1. © Andrew IrelandDependable Systems Group

2. © Andrew IrelandDependable Systems Group Proof Automation for the SPARK Approach to High Integrity Ada Andrew Ireland Computing & Electrical Engineering Heriot-Watt Univeristy Edinburgh

3. © Andrew IrelandDependable Systems Group Executive Summary Funded by the EPSRC Critical Systems programme ( GR/R24081 ) in collaboration with Praxis Critical Systems Julian Richardson (Co-investigator) and Bill Ellis (Research Associate) Investigate the role of proof planning within the SPARK approach to high integrity Ada

4. © Andrew IrelandDependable Systems Group Outline Background and basic approach Proposed verification architecture Initial investigation into proof automation Future work

5. © Andrew IrelandDependable Systems Group Program Verification Long history dating back to 70s, Wegbreit, German, Katz & Manna, … Theorem proving and heuristic components were kept separate Adopting a proof planning approach integrates high-level theorem proving and heuristic components

6. © Andrew IrelandDependable Systems Group Ada Verification Systems ANNA: Stanford University PAVG Penelope: Odyssey Research Associates MALPAS: TA Group (RSRE Malvern) SPARK: Praxis Critical Systems (PVL)

7. © Andrew IrelandDependable Systems Group Praxis Critical Systems Internationally leading within the sector Aerospace, Defence, Transportation, Finance, Energy and Utilities. Boeing, Lockheed-Martin, CAA, FAA, QinetiQ (DERA), Westinghouse Signals, MONDEX,...

8. © Andrew IrelandDependable Systems Group SPARK Projects SHOLIS: Ship Helicopter Operating Limits Instrumentation System, UK MoD’s first Def Standard 00-55 project C130J: Lockheed Martin military transport aircraft MONDEX: International smart card security, developed to ITSEC E6 standard

9. © Andrew IrelandDependable Systems Group The SPARK Language A subset of Ada that eliminates potential ambiguities and insecurities Specification supported via code level annotations

10. © Andrew IrelandDependable Systems Group Static Analysis Data flow analysis: checks basic integrity constraints, e.g. definition-usage Information flow analysis: checks various interdependencies via program annotations Formal verification: generates verification conditions (VCs) based upon program annotations and SPARK semantics

11. © Andrew IrelandDependable Systems Group The SPARK Tools SPADE Simplifier SPARK Examiner SPADE Proof Checker proof code VCs user rules (lemmas) path functions flow analysis feedback

12. © Andrew IrelandDependable Systems Group Clam-Oyster plannerchecker tactic conjectures theory proof user

13. © Andrew IrelandDependable Systems Group NuSPADE plannerchecker cmd VCs conjectures theory proof user

14. © Andrew IrelandDependable Systems Group NuSPADE: High-Level Aims Integrity: only modify the SPADE proof state via SPADE commands Compatibility: preserve SPADE at its core Transparency: provide users with the look- and-feel of a SPADE session

15. © Andrew IrelandDependable Systems Group Proof Plans ripple fertilize simplify induction ripple fertilize simplify tautology ind-stratinv-strat

16. © Andrew IrelandDependable Systems Group Polish Flag Problem --# pre (for all I in IndexRange => (Flag(I)=Red or Flag(I)=White)) --# post for some P in Integer range (Flag'First).. (Flag'Last+1) => --# ((for all Q in Integer range Flag'First..(P-1) => (Flag(Q)=Red)) and --# (for all R in Integer range P..Flag'Last => (Flag(R)=White)));

17. © Andrew IrelandDependable Systems Group Loop Invariant --# assert Flag'First<=I and --# J<=(Flag'Last+1) and --# I<=J and --# (for all Q in Integer range Flag'First..(I-1) => (Flag(Q)=Red)) and --# (for all R in Integer range J..Flag'Last => (Flag(R)=White)); IFlag'FirstFlag'LastJ

18. © Andrew IrelandDependable Systems Group SPARK Code procedure Partition_Section(Flag: in out ArrayOfColours) is subtype JustBiggerRange is Integer range Flag'First.. Flag'Last+1; I: JustBiggerRange; J: JustBiggerRange; T: Colour; begin I:=Flag'First; J:=Flag'Last+1; loop --# assert Flag'First<=I and --# J<=(Flag'Last+1) and --# I<=J and --# (for all Q in Integer range Flag'First..(I-1) => (Flag(Q)=Red)) and --# (for all R in Integer range J..Flag'Last => (Flag(R)=White)); exit when I=J; if Flag(I)=Red then I:=I+1; else J:=J-1;T:=Flag(I); Flag(I):=Flag(J); Flag(J):=T; end if; end loop; end Partition_Section loop … if … else J:=J-1; T:=Flag(I); Flag(I):=Flag(J); Flag(J):=T; end if; end loop; Flag(I)=White

19. © Andrew IrelandDependable Systems Group procedure_partition_section_3. H1: indexrange__first <= i. H2: j <= indexrange__last + 1. H3: i <= j. H4: for_all (q_: integer, ((q_ >= indexrange__first) and (q_ (element(flag, [q_]) = red)). H5: for_all (r_: integer, ((r_ >= j) and (r_ (element(flag, [r_]) = white)). H6: not (i = j). H7: not (element(flag, [i]) = red). -> C1: indexrange__first <= i. C2: j - 1 <= indexrange__last + 1. C3: i <= j - 1. C4: for_all (q_: integer, ((q_ >= indexrange__first) and (q_ element(update(update(flag, [i], element(flag, [j - 1])), [j - 1], element(flag, [i])), [q_]) = red)). C5: for_all (r_: integer, ((r_ >= j - 1) and (r_ (element(update(update(flag, [i], element(flag, [j-1])), [j-1], element(flag, [i])), [r_]) = white)). Verification Condition

20. © Andrew IrelandDependable Systems Group Given Goal Ripple plan+ reduction= difference identification

21. © Andrew IrelandDependable Systems Group

22. © Andrew IrelandDependable Systems Group

23. © Andrew IrelandDependable Systems Group

24. © Andrew IrelandDependable Systems Group Rewrite Rules

25. © Andrew IrelandDependable Systems Group 1.there exists a subterm T of the goal formula that contains a wave-front 2.there exists a wave-rule that matches T 3.any wave-rule conditions follow from the proof context 4.Resulting inward directed wave-fronts are potentially cancellable Ripple Preconditions Note: Stronger decision procedure required for 3

26. © Andrew IrelandDependable Systems Group Speculative Loop Invariant --# assert Flag'First<=P and --# P<=(Flag'Last+1) and --# (for all Q in Integer range Flag'First..(P-1) => (Flag(Q)=Red)) and --# (for all R in Integer range P..Flag'Last => (Flag(R)=White)); PFlag'FirstFlag'Last

27. © Andrew IrelandDependable Systems Group Proof Failure Given Goal

28. © Andrew IrelandDependable Systems Group Failure Analysis Blocked wave-front Failed precondition Matching wave-rule 3. any wave-rule conditions follow from the proof context

29. © Andrew IrelandDependable Systems Group Productive Use Of Failure Generalization Case split Revise Induction Lemma speculation Precondition Patch X X X X 4321

30. © Andrew IrelandDependable Systems Group Proof Patch Find minimal instantiation for P such that i and (j-1) lie out side r, i.e. P becomes j Ripple plan applicable to revised invariant conjecture

31. © Andrew IrelandDependable Systems Group Range Splitting Proof Critic While the goal concerned with “white” gives rise to P = j, the complementary “red” goal gives rise to P = i This inconsistency suggests the required 3-way range split, i.e. i j

32. © Andrew IrelandDependable Systems Group Extending Critics Mechanism Build upon current capability to analyse failures over multiple branches Integrate a constraint solving capability Develop a bottom-up invariant generation capability - also important for reasoning about the absence of run-time errors.

33. © Andrew IrelandDependable Systems Group Future Work Complete first prototype of NuSPADE Adapt existing proof plans for SPADE Develop corresponding generic proof cmd templates (tactics) Extend critics mechanism Address proof management issues Investigate industrial strength case studies