1. The Dafny program verifier K. Rustan M. Leino Research in Software Engineering Microsoft Research, Redmond Victoria University of Wellington Wellington, NZ 13 April 2010

2. Some RiSE tools at Microsoft • SLAM, Static Driver Verifier (SDV) • Sage • Code Contracts for .NET • Clousot • Pex • Z3

3. Static Driver Verifier • Applied regularly to all Microsoft device drivers of the support device models • ~300 bugs found • Available in Windows DDK to third parties

4. Predicate abstraction and refinement e.g.: Graf & Saïdi, SLAM, BLAST, … correct modelchecker boolean program abstract trace predicateabstraction concrete trace predicates C program feasible? no yes error message predicaterefinement

5. Symbolic-powered testing • Sage [Godefroid, Levin, et al.] • White-box fuzzing for C programs • Applied regularly • 100s of people doing various kinds of fuzzing Seed input New generation of symbolically derived input

6. Specifications: .NET today StringBuilder.Append Method (Char[], Int32, Int32) Appends the string representation of a specified subarray of Unicode characters to the end of this instance. publicStringBuilderAppend(char[] value, intstartIndex, intcharCount); Parameters value A character array. startIndex The starting position in value. charCount The number of characters append. Return Value A reference to this instance after the append operation has occurred. Exceptions

7. Specifications in Spec# publicStringBuilderAppend(char[] value, intstartIndex,intcharCount ); requires value == null ==> startIndex == 0 && charCount == 0; requires 0 <= startIndex; requires 0 <= charCount; requires value == null ||startIndex + charCount <= value.Length;ensuresresult == this;

8. Specifications with Code Contracts publicStringBuilderAppend(char[] value, intstartIndex,intcharCount){ Contract.Requires(value != null|| (startIndex== 0 && charCount == 0)); Contract.Requires(0 <= startIndex); Contract.Requires(0 <= charCount); Contract.Requires(value == null ||startIndex+ charCount <= value.Length); Contract.Ensures(Contracts.Result<StringBuilder>() == this); // method implementation...} Note that postcondition is declared at top of method body, which is not where it should be executed.A rewriter tool moves these.

9. Code Contracts[Barnett, Fähndrich, Grunkemeyer, Logozzo, et al.] • Declarative contracts • Language independent • Library to ship in .NET 4.0 • Tools available on DevLabs • Code Contracts Rewriter (for run-time checking) • Clousot abstract interpreter • Pex automated testing tool [de Halleux, Tillman, et al.]

10. Clousot[Fähndrich, Logozzo] • Abstract interpreter for .NET • Verifies Code Contracts at compile time • Some key technology: • Heap-aware abstraction • Iterative application of numerical domains: • Pentagons • Subpolyhedra • others

11. Pentagons • Some common abstract domains: • Intervals x  [A,B] • Octagons  x  y ≤ K • PolyhedraΣi xi≤ K • Observation: • Checking array accessesinvolves constraints like0 ≤ x < a.Length • These can be representedby intervals plus variableorderings y ≤ x Pentagon: Picture source: Robert Webb's Great Stella software, http://www.software3d.com/Stella.html

12. Z3 [Bjørner, de Moura] • Satisfiability Modulo Theories (SMT) solver • 9 first places and 6 second places atSMT-COMP’08 • Used in all tools mentioned, except Clousot

13. Deductive verificaton tools • HAVOC • Has been applied to 100s of KLOC • ~40 bugs in resource leaks, lock usage, use-after-free • VCC • Being applied to Microsoft Hypervisor • …

14. Dafny a language and verifier

15. Program verification functional correctness Dafny traditional mechanical program verification extended static checking limited checking automaticdecision procedures (SMT solvers) interactiveproof assistants

16. Dafny language • Sequential programs • Generic classes • Built-in specifications • Simple yet flexible framing • Sets, sequences, algebraic datatypes • User-defined functions • Ghost variables • Termination specifications

17. Dafny demos • Cubes • Queue • Schorr-Waite

18. Verification architecture Spec# C Dafny Chalice … Boogie Simplify Z3 SMT Lib …

19. Boogie language overview Mathematical features • type T; • const x: T; • functionf(A, B): T; • axiom E; Imperative features • var y: T; • procedureP(a: A, b: B) returns(x: T, y: U);requirespre;modifies w; ensurespost; • implementation P(a: A, b: B) returns(x: T, y: U) { … }

20. Boogie statements • x := E • a[ i ] := E • havoc x • assert E • assume E • ; • call P() • if • while • break • label: • goto A, B

21. Example: Defining OO semantics by translation into Boogie class C {var x: int; method M(n: int) returns (r: int) { … } staticmethodMain() {var c := new C;c.x:= 12;cally := c.M(5); }}

22. // class types typeClassName; constuniqueC: ClassName; type Ref; functiondtype(Ref): CName; const null: Ref; // fields typeField α; constuniqueC.x: Field int; constuniqueallocated: Field bool; // memory var Heap: <α>[Ref, Field α] α; Example: Boogie translation (0) classC { var x: int;

23. // method declarations procedureC.M(this: Ref, n: int) returns(r: int); requires this != null && dtype(this) == C; modifies Heap; procedureC.Main(); modifies Heap; Example: Boogie translation (1) method M(n: int)returns (r: int) staticmethod Main()

24. // method implementations implementationC.Main() { var c: Ref, y: int; havoc c; assume c != null; assume Heap[c, allocated] == false; assumedtype(c) == C; Heap[c, allocated] := true; assert c != null; Heap[c, C.x] := 12; call y := C.M(c, 5); } Example: Boogie translation (2) c.x:= 12; varc := new C; cally := c.M(5);

25. Conclusions • Tools and specifications are useful in software development • Full functional-correctness verification is becoming more automatic • To build a verifier, use an intermediate verification language Dafny and Boogie boogie.codeplex.com Code Contracts research.microsoft.com/contracts Projects and videos research.microsoft.com/rise Various papers research.microsoft.com/~leino/papers.html