Verifying event-driven programs using ramified frame properties

ABSTRACT

Interactive programs, such as GUIs or spreadsheets, often maintain dependency information over dynamically-created networks of objects. That is, each imperative object tracks not only the objects its own invariant depends on, but also all of the objects which depend upon it, in order to notify them when it changes.

These bidirectional linkages pose a serious challenge to verification, because their correctness relies upon a global invariant over the object graph.

We show how to modularly verify programs written using dynamically-generated bidirectional dependency information. The critical idea is to distinguish between the footprint of a command, and the state whose invariants depends upon the footprint. To do so, we define an application-specific semantics of updates, and introduce the concept of a ramification operator to explain how local changes can alter our knowledge of the rest of the heap. We illustrate the applicability of this style of proof with a case study from functional reactive programming, and formally justify reasoning about an extremely imperative implementation as if it were pure.

References

1. U. A. Acar, G. E. Blelloch, and R. Harper. Adaptive functional programming. ACM Transactions on Programming Languages and Systems (TOPLAS), 28 (6): 990--1034, 2006.
2. Anindya Banerjee, David A. Naumann 2, and Stan Rosenberg. Regional logic for local reasoning about global invariants. In ECOOP, pages 387--411, 2008.
3. Mike Barnett and David A. Naumann. Friends need a little bit more: Maintaining invariants over shared state. In MPC, pages 54--64, 2004.
4. Bodil Biering, Lars Birkedal, and Noah Torp-Smith. BI-hyperdoctrines, higher-order separation logic, and abstraction. ACM TOPLAS, 29 (5): 24, 2007. ISSN 0164-0925.
5. R. Bird and P. Wadler. An introduction to functional programming. Prentice Hall International (UK) Ltd. Hertfordshire, UK, UK, 1988.
6. L. Birkedal, N. Torp-Smith, and H. Yang. Semantics of separation-logic typing and higher-order frame rules. In Proc. of LICS'05, pages 260--269, 2005.
7. Lars Birkedal, Kristian Støvring, and Jacob Thamsborg. Realizability semantics of parametric polymorphism, general references, and recursive types. In Luca de Alfaro, editor, FOSSACS, volume 5504 of LNCS, pages 456--470. Springer, 2009. ISBN 978-3-642-00595-4.
8. Magnus Carlsson. Monads for incremental computing. In ICFP, pages 26--35, 2002.
9. Gregory H. Cooper and Shriram Krishnamurthi. Embedding dynamic dataflow in a call-by-value language. In Peter Sestoft, editor, ESOP, volume 3924 of LNCS, pages 294--308. Springer, 2006. ISBN 3-540-33095-X.
10. C. Elliott and P. Hudak. Functional reactive animation. In Proceedings of ICFP'97, pages 263--273. ACM New York, NY, USA, 1997.
11. J. J. Finger. Exploiting constraints in design synthesis. PhD thesis, Stanford University, Stanford, CA, USA, 1987.
12. Paul Hudak, Antony Courtney, Henrik Nilsson, and John Peterson. Arrows, robots, and functional reactive programming. In Johan Jeuring and Simon L. Peyton Jones, editors, Advanced Functional Programming, volume 2638 of LNCS, pages 159--187. Springer, 2002. ISBN 3-540-40132-6.
13. Cliff B. Jones. Tentative steps toward a development method for interfering programs. ACM Transactions on Programming Languages and Systems (TOPLAS), 5 (4): 596--619, 1983.
14. N. Krishnaswami, J. Aldrich, and L. Birkedal. Modular verification of the subject-observer pattern via higher-order separation logic. In Proceedings of FTfJP: Formal Techniques for Java-like Programs, 2007.
15. N. Krishnaswami, J. Aldrich, L. Birkedal, K. Svendsen, and A. Buisse. Design patterns in separation logic. In Proceedings of TLDI'09, pages 105--116. ACM New York, NY, USA, 2009.
16. Neelakantan R. Krishnaswami. Verifying Higher-Order Programming Languages with Higher-Order Separation Logic. PhD thesis, forthcoming. Carnegie Mellon University, Pittsburgh, PA, USA, 2009.
17. K. Rustan M. Leino and Wolfram Schulte. Using history invariants to verify observers. In Rocco De Nicola, editor, ESOP, volume 4421 of LNCS, pages 80--94. Springer, 2007. ISBN 978-3-540-71314-2.
18. Barbara H. Liskov and Jeannette M. Wing. Behavioural subtyping using invariants and constraints. In Formal Methods for Distributed Processing: a Survey of Object-Oriented Approaches, pages 254--280. Cambridge University Press, New York, NY, USA, 2001. ISBN 0-521-77184-6.
19. John McCarthy and Patrick J. Hayes. Some philosophical problems from the standpoint of artificial intelligence. In B. Meltzer and D. Michie, editors, Machine Intelligence 4, pages 463--502. Edinburgh University Press, 1969.
20. Sean McDirmid and Wilson C. Hsieh. Superglue: Component programming with object-oriented signals. In Dave Thomas, editor, ECOOP, volume 4067 of LNCS, pages 206--229. Springer, 2006. ISBN 3-540-35726-2.
21. Aleksandar Nanevski, Greg Morrisett, and Lars Birkedal. Polymorphism and separation in hoare type theory. In Proceedings ICFP, pages 62--73, New York, NY, USA, 2006. ACM. ISBN 1-59593-309-3.
22. M. Parkinson. Class invariants: The end of the road. Proceedings IWACO, 2007.
23. Matthew J. Parkinson and Gavin M. Bierman. Separation logic, abstraction and inheritance. In George C. Necula and Philip Wadler, editors, POPL, pages 75--86. ACM, 2008. ISBN 978-1-59593-689-9.
24. Frank Pfenning and Rowan Davies. A judgmental reconstruction of modal logic. phMathematical Structures in Computer Science, 11 (4): 511--540, 2001. ISSN 0960-1295.
25. John C. Reynolds. Separation logic: A logic for shared mutable data structures. In Logic in Computer Science (LICS 2002), pages 55--74. IEEE Computer Society, 2002. ISBN 0-7695-1483-9.
26. Steve M. Shaner, Gary T. Leavens, and David A. Naumann. Modular verification of higher-order methods with mandatory calls specified by model programs. In OOPSLA, pages 351--368, 2007.

Index Terms

• Theory of computation

  • Logic

    • Programming logic

  • Semantics and reasoning

    • Program reasoning

      • Invariants

      • Pre- and post-conditions

      • Program specifications