An Integrated Approach to High Integrity Software Verification

Abstract

Using automated reasoning techniques, we tackle the niche activity of proving that a program is free from run-time exceptions. Such a property is particularly valuable in high integrity software, for example, safety-or security-critical applications. The context for our work is the SPARK Approach for the development of high integrity software. The SPARK Approach provides a significant degree of automation in proving exception freedom. Where this automation fails, however, the programmer is burdened with the task of interactively constructing a proof and possibly also having to supply auxiliary program annotations. We minimize this burden by increasing the automation, through an integration of proof planning and a program analysis oracle. We advocate a 'cooperative' integration, where prooffailure analysis directly constrains the search for auxiliary program annotations. The approach has been successfully tested on industrial data.

European collaboration on automated reasoning

“…Proof planning: also continued to be a constant theme [5,12,22,25] with an additional ingredient of the automatic learning of new proof methods [27,43] from example proofs. Verification: of computer systems was the main application of inductive proof [18,35,38,41,52,58,64], with a continuing interest in the synthesis of programs from their specifications [2,7,24,49] and a new interest in security applications [1,59]. Despite Turing's proof of the undecidability of the halting problem, in practice it has proved possible to prove the termination of most naturally-occurring, wellfounded programs.…”

A Framework for Developing Feature-Rich Software Systems

“…For an assignment statement, for instance, the Examiner may generate a verification condition that assigning to the variable a value outside the range defined in the variable declaration is impossible. If this theorem cannot be proved, the program is thought not to be reliable [5,15,23]. The Examiner itself is written in SPARK, and therefore subject to its own analysis.…”

Using SMT solvers to verify high-integrity programs

“…As mentioned in the introduction, Ellis and Ireland [18] have used proof-planning to identify how to strengthen loop invariants.…”

“…Notable earlier work on improving the verification of Spark programs is by Ellis and Ireland [18]. They used a proofplanning and recursion analysis approach to analyse failed proofs of VCs involving loops to identify how to strengthen loop invariants.…”