1. Bill J. Ellis (bill@macs.hw.ac.uk) Dependable Systems Group Heriot-Watt University (Project page: http://www.macs.hw.ac.uk/~air/clamspark/) Proving Exception Freedom within High Integrity Software Systems

2. Overview High integrity software Proving exception freedom in SPARK Property discovery –Abstract interpretation –Recurrence relations –Interval arithmetic Proofs Conclusions

3. High Integrity Software Software standards encourage or enforce proof for high integrity software: –MOD 00-55: requirements for the procurement of safety critical software in defence equipment. Formal methods and proof mandatory –ITSEC: Information technology security evaluation criteria Formal methods mandatory

4. Praxis and SPARK SPARK is developed by Praxis Critical Systems for building high integrity software: –Formally defined safe subset of Ada –Information and data flow static analysis –Supports proofs of: Partial correctness Exception freedom (No run time errors) SPARK is used in industry: –BAE prove exception freedom (Unnamed project) –Praxis completed SHOLLIS and MULTOS CA –Many more...

5. SPARK Proof In Industry Partial correctness (Rare): –User supplied specification –Proofs usually deep –Very limited automation Exception freedom (Increasingly common): –Automatic specification –Proofs usually shallow –Good (90%) automation via Praxis Simplifier –Remaining 10% may number in the thousands...

6. Exception Freedom in SPARK Storage_Error  (Static memory requirement) Program_Error  Tasking_Error  Constraint_Error  (Some can occur in SPARK) –Access_Check  –Discriminant_Check  –Tag_Check  –Division_Check  –Index_Check  –Range_Check  –Overflow_Check  Proving exception freedom in SPARK is proving variables stay within legal bounds

7. Example Code subtype Index is Integer range 0.. 9; type D is array (Index) of Integer; R:=0; For I in Index loop if D(I) >= 0 and D(I) <= 100 then R := R + D(I); end if; end loop;

8. Example Code (Exception Freedom Checks) subtype Index is Integer range 0.. 9; type D is array (Index) of Integer; --#check 0>=-32768 and 0<=32767; R:=0; For I in Index loop --#invariant I>=0 and I<=9 and --#forall J in 0..9 D(J)>=-32768 and D(J)<=32767; --#check I>=0 and I<=9; if D(I) >= 0 and D(I) <= 100 then --#check I>=0 and I<=9; --#check R+D(I)>=-32768 and R+D(I)<=32767; R := R + D(I); end if; end loop;

9. Exception Freedom VCs Pre-condition Post-condition Invariant Prove properties hold between between cut points Check... Check... Check... Prove exception freedom VCs using properties

10. Proof Strategy Prove Exception Freedom VCs Discover properties (Typically invariants) Prove properties Fail Try proof again Success!

11. Abstract Interpretation (AI) Evaluate a program, replacing concrete variables with abstract values. –Concrete integer variable: -32768 to +32767 –An abstract integer variable: {-,0,+}. Abstract interpretation provides a framework to reason about programs in the abstract.

12. Example (AI Flowchart) I:=I+1 Invariant N Pre-condition R:=0 I:=0 R:=R+D(I) D(I)  0 and D(I)  100 I=9 Post- condition Loop junction node Simple junction node Normalised form of a SPARK for loop

13. Recurrence Relations Fibonacci sequence: 0, 1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144.. –Recurrence relation: A 0 =0, A 1 =1, A n =A (n-1) +A (n-2) Liner recurrence relations with constant coefficients (LRRCs): –A n =c 1 *A (n-1) +…+c k *A (n-k) +f(n) n  k Only use first powers of previous terms (A (n-1) ^1) Coefficients c k are constants f(n) is a function Can automatically solve LRRCs (and a few other special cases) using: –Mathematica –The Parma University's Recurrence Relation Solver (PURRS)

14. Interval Arithmetic/Algebra A theory for reasoning about bounds. Bounds on x: x  1 and x  5 –Interval: X  =[1, 5], lower: X  =1, upper: X  =5 Operations are defined on intervals: –X  +Y  = [X  +Y , X  +Y  ] –X  -Y  = [X  -Y , X  -Y  ] Example: –[0, 2] + [-4, 6] = [0+(-4), 2+6] = [-4, 8] –[0, 2] - [-4, 6] = [0-6, 2-(-4)] = [-6, 6]

15. Property Discovery Abstract interpretation: –Focus on bounds of variables and arrays. Discover and propagate bounds: –Using code semantics. (Of assignment, test, …) –Exploit semantics of exception freedom. –Use interval algebra and proof planning. Loop junction nodes (Invariant discovery): –Exploit recurrence relation solvers. –Replace ‘n’ with program variables.

16. Example (Variable R) I:=I+1 Invariant N Pre-condition R:=0 I:=0 R:=R+D(I) D(I)  0 and D(I)  100 I=9 Post- condition R  :[min(R), max(R)] R  :[0,0] D [0,0] :[0, 100] R  :[(R (n-1) )  +(D(0)) , ((R (n-1) )  +(D(0))  ] R  :[(R (n-1) )  +0, ((R (n-1) )  +100] R  :[(R (n-1) )  +(D(I)) , ((R (n-1) )  +(D(I))  ] R  :merge([(R (n-1) )  +0, (R (n-1) )  +100], [0, 0])

17. Example (Variable R) Solve lower: R n = R (n-1) +0 R n =R 0  0 R  :merge( [(R (n-1) )  +0, (R (n-1) )  +100], [0, 0]) R  :[0, 0] Returning from first iteration Arriving at the loop Starting second iteration... Solve upper: R n = R (n-1) +100 R n =R 0 + 100*n  0 + 100*n  100*n R  :merge([0, 100*n], [0, 0]) R  :[0, 100*n]

18. Invariant Discovery (Eliminate n) Express n in terms of I: I=n  n=I Substitute n for I in R: R  :[0, 100*I] Properties for R R  0 and R  100*I R  :[0, 100*n] I  :[n,n] | {exit([min(I), 9]) or exit([10, max(I)])} Properties for I I  0 and I  9 Some details... Stabilised abstract values for R and I at the invariant Invariant N

19. Example (Discovered invariant) subtype Index is Integer range 0.. 9; type D is array (Index) of Integer; --#check 0>=-32768 and 0<=32767; R:=0; For I in Index loop --#invariant I>=0 and I =0 and R<=100*I and --#forall J in 0..9 D(J)>=-32768 and D(J)<=32767; --#check I>=0 and I<=9; if D(I) >= 0 and D(I) <= 100 then --#check R+D(I)>=-32768 and R+D(I)<=32767; --#I>=0 and I<=9; R := R + D(I); end if; end loop;

20. And the proofs? Invariant property VCs: –Rippling reduces VC to a residue Prove residue using proof planning Exception freedom VCs: –Middle-out reasoning? –‘Look ahead’ using interval algebra?

21. NuSPADE Implementation (Underway…) Light weight SPARK Parser Subprogram Spider VCs SPARK code Rule files Proof Planne r SPARK structure Subprogram Details Method: Rippling Method: Abstracting to bounds Praxis Examiner Add new properties to code Proof scripts CLAM

22. Related Work RUNCHECK (Steven M. German) (1981) –Proves exception freedom VCs for Pascal –Uses a few rewrite rules (7) to solve recurrence relations as a final stage –Does not exploit program context –Limited treatment of arrays (Considered array initialisation) Abstract Interpretation (Patrick Cousot, Radhia Cousot) (1976) –Is algorithmic and always generates correct results –Good automatic linear property generation for programs with linear assignments and no arrays –Used for compiler optimisation, exception detection, program documentation, program visualisation...

23. Conclusions Abstract Interpretation (Framework) + Interval Algebra (Theory) + Recurrence Relations (Off the shelf tools) + Proof Planning (Light reasoning) = Property generation for exception freedom Properties + Rippling (For invariants) + Proof Planning (Suitable methods) = Automated exception freedom proof Note: Is not complete -- Can fail!

24. EOF