Relational Specification and Verification From Non-Interference to - - PowerPoint PPT Presentation

▶
relational specification and verification
SMART_READER_LITE
LIVE PREVIEW

Relational Specification and Verification From Non-Interference to - - PowerPoint PPT Presentation

Oct 06, 2023 99 likes •819 views

Relational Specification and Verification From Non-Interference to Regression-free Program Evolution Bernhard Beckert with M. Kirsten, V. Klebanov, M. Ulbrich, A. Weigl | RS3 Practitioner Event www.kit.edu KIT Universit at des Landes

slide-1
SLIDE 1

www.kit.edu

KIT – Universit¨ at des Landes Baden-W¨ urttemberg und nationales Forschungszentrum in der Helmholtz-Gemeinschaft

Bernhard Beckert with M. Kirsten, V. Klebanov, M. Ulbrich, A. Weigl | RS3 Practitioner Event

Relational Specification and Verification

From Non-Interference to Regression-free Program Evolution

slide-2
SLIDE 2

Relational vs. Function

Functional Verification: Prove property for one program Relational Verification: Prove relation between two programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 2/29

slide-3
SLIDE 3

Verification of Relational Properties

Use Cases: Non-interference / Information flow Regression Verification Relational Properties of Algorithms Refinement

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 3/29

slide-4
SLIDE 4

Verification of Relational Properties

Use Cases: Non-interference / Information flow low1 = low2 → P1;P2 low1 = low2 Regression Verification Relational Properties of Algorithms Refinement

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 3/29

slide-5
SLIDE 5

Verification of Relational Properties

Use Cases: Non-interference / Information flow low1 = low2 → P1;P2 low1 = low2 Regression Verification inP = inQ → P;Q outP = outQ Relational Properties of Algorithms Refinement

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 3/29

slide-6
SLIDE 6

Verification of Relational Properties

Use Cases: Non-interference / Information flow low1 = low2 → P1;P2 low1 = low2 Regression Verification inP = inQ → P;Q outP = outQ Relational Properties of Algorithms ballots1 ∼ ballots2 → P1;P2 winner1 ≈ winner2 Refinement

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 3/29

slide-7
SLIDE 7

Verification of Relational Properties

Use Cases: Non-interference / Information flow low1 = low2 → P1;P2 low1 = low2 Regression Verification inP = inQ → P;Q outP = outQ Relational Properties of Algorithms ballots1 ∼ ballots2 → P1;P2 winner1 ≈ winner2 Refinement inAbs ∼ inConcr → Abs;Concr outAbs ≈ outConcr

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 3/29

slide-8
SLIDE 8

Relational vs. Function

Functional Verification: Prove property for one program P Relational Verification: Prove relation between two programs P, Q

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 4/29

slide-9
SLIDE 9

Relational vs. Function

Functional Verification: Prove property for one program P Effort grows with size/complexity of P Relational Verification: Prove relation between two programs P, Q

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 4/29

slide-10
SLIDE 10

Relational vs. Function

Functional Verification: Prove property for one program P Effort grows with size/complexity of P Relational Verification: Prove relation between two programs P, Q Effort grows with size/complexity of ∆(P, Q)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 4/29

slide-11
SLIDE 11

Relational vs. Function

Functional Verification: Prove property for one program P Effort grows with size/complexity of P Relational Verification: Prove relation between two programs P, Q Effort grows with size/complexity of ∆(P, Q) Verification considers P, Q simultaneously!

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 4/29

slide-12
SLIDE 12

General Setting

deductive reasoning about complex interferences / flows with high precision at program level “small” programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 5/29

slide-13
SLIDE 13

Relational Verification

Loop synchronisation

f1 f2

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-14
SLIDE 14

Relational Verification

Loop synchronisation

f1 f2

= =

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-15
SLIDE 15

Relational Verification

Loop synchronisation

f1 f2

= =

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-16
SLIDE 16

Relational Verification

Loop synchronisation

f1 f2

= = =

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-17
SLIDE 17

Relational Verification

Loop synchronisation

f1 f2

= = =

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-18
SLIDE 18

Relational Verification

Loop synchronisation

f1 f2

= =

Cpl Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-19
SLIDE 19

Relational Verification

Loop synchronisation

f1 f2 Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-20
SLIDE 20

Relational Verification

Loop synchronisation

f1 f2 Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-21
SLIDE 21

Relational Verification

Loop synchronisation

f1 f2

= =

Cpl Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-22
SLIDE 22

Relational Verification

Loop synchronisation

f1 f2

=

Cpl Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-23
SLIDE 23

Relational Verification

Loop synchronisation

f1 f2

=

Cpl Cpl Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-24
SLIDE 24

Relational Verification

Loop synchronisation

f1 f2

=

Cpl Cpl Cpl

=

Coupling Invariant Cpl

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 6/29

slide-25
SLIDE 25

Synchronised Traces

B n1 n2

. . .

E

ΨB,n1 Ψn1,n2 Ψn2,n3 Ψnk,E

B n1 n2

. . .

E

ΦB,n1 Φn1,n2 Φn2,n3 Φnk, E

CplB Cpln1 Cpln2 CplE

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 7/29

slide-26
SLIDE 26

Relational Verification

for

Object-oriented Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 8/29

slide-27
SLIDE 27

KeY Project

www.key-project.org

Project Consortium

Bernhard Beckert Karlsruhe Institute of Technology Reiner H¨ ahnle TU Darmstadt Wolfgang Ahrendt Chalmers Univ., Gothenburg

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-28
SLIDE 28

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-29
SLIDE 29

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-30
SLIDE 30

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-31
SLIDE 31

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-32
SLIDE 32

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-33
SLIDE 33

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-34
SLIDE 34

KeY Project

www.key-project.org

Deductive Verification of

Java Specification: Java Modeling Language Source-code level

KeY Tool

Deductive rules for all Java features Symbolic execution Java Card (Java 1.4) Semi-automated (automation and usability both important)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 9/29

slide-35
SLIDE 35

Object-Sensitive Non-interference

Leakage by aliasing

void m( ) { C c1 = new C ( ) ; / / new obj C c2 = c1 ; / / a l i a s c2 . x = high ; low = c1 . x ;

}

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 10/29

slide-36
SLIDE 36

Object-Sensitive Non-interference

Leakage by aliasing

void m( ) { C c1 = new C ( ) ; / / new obj C c2 = c1 ; / / a l i a s c2 . x = high ; low = c1 . x ;

}

NOT SECURE

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 10/29

slide-37
SLIDE 37

Object-Sensitive Non-interference

Object creation and object identity

i f ( high >0) { low1 = new C ( ) ; low2 = new C ( ) ;

} else {

low2 = new C ( ) ; low1 = new C ( ) ;

}

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 11/29

slide-38
SLIDE 38

Object-Sensitive Non-interference

Object creation and object identity

i f ( high >0) { low1 = new C ( ) ; low2 = new C ( ) ;

} else {

low2 = new C ( ) ; low1 = new C ( ) ;

}

SECURE

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 11/29

slide-39
SLIDE 39

E-Voting Case Study

Joint work with Ralph K¨ usters, Trier Gregor Snelting, Karlsruhe

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 12/29

slide-40
SLIDE 40

E-Voting Case Study

Joint work with Ralph K¨ usters, Trier Gregor Snelting, Karlsruhe

Proof Goal

The sum is the only information about the votes that is leaked.

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 12/29

slide-41
SLIDE 41

E-Voting Case Study

Joint work with Ralph K¨ usters, Trier Gregor Snelting, Karlsruhe

Proof Goal

The sum is the only information about the votes that is leaked.

Hybrid Approach [GRSD 2013]

information-flow analysis in JOANA (w/o declassification)

+ functional verification in KeY = non-interference with declassification

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 12/29

slide-42
SLIDE 42

E-Voting Case Study

Joint work with Ralph K¨ usters, Trier Gregor Snelting, Karlsruhe

Proof Goal

The sum is the only information about the votes that is leaked.

Hybrid Approach [GRSD 2013]

information-flow analysis in JOANA (w/o declassification)

+ functional verification in KeY = non-interference with declassification

Simplified system fully verified (functional and information-flow)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 12/29

slide-43
SLIDE 43

Relational Verification

  • f

Programmable Logic Controllers

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 13/29

slide-44
SLIDE 44

PLC Software Equivalence

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 14/29

slide-45
SLIDE 45

PLC Software Equivalence

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 14/29

Collaboration with

  • Prof. Vogel-Heuser
slide-46
SLIDE 46

Programmable Logic Controllers (PLCs)

special-purpose programming languages (IEC 61131, . . . ) simple structure (scan cycles)

slide-47
SLIDE 47

Programmable Logic Controllers (PLCs)

special-purpose programming languages (IEC 61131, . . . ) simple structure (scan cycles) scan inputs execute routine update outputs

  • Relational vs. Functional

Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 15/29

slide-48
SLIDE 48

Equivalence of PLC Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 16/29

IF x AND y THEN z := TRUE ENDIF ...

in1

  • ut1
slide-49
SLIDE 49

Equivalence of PLC Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 16/29

ρ1

IF x AND y THEN z := TRUE ENDIF ...

in1

  • ut1
slide-50
SLIDE 50

Equivalence of PLC Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 16/29

State

ρ1

IF x AND y THEN z := TRUE ENDIF ...

in1

  • ut1
slide-51
SLIDE 51

Equivalence of PLC Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 16/29

IF x THEN z := y ENDIF ...

in2

  • ut2

ρ2

State State

ρ1

IF x AND y THEN z := TRUE ENDIF ...

in1

  • ut1
slide-52
SLIDE 52

Equivalence of PLC Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 16/29

IF x THEN z := y ENDIF ...

in2

  • ut2

ρ2

State State

= =

ρ1

IF x AND y THEN z := TRUE ENDIF ...

in1

  • ut1
slide-53
SLIDE 53

Workflow

Relational Verfication Workflow for PLC: P1 P2 symbex IR symbex IR VCG SMV NuXMV

  • env. model

✓ ✗

  • Relational vs. Functional

Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 17/29

slide-54
SLIDE 54

Workflow

Relational Verfication Workflow for PLC: P1 P2 symbex IR symbex IR VCG SMV NuXMV

  • env. model

✓ ✗

  • Relational vs. Functional

Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 17/29

slide-55
SLIDE 55

Workflow

Relational Verfication Workflow for PLC: P1 P2 symbex IR symbex IR VCG SMV NuXMV + IC3

  • env. model

✓ ✗

  • Relational vs. Functional

Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 17/29

slide-56
SLIDE 56

Attacker Model

Attacker: Can change system parameters (remote maintenace)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 18/29

slide-57
SLIDE 57

Attacker Model

Attacker: Can change system parameters (remote maintenace) Proof Goal: No interference with critical functionality (safety features)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 18/29

slide-58
SLIDE 58

Non-interference of Parameters with Safety Feature

Sensor values PLC[ Parameter ] SpecEmergency Actuator values Actuator values PLC-Software Specification

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 19/29

slide-59
SLIDE 59

Non-interference of Parameters with Safety Feature

Proof Obligation ∀Parameter : G (Emergency → PLC[ Parameter ] ≈ Spec Emergency)

PLC[ Parameter ] :

s0 s1 s2 s3 s4 s5 s6 s7

SEmergency :

e0 e1 e2 e3 Emergency Mode

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 20/29

slide-60
SLIDE 60

Case Study: Pick-and-Place Unit

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 21/29

slide-61
SLIDE 61

Case Study: Pick-and-Place Unit

50 Init TRUE Start_Crane interconnectCraneStartCommand Crane_Init CraneDown Crane_Init… CraneUp Interstep StartVar Interstep_2 SliderMovedOut TimeDelay TimeDelay_Timer_interconnect Turn_Right CraneOnMagazin Interstep_… WorkpieceReady Magazin_St… CraneSucked Step0 NOT ShouldIStamp Crane_Lift… CraneUp Crane_Turn… CraneOnConveyor Crane_On_C… CraneDown ShouldIStamp Crane_Lift… CraneUp Crane_Turn… CranePositionStamp Crane_On_S… CraneDown release_Wo… TRUE Crane_Go_Up CraneUp pause interconnect Reset_inte… SliderMovedOut Lower_Crane CraneDown Suck_At_St… CraneSucked Crane_Lift… CraneUp Crane_Turn… CraneOnConveyor Crane_On_C… CraneDown release TRUE Crane_Lift… TRUE (NOT WorkpieceReady) AND (StampSliderFilled) Wait_At_St… TRUE pause (NOT WorkpieceReady) AND (NOT StampSliderFilled) Step2 TRUE Start_Crane Interstep Init TRUE Start_Stamp interconnectStampStartCommand Green_Lamp TRUE Stamp_Init… StampSliderSensorMovedIn Stamp_Init… StampSliderSensorMovedOut Stamp_Init… StampLowered Stamp_Init… StampUp Interstep StartVar Interstep_2 StampSliderFilled Step0 CraneUp StampSlide… StampSliderSensorMovedIn StampProce… StampLowered Step1 interconnect StampSlide… StampSliderMovedOut Step2 CraneOnConveyor Interstep Init TRUE Start_Maga… interconnectMagazinStartCommand Green_Lamp TRUE Magazin_In… TRUE Magazin_In… TRUE Interstep StartVar convey CraneOnMagazin Step0 CraneDown Slider_Mov… CraneUp Step1 CraneOnConveyor Interstep

Start StampUp StampDown

ButtonUp ButtonDown ButtonUp ButtonDown ¬Emerg ¬Emerg

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 22/29

slide-62
SLIDE 62

Case Study: Pick-and-Place Unit

50 Init TRUE Start_Crane interconnectCraneStartCommand Crane_Init CraneDown Crane_Init… CraneUp Interstep StartVar Interstep_2 SliderMovedOut TimeDelay TimeDelay_Timer_interconnect Turn_Right CraneOnMagazin Interstep_… WorkpieceReady Magazin_St… CraneSucked Step0 NOT ShouldIStamp Crane_Lift… CraneUp Crane_Turn… CraneOnConveyor Crane_On_C… CraneDown ShouldIStamp Crane_Lift… CraneUp Crane_Turn… CranePositionStamp Crane_On_S… CraneDown release_Wo… TRUE Crane_Go_Up CraneUp pause interconnect Reset_inte… SliderMovedOut Lower_Crane CraneDown Suck_At_St… CraneSucked Crane_Lift… CraneUp Crane_Turn… CraneOnConveyor Crane_On_C… CraneDown release TRUE Crane_Lift… TRUE (NOT WorkpieceReady) AND (StampSliderFilled) Wait_At_St… TRUE pause (NOT WorkpieceReady) AND (NOT StampSliderFilled) Step2 TRUE Start_Crane Interstep Init TRUE Start_Stamp interconnectStampStartCommand Green_Lamp TRUE Stamp_Init… StampSliderSensorMovedIn Stamp_Init… StampSliderSensorMovedOut Stamp_Init… StampLowered Stamp_Init… StampUp Interstep StartVar Interstep_2 StampSliderFilled Step0 CraneUp StampSlide… StampSliderSensorMovedIn StampProce… StampLowered Step1 interconnect StampSlide… StampSliderMovedOut Step2 CraneOnConveyor Interstep Init TRUE Start_Maga… interconnectMagazinStartCommand Green_Lamp TRUE Magazin_In… TRUE Magazin_In… TRUE Interstep StartVar convey CraneOnMagazin Step0 CraneDown Slider_Mov… CraneUp Step1 CraneOnConveyor Interstep

Start StampUp StampDown

ButtonUp ButtonDown ButtonUp ButtonDown ¬Emerg ¬Emerg

Relational: 300ms Functional: timeout (30 min)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 22/29

slide-63
SLIDE 63

Relational Verification

  • f

C Programs

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 23/29

slide-64
SLIDE 64

Workflow

Workflow for PLC: P1 P2 symbex IR symbex IR VCG SMV NuXMV + IC3

  • env. model

✓ ✗

  • Relational vs. Functional

Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 24/29

slide-65
SLIDE 65

Workflow

Workflow for PLC: P1 P2 symbex IR symbex IR VCG SMV NuXMV + IC3

  • env. model

✓ ✗

  • Workflow for C Programs:

P1 P2 CLANG LLVM CLANG LLVM VCG Horn Clau- ses SMT

✓ ✗

  • Coupling invariant inferred automatically!

(Z3/Eldarica)

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 24/29

slide-66
SLIDE 66

Our approach by example

Original code int f1(int n) { int result = 1; n = n/10; while(n > 0) { result ++; n = n/10; } return result; }

What does it compute?

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 25/29

slide-67
SLIDE 67

Our approach by example

Original code int f1(int n) { int result = 1; n = n/10; while(n > 0) { result ++; n = n/10; } return result; }

What does it compute?

... the number of decimal digits of a non-negative number n.

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 25/29

slide-68
SLIDE 68

Behaviour preserved?

Original code int f1(int n) { int result = 1; n = n/10; while(n > 0) { result ++; n = n/10; } return result; } Optimised version int f2(int n) { int result = 1; while(true) { if(n<10) return result; if(n<100) return result+1; if(n<1000) return result+2; if(n<10000) return result+3; n /= 10000; result += 4; } return result; }

Optimisation uses fewer divisions (≈ 7 times faster)

[A. Alexandrescu. Three optimization tips for C++, 2012]

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 26/29

slide-69
SLIDE 69

Demo: rˆ eve Tool

Regression verification:

formal.iti.kit.edu/improve/reve/

Non-interference:

formal.iti.kit.edu/improve/reve/noninter/

Try for yourself!

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 27/29

slide-70
SLIDE 70

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 28/29

slide-71
SLIDE 71

Relational vs. Functional Object-oriented Programs Programmable Logic Controllers C Programs Demo Reve Tool Bernhard Beckert – Relational Specification and Verification RS3 Practitioner Event 29/29