A formal verification framework for static analysis

Abstract

Static analysis tools, such as resource analyzers, give useful information on software systems, especially in real-time and safety-critical applications. Therefore, the question of the reliability of the obtained results is highly important. State-of-the-art static analyzers typically combine a range of complex techniques, make use of external tools, and evolve quickly. To formally verify such systems is not a realistic option. In this work, we propose a different approach whereby, instead of the tools, we formally verify the results of the tools. The central idea of such a formal verification framework for static analysis is the method-wise translation of the information about a program gathered durCommunicated by Prof. Einar Broch Johnsen and Luigia Petre. This work is a revised and extended version of two conference papers published in the proceedings of PEPM'11 [8] and FASE'12 [9].B ing its static analysis into specification contracts that contain enough information for them to be verified automatically. We instantiate this framework with costa, a state-of-theart static analysis system for sequential Java programs, for producing resource guarantees and KeY, a state-of-the-art verification tool, for formally verifying the correctness of such resource guarantees. Resource guarantees allow to be certain that programs will run within the indicated amount of resources, which may refer to memory consumption, number of instructions executed, etc. Our results show that the proposed tool cooperation can be used for automatically producing verified resource guarantees.

Certifying Safety and Termination Proofs for Integer Transition Systems

“…A less formal approach, taken in the context of complexity [2] and safety [3] proofs, is to cross-check a tool output using another (unverified) tool. A weakness of this approach is that, even if a "cross-checker" accepts a proof, it does not mean the proof is fully trustable.…”