Chalice to Boogie Program Verification for ObjectOriented Programs - - PowerPoint PPT Presentation

▶
chalice to boogie
SMART_READER_LITE
LIVE PREVIEW

Chalice to Boogie Program Verification for ObjectOriented Programs - - PowerPoint PPT Presentation

Jun 21, 2023 357 likes •1.12k views

(star) (no star) Chalice to Boogie Program Verification for ObjectOriented Programs Chinmay Kakatkar

slide-1
SLIDE 1

Chalice to Boogie

Program Verification for ObjectOriented Programs

Chinmay Kakatkar

(star) (no star)

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5

!"#

slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8

$% &

  • '
slide-9
SLIDE 9

()

  • !*

+,

slide-10
SLIDE 10
slide-11
SLIDE 11

,-

  • !
slide-12
SLIDE 12
  • ,-
  • !
slide-13
SLIDE 13

SMT Solver Yes! No!

.",

Highlevel verification language Intermediate representation

Generation of verification conditions Translation Step 1 Step 2 Step 3 Chalice (star) Boogie (no star) Satisfiable?

slide-14
SLIDE 14

SMT Solver Yes! No!

.",

Highlevel verification language Intermediate representation

Generation of verification conditions

  • Step 2

Step 3 Chalice (star) Boogie (no star) Satisfiable?

slide-15
SLIDE 15
  • 1.

Formalization of a Chalice subset

2. Formalization of a Boogie subset

  • 3. Formalization of a subset translation

from Chalice to Boogie

  • 4. Proof of Soundness of Translation
slide-16
SLIDE 16
  • 1.

Formalization of a Chalice subset

2. Formalization of a Boogie subset

  • 3. Formalization of a subset translation

from Chalice to Boogie

  • 4. Proof of Soundness of Translation
slide-17
SLIDE 17
  • We give:
  • { Pre } C { Post }
slide-18
SLIDE 18
slide-19
SLIDE 19
  • //011(1,
  • 2*,-
slide-20
SLIDE 20
  • 3//011(14-

!

  • 2*,-
slide-21
SLIDE 21
  • An assertion is

if and only if

slide-22
SLIDE 22

!!

Rights Access

is selfframing if and only if Access ( ) ⊆ Rights ( )

slide-23
SLIDE 23

"

  • Access ( )

Rights ( )

acc(x.f) &*& x.f == 100 { x.f } { x.f } acc(x.f) &*& y.f == 90 { y.f } { x.f } acc(x.f) &*& x.g == 101 { x.g } { x.f } acc(x.f) { } { x.f }

slide-24
SLIDE 24
  • #$

#% $ % %

slide-25
SLIDE 25
  • Scoping & Simplification
  • Design choices
  • Formalization of method calls
slide-26
SLIDE 26
  • 1.

Formalization of a Chalice subset

2. Formalization of a Boogie subset

  • 3. Formalization of a subset translation

from Chalice to Boogie

  • 4. Proof of Soundness of Translation
slide-27
SLIDE 27

&

  • ! " #$%&!
slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30
  • '

$$( ' )* & %

slide-31
SLIDE 31
  • 1.

Formalization of a Chalice subset

2. Formalization of a Boogie subset

  • 3. Formalization of a subset translation

from Chalice to Boogie

  • 4. Proof of Soundness of Translation
slide-32
SLIDE 32

&

Has special commands and predicates < frameB >

slide-33
SLIDE 33

&

Has notion of star operator < maskC , heapC , frameC > Has special commands and predicates < frameB >

slide-34
SLIDE 34

+%

slide-35
SLIDE 35

Caller Callee

x.y(m) Execute method body

  • return
slide-36
SLIDE 36

Caller Callee

x.y(m) Execute method body

  • return

!"#$!% &"#$!% !"#% &"#%

slide-37
SLIDE 37

x.m(y)

slide-38
SLIDE 38

x.m(y) method m ( t p ) Ar;

  • Ae;

{ %'(E }

slide-39
SLIDE 39

x.m(y) method m ( t p ) Ar;

  • Ae;

{ %'(E } var mask_e : Mask; var heap_i : Heap; var y1 : Expression; y1 := y; mask_e := mask; exhale( Ar [ this / x ] [ y1 / y ] , mask_e ); mask := mask_e; havoc heap_i; assume IsGoodInhaleState( heap_i , heap , mask ); inhale( Ae [ this / x ] [ y1 / y ] , mask , heap_i );

slide-40
SLIDE 40

x.m(y) var mask_e : Mask; var heap_i : Heap; var y1 : Expression; y1 := y; mask_e := mask; exhale( Ar [ this / x ] [ y1 / y ] , mask_e ); mask := mask_e; havoc heap_i; assume IsGoodInhaleState( heap_i , heap , mask ); inhale( Ae [ this / x ] [ y1 / y ] , mask , heap_i ); method m ( t p ) Ar;

  • Ae;

{ %'(E } procedure C.m ( this : C , p : t ) { var mask_e : Mask; var heap_i : Heap; havoc heap_i; assume IsGoodInhaleState ( heap_i , heap , mask ); inhale ( Ar , mask , heap_i ); translate ( %'( ); mask_e := mask; exhale ( Ae , mask_e ); mask := mask_e; }

slide-41
SLIDE 41

exhale( acc( x.f ) , mask ) = assert 0 < mask[ x , C.f ]; mask[x , C.f] := mask[ x , C.f ] – 1; assume IsGoodMask ( mask ); exhale( a1 &*& a2 , mask ) = exhale( a1 , mask ); exhale( a2 , mask ); exhale( b , mask ) = assert translate ( b ); inhale( b , mask , heap_i ) = assume translate ( b ); inhale( a1 &*& a2 , mask , heap_i ) = inhale( a1 , mask , heap_i ); inhale( a2 , mask , heap_i ); inhale( acc(x.f) , mask , heap_i ) = heap[ x , C.f ] := heap_i[ x , C.f ]; mask[ x , C.f ] := mask[ x , C.f ] + 1; assume IsGoodMask ( mask );

slide-42
SLIDE 42

exhale( acc( x.f ) , mask ) = assert 0 < mask[ x , C.f ]; mask[x , C.f] := mask[ x , C.f ] – 1; assume IsGoodMask ( mask ); exhale( a1 &*& a2 , mask ) = exhale( a1 , mask ); exhale( a2 , mask ); exhale( b , mask ) = assert translate ( b ); inhale( b , mask , heap_i ) = assume translate ( b ); inhale( a1 &*& a2 , mask , heap_i ) = inhale( a1 , mask , heap_i ); inhale( a2 , mask , heap_i ); inhale( acc(x.f) , mask , heap_i ) = heap[ x , C.f ] := heap_i[ x , C.f ]; mask[ x , C.f ] := mask[ x , C.f ] + 1; assume IsGoodMask ( mask );

slide-43
SLIDE 43

Checking selfframedness of assertions in Boogie (1)

Not selfframing: A = x.f == 3 &*& y.f == 3; exhale(x.f == 3 &*& y.f == 3, mask ) = assert heap[ x , C.f ] == 3; //ERROR assert heap[ y , C.f ] == 3;

slide-44
SLIDE 44

Selfframing: A = acc(x.f) &*& acc(y.f) &*& x.f == 3 &*& y.f == 3; exhale(acc(x.f) &*& acc(y.f) &*& x.f == 3 &*& y.f == 3, mask ) = assert 0 < mask[ x , C.f ]; mask[ x , C.f ] := mask[ x , C.f ] – 1; assume IsGoodMask ( mask ); assert 0 < mask[ y , C.f ]; mask[ y , C.f ] := mask[ y , C.f ] – 1; assume IsGoodMask ( mask ); assert heap[ x , C.f ] == 3; assert heap[ y , C.f ] == 3;

Checking selfframedness of assertions in Boogie (2)

slide-45
SLIDE 45

class Car { var fuel : int; void refuel ( amount : int ) acc ( this.fuel ); acc ( this.fuel ) this.fuel == amount; { this.fuel := amount; } void main ( ) { var c1 := new Car; var c2 := new Car; call c1.refuel ( 3 ); call c2.refuel ( 5 ); ( c1.fuel == 3 ); } }

,--

slide-46
SLIDE 46

void refuel ( amount : int ) acc ( this.fuel ); acc ( this.fuel ) this.fuel == amount; { this.fuel := amount; } call c1.refuel ( 3 ); //set up variables var mask_e : Mask; var heap_i : Heap; var y : Expression; y := 3; mask_e := mask; //exhale precondition assert 0 < mask_e [ this , Car.fuel ]; mask_e [ this , Car.fuel ] := mask_e [ this , Car.fuel ] – 1; assume IsGoodMask ( mask_e ); mask := mask_e; havoc heap_i; assume IsGoodInhaleState ( heap_i , heap, mask ); //inhale postcondition heap [ this , Car.fuel ] := heap_i [ this , Car.fuel ]; mask [ this , Car.fuel ] := mask [ this , Car.fuel ] + 1; assume IsGoodMask ( mask ); assume heap [ this , Car.fuel ] == y; procedure Car.refuel ( this : Car , amount : int ) { var mask_e : Mask; var heap_i : Heap; havoc heap_i; assume IsGoodInhaleState ( heap_i , heap , mask ); //inhale precondition heap [ this , Car.fuel ] := heap_i [ this , Car.fuel ]; mask [ this , Car.fuel ] := mask [ this , Car.fuel ] + 1; assume IsGoodMask ( mask ); //translate method body CanAccess ( mask , this , Car.fuel ); heap [ this , Car.fuel ] := amount; mask_e := mask; //exhale postcondition assert 0 < mask_e [ this , Car.fuel ]; mask_e [ this , Car.fuel ] := mask_e [ this , Car.fuel ] – 1; assume IsGoodMask ( mask_e ); assert heap [ this , Car.fuel ] == amount; mask := mask_e; }

slide-47
SLIDE 47
  • 1.

Formalization of a Chalice subset

2. Formalization of a Boogie subset

  • 3. Formalization of a subset translation

from Chalice to Boogie

  • 4. Proof of Soundness of Translation
slide-48
SLIDE 48

%

The translation of a Chalice program # is sound if and only if given that # verifies in the Boogie environment, it also verifies in the Chalice environment.

slide-49
SLIDE 49

.",1

SMT Solver Yes! No!

Highlevel verification language Intermediate representation

Translation Step 1 Step 2 Step 3 Chalice (star) Boogie (no star) Satisfiable? Generation of verification conditions

slide-50
SLIDE 50

+,-

SMT Solver Yes!

Highlevel verification language Intermediate representation

Translation Step 1 Step 2 Step 3 Chalice (star) Boogie (no star) Satisfiable? Generation of verification conditions

slide-51
SLIDE 51

+,-2-

SMT Solver Yes!

Intermediate representation

Step 2 Step 3 Boogie (no star) Satisfiable? Generation of verification conditions

slide-52
SLIDE 52
slide-53
SLIDE 53

+,

Auxiliary Definitions, Lemmas E

slide-54
SLIDE 54
  • Design of translation function
  • Formulating & justifying soundness argument
  • Lemmas and proofs
slide-55
SLIDE 55
  • 1.

Formalization of a Chalice subset

  • Approach to selfframing

2. Formalization of a Boogie subset

  • Operational semantics

3. Formalization of a sound translation from Chalice to Boogie

  • Translation function, soundness argument & proofs
slide-56
SLIDE 56
  • 1. Boogiebased verification
  • 2. Pedagogic uses
slide-57
SLIDE 57

http://rise4fun.com/

  • 1. Boogiebased verification
  • 2. Pedagogic uses
slide-58
SLIDE 58

./

  • Lots of background reading
  • An openended project
  • Balancing breadth and depth of investigation
  • Experimenting with tools
  • Formalizing approaches and arguments
  • Making original contributions
  • I am not JMC or MEng (but I am passionate about research!)
slide-59
SLIDE 59
slide-60
SLIDE 60

Knowledge Time

slide-61
SLIDE 61

)01

  • ! translation of while loop, and proof of method call

" #$ language subsets to include concurrency % translation from VeriFast to Chalice

slide-62
SLIDE 62
slide-63
SLIDE 63

2

slide-64
SLIDE 64

3%

slide-65
SLIDE 65

4

An assertion is if and only if & '

  • )# %%
slide-66
SLIDE 66

while ( condition ) {

// check invariant holds upon loop entry (assert E)

loop body E

// check invariant holds after arbitrary loop iteration (havocE)

}

slide-67
SLIDE 67

+%

If:

  • *+%(
  • translation of *+%( gives a Boogie encoding ,
  • , verifies in Boogie
  • Chalice and Boogie starting configurations are congruent
  • and given preconditions of operational semantics for *+%(E

Then: (esp. using Lemmas for Inhale / Exhale E) Show that there exists a terminal Boogie configuration ϕ, s. t.

  • , execution in Boogie leads to ϕ,
  • Terminal configurations in Chalice and Boogie match
slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70
slide-71
SLIDE 71
slide-72
SLIDE 72
slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75