Certifying a file system using crash hoare logic

Abstract

FSCQ is the first file system with a machine-checkable proof that its implementation meets a specification, even in the presence of fail-stop crashes. FSCQ provably avoids bugs that have plagued previous file systems, such as performing disk writes without sufficient barriers or forgetting to zero out directory blocks. If a crash happens at an inopportune time, these bugs can lead to data loss. FSCQ's theorems prove that, under any sequence of crashes followed by reboots, FSCQ will recover its state correctly without losing data. To state FSCQ's theorems, this paper introduces the Crash Hoare logic (CHL), which extends traditional Hoare logic with a crash condition, a recovery procedure, and logical address spaces for specifying disk states at different abstraction levels. CHL also reduces the proof effort for developers through proof automation. Using CHL, we developed, specified, and proved the correctness of the FSCQ file system. Although FSCQ's design is relatively simple, experiments with FSCQ as a user-level file system show that it is sufficient to run Unix applications with usable performance. FSCQ's specifications and proofs required significantly more work than the implementation, but the work was manageable even for a small team of a few researchers.

Towards Sophisticated Air Traffic Control System Using Formal Methods

“…(i) Hoare logic is a formal method for reasoning on computer program correctness where specifications are of the form {P} procedure {Q} [7]. (ii) Petri nets are a graphical and mathematical modeling tool applicable to many systems.…”

Continuous Reasoning

“…Impressive advances have been made in mechanized verification in recent years. We have seen example verifications of OS microkernels [48,67], a file system [13], crypto algorithms [4] and distributed systems [41]. Some of this work develops the program and the proof side by side, while other work proves existing code.…”

Modular Verification of Order-Preserving Write-Back Caches

“…consists of a set of states S, inputs In and outputs Out, initial states Init, synchronized states Sync with Init ⊆ Sync ⊆ S, a relation Crash ⊆ S×Sync with Sync ⊆ dom(Crash) describing the effect of a crash including its subsequent recovery, 4 and regular operations Op i ⊆ In × S × S × (Out { }). The value signifies that the operation was interrupted by a power cut.…”

“…f (s, x, sync = false)). Ntzik et al [16] as well as Chen et al [6,4] have developed Hoare-style proof rules that establish a user-provided invariant called "crash condition" over the intermediate states of a program that serves as the precondition of recovery. The latter work has produced the FSCQ file system that is verified with Coq.…”