1. © Andrew IrelandDependable Systems Group The Use of Patterns to Guide Code Certification: A Proposal Andrew Ireland School of Mathematical & Computer Sciences Heriot-Watt University Edinburgh

2. © Andrew IrelandDependable Systems Group Outline Context Research hypothesis Basic approach

3. © Andrew IrelandDependable Systems Group Program Proof - Past Foundations: Turing 49, Floyd 67, Hoare 69 Mechanization: King 69, Waldinger & Levitt 74, German & Wegbreit 75, Luckham et al 79, 86, Good et al 84, … Heuristics: Katz & Manna 73, Wegbreit 73, …

4. © Andrew IrelandDependable Systems Group Program Proof - Present Debugging: ESC/Java, … Development: Perfect Developer, SPARK, … Certification: AutoFilter, AutoBayes, Proof Carrying Code, Compliance Toolset, …

5. © Andrew IrelandDependable Systems Group Simulink ClawZ SPARK [ Ada ] S ystems Assurance Group, QinetiQ Simplified Compliance Process code generator high-level model high-level code + VCs

6. © Andrew IrelandDependable Systems Group Hypothesis Domain specific code generation tools give rise to common patterns of program code Common program patterns give rise to common patterns of proof Combining patterns of program and proof provides an effective basis for increasing the automation of code certification

7. © Andrew IrelandDependable Systems Group Proof Patterns Proof Plan = Tactics + Methods + Critics Proof planning: Proof checking: Methods + Critics Tactics Note: proof planning can use meta-variables to delay choice

8. © Andrew IrelandDependable Systems Group Mathematical induction: program verification, synthesis, and optimization; hardware verification; correction of faulty specifications. Non-inductive proof: summing series; limit theorems. Automatic proof patching: conjecture generalization, lemma discovery, induction revision, case splitting, loop invariant discovery. Applications of Proof Plans

9. © Andrew IrelandDependable Systems Group Program Patterns Bottom-up analysis i.e. generation of properties directly from program code that support proof construction Extend bottom-up analysis to include the generation of properties that support proof search

10. © Andrew IrelandDependable Systems Group NuSPADE SPARK Examiner SPARK code VCs AutoGap meta data Proof Planner SPADE Praxis Critical Systems

11. © Andrew IrelandDependable Systems Group Polish Flag Problem --# pre (for all I in IndexRange => (Flag(I)=Red or Flag(I)=White))

12. © Andrew IrelandDependable Systems Group Polish Flag Problem --# pre (for all I in IndexRange => (Flag(I)=Red or Flag(I)=White)) --# post for some P in Integer range (Flag'First).. (Flag'Last+1) => --# ((for all Q in Integer range Flag'First..(P-1) => (Flag(Q)=Red)) and --# (for all R in Integer range P..Flag'Last => (Flag(R)=White))); P

13. © Andrew IrelandDependable Systems Group Loop Invariant --# assert Flag'First<=I and --# J<=(Flag'Last+1) and --# I<=J and --# (for all Q in Integer range Flag'First..(I-1) => (Flag(Q)=Red)) and --# (for all R in Integer range J..Flag'Last => (Flag(R)=White)); I Flag'First Flag'LastJ

14. © Andrew IrelandDependable Systems Group Bottom-Up Analysis Program properties: Flag'First<=I J<=(Flag'Last+1) I<=J Meta-data: index_var(Flag, I) index_var(Flag, J) mono_inc(I) mono_dec(J) partition(Flag, Flag'First, I) partition(Flag, J, Flag'First)

15. © Andrew IrelandDependable Systems Group Loop Invariant --# assert Flag'First<=I and --# J<=(Flag'Last+1) and --# I<=J and --# (for all Q in Integer range Flag'First..(P’-1) => (Flag(Q)=Red)) and --# (for all R in Integer range P’’..Flag'Last => (Flag(R)=White));

16. © Andrew IrelandDependable Systems Group Loop Invariant --# assert Flag'First<=I and --# J<=(Flag'Last+1) and --# I<=J and --# (for all Q in Integer range Flag'First..(P’-1) => (Flag(Q)=Red)) and --# (for all R in Integer range P’’..Flag'Last => (Flag(R)=White)); Bottom-up analysis Top-down analysis (schematic invariant) Note: P’ and P’’ denote meta-variables

17. © Andrew IrelandDependable Systems Group Proof Planning Failure Given Goal

18. © Andrew IrelandDependable Systems Group Proof Patching Proof pattern: Instantiate (lower bound of r ) such that difference reduction is applicable Program pattern: Exploit properties of array partitions within the program to constrain search for an appropriate i.e. becomes j i j

19. © Andrew IrelandDependable Systems Group Proposal Summary Develop proof automation for domain specific code certification Focus on commercial code generators Extend proof planning to support program patterns (or model patterns?) Exploit and extend early work on bottom-up analysis