Abstract
We provide a way to ease the verification of programs whose state evolves monotonically. The main idea is that a property witnessed in a prior state can be soundly recalled in the current state, provided (1) state evolves according to a given preorder, and (2) the property is preserved by this preorder. In many scenarios, such monotonic reasoning yields concise modular proofs, saving the need for explicit program invariants. We distill our approach into the monotonic-state monad, a general yet compact interface for Hoare-style reasoning about monotonic state in a dependently typed language. We prove the soundness of the monotonic-state monad and use it as a unified foundation for reasoning about monotonic state in the F⋆ verification system. Based on this foundation, we build libraries for various mutable data structures like monotonic references and apply these libraries at scale to the verification of several distributed applications.
Supplemental Material
Available for Download
- D. Ahman, C. Hriţcu, K. Maillard, G. Martínez, G. Plotkin, J. Protzenko, A. Rastogi, and N. Swamy. Dijkstra monads for free . POPL. 2017. Google Scholar
Digital Library
- M. Barnett and D. A. Naumann. Friends need a bit more: Maintaining invariants over shared state . MPC. 2004. Google Scholar
Cross Ref
- J. Bengtson, K. Bhargavan, C. Fournet, A. D. Gordon, and S. Maffeis. Refinement types for secure implementations . ACM Trans. Prog. Lang. Syst. (TOPLAS), 33(2):8, 2011. Google Scholar
Digital Library
- K. Bhargavan, C. Fournet, and A. D. Gordon. Modular verification of security protocol code by typing. POPL, 2010. Google Scholar
Digital Library
- K. Bhargavan, B. Bond, A. Delignat-Lavaud, C. Fournet, C. Hawblitzel, C. Hriţcu, S. Ishtiaq, M. Kohlweiss, R. Leino, J. Lorch, K. Maillard, J. Pang, B. Parno, J. Protzenko, T. Ramananandro, A. Rane, A. Rastogi, N. Swamy, L. Thompson, P. Wang, S. Zanella-Béguelin, and J.-K. Zinzindohoué. Everest: Towards a verified, drop-in replacement of HT TPS . SNAPL, 2017a.Google Scholar
- K. Bhargavan, A. Delignat-Lavaud, C. Fournet, M. Kohlweiss, J. Pan, J. Protzenko, A. Rastogi, N. Swamy, S. Z. Béguelin, and J. K. Zinzindohoue. Implementing and proving the TLS 1.3 record layer. IEEE Security & Privacy, 2017b.Google Scholar
- T. Chajed, H. Chen, A. Chlipala, M. F. Kaashoek, N. Zeldovich, and D. Ziegler. Certifying a file system using crash hoare logic: correctness in the presence of crashes . Commun. ACM, 60(4):75–84, 2017. Google Scholar
Digital Library
- K. M. Chandy and L. Lamport. Distributed snapshots: Determining global states of distributed systems . ACM Trans. Comput. Syst., 3(1):63–75, 1985. Google Scholar
Digital Library
- A. Charguéraud. Characteristic formulae for the verification of imperative programs . ICFP. 2011. Google Scholar
Digital Library
- E. Cohen, M. Moskal, W. Schulte, and S. Tobies. Local verification of global invariants in concurrent programs . CAV. 2010. Google Scholar
Digital Library
- T. Dinsdale-Young, M. Dodds, P. Gardner, M. J. Parkinson, and V. Vafeiadis. Concurrent abstract predicates . ECOOP. 2010. Google Scholar
Cross Ref
- A. Filinski. Representing monads . POPL. 1994. Google Scholar
Digital Library
- C. S. Gordon, M. D. Ernst, and D. Grossman. Rely-guarantee references for refinement types over aliased mutable data . PLDI. 2013. Google Scholar
Digital Library
- N. Grimm, K. Maillard, C. Fournet, C. Hriţcu, M. Maffei, J. Protzenko, T. Ramananandro, A. Rastogi, N. Swamy, and S. ZanellaBéguelin. A monadic framework for relational verification: Applied to information security, program equivalence, and optimizations . arXiv:1703.00055, 2017.Google Scholar
- S. S. Ishtiaq and P. W. O’Hearn. BI as an assertion language for mutable data structures . POPL. 2001. Google Scholar
Digital Library
- J. B. Jensen and L. Birkedal. Fictional separation logic . ESOP. 2012. Google Scholar
Digital Library
- I. T. Kassios. Dynamic frames: Support for framing, dependencies and sharing without restrictions . FM. 2006. Google Scholar
Digital Library
- S. Katsumata. Parametric effect monads and semantics of effect systems . POPL. 2014. Google Scholar
Digital Library
- R. Krebbers, R. Jung, A. Bizjak, J. Jourdan, D. Dreyer, and L. Birkedal. The essence of higher-order concurrent separation logic . ESOP. 2017. Google Scholar
Digital Library
- K. R. M. Leino and W. Schulte. Using history invariants to verify observers . ESOP. 2007. Google Scholar
Cross Ref
- X. Leroy and S. Blazy. Formal verification of a C-like memory model and its uses for verifying program transformations . JAR, 41(1):1–31, 2008. Google Scholar
Digital Library
- P. B. Levy. Call-By-Push-Value: A Functional/Imperative Synthesis, volume 2 of Semantics Structures in Computation. Springer, 2004.Google Scholar
Digital Library
- S. Lindley and I. Stark. Reducibility and tt-lifting for computation types . TLCA. 2005. Google Scholar
Digital Library
- T. Lindvall. Lectures on the Coupling Method . Dover Books on Mathematics Series. Dover Publications, Incorporated, 2002.Google Scholar
- S. Matetic, M. Ahmed, K. Kostiainen, A. Dhar, D. Sommer, and A. Gervai. Rote: Rollback protection for trusted execution . USENIX Security. 2017.Google Scholar
- A. Nanevski, J. G. Morrisett, and L. Birkedal. Hoare type theory, polymorphism and separation . JFP, 18(5-6):865–911, 2008. Google Scholar
Digital Library
- S. Negri and J. von Plato. Cut elimination in the presence of axioms . Bulletin of Symbolic Logic, 4(4):418–435, 1998. Google Scholar
Cross Ref
- B. Parno, J. R. Lorch, J. R. Douceur, J. W. Mickens, and J. M. McCune. Memoir: Practical state continuity for protected modules . S&P. 2011. Google Scholar
Digital Library
- A. Pilkiewicz and F. Pottier. The essence of monotonic state . TLDI. 2011. Google Scholar
Digital Library
- N. Polikarpova, J. Tschannen, C. A. Furia, and B. Meyer. Flexible invariants through semantic collaboration . FM. 2014. Google Scholar
Digital Library
- J. Protzenko, J.-K. Zinzindohoué, A. Rastogi, T. Ramananandro, P. Wang, S. Zanella-Béguelin, A. Delignat-Lavaud, C. Hriţcu, K. Bhargavan, C. Fournet, and N. Swamy. Verified low-level programming embedded in F* . ICFP, 2017.Google Scholar
Digital Library
- X. Qi and A. C. Myers. Masked types for sound object initialization . POPL. 2009. Google Scholar
Digital Library
- J. Reed. A Hybrid Logical Framework. PhD thesis, Carnegie Mellon University, 2009.Google Scholar
- J. C. Reynolds. Separation logic: A logic for shared mutable data structures . LICS. 2002.Google Scholar
- I. Sergey, J. R. Wilcox, and Z. Tatlock. Programming and proving with distributed protocols . POPL, 2018.Google Scholar
Digital Library
- R. Strackx and F. Piessens. Ariadne: A minimal approach to state continuity . USENIX Security. 2016.Google Scholar
- R. E. Strom and S. Yemini. Typestate: A programming language concept for enhancing software reliability . IEEE Trans. Softw. Eng., 12(1):157–171, 1986. Google Scholar
Digital Library
- N. Swamy, J. Chen, C. Fournet, P. Strub, K. Bhargavan, and J. Yang. Secure distributed programming with value-dependent types . JFP, 23(4):402–451, 2013a. Google Scholar
Cross Ref
- N. Swamy, J. Weinberger, C. Schlesinger, J. Chen, and B. Livshits. Verifying higher-order programs with the Dijkstra monad . PLDI, 2013b. Google Scholar
Digital Library
- N. Swamy, C. Hriţcu, C. Keller, A. Rastogi, A. Delignat-Lavaud, S. Forest, K. Bhargavan, C. Fournet, P.-Y. Strub, M. Kohlweiss, J.-K. Zinzindohoué, and S. Zanella-Béguelin. Dependent types and multi-monadic effects in F* . POPL. 2016. Google Scholar
Digital Library
- W. Swierstra. A functional specification of effects . PhD thesis, University of Nottingham, UK, 2009.Google Scholar
- J.-K. Zinzindohoué, K. Bhargavan, J. Protzenko, and B. Beurdouche. HACL*: A verified modern cryptographic library. CCS, 2017. Google Scholar
Digital Library
Index Terms
Recalling a witness: foundations and applications of monotonic state
Recommendations
Operational Annotations: A New Method for Sequential Program Verification
NASA Formal MethodsAbstractI present a new method for specifying and verifying the partial correctness of sequential programs. The key observation is that, in Hoare logic, assertions are used as selectors of states, that is, an assertion specifies the set of program states ...
Verification conditions for source-level imperative programs
This paper is a systematic study of verification conditions and their use in the context of program verification. We take Hoare logic as a starting point and study in detail how a verification conditions generator can be obtained from it. The notion of ...
Outcome Logic: A Unifying Foundation for Correctness and Incorrectness Reasoning
Program logics for bug-finding (such as the recently introduced Incorrectness Logic) have framed correctness and incorrectness as dual concepts requiring different logical foundations. In this paper, we argue that a single unified theory can be used ...






Comments