Verifying event-driven programs using ramified frame properties

  • Authors:

  • Neel R. Krishnaswami;Lars Birkedal;Jonathan Aldrich

  • Affiliations:

  • Microsoft Research, Cambridge, United Kingdom;IT University of Copenhagen, Copenhagen, Denmark;Carnegie Mellon University, Pittsburgh, PA, USA

  • Venue:
  • Proceedings of the 5th ACM SIGPLAN workshop on Types in language design and implementation
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Interactive programs, such as GUIs or spreadsheets, often maintain dependency information over dynamically-created networks of objects. That is, each imperative object tracks not only the objects its own invariant depends on, but also all of the objects which depend upon it, in order to notify them when it changes. These bidirectional linkages pose a serious challenge to verification, because their correctness relies upon a global invariant over the object graph. We show how to modularly verify programs written using dynamically-generated bidirectional dependency information. The critical idea is to distinguish between the footprint of a command, and the state whose invariants depends upon the footprint. To do so, we define an application-specific semantics of updates, and introduce the concept of a ramification operator to explain how local changes can alter our knowledge of the rest of the heap. We illustrate the applicability of this style of proof with a case study from functional reactive programming, and formally justify reasoning about an extremely imperative implementation as if it were pure.