What is the Meaning of These Constant Interruptions? Graham Hutton and Joel Wright University of Nottingham.

What is the Meaning of These Constant Interruptions?

Graham Hutton and Joel WrightUniversity of Nottingham

2

What Is An Exception?

Division by zeroNull pointer

Examples:

An event within a computation that causes termination in a non-

standard way

3

What Is An Interrupt?

An exception that arises from the external environement, e.g. another

computation

TerminateAny exception

Examples:

4

This TalkHaskell is unique in providing both full support

for interrupts and a semantics for this.

But the semantics is subtle, and relies on quite considerable technical machinery.

We give a simple, formally justified, semantics for interrupts in a small language.

5

An Exceptional Language

data Expr = Val Int | Throw | Add Expr Expr | Seq Expr Expr | Catch Expr Expr

Syntax:

Semantics:

e ve can evaluate to

v

6

Sequencing:

Seq x y v

x Val n y v

Seq x y Throw

x Throw

Catch x y Val n

x Val n

Catch x y v

x Throw y v

Catch:

7

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

8

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

Seq x y

9

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

Seq x y

If x produces an exception,

y is not evaluated

10

Seq (Catch x y) y

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

11

Seq (Catch x y) y

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

If x produces an exception, y

may be evaluated twice

12

Seq (Catch x (Seq y Throw)) y

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

13

Seq (Catch x (Seq y Throw)) y

Finally, An Example

Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y?

finally x y

=

Now has the correct

behaviour

14

Adding Interrupts

To avoid the need for concurrency, we adopt the following worst-case rule for interrupts:

x ThrowEvaluation can be interrupted at any time by replacing

the current expression by throw

15

Seq (Catch x (Seq y Throw)) y

Note:

Evaluation is now non-deterministic.

Finally no longer behaves as expected.

could be interrupted as y is about to be

evaluated

16

Controlling Interrupts

data Expr = ••• | Block Expr | Unblock Expr

Syntax:

Semantics:

e i ve can evaluate to

v in interrupt status i

17

Key rules:

Block x i v

x B v

Unblock x i v

x U v

x U Throw

The other rules are simply modified to propogate the current interrupt status to their arguments.

18

Finally Revisited

finally x y

=

Seq (Catch x (Seq y Throw)) y

19

Block (Seq (Catch (Unblock x) (Seq y Throw)) y)

Finally Revisited

finally x y

=

20

Block (Seq (Catch (Unblock x) (Seq y Throw)) y)

Finally Revisited

finally x y

=

Modulo syntax, finally in Haskell is defined in precisely

the same way

21

Is Our Semantics Correct?

How does our high-level semantics reflect our low-level intuition about interrupts?

To address this issue, we first define a virtual machine, its semantics, and a compiler.

We explain the basic ideas informally using an example - the paper gives full details.

22

Catch (Unblock (2+3)) 4

Example

Code

23

Catch (Unblock (2+3)) 4

Example

Code

24

Catch (Unblock (2+3)) 4

Example

MARK [ ]

UNMARK

Code

25

Catch (Unblock (2+3)) 4

Example

MARK [ ]

UNMARK

Code

26

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]

UNMARK

Code

27

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]

UNMARK

Code

28

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]SET U

RESETUNMARK

Code

29

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]SET U

RESETUNMARK

Code

30

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]SET UPUSH 2PUSH 3ADDRESETUNMARK

Code

31

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]SET UPUSH 2PUSH 3ADDRESETUNMARK

Code

Stack

Status

32

Catch (Unblock (2+3)) 4

Example

MARK [PUSH 4]SET UPUSH 2PUSH 3ADDRESETUNMARK

Code

Stack

Status

B

33

Catch (Unblock (2+3)) 4

Example

SET UPUSH 2PUSH 3ADDRESETUNMARK

Code

Stack

HAN [PUSH 4]

Status

B

34

Catch (Unblock (2+3)) 4

Example

PUSH 2PUSH 3ADDRESETUNMARK

Code

Stack

INT BHAN [PUSH 4]

Status

U

35

Catch (Unblock (2+3)) 4

Example

PUSH 3ADDRESETUNMARK

Code

Stack

VAL 2INT BHAN [PUSH 4]

Status

U

36

Catch (Unblock (2+3)) 4

Example

ADDRESETUNMARK

Code

Stack

VAL 3VAL 2INT BHAN [PUSH 4]

Status

U

37

Catch (Unblock (2+3)) 4

Example

ADDRESETUNMARK

Code

Stack

VAL 3VAL 2INT BHAN [PUSH 4]

Status

U

interrupt!

38

Catch (Unblock (2+3)) 4

Example

THROWRESETUNMARK

Code

Stack

VAL 3VAL 2INT BHAN [PUSH 4]

Status

U

interrupt!

39

Catch (Unblock (2+3)) 4

Example

THROWRESETUNMARK

Code

Stack

VAL 2INT BHAN [PUSH 4]

Status

U

40

Catch (Unblock (2+3)) 4

Example

THROWRESETUNMARK

Code

Stack

INT BHAN [PUSH 4]

Status

U

41

Catch (Unblock (2+3)) 4

Example

THROWRESETUNMARK

Code

Stack

HAN [PUSH 4]

Status

B

42

Catch (Unblock (2+3)) 4

Example

PUSH 4

Code

Stack

Status

B

43

Catch (Unblock (2+3)) 4

Example

Code

Stack

VAL 4

Status

B

44

Catch (Unblock (2+3)) 4

Example

Code

Stack

VAL 4

Status

B

Final result

45

Compiler CorrectnessWe will exploit two basic notions of reachability for configurations of our virtual machine.

x can reach everything in

Y

x will reach something in

Y

x * Y

x Y

46

Theorem

{ | e i Val n }

{ | e i Throw }

*

U

Proof: approximately 10 pages of calculation, much of which requires considerable care.

comp e c i s

c i VAL n : s

i s

47

Summary

Simple semantics for interrupts, formally justified by a compiler correctness theorem.

Discovery of an error in the semantics for Haskell, concerning the delivery of interrupts.

Verification of finally, a useful high-level operator for programming with exceptions/interrupts.

48

Further Work

Mechanical verification

Bisimulation theorem

Generalising the language

Reasoning about programs

Calculating the compiler