Asankhaya Sharma, profile picture
Uploaded byAsankhaya Sharma
PPTX, PDF1,017 views

Certified Reasoning for Automated Verification

The document presents a PhD defense by Asankhaya Sharma focused on certified reasoning to improve automated verification in software development. Key contributions include the development of a certified decision procedure for Presburger arithmetic (omega++), a proof system for compatible sharing in data structures (hipcomp), and a program for verified subtyping (sleek dsl). Future work aims to integrate complete functional proofs with automated verification techniques.

Embed presentation

Download to read offline
Certified Reasoning for Automated Verification Asankhaya Sharma PhD Defense
Building Reliable Software • Formal Verification – Proving correctness of programs • Testing – Discovering bugs in programs 10/6/2015 PhD Defense 2
Formal Methods Work Hall, Anthony. "Realising the Benefits of Formal Methods." J. UCS 13.5 (2007): 669-678. 10/6/2015 PhD Defense 3
Thesis “Certified reasoning improves the correctness and expressivity of automated verification without sacrificing on performance” 10/6/2015 PhD Defense 4
Certified Reasoning • Correctness is machine checked – (Decision) Procedures – Proofs – Programs • Using the Coq Proof Assistant 10/6/2015 PhD Defense 5
Automated Verification • Hoare Logic – Specify pre and post conditions for each method • Separation Logic – Heap manipulating programs – Separating conjunction “*” denotes disjoint heaps • Using the HIP/SLEEK Verification System 10/6/2015 PhD Defense 6
Why Certify? • Correctness – Find bugs in implementation of the verifier • Expressivity – Verifying more properties by extending decision procedures to cover richer domain/logic • Performance – Code generated from certified procedure should be scalable 10/6/2015 PhD Defense 7
Thesis Contributions • Certified Decision Procedure (Omega++) – Certified Reasoning with Infinity • Certified Proof (HIPComp) – Specifying Compatible Sharing in Data Structures – Automated Verification of Ramifications in SL • Certified Program (SLEEK DSL) – Verified Subtyping with Traits and Mixins 10/6/2015 PhD Defense 8
Certified Reasoning with Infinity
PAInf Domain • Presburger arithmetic (PA) is the first order theory of natural numbers with addition – Linear integer arithmetic with constant multiplication • We present Omega++, a decision procedure for Presburger arithmetic extended with +∞ and -∞ – Omega++ is implemented in Coq – Implementation is generated using extraction • Allows using infinity as a ghost constant in specifications 10/6/2015 PhD Defense 10
Example data node{ int val; node next} sortedll<min> == root::node<min,null> or root::node<min,p> * p::sortedll<mt> & min <= mt sortedll<min> == root = null & min = ∞ or root::node<min,p> * p::sortedll<mt> & min <= mt val next 10/6/2015 PhD Defense 11
Example node insert(node x, node y) {// code for insertion into sorted list} Pre - y::node<v,null> & x = null or x::sortedll<a> * y::node<v,null> Post - res::sortedll<b> & x = null & b = v or res::sortedll<b> & b = min(a,v) Pre - x::sortedll<a> * y::node<v,null> Post - res::sortedll<b> & b = min(a,v) More concise specification with infinity 10/6/2015 PhD Defense 12
Related Work Lasaruk, Aless, and Thomas Sturm. "Effective quantifier elimination for presburger arithmetic with infinity." Computer Algebra in Scientific Computing. Springer Berlin Heidelberg, 2009. Kapur, Deepak, et al. "Geometric quantifier elimination heuristics for automatically generating octagonal and max-plus invariants." Automated Reasoning and Mathematics. Springer Berlin Heidelberg, 2013. 189-228. Domain Implemented Certified Proof Expressivity [Lasaruk 2009] PA U {∞} ✗ ✗ Cannot express ordering (no < symbol) [Kapur 2013] PA U {-∞,+∞} ✗ ✗ Can express ordering (includes < symbol) Omega++ PA U {-∞,+∞} ✓ ✓ Can express ordering, min and max constraints 10/6/2015 PhD Defense 13
Omega++ Procedure 1. Quantifier Elimination 2. Normalization 3. Simplification 4. Omega 10/6/2015 PhD Defense 14
Parameterized Semantics • Six different customized semantics – 0 * ∞ : {0,⊥,∞} – Choose between a two valued or three valued logic 10/6/2015 PhD Defense 15
(1) Quantifier Elimination Reduce quantifiers to finite domain of integers 10/6/2015 PhD Defense 16
(2) Normalization Evaluate variables in finite domain plus infinity symbols 10/6/2015 PhD Defense 17
10/6/2015 Eliminate infinities PhD Defense 18
(3) Simplification 10/6/2015 Eliminate min max and constant constraints PhD Defense 19 Propagate undefined
(4) Omega • The formula is now in PA so we can use an existing decision procedure for PA to solve it – Omega Calculator 10/6/2015 PhD Defense 20
Implementation • Omega++ is implemented in Coq – Program (in Gallina) and Proof – http://loris- 7.ddns.comp.nus.edu.sg/~project/SLPAInf/ • OCaml code is generated from Coq using extraction – Extracted code is integrated with HIP/SLEEK 10/6/2015 PhD Defense 21
Coq Development Coq File Program Proof Time (s) Description Theory.v 585 737 20.68 Syntax and Semantics Transformation.v 380 1203 31.07 Normalization Simplification.v 0 856 338.96 Tactics/lemmas for simplification Extraction.v 257 0 1.27 Module to extract OCaml code 1192 2796 391.98 Total Coq Ratio of proof to program is 2.35 Proof scripts take 6+ minutes to type check Simplification procedure was easy to write but difficult to prove due to large number of cases, we use Ltac (Coq’s proof tactic language) to automate the proof search 10/6/2015 PhD Defense 22
Correctness Tool Sound Complete Termination Semantics Verified OCaml Prototype No No Unclear Unclear No Omega++ Yes Yes Guaranteed Precise In Coq Prototype’s version of normalization did additional case analysis. Due to our careful treatment of quantifier elimination we were able to prove that much of this case analysis was unnecessary in our Coq tool. The Coq development identified a soundness bug in the OCaml prototype, which allowed the invalid transformation x ≥ y  x+1 > y, which is false when x = y = ∞ 10/6/2015 PhD Defense 23
Expressivity (and Conciseness) Benchmark LOC Disjuncts (PA) Time (Ω) Disjuncts (PAInf) Time(Ω++) Insertion Sort 30 4 0.14 2 0.15 Selection Sort 69 14 0.36 7 0.35 BST 105 12 0.43 6 0.35 Bubble Sort 110 12 0.29 9 0.50 Merge Sort 91 6 0.32 4 1.81 Priority Queue 207 16 0.84 10 2.73 Total Correctness 21 - - 2 0.21 Sort Min Max 79 - - 7 1.82 10/6/2015 PhD Defense 24
Optimizations • No desugaring of formulas – Handling full constraint language with all operators made the proof more tedious but was important for performance • Support two kinds of quantifiers, over PA and PAInf – Program variables quantify over PA while specification variables over PAInf • Implement formula simplification – Keeps the size small but increased the time taken to check the proof scripts • Treat string (used for variables and arbitrary integers) in Coq as abstract – Use OCaml’s string data type which is more efficient 10/6/2015 PhD Defense 25
Performance Benchmark Calls Time (Lasaruk) Time (Proto) Time (Ω++) Insertion Sort 100 4.58 0.78 0.39 Selection Sort 245 >600.00 0.62 0.78 BST 116 150.00 0.48 0.50 Bubble Sort 336 >600.00 1.25 1.34 Merge Sort 155 >600.00 1.05 1.92 Priority Queue 778 >600.00 FAIL 1.20 Total Correctness 120 >600.00 0.31 0.16 Sort Min Max 376 >600.00 0.29 0.19 10/6/2015 PhD Defense 26
Specifying Compatible Sharing in Data Structures
Frame Rule P RP * R Frame Rule P {c} Q ------------------- P * R {c} Q * R 10/6/2015 PhD Defense 28
From Separation to Sharing • Disjoint Heaps (*) – x::node<a,b> * y::node<c,d> • Aliased Heaps (&) – x::node<a,b> & y::node<c,d> • Overlaid Heaps (&*) – x::node<a,_> &* y::node<_,d> 10/6/2015 PhD Defense 29
Overlaid Data Structures 10/6/2015 PhD Defense 30
Compatible Sharing Disk IO Scheduler – List of Nodes (ll) and Tree of Nodes (tree) – The linked list and tree represent multiple views over same set of nodes data node{ int val; node next; node parent; node left; node right;} 10/6/2015 PhD Defense 31
Related Work Lee, Oukseh, Hongseok Yang, and Rasmus Petersen. "Program analysis for overlaid data structures." Computer Aided Verification. Springer Berlin Heidelberg, 2011. Drăgoi, Cezara, Constantin Enea, and Mihaela Sighireanu. "Local Shape Analysis for Overlaid Data Structures." Static Analysis. Springer Berlin Heidelberg, 2013. 150-171. Expressivity Entailment Procedure Program Analysis Local Reasoning Certified Proof Properties [Lee 2011] List and Tree ✗ ✓ ✗ ✗ Shape [Drăgoi 2013] Only Lists ✗ ✓ ✓ ✗ Shape HIPComp User Defined Predicates ✓ ✗ ✓ ✓ Shape, Size and Bag 10/6/2015 PhD Defense 32
LL &* Tree ll<S> == root = null & S = {} or root::node<_@I,p,_@A,_@A,_@A> * p::ll<Sp> & S = Sp U {root} tree<p,S> == root = null & S = {} or root::node<_@I,_@A,p,l,r> * l::tree<root,Sl> * r::tree<root,Sr> & S = Sl U Sr U {root} x::ll<S> &* t::tree<_,S> Field Annotations @A – Absent @I – Immutable Memory Footprint S – Set of Addresses 10/6/2015 PhD Defense 33
Memory Specifications XMem(P) = {}->() XMem(H & P) = XMem(H) XMem(H1 * H2) = XMem (H1) DU XMem(H2) XMem(H1 &* H2) = XMem(H1) U XMem(H2) XMem(x::node<v@I,p>) = {x}->(node<@I,@M>) XMem(x::ll<S>) = S->() A memory specification of a predicate is of the form S->L S is the set of addresses and L is the list of field annotations x::ll<S> &* t::tree<_,S> XMem(x::ll<S>) = S->(node<@I,@M,@A,@A,@A>) XMem(t::tree<_,S>) = S->(node<@I,@A,@M,@M,@M) Compatible Fields @A @M @M @A @I @I 10/6/2015 PhD Defense 34
Compatible Frame Rule Compatible(P,R) Compatible(Q,R) P {c} Q ----------------------------------- P &* R {c} Q &* R 10/6/2015 PhD Defense 35 Same memory and compatible field annotations
void move_request(node q1s, node q2, node q1t) requires q1s::ll<S> &* q1t::tree<_,S> * q2::ll<T> ensures q1s::ll<Su> &* q1t::tree<_,Su> * q2::ll<Tu> & S = union(Su,{q1s}) & Tu = union(T,{q1s}); { node c; c = list_remove_first(q1s); if (c == null) return; tree_remove(c,q1t); list_add_first(q2,c); c = null; } DISK IO Scheduler Example 10/6/2015 PhD Defense 36
Implementation • Developed an entailment procedure using memory specification and compatible sharing • HIPComp Tool and Coq Proofs – A prototype in Objective Caml http://loris- 7.ddns.comp.nus.edu.sg/~project/HIPComp/ – Based on HIP/SLEEK verification system • Benchmark of Programs with Sharing – Examples from papers and system software 10/6/2015 PhD Defense 37
Coq Development Coq File Proof Time (s) Description PA.v 355 2.40 Syntax and Semantics of PA SLPA.v 416 3.38 Reducing Separation Logic to PA SLSET.v 169 7.32 Reducing Separation Logic to MONA 940 13.10 Total Coq Certified functions XPure (SLPA.v) and XMem (SLSET.v) are required to show the soundness of the compatible frame rule 10/6/2015 PhD Defense 38
Correctness • Found two soundness issues – In the paper pen proof of XPure function given in [Chin 2012] a condition was missing (p!=0) in one of the cases – Certifying XMem function helped uncover a soundness bug in the implementation where the order of Matching and Splitting rules was wrong Chin, Wei-Ngan, et al. "Automated verification of shape, size and bag properties via user-defined predicates in separation logic." Science of Computer Programming 77.9 (2012): 1006-1036. 10/6/2015 PhD Defense 39
Expressivity (and Performance) Program LOC Timing (Seconds) Sharing (%) Compatibility (%) PLL (Shape, Size) 30 0.28 100 11 Compatible Pairs 12 0.09 100 25 LL &* SortedLL (Shape, Bag) 175 0.61 22 22 LL &* Tree (Shape) 70 0.24 16 7 Process Scheduler (Shape) 70 0.47 33 23 Disk IO Scheduler (Shape) 88 1.30 16 27 Doubly Circular List (Shape) 50 0.41 50 32 10/6/2015 PhD Defense 40
Conclusions • Omega++ - a certified decision procedure for Presburger arithmetic extended with +∞ and - ∞ • Specification Mechanism for Overlaid Data Structures – Entailment Procedure for Verifying Programs with Compatible Sharing 10/6/2015 PhD Defense 41
Future work • Certified Reasoning for Functional Correctness – Integrate full functional proofs done in Coq with automated proofs generated using HIP/SLEEK • End-to-End Verification – Mathematical Reasoning in Coq – Spatial Reasoning in HIP/SLEEK 10/6/2015 PhD Defense 42
Thank You ! • Questions ? • Contact – asankhaya@u.nus.edu • Publications – Certified Reasoning with Infinity [FM 15] – Verified Subtyping with Traits and Mixins [FSFMA 14] – Exploiting Undefined Behaviors for Efficient Symbolic Execution [ICSE (Student Research Competition) 14] – HIPimm: Verifying Granular Immutability Guarantees [PEPM 14] – A Refinement Calculus for Promela [ICECCS 13] – Towards Complete Specifications with an Error Calculus [NFM 13] 10/6/2015 PhD Defense 43
Additional Slides 10/6/2015 PhD Defense 44
Kleene’s weak three valued logic 10/6/2015 PhD Defense 45
PAInf is a domain extension Valid both in PA and PAInf Valid in PA but Invalid in PAInf 10/6/2015 PhD Defense 46
Useful Properties of PAInf domain 10/6/2015 PhD Defense 47
Application • Quantifier elimination in PAInf for specification inference • Using [Kapur 2012] we support inference of octagonal size constraints using ghost infinity in the presence of heap-based verification Kapur, Deepak. "Program analysis using quantifier-elimination heuristics." Theory and Applications of Models of Computation. Springer Berlin Heidelberg, 2012. 94-108. 10/6/2015 PhD Defense 48
Specification Inference Method Pre Post Inferred Time (Ω++) Create True ll<res,m> m=n 0.13 Delete ll<x,n> ll<res,m> n-1 ≤ m 0.17 Insert ll<x,n> ∧ x!=null ll<x,m> n=m-1 0.13 Copy ll<x,n> * ll<res,m> ll<x,m> m=n 0.16 Remove ll<x,n> ∧ x!=null ll<x,m> n-1 ≤ m ∧ m≤n 0.19 Return ll<x,n> ll<x,m> m=n ∧ 0≤m 0.07 Traverse ll<x,n> ll<x,m> m=n 0.12 Get ll<x,n> ∧ x!=null ll<res,m> m=n-2 ∧ 2≤n 0.11 Head ll<x,n> * ll<y,m> ll<res,n+m-1> 1=min(n,m) 0.21 10/6/2015 PhD Defense 49
Conclusions • Omega++ - a certified decision procedure for Presburger arithmetic extended with +∞ and - ∞ • Integrated Omega++ in HIP/SLEEK verification system and evaluated the usefulness for verification and specification inference 10/6/2015 PhD Defense 50
Verified Subtyping with Traits and Mixins
Object Oriented Design • S – Single Responsibility • O – Open Close • L – Liskov Substitution • I – Interface Segregation • D – Dependency Inversion First proposed by Robert C. Martin in comp.object newsgroup in March 1995 10/6/2015 PhD Defense 52
Liskov Substitution Principle “Let q(x) be a property provable about objects x of type T. Then q(y) should be provable for objects y of type S where S is a subtype of T” - Barbara Liskov and Jeannette Wing 10/6/2015 PhD Defense 53
Behavior Subtyping • Useful to reason about design of class hierarchies • Stronger notion than typical subtyping of functions defined in type theory – Function subtyping is based on contravariance of argument types and covariance of the return type • Behavioral subtyping is trivially undecidable – If the property is “this method always terminates” 10/6/2015 PhD Defense 54
Contributions • Subtyping with Traits and Mixins in Scala – By checking entailments in separation logic • Extend Scala with a domain specific language (SLEEK DSL) – Allows Scala programmers to insert subtyping checks in their programs • Case study on subtyping in Scala Standard Library – Verified subtyping in 67% of Mixins 10/6/2015 PhD Defense 55
Traits and Mixins • Traits – Fine grained unit of reuse – Similar to abstract classes but some methods can have implementations as well • Mixin Composition (Mixin) – A class which contains a combination of methods from other traits and classes – Similar to multiple inheritance if the combination contains all methods of combined classes 10/6/2015 PhD Defense 56
Traits Example trait ICell { def get() : Int def set(x : Int) } trait BICell extends ICell { private var x : Int = 0 def get() { x } def set(x : Int) { this.x = x } } Similar to an Abstract Class Implementation of ICell 10/6/2015 PhD Defense 57
Traits Example (cont.) trait Double extends ICell { abstract override def set(x : Int) { super.set(2*x) } } trait Inc extends ICell { abstract override def set(x : Int) { super.set(x+1) } } 10/6/2015 PhD Defense 58
Mixins Example • OddICell (odd values) – class OddICell extends BICell with Inc with Double • EvenICell (even values) – class EvenICell extends BICell with Double with Inc OddICellDoubleIncBICell EvenICellIncDoubleBICell Class Linearization 10/6/2015 PhD Defense 59
Scala doesn’t enforce Subtyping def m (c: BICell with Inc with Double) : Int { c.get } val oic = new OddICell val eic = new EvenICell m(oic) m(eic) Both calls are allowed by the type system Only object oic is subtype of c 10/6/2015 PhD Defense 60
Verified Subtyping • A mixin can be represented as a separation logic predicate based on class linearization OddICellDoubleIncBICell OddICell<this> == BICell<this,p> * Inc<p,q> * Double<q,null> EvenICellIncDoubleBICell EvenICell<this> == BICell<this,p> * Double<p,q> * Inc<q,null> 10/6/2015 PhD Defense 61
From Subtyping to Entailment • Subtyping can be reduced to checking entailment between the predicates m(oic) OddICell<oic> |- BICell<c,p> * Inc<p,q> * Double<q,null> m(eic) EvenICell<eic> |- BICell<c,p> * Inc<p,q> * Double<q,null> Valid Invalid 10/6/2015 PhD Defense 62
SLEEK DSL • Implementation based on SLEEK – An existing separation logic based entailment prover – Supports user defined predicates and user specified lemmas – With Shape, Size, and Bag properties – http://loris- 7.ddns.comp.nus.edu.sg/~project/SLEEKDSL/ 10/6/2015 PhD Defense 63
Implementation Overview SLEEK exesleek.lib sleek.dsl sleek.inter Scala Programs Scala Interpreter 10/6/2015 PhD Defense 64
Scala with SLEEK DSL def m (c: BICell with Inc with Double) : Int { c.get } val oic = new OddICell val eic = new EvenICell if (OddICell<oic> |- BICell<c,p> * Inc<p,q> * Double<q,null> ) m(oic) if (EvenICell<eic> |- BICell<c,p> * Inc<p,q> * Double<q,null>) m(eic) • Insert checks in Scala programs to verify subtyping using SLEEK DSL 10/6/2015 PhD Defense 65
Experiments • Scala Standard Library • Considered four class hierarchies – Exceptions – Maths – Parser Combinators – Collections 10/6/2015 PhD Defense 66
Results Class Hierarchy Mixins in the Hierarchy Mixins with Verified Subtyping Percentage Exceptions 11 11 100 Maths 5 4 80 Combinators 6 6 100 Collections 27 12 44 Total 49 33 67 Traits provide more flexibility, 33% of Mixins use Traits in a way that does not conform to subytping 10/6/2015 PhD Defense 67
Conclusions • We use entailment proving in separation logic to check subtyping with Traits and Mixins • A domain specific language based on SLEEK to check entailments from Scala programs • Case study based on Scala Standard Library 10/6/2015 PhD Defense 68
Perspectives • Lays the foundation for verifying OO Scala programs – Specification reuse with traits and mixins – Inheritance verification • Static and Dynamic Specifications for traits and mixins – Avoid re-verification – Compositional and modular 10/6/2015 PhD Defense 69

More Related Content

PPT
Tracing Parallel Execution (UKOUG 2006)
byDoug Burns
 
PDF
Deep Convolutional GANs - meaning of latent space
byHansol Kang
 
PPTX
SQCFramework: SPARQL Query containment Benchmark Generation Framework
byMuhammad Saleem
 
PPTX
Heterogeneous Defect Prediction (

ESEC/FSE 2015)
bySung Kim
 
PDF
IPA Fall Days 2019
byAnnibale Panichella
 
PPTX
CppConcurrencyInAction - Chapter07
byDooSeon Choi
 
PDF
딥러닝 중급 - AlexNet과 VggNet (Basic of DCNN : AlexNet and VggNet)
byHansol Kang
 
PDF
Automated Repair of Feature Interaction Failures in Automated Driving Systems
byLionel Briand
 
Tracing Parallel Execution (UKOUG 2006)
byDoug Burns
 
Deep Convolutional GANs - meaning of latent space
byHansol Kang
 
SQCFramework: SPARQL Query containment Benchmark Generation Framework
byMuhammad Saleem
 
Heterogeneous Defect Prediction (

ESEC/FSE 2015)
bySung Kim
 
IPA Fall Days 2019
byAnnibale Panichella
 
CppConcurrencyInAction - Chapter07
byDooSeon Choi
 
딥러닝 중급 - AlexNet과 VggNet (Basic of DCNN : AlexNet and VggNet)
byHansol Kang
 
Automated Repair of Feature Interaction Failures in Automated Driving Systems
byLionel Briand
 

What's hot

PPTX
Automated Program Repair Keynote talk
byAbhik Roychoudhury
 
PDF
PyTorch 튜토리얼 (Touch to PyTorch)
byHansol Kang
 
PPTX
Ember
bymrphilroth
 
PPTX
concurrency gpars
byPaul King
 
PDF
Pyconie 2012
byYaqi Zhao
 
PPTX
Scientific Software Development
byjalle6
 
PDF
Verification of Concurrent and Distributed Systems
byMykola Novik
 
PDF
STAMP Descartes Presentation
bySTAMP Project
 
ODP
Java 5 6 Generics, Concurrency, Garbage Collection, Tuning
byCarol McDonald
 
PPTX
Machine Learning Model Bakeoff
bymrphilroth
 
PPTX
Time Series Analysis for Network Secruity
bymrphilroth
 
PDF
Mutate and Test your Tests
bySTAMP Project
 
PPT
JDK1.7 features
byindia_mani
 
PDF
Property-based Testing and Generators (Lua)
bySumant Tambe
 
PDF
Guaranteeing Consensus in Distriubuted Systems with CRDTs
bySun-Li Beatteay
 
PDF
Industrial Strength Groovy - Tools for the Professional Groovy Developer: Pau...
byPaul King
 
PDF
쉽게 설명하는 GAN (What is this? Gum? It's GAN.)
byHansol Kang
 
PDF
Chapter 8 advanced sorting and hashing for print
byAbdii Rashid
 
PPTX
It's Java Jim, But Not As We Know It!
bySimon Ritter
 
PDF
Concurrency Concepts in Java
byDoug Hawkins
 
Automated Program Repair Keynote talk
byAbhik Roychoudhury
 
PyTorch 튜토리얼 (Touch to PyTorch)
byHansol Kang
 
Ember
bymrphilroth
 
concurrency gpars
byPaul King
 
Pyconie 2012
byYaqi Zhao
 
Scientific Software Development
byjalle6
 
Verification of Concurrent and Distributed Systems
byMykola Novik
 
STAMP Descartes Presentation
bySTAMP Project
 
Java 5 6 Generics, Concurrency, Garbage Collection, Tuning
byCarol McDonald
 
Machine Learning Model Bakeoff
bymrphilroth
 
Time Series Analysis for Network Secruity
bymrphilroth
 
Mutate and Test your Tests
bySTAMP Project
 
JDK1.7 features
byindia_mani
 
Property-based Testing and Generators (Lua)
bySumant Tambe
 
Guaranteeing Consensus in Distriubuted Systems with CRDTs
bySun-Li Beatteay
 
Industrial Strength Groovy - Tools for the Professional Groovy Developer: Pau...
byPaul King
 
쉽게 설명하는 GAN (What is this? Gum? It's GAN.)
byHansol Kang
 
Chapter 8 advanced sorting and hashing for print
byAbdii Rashid
 
It's Java Jim, But Not As We Know It!
bySimon Ritter
 
Concurrency Concepts in Java
byDoug Hawkins
 

Viewers also liked

PDF
My Thesis Defense Presentation
byOnur Taylan
 
PPTX
Prepare your Ph.D. Defense Presentation
byChristian Glahn
 
PPT
Masters Thesis Defense Presentation
bynancyanne
 
KEY
PhD Thesis Defense Presentation
byMariano Martínez Peck
 
PPT
Dissertation oral defense presentation
byDr. Naomi Mangatu
 
PPTX
PhD Defense Presentation_Primus Che Chi_06.03.2016.pptx_updated
byPrimus Che Chi
 
My Thesis Defense Presentation
byOnur Taylan
 
Prepare your Ph.D. Defense Presentation
byChristian Glahn
 
Masters Thesis Defense Presentation
bynancyanne
 
PhD Thesis Defense Presentation
byMariano Martínez Peck
 
Dissertation oral defense presentation
byDr. Naomi Mangatu
 
PhD Defense Presentation_Primus Che Chi_06.03.2016.pptx_updated
byPrimus Che Chi
 

Similar to Certified Reasoning for Automated Verification

PDF
Formal Verification
byIlia Levin
 
PPTX
Ads unit 3 ppt
bypraveena p
 
PDF
Principles of programming languages
byNYversity
 
PDF
ZK Study Club: Sumcheck Arguments and Their Applications
byAlex Pruden
 
PDF
Logic Programming and ILP
byPierre de Lacaze
 
PDF
Monads and Monoids by Oleksiy Dyagilev
byJavaDayUA
 
PDF
Formal methods 4 - Z notation
byVlad Patryshev
 
PPT
Jarrar.lecture notes.aai.2011s.descriptionlogic
byPalGov
 
PPTX
Specifying compatible sharing in data structures
byAsankhaya Sharma
 
PDF
Functional Operations - Susan Potter
bydistributed matters
 
PDF
Sep logic slide
byrainoftime
 
PPTX
20100522 software verification_sharygina_lecture02
byComputer Science Club
 
PDF
talk at Virginia Bioinformatics Institute, December 5, 2013
byericupnorth
 
PDF
programacion funcional.pdf
byFranciscoJavierAcost31
 
PDF
Formalizing (Web) Standards: An Application of Test and Proof
byAchim D. Brucker
 
KEY
Pontificating quantification
byAaron Bedra
 
PPT
Pl vol1
byAarsh Ps
 
PDF
DConf 2016 Opening Keynote
byAndrei Alexandrescu
 
PPT
003 bd ds
byHarish Sahu
 
PDF
Lambda Zero Programming Language Introduction
byclark800
 
Formal Verification
byIlia Levin
 
Ads unit 3 ppt
bypraveena p
 
Principles of programming languages
byNYversity
 
ZK Study Club: Sumcheck Arguments and Their Applications
byAlex Pruden
 
Logic Programming and ILP
byPierre de Lacaze
 
Monads and Monoids by Oleksiy Dyagilev
byJavaDayUA
 
Formal methods 4 - Z notation
byVlad Patryshev
 
Jarrar.lecture notes.aai.2011s.descriptionlogic
byPalGov
 
Specifying compatible sharing in data structures
byAsankhaya Sharma
 
Functional Operations - Susan Potter
bydistributed matters
 
Sep logic slide
byrainoftime
 
20100522 software verification_sharygina_lecture02
byComputer Science Club
 
talk at Virginia Bioinformatics Institute, December 5, 2013
byericupnorth
 
programacion funcional.pdf
byFranciscoJavierAcost31
 
Formalizing (Web) Standards: An Application of Test and Proof
byAchim D. Brucker
 
Pontificating quantification
byAaron Bedra
 
Pl vol1
byAarsh Ps
 
DConf 2016 Opening Keynote
byAndrei Alexandrescu
 
003 bd ds
byHarish Sahu
 
Lambda Zero Programming Language Introduction
byclark800
 

More from Asankhaya Sharma

PPTX
Visualizing Symbolic Execution with Bokeh
byAsankhaya Sharma
 
PDF
Securing Open Source Code in Enterprise
byAsankhaya Sharma
 
PPTX
Developer-focused Software Security
byAsankhaya Sharma
 
PDF
OpenEvolve: an open-source evolutionary coding agent
byAsankhaya Sharma
 
PPT
Crafting a Successful Engineering Career
byAsankhaya Sharma
 
PPTX
Exploiting undefined behaviors for efficient symbolic execution
byAsankhaya Sharma
 
PDF
Design and Implementation of the Security Graph Language
byAsankhaya Sharma
 
PPTX
Verified Subtyping with Traits and Mixins
byAsankhaya Sharma
 
PPT
DIDAR: Database Intrusion Detection with Automated Recovery
byAsankhaya Sharma
 
PPTX
Secure Software Development
byAsankhaya Sharma
 
PDF
9 types of people you find on your team
byAsankhaya Sharma
 
PDF
Last Days of Academy
byAsankhaya Sharma
 
PPT
SayCheese Ad
byAsankhaya Sharma
 
Visualizing Symbolic Execution with Bokeh
byAsankhaya Sharma
 
Securing Open Source Code in Enterprise
byAsankhaya Sharma
 
Developer-focused Software Security
byAsankhaya Sharma
 
OpenEvolve: an open-source evolutionary coding agent
byAsankhaya Sharma
 
Crafting a Successful Engineering Career
byAsankhaya Sharma
 
Exploiting undefined behaviors for efficient symbolic execution
byAsankhaya Sharma
 
Design and Implementation of the Security Graph Language
byAsankhaya Sharma
 
Verified Subtyping with Traits and Mixins
byAsankhaya Sharma
 
DIDAR: Database Intrusion Detection with Automated Recovery
byAsankhaya Sharma
 
Secure Software Development
byAsankhaya Sharma
 
9 types of people you find on your team
byAsankhaya Sharma
 
Last Days of Academy
byAsankhaya Sharma
 
SayCheese Ad
byAsankhaya Sharma
 

Recently uploaded

PPTX
CodeMash 2026 - Optimizing Azure App Services
byBrian McKeiver
 
PPTX
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
PPTX
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
PDF
Safer’s Picks: Recent FME Enhancements with Big Everyday Impact
bySafe Software
 
PPTX
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
PDF
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
PDF
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
PDF
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
PDF
Unlocking Gen AI Capabilities Within UiPath Document Understanding
byDianaGray10
 
PDF
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PPTX
A CIO’s Guide to Salesforce AI Architecture, Governance, and Implementation R...
byKerry Millar
 
PDF
What Is AI LXP and Why Enterprises Are Adopting It.pdf
byneuralminds4
 
PDF
Deploying Windows Clients & Managing Identities
byVICTOR MAESTRE RAMIREZ
 
PPTX
The Abomination of AI – keynote at ICoSCI 2026
byAlan Dix
 
PDF
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
PPT
connectives-linking words in English.ppt
byAmrMohammed82
 
PDF
Lightweight, Travel-Ready Freedom for Adults and Seniors
byTopmate
 
PPTX
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
DOCX
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
CodeMash 2026 - Optimizing Azure App Services
byBrian McKeiver
 
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
Safer’s Picks: Recent FME Enhancements with Big Everyday Impact
bySafe Software
 
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
Unlocking Gen AI Capabilities Within UiPath Document Understanding
byDianaGray10
 
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
A CIO’s Guide to Salesforce AI Architecture, Governance, and Implementation R...
byKerry Millar
 
What Is AI LXP and Why Enterprises Are Adopting It.pdf
byneuralminds4
 
Deploying Windows Clients & Managing Identities
byVICTOR MAESTRE RAMIREZ
 
The Abomination of AI – keynote at ICoSCI 2026
byAlan Dix
 
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
connectives-linking words in English.ppt
byAmrMohammed82
 
Lightweight, Travel-Ready Freedom for Adults and Seniors
byTopmate
 
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 

Certified Reasoning for Automated Verification

  • 1.
    Certified Reasoning for AutomatedVerification Asankhaya Sharma PhD Defense
  • 2.
    Building Reliable Software •Formal Verification – Proving correctness of programs • Testing – Discovering bugs in programs 10/6/2015 PhD Defense 2
  • 3.
    Formal Methods Work Hall,Anthony. "Realising the Benefits of Formal Methods." J. UCS 13.5 (2007): 669-678. 10/6/2015 PhD Defense 3
  • 4.
    Thesis “Certified reasoning improvesthe correctness and expressivity of automated verification without sacrificing on performance” 10/6/2015 PhD Defense 4
  • 5.
    Certified Reasoning • Correctnessis machine checked – (Decision) Procedures – Proofs – Programs • Using the Coq Proof Assistant 10/6/2015 PhD Defense 5
  • 6.
    Automated Verification • HoareLogic – Specify pre and post conditions for each method • Separation Logic – Heap manipulating programs – Separating conjunction “*” denotes disjoint heaps • Using the HIP/SLEEK Verification System 10/6/2015 PhD Defense 6
  • 7.
    Why Certify? • Correctness –Find bugs in implementation of the verifier • Expressivity – Verifying more properties by extending decision procedures to cover richer domain/logic • Performance – Code generated from certified procedure should be scalable 10/6/2015 PhD Defense 7
  • 8.
    Thesis Contributions • CertifiedDecision Procedure (Omega++) – Certified Reasoning with Infinity • Certified Proof (HIPComp) – Specifying Compatible Sharing in Data Structures – Automated Verification of Ramifications in SL • Certified Program (SLEEK DSL) – Verified Subtyping with Traits and Mixins 10/6/2015 PhD Defense 8
  • 9.
  • 10.
    PAInf Domain • Presburgerarithmetic (PA) is the first order theory of natural numbers with addition – Linear integer arithmetic with constant multiplication • We present Omega++, a decision procedure for Presburger arithmetic extended with +∞ and -∞ – Omega++ is implemented in Coq – Implementation is generated using extraction • Allows using infinity as a ghost constant in specifications 10/6/2015 PhD Defense 10
  • 11.
    Example data node{ int val; nodenext} sortedll<min> == root::node<min,null> or root::node<min,p> * p::sortedll<mt> & min <= mt sortedll<min> == root = null & min = ∞ or root::node<min,p> * p::sortedll<mt> & min <= mt val next 10/6/2015 PhD Defense 11
  • 12.
    Example node insert(node x,node y) {// code for insertion into sorted list} Pre - y::node<v,null> & x = null or x::sortedll<a> * y::node<v,null> Post - res::sortedll<b> & x = null & b = v or res::sortedll<b> & b = min(a,v) Pre - x::sortedll<a> * y::node<v,null> Post - res::sortedll<b> & b = min(a,v) More concise specification with infinity 10/6/2015 PhD Defense 12
  • 13.
    Related Work Lasaruk, Aless,and Thomas Sturm. "Effective quantifier elimination for presburger arithmetic with infinity." Computer Algebra in Scientific Computing. Springer Berlin Heidelberg, 2009. Kapur, Deepak, et al. "Geometric quantifier elimination heuristics for automatically generating octagonal and max-plus invariants." Automated Reasoning and Mathematics. Springer Berlin Heidelberg, 2013. 189-228. Domain Implemented Certified Proof Expressivity [Lasaruk 2009] PA U {∞} ✗ ✗ Cannot express ordering (no < symbol) [Kapur 2013] PA U {-∞,+∞} ✗ ✗ Can express ordering (includes < symbol) Omega++ PA U {-∞,+∞} ✓ ✓ Can express ordering, min and max constraints 10/6/2015 PhD Defense 13
  • 14.
    Omega++ Procedure 1. QuantifierElimination 2. Normalization 3. Simplification 4. Omega 10/6/2015 PhD Defense 14
  • 15.
    Parameterized Semantics • Sixdifferent customized semantics – 0 * ∞ : {0,⊥,∞} – Choose between a two valued or three valued logic 10/6/2015 PhD Defense 15
  • 16.
    (1) Quantifier Elimination Reduce quantifiersto finite domain of integers 10/6/2015 PhD Defense 16
  • 17.
    (2) Normalization Evaluate variables infinite domain plus infinity symbols 10/6/2015 PhD Defense 17
  • 18.
  • 19.
    (3) Simplification 10/6/2015 Eliminate min maxand constant constraints PhD Defense 19 Propagate undefined
  • 20.
    (4) Omega • Theformula is now in PA so we can use an existing decision procedure for PA to solve it – Omega Calculator 10/6/2015 PhD Defense 20
  • 21.
    Implementation • Omega++ isimplemented in Coq – Program (in Gallina) and Proof – http://loris- 7.ddns.comp.nus.edu.sg/~project/SLPAInf/ • OCaml code is generated from Coq using extraction – Extracted code is integrated with HIP/SLEEK 10/6/2015 PhD Defense 21
  • 22.
    Coq Development Coq FileProgram Proof Time (s) Description Theory.v 585 737 20.68 Syntax and Semantics Transformation.v 380 1203 31.07 Normalization Simplification.v 0 856 338.96 Tactics/lemmas for simplification Extraction.v 257 0 1.27 Module to extract OCaml code 1192 2796 391.98 Total Coq Ratio of proof to program is 2.35 Proof scripts take 6+ minutes to type check Simplification procedure was easy to write but difficult to prove due to large number of cases, we use Ltac (Coq’s proof tactic language) to automate the proof search 10/6/2015 PhD Defense 22
  • 23.
    Correctness Tool Sound CompleteTermination Semantics Verified OCaml Prototype No No Unclear Unclear No Omega++ Yes Yes Guaranteed Precise In Coq Prototype’s version of normalization did additional case analysis. Due to our careful treatment of quantifier elimination we were able to prove that much of this case analysis was unnecessary in our Coq tool. The Coq development identified a soundness bug in the OCaml prototype, which allowed the invalid transformation x ≥ y  x+1 > y, which is false when x = y = ∞ 10/6/2015 PhD Defense 23
  • 24.
    Expressivity (and Conciseness) BenchmarkLOC Disjuncts (PA) Time (Ω) Disjuncts (PAInf) Time(Ω++) Insertion Sort 30 4 0.14 2 0.15 Selection Sort 69 14 0.36 7 0.35 BST 105 12 0.43 6 0.35 Bubble Sort 110 12 0.29 9 0.50 Merge Sort 91 6 0.32 4 1.81 Priority Queue 207 16 0.84 10 2.73 Total Correctness 21 - - 2 0.21 Sort Min Max 79 - - 7 1.82 10/6/2015 PhD Defense 24
  • 25.
    Optimizations • No desugaringof formulas – Handling full constraint language with all operators made the proof more tedious but was important for performance • Support two kinds of quantifiers, over PA and PAInf – Program variables quantify over PA while specification variables over PAInf • Implement formula simplification – Keeps the size small but increased the time taken to check the proof scripts • Treat string (used for variables and arbitrary integers) in Coq as abstract – Use OCaml’s string data type which is more efficient 10/6/2015 PhD Defense 25
  • 26.
    Performance Benchmark Calls Time(Lasaruk) Time (Proto) Time (Ω++) Insertion Sort 100 4.58 0.78 0.39 Selection Sort 245 >600.00 0.62 0.78 BST 116 150.00 0.48 0.50 Bubble Sort 336 >600.00 1.25 1.34 Merge Sort 155 >600.00 1.05 1.92 Priority Queue 778 >600.00 FAIL 1.20 Total Correctness 120 >600.00 0.31 0.16 Sort Min Max 376 >600.00 0.29 0.19 10/6/2015 PhD Defense 26
  • 27.
  • 28.
    Frame Rule P RP* R Frame Rule P {c} Q ------------------- P * R {c} Q * R 10/6/2015 PhD Defense 28
  • 29.
    From Separation toSharing • Disjoint Heaps (*) – x::node<a,b> * y::node<c,d> • Aliased Heaps (&) – x::node<a,b> & y::node<c,d> • Overlaid Heaps (&*) – x::node<a,_> &* y::node<_,d> 10/6/2015 PhD Defense 29
  • 30.
  • 31.
    Compatible Sharing Disk IOScheduler – List of Nodes (ll) and Tree of Nodes (tree) – The linked list and tree represent multiple views over same set of nodes data node{ int val; node next; node parent; node left; node right;} 10/6/2015 PhD Defense 31
  • 32.
    Related Work Lee, Oukseh,Hongseok Yang, and Rasmus Petersen. "Program analysis for overlaid data structures." Computer Aided Verification. Springer Berlin Heidelberg, 2011. Drăgoi, Cezara, Constantin Enea, and Mihaela Sighireanu. "Local Shape Analysis for Overlaid Data Structures." Static Analysis. Springer Berlin Heidelberg, 2013. 150-171. Expressivity Entailment Procedure Program Analysis Local Reasoning Certified Proof Properties [Lee 2011] List and Tree ✗ ✓ ✗ ✗ Shape [Drăgoi 2013] Only Lists ✗ ✓ ✓ ✗ Shape HIPComp User Defined Predicates ✓ ✗ ✓ ✓ Shape, Size and Bag 10/6/2015 PhD Defense 32
  • 33.
    LL &* Tree ll<S>== root = null & S = {} or root::node<_@I,p,_@A,_@A,_@A> * p::ll<Sp> & S = Sp U {root} tree<p,S> == root = null & S = {} or root::node<_@I,_@A,p,l,r> * l::tree<root,Sl> * r::tree<root,Sr> & S = Sl U Sr U {root} x::ll<S> &* t::tree<_,S> Field Annotations @A – Absent @I – Immutable Memory Footprint S – Set of Addresses 10/6/2015 PhD Defense 33
  • 34.
    Memory Specifications XMem(P) ={}->() XMem(H & P) = XMem(H) XMem(H1 * H2) = XMem (H1) DU XMem(H2) XMem(H1 &* H2) = XMem(H1) U XMem(H2) XMem(x::node<v@I,p>) = {x}->(node<@I,@M>) XMem(x::ll<S>) = S->() A memory specification of a predicate is of the form S->L S is the set of addresses and L is the list of field annotations x::ll<S> &* t::tree<_,S> XMem(x::ll<S>) = S->(node<@I,@M,@A,@A,@A>) XMem(t::tree<_,S>) = S->(node<@I,@A,@M,@M,@M) Compatible Fields @A @M @M @A @I @I 10/6/2015 PhD Defense 34
  • 35.
    Compatible Frame Rule Compatible(P,R) Compatible(Q,R) P{c} Q ----------------------------------- P &* R {c} Q &* R 10/6/2015 PhD Defense 35 Same memory and compatible field annotations
  • 36.
    void move_request(node q1s,node q2, node q1t) requires q1s::ll<S> &* q1t::tree<_,S> * q2::ll<T> ensures q1s::ll<Su> &* q1t::tree<_,Su> * q2::ll<Tu> & S = union(Su,{q1s}) & Tu = union(T,{q1s}); { node c; c = list_remove_first(q1s); if (c == null) return; tree_remove(c,q1t); list_add_first(q2,c); c = null; } DISK IO Scheduler Example 10/6/2015 PhD Defense 36
  • 37.
    Implementation • Developed anentailment procedure using memory specification and compatible sharing • HIPComp Tool and Coq Proofs – A prototype in Objective Caml http://loris- 7.ddns.comp.nus.edu.sg/~project/HIPComp/ – Based on HIP/SLEEK verification system • Benchmark of Programs with Sharing – Examples from papers and system software 10/6/2015 PhD Defense 37
  • 38.
    Coq Development Coq FileProof Time (s) Description PA.v 355 2.40 Syntax and Semantics of PA SLPA.v 416 3.38 Reducing Separation Logic to PA SLSET.v 169 7.32 Reducing Separation Logic to MONA 940 13.10 Total Coq Certified functions XPure (SLPA.v) and XMem (SLSET.v) are required to show the soundness of the compatible frame rule 10/6/2015 PhD Defense 38
  • 39.
    Correctness • Found twosoundness issues – In the paper pen proof of XPure function given in [Chin 2012] a condition was missing (p!=0) in one of the cases – Certifying XMem function helped uncover a soundness bug in the implementation where the order of Matching and Splitting rules was wrong Chin, Wei-Ngan, et al. "Automated verification of shape, size and bag properties via user-defined predicates in separation logic." Science of Computer Programming 77.9 (2012): 1006-1036. 10/6/2015 PhD Defense 39
  • 40.
    Expressivity (and Performance) ProgramLOC Timing (Seconds) Sharing (%) Compatibility (%) PLL (Shape, Size) 30 0.28 100 11 Compatible Pairs 12 0.09 100 25 LL &* SortedLL (Shape, Bag) 175 0.61 22 22 LL &* Tree (Shape) 70 0.24 16 7 Process Scheduler (Shape) 70 0.47 33 23 Disk IO Scheduler (Shape) 88 1.30 16 27 Doubly Circular List (Shape) 50 0.41 50 32 10/6/2015 PhD Defense 40
  • 41.
    Conclusions • Omega++ -a certified decision procedure for Presburger arithmetic extended with +∞ and - ∞ • Specification Mechanism for Overlaid Data Structures – Entailment Procedure for Verifying Programs with Compatible Sharing 10/6/2015 PhD Defense 41
  • 42.
    Future work • CertifiedReasoning for Functional Correctness – Integrate full functional proofs done in Coq with automated proofs generated using HIP/SLEEK • End-to-End Verification – Mathematical Reasoning in Coq – Spatial Reasoning in HIP/SLEEK 10/6/2015 PhD Defense 42
  • 43.
    Thank You ! •Questions ? • Contact – asankhaya@u.nus.edu • Publications – Certified Reasoning with Infinity [FM 15] – Verified Subtyping with Traits and Mixins [FSFMA 14] – Exploiting Undefined Behaviors for Efficient Symbolic Execution [ICSE (Student Research Competition) 14] – HIPimm: Verifying Granular Immutability Guarantees [PEPM 14] – A Refinement Calculus for Promela [ICECCS 13] – Towards Complete Specifications with an Error Calculus [NFM 13] 10/6/2015 PhD Defense 43
  • 44.
  • 45.
    Kleene’s weak threevalued logic 10/6/2015 PhD Defense 45
  • 46.
    PAInf is adomain extension Valid both in PA and PAInf Valid in PA but Invalid in PAInf 10/6/2015 PhD Defense 46
  • 47.
    Useful Properties ofPAInf domain 10/6/2015 PhD Defense 47
  • 48.
    Application • Quantifier eliminationin PAInf for specification inference • Using [Kapur 2012] we support inference of octagonal size constraints using ghost infinity in the presence of heap-based verification Kapur, Deepak. "Program analysis using quantifier-elimination heuristics." Theory and Applications of Models of Computation. Springer Berlin Heidelberg, 2012. 94-108. 10/6/2015 PhD Defense 48
  • 49.
    Specification Inference Method PrePost Inferred Time (Ω++) Create True ll<res,m> m=n 0.13 Delete ll<x,n> ll<res,m> n-1 ≤ m 0.17 Insert ll<x,n> ∧ x!=null ll<x,m> n=m-1 0.13 Copy ll<x,n> * ll<res,m> ll<x,m> m=n 0.16 Remove ll<x,n> ∧ x!=null ll<x,m> n-1 ≤ m ∧ m≤n 0.19 Return ll<x,n> ll<x,m> m=n ∧ 0≤m 0.07 Traverse ll<x,n> ll<x,m> m=n 0.12 Get ll<x,n> ∧ x!=null ll<res,m> m=n-2 ∧ 2≤n 0.11 Head ll<x,n> * ll<y,m> ll<res,n+m-1> 1=min(n,m) 0.21 10/6/2015 PhD Defense 49
  • 50.
    Conclusions • Omega++ -a certified decision procedure for Presburger arithmetic extended with +∞ and - ∞ • Integrated Omega++ in HIP/SLEEK verification system and evaluated the usefulness for verification and specification inference 10/6/2015 PhD Defense 50
  • 51.
    Verified Subtyping withTraits and Mixins
  • 52.
    Object Oriented Design •S – Single Responsibility • O – Open Close • L – Liskov Substitution • I – Interface Segregation • D – Dependency Inversion First proposed by Robert C. Martin in comp.object newsgroup in March 1995 10/6/2015 PhD Defense 52
  • 53.
    Liskov Substitution Principle “Letq(x) be a property provable about objects x of type T. Then q(y) should be provable for objects y of type S where S is a subtype of T” - Barbara Liskov and Jeannette Wing 10/6/2015 PhD Defense 53
  • 54.
    Behavior Subtyping • Usefulto reason about design of class hierarchies • Stronger notion than typical subtyping of functions defined in type theory – Function subtyping is based on contravariance of argument types and covariance of the return type • Behavioral subtyping is trivially undecidable – If the property is “this method always terminates” 10/6/2015 PhD Defense 54
  • 55.
    Contributions • Subtyping withTraits and Mixins in Scala – By checking entailments in separation logic • Extend Scala with a domain specific language (SLEEK DSL) – Allows Scala programmers to insert subtyping checks in their programs • Case study on subtyping in Scala Standard Library – Verified subtyping in 67% of Mixins 10/6/2015 PhD Defense 55
  • 56.
    Traits and Mixins •Traits – Fine grained unit of reuse – Similar to abstract classes but some methods can have implementations as well • Mixin Composition (Mixin) – A class which contains a combination of methods from other traits and classes – Similar to multiple inheritance if the combination contains all methods of combined classes 10/6/2015 PhD Defense 56
  • 57.
    Traits Example trait ICell{ def get() : Int def set(x : Int) } trait BICell extends ICell { private var x : Int = 0 def get() { x } def set(x : Int) { this.x = x } } Similar to an Abstract Class Implementation of ICell 10/6/2015 PhD Defense 57
  • 58.
    Traits Example (cont.) traitDouble extends ICell { abstract override def set(x : Int) { super.set(2*x) } } trait Inc extends ICell { abstract override def set(x : Int) { super.set(x+1) } } 10/6/2015 PhD Defense 58
  • 59.
    Mixins Example • OddICell(odd values) – class OddICell extends BICell with Inc with Double • EvenICell (even values) – class EvenICell extends BICell with Double with Inc OddICellDoubleIncBICell EvenICellIncDoubleBICell Class Linearization 10/6/2015 PhD Defense 59
  • 60.
    Scala doesn’t enforceSubtyping def m (c: BICell with Inc with Double) : Int { c.get } val oic = new OddICell val eic = new EvenICell m(oic) m(eic) Both calls are allowed by the type system Only object oic is subtype of c 10/6/2015 PhD Defense 60
  • 61.
    Verified Subtyping • Amixin can be represented as a separation logic predicate based on class linearization OddICellDoubleIncBICell OddICell<this> == BICell<this,p> * Inc<p,q> * Double<q,null> EvenICellIncDoubleBICell EvenICell<this> == BICell<this,p> * Double<p,q> * Inc<q,null> 10/6/2015 PhD Defense 61
  • 62.
    From Subtyping toEntailment • Subtyping can be reduced to checking entailment between the predicates m(oic) OddICell<oic> |- BICell<c,p> * Inc<p,q> * Double<q,null> m(eic) EvenICell<eic> |- BICell<c,p> * Inc<p,q> * Double<q,null> Valid Invalid 10/6/2015 PhD Defense 62
  • 63.
    SLEEK DSL • Implementationbased on SLEEK – An existing separation logic based entailment prover – Supports user defined predicates and user specified lemmas – With Shape, Size, and Bag properties – http://loris- 7.ddns.comp.nus.edu.sg/~project/SLEEKDSL/ 10/6/2015 PhD Defense 63
  • 64.
    Implementation Overview SLEEK exesleek.lib sleek.dslsleek.inter Scala Programs Scala Interpreter 10/6/2015 PhD Defense 64
  • 65.
    Scala with SLEEKDSL def m (c: BICell with Inc with Double) : Int { c.get } val oic = new OddICell val eic = new EvenICell if (OddICell<oic> |- BICell<c,p> * Inc<p,q> * Double<q,null> ) m(oic) if (EvenICell<eic> |- BICell<c,p> * Inc<p,q> * Double<q,null>) m(eic) • Insert checks in Scala programs to verify subtyping using SLEEK DSL 10/6/2015 PhD Defense 65
  • 66.
    Experiments • Scala StandardLibrary • Considered four class hierarchies – Exceptions – Maths – Parser Combinators – Collections 10/6/2015 PhD Defense 66
  • 67.
    Results Class Hierarchy Mixins in the Hierarchy Mixinswith Verified Subtyping Percentage Exceptions 11 11 100 Maths 5 4 80 Combinators 6 6 100 Collections 27 12 44 Total 49 33 67 Traits provide more flexibility, 33% of Mixins use Traits in a way that does not conform to subytping 10/6/2015 PhD Defense 67
  • 68.
    Conclusions • We useentailment proving in separation logic to check subtyping with Traits and Mixins • A domain specific language based on SLEEK to check entailments from Scala programs • Case study based on Scala Standard Library 10/6/2015 PhD Defense 68
  • 69.
    Perspectives • Lays thefoundation for verifying OO Scala programs – Specification reuse with traits and mixins – Inheritance verification • Static and Dynamic Specifications for traits and mixins – Avoid re-verification – Compositional and modular 10/6/2015 PhD Defense 69

Editor's Notes

  • #22 Haskell and Scheme code can also be generated we use OCaml as we integrate with HIP/SLEEK