Developing Verified Software Using Leon

Abstract

Abstract. We present Leon, a system for developing functional Scala programs annotated with contracts. Contracts in Leon can themselves refer to recursively defined functions. Leon aims to find counterexamples when functions do not meet the specifications, and proofs when they do. Moreover, it can optimize run-time checks by eliminating statically checked parts of contracts and doing memoization. For verification Leon uses an incremental function unfolding algorithm (which could be viewed as k-induction) and SMT solvers. For counterexample finding it uses these techniques and additionally specification-based test generation. Leon can also execute specifications (e.g. functions given only by postconditions), by invoking a constraint solver at run time. To make this process more efficient and predictable, Leon supports deductive synthesis of functions from specifications, both interactively and in an automated mode. Synthesis in Leon is currently based on a custom deductive synthesis framework incorporating, for example, syntax-driven rules, rules supporting synthesis procedures, and a form of counterexample-guided synthesis. We have also developed resource bound invariant inference for Leon and used it to check abstract worst-case execution time. We have also explored within Leon a compilation technique that transforms realvalued program specifications into finite-precision code while enforcing the desired end-to-end error bounds. Recent work enables Leon to perform program repair when the program does not meet the specification, using error localization, synthesis guided by the original expression, and counterexample-guided synthesis of expressions similar to a given one. Leon is open source and can also be tried from its web environment at leon.epfl.ch . OverviewWe present Leon, a system supporting the development of functional Scala [21] programs. We illustrate the flavor of program development in Leon, and present techniques deployed in it. Leon supports a functional subset of Scala. It has been observed time and again that one of the most effective ways of writing software that needs to be proved correct is to write it in a purely functional language. ACL2 [8] and its predecessors have demonstrated the success of this approach, resulting in verification of a number of hardware and software systems.

Provable multicore schedulers with Ipanema

“…Such code does not map to any C code but rather is included in the WhyML code only to enable a proof. Ghost code is available in a number of proof tools in addition to Why3, such as Dafny [31] and Leon [30]. Concretely, the Ipanema compiler instruments the generated WhyML code to maintain boolean maps B and U that record the set of cores on which threads have blocked or unblocked, respectively, since the start of the execution of the CWC operation.…”

LMS-Verify: abstraction without regret for verified systems programming

“…There exists many static verification, analysis, and model-checking tools of various degrees of sophistication for a variety of languages, e.g. VeriFast [39] Frama-C [21], Astré [20], Boogie [5], Spec# [6], Dafny [52], Leon [48], BLAST [36]. Still, building fully verified software remains extremely labor intensive.…”

Translating Scala Programs to Isabelle/HOL

“…We hope to introduce some of the many Scala users to formal methods by providing tools they can use directly on Scala code. Leon system (http://leon.epfl.ch) is a verification and synthesis system for a subset of Scala [2,10]. Leon reuses the Scala compiler's parsing and type-checking frontend and subsequently derives verification conditions to be solved by the automated theorem provers, such as Z3 [13] and CVC4 [1].…”