Proving Fairness and Implementation Correctness of a Microkernel Scheduler

Daum, Matthias; Dörrenbächer, Jan; Wolff, Burkhart

doi:10.1007/s10817-009-9119-8

Cited by 15 publications

(7 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Existing works on using ontologies as part of safety-critical (e. g., [7,26]) or security-critical (e. g., [15]) focus on using ontologies for structuring queries on the set of specifications documents. While not discussed in this paper, Isabelle/DOF supports this time of knowledge management as well: the Isabelle/DOF editor allows for interactively querying for instances of concepts defined in the underlying ontologies as well as for the formal artifacts (formal definitions, proofs, etc.).…”

Section: Related Workmentioning

confidence: 99%

“…This failure led the authors of this paper to the following insight: For a successful formal certification process, it is by far not enough to have abstract models and corresponding refinement proofs to some implementation model (or even, as is the case in [13] or the seL4 initiative [20], to realistic C code). Certification processes targeting higher-levels of assurance such as CENELEC 50128/SIL 4 [11] or CC EAL7 [12] are all requiring the use of formal methods.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Using Ontologies in Formal Developments Targeting Certification

Brucker

Wolff

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

A common problem in the certification of highly safety or security critical systems is the consistency of the certification documentation in general and, in particular, the linking between semi-formal and formal content of the certification documentation. We address this problem by using an existing framework, Isabelle/DOF, that allows writing certification documents with consistency guarantees, in both, the semi-formal and formal parts. Isabelle/DOF supports the modeling of document ontologies using a strongly typed ontology definition language. An ontology is then enforced inside documents including formal parts, e. g., system models, verification proofs, code, tests and validations of corner-cases. The entire set of documents is checked within Isabelle/HOL, which includes the definition of ontologies and the editing of integrated documents based on them. This process is supported by an IDE that provides continuous checking of the document consistency. In this paper, we present how a specific software-engineering certification standard, namely CENELEC 50128, can be modeled inside Isabelle/DOF. Based on an ontology covering a substantial part of this standard, we present how Isabelle/DOF can be applied to a certification case-study in the railway domain.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Using Ontologies in Formal Developments Targeting Certification

Brucker

Wolff

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…C0 assumes a typed memory model. While C0 has been used in substantial case studies [1,20], the limited language fragment restricts its use to "code designed for verification", i. e. academic projects. These limitations were partially overcome within the current L4.VERIFIED project [32], where a trusted pre-compiler to C0 is used to enlarge the supported C fragment; the code to be verified is about 10kloc.…”

Section: Related Workmentioning

confidence: 99%

HOL-Boogie—An Interactive Prover-Backend for the Verifying C Compiler

et al. 2009

Self Cite

View full text Add to dashboard Cite

Boogie is a verification condition generator for an imperative core language. It has front-ends for the programming languages C# and C enriched by annotations in first-order logic, i. e. pre-and postconditions, assertions, and loop invariants. Moreover, concepts like ghost fields, ghost variables, ghost code and specification functions have been introduced to support a specific modeling methodology. Boogie's verification conditions-constructed via a wp calculus from annotated programs-are usually transferred to automated theorem provers such as Simplify or Z3. This also comprises the expansion of language-specific modeling constructs in terms of a theory describing memory and elementary operations on it; this theory is called a machine/memory model. In this paper, we present a proof environment, HOL-Boogie, that combines Boogie with the interactive theorem prover Isabelle/HOL, for a specific C front-end and a machine/memory model. In particular, we present specific techniques combining automated and interactive proof methods for code verification. The main goal of our environment is to help program verification engineers in their task to "debug" annotations and to find combined proofs where purely automatic proof attempts fail.

show abstract

“…The CVM marks the top-level model described in this article. It is the basis for a microkernel and an operating system built on top of it [15][16][17].…”

Section: Cvmmentioning

confidence: 99%

Balancing the Load

et al. 2009

View full text Add to dashboard Cite

We have developed a stack of semantics for a high-level C-like language and low-level assembly code, which has been carefully crafted to support the pervasive verification of system software. It can handle mixed-language implementations and concurrently operating devices, and permits the transferral of properties to the target architecture while obeying its resource restrictions. We demonstrate the applicability of our framework by proving the correct virtualization of user memory in our microkernel, which implements demand paging. This verification target is of particular interest because it has a relatively simple top-level specification and it exercises all parts of our semantics stack. At the bottom level a disk driver written 390 E. Alkassar et al.in assembly implements page transfers via a swap disk. A page-fault handler written in C uses the driver to implement the paging algorithm. It guarantees that a step of the currently executing user can be simulated at the architecture level. Besides the mere theoretical and technical difficulties the project also bore the social challenge to manage the large verification effort, spread over many sites and people, concurrently contributing to and maintaining a common theory corpus. We share our experiences and elaborate on lessons learned.

show abstract

Proving Fairness and Implementation Correctness of a Microkernel Scheduler

Cited by 15 publications

References 40 publications

Using Ontologies in Formal Developments Targeting Certification

Using Ontologies in Formal Developments Targeting Certification

HOL-Boogie—An Interactive Prover-Backend for the Verifying C Compiler

Balancing the Load

Contact Info

Product

Resources

About