Type-Driven Verification of Non-functional Properties

Abstract

Energy, Time and Security (ETS) properties of programs are becoming increasingly prioritised by developers, especially where applications are running on ETS sensitive systems, such as embedded devices or the Internet of Things. Moreover, developers currently lack tools and language properties to allow them to reason about ETS. In this paper, we introduce a new contract specification framework, called Drive, which allows a developer to reason about ETS or other non-functional properties of their programs as first-class properties of the language. Furthermore, we introduce a contract specification language, allowing developers to reason about these first-class ETS properties by expressing contracts that are proved correct by an underlying formal type system. Finally, we show our contract framework over a number of representable examples, demonstrating provable worst-case ETS properties. CCS CONCEPTS• Software and its engineering → Formal software verification; Imperative languages; Software maintenance tools; • Security and privacy → Software security engineering.

A trustworthy framework for resource-aware embedded programming

“…Instead of defining Imp with a specific numeric data type, e.g. the natural numbers, as in [6], we aim to build a framework that allows for generic representations of numeric values. Taking inspiration from Slama and Brady [30], we index expressions and statements with a setoid, (set : Setoid c (≃)) and an algebraic structure, (Struct c set kind), defined on a carrier type, (c : Type).…”

“…We might define an example context for the environment defined in Example 3.7, which has a single numeric variable, x 2 , and three arrays, α 1 1 , α 3 2 , and α 5 2 , in scope. 5,6,7,8,9]. The variable testAValsStructSame provides the proof that the list of arrays, testAVals is a vector of length three, with nested vectors of lengths 1, 3, and 5.…”

“…Energy consumption, which is of increasing interest to embedded systems programming [24], has also been represented as a function of program arguments [13,22]. These approaches typically depend upon specific type systems or languages; accordingly, applying them to other languages can prove non-trivial [6]. Abstract interpretation offers an alternative approach to the verification and debugging of programs in languages that may not necessarily be best equipped for the desired techniques [23].…”

“…More recently, The Ciao Preprocessor system (CiaoPP) [16,23,29] models Java [14] and XC [1] programs as sequences of Horn Clauses in order to debug and certify programs, using resource usage information that the system derives. A high-level comparison between CiaoPP and Drive is given by Brown et al [6].…”

“…Drive [6], is a framework for capturing, and reasoning about, non-functional properties such as Energy, Time and Security (ETS) in C programs. It includes the Contract Specification Language (CSL), an Embedded Domain Specific Language (EDSL) that defines C-statement annotations in order to capture non-functional properties of the statements they annotate, including energy usage, worst-case execution time (WCET), and the degree of vulnerability to side-channel attacks.…”