Functional Correctness Properties Research Articles

Verus: Verifying Rust Programs using Linear Ghost Types

The Rust programming language provides a powerful type system that checks linearity and borrowing, allowing code to safely manipulate memory without garbage collection and making Rust ideal for developing low-level, high-assurance systems. For such systems, formal verification can be useful to prove functional correctness properties beyond type safety. This paper presents Verus, an SMT-based tool for formally verifying Rust programs. With Verus, programmers express proofs and specifications using the Rust language, allowing proofs to take advantage of Rust's linear types and borrow checking. We show how this allows proofs to manipulate linearly typed permissions that let Rust code safely manipulate memory, pointers, and concurrent resources. Verus organizes proofs and specifications using a novel mode system that distinguishes specifications, which are not checked for linearity and borrowing, from executable code and proofs, which are checked for linearity and borrowing. We formalize Verus' linearity, borrowing, and modes in a small lambda calculus, for which we prove type safety and termination of specifications and proofs. We demonstrate Verus on a series of examples, including pointer-manipulating code (an xor-based doubly linked list), code with interior mutability, and concurrent code.

Distributed causal memory: modular specification and verification in higher-order distributed separation logic

We present the first specification and verification of an implementation of a causally-consistent distributed database that supports modular verification of full functional correctness properties of clients and servers. We specify and reason about the causally-consistent distributed database in Aneris, a higher-order distributed separation logic for an ML-like programming language with network primitives for programming distributed systems. We demonstrate that our specifications are useful, by proving the correctness of small, but tricky, synthetic examples involving causal dependency and by verifying a session manager library implemented on top of the distributed database. We use Aneris's facilities for modular specification and verification to obtain a highly modular development, where each component is verified in isolation, relying only on the specifications (not the implementations) of other components. We have used the Coq formalization of the Aneris logic to formalize all the results presented in the paper in the Coq proof assistant.

Formal Verification of Hardware Components in Critical Systems

Hardware components, such as memory and arithmetic units, are integral part of every computer-controlled system, for example, Unmanned Aerial Vehicles (UAVs). The fundamental requirement of these hardware components is that they must behave as desired; otherwise, the whole system built upon them may fail. To determine whether or not a component is behaving adequately, the desired behaviour of the component is often specified in the Boolean algebra. Boolean algebra is one of the most widely used mathematical tools to analyse hardware components represented at gate level using Boolean functions. To ensure reliable computer-controlled system design, simulation and testing methods are commonly used to detect faults; however, such methods do not ensure absence of faults. In critical systems’ design, such as UAVs, the simulation-based techniques are often augmented with mathematical tools and techniques to prove stronger properties, for example, absence of faults, in the early stages of the system design. In this paper, we define a lightweight mathematical framework in computer-based theorem prover Coq for describing and reasoning about Boolean algebra and hardware components (logic circuits) modelled as Boolean functions. To demonstrate the usefulness of the framework, we (1) define and prove the correctness of principle of duality mechanically using a computer tool and all basic theorems of Boolean algebra, (2) formally define the algebraic manipulation (step-by-step procedure of proving functional equivalence of functions) used in Boolean function simplification, and (3) verify functional correctness and reliability properties of two hardware components. The major advantage of using mechanical theorem provers is that the correctness of all definitions and proofs can be checked mechanically using the type checker and proof checker facilities of the proof assistant Coq.

JaVerT: JavaScript verification toolchain

The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain, based on separation logic and aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code. To specify JavaScript programs, we design abstractions that capture its key heap structures (for example, prototype chains and function closures), allowing the developer to write clear and succinct specifications with minimal knowledge of the JavaScript internals. To verify JavaScript programs, we develop JaVerT, a verification pipeline consisting of: JS-2-JSIL, a well-tested compiler from JavaScript to JSIL, an intermediate goto language capturing the fundamental dynamic features of JavaScript; JSIL Verify, a semi-automatic verification tool based on a sound JSIL separation logic; and verified axiomatic specifications of the JavaScript internal functions. Using JaVerT, we verify functional correctness properties of: data-structure libraries (key-value map, priority queue) written in an object-oriented style; operations on data structures such as binary search trees (BSTs) and lists; examples illustrating function closures; and test cases from the official ECMAScript test suite. The verification times suggest that reasoning about larger, more complex code using JaVerT is feasible.

Refinement reflection: complete verification with SMT

We introduce Refinement Reflection , a new framework for building SMT-based deductive verifiers. The key idea is to reflect the code implementing a user-defined function into the function’s (output) refinement type. As a consequence, at uses of the function, the function definition is instantiated in the SMT logic in a precise fashion that permits decidable verification. Reflection allows the user to write equational proofs of programs just by writing other programs using pattern-matching and recursion to perform case-splitting and induction. Thus, via the propositions-as-types principle, we show that reflection permits the specification of arbitrary functional correctness properties. Finally, we introduce a proof-search algorithm called Proof by Logical Evaluation that uses techniques from model checking and abstract interpretation, to completely automate equational reasoning. We have implemented reflection in Liquid Haskell and used it to verify that the widely used instances of the Monoid, Applicative, Functor, and Monad typeclasses actually satisfy key algebraic laws required to make the clients safe, and have used reflection to build the first library that actually verifies assumptions about associativity and ordering that are crucial for safe deterministic parallelism.

Automatically deriving cost models for structured parallel processes using hylomorphisms

Structured parallelism using nested algorithmic skeletons can greatly ease the task of writing parallel software, since common, but hard-to-debug, problems such as race conditions are eliminated by design. However, choosing the best combination of algorithmic skeletons to yield good parallel speedups for a specific program on a specific parallel architecture is still a difficult problem. This paper uses the unifying notion of hylomorphisms, a general recursion pattern, to make it possible to reason about both the functional correctness properties and the extra-functional timing properties of structured parallel programs. We have previously used hylomorphisms to provide a denotational semantics for skeletons, and proved that a given parallel structure for a program satisfies functional correctness. This paper expands on this theme, providing a simple operational semantics for algorithmic skeletons and a cost semantics that can be automatically derived from that operational semantics. We prove that both semantics are sound with respect to our previously defined denotational semantics. This means that we can now automatically and statically choose a provably optimal parallel structure for a given program with respect to a cost model for a (class of) parallel architecture. By deriving an automatic amortised analysis from our cost model, we can also accurately predict parallel runtimes and speedups.

Property-Directed Inference of Universal Invariants or Proving Their Absence

We present Universal Property Directed Reachability (PDR ∀ ), a property-directed semi-algorithm for automatic inference of invariants in a universal fragment of first-order logic. PDR ∀ is an extension of Bradley’s PDR/IC3 algorithm for inference of propositional invariants. PDR ∀ terminates when it discovers a concrete counterexample, infers an inductive universal invariant strong enough to establish the desired safety property, or finds a proof that such an invariant does not exist . PDR ∀ is not guaranteed to terminate. However, we prove that under certain conditions, for example, when reasoning about programs manipulating singly linked lists, it does. We implemented an analyzer based on PDR ∀ and applied it to a collection of list-manipulating programs. Our analyzer was able to automatically infer universal invariants strong enough to establish memory safety and certain functional correctness properties, show the absence of such invariants for certain natural programs and specifications, and detect bugs. All this without the need for user-supplied abstraction predicates.

Staged Symbolic Execution for Parallel Property Checking

While annotating functional correctness properties of code, e.g., using assertions, enables automated conformance checking of program behaviors to expected properties and has found its use in many bug finding techniques, efficiently checking properties in practice remains challenging. In this paper, we introduce a novel approach to distributing checking properties using staged symbolic execution, which consists of two stages: (1) the first stage searches for all feasible paths to the checked properties as targets for the second stage, and (2) the second stage distributes property checking along these target paths among multiple workers, each focusing on one or more paths depending on the available computing resources. We implement our approach on top of Symbolic PathFinder, and our experience with our approach in checking assertions annotated in two Java programs shows its effectiveness

Формальная верификация библиотечных функций ядра Linux

The paper presents result of a study on deductive verification of 26 Linux kernel library functions with AstraVer toolset. The code includes primarily string-manipulating functions and is verified against contract specifications formalizing its functional correctness properties. The paper presents a brief review of the related earlier studies, discusses their results and indicates both the previous issues that were successfully solved in this study and the ones that remain and still prevent successful verification. The paper also presents several specification practices that were applied in the study, including some common specification patterns. The authors have successfully and fully proved functional correctness of 25 functions. The paper includes results of benchmarking 5 state-of-the-art SMT solvers on the resulting verification conditions.

Safety Verification Utilizing Model-based Development for Safety Critical Cyber-Physical Systems

The application of cyber-physical systems (CPSs) in safety-critical application domain requires rigorous verification of their functional correctness and safety-relevant properties. We propose a practical verification process which enables to conduct safety verification of safety critical CPSs. The verification process consists of (a) a system model construction method, which generates a system model by combining software described in C and plant model code reused from model-based development, (b) a model transformation method, which transforms the plant models including differential algebraic equations (DAE) to approximate models without DAE to reduce verification complexity induced by DAE solver execution, (c) a model simplification framework, which enables the simplification of bond-graph plant models using domain-knowledge-based replacement of complex model components for further verification overhead reductions, and (d) a formal verification based on symbolic execution. We implemented the proposed methods and framework, and successfully applied the proposed verification process for safety verification of automotive brake control systems. The results of the study demonstrate that the verification detects a complex failure condition in a real-world brake control system from the generated system model and that the automated model transformations of the CPS models yield significant verification complexity reductions without impairing the ability to detect unsafe behavior. © 2017 Information Processing Society of Japan.

Distributed Assertion Checking Using Symbolic Execution

Annotating functional correctness properties of code using assertions, in principle, enables systematic checking of code against behavioral properties. In practice however, checking assertions can be costly, especially for complex code annotated with rich behavioral properties. This paper introduces a novel approach for distributing the problem of checking assertions for better scalability. Leveraging that assertions should be side effect free, our approach distributes assertion checking into simpler sub-problems---each focusing on checking one single assertion, so that different assertions are checked in parallel among multiple workers. Furthermore, the sub-problem analysis performed by each worker is guided by the checked assertion to avoid irrelevant path exploration and is prioritized based on the distance towards the checked assertion to provide earlier feedback. A case study shows that our approach can provide a reduction in analysis time required for symbolic execution of Java programs compared to non-distributed approach using the Symbolic PathFinder tool.

Parametrized invariance for infinite state processes

We study the uniform verification problem for infinite state processes. This problem consists of proving that the parallel composition of an arbitrary number of processes running the same program (or a finite collection of programs) satisfies a temporal property. Our practical motivation is to build a general framework for the temporal verification of concurrent datatypes. In this paper we propose a general method for the verification of safety properties of parametrized programs that manipulate complex local and global data, including mutable state in the heap. Our method is based on a clear division between the following two dimensions of the problem: the interaction between executing threads—handled by novel parametrized invariance proof rules, and the data being manipulated—handled by specialized decision procedures. Our proof rules discharge automatically a finite collection of verification conditions. The size of this collection depends only on the size of the program and the specification, but not on the number of processes in any given instance or on the kind of data manipulated. Moreover, all verification conditions are quantifier free, which eases the development of decision procedures for complex data-types on top of off-the-shelf SMT solvers. We prove soundness of our proof rules and illustrate their application in the formal verification of (1) two infinite-state mutual exclusion protocols; (2) shape and functional correctness properties of several concurrent data-types, including fine-grained and non-blocking concurrent lists and queues. We report empirical results using a prototype implementation of the proof rules and decision procedures.

Automated verification of the FreeRTOS scheduler in Hip/Sleek

Automated verification of operating system kernels is a challenging problem, partly due to the use of shared mutable data structures. In this paper, we show how we can automatically verify memory safety and functional correctness properties of the task scheduler component of the FreeRTOS kernel using the verification system Hip/Sleek. We show how some of Hip/Sleek features such as user-defined predicates and lemmas make the specifications highly expressive and the verification process viable. To the best of our knowledge, this is the first code-level verification of memory safety and functional correctness properties of the FreeRTOS scheduler. The outcome of our experiment confirms that Hip/Sleek can indeed be used to verify code that is used in production. Moreover, since the properties that we verify are quite general, we envisage that the same approach can be adopted to verify components of other operating systems.

On the formal verification of component-based embedded operating systems

The increasing complexity of embedded systems is pushing their design to System-Level, thus leading to a convergence between software and hardware. Consequently, operating systems in this realm are also being required to deliver their services both as software and as hardware. In such a scenario, it is desirable to verify system properties regardless of whether its components are instantiated at software or hardware. In this paper, we describe an approach to formally verify functional correctness and safety properties of such system-level component. The approach is illustrated by a case study of EPOS' scheduler, whose implementation can be driven to yield both a software instance compiled by the GCC C++ compiler or a hardware instance synthesized by the CatapultC ESL tool. We demonstrate that the scheduler follows its specification regardless of the domain for which it is instantiated. We also demonstrate that the proposed approach causes no run-time overhead, since the adopted Software Model Checking techniques are deployed at compile-time.

Session details: Selected extended papers from SBESC 2012 Brazilian symposium on computing system engineering

The Brazilian Symposium on Computing System Engineering (SBESC) is an initiative of the research community originally associated with three events: the Brazilian Workshop on Real-Time Systems, created in 1998; the Brazilian Workshop on Operating Systems, created in 2004; and the Brazilian Workshop on Embedded Systems, created in 2010. The identification of a strong synergy among these research areas added to the fact that designing computing systems is an increasingly multidisciplinary task has motivated the workshops to move from their native conferences to form an independent symposium. The broad term "Computing System Engineering" emerged in the context of contemporary Cyber-Physical Systems, which challenge Engineers and Scientist as they shape a new reality for modern societies. This year, the symposium was hosted by the Federal University of Rio Grande do Norte (UFRN) in the beautiful coastal city of Natal in Northeast Brazil. The program spanned a whole week, from November 5 to 9, and was organized in two big blocks: peer-reviewed paper sessions and tutorials. The event was organized by UFRN's Computer Science Department (DIMAP), sponsored by the Brazilian Computing Society (SBC), and financed by CAPES, CNPq, and FAPERN. SBESC's Technical Program Committee also selected two papers from those presented at the symposium addressing operating systems issues to appear in the Operating Systems Review and thus offer ACM fellows a glimpse of the event. Authors were invited to extend and improve their manuscripts with recent research results. The first paper, On the Formal Verification of Component-based Embedded Operating Systems, by M. Ludwich and A. Frohlich, introduces an approach to formally verify the functional correctness and safety properties of embedded operating system components described at system-level. The convergence between software and hardware in the domain of embedded systems is pressing operating systems in the filed to deliver their services both as software and as hardware. In such a scenario, it is desirable to verify system properties regardless of whether components are instantiated as software or hardware. The approach combines software model checking and programming by contract concepts to address such issues. The second, Adaptive Request Batching for Byzantine Replication, by A. de Sa, A. Freitas, and R. Macedo, proposes an adaptation of the Practical Byzantine Fault Tolerance algorithm proposed by Liskov and Castro to increase its performance. The original PBFT algorithm uses a batch to store client requests on the primary replica. Requests in a batch are handled together, aiming at decreasing the time spent with message authentication. The adaptation strategy dynamically varies the batch size and the batch time-out according with application activity.