Verifying Custom Synchronization Constructs Using Higher-Order Separation Logic

Separation logic is a recent approach to the analysis of pointer programs in which resource separation is expressed with a logical connective in assertions that describe the state at any given point in the program. We extend this approach to express properties of memory separation between different points in the program, and present an algorithm for determining independences between program statements which can be used for parallelization.KeywordsAction TraceSymbolic ExecutionSymbolic StateDenotational SemanticPrimitive ActionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

SuSLik is a program synthesizer that generates provably safe pointer-manipulating programs automatically from high-level specifications. More precisely, the input to SuSLik is a pair of assertions in separation logic, which describe what the heap looks like before and after executing the program. Using only this information, SuSLik is able to synthesize a wide range of operations on linked data structures, such as singly- and doubly-linked lists, sorted lists, and trees. In this tutorial you will get hands-on experience with SuSLik (bring your laptops!) and learn how synthesis is made possible by a novel proof system we call synthetic separation logic. Experience with separation logic and program synthesis is helpful but not required.

Much work in formal verification of low-level systems is based on one of two approaches: refinement or separation logic. These two approaches have complementary benefits: refinement supports the use of programs as specifications, as well as transitive composition of proofs, whereas separation logic supports conditional specifications, as well as modular ownership reasoning about shared state. A number of verification frameworks employ these techniques in tandem, but in all such cases the benefits of the two techniques remain separate. For example, in frameworks that use relational separation logic to prove contextual refinement, the relational separation logic judgment does not support transitive composition of proofs, while the contextual refinement judgment does not support conditional specifications. In this paper, we propose Conditional Contextual Refinement (or CCR, for short), the first verification system to not only combine refinement and separation logic in a single framework but also to truly marry them together into a unified mechanism enjoying all the benefits of refinement and separation logic simultaneously. Specifically, unlike in prior work, CCR’s refinement specifications are both conditional (with separation logic pre- and post-conditions) and transitively composable. We implement CCR in Coq and evaluate its effectiveness on a range of interesting examples.

The incorrect use of pointers, such as null pointer dereference and memory leak, is one of the most common sources of program errors. In this talk, I will describe our techniques for automatically verifying the absence of such pointer errors, which we have been developing for the past three years, based on a new program logic called separation logic. This talk has two goals. The first is to show, by demo, the current status of techniques for automatically verifying pointer safety. The second is to present interesting instances of the interplay between automatic verification and program logic. In order to reduce the complexity of formal (manual) verification of programs, separation logic has unusual proof rules that exploit programming disciplines used by skilled software developers. I will explain how such rules have been used to improve the performance of our automatic verification techniques. Regarding the influence of automatic verification on program logic, I will describe new types of theorem proving questions on separation logic that were motivated by automatic verification.

VeriFast is a sound modular formal verification tool for C and Java programs. Based on separation logic and using symbolic execution, VeriFast can verify not only memory safety of programs but also full functional correctness. Formal verification is a powerful way of analyzing code, but not yet widely used in practice. Source code has to be annotated with formal specification mostly in the form of function preconditions and postconditions. In this paper, we present Automated VeriFast which is a new extension or an automation layer that lies on top of VeriFast that, given a partially annotated program, offers to attempt to incrementally improve the annotations, e.g. by inferring a fix to the specification of a program fragment that fails to verify. Our thesis is that such small, interactive inference steps will have practical benefits over non-interactive specification inference approaches by allowing the user to guide the inference process and by being simpler and therefore more predictable and diagnosable.

In this paper, we propose and solve sequential coupling models for molecular dissociation of the Rice-McLaughlin-Jortner (RMJ) type in which the usual assumption of constant coupling among the states is replaced by an assumption of random coupling. The counter-intuitive nonsequential branching behavior found previously for constant coupling is eliminated and we find completely sequential time dependence which obeys the phenomenological rate equations. We isolate the features of constant vs random coupling which give rise to the branching vs sequential behavior in terms of simple physical models and considerations of the coherence properties of the wavefunction. It is concluded that constant coupling is inappropriate for most molecules, and that the random coupling assumption has the effect of validating the use of a random phase approximation which in turn causes the molecule to decay as if each quasibound molecular level is coupled to its own continuum. Our conclusions do not change when we solve an extended model with many continua, with each molecular level coupled to each continuum.

In the recent past, there has been a steady growth of the market for consumer embedded devices such as cell phones, GPS and portable multimedia systems. In embedded systems, digital, analog and software components are combined on a single chip, resulting in increasingly complex designs that introduce richer functionality on smaller devices. As a consequence, the potential insertion of errors into a design becomes higher, yielding an increasing need for automated analog and mixed-signal validation tools. In the purely digital setting, formal verification based on properties expressed in industrial specification languages such as PSL and SVA is nowadays successfully integrated in the design flow. On the other hand, the validation of analog and mixed-signal systems still largely depends on simulation-based, ad-hoc methods. In this tutorial, we consider some ingredients of the standard verification methodology that can be successfully exported from digital to analog and mixed-signal setting, in particular property-based monitoring techniques. Property-based monitoring is a lighter approach to the formal verification, where the system is seen as a “black-box” that generates sets of traces, whose correctness is checked against a property, that is its high-level specification. Although incomplete, monitoring is effectively used to catch faults in systems, without guaranteeing their full correctness.In the first part of the tutorial, we present a technique for property-based analog and mixed-signal monitoring. In the heart of the framework lies signal temporal logic STL, that is a high-level specification language allowing to express transient properties of analog, mixed and timed signals. STL is an extension of the real-time metric interval temporal logic MITL, where one can specify temporal relations between relevant “events” in the continuous signals that are captured using numerical predicates. We then present procedures for automatic translation of arbitrary STL specifications into monitors, i.e. programs that check the correctness of a set of simulation traces with respect to the given property. We introduce analog monitoring tool AMT that implements the presented monitoring techniques and illustrate the usefulness and the limitations of the approach on two industrial case studies, considering properties of a FLASH memory cell and a DDR2 memory interface.Although the STL framework implemented in AMT provides a theoretical basis for analog and mixed-signal verification, it is not adequate for industrial-strength verification. The DDR2 example shows that STL lacks the expressiveness to specify complex timing relationships required by industrial designs. The STL framework provides real-time extensions to linear temporal logic, but it does not provide extensions to the regular expressions present in both PSL and SVA. However, the industrial interest in the methodology resulted in the creation of the A-SVA sub-committee of the Accellera Verilog-AMS committee that is investigating extending SVA with features that would enable industrial-strength property-based monitoring of analog and mixed-signal systems. This includes in particular real-time regular expressions, local variables, and requirements for the properties to access accurate continuous values. The committee have agreed upon a preliminary syntax and semantics for real-time regular expressions and local variables. They are in the process of integrating the real-time regular expressions with the digital and real-time properties. These results are expected to be integrated into the next revisions of Verilog-AMS and SystemVerilog.

Software and hardware are increasingly being formally verified against specifications, but how can we verify the specifications themselves? This paper explores what it means to formally verify a specification. We solve three challenges: (1) How to create a secondary, higher-level specification that can be effectively reviewed by processor designers who are not experts in formal verification; (2) How to avoid common-mode failures between the specifications; and (3) How to automatically verify the two specifications against each other. One of the most important specifications for software verification is the processor specification since it defines the behaviour of machine code and of hardware protection features used by operating systems. We demonstrate our approach on ARM's v8-M Processor Specification, which is intended to improve the security of Internet of Things devices. Thus, we focus on establishing the security guarantees the architecture is intended to provide. Despite the fact that the ARM v8-M specification had previously been extensively tested, we found twelve bugs (including two security bugs) that have all been fixed by ARM.

Industry is increasingly dependent on distributed systems. In order to prevent the users having to deal with unnecessary details, experts are going for languages specifically created for distributed system domain. Such systems are often considered to be complex. Assuring the correctness of these systems with traditional code reviews and testing is difficult as these verification methods deal with the high-level specification of the system. In order to prove that high-level specification is correctly implemented at the lower level, the compiler, which performs the translation, needs to be verified. Using formal methods, based on mathematics and formal logic, specification and verification have been discussed as a means of a solution. This paper identifies and analyses the available formalisms and techniques for verifying the correct operation of parallel and distributed systems.

Programs manipulating mutable data structures with intrinsic sharing present a challenge for modular verification. Deep aliasing inside data structures dramatically complicates reasoning in isolation over parts of these objects because changes to one part of the structure (say, the left child of a dag node) can affect other parts (the right child or some of its descendants) that may point into it. The result is that finding intuitive and compositional proofs of correctness is usually a struggle. We propose a compositional proof system that enables local reasoning in the presence of sharing.While the AI frame elegantly captures the reasoning required to verify programs without sharing, we contend that natural reasoning about programs with sharing instead requires an answer to a different and more challenging AI problem, the problem: reasoning about the indirect consequences of actions. Accordingly, we present a RAMIFY proof rule that attacks the ramification problem head-on and show how to reason with it. Our framework is valid in any separation logic and permits sound compositional and local reasoning in the context of both specified and unspecified sharing. We verify the correctness of a number of examples, including programs that manipulate dags, graphs, and overlaid data structures in nontrivial ways.

Accurately representing the structure and manipulation of heap-allocated data structures is a key challenge for automatic verification of nontrivial code. Capturing this information is central to proving properties such as the absence of invalid memory accesses (for instance, deallocating memory twice or dereferencing dangling or NULL pointers), the absence of memory leaks, and data-structure integrity properties (for instance, that a doubly-linked list structure is properly linked in both directions).

Although all behaviors occur over time, it is relatively uncommon for the temporal order or sequence of behaviors to be a matter of great interest in psychological research. Thus sequence, an intrinsic feature of all behavioral phenomena, has been largely ignored in attempts to explore and understand these phenomena. It is particularly noteworthy that this oversight occurs in research on social interaction, where investigators often claim to study reciprocity, patterns, processes, systems, and cycles. Rather than examine the sequential dependencies among behaviors that are strongly implied by these terms, simple rates of behavior are often studied instead. This practice is deficient because it fails to capture the dynamic qualities of social interaction and also promotes inferential error: A behavior that emerges from the combined actions of two individuals is often viewed as being solely determined by the one individual exhibiting the behavior. More generally, “efforts to analyze given actions while ignoring their interactive context seem misdirected, error prone, and noise generating” (Duncan, Kanki, Mokros, & Fiske, 1984, p. 1346).

Modern embedded systems integrate more and more complex functionalities. At the same time, the semiconductor technology advances enable to increase the amount of hardware resources on a chip for the execution. Massively parallel embedded systems specifically deal with the optimized usage of such hardware resources to efficiently execute their functionalities. The design of these systems mainly relies on the following challenging issues: first, how to deal with the parallelism in order to increase the performance; second, how to abstract their implementation details in order to manage their complexity; third, how to refine these abstract representations in order to produce efficient implementations. This article presents the Gaspard design framework for massively parallel embedded systems as a solution to the preceding issues. Gaspard uses the repetitive Model of Computation (MoC), which offers a powerful expression of the regular parallelism available in both system functionality and architecture. Embedded systems are designed at a high abstraction level with the MARTE (Modeling and Analysis of Real-time and Embedded systems) standard profile, in which our repetitive MoC is described by the so-called Repetitive Structure Modeling (RSM) package. Based on the Model-Driven Engineering (MDE) paradigm, MARTE models are refined towards lower abstraction levels, which make possible the design space exploration. By combining all these capabilities, Gaspard allows the designers to automatically generate code for formal verification, simulation and hardware synthesis from high-level specifications of high-performance embedded systems. Its effectiveness is demonstrated with the design of an embedded system for a multimedia application.

In order to ensure memory properties of an operating system, it is important to verify the implementation of its heap manager. In the case of an existing operating system, this is a difficult task because the heap manager is usually written in a low-level language that makes use of pointers, and it is usually not written with verification in mind. In this paper, our main contribution is the formal verification of the heap manager of an existing embedded operating system, namely Topsy. For this purpose, we develop in the Coq proof assistant a library for separation logic, an extension of Hoare logic to deal with pointers. Using this library, we were able to verify the C source code of the Topsy heap manager, and to find and correct bugs.

Formal verification of complex systems using high-level Petri Nets faces the so-called state-space explosion problem. In the context of Petri nets generated from a higher level specification, this problem is particularly acute due to the inherent size of the considered models. A solution is to perform a symbolic analysis of the reachability graph, which exploits the symmetry of a model.Well-Formed Nets (WN) are a class of high-level Petri nets, developed specifically to allow automatic construction of a symbolic reachability graph (SRG), that represents equivalence classes of states. This relies on the definition by the modeler of the symmetries of the model, through the definition of “static sub-classes”. Since a model is self-contained, these (a)symmetries are actually defined by the model itself.This paper presents an algorithm capable of automatically extracting the symmetries inherent to a model, thus allowing its symbolic study by translating it toWN. The computation starts from the assumption that the model is entirely symmetric, then examines each component of a net to deduce the symmetry break it induces. This translation is transparent to the end-user, and is implemented as a service for the AMI-Net package. It is particularly adapted to models containing large value domains, yielding combinatorial gain in the size of the reachability graph.KeywordsWell-Formed Petri netssymmetry detectionsymbolic model-checkingpartial symmetry