Program Correctness by Transformation

Abstract

Deductive program verification can be used effectively to verify high-level programs, but can be challenging for low-level, highperformance code. In this paper, we argue that compilation and program transformations should be made annotation-aware, i.e. during compilation and program transformation, not only the code should be changed, but also the corresponding annotations. As a result, if the original highlevel program could be verified, also the resulting low-level program can be verified. We illustrate this approach on a concrete case, where loop annotations that capture possible loop parallelisations are translated into specifications of an OpenCL kernel that corresponds to the parallel loop. We also sketch how several commonly used OpenCL kernel transformations can be adapted to also transform the corresponding program annotations. Finally, we conclude the paper with a list of research challenges that need to be addressed to further develop this approach.

Towards verified construction of correct and optimised GPU software

“…We will work on producing GPU programs that come with detailed annotations describing which parts of the memory are accessed and changed by which parts of the code (see [49] for preliminary ideas). Besides making a program verifiable, these annotations will also provide valuable information to determine which transformations can be applied to optimise the program.…”

On Models and Code

“…-we need to further develop refinement techniques that from an abstract model can generate annotated and verifiable code, where it is important that the generated code can be executed efficiently; -we need techniques to prove that a program that is transformed to optimise it for performance remains correct after the transformation, see [13] for further ideas; -we need to consider whether it is possible to automatically derive a model or abstract view from a concrete program; and -we need to further develop the abstract model theory for concurrent software, in particular making the abstract models compositional, such that it is possible to reason about the global behaviour of a system that is composed of both abstract models and concrete code components.…”

Modelo e critérios de teste estrutural para programas CUDA

“…SESA busca identificar automaticamente as entradas que devem ter valores concretos, para melhorar o desempenho sem diminuir a cobertura em comparação com o GKLEE. Vercors também utiliza o SMT para verificar programas em OpenCL por condições de disputa, e tendo suporte a operações atômicas (HUISMAN;MIHELCIC, 2013;BLOM;BLOM et al, 2017;BLOM;HUISMAN;MIHELCIC, 2014;AMIGHI et al, 2015;HUISMAN et al, 2018;SAFARI et al, 2020). Entretanto ele verifica apenas o kernel, não verificando o código do host.…”