Modular, compositional and sound verification of the input/output - - PowerPoint PPT Presentation

▶
modular compositional and sound verification of the input
SMART_READER_LITE
LIVE PREVIEW

Modular, compositional and sound verification of the input/output - - PowerPoint PPT Presentation

Jan 03, 2023 199 likes •665 views

Modular, compositional and sound verification of the input/output behavior of programs Willem Penninckx, Bart Jacobs, Frank Piessens Department of Computer Science, KU Leuven, Belgium DRADS 2014 Table of Contents Introduction Requirements

slide-1
SLIDE 1

Modular, compositional and sound verification of the input/output behavior of programs

Willem Penninckx, Bart Jacobs, Frank Piessens

Department of Computer Science, KU Leuven, Belgium

DRADS 2014

slide-2
SLIDE 2

Table of Contents

Introduction Requirements Specifying I/O behaviour Wrapping up

slide-3
SLIDE 3

Table of Contents

Introduction Requirements Specifying I/O behaviour Wrapping up

slide-4
SLIDE 4

Popular way to prove software properties

◮ Theorem: ◮ Possible proofs: ◮ When is a proof correct?

slide-5
SLIDE 5

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number ◮ Possible proofs: ◮ When is a proof correct?

slide-6
SLIDE 6

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal:

◮ Possible proofs: ◮ When is a proof correct?

slide-7
SLIDE 7

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal: if x > y then result := x else result := y

◮ Possible proofs: ◮ When is a proof correct?

slide-8
SLIDE 8

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal: if x > y then result := x else result := y {result >= x ∧ result >= y}

◮ Possible proofs: ◮ When is a proof correct?

slide-9
SLIDE 9

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal: {} if x > y then result := x else result := y {result >= x ∧ result >= y}

◮ Possible proofs: ◮ When is a proof correct?

slide-10
SLIDE 10

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal: {} if x > y then result := x else result := y {result >= x ∧ result >= y}

◮ Possible proofs:

No time to explain!

◮ When is a proof correct?

slide-11
SLIDE 11

Popular way to prove software properties

◮ Theorem: Informal: returns a bigger number

Formal: {} if x > y then result := x else result := y {result >= x ∧ result >= y}

◮ Possible proofs:

No time to explain!

◮ When is a proof correct?

No time to explain!

slide-12
SLIDE 12

◮

{x = 2}

state before program starts

x := x + 1 {x = 3}

state after program terminates

◮ People added support for... ◮ Concurrency ◮ Dynamic memory allocation ◮ ...

slide-13
SLIDE 13

◮

{x = 2}

state before program starts

x := x + 1 {x = 3}

state after program terminates

◮ People added support for... ◮ Concurrency ◮ Dynamic memory allocation ◮ ... ◮ Typically verified: (memory) state.

slide-14
SLIDE 14

◮

{x = 2}

state before program starts

x := x + 1 {x = 3}

state after program terminates

◮ People added support for... ◮ Concurrency ◮ Dynamic memory allocation ◮ ... ◮ Typically verified: (memory) state. ◮ End-users care about: what’s on their screen.

slide-15
SLIDE 15

◮

{x = 2}

state before program starts

x := x + 1 {x = 3}

state after program terminates

◮ People added support for... ◮ Concurrency ◮ Dynamic memory allocation ◮ ... ◮ Typically verified: (memory) state. ◮ End-users care about: what’s on their screen.

◮ => Add support to verify Input/Output (I/O)

slide-16
SLIDE 16

Table of Contents

Introduction Requirements Specifying I/O behaviour Wrapping up

slide-17
SLIDE 17

{...} main(){ code; code; code; code; code; code; code; code; ... code; } {...}

slide-18
SLIDE 18

{...} main(){ code; code; code; code; code; code; code; code; ... code; } {...} {...} main(){ f1(); f2(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...}

slide-19
SLIDE 19

{...} main(){ code; code; code; code; code; code; code; code; ... code; } {...} {...} main(){ f1(); f2(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...} Compositionality

slide-20
SLIDE 20

{...} main(){ code; code; code; code; code; code; code; code; ... code; } {...} {...} main(){ f1(); f2(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...} {...} f1(){ f3(); f4(); } {...} {...} f2(){ f4(); f5(); } {...} different developers Modularity

slide-21
SLIDE 21

{specs specs specs specs} main(){ ... } { specs specs specs specs}

slide-22
SLIDE 22

{specs specs specs specs} main(){ ... } { specs specs specs specs} { spec1 * spec2} main(){ ... } spec1= spec3 * spec4 spec2= spec4 * spec5 .

slide-23
SLIDE 23

{specs specs specs specs} main(){ ... } { specs specs specs specs} { spec1 * spec2} main(){ ... } spec1= spec3 * spec4 spec2= spec4 * spec5 . Compositionality

slide-24
SLIDE 24

{specs specs specs specs} main(){ ... } { specs specs specs specs} { spec1 * spec2} main(){ ... } spec1= spec3 * spec4 spec2= spec4 * spec5 . different developers Modularity

slide-25
SLIDE 25

Requirements

◮ Compositionality.

◮ e.g. define I/O action download on top of tcp write and

file write, etc.

slide-26
SLIDE 26

Requirements

◮ Compositionality.

◮ e.g. define I/O action download on top of tcp write and

file write, etc.

◮ Modularity

◮ e.g. combine independent I/O action tcp write with

file write

slide-27
SLIDE 27

Requirements

◮ Compositionality.

◮ e.g. define I/O action download on top of tcp write and

file write, etc.

◮ Modularity

◮ e.g. combine independent I/O action tcp write with

file write

◮ Non-terminating programs (part WIP)

◮ e.g. {} while true ... {these I/O happened}: postcondition

useless

slide-28
SLIDE 28

Requirements

◮ Compositionality.

◮ e.g. define I/O action download on top of tcp write and

file write, etc.

◮ Modularity

◮ e.g. combine independent I/O action tcp write with

file write

◮ Non-terminating programs (part WIP)

◮ e.g. {} while true ... {these I/O happened}: postcondition

useless

◮ Actions depend on outcome of actions

◮ e.g. read file containing filenames to read

◮ ...

slide-29
SLIDE 29

Table of Contents

Introduction Requirements Specifying I/O behaviour Wrapping up

slide-30
SLIDE 30

By example

slide-31
SLIDE 31

By example

◮ {} ... {}

◮ No I/O allowed

slide-32
SLIDE 32

By example

◮ {} ... {}

◮ No I/O allowed

◮ { time(t1) } ... { time(t1) }

◮ No I/O allowed ◮ A time like t1 ≈ a point in time. ◮ Doing I/O “increases” time

slide-33
SLIDE 33

By example

◮ {} ... {}

◮ No I/O allowed

◮ { time(t1) } ... { time(t1) }

◮ No I/O allowed ◮ A time like t1 ≈ a point in time. ◮ Doing I/O “increases” time

◮ { time(t1) ⋆ print io(t1, ‘h′, t2) }

print char(‘h′); { time(t2) }

◮ Doing print char(‘h’) ◮ requires a permission print io(t1, ‘h′, t2) ◮ requires a time(t1) ◮ disposes the permission ◮ “increases” the time to t2

slide-34
SLIDE 34

◮ { time(t1) ⋆ print io(t1, ‘h′, t2) ⋆ print io(t2, ‘i′, t3) }

... { time(t3) }

◮ Can print “hi”, “h”, “”. ◮ If terminates: can only print “hi”. ◮ Can not print: “x”, “i”, “ih”, ...

slide-35
SLIDE 35

◮ { time(t1) ⋆ print io(t1, ‘h′, t2) ⋆ print io(t2, ‘i′, t3) }

... { time(t3) }

◮ Can print “hi”, “h”, “”. ◮ If terminates: can only print “hi”. ◮ Can not print: “x”, “i”, “ih”, ...

◮ { time(t1) ⋆ print io(t1, ‘h′, t2) ⋆ print io(t1, ‘i′, t2) }

... { time(t2) }

◮ Can print “h”, “i”, “”. ◮ If terminates: has printed either “h” or “i”. ◮ Can not print: “x”, “hi”, ...

slide-36
SLIDE 36

Defining new I/O actions

◮ predicate print string io(t1, str, t2) =

if str = nil then t1 = t2 else ( print io(t1, head(str), tbetween) ⋆ print string io(tbetween, tail(str), t2) )

slide-37
SLIDE 37

Defining new I/O actions

◮ predicate print string io(t1, str, t2) =

if str = nil then t1 = t2 else ( print io(t1, head(str), tbetween) ⋆ print string io(tbetween, tail(str), t2) )

◮ Build actions using actions (compositionality)

slide-38
SLIDE 38

Defining new I/O actions

◮ predicate print string io(t1, str, t2) =

if str = nil then t1 = t2 else ( print io(t1, head(str), tbetween) ⋆ print string io(tbetween, tail(str), t2) )

◮ Build actions using actions (compositionality) ◮ {time(t1) ⋆ print string io(t1, “hello world!′′, t2)}

... {time(t2)}

slide-39
SLIDE 39

Linking arguments

◮ { time(t1) ⋆ read string io(t1, str, t2)

⋆ print string io(t2, str, t3) } ... {time(t3)}

slide-40
SLIDE 40

Unconstrained order/interleaving

◮ { time(t2) ⋆ time(t3)

⋆ read string io(t2, str, t4) ⋆ print string io(t3, str, t5) } ... { time(t4) ⋆ time(t5) }

◮ Allows buffering of any size.

slide-41
SLIDE 41

Unconstrained order/interleaving

◮ { time(t2) ⋆ time(t3)

⋆ read string io(t2, str, t4) ⋆ print string io(t3, str, t5) } ... { time(t4) ⋆ time(t5) }

◮ Allows buffering of any size. ◮ How to get two times (time(t2) and time(t3))?

slide-42
SLIDE 42

Unconstrained order/interleaving

◮ { time(t1) ⋆ split(t1, t2, t3)

⋆ read string io(t2, str, t4) ⋆ print string io(t3, str, t5) ⋆ join(t4, t5, t6) } ... { time(t4) }

◮ split(t1, t2, t3) consumes time(t1) and yields time(t2) and

time(t3).

slide-43
SLIDE 43

Table of Contents

Introduction Requirements Specifying I/O behaviour Wrapping up

slide-44
SLIDE 44

What can we do now?

◮ Verify software like this:

  • 1. Write software
  • 2. Write down the wanted I/O behaviour
  • 3. Write a proof (add annotations)
  • 4. Feed to proofchecker software.

◮ Output: OK or Not OK.

◮ With support for:

◮ Modularity ◮ Compositionality ◮ ...

slide-45
SLIDE 45

◮ The End