Automating formal proofs for reactive systems

Abstract

Implementing systems in proof assistants like Coq and proving their correctness in full formal detail has consistently demonstrated promise for making extremely strong guarantees about critical software, ranging from compilers and operating systems to databases and web browsers. Unfortunately, these verifications demand such heroic manual proof effort, even for a single system, that the approach has not been widely adopted.We demonstrate a technique to eliminate the manual proof burden for verifying many properties within an entire class of applications, in our case reactive systems, while only expending effort comparable to the manual verification of a single system. A crucial insight of our approach is simultaneously designing both (1) a domain-specific language (DSL) for expressing reactive systems and their correctness properties and (2) proof automation which exploits the constrained language of both programs and properties to enable fully automatic, pushbutton verification. We apply this insight in a deeply embedded Coq DSL, dubbed REFLEX, and illustrate REFLEX's expressiveness by implementing and automatically verifying realistic systems including a modern web browser, an SSH server, and a web server. Using REFLEX radically reduced the proof burden: in previous, similar versions of our benchmarks written in Coq by experts, proofs accounted for over 80% of the code base; our versions require no manual proofs.

QED at Large: A Survey of Engineering of Formally Verified Software

“…It can automatically prove mathematical statements that can be difficult for Coq users to prove by hand. Some domains include verifying programs within specific languages (Cao et al, 2015;Ricketts et al, 2014), writing mathematical proofs (Nipkow, 1990;Slind, 1994;Braibant and Pous, 2011;Narboux, 2004;Grégoire and Mahboubi, 2005;Pouillard, 2012), deciding regular expressions (Braibant and Pous, 2012), and reasoning about embedded logics such as separation logic (Appel, 2006;McCreight, 2009;Krebbers et al, 2017).…”

On Certifying Distributed Algorithms: Problem of Local Correctness

“…Die Bibliothek Reflex baut auf Ynot auf und ermöglicht teilweise eine Verifikation [Ric+14]. Allerdings wird Reflex nicht mehr weiter entwickelt und auch von aktuellen COQ-Versionen nicht mehr unterstützt.…”

Verdi: a framework for implementing and formally verifying distributed systems

“…The Reflex framework [33] provides a domain-specific language for reasoning about the behavior of reactive systems. By carefully restricting the DSL, the authors were able to achieve high levels of proof automation.…”