|
|
|
| e-Pub |
Previous | 
Home
Section: New Results
Software specification and verification
Machine-checked proofs of programs, including time complexity
Participants : Arthur Charguéraud, Armaël Guéneau, François Pottier.
In a security-critical setting, it is important to prove that a program is correct, and to do so formally, that is, via a machine-checked proof. It is also important, one may argue, to prove that the program does not require more resources than expected (where a “resource” may be time, memory space, disk space, network bandwidth, etc.). Otherwise, even though the program is “correct” in theory, it may turn out to be unusable in practice.
Separation Logic, extended with the notion of a “time credit”, a permission to perform one step of computation, allows reasoning about the correctness and the (amortized) time complexity of a program. Using this approach, which Charguéraud implemented in the CFML tool, Charguéraud and Pottier produced a machine-checked proof of the correctness and time complexity of a Union-Find data structure, implemented as an OCaml module. This demonstrates that this approach scales up to difficult complexity analyses and down to the level of actual executable code (as opposed to pseudo-code). This work was presented at ITP 2015 [17] .
During his M2 internship, Armaël Guéneau extended this approach so as to allow working conveniently with the big- notation. He extended the CFML library and verified the time complexity of a binary random access list data structure due to Okasaki. This work has not been published yet.
Verified property-based random testing
Participants : Zoe Paraskevopoulou [ENS Cachan, team Prosecco] , Cătălin Hriţcu [team Prosecco] , Maxime Dénès, Leonidas Lampropoulos [U. of Pennsylvania] , Benjamin C. Pierce [U. of Pennsylvania] .
Property-based random testing has been popularized in the functional programming community by tools like QuickCheck. Its integration with a proof assistant creates an interesting opportunity: reusable or tricky testing code can be formally verified using the proof assistant itself.
We introduced a novel methodology for formally verified property-based testing and implemented it as a foundational verification framework for QuickChick, a port of QuickCheck to Coq. Our framework enables one to verify that the executable testing code is testing the right Coq property. To make verification tractable, we provided a systematic way for reasoning about the set of outcomes a random data generator can produce with non-zero probability, while abstracting away from the actual probabilities.
We also applied this methodology to a complex case study on testing an information-flow control abstract machine, demonstrating that our verification methodology is modular and scalable and that it requires minimal changes to existing code.
Maxime Dénès more specifically contributed to the development of the QuickChick Coq plug-in, to the development of Coq libraries for reasoning on the set of outcomes of random generators and to the verification of QuickChick's combinator library.
This work was presented at ITP 2015 [20] .
Tools for TLA+
Participants : Damien Doligez, Leslie Lamport [Microsoft Research] , Martin Riener [team VeriDis] , Stephan Merz [team VeriDis] .
Damien Doligez is head of the “Tools for Proofs” team in the Microsoft-Inria Joint Centre. The aim of this project is to extend the TLA+ language with a formal language for hierarchical proofs, formalizing Lamport's ideas [43] , and to build tools for writing TLA+ specifications and mechanically checking the proofs.
This year, we released version 1.4.3 of the TLA+ Proof System (TLAPS) [40] , the part of the TLA+ tools that handles mechanical checking of TLA+ proofs.
This was the last year of the ADN4SE project, which develops tools for rapid development of real-time software based on the PharOS real-time kernel developed by CEA. Within this project we built, in collaboration with CEA, a formal proof of determinacy of the message-passing subsystem of PharOS. We used this experience to improve our TLA+ tools and libraries.
We have started a rewrite of TLAPS from scratch, which will make it possible to handle all aspects of the TLA+ language, including temporal formulas and their proofs.
Certified distributed algorithms for autonomous mobile robots
Participants : Pierre Courtieu, Xavier Urbain [ENSIIE] , Sébastien Tixeuil [U. Pierre et Marie Curie] , Lionel Rieg [Collège de France] .
The variety and complexity of the tasks that can be performed by autonomous robots are increasing. Many applications envision groups of mobile robots that self-organise and cooperate toward the resolution of common objectives, in the absence of any central coordinating authority.
We are developing a Coq-based verification platform for distributed algorithms for autonomous robots. This year, we mechanically proved and slightly generalized a non-trivial proof of impossibility of such an algorithm under certain hypotheses [14] . We also proved several algorithms in the literature, demonstrating the viability of the platform [13] .
Contributions to ProofGeneral, an IDE for Coq
Participant : Pierre Courtieu.
User interface is a crucial issue for theorem provers like Coq. ProofGeneral [38] , an emacs-based prover interface, is widely used among Coq users. In addition to synchronizing with the evolutions of Coq itself, we contributed many improvements to ProofGeneral during the past year, among which: a better debugging mode and message printing, user assistance for naming hypotheses and indenting proof scripts, and more.