The Mobius Program Verification Environment Recent Advances in - - PowerPoint PPT Presentation

▶
the mobius program verification environment recent
SMART_READER_LITE
LIVE PREVIEW

The Mobius Program Verification Environment Recent Advances in - - PowerPoint PPT Presentation

Jan 17, 2024 317 likes •536 views

The Mobius Program Verification Environment Recent Advances in Extended Static Checking Joe Kiniry, University College Dublin Joe Kiniry, University College Dublin http://mobius.inria.fr/ http://mobius.inria.fr/ Contract n IST 015905

slide-1
SLIDE 1

The Mobius Program Verification Environment

Joe Kiniry, University College Dublin

Contract n° IST 015905

http://mobius.inria.fr/

This presentation reflects only the author’s views the Community is not liable for any use that may be made of the information contained therein This work was funded in part by the Information Society Technologies programme of the European Commission, Future and Emerging Technologies under the IST-2005-015905 MOBIUS Project.

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security 1

Recent Advances in Extended Static Checking

Joe Kiniry, University College Dublin

Contract n° IST 015905

http://mobius.inria.fr/

This work was funded in part by the Information Society Technologies programme of the European Commission, Future and Emerging Technologies under the IST-2005-015905 MOBIUS Project.

slide-2
SLIDE 2

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security 2

Extended Static Checking for Java

  • ESC/Java is an extended static checker
  • originated with DEC/Compaq SRC
  • used a minimal annotation language
  • behaves like a compiler
  • error messages similar to javac & gcc
  • completely automated
  • hides enormous complexity from user
  • ESC/Java2: an über-extended static

checker for JML-annotated Java

  • includes about a dozen new ESCers
  • integrated with Eclipse
  • supports multiple logics and provers
  • represents the work of dozens of people
slide-3
SLIDE 3

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

The Mobius Program Verification Environment

  • general-purpose architecture for JML/

Java-centric program analysis and verification

  • formalized toolbus and architecture

based upon existing component model

  • integration of automatic and interactive

provers (e.g., Simplify, CVC3, and Coq)

  • ESC/Java2 is evolving into ESC/Java3

within this framework

3

slide-4
SLIDE 4

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

static checking full program verification

extended static checking

Evolution of Static and Interactive Checkers/Verifiers quality 100% effort

Note: graph is not to scale type systems lint SRC ESC/Java ESC/Modula III ESC/Java2 ESC/Java3

4

Krakatoa Loop KeY MOBIUS

slide-5
SLIDE 5

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

ESC/Java2 Architecture

5

ESC a package/ module/method command line switches

  • utput "pass"
  • r warning

scanning/ lexing parsing typechecking Java + JML AST JML specifications BML specifications Java Source Java Bytecode GC language DSA form verification condition Java to DSA translation DSA to GC Java to GC VCgen pretty-print concrete syntax emit VC to prover Decision produce warning interpret feedback produce "pass" display warning or pass

slide-6
SLIDE 6

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

ESC’s Key Strengths

  • push-button automation
  • tool robustness
  • user feedback with no user specifications
  • integration with popular IDE (Eclipse)
  • large amounts of decent documentation
  • availability of slides, examples, tutorials
  • community size and involvement
  • popularity amongst FM community

6

slide-7
SLIDE 7

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

ESC’s Main Weaknesses

  • IP issues because of non-standard license
  • platform design, implementation, and

documentation problems

  • the need for fairly complete specs
  • insufficient developer involvement (for all

the ideas we have)

  • false positives and false negatives; aka

soundness and completeness issues

  • sometimes complex user feedback

7

slide-8
SLIDE 8

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Some Features Available in ESC/Java2 in the Mobius PVE

  • nearly full JML coverage (with refinement)
  • purity checking
  • frame axiom checking
  • soundness & completeness warning system
  • specification consistency checker
  • specification-aware dead code detection
  • under-defined specification checking
  • universes type checking
  • AST and GC graphical rendering
  • generic automatic prover interface
  • sorted and unsorted verification condition representation
  • support for multiple automated and interactive provers
  • proof generation from an automated prover
  • incorporation of other lightweight static checkers
  • process integration

8

slide-9
SLIDE 9

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Some Features Available in ESC/Java2 in the Mobius PVE

  • nearly full JML coverage (with refinement)
  • purity checking
  • frame axiom checking
  • soundness & completeness warning system
  • specification consistency checker
  • specification-aware dead code detection
  • under-defined specification checking
  • universes type checking
  • AST and GC graphical rendering
  • generic automatic prover interface
  • sorted and unsorted verification condition representation
  • support for multiple automated and interactive provers
  • proof generation from an automated prover
  • incorporation of other lightweight static checkers
  • process integration

9

slide-10
SLIDE 10

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Mobius PVE Verification Bus Features

  • Mobius VC back-end
  • unsorted and sorted VC representation
  • logic-aware syntax generation to several

automatic and interactive theorem provers

  • generation of Mobius VCs in Base Logic in Coq
  • Mobius ESC VC back-end
  • generation of ESC VCs in ESC Logics
  • generate ESC VCs for several automatic and

interactive theorem provers

  • extended static checking of ESC VCs with

rich in-editor feedback

10

slide-11
SLIDE 11

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Mobius PVE Verification Bus Features

  • Mobius Prover back-end
  • generic interaction with a variety of

automatic and interactive theorem provers

  • automatic provers supported

– Simplify, SMT, CVC3, Yices, Fx7

  • interactive provers supported

– Coq and PVS

  • proof status maintenance
  • proof unit/smoke testing
  • automatic and seamless proof sharing

amongst distributed collaborators

11

slide-12
SLIDE 12

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Mobius PVE Verification Bus Features

  • integration of other lightweight static

checkers

  • e.g., CheckStyle, FindBugs, and PMD
  • tune rules to guide programmer toward

writing code that is easier to ESC and verify

  • regular, lightweight checking early is

dramatically better than heavyweight checking late

  • help system and process management
  • task and feature tracking
  • online hypertext architecture docs and help

12

slide-13
SLIDE 13

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Focus of Current Work

  • completely FLOSS software foundation
  • complete documentation
  • rich platform integration
  • multiple provers and multiple logics
  • FreeBoogie integration
  • improved developer feedback
  • full integration into software process
  • integration with full verification and

refinement-based modeling languages

  • new, complex case studies

13

slide-14
SLIDE 14

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Ongoing Work

  • new JML model classes
  • pure, immutable, functional, executable,

referential equality-centric, fully unit tested and ESCed, tuned for static checking

  • FreeBoogie subsystem
  • FreeBoogiePL = structured and

unstructured BoogiePL + explicit heap + separation logic

  • FreeBoogie VC generation to target Mobius

VC back-end, thus support multiple provers

14

slide-15
SLIDE 15

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Ongoing Work

  • reflective unit testing
  • new generation of JMLunit that is

specification, source, and bytecode-aware

  • EBON-JML bicompiler
  • seamless and reversible translation to/from

EBON to JML

  • refinement will support informal and

formal documentation, system events, scenarios, allocation, and ownership

  • domain-specific annotations with formal

semantics integrated into refinement

15

slide-16
SLIDE 16

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Ongoing Work

  • ESC/Java3
  • use new JML front-end (JML[345])
  • reason about Java 1.5 source and bytecode
  • target FreeBoogie as IR
  • leverage recent work in separation logic
  • support automated multiple provers
  • selectively target interactive provers
  • perform contextually aware, cross-prover,

cross-logic checking

  • deeper process integration, particularly

across large teams as architecture evolves

16

slide-17
SLIDE 17

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

ESC/Java as a Research Vehicle for Static Checking

  • dozens of groups use ESC/Java2 for

teaching and research

  • use in teaching
  • Java programming
  • software engineering
  • formal methods
  • examples of external research
  • specification under-definedness checker
  • PVS VC generation
  • Houdini “rebirth”
  • Daikon + ESC/Java2 integration

17

slide-18
SLIDE 18

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Mobius PVE Status

  • full support available for:
  • all Java and nearly all JML features
  • editing, compilation, doc generation, etc.
  • code complexity and style checking
  • source and bytecode-level static checkers
  • partial BML support
  • no editing of BML or bytecode
  • Mobius VC back-end
  • Mobius Prover back-end
  • interactive proof support for Coq

18

slide-19
SLIDE 19

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Mobius PVE Next Steps

  • next version to integrate the subsystems:
  • full BML support
  • Universe type inference
  • FreeBoogie and the Race Condition Checker
  • user feedback of proof state in JML/Java
  • proof status and unit/smoke testing
  • Mobius VC generator (in Coq)
  • interactive proof support for PVS
  • Coq PCC certificate generation
  • basic help system and process management

19

slide-20
SLIDE 20

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Integrating KeY and Mobius and ESC/Java

  • integrate the Mobius prover interface in

the KeY system

  • KeY can use new SMT provers “for free”
  • provers run locally or remotely
  • JML to JavaDL bicompiler
  • theory-aware translation to/from a

fragment of JavaDL and JML

  • an ESC-centric sublogic
  • understand what kinds of VCs are

automatically discharged and build new VCgen that targets that sublogic

20

slide-21
SLIDE 21

KeY Symposium, 16 June 2007 Mobius: Mobility, Ubiquity, Security

Questions or Comments?

21