Program Verification by Coinduction

Abstract

We present a novel program verification approach based on coinduction, which takes as input an operational semantics. No intermediates like program logics or verification condition generators are needed. Specifications can be written using any state predicates. We implement our approach in Coq, giving a certifying language-independent verification framework. Our proof system is implemented as a single module imported unchanged into language-specific proofs. Automation is reached by instantiating a generic heuristic with language-specific tactics. Manual assistance is also smoothly allowed at points the automation cannot handle. We demonstrate the power and versatility of our approach by verifying algorithms as complicated as Schorr-Waite graph marking and instantiating our framework for object languages in several styles of semantics. Finally, we show that our coinductive approach subsumes reachability logic, a recent language-independent sound and (relatively) complete logic for program verification that has been instantiated with operational semantics of languages as complex as C, Java and JavaScript.

Proving partial-correctness and invariance properties of transition-system models

“…Another feature that distinguishes us from existing works (with the only notable exception of [16]) is that our approach is completely based on Coq's interactive theorem proving, whereas our colleagues sometimes prove the soundness of their RL proof systems in Coq [9,17], but afterwards leave the Coq environment and implement their proof systems as automatic program verifiers. Thus, verification in our case is less automatic, but it is more trustworthy 1 .…”

A generic framework for symbolic execution: A coinductive approach

“…MatchC also uses the formalism of Reachability Logic for program specifications; the MatchC tool implementation, is, however, dedicated to a subset of C. The main difference with our approach is that we emphasise on bridging the gap between theory and implementation (from an initial, abstract definition of symbolic execution to its extension for program verification, then to its encoding by rewriting and finally to its implementation in code), whereas in the MatchC tool it does not focus on intermediary steps between theory (a language-independent deductive system) and code implementing it for a subset of C. The same comparison holds between our approach and [13], in which a deductive system for a different version of RL is implemented for verifying programs written in a specific language. Since our approach of symbolic execution is founded on coinduction, it can also be seen as a bridge between the pure coinductive program verification techniques [30] and verification techniques based on operational semantics [13,40]. Java PathFinder [32] is a complex symbolic execution tool which uses a model checker to explore different symbolic execution paths.…”

A Certified Procedure for RL Verification

“…Last but not least, the Coq formalisation provides us with a certified program-verification procedure. Its use in practice depends on the availability in Coq of RL-based semantics for languages; such an effort is already underway in the K team [10].…”