Hyper Hoare Logic: (Dis-)Proving Program Hyperproperties (extended version)

Abstract

Hoare logics are proof systems that allow one to formally establish properties of computer programs. Traditional Hoare logics prove properties of individual program executions (so-called trace properties, such as functional correctness). On the one hand, Hoare logic has been generalized to prove properties of multiple executions of a program (so-called hyperproperties, such as determinism or non-interference). These program logics prove the absence of (bad combinations of) executions. On the other hand, program logics similar to Hoare logic have been proposed to disprove program properties (e.g., Incorrectness Logic), by proving the existence of (bad combinations of) executions. All of these logics have in common that they specify program properties using assertions over a fixed number of states, for instance, a single pre-and post-state for functional properties or pairs of pre-and post-states for non-interference.In this paper, we present Hyper Hoare Logic, a generalization of Hoare logic that lifts assertions to properties of arbitrary sets of states. The resulting logic is simple yet expressive: its judgments can express arbitrary trace-and hyperproperties over the terminating executions of a program. By allowing assertions to reason about sets of states, Hyper Hoare Logic can reason about both the absence and the existence of (combinations of) executions, and, thereby, supports both proving and disproving program (hyper-)properties within the same logic. In fact, we prove that Hyper Hoare Logic subsumes the properties handled by numerous existing correctness and incorrectness logics, and can express hyperproperties that no existing Hoare logic can. We also prove that Hyper Hoare Logic is sound and complete. All our technical results have been proved in Isabelle/HOL.

Outcome Logic: A Unifying Foundation for Correctness and Incorrectness Reasoning

“…Since our paper was conditionally accepted to OOPSLA, a closely related paper has appeared on arXiv, which presents a program logic, called Hyper Hoare Logic, for proving and disproving program hyper-properties (properties relating multiple program traces) [Dardinier and Müller 2023]. It achieves this using the same underlying semantics as Outcome Logic instantiated to the powerset monad.…”

Relational Adversarial Logic

“…Recently, a number of new program logics have been defined to reason about correctness and incorrectness within a unified framework. Outcome logic [20] (OL) and Hyper-Hoare Logic [21] (HHL) allow to express verification conditions as well as incorrectness conditions through refutation of specifications. HHL is designed to verify hyper-properties, unlike OL which currently has no such application.…”

Calculational design of a regular model checker by abstract interpretation

“…This design method has perdured over time, even if, nowadays, soundness and completeness proofs are often published together with the logic (e.g. [9,31,32,43,64,67,93,97,98] a.o.). Therefore, in this "classic approach" the program properties of interest (partial correctness, total correctness, incorrectness, etc) are the one provable by the proof system, while soundness and completeness theorems aims at connecting the provable properties to the program semantics.…”

“…[58] incorporate reasoning about non-terminating specifications. [31,Section 5] expresses different (hyper) logics in a common framework. [79] derives a logic from an abstraction.…”

“…The approach applies to all abstractions of the collecting semantics into a relation. For future work, this same principled approach can be used to design hyper logics [31], including dependency logics, to include meta information in predicates with an instrumented semantics (e.g. [93,97,98]), and to extend temporal logics like [75] to programming languages by structural induction and local invariants [10].…”