Local Reasoning for Stateful Programs

239 p.Thesis (Ph.D.)--University of Illinois at Urbana-Champaign, 2001.Programs are called stateful when they manipulate the state of a computer explicitly, for example, by assignment. The main theme of the thesis is reasoning about stateful programs. In fact, for the past 30 years, significant efforts have been made for obtaining good reasoning principles to ensure that such programs work correctly. However, reasoning techniques developed so far often result in significantly more complex verification than an informal argument; consequently, they don't attract attention from real programmers. In the thesis, we develop O'Hearn's idea of local reasoning, which was recently proposed to overcome such complexity problem in reasoning. The key observation of local reasoning is that most programs show conceptual locality in their use of the store: even though a program is able to access all global variables and all heap data structures in principle, it usually uses only a few of them. Local reasoning uses such an observation to simplify verification: one starts reasoning about a program considering only the accessed portion of the store so as to obtain a "local" fact; then, a "global" fact is inferred simply by conjoining as an invariant a property that only involves the portion of the store not accessed by the program. In the thesis, we formulate a rule which allows one to derive a global property from a local one. The rule is an extension of O'Hearn's Frame Rule for programs with procedures. It uses a symmetric noninterference predicate and a spatial conjunction to ensure that a program phrase doesn't alter the portion of the store that a conjoined property depends on. We show completeness of the rule, which provides a sense that all properties can be inferred with the rule. We also study reasoning principles for the symmetric noninterference predicate and the spatial conjunction connective; reasoning about certain uses of the spatial conjunction connective is shown to be automated. The benefit of the formalism is illustrated with the verification of the Schorr-Waite graph marking algorithm.U of I OnlyRestricted to the U of I community idenfinitely during batch ingest of legacy ETD