Refinement through restraint: bringing down the cost of verification

Abstract

We present a framework aimed at significantly reducing the cost of verifying certain classes of systems software, such as file systems. Our framework allows for equational reasoning about systems code written in our new language, Cogent. Cogent is a restricted, polymorphic, higher-order, and purely functional language with linear types and without the need for a trusted runtime or garbage collector. Linear types allow us to assign two semantics to the language: one imperative, suitable for efficient C code generation; and one functional, suitable for equational reasoning and verification. As Cogent is a restricted language, it is designed to easily interoperate with existing C functions and to connect to existing C verification frameworks.Our framework is based on certifying compilation: For a welltyped Cogent program, our compiler produces C code, a high-level shallow embedding of its semantics in Isabelle/HOL, and a proof that the C code correctly refines this embedding. Thus one can reason about the full semantics of real-world systems code productively and equationally, while retaining the interoperability and leanness of C. The compiler certificate is a series of language-level proofs and per-program translation validation phases, combined into one coherent top-level theorem in Isabelle/HOL.

The verified CakeML compiler backend

“…The Cogent (O'Connor et al, 2016) language has a proof-producing compiler down to C, which can be further compiled with CompCert, or via translation validation (Sewell et al, 2013). It is a pure, functional and total language, aimed at reasoning for systems programming.…”

Ready,Set, Verify! Applyinghs-to-coqto real-world Haskell code

“…There are many large and successful verification projects that demonstrate that functional languages are well suited for verification. In contrast to our work, these projects require either re-implementing the code in a new functional language, as is the case for Cogent (O'Connor et al, 2016;Amani et al, 2016) and F* (Swamy et al, 2016); re-implementing the code in a proof assistant, such as HOL4 in the case of CakeML Kumar et al, 2014); or taking an SMT solver-based approach, as found in Leon (Blanc et al, 2013). The CakeML and Cogent projects have a different focus than ours, and they provide a higher assurance in their verified code.…”

Build a trusted storage system on a mobile phone

“…Our work is similar to verify a file system (a similar system API like open, read and write etc.) Pioneering work in file system direction includes FSCQ [30], COGENT [31, 32] and Flashix [33, 34], which are all successful engineering achievements. However, almost all of these jobs need a developer to construct a proof of implementation correctness using theorem tools such as Coq or Isabelle.…”