1. Certifying Intermediate Programming Zhaopeng Li 2008-8-4

2. Outline Big Picture Related Work What To Do and Open Problems

3. Big Picture Goal Certifying System Software Method Hoare-style Program Verification

4. Related Work CAP / SCAP / … / OCAP / … Separation Logic / Smallfoot / SLAyer Spec# (Boogie, Z3, Terminator … ) And more …

5. Related Work (cont.) Main shortcomings of non-CAPs Not so expressive logic Only prove simple properties of programs Not support system level certification well No solid proofs Using decision procedures automated theorem provers But automation is one of their strongpoint.

6. Related Work (cont.) Main shortcomings of CAPs Assembly level code and proof Unfriendly to programmers hard to figure out and debug specifications Costly proof development Lengthy proof, and not easy to provide Nearly impossible to be applied to practice

7. What to do Based on methods of CAPs Propose framework that supports: Source (high-level)/intermediate language Expressive logic Automated or semi-automated proof development Connection with low-level CAP-like framework

8. What to do : language Which language to choose? Source language Intermediate language First-step choice : Intermediate language A better try to overcome shortcomings of CAPs Easy to connect with low-level CAPs

9. What to do : program logic Assertion language Asserts on the program state Heap, Store, Data Stack, … Uses Separation logic connectives ? Deal with program with mutable shared structures Specification Traditional pre- and post-conditions {P}C{Q} Guarantee from SCAP {g}C Single two-state-related pre-condition from FCAP {p}C Inference rules Depend on what specification we choose

10. What to do : proof method Proof Method VCGen and Automated Theorem Prover Coq and Semi-automated Proof Combination? Techniques to split VC

11. What to do : connect with CAP Translation Language Specification Proof Generation Specification Proof

12. Open Problems What kind of Language? Key features: Assignment statement Function call and return Goto statement Explicit or implicit data stack? And more? What kind of Logic? Assertion Specification Traditional pre- and post-conditions Guarantee from SCAP Single two-state-related pre-condition from FCAP

13. Open Problems (cont.) How to connect with CAP? Translation Generation Build higher framework based this one? C language …

14. Discussion Any suggestions? Or any options, ideas?

15. Thanks!