Extracting a data flow analyser in constructive logic

Abstract

A constraint-based data flow analysis is formalised in the specification language of the Coq proof assistant. This involves defining a dependent type of lattices together with a library of lattice functors for modular construction of complex abstract domains. Constraints are represented in a way that allows for both efficient constraint resolution and correctness proof of the analysis with respect to an operational semantics. The proof of existence of a solution to the constraints is constructive which means that the extraction mechanism of Coq provides a provably correct data flow analyser in Ocaml from the proof. The library of lattices and the representation of constraints are defined in an analysisindependent fashion that provides a basis for a generic framework for proving and extracting static analysers in Coq.

Certified Memory Usage Analysis

“…All these steps are performed in the Coq proof assistant. Steps 1, 2 and 5 benefit from the framework proposed in [3] and thus no new proof is required. We only need to prove steps 3 and 4, for which the property (1) represents the core of the work: Lemma 1.…”

“…It is meant to give an intuition for how the development of a certified analyser can be done methodologically [3] and to serve as a first guide to the site [13] from which the analyser and the Coq specification and proofs can be downloaded, compiled and tested. The formalisation of Java Card syntax and semantics is taken form an existing data flow analyser formalised in Coq [3]. The analysis consists in calculating the sets Anc, MutRecR, Pred and LoopCall that are indexed by program methods and program points.…”

“…The resolution of the constraints can now be done using the iterative fix-point solver, as explained in [3]. The fix-point solver is a function of type…”

“…Mechanical verification of Java analysers have so far mainly dealt with the Java byte code verifier [2,9,4]. The first exception is the work reported in [3] on formalising an interprocedural data flow analyser for Java Card, on which part of the formalisation of the present analysis is based. The framework proposed in [3] allows us to concentrate on the specification of the analysis as a set of constraints and on the correctness of this system with respect to the semantics of the language (see Section 4).…”

“…The first exception is the work reported in [3] on formalising an interprocedural data flow analyser for Java Card, on which part of the formalisation of the present analysis is based. The framework proposed in [3] allows us to concentrate on the specification of the analysis as a set of constraints and on the correctness of this system with respect to the semantics of the language (see Section 4). The lattice library and the generic solver of [3] were reused as is to extract the certified analyser.…”