No abstract

The theory of Dynamic Frames has been invented to deal with the frame problem in the presence of encapsulation and pointers. It has proved more flexible and conceptually simpler than previous approaches that tackled the problem. It is now being actively used both for theoretical and for practical purposes related to the formal verification of program correctness. This paper presents the full theory of Dynamic Frames, together with its reasoning laws and exemplifies the use of these laws in proving correct several common design patterns. It also discusses the ongoing research on the topic.

Abstract. Abstract predicates are the primary abstraction mechanism for program logics based on access permissions, such as separation logic and implicit dynamic frames. In addition to abstract predicates, it is useful to also support classical abstraction functions, for instance, to encode side-effect-free methods of the program and use them in specifications. However, combining abstract predicates and abstraction functions in a verification condition generator leads to subtle interactions, which complicate reasoning about heap modifications. Such complications may compromise soundness or cause divergence of the prover in the context of automated verification. In this paper, we present an encoding of abstract predicates and abstraction functions in the verification condition generator Boogie. Our encoding is sound and handles recursion in a way that is suitable for automatic verification using SMT solvers. It is implemented in the automatic verifier Chalice.

Abstract. There are two dominant approaches for the construction of automatic program verifiers, Verification Condition Generation (VCG) and Symbolic Execution (SE). Both techniques have been used to develop powerful program verifiers. However, to the best of our knowledge, no systematic experiment has been conducted to compare them. This paper reports on such an experiment. We have used the specification and programming language Chalice and compared the performance of its standard VCG verifier with a newer SE engine called Syxc, using the Chalice test suite as a benchmark. We have focused on comparing the efficiency of the two approaches, choosing suitable metrics for that purpose. Our metrics also suggest conclusions about the predictability of the performance. Our results show that verification via SE is roughly twice as fast as via VCG. It requires only a small fraction of the quantifier instantiations that are performed in the VCG-based verification.

The embedding of a small but expressive language of multidimensional functional programming in a well known and widely used language of object‐oriented programming leads to the combination of two radically different programming models. In this paper, we formally define the syntax and semantics of GLU♮, which can be thought of as the multidimensional core of Lucid and GLU, and we describe its implementation as a language embedded in C++. With the aid of a few examples, we argue that the marriage of the two programming models is not only compatible and natural, but also that it produces a new and interesting hybrid language. Copyright © 2004 John Wiley & Sons, Ltd.

Abstract. In the verification of programs that manipulate the heap, logics that emphasize localized reasoning, such as separation logic, are being used extensively. In such logics, state conditions may only refer to parts of the heap that are reachable from the stack. However, the correct implementation of some data structures is based on state conditions that depend on unreachable locations. For example, reference counting depends on the invariant that "the number of nodes pointing to a certain node is equal to its reference counter ". Such conditions are cumbersome or even impossible to formalize in existing variants of separation logic. In the first part of this paper, we develop a minimal programming discipline that enables the programmer to soundly express backpointer conditions, i.e., state conditions that involve heap objects that point to the reachable part of the heap, such as the above-mentioned reference counting invariant. In the second part, we demonstrate the expressiveness of our methodology by verifying the implementation of concurrent copy-on-write lists (CCoWL). CCoWL is a data structure with observational disjointness, i.e., its specification pretends that different lists depend on disjoint parts of the heap, so that separation logic reasoning is made easy, while its implementation uses sharing to maximize performance. The CCoWL case study is a very challenging problem, to which we are not aware of any other solutions.

No abstract

Abstract. The purpose of this paper is to try to put theory presentation and structuring in the simplest possible logical setting in order to improve our understanding of it. We look at how theories can be combined, and compared for strength. We look at theory refinement and implementation, and what constitutes proof of correctness. Our examples come from both the functional style and imperative (state-changing) style of theory.Finally, we explore how one implementation can be transformed to another. IntroductionA classic paper by Burstall and Goguen in 1977 [2] taught us to think about data types used in computer programs as logical theories, presented by axioms, whose properties can be explored by logical deduction. The following year, a paper by Guttag and Horning [4] developed the idea further, showing us the algebraic properties of data types presented as theories. Another important contribution came from Abrial [8] in the design of Z, and more recently B [1]. He brought to theory design all the structuring and scoping that programming languages provide, enabling us to build large theories by composing smaller ones. With the work of the Z and B community, and a change of terminology, theory design became an important part of software development.The purpose of this paper is to try to put theory presentation and structuring in the simplest possible logical setting in order to improve our understanding of it. It is not the purpose of this paper to provide a notation or language for practical engineering use; for that task the Z and B community are the leaders.