Holistic Specifications for Robust Programs

Abstract

Functional specifications describe what program components can do: the sufficient conditions to invoke a component's operations. They allow us to reason about the use of components in the closed world setting, where the component interacts with known client code, and where the client code must establish the appropriate pre-conditions before calling into the component. Sufficient conditions are not enough to reason about the use of components in the open world setting, where the component interacts with external code, possibly of unknown provenance, and where the component itself may evolve over time.In this open world setting, we must also consider the necessary conditions, i.e. what are the conditions without which an effect will not happen. In this paper we propose a language Chainmail for writing holistic specifications that focus on necessary conditions (as well as sufficient conditions). We give a formal semantics for Chainmail, and the core of Chainmail has been mechanised in the Coq proof assistant.

Necessity Specifications for Robustness

“…TooL is straightforward: Appendix A contains the full definitions. TooL is based on ℒ oo [Drossopoulou et al 2020b], with some small variations, as well as the addition of a simple type system -more in 4. As discussed in §2.5, open world specifications need to be able to provide guarantees which hold during execution of an internal, known, trusted module 𝑀 when linked together with any unknown, untrusted, module 𝑀 ′ .…”

“…To express our focus on external states, we define the external states semantics, of the form 𝑀 ′ ; 𝑀, 𝜎 𝜎 ′ , where 𝑀 ′ is the external module, and 𝑀 is the internal module, and where we collapse all internal steps into one single step. Drossopoulou et al [2020b] provides a simple graphical description of our external states semantics: (A) is the "normal" execution after linking two modules into one: 𝑀 ′ • 𝑀, ... ... whereas (B) is the external states execution when 𝑀 ′ is external, 𝑀 ′ ; 𝑀, ... .... Note that whether a module is external or internal depends on perspective -nothing in a module itself renders it internal or external.…”

“…Nevertheless, the logic of 𝐴 remains classical because recursion is restricted to expressions, and not generally to assertions. We have taken this approach from Drossopoulou et al [2020b], which also contains a mechanized Coq proof that assertions are classical [Drossopoulou et al 2020a]. The semantics of ↩→ is unsurprising (see Fig.…”

“…no decrease in balance without access to password). VerX [Permenev et al 2020a] and Chainmail [Drossopoulou et al 2020b] also work on problem-specific guarantees. Both these approaches are able to express necessary conditions like 𝑺 robust_1 using temporal logic operators and implication, and Chainmail is able to express 𝑺 robust_2 , however neither have a proof logic to prove adherence to such specifications.…”

Holistic Specifications for Robust Programs

“…Model We have constructed a Coq model 7 [23] of the core of the Chainmail specification language, along with the underlying L oo language. Our formalism is organised as follows:…”