Formal Verification with Ada 2012

Transcription

1 Formal Verification with Ada 2012 A Very Simple Case Study Didier Willame Ada DevRoom, FOSEDM 2014 February 1, 2014

2 Content The Toy A Sandpile Simulator A Quick Reminder Floyd-Hoare Logic Design by Contract Tool Suite by AdaCore Overview Installation Get Started Conclusion References Iconography

3 Introduction Definitions verification dynamic verification testing static verification manual review formal verification - act of proving or disproving the correctness of implemented algorithms with respect to given formal properties and using formal methods of logic 1

4 The Toy A Sandpile Simulator - Overview Figure 1: a flow on a sand dune 2

5 The Toy A Sandpile Simulator - Overview Figure 2: a sandpile 3

6 The Toy A Sandpile Simulator - Physics open system - model in which sand grains enter regularly by a unique source (center of the ceiling) and drop out by the sides. conservative law - there is no spontaneous generation of sand grains nor spontaneous annihilation. gravity force - each sand grain spontaneousely falls from top to bottom (vertical move). pressure - the stability of each sand grain, in contact directly or not with the ground, is proportional to the number of grains just above it. break - an horizontal move into a neighbour cell is possible, if this neighbour cell is empty, and if the pressure is high enough (toppling and cascade). 4

7 The Toy A Sandpile Simulator - Concepts model of sandpiles physics of granular materials dynamical systems displaying self-organized criticality applications models for avanches models for earthquakes models for forest-fires etc. simulator 2-D cellular automaton update of cell state synchronous depends of state of the neighboring cells (Von Neumann of indeterminate range) race conditions solved by random decision 5

8 The Toy A Sandpile Simulator - 1-to-2 race 1-to-2 race - possible horizontal move of 1 grain of sand, in the contiguous empty cells example: Figure 3: an 1-to-2 race and falls 6

9 The Toy A Sandpile Simulator - 2-to-1 race 2-to-1 race - possible horizontal moves of 2 grains of sand, in the same empty cell example: Figure 4: a 2-to-1 race, falls and an horizontal move 7

10 The Toy A Sandpile Simulator - Conventions Convention 1 (cell states) A = {0, 1, g, v} 0 - empty 1 - settled (by a grain of sand) g - ground v - vacuum Convention 2 (neighborhood) [ lef t neighborhood ; current column ; right neighborhood ] neighborhood (N) ::= N column column N ɛ column ::= upper column A lower column column A A column ɛ 8

11 The Toy A Sandpile Simulator - Rules Rule 1 (no move) [ 1 ; 1 ; ] 1 {1, g} [ ; 1 ; ] Rule 2 (fall) [ ; 1 ; 0 ] [ ; 0 ; 1 ] 9

12 The Toy A Sandpile Simulator - Rules Rule 3 (left move) ; 1 ;. {1, g} > 1 ; 0 ; Rule 4 (right move) 1. 0 ; 1 ; 0. {1, g} > ; 0 ; 1 10

13 The Toy A Sandpile Simulator - Definitions Definition 1 (state transitions) deterministic transition (always occurs) > possible transition time dependency - during a computation loop, the neighborhood can change (race issue) fragility - probability of breaking σ( T (P i,j ) ) θ σ - sigmoid map (shift, slope) T - triangular density function (width) Pi,j - pressure on the cell i,j θ - threshold 11

14 The Toy A Sandpile Simulator - Definitions Definition 2 (sigmoid map) σ : R [ 1, 1] : x x 1 + x 2 Figure 5: the algebraic sigmoid (shift = 0.0 and slope = 1.0) 12

15 The Toy A Sandpile Simulator - Definitions Definition 3 (triangular density function) 1 + x if x [ 1, 0[ T : R [0, 1] : x 1 x if x [0, 1] 0 else 0 if x < 1 (1+x) 2 2 if x [ 1, 0[ F : R [0, 1] : x 1 (1 x)2 2 if x [0, 1] 1 if x > 1 { 2x 1 if x [0, 0.5[ F 1 : [0, 1] R : x 1 2(1 x) if x [0.5, 1] 13

16 The Toy A Sandpile Simulator - Design 1 procedure Agit Main i s 2 3 to beat out the rhythm ( the computing c y c l e s ) 4 Next Time : Time ; 5 6 begin 7 Agit Cellular Automaton. S t a r t ; 8 9 loop 10 Next Time := Clock ; to r e s t a r t the timer Agit Cellular Automaton. Add A Grain ; 13 Agit Cellular Automaton. Next ; 14 Agit Cellular Automaton. Show ; delay u n t i l Next Time ; 17 end loop ; Agit Cellular Automaton. Stop ; 20 end Agit Main ; Listing 1: The main procedure 14

17 The Toy A Sandpile Simulator - Design 1 type State Type i s new Natural range ; 2 empty or s e t t l e d 3 4 p r o t e c t e d type P r o t e c t e d S t a t e i s 5 entry Set ( S t a t e : i n State Type ) ; 6 f u n c t i o n Get r e t u r n State Type ; 7 8 p r i v a t e 9 C u r r e n t S t a t e : State Type ; 10 Not Busy : Boolean := True ; the guard 11 end P r o t e c t e d S t a t e ; S t a t e s : array ( X Coordinate range, Y Coordinate range ) 14 o f P r o t e c t e d S t a t e ; Listing 2: The specification of the array of states 15

18 The Toy A Sandpile Simulator - Design 1 t a s k type C e l l i s 2 entry S t a r t (X : i n X Coordinate ; 3 Y : i n Y Coordinate ) ; 4 entry Stop ; 5 entry Drive Out Fall And Break ; 6 entry Make Fall ; 7 end C e l l ; 8 9 type C e l l A c c e s s i s a c c e s s C e l l ; Automaton : array ( X Coordinate range, 12 Y Coordinate range ) o f C e l l A c c e s s ; Listing 3: The specification of the array of cells 16

19 The Toy A Sandpile Simulator - Design 1 type H oriz onta l Mov e Sid e i s ( NO HORIZONTAL MOVE, 2 LEFT, 3 RIGHT ) ; 4 type Horizontal Move Type i s 5 r e c o r d 6 X : X Coordinate ; 7 Y : Y Coordinate ; c u r r e n t c e l l ( s e t t l e d ) 8 Side : H o r i z o n t a l M o v e S i d e ; 9 end r e c o r d ; p r o t e c t e d P o s s i b l e B r e a k i s 12 entry I n s e r t ( Key : Sigmoid Type ; 13 Horizontal Move : Horizontal Move Type ) ; 14 procedure Reset ; 15 procedure Make Breaks ; p r i v a t e 18 Horizontal Move Map : P o s s i b l e B r e a k P a c k a g e. Map ; 19 Not Busy : Boolean := True ; the guard 20 end P o s s i b l e B r e a k ; Listing 4: The specification of the list of break events 17

20 The Toy A Sandpile Simulator - Design 1 procedure Next i s 2 begin 3 Automaton Rendezvous. Reset ; 4 f o r J i n Y Coordinate range loop 5 f o r I i n X Coordinate range loop 6 Automaton ( I, J ). Drive Out Fall And Break ; 7 end loop ; 8 end loop ; 9 Wait Until End Of Computation ; Automaton Rendezvous. Reset ; 12 f o r J i n Y Coordinate range loop 13 f o r I i n X Coordinate range loop 14 Automaton ( I, J ). Make Fall ; v e r t i c a l move 15 end loop ; 16 end loop ; 17 Wait Until End Of Computation ; P o s s i b l e B r e a k. Make Breaks ; h o r i z o n t a l moves 20 end Next ; Listing 5: The next procedure 18

21 A Quick Reminder Floyd-Hoare Logic - The Pioneers Figure 6: Alan Mathison Turing ( ) Checking a Large Routine, 1949 [4] (the first proof of a program) 19

22 A Quick Reminder Floyd-Hoare Logic - The Pioneers Figure 7: Robert W. Floyd ( ) Assigning Meaning to Programs, 1967 [2] (use of logical assertions on flowcharts) 20

23 A Quick Reminder Floyd-Hoare Logic - The Pioneers Figure 8: Sir Charles Antony Richard Hoare (1934 -) An Axiomatic Basis for Computer Programming, 1969 [3] (set of inference rules) 21

24 A Quick Reminder Floyd-Hoare Logic - The Pioneers Figure 9: Edsger Wybe Dijkstra ( ) Guarded Commands, Nondeterminacy and Formal Derivation of Programs, 1975 [1] (total correctness) 22

25 A Quick Reminder Floyd-Hoare Logic - A Program Language imperative programming - flow of statements that change the program state (how to do) syntax e ::= n x e op e n denotes an integer constant x denotes a variable identifier op ::= + = < > and or s ::= skip x := e s;s if e then s else s while e loop s in the conditional and the loop structures, { true when e 0 e denotes false when e = 0 23

26 A Quick Reminder Floyd-Hoare Logic - A Program Language semantics Σ - current program state Σ(x) - current value of the variable x [e]σ - evaluation Σ, s Σ, s - execution of the next step of s Σ, s Σ, s - execution reaches Σ and remains s Σ, s Σ, skip - terminating execution (if Σ exists) 24

27 = P - denotes that Σ = P holds, for any state Σ 25 A Quick Reminder Floyd-Hoare Logic - Propositions about Programs (declarative programming) declarative programming - description of the desired results (what to do) syntax (FOL) P ::= true false e P P P P P P P x, P x, P semantics e denotes an assertion written in the imperative language [P ]Σ - evaluation (valid or not) [e]σ - defined by [[e] Σ 0 Σ = P - formula [P ]Σ is valid (Σ satisfies P )

28 A Quick Reminder Floyd-Hoare Logic - Inference Rules Hoare triple {P }s{q} validity - {P }s{q} is valid, if s is executed in a state satisfying its precondition {P }, and if it terminates, then the resulting state satisfies its post-condition {Q}. {P }s{q} is valid iff Σ, Σ, (Σ = P Σ, s Σ, skip) (Σ = Q) 26

29 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 1 (empty statement axiom schema) {P } skip {P } 27

30 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 2 (assignment axiom schema) {P [x e]} x:=e {P } P [x e] denotes the assertion P in which each free occurrence of x has been replaced by the expression E {x + 1 = 43} y := x + 1 {y = 43} is valid 28

31 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 3 (composition rule) {P }s 1 {Q}, {Q}s 2 {R} {P } s 1 ;s 2 {R} 29

32 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 4 (conditional rule) {P (e 0)}s 1 {Q}, {P (e = 0)}s 2 {Q} {P } if (e 0) then s 1 else s 2 {Q} 30

33 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 5 (consequence rule) P 1 P 2, {P 2 }s{q 2 }, Q 2 Q 1 {P 1 } s {Q 1 } This rule allows to strengthen the precondition {P 2 } and/or to weaken the postcondition {Q 2 } 31

34 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 6 (while rule for partial correctness) {I (e 0)}s{I} {I} while (e 0) loop s {I (e = 0)} I is a loop invariant 32

35 A Quick Reminder Floyd-Hoare Logic - Inference Rules Rule 7 (while rule for total correctness) wf( ), {I (e 0) (v = ξ)}s{i (v ξ)} {I} while (e 0) loop s {I (e = 0)} wf( ) is a well-founded order relation v is a loop variant 33

36 A Quick Reminder Floyd-Hoare Logic - Case Study (addition by incrementation) Figure 10: a geometric interpretation of the addition 34

37 A Quick Reminder Floyd-Hoare Logic - Case Study (addition by incrementation) 1 module IncrementalAddition 2 3 use import i n t. I n t 4 use import r e f. Ref 5 6 l e t a d d I t e r a t i v e ( x : i n t ) ( y : i n t ) : i n t 7 r e q u i r e s { x >= 0 /\ y >= 0 } 8 e n s u r e s { r e s u l t = x + y } 9 = 10 l e t s = r e f x i n ( the sum ) 11 l e t r = r e f y i n ( the r e s t to add ) 12 w h i l e! r > 0 do 13 i n v a r i a n t {! r >= 0 /\! s +! r = x + y } 14 ( the d i s c r e t e l i n e L ::= r = ( x+y ) s ) 15 v a r i a n t {! r } 16 ( the move on L must be downward ) 17 s :=! s + 1 ; 18 r :=! r 1 19 done ; 20! s 21 end Listing 6: The why3 proof of the incremental addition. 35

38 A Quick Reminder Floyd-Hoare Logic - Why3 why3 (INRIA, LRI and CNRS) (see the gallery of verified programs) a platform for verification of algorithms, based on the Floyd-Hoare Logic IVC - Intermediate Verification Language (stepping stone between source languages and reasoning engines - e.g., Alt-Ergo or Coq) VC - Verification Condition (e.g., precondition, postcondition, loop invariant or loop variant) 36

39 A Quick Reminder Design by Contract Design by Contract (DbC) design approach requiring the definition of formal, precise and verifiable specifications, using verification conditions mastering Floyd-Hoare logic helps develop relevant VC (what means correctness?) 37

40 Tool Suite by AdaCore Overview Figure 11: why3, a chain link 38

41 Tool Suite by AdaCore Overview Figure 12: gratprove, an integrated tool 39

42 Tool Suite by AdaCore Installation - Linux 1. dowload the packages from select the platform x86 64-linux select the packages GNAT 2013 (development environment) SPARK-HiLite GPL 2013 (proof environment) 2. install the packages (Makefile) /usr/gnat 3. set enrironment variables PATH=$PATH:/usr/gnat/bin 40

43 Tool Suite by AdaCore Get Started - Documentation Various Projects and Technical Documents SPARK GNATprove

44 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) 1 package Incremental Add i s 2 3 f u n c t i o n Incremental Add ( X, Y : Natural ) 4 r e t u r n Natural 5 with 6 Pre => ( Y <= Natural Last X ), 7 Post => ( Incremental Add Result = X+Y ) ; 8 9 end Incremental Add ; Listing 7: incremental add.ads (the specifications) 42

45 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) 1 package body Incremental Add i s 2 f u n c t i o n Incremental Add ( X, Y : Natural ) 3 r e t u r n Natural i s 4 5 S : Natural := X; the sum 6 R : Natural := Y; the r e s t to add 7 begin 8 9 w h i l e ( R > 0 ) loop 10 pragma L o o p I n v a r i a n t ( (R>=0) and ( S+R=X+Y) ) ; 11 pragma Loop Variant ( De cr eas es => R ) ; S := S + 1 ; 14 R := R 1 ; 15 end loop ; r e t u r n S ; end Incremental Add ; 20 end Incremental Add ; Listing 8: incremental add.adb (the body) 43

46 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) 1 with Incremental Add ; 2 3 with Ada. Text IO, Ada. I n t e g e r T e x t I O ; 4 use Ada. Text IO, Ada. I n t e g e r T e x t I O ; 5 6 procedure Add i s 7 X : Natural ; 8 Y : Natural ; 9 Result : Natural ; 10 begin 11 put ( X: ) ; get ( X ) ; 12 put ( Y: ) ; get ( Y ) ; Result := Incremental Add. Incremental Add ( X, Y ) ; 15 Put ( X + Y = ) ; 16 Put Line ( Natural Image ( Result ) ) ; e x c e p t i o n 19 when C o n s t r a i n t E r r o r => 20 Put Line ( o v e r f l o w! ) ; 21 end Add ; Listing 9: add.adb (the main unit) 44

47 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) 1 p r o j e c t Add i s 2 3 f o r S o u r c e D i r s use ( add/ s r c / ) ; 4 5 f o r S o u r c e F i l e s use ( i n c r e m e n t a l a d d. adb, 6 i n c r e m e n t a l a d d. ads, 7 add. adb ) ; 8 9 f o r O b j ect D i r use. / add/ obj / ; 10 f o r Exec Dir use. / add/ bin / ; 11 f o r Main use ( add. adb ) ; package Compiler i s 14 f o r D e f a u l t S w i t c h e s ( ada ) use ( gnat12 ) ; 15 end Compiler ; end Add ; Listing 10: add.gpr (the GPS script) 45

48 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) the gnatprove invocation > gnatprove -Padd.gpr --report=all the output (the phases) Phase 1 of 3: frame condition computation... Phase 2 of 3: translation to intermediate language... Statistics logged in./add/obj/gnatprove/gnatprove.out (detailed info can be found in./add/obj/gnatprove/*.alfa) Phase 3 of 3: generation and proof of VCs... 46

49 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) the output (the analysis) analyzing Incremental_Add.Incremental_Add, 9 checks incremental_add.adb:10:10: info: loop invariant initialization proved incremental_add.adb:10:10: info: loop invariant preservation proved incremental_add.adb:10:47: info: overflow check proved incremental_add.adb:10:51: info: overflow check proved incremental_add.adb:11:10: info: loop variant proved incremental_add.adb:13:17: info: overflow check proved incremental_add.adb:14:17: info: range check proved incremental_add.ads:7:14: info: postcondition proved incremental_add.ads:7:42: info: overflow check proved analyzing precondition for Incremental_Add.Incremental_Add, 1 checks incremental_add.ads:6:34: info: overflow check proved 47

50 Tool Suite by AdaCore Get Started - Case Study (addition by incrementation) the gnatprove.out file Subprograms in SPARK : 50% (1/2)... already supported : 50% (1/2)... not yet supported : 0% (0/2) Subprograms not in SPARK : 50% (1/2) Subprograms not in SPARK due to (possibly more than one reason): exception : 50% (1/2) Subprograms not yet supported due to (possibly more than one reason): (none) Units with the largest number of subprograms in SPARK: incremental_add : 100% (1/1) Units with the largest number of subprograms not in SPARK: add : 100% (1/1) 48

51 Conclusion current status theoretical basis to develop relevant VC complex and funny enough toy to make exciting exercises next steps make available on the internet the toy s source code complete the source code of the toy with relevant VC start a blog to discuss the relevance of the used VC use and/or develop with Jacob Sparre Andersen, the Jacob s tutorial about the design by contract 49

52 Thanks! Any questions?

53 References [1] Edsger W. Dijkstra, Guarded commands, nondeterminacy and formal derivation of programs, Commun. ACM 18 (1975), no. 8, pp [2] Robert W. Floyd, Assigning meaning to programs, Proceedings of Symposium on Applied Mathematics Mathematical Aspects of Computer Science (1967), no. 19, pp [3] C. A. R. Hoare, An axiomatic basis for computer programming, Commun. ACM 12 (1969), no. 10, pp [4] A. M. Turing, Checking a large routine, EDSAC Inaugural Conference, Report of a Conference on High Speed Automatic Calculating machines, Mathematical Laboratory, Cambridge, 24 June 1949, pp

54 Iconography fig. 1 : John K. Nakata (Landslides in art part 11) fig. 6 : faetopia.com fig. 7 : www-cs.stanford.edu fig. 8 : Rama (en.wikipedia.org) fig. 9 : Hamilton Richards (en.wikipedia.org) fig. 11 : Jean-Christophe Filliâtre (Deductive Program Verification with Why3, 2013) fig. 12 : Hi-Lite (project description, 2013) fig. 13 : Yale Babylonian Collection fig. 14 : University of Pennsylvania fig. 2, 3, 4, 5 and 10 : Didier Willame (Argonauts-IT Ltd)

55 Figure 13: Old Babylonian clay tablet (circa BCE), showing a computation of 2

56 Figure 14: fragment of Euclid s Elements (Oxyrhynchus papyrus I 29, circa A.D.), showing a sketch of the proof of the pythagorean theorem