# Operational semantics and program verification using many-sorted hybrid modal logic

We propose a general framework to allow: (a) specifying the operational semantics of a programming language; and (b) stating and proving properties about program correctness. Our framework is based on a many-sorted system of hybrid modal logic, for which we prove completeness results. We believe that our approach to program verification improves over the existing approaches within modal logic as (1) it is based on operational semantics which allows for a more natural description of the execution than Hoare's style weakest precondition used by dynamic logic; (2) being multi-sorted, it allows for a clearer encoding of semantics, with a smaller representational distance to its intended meaning.

• 5 publications
• 3 publications
• 5 publications
02/08/2021

### From Matching Logic To Parallel Imperative Language Verification

Program verification is to develop the program's proof system, and to pr...
06/20/2009

### Hybrid Rules with Well-Founded Semantics

A general framework is proposed for integration of rules and external fi...
03/05/2021

### Modal Reasoning = Metric Reasoning, via Lawvere

Graded modal types systems and coeffects are becoming a standard formali...
08/27/2018

### Reversing Parallel Programs with Blocks and Procedures

We show how to reverse a while language extended with blocks, local vari...
05/17/2022

### Local Completeness Logic on Kleene Algebra with Tests

Local Completeness Logic (LCL) has been put forward as a program logic f...
07/26/2022

### Normalization for Fitch-Style Modal Calculi

Fitch-style modal lambda calculi enable programming with necessity modal...
07/23/2020

### Dataflow Analysis With Prophecy and History Variables

Leveraging concepts from state machine refinement proofs, we use prophec...

## 1 Introduction

Program verification within modal logic, as showcased by dynamic logic [14], is following the mainstream axiomatic approach proposed by Hoare/Floyd [10, 16]. In this paper, we continue our work from [17] in exploring the amenability of dynamic logic in particular, and of modal logic in general, to express operational semantics of languages (as axioms), and to make use of such semantics in program verification. Consequently, we consider the SMC Machine described by Plotkin [19], we derive a dynamic logic set of axioms from its proposed transition semantics, and we argue that this set of axioms can be used to derive Hoare-like assertions regarding functional correctness of programs written in the SMC language.

The main idea is to define a general logical system that is powerful enough to represent both the programs and their semantics in a uniform way. With respect to this, we follow the line of [13] and the recent work from [20].

The logical system that we developed as support for our approach is a many-sorted hybrid polyadic modal logic, built upon our general many-sorted polyadic modal logic defined in [17]. We chose a modal setting since, as argued above, through dynamic logic and Hoare logic, modal logic has a long-standing tradition in program verification (see also [8] for a modal logic approach to separation logic [21]) and it is successfully used in specifying and verifying hybrid systems [18].

In [17] we defined a general many-sorted modal logic, generalizing some of the already existing approaches, e.g. [22, 23] (see [17] for more references on many-sorted modal logic). This system allows us to specify a language and its operational semantics and one can use it to certify executions as well. However, both its expressivity and its capability are limited: we were not able to perform symbolic execution and, in particular, we were not able to prove Hoare-style invariant properties for loops. In Remark 2.4, we point out some theoretical aspects related to these issues.

In the present paper we employ the procedure of hybridization on top of our many-sorted modal logic previously defined. We drew our inspiration from [7, 20] for practical aspects, and from the extensive research on hybrid modal logic [1, 6] on the theoretical side.

Our aim was to develop a system that is strong enough to perform all the addressed issues (specification, semantics, verification), but also to keep it as simple as possible from a theoretical point of view. To conclude: in our setting we are able to associate a sound and complete many-sorted hybrid modal logic to a given language such that both operational semantics and program verification can be performed through logical inference.

We have to make a methodological comment: sometimes nominals are presented as another sort of atoms (see, e.g.[6]). Our sorts come from a many-sorted signature , as in [13], so all the formulas (in particular the propositional variables, the state variables, the nominals) are -sorted sets. When we say that the hybrid logic is mono-sorted we use sorted according to our context, i.e. the sets of propositional variables, nominals and state variables are regular sets and not -sets.

We recall our many-sorted modal logic [17] in Section 2. The hybridization is performed in Section 3. A concrete language and its operational semantics are defined in Section 4; we also show how to perform Hoare-style verification. A section on related and future work concludes our paper.

## 2 Preliminaries: a many-sorted modal logic

Our language is determined by a fixed, but arbitrary, many-sorted signature and an -sorted set of propositional variables such that for any and for any in . For any and we denote .

The set of formulas of is an -indexed family inductively defined by:

where , and .

We use the classical definitions of the derived logical connectors: for any the dual operation is

In the sequel, by we mean that is a formula of sort . Similarly, means that is a set of formulas of sort . When the context uniquely determines the sort of a state symbol, we shall omit the subscript.

In order to define the semantics we introduce the -frames and the -models. An -frame is a tuple such that:

• is an -sorted set of worlds and for any ,

• for any .

An -model based on is a pair where such that for any . The model will be simply denoted as .

In the sequel we introduce a many-sorted satisfaction relation. If is an -model, , and is a formula of sort , then the many-sorted satisfaction relation is inductively defined:

• iff

• iff

• iff or

• if , then iff there exists such that and for any .

###### Definition 2.1 (Validity and satisfiability).

Let and assume is a formula of sort . Then is satisfiable if for some model and some . The formula is valid in a model if for any ; in this case we write . The formula is valid in a frame if is valid in all the models based on ; in this case we write . Finally, the formula is valid if is valid in all frames; in this case we write .

The set of theorems of is the least set of formulas that contains all the axioms and it is closed under deduction rules. Note that the set of theorems is obviously closed under -sorted uniform substitution (i.e. propositional variables of sort are uniformly replaced by formulas of the same sort). If is a theorem of sort write . Obviously, is a generalization of the modal system (see [6] for the mono-sorted version).

The distinction between local and global deduction from the mono-sorted setting (see [6]) is deepened in our version: locally, the conclusion and the hypotheses have the same sort, while globally, the set of hypotheses is a many-sorted set. In the sequel we only consider the local setting.

###### Definition 2.2 (Local deduction).

[17] If and is a set of formulas of sort , then we say that is (locally) provable from if there are such that . In this case we write .

The construction of the canonical model is a straightforward generalization of the mono-sorted setting. For more details, we refer to [17]. The last result we recall is the (strong) completeness theorem with respect to the class of all frames.

###### Theorem 2.3.

[17] Let be a set of formulas of set . If is a consistent set in then has a model. Moreover, if is a formula of sort , then iff , where denotes the fact that any model of is also a model of .

###### Remark 2.4 (Problems).

The many-sorted modal logic allows us to define both the syntax and the semantics of a programming language (see [17] for a complex example). However, there are few issues, both theoretical and operational, that we could not overcome:

• the logic can be used to certify executions, but not to perform symbolic verification; in particular, in order to prove the invariant properties for loops, the existential binder is required;

• the completeness theorem for extensions of from [17] only refers to model completeness, but says nothing about frame completeness (see [11] for a general discussion on this distinction);

• the sorts are completely isolated formally, but in our example elements of different sorts have a rich interaction.

These issues will be adressed in the following sections.

## 3 Many-sorted hybrid modal logic

The hybridization of our many-sorted modal logic is developed using a combination of ideas and techniques from [1, 3, 4, 6, 11, 12]. Hybrid logic is defined on top of modal logic by adding nominals, states variables and specific operators and binders.

Nominals allow us to directly refer the worlds (states) of a model, since they are evaluated in singletons in any model. However, a nominal may refer different worlds in different models. In the sequel we introduce the constant nominals, which are evaluated to singletons, but they refer to the same world (state) in all models. Our example for constant nominals are true and false from Section 4.

###### Definition 3.1 (Signature with constant nominals).

A signature with constant nominals is a triple where is a many-sorted signature and is an -sorted set of constant nominal symbols. In the sequel, we denote .

As before, the sorts will be denoted by , , and by , and we will denote some countable -sorted sets. The elements of are ordinary propositional variables and they will be denoted , ,; the elements of are called nominals and they will be denoted by , , ; the elements of are called state variables and they are denoted , , . We shall assume that for any distinct sorts , the corresponding sets of propositional variables, nominals and state variables are distinct. A state symbol is a nominal, a constant nominal or a state variable..

As in the mono-sorted case, nominals and state variables will be semantically constrained: they are evaluated in singleton, which means they will always refer to a unique world of our model. In addition, the constant nominals will refer to the same world(state) in any evaluation, so they will be defined at the frames’ level.

In the mono-sorted setting, starting with a modal logic, the simplest hybrid system is obtained by adding nominals alone. However, the basic hybrid system is obtained by adding the satisfaction modality (which states that is true at the world denoted by the nominal ). The most powerful hybrid systems are obtained by further adding the binders and that bind state variables to worlds, with the expected semantics [1, 2, 4]. The subsequently defined systems and develop the hybrid modal logic in our many-sorted setting.

Note that, whenever the context is clear, we’ll simply write instead of or , and instead of or . We will further assume that the sort of a formula (set of formulas) is implied by a concrete context but, whenever necessary, we will use subscripts to fix the sort of a symbol: means that is a state variable of sort , means that is a set of formulas of sort , etc.

###### Definition 3.2 (Formulas).

For any we define the formulas of sort :
- for : - for :

Here, , , , ,, and . For any , the dual formula is defined as in Section 2. We also define the dual binder : for any , if is a formula of sort and is a state variable of sort , then is a formula of sort . The notions of free state variables and bound state variables are defined as usual.

###### Remark 3.3 (Expressivity).

As a departure from our sources of inspiration, we only defined the satisfaction operators for nominals, and not for state variables. Hence, is not a valid formula in our logic. Our reason was to keep the system as ”simple” as possible, but strong enough to overcome the problems encountered in the non-hybrid setting (see Remarks 2.4). More issues concerning expressivity are analyzed in Section 5.

One important remark is the definition of the satisfaction modalities: if and are a nominal and respectively, a formula of the sort , then we define a family of satisfaction operators such that is a formula of sort for any . This means that is true at the world denoted by on the sort and is acknowledged on any sort . So, our sorted worlds are not isolated anymore, both from a syntactic and a semantic point of view.

###### Definition 3.4.

If then a -frame is where is an -frame and and for any . We will further assume that distinct constant nominals have distinct sorts, so we shall simply write .

###### Definition 3.5 (The satisfaction relation in HΣ(@)).

A (hybrid) model in is a triple

where is an -sorted valuation such that is a singleton for any and . If is an -sorted evaluation, we define by for any and otherwise.

The satisfaction relation for nominals, constant nominals and satisfaction operators is defined as follows:

• if and only if ,

• if and only if where .

Here , , , and is a formula of sort .

Satisfiability and validity in are defined as in Section 2.

In order to define the semantics for more is needed. Given a model , an assignment is an -sorted map . If and are assignment functions and then we say that is an -variant of (and we write ) if for and for any , .

###### Definition 3.6 (The satisfaction relation in HΣ(@,∀)).

In the sequel

is a model and an -sorted assignment. The satisfaction relation is defined as follows:

• , if and only if , where ,

• , if and only if , where ,

• , if and only if

• , if and only if or

• if then , if and only if there is
such that and for any ,

• if and only if where , has the sort and ,

• , if and only if for all .

Consequently,

• , if and only if .

Following the mono-sorted setting, satisfiability in is defined as follows: a formula of sort is satisfiable if for some model , some assignment and some . Consequently, the formula is valid in a model if for any assignment and any . One can speak about validity in a frame as in Section 2.

In the presence of nominals, we can speak about named models and pure formulas, as in [6][Section 7.3].

###### Definition 3.7 (Named models and pure formulas).

A formula is pure if it does not contain propositional variables. A pure instance of a formula is obtained by is obtained by uniformly substituting nominals for nominals of the same sort. A model is named if for any sort and world there exists such that .

As in the mono-sorted case, pure formulas and named models are important since they give rise to strong completeness results with respect to the class of frames they define.

###### Proposition 3.8 (Pure formulas in HΣ(@)).

Let be a named model, the corresponding frame and a pure formula of sort . Then if and only if for any that is a pure instance of .

###### Proof.

Let be a pure formula of sort and suppose . Then there exist a valuation and some state in the model such that .

On each sort we will notate all the nominals occurring in . But because we are working in a named model, labels every state of any sort in with a nominal of the same sort. Hence, on each sort there exist nominals such that , ,. Therefore, if and is obtained by substituting on each sort each nominal with the corresponding one , then .

But is a pure formula, and by substituting the nominals contained in the formula with other nominals of the same sort, the new instance it is also a pure formulas like . Therefore, by hypothesis, we have for any . But also , hence , and we have a contradiction. ∎

Can we prove a similar result for the system ? We give a positive answer to this question, inspired by the discussion on existential saturation rules from [3][Lemma 1]. In order to do this, we define the -pure formulas and we characterize frame satisfiability for such formulas. As consequence, Propositions 3.8 and 3.11 will lead to completeness results with respect to frame validity.

###### Definition 3.9.

In , we say that a formula is -pure if it is pure or it has the form , where contains no propositional variables and the only state symbols from are in .

###### Proposition 3.10 (Pure formulas in HΣ(@,∀)).

Let be a named model where , the corresponding frame and a -pure formula of sort . Then if and only if .

###### Proposition 3.11 (Pure formulas in HΣ(@,∀)).

Let be a named model where , the corresponding frame and a -pure formula of sort . Then if and only if .

###### Proof.

Suppose where do not occur in . Hence, for any and any of sort , where do not occur in . So, for any assignment exists an assignment such that . Let and for any . Because we work with named model, there exist nominals and such that and for any . Therefore, we get for any exist such that . But now we have a pure formula and the assignment function will not affect the satisfiability of the formula. Therefore, for any exist such that . Therefore, for any assignment and any of sort we have that for any there exist such that . We use the contrapositive of axiom to get that and by Lemma 3.14 we get that for any assignment and any of sort we have that if and only if

We are ready now to define the deductive systems of our logics. The deductive systems for and are presented in Figure 2.

In the sequel, our main focus is on the more expressive system . The properties and the proofs for follow easily from their equivalent in the richer setting.

Theorems and (local) deduction from hypothesis are defined as in Section 2. In order to further develop our framework, we need to analyze the uniform substitutions. Apart for being -sorted, in the hybrid setting, more restrictions are required: state variables are uniformly replaced by state symbols that are substitutable for them (as in the mono-sorted setting [4]). Nominals and constant nominals are always substitutable for state variables of the same sort. If and are state variables of the sort , then we define:

• if , then is substitutable for in ,

• is substitutable for in iff is substitutable for in ,

• is substitutable for in iff is substitutable for in and ,

• is substitutable for in iff is substitutable for in for all ,

• is substitutable for in iff is substitutable for in ,

• is substitutable for in iff does not occur free in , or and is substitutable for in .

In the sequel, we will say that a substitution is legal if it perform only allowed replacements. If is a formula and is a state variable we denote by the formula obtained by substituting for all free occurrences of in ( must be a nominal, a constant nominal or a state variable substitutable for ).

###### Lemma 3.12 (Agreement Lemma).

Let be a standard model. For all standard -assignments and , all states in and all formulas of sort , if and agree on all state variables occurring freely in , then:

 M,g,w|\joinrels=ϕ iff M,h,w|\joinrels=ϕ
###### Proof.

We suppose that and agree on all state variables occurring freely in on each sort. We prove this lemma by induction on the complexity of :

• iff we have iff .

• iff we have , but , therefore .

• iff . But, if and agree on all state variables occurring freely in , then same for . Therefore, from the induction hypothesis, iff . Then