Deductive Verification with Ghost Monitors

Martin Clochard (1) , Claude Marché (2) , Andrei Paskevich (2)

1 ETH Zürich - Eidgenössische Technische Hochschule - Swiss Federal Institute of Technology [Zürich]
2 TOCCATA - Formally Verified Programs, Certified Tools and Numerical Computations

We present a new approach to deductive program verification based on auxiliary programs called ghost monitors. This technique is useful when the syntactic structure of the target program is not well suited for verification, for example, when an essentially recursive algorithm is implemented in an iterative fashion. Our approach consists in implementing, specifying, and verifying an auxiliary program that monitors the execution of the target program, in such a way that the correct-ness of the monitor entails the correctness of the target. This technique is also applicable when we want to establish relational properties between two target programs written in different languages and having different syntactic structure. The ghost monitor maintains the necessary data and invariants to facilitate the proof. It can be implemented and verified in any suitable framework, which does not have to be related to the language of the target programs. We introduce one such framework, with an original extension that allows us to specify and prove fine-grained properties about infinite behaviors of target programs. The proof of correctness of our approach relies on a particular flavor of transfinite games. This proof is formalized and verified using the Why3 tool.

Mots clés: deductive verification; unstructured programs; ghost code; games; Hoare logic; predicate transformers; infinite behaviors

Domaines: Logique en informatique [cs.LO]

Martin Clochard, Claude Marché, Andrei Paskevich. Deductive Verification with Ghost Monitors. 2018. ⟨hal-01926659⟩