The Spirit of Ghost Code - Archive ouverte HAL Access content directly
Journal Articles Formal Methods in System Design Year : 2016

The Spirit of Ghost Code


In the context of deductive program verification, ghost code is a part of the program that is added for the purpose of specification. Ghost code must not interfere with regular code, in the sense that it can be erased without observable difference in the program outcome. In particular, ghost data cannot participate in regular computations and ghost code cannot mutate regular data or diverge. The idea exists in the folklore since the early notion of auxiliary variables and is implemented in many state-of-the-art program verification tools. However, ghost code deserves rigorous definition and treatment, and few formalizations exist. In this article, we describe a simple ML-style programming language with muta-ble state and ghost code. Non-interference is ensured by a type system with effects, which allows, notably, the same data types and functions to be used in both regular and ghost code. We define the procedure of ghost code erasure and we prove its safety using bisimulation. A similar type system, with numerous extensions which we briefly discuss, is implemented in the program verification environment Why3.
Fichier principal
Vignette du fichier
main.pdf (453.33 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-01396864 , version 1 (15-11-2016)



Jean-Christophe Filliâtre, Léon Gondelman, Andrei Paskevich. The Spirit of Ghost Code. Formal Methods in System Design, 2016, 48 (3), pp.152-174. ⟨10.1007/s10703-016-0243-x⟩. ⟨hal-01396864⟩
1525 View
538 Download



Gmail Mastodon Facebook X LinkedIn More