The VALS Team Verification, Validation of Algorithms, Languages and Systems Resp.: Burkhart Wolff Co-resp.: Claude Marché November 27-28, 2013 27-28 Nov 2013 Comité d’Evaluation du LRI 1 / 68
VALS: The Group for Formal Methods VALS New research team, created July 2013 Joining ForTesSE and Toccata ◮ Toccata : formal specification and computer-assisted proof in the development of software that requires a high assurance ◮ ForTesSE : formal testing , in particular model-based testing using combinations of Test and Proof 27-28 Nov 2013 Comité d’Evaluation du LRI 2 / 68
VALS: team members CNRS (2CR) Univ. Paris-Sud (5PR,5MCF) E. Contejean J.-C. Filliâtre V. Benzaken S. Conchon M.-C. Gaudel D. Longuet K.Nguyen A. Paskevich Inria (1DR,3CR) C. Paulin F. Voisin S. Boldo A. Charguéraud B. Wolff F. Zaïdi C. Marché G. Melquiond 4+7=11 doctoral students 1+4=5 post-docs 27-28 Nov 2013 Comité d’Evaluation du LRI 3 / 68
VALS: Toccata The Toccata Team http://toccata.lri.fr 27-28 Nov 2013 Comité d’Evaluation du LRI 4 / 68
Toccata: Main Research Themes Proof technology: ◮ Mathematical specifications ◮ Deductive program verification ◮ Formal Semantics Main Challenge Make Deductive verification usable in practice Both theory and practice: ◮ Development of several tools ◮ significant number of users 27-28 Nov 2013 Comité d’Evaluation du LRI 5 / 68
Structure and Evolution (2008-2013) ◮ Common team with Inria Saclay ◮ until 2011: team ProVal , leader: C. Paulin ◮ since 2012: team Toccata , leader: C. Marché Evolution: ◮ March 2010: M. Pouzet, mutation to Paris 6 & ENS ◮ Theme Synchronous Programming disappears ◮ Sep 2010: V. Benzaken, moved from the BD team ◮ New theme Data-Centric Languages ◮ 2 CR Inria and 2 MCF recruited in the period ◮ 13 PhD thesis, 3 HDR defended 27-28 Nov 2013 Comité d’Evaluation du LRI 6 / 68
The backbone of Toccata Balance between theory and practice All activities are related, in particular through tool development Two major federating tools : ◮ Why3 : generic environment for deductive program verification ◮ A logical framework connected to many theorem provers ◮ A dedicated programming language WhyML ◮ Contract-based formal specifications ◮ Alt-Ergo : a theorem prover based on Satisfiability Modulo Theory (SMT) approach ◮ Original combination approach CC ( X ) ◮ Support for theories needed for verification (quantifiers, type polymorphism, (non-)linear integral and rational arithmetic) 27-28 Nov 2013 Comité d’Evaluation du LRI 7 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Why3 Alt-Ergo 27-28 Nov 2013 Comité d’Evaluation du LRI 8 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Why3 Interactive provers Automatic provers CVC3, Simplify, SPASS, Vampire Alt-Ergo Alt-Ergo Coq Gappa PVS, etc. veriT, Yices, Z3, etc. 27-28 Nov 2013 Comité d’Evaluation du LRI 9 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Java programs Krakatoa Why3 Interactive provers Automatic provers CVC3, Simplify, SPASS, Vampire Alt-Ergo Alt-Ergo Coq Gappa PVS, etc. veriT, Yices, Z3, etc. 27-28 Nov 2013 Comité d’Evaluation du LRI 10 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Java programs C programs Frama-C Krakatoa Why3 Interactive provers Automatic provers CVC3, Simplify, SPASS, Vampire Alt-Ergo Alt-Ergo Coq Gappa PVS, etc. veriT, Yices, Z3, etc. 27-28 Nov 2013 Comité d’Evaluation du LRI 11 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Java programs C programs Ada programs Spark2014 Frama-C Krakatoa Why3 Interactive provers Automatic provers CVC3, Simplify, SPASS, Vampire Alt-Ergo Alt-Ergo Coq Gappa PVS, etc. veriT, Yices, Z3, etc. 27-28 Nov 2013 Comité d’Evaluation du LRI 12 / 68
The backbone of Toccata Why3: a language and a tool for deductive verification Java programs C programs Ada programs Spark2014 Frama-C Krakatoa EasyCrypt CAOVerif Why3 Interactive provers Automatic provers CVC3, Simplify, SPASS, Vampire Alt-Ergo Alt-Ergo Coq Gappa PVS, etc. veriT, Yices, Z3, etc. 27-28 Nov 2013 Comité d’Evaluation du LRI 13 / 68
Example: NASA case study (Frama-C) #define E 0x1p-45 /*@ requires @ sx == \exact (sx) && sy == \exact (sy) && @ vx == \exact (vx) && vy == \exact (vy) && @ \abs (sx) <= 100.0 && \abs (sy) <= 100.0 && @ \abs (vx) <= 1.0 && \abs (vy) <= 1.0; @ ensures @ \result != 0 ==> @ \result == l_sign( \exact (sx)* \exact (vx)+ \exact (sy)* \exact (vy)) @ * l_sign( \exact (sx)* \exact (vy)- \exact (sy)* \exact (vx)); @*/ int eps_line(double sx, double sy,double vx, double vy){ int s1,s2; s1=sign(sx*vx+sy*vy, E); s2=sign(sx*vy-sy*vx, E); return s1*s2; } 27-28 Nov 2013 Comité d’Evaluation du LRI 14 / 68
Example: NASA case study (Frama-C) 27-28 Nov 2013 Comité d’Evaluation du LRI 15 / 68
Why3: elements of impact ◮ Major results: ◮ The design of the programming language [ESOP 2013] ◮ The multi-prover architecture [CADE 2013] ◮ Used by other academic tools ◮ Cryptography ( EasyCrypt , IMDEA, Spain) ◮ Use in industrial-scale verification environments: ◮ Frama-C : CEA-List (Airbus France, NASA, etc.) ◮ Spark2014 : AdaCore (Astrium, etc.) ◮ Use in teaching ◮ http://why3.lri.fr , Why3 Club (mailing list) 27-28 Nov 2013 Comité d’Evaluation du LRI 16 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification Why3 Alt-Ergo 27-28 Nov 2013 Comité d’Evaluation du LRI 17 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification C programs Ada programs Spark2014 Frama-C Why3 Alt-Ergo 27-28 Nov 2013 Comité d’Evaluation du LRI 18 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification C programs Ada programs Spark2014 Frama-C Why3 CAVEAT Alt-Ergo 27-28 Nov 2013 Comité d’Evaluation du LRI 19 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification C programs Ada programs Spark2014 Frama-C Why3 Spark2005 CAVEAT Alt-Ergo 27-28 Nov 2013 Comité d’Evaluation du LRI 20 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification C programs Ada programs Spark2014 Frama-C Why3 Spark2005 CAVEAT Alt-Ergo Cubicle 27-28 Nov 2013 Comité d’Evaluation du LRI 21 / 68
Alt-Ergo Alt-Ergo: a theorem prover for program verification C programs Ada programs Spark2014 Frama-C Why3 Spark2005 CAVEAT Atelier B Alt-Ergo Cubicle Bware 27-28 Nov 2013 Comité d’Evaluation du LRI 22 / 68
Alt-Ergo: elements of impact ◮ Major results: ◮ theory of associativity-commutativity [TACAS 2011] (best EATCS paper award) ◮ Original approach for arithmetic [IJCAR 2012] ◮ Application to model-checking (Cubicle) [CAV 2012] ◮ Use in industrial-scale verification environments : ◮ via Why3 in Frama-C and Spark2014 ◮ via CAVEAT qualified by Airbus France for A350 development ◮ shipped with Spark2005 since 2011 ◮ Since 2013: Maintenance by OcamlPro start-up ◮ http://alt-ergo.lri.fr 27-28 Nov 2013 Comité d’Evaluation du LRI 23 / 68
Around the backbone Verified Numerical Programs ◮ Formal models in Coq ( Flocq library) [IEEE Symp. Comp. Arith. 2011] ◮ Semantics of floating-point computation in Why3 [IJCAR 2010] ◮ Specialized prover Gappa ◮ Significant case studies ◮ Certified resolution of a differential equation [ICALP 2009, JAR 2013] 27-28 Nov 2013 Comité d’Evaluation du LRI 24 / 68
Around the backbone (2) Verification of tools ◮ Verified provers: 1 PhD thesis, [PLPV 2014] ◮ Verified VC generators: 1 PhD thesis, [VSTTE 2012] ◮ Other on-going projects Data-Centric Languages ◮ Semantics of NoSQL languages [POPL 2013] ◮ Typed XML transformations [POPL 2014] ◮ On-going formal models in Coq ◮ On-going verified code using Why3 ◮ Programming Language C Duce, www.cduce.org 27-28 Nov 2013 Comité d’Evaluation du LRI 25 / 68
Positioning Our strongest competitor: Microsoft Research ◮ only us and them master all the verification chain Boogie Why3 VC generator Dafny, Fstar WhyML VCC Frama-C Z3 Alt-Ergo Our originalities: ◮ Multi-prover approach ◮ Combination of Automatic and Interactive Theorem Proving ◮ Support for Numerical Programs ◮ Open source distribution ◮ easier to reach industrial users 27-28 Nov 2013 Comité d’Evaluation du LRI 26 / 68
Scientific Production Quantitative summary: ◮ International major journal articles: 17 ◮ Other journal articles: 5 ◮ International major conf. articles: 47 ◮ Other conf. articles: 51 ◮ Books and book chapters: 8 27-28 Nov 2013 Comité d’Evaluation du LRI 27 / 68
Other elements of impact International: ◮ C. Paulin, docteur honoris causa University Göteborg, Sweden, 2011 ◮ J.-C. Filliâtre, member of IFIP Working Group 1.9/2.15 (Verified Software) since 2011 Event Organization: ◮ International Conference “Formal Verification of Object-Oriented Software”, Paris, 28-30 june 2010 ◮ Verification Competition joint with VSTTE 2012 Local: Strong implication in ◮ Digiteo research cluster ◮ Labex DigiCosme (C. Paulin, head of the Labex) ◮ Idex Univ. Paris Saclay , including future master program 27-28 Nov 2013 Comité d’Evaluation du LRI 28 / 68
Recommend
More recommend
