Abstraction and subsumption in modular verification of C programs
Abstraction and subsumption in modular verification of C programs
复制标题
C程序模块化验证中的抽象和包含
DOI：
10.1007/s10703-020-00353-1
复制
发表时间：
2021
影响因子：
0.8
通讯作者：
Appel, Andrew W.
中科院分区：
文献类型：
--
作者：
Beringer, Lennart;Appel, Andrew W.
The type-theoretic notions of existential abstraction, subtyping, subsumption, and intersection have useful analogues in separation-logic proofs of imperative programs. We have implemented these as an enhancement of the verified software toolchain (VST). VST is an impredicative concurrent separation logic for the C language, implemented in the Coq proof assistant, and proved sound in Coq. For machine-checked functional-correctness verification of software at scale, VST embeds its expressive program logic in dependently typed higher-order logic (CiC). Specifications and proofs in the program logic can leverage the expressiveness of CiC—so users can overcome the abstraction gaps that stand in the way of top-to-bottom verification: gaps between source code verification, compilation, and domain-specific reasoning, and between different analysis techniques or formalisms. Until now, VST has supported the specification of a program as a flat collection of function specifications (in higher-order separation logic)—one proves that each function correctly implements its specification, assuming the specifications of the functions it calls. But what if a function has more than one specification? In this work, we exploit type-theoretic concepts to structure specification interfaces for C code. This brings modularity principles of modern software engineering to concrete program verification. Previous work used representation predicates to enabledata abstractionin separation logic. We go further, introducingfunction-specification subsumptionandintersection specificationsto organize the multiple specifications that a function is typically associated with. As in type theory, ifis a of, that is, thenimplies, meaning that any function satisfying specificationcan be used wherever a function satisfyingis demanded. Subsumption incorporates separation-logic framing and parameter adaptation, as well as step-indexing and specifications constructed via mixed-variance functors (needed for C’s function pointers).
登录
查看更多内容
动态框架：支持无限制的框架、依赖和共享
DOI：
--
发表时间：
2006
期刊：
World Congress on Formal Methods
影响因子：
--
作者：
Ioannis T. Kassios
通讯作者：
Ioannis T. Kassios
Java 动态逻辑中的动态框架。
影响因子：
--
作者：
P. Schmitt;Mattias Ulbrich;Benjamin Weiß
通讯作者：
Benjamin Weiß
霍尔逻辑和辅助变量
影响因子：
1
作者：
["Thomas Kleymann
通讯作者：
["Thomas Kleymann
Java动态逻辑中的动态框架
影响因子：
1.1
作者：
P. Schmitt;Mattias Ulbrich;Benjamin Weiß
通讯作者：
Benjamin Weiß
影响因子：
--
作者：
Lennart Beringer
通讯作者：
Lennart Beringer