Why Would You Trust B?

Abstract

The use of formal methods provides confidence in the correctness of developments. Yet one may argue about the actual level of confidence obtained when the method itself -or its implementation -is not formally checked. We address this question for the B, a widely used formal method that allows for the derivation of correct programs from specifications. Through a deep embedding of the B logic in Coq, we check the B theory but also implement B tools. Both aspects are illustrated by the description of a proved prover for the B logic.A clear benefit of formal methods is to increase the confidence in the correctness of developments. However, one may argue about the actual level of confidence obtained, when the method or its implementation are not themselves formally checked. This question is legitimate for safety, as one may accidentally derive invalid results. It is even more relevant when security is a concern, as any flaw can be deliberately exploited by a malicious developer to obfuscate undesirable behaviours of a system while still getting a certification.B [1] is a popular formal method that allows for the derivation of correct programs from specifications. Several industrial implementations are available (e.g. AtelierB, B Toolkit ), and it is widely used in the industry for projects where safety or security is mandatory. So the B is a good candidate for addressing our concern: when the prover says that a development is right, who says that the prover is right? To answer this question, one has to check the theory as well as the prover w.r.t. this theory (or, alternatively, to provide a proof checker). Those are the objectives of BiCoq, a deep embedding of the B logic in Coq [2].BiCoq benefits from the support of Coq to study the theory of B, and to check the validity of standard definitions and results. BiCoq also allows us, through an implementation strategy, to develop formally checked B tools. This strategy is illustrated in this paper by the development of a prover engine for the B logic, that can be extracted and used independently of Coq. Coq is therefore our notary public, witnessing the validity of the results associated to the B theory, as well as the correctness of tools implementing those results -ultimately increasing confidence in B developments. The approach, combining a deep embedding and an implementation technique, can be extended to address further elements of the B, beyond its logic, or to safely enrich it, as illustrated in this paper. This paper is divided into 9 sections. Sections 1, 2 and 3 briefly introduce B, Coq and the notion of embedding. The B logic and its formalisation in Coq are presented in Sec. 4. Section 5 describes various results proved using BiCoq. Section 6 focuses on the implementation strategy, and presents its application to the development of a set of extractible proof tactics for a B prover. Section 7 discusses further uses of BiCoq, and mentions some existing extensions. Finally, Sect. 8 concludes and identifies further activities.

Yet Another Deep Embedding of B:Extending de Bruijn Notations

“…[11,12]), and it is therefore important to know what is the level of confidence that one can grant to a system proven using this method, and how to improve this level of confidence. The other objectives are the development of formally checked tools for B developments, illustrated by a proven prover (not discussed further in this paper but detailed in [13]) and the derivation of new results about the B logic. Regarding the latter, it is again important to be able to justify that such results are not a consequence of the embedding itself, e.g.…”

“…We also benefit from the Notation command provided by Coq to use UTF-8 symbols instead of constructors or functions names 9. Further details are discussed in[13].…”

A Few Remarks about Formal Development of Secure Systems

“…In [29] a deep embedding (cf. [30], [31]) of the B logic in Coq is described, that is intuitively a form of B virtual machine developed in Coq with the objective to check the validity of the B logic.…”

“…In our view, the (potential) existence of bugs in a tool does not mean that it should not be used, but that the provided results should be considered with some care, and possibly verified by other mechanisms. This is addressed for example by [29], [35].…”

Soundly Proving B Method Formulæ Using Typed Sequent Calculus

“…The concerns about the confidence given to ATP in the case of B proof have been resolved using the alternative approach of a certified prover and relying on a deep embedding of the B logic into the interactive prover Coq, by Jaeger et al [14]. It has also been studied in the context of Event-B by Schmalz in [17].…”