Deductive Program Verification with Why3, Past and Future

Deductive Program Verification with Why3, Past and Future Claude Marché ProofInUse Kick-Off Day February 2nd, 2015

A bit of history 1999: Jean-Christophe Filliâtre s PhD Thesis Proof of imperative programs, using Coq

A bit of history 1999: Jean-Christophe Filliâtre s PhD Thesis Proof of imperative programs, using Coq 2001: standalone Why tool produces proof goals for Coq or for PVS

A bit of history 1999: Jean-Christophe Filliâtre s PhD Thesis Proof of imperative programs, using Coq 2001: standalone Why tool produces proof goals for Coq or for PVS 2002: EU project VerifiCard JavaCard, Krakatoa tool, compiling Java/JML to Why Inspired by ESC/Java: we produce goals for the Simplify theorem prover 2004: Caduceus tool Like Krakatoa for C (In French: pour traiter le cas du C) 2005-2008, ANR CAT project, beginning of Frama-C Lead by CEA (B. Monate) Caduceus replaced by the Jessie plug-in

Birth of Why3 2011, full re-implementation of Why: Why3 Many new features Richer specification language algebraic data types inductive predicates since 2013, higher-order functions Richer programming language records with mutable fields More generic interface with theorem provers notion of proof task, transformations driver for each prover Proof sessions OCaml API etc.

Why3 kernel: a Simple Example theory T use import int.int goal g: forall x:int. (x+7)*(x+6) = x*x + 13*x + 42 end Alt-Ergo driver Alt-Ergo goal Alt-Ergo Why3 theories Proof tasks Coq driver Coq goal Coq Transformations

Why3 graphical interface > why3 ide simple.why

Provers supported by Why3 How many provers supported?

Provers supported by Why3 How many provers supported? SMT solvers: Alt-Ergo CVC3 CVC4 Z3

Provers supported by Why3 How many provers supported? SMT solvers: Alt-Ergo CVC3 CVC4 Z3 Interactive proof assistants: Coq Isabelle PVS

Provers supported by Why3 How many provers supported? SMT solvers: Alt-Ergo CVC3 CVC4 Z3 Interactive proof assistants: Coq Isabelle PVS TPTP provers: Eprover Metis Vampire Princess Beagle Zenon iprover SPASS more SMT solvers: Simplify Yices verit MathSAT5

Why3 programming language ML-style functional language with Mutable references, aliasing control by static typing Annotations: contracts, loop invariants, etc. VC generator: weakest preconditions calculus let isqrt (x:int) : int requires { x >= 0 } ensures { result >= 0 } ensures { sqr result <= x < sqr (result + 1) } = let count = ref 0 in let sum = ref 1 in while!sum <= x do invariant {!count >= 0 } invariant { x >= sqr!count } invariant {!sum = sqr (!count+1) } variant { x -!count } count :=!count + 1; sum :=!sum + 2 *!count + 1 done;!count

Why3 as a development environment Proof replay in batch Documentation generator Execution by internal interpreter Extraction to OCaml

Programs developed with Why3 Gallery of verified programs: 109 examples today mainly small but smart algorithms proved formally various domains: data-structures: lists, arrays, trees, graphs, matrices... various algorithms e.g. searching, sorting... arithmetic (integer, floating-point), mathematical puzzles solutions to past verification competitions increasing use of Why3 for teaching largest example so far: a certified prover

Example: a certified prover [Clochard, Marché, Paskevich, PLPV 2014] Initial concern: Formalisation of binders Solution: a small tool on top of Why3 input: declaration of algebraic data types with binders outputs a Why3 source providing types for specifications and for code functions for opening/closing binder, for substitution general lemmas on fresh variables, substitution, etc. Applications An interpreter for pure lambda-calculus, various strategies A first-order theorem prover, tableau-based

A general issue: automation of proofs Terms, formulas: inductive types Substitution: recursive definition Proofs require reasoning by induction Induction is out of reach of automated provers Possible solutions: Use interactive proof assistants: Coq, Isabelle, PVS Use SMT solvers inside PA: Isabelle s sledgehammer, why3 tactic of Coq Use lemma functions

The why3 tactic of Coq Alt-Ergo driver Alt-Ergo goal Alt-Ergo Why3 Theories Proof tasks why3 tactic Coq driver Coq goal Coq Transformations Typical form of a proof Require Import Why3. Ltac altergo := why3 "alt-ergo" timelimit 5 intros x1 x2 h1 h2 h3. induction h2; altergo.

Lemma functions A program without side-effects of the form let rec lemma f (arguments) : unit requires { p } ensures { q } variant { v } =... is a proof (by induction) of the lemma lemma f : forall arguments. p -> q

Lemma functions: example Pigeon-hole principle [team ProofInUse, VScomp 2014] predicate range (f: int -> int) (n: int) (m:int) = forall i: int. 0 <= i < n -> 0 <= f i < m (** [range f n m] true when [f] maps [(0..n-1)] into [(0..m-1)] *) predicate injective (f: int -> int) (n: int) (m:int) = forall i j: int. 0 <= i < j < n -> f i <> f j (** [injective f n m] true when [f] is an injection from [(0..n-1)] to [(0.. let rec lemma pigeon_hole (n m:int) (f: int -> int) requires { range f n m } requires { n > m >= 0 } variant { m } ensures { not (injective f n m) } = try for i = 0 to n-1 do invariant { forall k. 0 <= k < i -> f k <> m-1 } if f i = m-1 then begin (* we have found index i such that f i = m-1 *) for j = i+1 to n-1 do...

Tableau-based prover: summary data types with binders for first-order logic automatically generated Formalisation of the semantics Implementation of a proof engine, including Skolemization Unification Proof of soundness val prove_unsat (l:formula_list) : unit requires { formula_list_ok l } ensures { forall rho:interpretation fsymb psymb varsymb. not(formula_list_conjunction l rho) } Why3 loc verification conditions generated 16.000 3.051 manual 6.000 4.303 Provers needed: Alt-Ergo, CVC3, CVC4, Eprover, Spass, Z3 (time limit: 20s)

Prover performance Compiled to binary via extraction to OCaml Family of examples: ( x.r x R(f x)) x.r x R (f 2n x) n 3 4 5 6 time (sec.) 0.02 0.55 3.36 19.67 nb of nodes 502 9,506 42,898 197,244 generated per 25,134 17,316 12,779 10,028 sec.

Why3 as a development environment Why3 is becoming mature enough to be used as an environment for developing certified code Perspectives on the core language: Better integration of logic specification and code Improve the module system (refinement) Improve support for higher-order functions Improve support for machine integers... Other perspectives: Improve extraction, extraction to other languages (C, Ada) Develop more reusable certified libraries Certification of transformations, drivers Provide feedback from provers counter-examples...

Why3 as an intermediate language Why3 should become easier to use/more powerful as an intermediate language for Ada, C, Java provide support for bit-wise arithmetic Interpret counter-examples feedback into the source language Allow the use of Why3 libraries as specification libraries for front-end language on-going experiment within Frama-C/WP