Gradual verification of recursive heap data structures

Abstract

Current static verification techniques do not provide good support for incrementality, making it difficult for developers to focus on specifying and verifying the properties and components that are most important. Dynamic verification approaches support incrementality, but cannot provide static guarantees. To bridge this gap, prior work proposed gradual verification, which supports incrementality by allowing every assertion to be complete, partial, or omitted, and provides sound verification that smoothly scales from dynamic to static checking. The prior approach to gradual verification, however, was limited to programs without recursive data structures. This paper extends gradual verification to programs that manipulate recursive, mutable data structures on the heap. We address several technical challenges, such as semantically connecting iso-and equi-recursive interpretations of abstract predicates, and supporting gradual verification of heap ownership. This work thus lays the foundation for future tools that work on realistic programs and support verification within an engineering process in which cost-benefit trade-offs can be made.

Evaluating Soundness of a Gradual Verifier with Property Based Testing

“…The withdraw call in Figure 3 elicits this check before the termination of monthEnd in order to ensure a valid account balance, but only for the path denoted by the conditional branch. Wise et al (2020) extended gradual verification to support heap-allocated data structures using implicit dynamic frames (IDF) (Smans et al, 2009). In addition, Viper uses IDF in its implementation of static verification.…”

“…In addition to previously mentioned programs, our test suite is expanded to include tests that implement failing implementations from each issue in the issue tracker. A particularly interesting and significant issue was originally caught with the formalization of Gradual Verification from Wise et al (2020) regarding the internal output of Gradual C0 after the behavior had been formalized-Footprint Splitting. In this issue, Gradual C0 was not removing information from the optimistic heap, framed by an imprecise specification, when it should.…”

“…Inspired by gradual typing (Garcia et al 2016;Siek & Taha, 2006;Siek & Taha, 2007), with gradual verification the programmer gains control over the trade-offs between static and dynamic checking by way of partial specifications, allowing the behavior of unspecified components to be verified at run-time. Wise et al (2020) introduces the theory of gradual verification for programs that manipulate recursive heap data structures (trees, graphs, lists, etc.). 2022) also shows in a performance study that Gradual C0 reduces run-time overhead by 50-90% on average compared to dynamic verification.…”

More Programming Than Programming: Teaching Formal Methods in a Software Engineering Programme

“…Following the example of Gradual Dafny [18] and Gradual Verification [3,5,48] more generally should make testing easier. Ideally students would be able to run programs in a "test mode" where Dafny checks as many assertions, assumptions, and preand postconditions as possible dynamically.…”

“…Whereas the Dafny tool, although interactive, requires programmers to verify their whole program statically, Gradual Dafny [18] allows programmers to choose between static ("assert") and dynamic (run time "assume") verification for each invariant. Other gradual verification approaches have shown similar promise at partial verification, but with choices embodied in the tools themselves [3,45,5,48]. Coming at the problem from the other side, Müller & Ruskiewicz [41] demonstrated how standard program debuggers could be used to debug verification failures, by generating a modified program that reproduced the failure when run, and Christakis [12] integrated concolic testing tools and lower level solver debuggers into Dafny's IDE.…”