1. Verifying the Composite Pattern using Separation Logic Bart Jacobs Jan Smans Frank Piessens Katholieke Universiteit Leuven, Belgium

2. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Overview  General Idea  Example: Binary Tree Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes  Demonstration  Conclusion

3. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic General Idea ModuleClient Invariant

4. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Interface

5. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Client

6. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Specification

7. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Specification: Datatype tree n0 n1 n2n3 tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil)

8. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Pure function count count(tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil)) = 4 n0 n1 n2n3

9. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Datatype context root n0 left_context(root, n0, nil) n0 n1 n2 right_context(left_context(root, n0, nil), n1, tree(n2, nil, nil))

10. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Predicate tree n0 n1 n2 n3 memory region tree(n0, root, tree(n0, tree(n1, tree(n2, nil, nil), tree(n3, nil, nil)), nil)) focus node

11. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Predicate tree n0 n1 n2 n3 memory region tree(n1, left_context(root, n0, nil), tree(n1, tree(n2, nil, nil), tree(n3, nil, nil))) focus node

12. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Predicate tree n0 n1 n2 n3 memory region tree(n3, right_context( left_context(root, n0, nil), n1, tree(n2, nil, nil)), tree(n3, nil, nil)) focus node

13. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Function create_tree result focus node

14. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic c Example: Binary Tree Spec’n: Function tree_add_left node r focus node c node r result focus node

15. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic c Example: Binary Tree Spec’n: Function tree_get_count node t focus node c node t focus node

16. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Function tree_get_parent node t focus node pns r p node t pns r p focus node (case left_context)

17. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Spec’n: Function tree_dispose node focus node

18. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Client Proof

19. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Implementation: struct node

20. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Implementation: predicate tree c node subtree focus node c node subtree context(node, parent, count(subtree), c) subtree(node, parent, subtree)

21. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Implementation: predicate subtree left left- Nodes right- Nodes node right node->left |-> left node->right |-> right node->parent |-> parent node->count |-> count(t) malloc_block_node(node) left left- Nodes right right- Nodes

22. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Implementation: predicate context n pns r p right p->left |-> n p->right |-> right p->parent |-> gp p->count |-> pcount malloc_block_node(p) right r pns p

23. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Implementation: function create_tree

24. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Impl’n: function subtree_get_count

25. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Impl’n: function fixup_ancestors

26. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Impl’n: function tree_add_left

27. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Impl’n: function tree_get_count

28. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Example: Binary Tree Impl’n: function tree_get_parent

29. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Overview  General Idea  Example: Binary Tree Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes  Demonstration  Conclusion

30. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Non-contiguous Focus Changes Example Client Program

31. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Non-contiguous Focus Changes Additional Specification Elements

32. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Non-contiguous Focus Changes Proof of Example Client Program

33. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Non-contiguous Focus Changes Proof of lemma change_focus

34. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Overview  General Idea  Example: Binary Tree Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes  Demonstration  Conclusion

35. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Overview  General Idea  Example: Binary Tree Interface Client Specification Client Proof Implementation and Implementation Proof Non-contiguous Focus Changes  Demonstration  Conclusion

36. Bart Jacobs, Jan Smans, Frank Piessens - Verifying the Composite Pattern using Separation Logic Conclusion  Approach: Structure = 1 seplogic predicate In proof: Separate out focus node In client: Change focus node using lemma  VeriFast: www.cs.kuleuven.be/~bartj/verifast