Automated creation of verification models for C-programs Yury Yusupov Saint-Petersburg State Polytechnic University The Second Spring Young Researchers Colloquium on Software Engineering Saint-Petersburg May Prof. Vsevolod Kotlyarov Motorola Software Center

SYRCoSE Introduction Problems, goals, and solution One of the features of modern design – software component reuse Problems: how to reuse legacy code? Goals: to quickly understand legacy components for their reuse in a new product Solution: apply verification technologies  Automatic modeling of a legacy component at a higher abstraction level  Formal verification of model properties

SYRCoSE Verification process Requirements Implementation Formalization: Analysis of program or requirements and creation of model in formal language System properties Verification: Searching inconsistencies and checking system properties System model Program system Verdict: the system does or does not meet its requirements

SYRCoSE Types of errors found with verification Documentation inconsistencies – typos, missing or incorrect references, absence of definitions, etc. Transition inconsistency (non-determinism) – non- deterministic behavior. Safety violations – prohibited events may happen, security violation (unauthorized usage of a system) is a particular case. Deadlocks – incomplete specifications. Unreachability – unreachable (never used) system states. Certain run-time errors – like an uninitialized attribute usage or out of bounds error – lists overflow, incorrect array indexing, enumerated type overflow.

SYRCoSE VRS-based verification process System basic protocols VRS reqs formalization Behavior properties verdict verification correction Behavior formal model in form of System can be presented with requirements, source program code, or UML model

SYRCoSE Basic protocol – a simple MSC diagram, which specifies: pre-condition - the state of the system where the system shall perform some activity process part - the activity itself (transmission of a message or performance of an action) post-condition - the state of the system after the activity is performed pre-condition post-condition process part message action

SYRCoSE Goal of the work Reqs semi-automatic basic protocols formalization UML C-program automatic Source system representation Behavior formal model in form of basic protocols basic protocols manual Problem: high efforts for manual formalization of source code Goal: reduce manual efforts through automation

SYRCoSE Proposed solution Klocwork™ as a tool for formalization Static analysis –Control flow visualization –Graphical view of a program structure –… Automated analysis of C, C++, and Java source code – checkers –Detect a wide variety of code defects and security vulnerabilities –Klocwork™ allows to write additional C and C++ code checkers –2 application programming interfaces (API) Code style analysis (AST – Abstract Syntax Tree) Control and data flow (MIR – Medium-level Intermediate Representation) Klocwork provides automated source code analysis and creation of intermediate views of code

SYRCoSE Klocwork™ extensibility feature Defect detection with checkers defects config enable/disable custom defect custom checker Source code defects are reported source file is analyzed, defects are detected Klocwork™ Klocwork + custom checker = instrument for C code analysis and translation into basic protocols

SYRCoSE Custom checker: realization Tree traversal module Nodes handling module: - expression - function call - if-then-else - for - while - switch-case - … Basic protocols Pre-condition Process part Post-condition Abstract Syntax Tree Klocwork interface Checker interface Source code Code analysis and AST creation Module of basic protocol generation

SYRCoSE The autoformalization feature based on Klocwork™ toolset BPX (Basic Protocol eXtractor) –plug-in for Klocwork in form of DLL (dynamically loaded library) –~3.1 KLOC in C Input data –Abstract Syntax Trees of source files Output data –Basic protocols in MSC-PR (Phrase Representation) format Reflect usage and change of variables Reflect function calls Preserve program control flow Represent program semantics Preserve the project structure Automatic extraction of basic protocols from Klocwork AST

SYRCoSE Simple example … int function() { int a,b,c; c = 3; if ( c>5 ) {a = 1; } b = a; return 0; } … Basic protocols automatically extracted from a C-code

SYRCoSE Verification of C-programs with extended VRS technology C program VRS reqs formalization Behavior properties verdict verification correction Behavior formal model in form of BPX KlocWork™ basic protocols

SYRCoSE Creation of multilevel models and architecture recovering … ………… Forward engineering Reverse engineering Function level File level System High-level system model Source code module level

SYRCoSE First experiment results for C-projects Size of project source code Time Manual approach small mediumlarge 1x 10x Automatic approach Decreasing: –formalization time –manual efforts –errors in program model (human factor) Simplifying: –program logic understanding –verification process Formalization time reduction ~10x vs manual formalization

SYRCoSE Further work Verification of large C-projects with VRS technology –Investigating the scalability limits –Creation multilevel behavior models Generation of multilevel behavior scenarios Adaptation to Java code –Reusing AST traversal and basic protocol generation algorithms for JAVA checker creation

SYRCoSE THANK YOU Q&A