Verifying the Composite Pattern using Separation Logic

Bart JacobsJan SmansFrank PiessensKatholieke Universiteit Leuven, Belgium

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Overview

General Idea Example: Binary Tree

Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes

Demonstration Conclusion

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

General Idea

Module Client

Invariant

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeInterface

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeClient

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpecification

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpecification: Datatype tree

n0

n1

n2 n3

tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil)

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Pure function count

count(tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil)) = 4

n0

n1

n2 n3

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Datatype context

root

n0

left_context(root, n0, nil)

n0

n1

n2

right_context(left_context(root, n0, nil), n1, tree(n2, nil, nil))

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Predicate tree

n0

n1

n2 n3

memory region

tree(n0, root, tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil))

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Predicate tree

n0

n1

n2 n3

memory region

tree(n1, left_context(root, n0, nil), tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)))

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Predicate tree

n0

n1

n2 n3

memory region

tree(n3, right_context( left_context(root, n0, nil), n1, tree(n2, nil, nil)), tree(n3, nil, nil))

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Function create_tree

result

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

c

Example: Binary TreeSpec’n: Function tree_add_left

node

r focus node

cnode

r

result

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

c

Example: Binary TreeSpec’n: Function tree_get_count

node

t

focus node

cnode

t

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Function tree_get_parent

node

tfocus node

pns

r

pnode

t

pns

r

p

focus node(case left_context)

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeSpec’n: Function tree_dispose

node

focus node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeClient Proof

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImplementation: struct node

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImplementation: predicate tree

cnode

subtree

focus node cnode

node

subtree

context(node, parent, count(subtree), c)

subtree(node, parent, subtree)

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImplementation: predicate subtree

left

left-Nodes

right-Nodes

node

right

node->left |-> left

node->right |-> right

node->parent |-> parent

node->count |-> count(t)

malloc_block_node(node)

left

left-Nodes

right

right-Nodes

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImplementation: predicate context

n

pns

r

pright

p->left |-> n

p->right |-> right

p->parent |-> gp

p->count |-> pcount

malloc_block_node(p)

right

r

pnsp

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImplementation: function create_tree

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImpl’n: function subtree_get_count

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImpl’n: function fixup_ancestors

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImpl’n: function tree_add_left

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImpl’n: function tree_get_count

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Example: Binary TreeImpl’n: function tree_get_parent

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Overview

General Idea Example: Binary Tree

Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes

Demonstration Conclusion

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Non-contiguous Focus ChangesExample Client Program

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Non-contiguous Focus ChangesAdditional Specification Elements

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Non-contiguous Focus ChangesProof of Example Client Program

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Non-contiguous Focus ChangesProof of lemma change_focus

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Overview

General Idea Example: Binary Tree

Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes

Demonstration Conclusion

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Overview

General Idea Example: Binary Tree

Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes

Demonstration Conclusion

Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic

Conclusion

Approach: Structure = 1 seplogic predicate In proof: Separate out focus node In client: Change focus node using

lemma VeriFast:

www.cs.kuleuven.be/~bartj/verifast