1 MSR/Cambridge Formal Verification Overview Byron Cook Microsoft Research, Cambridge

2 Cambridge:  Long standing tradition of areas of formal methods research MSR-Cambridge  Strong background in programming languages research  Recent strength in formal verification Queen Mary, University of London  Separation logic is frequent subject of interest  Much interaction between Queen Mary and Cambridge area researchers Great deal of joint research in recent years  Continuum between academic and industrial research  Frequent cross-organization exchange and discussion  Cross-organization supervision MSR/Cambridge/London

3 Cambridge: long standing tradition of formal verification research MSR-Cambridge  Strong background in programming languages research  Recent strength in formal verification Queen Mary, University of London  Separation logic is frequent subject of interest  Much interaction between Queen Mary and Cambridge area researchers Continuum between academic and industrial research  Frequent cross-organization exchange and discussion  Cross-organization supervision MSR/Cambridge/London

4

5 Cambridge: long standing tradition of formal verification research MSR-Cambridge  Strong background in programming languages research  Recent strength in formal verification Queen Mary, University of London  Separation logic is frequent subject of interest  Much interaction between Queen Mary and Cambridge area researchers Continuum between academic and industrial research  Frequent cross-organization exchange and discussion  Cross-organization supervision MSR/Cambridge/London

6 Projects: Semi-automatic methods of proving correctness of (fine-grained) concurrent programs with data Automatic methods of proving correctness of (course-grained) concurrent programs Automatic methods of proving termination/liveness Shape analysis Security analysis ARM research MSR/Cambridge

7 Projects: Semi-automatic methods of proving correctness of (fine-grained) concurrent programs with data Automatic methods of proving correctness of (course-grained) concurrent programs Automatic methods of proving termination/liveness Shape analysis Security analysis ARM research MSR/Cambridge

8

9 Termination analysis research Byron Cook Microsoft Research, Cambridge

10 Introduction Reactive systems: Operating systems Medical systems Web servers & clients servers & clients etc...

11 Introduction Reactive systems: Operating systems Medical systems Web servers & clients servers & clients etc...

12 Introduction

13 Introduction

14 Introduction

15 Introduction

16 Introduction

17 Introduction

18

19

20

21

22

23

24

25

26

27 All known program proof/analysis tools support ONLY safety properties: Safety properties ensure that “nothing bad happens” Safety properties are guaranteed to have finite counterexamples: If the code calls KeLeaveCriticalRegion then it has (in some time in the past) it called KeEnterCriticalRegion Safety and liveness properties

28 Termination is an example of a liveness property: Liveness properties ensure that “something good will eventually happen” Will the parallel port’s PNP dispatch routine eventually return execution to its caller (i.e. Termination) If the code calls KeEnterCriticalRegion then it will eventually call KeLeaveCriticalRegion Liveness can always be converted into fair termination Safety and liveness properties

29 What we need: Tools that automatically prove termination of program fragments Support for large program fragments (>50,000 LOC) Precision & true counterexamples Arbitrarily nested loops, recursive functions, pointers, callbacks, etc Perhaps even tools that attempt to compute code complexity Prospects for automatic/scalable termination provers

30 What we need: Tools that automatically prove termination of program fragments Support for large program fragments (>50,000 LOC) Precision & true counterexamples Arbitrarily nested loops, recursive functions Perhaps even tools that attempt to compute code complexity Prospects for automatic/scalable termination provers

31 What we need: Tools that automatically prove termination of program fragments Support for large program fragments (>50,000 LOC) Precision & true counterexamples Arbitrarily nested loops, recursive functions Perhaps even tools that attempt to compute code complexity Prospects for automatic/scalable termination provers

32 What we need: Tools that automatically prove termination of program fragments Support for large program fragments (>50,000 LOC) Precision & true counterexamples Arbitrarily nested loops, recursive functions Perhaps even tools that attempt to compute code complexity Prospects for automatic/scalable termination provers

33 Prospects for automatic/scalable termination provers What we need: Usability/features:  User supplied & maintained termination arguments  Independently checkable witnesses Bit-vector support Concurrency Fair termination and liveness Mutating heaps Variance analysis

34 Prospects for automatic/scalable termination provers What we need: Usability/features:  User supplied & maintained termination arguments  Independently checkable witnesses Bit-vector support Concurrency Fair termination and liveness Mutating heaps Variance analysis

35 Status Papers written using preliminary prototypes  Suffering from bit-rot Current plan: re-implement tools on top of SLAyer  On the Static driver Verifier product roadmap. New research directions:  Termination for fine-grained concurrency  Runtime techniques using termination analysis

36 Prospects for automatic/scalable termination provers What we need: Usability/features:  User supplied & maintained termination arguments  Independently checkable witnesses Bit-vector support Concurrency Fair termination and liveness Mutating heaps Variance analysis

37 Variance analyses

38 Variance analyses

39 Variance analyses

40 Variance analyses

41 Variance analyses

42 Variance analyses

43 Variance analyses