Formal verification of synchronous data-flow program transformations toward certified compilers

Abstract

Translation validation was invented in the 90’s by Pnueli et al. as a technique to formally verify the correctness of code generators. Rather than certifying the code generator or exhaustively qualifying it, translation validators attempt to verify that program transformations preserve semantics. In this work, we adopt this approach to formally verify that the clock semantics and data dependence are preserved during the compilation of the Signal compiler. Translation validation is implemented for every compilation phase from the initial phase until the latest phase where the executable code is generated, by proving the transformation in each phase of the compiler preserves the semantics. We represent the clock semantics, the data dependence of a program and its transformed counterpart as first-order formulas which are called clock models and synchronous dependence graphs (SDGs), respectively. We then introduce clock refinement and dependence refinement relations which express the preservations of clock semantics and dependence, as a relation on clock models and SDGs, respectively. Our validator does not require any instrumentation or modification of the compiler, nor any rewriting of the source program.

Keywords

formal verification / translation validation / certified compiler / multi-clocked synchronous programs / embedded systems

References

[1] Berry G.The foundations of Esterel. In: Proof, Language, and Interaction. 2000, 425−454

[2] Halbwachs N. A synchronous language at work: the story of lustre. In: Proceedings of the 3rd ACM and IEEE International Conference on Formal Methods and Models for Co-Design. 2005, 3−11

[3] Gamati A. Designing embedded systems with the Signal programming language: synchronous, reactive specification. Springer Publishing Company, Incorporated, 2009

[4] Inria. The coq proof assitant.

[5] Do-178c. http://rtca.org

[6] Pnueli A, Siegel M, Singerman E. Translation validation. Tools and Algorithms for the Construction and Analysis of Systems, Springer, 1998_151−166

[7] Pnueli A, Shtrichman O, Siegel M. Translation validation: from Signal to C. Lecture Notes in Computer Science, 1999,1710: 231−255

[8] Inria. The compcert project.

[9] Necula G C. Translation validation for an optimizing compiler. ACM SIGPLAN Notices, 2000, 35(5): 83−94

[10] Tristan J B, Govereau P, Morrisett G. Evaluating value-graph translation validation for LLVM. ACM Sigplan Notices, 2011, 295−305

[11] Dutertre B, Moura de L. Yices Sat-solver.

[12] Espresso, Polychrony toolset. http://www.irisa.fr/espresso/Polychrony

[13] Benveniste A,Le Guernic P. Hybrid dynamical systems theory and the signal language. IEEE Transactions on Automatic Control, 1990, 35(5): 535−546

[14] Gautier T, Le Guernic P, Besnard L. Signal: a declarative language for synchronous programming of real-time systems. Lecture Notes in Computer Science, 1987, 274: 257−277

[15] Abramsky S, Jung A Domain theory. Abramsky S, Gabbay D M, Maibaum T S E, ed(s). Handbook of Logic in Computer Science: Volume 3: Semantic Structures. Oxford:Clarendon Press, 1994, 1−168

[16] Kahn G. The semantics of a simple language for parallel programming. IFIP Congress, 1974, 471−475

[17] Besnard L, Gautier T, Le Guernic P, Talpin J P. Compilation of polychromous data flow equations. Synthesis of Embedded Software, Springer, 2010, 1−40

[18] Ackermann W. Solvable Cases of the Decision Problem. Vol. 12. North-Holland Pub. Co., 1954

[19] Le Guernic P, Gautier T. Data-flow to von neumann: the signal approach. Rapports de recherche- INRIA

[20] Gamatié A, Gonnord L. Static analysis of synchronous programs in signal for effcient design of multi-clocked embedded systems. ACM Sigplan Notices, 2011, 46(5): 71−80

[21] Allen F E. Control flow analysis. ACM SIGPLAN Notices, 1970, 1−19

[22] Biere A, Heule M, Maarenv H, Walsh T. Handbook of Satisfiability Frontiers in Artificial Intelligence and Applications, vol. 185, 2009

[23] Ma_eïs O, Le Guernic P. Combining dependability with architectural adaptability by means of the signal language. Lecture Notes in Computer Science, 1993(724): 99−110

[24] Barrett C, Ranise S, Stump A, Tinelli C. The satisfiability modulo theories library (SMT-LIB). http://www.SMT-LIB.org, 2008

[25] http://www.smtcomp.org/2009

[26] Bryant R E. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers, 1986, 100(8): 677−691

[27] Leroy X. Formal certification of a compiler back-end or: programming a compiler with a proof assistant. ACM SIGPLAN Notices, 2006, 41(1): 42−54

[28] Tristan J B, Leroy X. A simple, verified validator for software pipelining. ACM SIGPLAN Notices, 2010, 45(1): 83−92

[29] Biernacki D, Colaço J L, Hamon G, Pouzet M. Clock-directed modular code generation for synchronous data-flow languages. ACM SIGPLAN Notices, 2008, 43(7): 121−130

[30] Ngo V C, Talpin J P, Gautier T, Le Guernic P, Besnard L. Formal verification of compiler transformations on polychronous equations. Lecture Notes in Computer Science, 2012, 7321:113−127

RIGHTS & PERMISSIONS

2013 Higher Education Press and Springer-Verlag Berlin Heidelberg