HOL-Boogie—An Interactive Prover-Backend for the Verifying C Compiler

Abstract

Boogie is a verification condition generator for an imperative core language. It has front-ends for the programming languages C# and C enriched by annotations in first-order logic, i. e. pre-and postconditions, assertions, and loop invariants. Moreover, concepts like ghost fields, ghost variables, ghost code and specification functions have been introduced to support a specific modeling methodology. Boogie's verification conditions-constructed via a wp calculus from annotated programs-are usually transferred to automated theorem provers such as Simplify or Z3. This also comprises the expansion of language-specific modeling constructs in terms of a theory describing memory and elementary operations on it; this theory is called a machine/memory model. In this paper, we present a proof environment, HOL-Boogie, that combines Boogie with the interactive theorem prover Isabelle/HOL, for a specific C front-end and a machine/memory model. In particular, we present specific techniques combining automated and interactive proof methods for code verification. The main goal of our environment is to help program verification engineers in their task to "debug" annotations and to find combined proofs where purely automatic proof attempts fail.

Extending Sledgehammer with SMT Solvers

“…Other tools, such as HOL-Boogie [8], assist in specific applications. Isabelle/HOL is powerful enough for the vast majority of hardware and software verification efforts, and its LCF-style inference kernel provides a trustworthy foundation.…”

“…While a motivated user can go a long way with the smt proof method [8], the need to specify facts and to guess that a conjecture could be solved by SMT makes it hard to use. As evidence of this, the Isabelle formalizations accepted in the Archive of Formal Proofs [23] in 2010 and 2011, after smt was introduced in Isabelle, contain 7958 calls to the simplifier, 928 calls to the internal tableau prover, 219 calls to Metis (virtually all generated using Sledgehammer), but not even one smt call.…”

Verification of Certifying Computations

“…Export to Isabelle/HOL: Next -based on the abstract postcondition of the checkerwe formulate the overall correctness theorem in VCC, i.e., implication (1). 4 Establishing such a theorem may involve non-trivial mathematical reasoning. Therefore we translate it to Isabelle/HOL.…”

“…Integrating powerful interactive theorem provers as backends to code verification systems has been exercised for VCC and Boogie with Isabelle/HOL as backend [4] as well as for Why with a Coq backend [10]. Both systems have a C verifier frontend.…”

Deductive Verification of System Software in the Verisoft XT Project

“…While there are ongoing efforts to accommodate different theorem provers into the VCC tool chain (including interactive ones, like Isabelle/HOL [5]), the Verisoft XT subprojects Hypervisor and Avionics mostly use the SMT solver called Z3 as the underlying deduction engine. SMT stands for Satisfiability Modulo Theories.…”