Local Reasoning for Global Invariants, Part II: Dynamic Boundaries
Local Reasoning for Global Invariants, Part II: Dynamic Boundaries
复制标题
DOI：
10.1145/2487241.2485981
复制
发表时间：
2013-06-01
影响因子：
2.5
通讯作者：
Naumann, David A.
中科院分区：
文献类型：
--
作者：
Banerjee, Anindya;Naumann, David A.
The hiding of internal invariants creates a mismatch between procedure specifications in an interface and proof obligations on the implementations of those procedures. The mismatch is sound if the invariants depend only on encapsulated state, but encapsulation is problematic in contemporary software due to the many uses of shared mutable objects. The mismatch is formalized here in a proof rule that achieves flexibility via explicit restrictions on client effects, expressed using ghost state and ordinary first order assertions. The restrictions amount to a stateful frame condition that must be satisfied by any client; this dynamic encapsulation boundary complements conventional scope-based encapsulation. The technical development is based on a companion article, Part I, that presents Region Logic-a programming logic with stateful frame conditions for commands.
