 1 w 2 and f(w 1 ) = w 1 and f(w 2) = w 2 ; 4. w 2 f(w) w 1 implies w 1, w 2 W. w 2 w w 1 and f(w 1 ) = w 1 and f(w 2) = w 2. Proposition Suppose there is a surjective bounded morphism from M to M. Then any formula valid in M is also valid in M. 12/ 20

40 Undefinability via bounded morphisms Lemma Suppose there are BBI-models M and M s.t. there is a surjective bounded morphism from M to M, and M P while M / P. Then P is not BBI-definable. 13/ 20

41 Undefinability via bounded morphisms Lemma Suppose there are BBI-models M and M s.t. there is a surjective bounded morphism from M to M, and M P while M / P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M but not in M, contradicting previous Proposition. 13/ 20

42 Undefinability via bounded morphisms Lemma Suppose there are BBI-models M and M s.t. there is a surjective bounded morphism from M to M, and M P while M / P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M but not in M, contradicting previous Proposition. Theorem None of the following properties is BBI-definable: (a) partial functionality; (b) cancellativity; (c) disjointness. 13/ 20

43 Undefinability via bounded morphisms Lemma Suppose there are BBI-models M and M s.t. there is a surjective bounded morphism from M to M, and M P while M / P. Then P is not BBI-definable. Proof. If P were definable via A say, then A would be true in M but not in M, contradicting previous Proposition. Theorem None of the following properties is BBI-definable: (a) partial functionality; (b) cancellativity; (c) disjointness. Proof. In each case we build models M and M such that there is a bounded morphism from M to M, but M has the property while M doesn t. 13/ 20

44 Example:partial functionality Define BBI-models M = W,, E and M = W,, E by W = {e, v 1, v 2, x 1, x 2, y, z} E = {e} w e = e w = {w} for all w W x 1 v 1 = v 1 x 1 = {y} x 1 v 2 = v 2 x 1 = {y} x 2 v 1 = v 1 x 2 = {z} x 2 v 2 = v 2 x 2 = {z} 14/ 20

45 Example:partial functionality Define BBI-models M = W,, E and M = W,, E by W = {e, v 1, v 2, x 1, x 2, y, z} E = {e} w e = e w = {w} for all w W x 1 v 1 = v 1 x 1 = {y} x 1 v 2 = v 2 x 1 = {y} x 2 v 1 = v 1 x 2 = {z} x 2 v 2 = v 2 x 2 = {z} W = {e, v, x, y, z} E = {e} w e = e w = {w} for all w W x v = v x = {y, z} 14/ 20

46 Example:partial functionality Define BBI-models M = W,, E and M = W,, E by W = {e, v 1, v 2, x 1, x 2, y, z} E = {e} w e = e w = {w} for all w W x 1 v 1 = v 1 x 1 = {y} x 1 v 2 = v 2 x 1 = {y} x 2 v 1 = v 1 x 2 = {z} x 2 v 2 = v 2 x 2 = {z} W = {e, v, x, y, z} E = {e} w e = e w = {w} for all w W x v = v x = {y, z} Easy to check M, M are both BBI-models, and M is partial functional but M is not. 14/ 20

47 Example:partial functionality Define BBI-models M = W,, E and M = W,, E by W = {e, v 1, v 2, x 1, x 2, y, z} E = {e} w e = e w = {w} for all w W x 1 v 1 = v 1 x 1 = {y} x 1 v 2 = v 2 x 1 = {y} x 2 v 1 = v 1 x 2 = {z} x 2 v 2 = v 2 x 2 = {z} W = {e, v, x, y, z} E = {e} w e = e w = {w} for all w W x v = v x = {y, z} Easy to check M, M are both BBI-models, and M is partial functional but M is not. Our surjective morphism is: f(v 1 ) = f(v 2 ) = v f(x 1 ) = f(x 2 ) = x f(w) = w (w {e, y, z}) 14/ 20

48 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. 15/ 20

49 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. 15/ 20

50 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. HyBBI extends the language of BBI by: any nominal l is a formula, and so is any formula of the l A. 15/ 20

51 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. HyBBI extends the language of BBI by: any nominal l is a formula, and so is any formula of the l A. Valuations interpret nominals as individual worlds in a BBI-model. 15/ 20

52 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. HyBBI extends the language of BBI by: any nominal l is a formula, and so is any formula of the l A. Valuations interpret nominals as individual worlds in a BBI-model. We extend the forcing relation by: M, w = ρ l w = ρ(l) 15/ 20

53 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. HyBBI extends the language of BBI by: any nominal l is a formula, and so is any formula of the l A. Valuations interpret nominals as individual worlds in a BBI-model. We extend the forcing relation by: M, w = ρ l w = ρ(l) M, w = l A M, ρ(l) = ρ A 15/ 20

54 HyBBI: a hybrid extension of BBI So, BBI cannot define some natural properties. Idea: conservatively increase the expressivity of BBI, using machinery of hybrid logic. HyBBI extends the language of BBI by: any nominal l is a formula, and so is any formula of the l A. Valuations interpret nominals as individual worlds in a BBI-model. We extend the forcing relation by: M, w = ρ l w = ρ(l) M, w = l A M, ρ(l) = ρ A Easy to see that HyBBI is a conservative extension of BBI. 15/ 20

55 Definable properties in HyBBI Theorem The following properties are HyBBI-definable: l (j l (j l l 16/ 20

56 Definable properties in HyBBI Theorem The following properties are HyBBI-definable: l (j l (j l l Cancellativity: l j l j k 16/ 20

57 Definable properties in HyBBI Theorem The following properties are HyBBI-definable: l (j l (j l l Cancellativity: l j l j k Single l1 l2 l1 l 2 16/ 20

58 Definable properties in HyBBI Theorem The following properties are HyBBI-definable: l (j l (j l l Cancellativity: l j l j k Single l1 l2 l1 l 2 Disjointness: l l I l 16/ 20

59 Definable properties in HyBBI Theorem The following properties are HyBBI-definable: Proof. Easy verifications! l (j l (j l l Cancellativity: l j l j k Single l1 l2 l1 l 2 Disjointness: l l I l 16/ 20

60 A word about cross-split We have brushed over the cross-split property: (a b) (c d), implies ac, ad, bc, bd with a ac ad, b bc bd, c ac bc, d ad bd. a b c ac bc d ad bd 17/ 20

61 A word about cross-split We have brushed over the cross-split property: (a b) (c d), implies ac, ad, bc, bd with a ac ad, b bc bd, c ac bc, d ad bd. a b c ac bc d ad bd We conjecture this is not definable in BBI or in HyBBI. 17/ 20

62 A word about cross-split We have brushed over the cross-split property: (a b) (c d), implies ac, ad, bc, bd with a ac ad, b bc bd, c ac bc, d ad bd. a b c ac bc d ad bd We conjecture this is not definable in BBI or in HyBBI. If we add the binder to HyBBI, defined by M, w = ρ l. A M, w = ρ[l:=w] A 17/ 20

63 A word about cross-split We have brushed over the cross-split property: (a b) (c d), implies ac, ad, bc, bd with a ac ad, b bc bd, c ac bc, d ad bd. a b c ac bc d ad bd We conjecture this is not definable in BBI or in HyBBI. If we add the binder to HyBBI, defined by M, w = ρ l. A M, w = ρ[l:=w] A then cross-split is definable as the pure formula (a b) (c a ( a ( a (ac b ( b ( b (bc c (ac d (ad bd))))) 17/ 20

64 Statement of completeness We can write down a (quite complex) Hilbert-style proof system for HyBBI by adding rules for the hybrid operators. Soundness is easy, as usual. 18/ 20

65 Statement of completeness We can write down a (quite complex) Hilbert-style proof system for HyBBI by adding rules for the hybrid operators. Soundness is easy, as usual. Following an approach based on a Lindenbaum construction using maximal consistent sets we obtain the following completeness result: 18/ 20

66 Statement of completeness We can write down a (quite complex) Hilbert-style proof system for HyBBI by adding rules for the hybrid operators. Soundness is easy, as usual. Following an approach based on a Lindenbaum construction using maximal consistent sets we obtain the following completeness result: Theorem (Completeness) Let Ax be a set of axioms not containing any propositional variables (nominals are OK). 18/ 20

67 Statement of completeness We can write down a (quite complex) Hilbert-style proof system for HyBBI by adding rules for the hybrid operators. Soundness is easy, as usual. Following an approach based on a Lindenbaum construction using maximal consistent sets we obtain the following completeness result: Theorem (Completeness) Let Ax be a set of axioms not containing any propositional variables (nominals are OK). Suppose that A is valid in the class of BBI-models satisfying Ax. 18/ 20

68 Statement of completeness We can write down a (quite complex) Hilbert-style proof system for HyBBI by adding rules for the hybrid operators. Soundness is easy, as usual. Following an approach based on a Lindenbaum construction using maximal consistent sets we obtain the following completeness result: Theorem (Completeness) Let Ax be a set of axioms not containing any propositional variables (nominals are OK). Suppose that A is valid in the class of BBI-models satisfying Ax. Then A is provable in the Hilbert system for HyBBI, extended with Ax. 18/ 20

69 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. 19/ 20

70 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. 19/ 20

71 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. 19/ 20

72 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. In particular, this yields complete proof systems for previously undefinable classes of BBI-models. 19/ 20

73 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. In particular, this yields complete proof systems for previously undefinable classes of BBI-models. Future work on our hybrid logics could include 19/ 20

74 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. In particular, this yields complete proof systems for previously undefinable classes of BBI-models. Future work on our hybrid logics could include identification of decidable fragments; 19/ 20

75 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. In particular, this yields complete proof systems for previously undefinable classes of BBI-models. Future work on our hybrid logics could include identification of decidable fragments; search for nice structural proof theories; 19/ 20

76 Conclusions and future work BBI is insufficiently expressive to capture important classes of models. We can gain this expressivity by deploying naming machinery from hybrid logic. In HyBBI, we have parametric completeness for any set of axioms expressed as pure formulas. In particular, this yields complete proof systems for previously undefinable classes of BBI-models. Future work on our hybrid logics could include identification of decidable fragments; search for nice structural proof theories; investigate possible applications to program analysis. 19/ 20

77 Further reading J. Brotherston and J. Villard. Parametric completeness for separation theories. In Proc. POPL-41. ACM, P. Blackburn, M. de Rijke and Y. Venema. Modal Logic. Cambridge University Press, Z. Hóu, R. Clouston, R. Goré and A. Tiu. Proof search for propositional abstract separation logics via labelled sequents. In Proc. POPL-41. ACM, D. Larchey-Wendling and D. Galmiche. Exploring the relation between intuitionistic BI and Boolean BI: an unexpected embedding. In Math. Struct. in Comp. Sci., vol. 19. Cambridge University Press, / 20