Certifying Intermediate Programming

Zhaopeng Li2008-8-4

Outline

Big Picture Related Work What To Do and Open Problems

Big Picture

GoalCertifying System Software

MethodHoare-style Program Verification

Related Work CAP / SCAP /…/ OCAP /… Separation Logic / Smallfoot / SLAyer Spec# (Boogie, Z3, Terminator…) And more…

Related Work (cont.) Main shortcomings of non-CAPs

Not so expressive logicOnly prove simple properties of programsNot support system level certification well

No solid proofsUsing decision procedures

automated theorem provers

But automation is one of their strongpoint.

Related Work (cont.) Main shortcomings of CAPs

Assembly level code and proofUnfriendly to programmershard to figure out and debug specifications

Costly proof developmentLengthy proof , and not easy to provideNearly impossible to be applied to practice

What to do Based on methods of CAPs Propose framework that supports:

Source (high-level)/intermediate language Expressive logic Automated or semi-automated proof deve

lopment Connection with low-level CAP-like frame

work

What to do : language Which language to choose?

Source language Intermediate language

First-step choice : Intermediate language

A better try to overcome shortcomings of CAPs Easy to connect with low-level CAPs

What to do : program logic Assertion language

Asserts on the program stateHeap, Store, Data Stack,…

Uses Separation logic connectives ? Deal with program with mutable shared structures

Specification Traditional pre- and post-conditions {P}C{Q} Guarantee from SCAP {g}C Single two-state-related pre-condition from FCAP {p}C

Inference rules Depend on what specification we choose

What to do : proof method Proof Method

VCGen and Automated Theorem Prover Coq and Semi-automated Proof

Combination? Techniques to split VC

What to do : connect with CAP Translation

Language Specification Proof

Generation Specification Proof

Open Problems What kind of Language?

Key features: Assignment statement Function call and return Goto statement Explicit or implicit data stack? And more?

What kind of Logic? Assertion Specification

Traditional pre- and post-conditions Guarantee from SCAP Single two-state-related pre-condition from FCAP

Open Problems (cont.) How to connect with CAP?

Translation Generation

Build higher framework based this one? C language …

Discussion

Any suggestions? Or any options, ideas?

Thanks!