Dependency Analysis of Functional Specifications with Algebraic Data Structures

Abstract

International audienceIn the context of interactive formal verification of complex systems, much effort is spent on proving the preservation of the systems invariants. However, most operations have a localized effect on the system, which only really impacts few invariants at the same time. Identifying those invariants that are unaffected by an operation can substantially ease the proof burden for the programmer. We present a dependency analysis for a strongly-typed, functional language, which computes a conservative approximation of the input fragments on which the operations depend. It is a flow-sensitive interprocedural analysis that handles arrays, structures and variant data types. For the latter, it simultaneously computes a subset of possible constructors. We have validated the scalability of the analysis to complex transition systems by applying it to a functional specification of the MINIX operating system

Inferring frame conditions with static correlation analysis

“…The procedure computes a correlation for f , which gives an upper bound of f 's effect. Then, it runs a dependency analysis [Andreescu et al 2015] for P, which gives a relation on states that preserves P. Finally, the procedure performs an inclusion test between the two relations using ⊑, to check that the changes performed by f preserve P. We considered the 28 system calls of ProvenCore and its 50 invariants (Fig. 17).…”

“…We present a general-purpose static dataflow analysis [Nielson et al 2010] for identifying equalities between parts of the input and output states, for programs written in a language used in the ProvenCore [Lescuyer 2015] development. ProvenCore is a project whose goal is the formal verification of a micro-kernel, starting from a high-level functional specification and refining it to an efficient implementation, that is eventually compiled to C. Starting from a set of atomic equality relations between basic values, we construct the abstract domain of correlations that describes relations between complex data-structures, including records, variants and arrays.…”

Verification of high-level transformations with inductive refinement types

“…The properties they can verify are very expressive, but they do not scale to large programs like transformations. Possible constructor analysis [6] has been used to calculate the actual dependencies of a predicate and make flow-sensitive analyses more precise. This analysis works with complex data-types and arrays, but only captures the prefix of the target structures.…”

Verification of high-level transformations with inductive refinement types

“…The exact techniques employed are not very scalable, and encoding a complex 5 We only learned about this related work at a late stage transformation directly would not finish verifying even simple properties within reasonable time. Possible constructor analysis [5] has been used to calculate the actual dependencies of a predicate and make flow-sensitive analyses more precise. This is a type of shape analysis that works with complex data-types and arrays, but only captures the prefix of the target structures.…”