Periodic Reporting for period 1 - Cameleer (Principles and Methods to Verify OCaml Programs)
Periodo di rendicontazione: 2020-06-01 al 2022-05-31
Deductive software verification, a subject within the broader field of formal methods, proposes a very ambitious path: to turn the correctness of a computer program into a mathematical statement, and then prove it. This project aims to develop a deductive verification framework, with a clear focus on proof automation, that directly tackles the verification of OCamlwritten programs.
OCaml seems to be particularly good target for verification. On one hand, it is the language of choice for the implementation of sensible software such as proof assistants, automated solvers, and compilers. On the other hand, OCaml is a multiparadigm language, supporting both the functional and imperative paradigm, one can write clean, concise, type-safe, and efficient code. Yet, a verification tool that can handle hand-written code and is mostly automated does not currently exist. OCaml programmers must chose between proof automation, with the price of learning and programming in a verificationaware language, and then perform code extraction, or tools that require manual proof assistance.
The Cameleer project aims to remedy this situation by providing the tools and principles for the verification of OCaml programs. The main outcome of this project is a powerful, usable, and mostly automated verification framework for the OCaml-written code. This will be a major step towards making verification more accessible to OCaml programmers, even in case they are not verification experts. The Cameleer framework will feature a translation of OCaml programs annotated with specifications written in GOSPEL, a recently proposed specification language, to different intermediate verification languages, namely WhyML, Viper, and Coq. This coexistence of multiple intermediate verification infrastructures allows the devised framework to target the verification of a large subset of OCaml programs, while combining the strengths of each individual intermediate language to obtain better verification results.
OCaml seems to be particularly good target for verification. On one hand, it is the language of choice for the implementation of sensible software such as proof assistants, automated solvers, and compilers. On the other hand, OCaml is a multiparadigm language, supporting both the functional and imperative paradigm, one can write clean, concise, type-safe, and efficient code. Yet, a verification tool that can handle hand-written code and is mostly automated does not currently exist. OCaml programmers must chose between proof automation, with the price of learning and programming in a verificationaware language, and then perform code extraction, or tools that require manual proof assistance.
The Cameleer project aims to remedy this situation by providing the tools and principles for the verification of OCaml programs. The main outcome of this project is a powerful, usable, and mostly automated verification framework for the OCaml-written code. This will be a major step towards making verification more accessible to OCaml programmers, even in case they are not verification experts. The Cameleer framework will feature a translation of OCaml programs annotated with specifications written in GOSPEL, a recently proposed specification language, to different intermediate verification languages, namely WhyML, Viper, and Coq. This coexistence of multiple intermediate verification infrastructures allows the devised framework to target the verification of a large subset of OCaml programs, while combining the strengths of each individual intermediate language to obtain better verification results.
This project main outcome is Cameleer, a deductive verification tool for OCaml-written code. Formal specification of OCaml programs is given in terms of Gospel annotations, while the proof is conducted via a translation into WhyML, the language of the Why3 verification framework. Hence, Cameleer is clearly focused towards proof automation.
With the Cameleer tool, one is able to prove realistic, large-scale OCaml modules. These range from classical persistent data structures, to stateful functions, and finally higher-order iterators.
The results of this project have been main presented via scientific publications. We highlight the paper "Cameleer: a Deductive Verification Tool for OCaml", accepted for publication at CAV 2021, the flagship conference on computer verification (core A*). Also, Cameleer and developed case studies have been presented to strategic workshops to the community, namely the OCaml Workshop 2021 and the ML-family workshop 2021. The Cameleer framework was also publicly presented in more than 10 invited research seminars given by the Experienced Researcher, either among the Portuguese community as well as abroad. Some of these were given to industrial partners and are available online (cf, https://www.youtube.com/watch?v=_tdZ1c9K1s4(si apre in una nuova finestra)). Finally, the Experienced Researcher also gave a three-hours long course on Cameleer during ICFP 2021, the flagship conference on functional programming (also available online, https://www.youtube.com/watch?v=frMKr-5RaD4(si apre in una nuova finestra)).
On a wider audience dissemination effort, Cameleer is the topic of a publication by the Research Outreach agency, available online (cf, https://researchoutreach.org/publications/issue-130/(si apre in una nuova finestra)).
In the aftermath of this MSCA, Cameleer will play a key role in a new research project, funded by the French National Research agency (ANR). This project is set to start on January 1st, 2023 and the Experienced Researcher is part of the research team. This will provide an excellent opportunity to complete parts of the translation from Cameleer into Separation Logic based frameworks, namely Viper and CFML.
With the Cameleer tool, one is able to prove realistic, large-scale OCaml modules. These range from classical persistent data structures, to stateful functions, and finally higher-order iterators.
The results of this project have been main presented via scientific publications. We highlight the paper "Cameleer: a Deductive Verification Tool for OCaml", accepted for publication at CAV 2021, the flagship conference on computer verification (core A*). Also, Cameleer and developed case studies have been presented to strategic workshops to the community, namely the OCaml Workshop 2021 and the ML-family workshop 2021. The Cameleer framework was also publicly presented in more than 10 invited research seminars given by the Experienced Researcher, either among the Portuguese community as well as abroad. Some of these were given to industrial partners and are available online (cf, https://www.youtube.com/watch?v=_tdZ1c9K1s4(si apre in una nuova finestra)). Finally, the Experienced Researcher also gave a three-hours long course on Cameleer during ICFP 2021, the flagship conference on functional programming (also available online, https://www.youtube.com/watch?v=frMKr-5RaD4(si apre in una nuova finestra)).
On a wider audience dissemination effort, Cameleer is the topic of a publication by the Research Outreach agency, available online (cf, https://researchoutreach.org/publications/issue-130/(si apre in una nuova finestra)).
In the aftermath of this MSCA, Cameleer will play a key role in a new research project, funded by the French National Research agency (ANR). This project is set to start on January 1st, 2023 and the Experienced Researcher is part of the research team. This will provide an excellent opportunity to complete parts of the translation from Cameleer into Separation Logic based frameworks, namely Viper and CFML.
The Cameleer tool is now a stable tool that can be used to conduct mostly-automated deductive verification of OCaml programs. It is the first automated verification tool that can deal directly with OCaml code, avoiding the need for programmers to re-write entire code bases just for the sack of formal proof. The case successful case studies conducted in Cameleer (over than 1000 lines of production-ready OCaml code) are an important milestone towards building a large body of formally verified OCaml modules.
In order to cope with the particular issues of OCaml implementations, the Gospel specification language has been consistently extended throughout the course of the Cameleer project. Gospel can now cope with implementations features such as loop invariants, intermediate assertions, as well as auxiliary logical definitions (e.g. ghost code, inductive predicates, auxiliary lemmas). Moreover, Gospel is now being developed by a larger group of researchers, which include François Pottier (supervisor of the secondment in Paris) and Arthur Charguéraud (supervisor of the secondment in Strasbourg, which did not happen due to Covid-19 travel restrictions). The Experienced Researcher has been working closely with Pottier and Charguéraud in the extension of Gospel to incorporate different ownership models, so that make it fit for the purpose of translation of OCaml-annotated programs into different flavors of Separation Logic.
Finally, the new ANR funded project features a clear goal towards the adoption of Cameleer within an industrial context. The French companies Tarides and Nomadic Labs are partners of the said project and are responsible for tasks on the incorporation of Cameleer and Gospel in their daily development activities.
In order to cope with the particular issues of OCaml implementations, the Gospel specification language has been consistently extended throughout the course of the Cameleer project. Gospel can now cope with implementations features such as loop invariants, intermediate assertions, as well as auxiliary logical definitions (e.g. ghost code, inductive predicates, auxiliary lemmas). Moreover, Gospel is now being developed by a larger group of researchers, which include François Pottier (supervisor of the secondment in Paris) and Arthur Charguéraud (supervisor of the secondment in Strasbourg, which did not happen due to Covid-19 travel restrictions). The Experienced Researcher has been working closely with Pottier and Charguéraud in the extension of Gospel to incorporate different ownership models, so that make it fit for the purpose of translation of OCaml-annotated programs into different flavors of Separation Logic.
Finally, the new ANR funded project features a clear goal towards the adoption of Cameleer within an industrial context. The French companies Tarides and Nomadic Labs are partners of the said project and are responsible for tasks on the incorporation of Cameleer and Gospel in their daily development activities.