[Paper Review] Proof Pearl: Magic Wand as Frame

Qinxiang Cao, Shengyi Wang+2 more|arXiv (Cornell University)|Sep 19, 2019

Logic, programming, and type systems14 references4 citations

TL;DR

This paper introduces the 'magic-wand-as-frame' technique, using separating implication (magic wand) with quantifiers to describe partial data structures in separation logic, enabling concise, automated proofs of loop invariants and modifications in programs like binary search tree insertion. The method simplifies verification in Coq by replacing inductive predicates with wand-based assertions, reducing reliance on complex induction and enabling high-level, compositional reasoning.

ABSTRACT

Separation logic adds two connectives to assertion languages: separating conjunction * ("star") and its adjoint, separating implication -* ("magic wand"). Comparatively, separating implication is less widely used. This paper demonstrates that by using magic wand to express frames that relate mutable local portions of data structures to global portions, we can exploit its power while proofs are still easily understandable. Many useful separation logic theorems about partial data structures can now be proved by simple automated tactics, which were usually proved by induction. This magic-wand-as-frame technique is especially useful when formalizing the proofs by a high order logic. We verify binary search tree insert in Coq as an example to demonstrate this proof technique.

Motivation & Objective

• To address the challenge of verifying programs with mutable, partially updated data structures, especially in the presence of loops.
• To demonstrate that separating implication (magic wand) can be used effectively and intuitively as a frame in program verification, contrary to its traditional perception as hard to manage.
• To provide a systematic proof technique using magic wand and quantifiers to describe partial data structures, avoiding complex inductive definitions.
• To enable automated, tactic-based proof strategies for separation logic entailments that would otherwise require manual induction.
• To formalize the technique in Coq using existing tools like Verifiable C and VFA, achieving end-to-end verification from specification to assembly code.

Proposed method

• Define partial data structures using magic wand expressions: e.g., 'tree_shape(p) -∗ tree_shape(q)' to represent a subtree that can be extended.
• Use quantifiers to express unknown or dynamically computed modifications, such as inserting a new value along a path.
• Introduce five core proof rules: wandQ-frame-intro, wandQ-frame-elim, ver(tical) composition, hor(izontal) composition, and refine, to manage frame reasoning.
• Apply the magic-wand-as-frame technique to the BST insertion algorithm, where the loop invariant is expressed as a wand-based frame over a partial tree.
• Leverage Coq’s higher-order logic and existing formalizations (e.g., VFA, CompCert) to automate proof steps and reduce boilerplate.
• Derive and use generalized frame rules like ramifQ and compositionality rules to support modular and composable verification.

Experimental results

Research questions

• RQ1 Can separating implication (magic wand) be used effectively as a frame to describe partial data structures in separation logic?
• RQ2 Can the magic-wand-as-frame technique replace inductive definitions of partial trees and list segments, simplifying verification?
• RQ3 Does using magic wand with quantifiers enable automated proof tactics that avoid complex induction in program verification?
• RQ4 Can this method be integrated into existing Coq-based verification stacks (e.g., Verifiable C, VFA) to support end-to-end correctness proofs?
• RQ5 How does the magic-wand-as-frame technique compare in expressiveness and automation to traditional inductive predicate-based approaches?

Key findings

• The magic-wand-as-frame technique allows concise, high-level specification of loop invariants in BST insertion by expressing the partial tree as a wand frame.
• The method enables automated proof tactics for entailments involving partial data structures, eliminating the need for manual induction proofs.
• By using quantifiers with magic wand, the technique handles dynamic modifications such as path-dependent value updates, even when the final result is unknown at the start.
• The Coq formalization of BST insertion using this method is more concise and reusable than prior approaches based on inductive tree-with-hole predicates.
• The approach successfully integrates with existing verification tooling (e.g., Verifiable C, VFA), enabling end-to-end verification from C code to assembly.
• The technique generalizes to other data structures: similar rules and tactics can be applied to linked lists and other recursive structures.