How Verified is My Code? Falsification-Driven Verification (T)

Abstract

Formal has advanced to the point that developers can verify the correctness of small, critical modules. Unfortunately, despite considerable efforts, determining if a verification verifies what the author intends is still difficult. Previous approaches are difficult to understand and often limited in applicability. Developers need coverage in terms of the software they are verifying, not model checking diagnostics. We propose a methodology to allow developers to determine (and correct) what it is that they have verified, and tools to support that methodology. Our basic approach is based on a novel variation of mutation analysis and the idea of driven by falsification. We use the CBMC model checker to show that this approach is applicable not only to simple data structures and sorting routines, and of a routine in Mozilla's JavaScript engine, but to understanding an ongoing effort to verify the Linux kernel Read-Copy-Update (RCU) mechanism.