{"title":"Differential Testing of a Verification Framework for Compiler Optimizations (Case Study)","authors":"M. Utting, Brae J. Webb, I. Hayes","doi":"10.1109/FormaliSE58978.2023.00015","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00015","url":null,"abstract":"We want to verify the correctness of optimization phases in the GraalVM compiler, which consist of many thousands of lines of complex Java code performing sophisticated graph transformations. We have built high-level models of the data structures and operations of the code using the Isabelle/HOL theorem prover, and can formally verify the correctness of those high-level operations. But the remaining challenge is: how can we be sure that those high-level operations accurately reflect what the Java code is doing? This paper addresses that issue by applying several different kinds of differential testing to validate that the formal model and the Java code have the same semantics. The lessons learned from applying these validation techniques should be applicable to other projects that are building formal models of real-world code.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129234321","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Baptiste Pollien, C. Garion, G. Hattenberger, P. Roux, X. Thirioux
{"title":"A Verified UAV Flight Plan Generator","authors":"Baptiste Pollien, C. Garion, G. Hattenberger, P. Roux, X. Thirioux","doi":"10.1109/FormaliSE58978.2023.00021","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00021","url":null,"abstract":"FPL is a domain specific language used to specify complex drone missions for the Paparazzi open-source autopilot. FPL missions are compiled into C code that is directly embedded into the autopilot code. The FPL to C code generator, currently written in OCaml, is therefore a critical component when addressing the drone safety. This paper presents the formal verification of the FPL compilation process. First, we have developed in Coq a new three-pass code generator, targeting the Clight intermediate language from the CompCert suite. We have then formally defined an operational semantics for FPL. Finally, we have proved a bisimulation relation between FPL semantics and Clight semantics. In the course of the formalization and verification process, we have also unveiled several problems in the original Paparazzi code generator.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"600 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125557248","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
D. Basile, Maurice H. ter Beek, Hendrik Göttmann, Malte Lochau
{"title":"Mutant Equivalence as Monotonicity in Parametric Timed Games","authors":"D. Basile, Maurice H. ter Beek, Hendrik Göttmann, Malte Lochau","doi":"10.1109/FormaliSE58978.2023.00014","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00014","url":null,"abstract":"The detection of faults in software systems can be enhanced effectively by model-based mutation testing. The efficiency of this technique is hindered when mutants are equivalent to the original system model, since this makes them useless. Recently, the application of model-based mutation testing to real-time systems modelled as timed games has been investigated, which has resulted in guidelines for statically avoiding equivalent mutants.In this paper, we recast this problem into the framework of parametric timed games. We then prove a correspondence between theoretical results for the detection of equivalent mutants in timed games and the property of monotonicity that is known to hold for a sub-class of parametric timed games called L/U parametric timed games. The presented results not only simplify the theory underlying the detection of equivalent mutants in timed games, but at the same time they improve the expressiveness of a known decidable fragment of parametric timed games for which monotonicity holds.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134452716","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Dafny-based approach to thread-local information flow analysis","authors":"Graeme Smith","doi":"10.1109/FormaliSE58978.2023.00017","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00017","url":null,"abstract":"The Dafny program verifier supports proofs of functional correctness of single-threaded programs written in an imperative, object-based or functional style. In this paper, we show how Dafny can also be used to support proofs of information flow security in multi-threaded programs. For generality, information flow is analysed with respect to a user-defined lattice of security values, and the security classifications of program variables are value-dependent, i.e., they are not fixed but depend on the current program state. For scalability, our multi-threaded analysis is carried out thread locally using rely/guarantee reasoning. The required well formedness properties of our security lattices and rely and guarantee conditions are proven using Dafny lemmas.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131103733","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using scylindric algebra to support local variables in rely/guarantee concurrency*","authors":"L. Meinicke, I. Hayes","doi":"10.1109/FormaliSE58978.2023.00019","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00019","url":null,"abstract":"Local variable blocks are a simple but effective program structuring technique. In the context of concurrency, local variables have the added advantage of avoiding interference from threads running concurrently with the thread declaring the local variable. To provide mechanised support for verifying concurrent programs in Isabelle/HOL, we have found making use of algebraic properties of programs simplifies the development of refinement laws. The algebraic properties of local variable blocks are similar to those of existential quantifiers in predicate calculus, the algebra of which is Tarski’s cylindric algebra. Hence to support local variables, we make use of a variant of cylindric algebra that allows quantification of a variable over a command, rather than a predicate. The approach allows a local variable to become a shared variable of parallel threads that are local to the block that introduced the variable.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132988248","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
F. Ghassemi, M. Sirjani, E. Khamespanah, Mahrokh Mirani, Hossein Hojjat
{"title":"Transparent Actor Model","authors":"F. Ghassemi, M. Sirjani, E. Khamespanah, Mahrokh Mirani, Hossein Hojjat","doi":"10.1109/FormaliSE58978.2023.00018","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00018","url":null,"abstract":"Several programming and formal modeling languages are designed based on actors. Each language has certain policies for message delivery between actors and for handling the messages in the buffers. These policies are implicit in the semantics of each language. One can infer interesting properties of actor languages related to communication and coordination based on different policies and their interactions. We define the “Transparent Actor” model where we make policies explicit as points of possible variations. We identify an abstract network entity and define the semantics of Transparent Actors in three parts: actors, network, and composition. We define a core actor language named BABEL as a basis to describe the semantics of Transparent Actors using structural operational semantics (SOS) rules with variation points. These parametric rules make the implicit policies clear and can be used as a template to define the semantics of different actor-based languages. We evaluate the applicability of the template by examining the semantics for actor-based languages Rebeca, Lingua Franca, ABS, AKKA, and Erlang. We implement BABEL in Maude as a proof of concept, then concretize the parametric rules to implement some of the above languages. We consider a few properties, check them via a set of designated litmus test cases using our Maude implementations, and discuss the policy interactions.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"109 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133226140","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Eli Pregerson, Shaheen Cullen-Baratloo, David Chen, Duy Lam, Max Szostak, Lucas Bang
{"title":"Formalizing Path Explosion for Recursive Functions via Asymptotic Path Complexity","authors":"Eli Pregerson, Shaheen Cullen-Baratloo, David Chen, Duy Lam, Max Szostak, Lucas Bang","doi":"10.1109/FormaliSE58978.2023.00016","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00016","url":null,"abstract":"Path coverage is of critical importance in software testing and verification. Furthermore, path explosion is a well-known challenge for automatic software analysis techniques like symbolic execution. Asymptotic Path Complexity (APC) is a code complexity metric that formalizes the quantitative measurement of path explosion and therefore measures the difficulty of achieving path coverage. Prior APC methods were not sufficiently expressive to model the path explosion behavior in recursive functions. Existing analyses simply ignored recursive calls and were unable to correctly compute APC for recursive functions. We present a novel method for computing asymptotic path complexity for recursive functions, which we call APC-R. Our approach is based on the analytic combinatorics of context-free grammars. We implemented our approach on top of the code complexity analysis tool METRINOME and evaluated our implementation on a set of benchmark programs written in the C programming language. Our experiments demonstrate that APC-R is a sound upper bound on the growth rate of the number of program paths explored as a function of increasing exploration depth when generating tests with the KLEE symbolic execution engine. Our APC-R implementation provides sound bounds on KLEE’S symbolic execution path explosion for recursive functions in cases where the original APC implementation did not, and APC-R matches the results of APC for non-recursive functions with only marginal computational overhead. That is, APC-R subsumes earlier APC work without significant performance cost.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127063716","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ahmed Nagy Abdelkhalek Mansour, S. Grillo, E. Ragaini, Matteo G. Rossi
{"title":"A Formal Approach to the Verification of Protection Systems in Low-Voltage Distribution Grids","authors":"Ahmed Nagy Abdelkhalek Mansour, S. Grillo, E. Ragaini, Matteo G. Rossi","doi":"10.1109/FormaliSE58978.2023.00020","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00020","url":null,"abstract":"Poiver systems have mechanisms-so-called protection systems-to automatically disconnect parts of the electrical network when faults occur, to isolate the faulty part of the system. These mechanisms rely on devices, called circuit breakers, that automatically open when a fault is detected. The logic for opening circuit breakers is most commonly based on a combination of timing properties of the devices and current thresholds. The logic is configured at design time, and it is crucial that it achieves selectivity, that is, that it only disconnects the relevant part of the network, thus minimizing the amount of unfed load. In this paper, we present an approach to formally verify the correct configuration of the protection systems in a low-voltage (LV) distribution grid. In particular, the approach relies on a formal model, based on Timed Automata, of the relevant elements of an LV distribution grid. It also includes a mechanism to automatically generate and verify formal models starting from higher-level, JSON-based descriptions of electrical networks. The formal verification mechanism exploits the UPPAAL model checker. The paper presents some experimental results that show the promise of the proposed approach.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115832303","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Niloofar Mansoor, H. Bagheri, Eunsuk Kang, Bonita Sharif
{"title":"An Empirical Study Assessing Software Modeling in Alloy","authors":"Niloofar Mansoor, H. Bagheri, Eunsuk Kang, Bonita Sharif","doi":"10.1109/FormaliSE58978.2023.00013","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00013","url":null,"abstract":"Alloy is a declarative formal modeling language with syntax derived from notations common to object-oriented design and first-order relational logic semantics. To better understand the usability of Alloy, the paper presents the results of an empirical study with 30 participants assessing two types of modeling tasks: bug fixing and model building based on natural language specifications. The participants consisted of both novices and non-novices. Besides accuracy and time to complete tasks, we also examined the correlation between the performance of two cognitive tasks and task performance. Results indicate that overall, non-novices completed the tasks with significantly higher accuracy (54% more accurate) than novices. In the novice group, performing more actions using the Alloy analyzer led to more edits and, eventually, higher scores in the bug fixing tasks. We found that participants of all levels had much difficulty writing a model from scratch, and they did not utilize the analyzer to improve their models. On average, non-novices completed all the tasks 32 minutes faster than novices. Non-novices who performed better on the Alloy tasks had higher mental rotation scores, which indicates the importance of spatial cognition ability in solving Alloy tasks. Overall, we find that there is a definite need to improve the usability of the visualizations in the Alloy Analyzer.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116509023","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Patch Specifications via Product Programs","authors":"Cristian Cadar, Daniel Schemmel, Arindam Sharma","doi":"10.1109/FormaliSE58978.2023.00012","DOIUrl":"https://doi.org/10.1109/FormaliSE58978.2023.00012","url":null,"abstract":"Code patches are the basic blocks of software evolution and several testing and analysis techniques have been proposed to validate them. However, due to lack of specifications, most of these techniques focus on generic errors, such as crashes. In this vision paper, we propose to adopt product programs as a practical means of writing patch specifications that could be checked using existing testing techniques. Future work will investigate the feasibility of automatically generating product programs for real-world code patches, the ease of writing useful patch specifications, and the integration of such patch specifications with existing testing techniques.","PeriodicalId":434351,"journal":{"name":"2023 IEEE/ACM 11th International Conference on Formal Methods in Software Engineering (FormaliSE)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130964370","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}