Download presentation

Presentation is loading. Please wait.

Published byGunner Hall Modified over 3 years ago

1
Automated Verification with HIP and SLEEK Asankhaya Sharma

2
Goal Design and build software that is correct by construction Needed: Automatic tools for establishing software correctness Such tools can – Search for standard problems like memory access violations or array index out of bounds – Check if a program does what it is supposed to do with respect to a specification

3
Why a Need for Automatic Tools?

4
Let the tool fill in the details

5
A Tale of Two Tools HIP – Automatically applies a given set of Hoare rules SLEEK – Discharges the proof obligations resulting from the rule of consequence and the frame rule Under development since 2006 – 180k lines of OCaml – Currently 6 PhD students; 3 graduated

6
Overview code verifier (HIP) separation logic prover (SLEEK) Pre/Post PredicatesLemmas Code range of pure provers … Omega, MONA, Isabelle, Coq, SMT, Redlog, MiniSAT, Mathematica

7
An Example – List Length struct node{ int val; struct node* next; }; int length(struct node* p) { if(p == NULL) return 0; else return 1 + length(p->next); }

8
List Predicate Example of Acyclic List : list(x ) x null pointer to memoryspatial conjunction

9
Syntactic Abbreviation (ASCII) list == self=null or self::node _, r r::list implicit existential instantiation

10
Verify with Shape Property struct node{ int val; struct node* next; }; /*@ list<> == self=null or self::node *q::list<>; */ int length(struct node* p) /*@ requires p::list<> ensures p::list<>; */ { if(p == NULL) return 0; else return 1 + length(p->next); } Predicate Definition Method Pre and Post condition Memory Safety

11
With Size list n == self=null & n=0 or self::node _, r r::list n-1 inv n >= 0 parameter on length of linked list predicate invariant x::ll 5 x null

12
Verify with Shape and Size int length(struct node* p) /*@ requires p::list ensures p::list & res=n; */ { if(p == NULL) return 0; else return 1 + length(p->next); } Memory Safety Length of the List

13
With Size and Bag list n,B == self=null & n=0 & B={} or self::node v, r r::list n-1,B1 & B = B1 U {v} inv n >= 0 & n=|B|

14
Verify with Shape, Size and Bag int length(struct node* p) /*@ requires p::list ensures p::list & res=n; */ { if(p == NULL) return 0; else return 1 + length(p->next); } Memory Safety Length of the List Bag of Values

15
Automated Verification int length(struct node* p) /*@ requires p::list ensures p::list & res=n; */ { if(p == NULL) return 0; // p=null & n = 0 & res = 0 |- p::list & res = n // p::ll & p!=null |- p::node // p::node * q::ll & p!=null & q = r |- r::ll else return 1 + length(p->next); // p::node * q::ll & x!=null & res = 1 + n – 1 |- p::ll & res = n } Pre condition Checking Post condition Checking Memory dereference Checking

16
SLEEK Automatic Checking of Entailment Custom decision procedure for the spatial fragment (Separation Logic) – Handles user-defined data structures and inductive predicates Uses off-the-shelf provers to discharge: – Linear Arithmetic (using Omega) Also available as a tactic in Coq – Bag Expressions (using MONA) Sound but incomplete

17
Numerical Examples for SLEEK Checking implications with integer constraints: checkentail x > 5 |- x > 0. checkentail x > 5 |- x < 0. checkentail x > 5 |- x > 6. checkentail x > 1 & y > 1 & r = x + y |- r > 3. SLEEK uses Omega for these examples Valid. InValid. Valid.

18
List Examples for SLEEK checkentail x::node |- x::list. checkentail x::node |- x::list & B = {17}. checkentail x::node * y::list. checkentail x::list |- x::node. Valid. InValid. Valid.

19
HIP Automatic checking of pre/post for methods – Handle conditional, loops, methods – With arrays, data structures, dynamic memory allocation – Supports Multiple pre/post specifications, structured specifications, termination specifications Sound but incomplete Automated with the help of SLEEK

20
Append Example with HIP What should be the specification for the following method ? void append(node* x, node* y) requires ? ensures ? { if(x->next==NULL) x->next=y; else append(x->next,y); }

21
Append Example with HIP Is the following specification which aims to guarantee memory safety correct? void append(node* x, node* y) requires x::list<> * y::list<> ensures x::list<> { if(x->next==NULL) x->next=y; else append(x->next,y); } No, null pointer dereference possible

22
Append Example with HIP Correct specification for safety void append(node* x, node* y) requires x::list<> * y::list<> & x!=null ensures x::list<> { if(x->next==NULL) x->next=y; else append(x->next,y); }

23
Append Example with HIP With size and bag properties void append(node* x, node* y) requires x::list * y::list & x!=null ensures { if(x->next==NULL) x->next=y; else append(x->next,y); } x::list

24
Multiple Specifications Same method may be called in different calling contexts Verify using different specifications for each scenario Which sorting algorithm may require an append function for two sorted lists ? – Quick Sort (and Merge Sort)

25
With Bag and Sortedness

26
Verify with Multiple Specifications void append(node* x, node* y) requires x::list * y::list & x!=null ensures x::list requires x::lsort * y::lsort & x!=null & ∀ a ∈ B1. ∀ b ∈ B2. a { if(x->next==NULL) x->next=y; else append(x->next,y); }

27
List Segment with Size lseg p,n == self=p & n=0 or self::node _, r r::lseg p,n-1 inv n >= 0 x y x::lseg y,3 y::lseg x,2

28
Circular List with Size x r::lseg x,2 r x::clist 3 clist n == self::node _, r r::lseg self,n-1 inv n >= 1

29
Use of Multiple Pre/Post void append(node* x, node* y) requires x::list & x != null & x = y ensures requires x::list & x != null ensures { if(x->next==NULL) x->next=y; else append(x->next,y); } x::clist x::lseg

30
Binary Search Tree How do we express a binary search tree ? tree<> == self=null or self::node * l::tree<> * r::tree<> Shape Property for Tree

31
Binary Search Tree bst == self=null & B = {} or self::node * l::bst * r::bst & B = {v} U B1 U B2 & ∀ w ∈ B1. v>=w & ∀ w ∈ B2. v<=w 5 37 14 Sortedness property

32
AVL Tree How do we specify height balanced trees ? avl == self=null & B = {} & h = 0 or self::node * l::avl * r::avl & B={v}UB1UB2 & ∀ w ∈ B1.v>=w & ∀ w ∈ B2.v<=w & h = 1 + max(h1,h2) & h2<=h1+1 & h1<=h2+1

33
Conclusions HIP and SLEEK Verification System – Automated Given pre/post and loop invariants – Modular and scalable Each method verified independently – Expressive From shape, size, bag properties towards functional correctness Total correctness with Termination and Non- Termination proving

34
Perspectives Hardware community has accepted verification in their design phase Verified software is the future for guarantying high assurance and reliability Many challenges remain on scalability, automation, expressivity, concurrency, inference and higher order programs

35
Questions? We will try out some examples in Lab tomorrow using TeachHIP TeachHIP is a Web Interface to – Try out HIP and SLEEK without installing any software – Available at http://loris-7.ddns.comp.nus.edu.sg/~project/TeachHIP/ http://loris-7.ddns.comp.nus.edu.sg/~project/TeachHIP/ Contact – asankhaya@nus.edu.sg

36
Further Reading Chin, Wei-Ngan, Cristina David, Huu Hai Nguyen, and Shengchao Qin. "Automated verification of shape, size and bag properties via user-defined predicates in separation logic." Science of Computer Programming 77, no. 9 (2012): 1006-1036.

Similar presentations

OK

Copyright © 2006 The McGraw-Hill Companies, Inc. Programming Languages 2nd edition Tucker and Noonan Chapter 18 Program Correctness To treat programming.

Copyright © 2006 The McGraw-Hill Companies, Inc. Programming Languages 2nd edition Tucker and Noonan Chapter 18 Program Correctness To treat programming.

© 2018 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google