Refinable Record Structures in Formal Methods

This paper presents a method for formalization of operations on certain class of syntactically represented linked Data Structures and then defines a set of functions to perform the operations. The formalization will be done by designing a set of transformation rules which are based on the grammars generating these Data Structures. Rooted in formal language theory, this method of formalization provides a basis for mathematical demonstration of the correctness of the operations. The function definitions are based on the idea of Functional Programming (FP) originated by John Backus. These function definitions will provide more functions for implementation of Extended Functional Programming (EFP) language designed for operations on Data Structures.

Various methods are used to describe communication protocols. The search for suitable description methods for communication protocols in the 1980s yielded a broad range of approaches out of which some fundamental methods have crystallized. These methods constitute the basis of the semantic models of the various formal description techniques. Therefore we first consider the most important description methods in this chapter before we turn to the formal description techniques. From these, finite state machines, Petri nets, process calculi, and temporal logics have crystallized as the most important and most common ones. Apart from these methods, other approaches were also investigated, such as the use of grammars, data flow languages, and functional languages. They did not receive wider attention because they were not applied to real-life protocols. The use of high-level programming languages was considered likewise. Programming languages support the algorithmic description of protocol procedures as well as the generation of prototypes, but they usually do not possess a formally defined semantics. In addition, programming languages are primarily implementation languages and not specification languages. They often yield descriptions which are close to an implementation. For that reason, high-level programming languages are not used for protocol description. Many formal description techniques, however, use programming language features.

In this thesis, we explore techniques for the development and verification of programs in a high-level, expressive, and safe programming language. Our programs can express problems over unbounded domains and over recursive and mutable data structures. We present an implementation language flexible enough to build interesting and useful systems. We mostly maintain a core shared language for the specifications and the implementation, with only a few extensions specific to expressing the specifications. Extensions of the core shared language include imperative features with state and side effects, which help when implementing efficient systems. Our language is a subset of the Scala programming language. Once verified, programs can be compiled and executed using the existing Scala tools. We present algorithms for verifying programs written in this language. We take a layer-based approach, where we reduce, at each step, the program to an equivalent program in a simpler language. We first purify functions by transforming away mutations into explicit return types in the functions' signatures. This step rewrites all mutations of data structures into cloning operations. We then translate local state into a purely functional code, hence eliminating all traces of imperative programming. The final language is a functional subset of Scala, on which we apply verification. We integrate our pipeline of translations into Leon, a verifier for Scala. We verify the core functional language by using an algorithm already developed inside Leon. The program is encoded into equivalent first-order logic formulas over a combination of theories and recursive functions. The formulas are eventually discharged to an external SMT solver. We extend this core language and the solving algorithm with support for both infinite-precision integers and bit-vectors. The algorithm takes into account the semantics gap between the two domains, and the programmer is ultimately responsible to use the proper type to represent the data. We build a reusable interface for SMT-LIB that enables us to swap solvers transparently in order to validate the formulas emitted by Leon. We experiment with writing solvers in Scala; they could offer both a better and safer integration with the rest of the system. We evaluate the cost of using a higher-order language to implement such solvers, traditionally written in C/C++. Finally, we experiment with the system by building fully working and verified applications. We rely on the intersection of many features including higher-order functions, mutable data structures, recursive functions, and nondeterministic environment dependencies, to build concise and verified applications.

: Odyssey Research Associates has undertaken a study of the feasibility of developing formally verified Ada programs. We have designed a specification language for sequential Ada programs. It is a member of the Larch family of specification languages. We have built a prototype program editor that is intended to help programmers develop programs and proofs from specifications, as advocated by Dijkstra and Gries (2,4). It contains predicate transformers, which compute wp (an approximation to the weakest precondition of a program), and it generates verification conditions. The semantics of the specification language and the definition of the predicate transformers are derivable from a denotational definition of sequential Ada. The predicate transformers can be proved sound with respect to these definitions by structural induction on programs. The denotational-style definition of the predicate transformers is well suited to an implementation as an attribute grammar. The program editor is designed to be used on program fragments, not just complete programs. The next step in improving the prototype editor is to find ways to simplify the intermediate values of wp so they can be used to guide the development of fragments into programs. Ada, Larch, Larch/Ada, Formal Methods, Formal Specification, Program Verification, Predicate Transformers, Ada Verification.

The situation of telecommunications systems is rapidly evolving towards a state characterized by the presence of a multitude of services integrated in a single network structure. In order to ease their integration, it is important to provide an unambiguous description of the organization, of the functionality, and of the relationships existing among services. Since it is not possible to completely foresee the situation of services in the future, the description should be modular, so that the task of adding new services to an existing environment is simplified. Formal description techniques are languages designed to handle such descriptions. Their goal is to produce correct and unambiguous specifications, understanding and modeling the system and the domain within which it operates. Their input is a set of required statements and a conceptual overview of the system. Their output is a formal representation that captures the functional behavior. On the other hand, the throughput of physical networks is constantly growing, reaching the order of Gbit/s. In the meantime, services needing high throughput, like multimedia conferencing systems are being designed, creating a need for flexible, high performance communication systems. An important feature of new high speed services is their increased need for guarantees. Therefore, the use of powerful performance modeling techniques becomes of prime importance. Their goal is to obtain some notion of how the system will perform under a given set of conditions. Performance evaluation theorists have long been using system specifications to make a heuristic model of the system and then an analysis of the model. When system specifications exist, the question arises whether a more direct path to performance analysis can be found. Our scope is to provide a methodology that fully and consistently integrates formal specification and performance evaluation. A problem is that many of the bottlenecks and impediments to smooth data flow have to do with implementation issues not directly dealt within the system specification itself. Therefore, prior to generating a performance model, the formal specification should be enhanced with the relevant non-functional information. It is essential to assure a smooth specification of the non-functional information. Thus, it is necessary to consistently add this information to the formal specification. Besides, the extended formal method should focus on conserving the semantics of the original one, and on providing a coherent extension of the semantics and syntax for the new concepts. Since all relevant required information is integrated within the formal extended representation, we provide a mapping technique that translates the extended formal representation into a performance modeling conserving the properties of the formal model. In parallel to the development of a performance model, the formal model can be validated and verified, and their implementation can be tested for conformance towards the original formal model. Finally, the performance modelling is implemented in a programming language, and then simulated. The results from simulation can be reused as inputs for the optimization of the formal specification (functional optimization) or the extended formal model (design optimization). To sum up, the goal of this work is to: Define extensions to current formal methods that allow to enhance the formal specification with performance modeling related information. Develop a method to translate the extended formal specification into a performance modeling. Develop rules and guidelines to automatically implement the performance modeling for the purpose of a performance evaluation (we use the commercial tool Opnet). Develop a consistent and coherent methodology for the integration of performance modeling and formal specification.

After a review of semaphores and monitors the principles underlying the programming language OCCAM are outlined. We show how it can also be used as a specification language. We also examine in detail the language CCS, principely by giving examples of processes or specifications. We end with some remarks on the issues raised by these modern languages which on the one hand may be viewed as programming languages for highly parallel architectures and on the other languages for specifying the required behaviour of systems.

Traditional methods for programming sequential machines are inadequate for specifying parallel systems. Because debugging of parallel programs is hard, due to e.g. non-deterministic execution, verification of program correctness becomes an even more important issue. The Algebra of Communicating Processes (ACP) is a formal theory which emphasizes verification and can be applied to a large domain of problems ranging from electronic circuits to CAM architectures. The manual verification of specifications of small size has already been achieved, but this cannot easily be extended to the verification of larger industrially relevant systems. To deal with this problem we need computer tools to help with the specification, simulation, verification and implementation. The first requirement for building such a set of tools is a specification language. In this paper we introduce PSFd (Process Specification Formalism – draft) which can be used to formally express processes in ACP. In order to meet the modern requirements of software engineering, like reusability of software, PSFd supports the modular construction of specifications and parameterization of modules. To be able to deal with the notion of data, ASF (Algebraic Specification Formalism) is embedded in our formalism. As semantics for PSFd a combination of initial algebra semantics and operational semantics for concurrent processes is used. A comparison with programming languages and other formal description techniques for the specification of concurrent systems is included.

Current programming languages and programming models make it easy to create software and hardware systems that fulfill an intended function but also leave such systems open to unintended function and vulnerabilities. Software engineering and code hygiene may make systems incrementally safer, but do not produce the wholesale change necessary for secure systems from the outset. Yet there exists an approach with impressive results: We cite recent examples showing that formal methods, coupled with formally informed digital design, have produced objectively more robust code even beyond the properties directly proven. Though discovery of zero-day vulnerabilities is almost always a surprise and powerful tools like semantic fuzzers can cover a larger search space of vulnerabilities than a developer can conceive of, formal models seem to produce robustness of a higher qualitative order than traditionally developed digital systems. Because the claim is necessarily a qualitative one, we illustrate similar results with an idealized programming language in the form of Boolean networks where we have control of parameters related to stability and adaptability. We argue that verifiability with formal methods is an instance of broader design constraints that promote robustness. We draw analogies to real-world programming models and languages that can be mathematically reasoned about in contrast to ones that are essentially undecidable.

<span lang="EN-US">Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers’ expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java-based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.</span>

Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers' expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.

An introduction to metric semantics: operational and denotational models for programming and specification languages

We describe ongoing work on building an environment to support reasoning in proof assistants that represent formal systems using higher-order abstract syntax (HOAS). We use a simple and general specification language whose syntax supports HOAS. Using this language, we can encode the syntax and inference rules of a variety of formal systems, such as programming languages and logics. We describe our tool, implemented in OCaml, which parses this syntax, and translates it to a Coq library that includes definitions and hints for aiding automated proof in the Hybrid system. Hybrid itself is implemented in Coq, and designed specifically to reason about such formal systems. Given an input specification, the library that is automatically generated by our tool imports the general Hybrid library and adds definitions and hints for aiding automated proof in Hybrid about the specific programming language or logic defined in the specification. This work is part of a larger project to compare reasoning in systems supporting HOAS. Our current work focuses on Hybrid, Abella, Twelf, and Beluga, and the specification language is designed to be general enough to allow the automatic generation of libraries for all of these systems from a single specification.

Traditionally, practitioners use formal methods pre-dominately for one half of the quality-assurance process: verification (do we build the software right?). The other half - validation (do we build the right software?) - has been given comparatively little attention. While verification is the core of refinement-based formal methods, where each new refinement step must preserve all properties of its abstract model, validation is usually postponed until the latest stages of the development, when models can be automatically executed. Thus mistakes in requirementsor in their interpretation are caught too late: usually at the endof the development process. In this paper, we present a novelapproach to check compliance between requirements and theirformal refinement-based specification during the earlier stages ofdevelopment. Our proposed approach - "validation obligations"- is based on the simple idea that both verification and validationare an integral part of all refinement steps of a system.

A class dictionary defines all data structures that appear in a program as well as a language for describing data specified by the data structures. We demonstrate that class dictionaries are ideal for simplifying object-oriented programming. Our class dictionary-based approach to object-oriented programming is independent of any particular programming language, so it is applicable to a large variety of object-oriented systems. The experience in designing and using over one hundred class dictionaries has resulted in a set of useful design techniques. This novel approach to object-oriented programming makes interesting links between language design, data structure design, and data-base design.

The ubiquity of multicore computers has forced programming language designers to rethink how languages express parallelism and concurrency. This has resulted in new language constructs and new combinations or revisions of existing constructs. In this line, we extended the programming languages Encore, actor-based, and Clojure, functional, with an asynchronous parallel abstraction called ParT, a data structure that can dually be seen as a collection of asynchronous values (integrating with futures) or a handle to a parallel computation, plus a collection of combinators for manipulating the data structure. The combinators can express parallel pipelines and speculative parallelism. This paper presents a typed calculus capturing the essence of ParT, abstracting away from details of the Encore and Clojure programming languages. The calculus includes tasks, futures, and combinators similar to those of Orc but, implemented in a non-blocking fashion. Furthermore, the calculus strongly mimics how ParT is implemented, and it can serve as the basis for adaptation of ParT into different languages and for further extensions.