What is the Meaning of These Constant Interruptions? Graham Hutton and Joel Wright University of Nottingham

1 What Is An Exception? zDivision by zero zNull pointer Examples: An event within a computation that causes termination in a non-standard way

2 What Is An Interrupt? An exception that arises from the external environement, e.g. another computation zTerminate zAny exception Examples:

3 This Talk zHaskell is unique in providing both full support for interrupts and a semantics for this. zBut the semantics is subtle, and relies on quite considerable technical machinery. zWe give a simple, formally justified, semantics for interrupts in a small language.

4 An Exceptional Language data Expr = Val Int | Throw | Add Expr Expr | Seq Expr Expr | Catch Expr Expr Syntax: Semantics: e  v e can evaluate to v

5 Sequencing: Seq x y  v x  Val ny  v Seq x y  Throw x  Throw Catch x y  Val n x  Val n Catch x y  v x  Throwy  v Catch:

6 Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y =

7 Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y = Seq x y

8 Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y = Seq x y If x produces an exception, y is not evaluated

9 Seq (Catch x y) y Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y =

10 Seq (Catch x y) y Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y = If x produces an exception, y may be evaluated twice

11 Seq (Catch x (Seq y Throw)) y Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y =

12 Seq (Catch x (Seq y Throw)) y Finally, An Example Problem: how can we ensure that evaluation of x is always succeeded by evaluation of y? finally x y = Now has the correct behaviour

13 Adding Interrupts To avoid the need for concurrency, we adopt the following worst-case rule for interrupts: x  Throw Evaluation can be interrupted at any time by replacing the current expression by throw

14 Seq (Catch x (Seq y Throw)) y Note: zEvaluation is now non-deterministic. zFinally no longer behaves as expected. could be interrupted as y is about to be evaluated

15 Controlling Interrupts data Expr = | Block Expr | Unblock Expr Syntax: Semantics: e  i v e can evaluate to v in interrupt status i

16 Key rules: Block x  i v x  B v Unblock x  i v x  U v x  U Throw The other rules are simply modified to propogate the current interrupt status to their arguments.

17 Finally Revisited finally x y = Seq (Catch x (Seq y Throw)) y

18 Block (Seq (Catch (Unblock x) (Seq y Throw)) y) Finally Revisited finally x y =

19 Block (Seq (Catch (Unblock x) (Seq y Throw)) y) Finally Revisited finally x y = Modulo syntax, finally in Haskell is defined in precisely the same way

20 Is Our Semantics Correct? zHow does our high-level semantics reflect our low-level intuition about interrupts? zTo address this issue, we first define a virtual machine, its semantics, and a compiler. zWe explain the basic ideas informally using an example - the paper gives full details.

21 Catch (Unblock (2+3)) 4 Example Code

22 Catch (Unblock (2+3)) 4 Example Code

23 Catch (Unblock (2+3)) 4 Example MARK [ ] UNMARK Code

24 Catch (Unblock (2+3)) 4 Example MARK [ ] UNMARK Code

25 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] UNMARK Code

26 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] UNMARK Code

27 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] SET U RESET UNMARK Code

28 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] SET U RESET UNMARK Code

29 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] SET U PUSH 2 PUSH 3 ADD RESET UNMARK Code

30 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] SET U PUSH 2 PUSH 3 ADD RESET UNMARK CodeStackStatus

31 Catch (Unblock (2+3)) 4 Example MARK [PUSH 4] SET U PUSH 2 PUSH 3 ADD RESET UNMARK CodeStackStatus B

32 Catch (Unblock (2+3)) 4 Example SET U PUSH 2 PUSH 3 ADD RESET UNMARK CodeStack HAN [PUSH 4] Status B

33 Catch (Unblock (2+3)) 4 Example PUSH 2 PUSH 3 ADD RESET UNMARK CodeStack INT B HAN [PUSH 4] Status U

34 Catch (Unblock (2+3)) 4 Example PUSH 3 ADD RESET UNMARK CodeStack VAL 2 INT B HAN [PUSH 4] Status U

35 Catch (Unblock (2+3)) 4 Example ADD RESET UNMARK CodeStack VAL 3 VAL 2 INT B HAN [PUSH 4] Status U

36 Catch (Unblock (2+3)) 4 Example ADD RESET UNMARK CodeStack VAL 3 VAL 2 INT B HAN [PUSH 4] Status U interrupt!

37 Catch (Unblock (2+3)) 4 Example THROW RESET UNMARK CodeStack VAL 3 VAL 2 INT B HAN [PUSH 4] Status U interrupt!

38 Catch (Unblock (2+3)) 4 Example THROW RESET UNMARK CodeStack VAL 2 INT B HAN [PUSH 4] Status U

39 Catch (Unblock (2+3)) 4 Example THROW RESET UNMARK CodeStack INT B HAN [PUSH 4] Status U

40 Catch (Unblock (2+3)) 4 Example THROW RESET UNMARK CodeStack HAN [PUSH 4] Status B

41 Catch (Unblock (2+3)) 4 Example PUSH 4 CodeStackStatus B

42 Catch (Unblock (2+3)) 4 Example CodeStack VAL 4 Status B

43 Catch (Unblock (2+3)) 4 Example CodeStack VAL 4 Status B Final result

44 Compiler Correctness We will exploit two basic notions of reachability for configurations of our virtual machine. x can reach everything in Y x will reach something in Y x * Y x Y

45 Theorem { | e  i Val n } { | e  i Throw } * U Proof: approximately 10 pages of calculation, much of which requires considerable care. comp e c i s c i VAL n : s i s

46 Summary zSimple semantics for interrupts, formally justified by a compiler correctness theorem. zDiscovery of an error in the semantics for Haskell, concerning the delivery of interrupts. zVerification of finally, a useful high-level operator for programming with exceptions/interrupts.

47 Further Work zMechanical verification zBisimulation theorem zGeneralising the language zReasoning about programs zCalculating the compiler