Certifying Domain-Specific Policies

1. Certifying Domain-Specific Policies Michael Lowry Thomas Pressburger Grigore Rosu NASA Ames Research Center

2. Certification Spectrum I Automation • Type checking: • Automatic, efficient, effective • Reveals avery limitedset of errors Trade - off Efficiency Generality Efficacy

3. Certification Spectrum II • Polyspace – a static analysis tool • Automatic, sometimes efficient, sound • False positives, limited to prog language-specific errors • Proof Carrying Code (PCC) – Necula et al. • Automatic, effective and efficient for consumer; sound • Annotations, limited safety policies (memory safety) • Extended Static Checker (ESC) – Leino et al. • Elegant trade-off; relatively efficient and effective • language-specific errors and a bit more • ~10% annotations, not sound!

4. Domain Specific Certifiers (DSC) • Check domain-specific safety policies • Domains presented axiomatically • Safety policies as partial abstractions • High degree of automation • Annotations often needed only for inputs • Informative warnings • Inconsistency with axioms, deep meaning

5. Architecture of a DSC Abstract Domain (Executable Specification) Coordinate Frames SI Units, etc. Abstraction Semantics (Executable Specification) Encodes Safety Policies frameSafe : Pgm -> Bool unitSafe : Pgm -> Bool Programming Language (Syntax Specification) C, Java, Fortran

6. Our Approach to DSC • Use a limited amount of theorem proving • Equational logics are powerful and expressive • Rewriting implements them efficiently • Use Maude as executable spec language • 3 milion rewrites per second on 1.5 GHz PCs! • Membership Equational Logic (MEL) • excelent to deal with partiality • Mix-fix signatures • parsing for free, natural and easy to read axioms

7. A Case Study:Frame Certification • Abstract Domain = Axiomatization of Frames (Translations, Rotations, etc.) • Abstraction = Partial interpretation of functions into the abstract domain • Programming Language = Simple assignment language; Fortran & NAIF

8. Frame Certification:Programming Language • NAIF library + assignment • Example problem: Given a time tEarth and an observation point pObs on Earth, calculate the angle under which Saturn is seen from pObs at time tEarth; the angle is relative to the normal on Earth’s surface in pObs.

9. Earth dNorm pObs rEarth mEarth pObs dNorm angle Saturn dSaturn Earth pObs pSaturn pEarth J2000 Example ... // tEarth : time of observation // pObs : position of observation rEarth := bodvar(earthId, ‘radii’); dNorm := surfnm(rEarth, pObs); pEarth := findp(earthId, tEarth); mEarth := bodmat(earthId, tEarth); pObs := mtxv(mEarth, pObs); dNorm := mtxv(mEarth, dNorm); tSaturn := sent(saturnId, earthId, tEarth); pSaturn := findp(saturnId, tSaturn); pObs := vadd(pEarth, pObs); dSaturn := vsub(pSaturn, pObs); angle := vsep(dNorm, dSaturn);

10. Specifying the Language • Maude: order-sorted mix-fix notation • Can parse any familiar syntax • Only domain-specific semantics is needed! fmod PROG-LANG is sorts PlReal PlVector PlMatrix Var Stmt Pgm . subsort Stmt < Pgm . op _;_ : Pgm ; Stmt -> Pgm . ops vadd vsub : PlVector PlVector -> PlVector . ops mxv mtxv : PlMatrix PlVector -> PlVector . ops vdist vsep : PlVector PlVector -> PlReal . op _:=_ : Var PlVector -> Stmt . … enfm

11. Frame Certification:Abstract Domain • The most difficult part of the frame DSC

12. Abstract Domain:Orientations and Rotations • Orientations and rotations as ADT • Form a Category unit(O) sorts Orientation Rotation . ops s t : Rotation -> Orientation . op unit : Orientation -> Rotation . eq s(unit(O)) = O . eq t(unit(O)) = O . op _~ : Rotation -> Rotation . eq Rot ~ ~ = Rot . eq s(Rot ~) = t(Rot) . op _*_ : Rotation Rotation -> [Rotation] . cmb Rot * Rot’ : Rotation if t(Rot) = s(Rot’) . eq Rot * (Rot ~) = unit(s(Rot)) . O Rot O’ O partiality Rot ~ Rot’ Rot * Rot’ Rot O’’ = O’’ O O O’ O

13. Abstract Domain:Frames and Translations • Frames and Translations are also a Category Trans’ Frm’’ Frm’ Trans Trans + Trans’ Frm

14. Abstract Domain:Some Axioms (Rewriting Rules) • Other operations added: • Rotate frames, translations, directions op _@_ : Frame Rotation ->[Frame], etc. • Extract orientation of frames, translations op frameOrt : Frame -> Orientation, etc • Other axioms added, such as: • Check and cumulate rotations cmb Frm @ Rot : Frame if frameOrt(Frm) = s(Rot) . ceq frameOrt(Frm @ Rot) = t(Rot) if Frm @ Rot :: Frame . eq (Frm @ Rot) @ Rot’ = Frm @ (Rot * Rot’) • Commutativity of translations and rotations, etc • Rotation then translation = translation then rotation partiality

15. Frame Certification:Abstraction, Safety Policy • Common abstract supersort: FrameSafe • Common concrete supersort: Value • Partial abstraction operation: op |_| : Value -> [FrameSafe] • Axioms: eq | vadd(V, V’) | = | V | + | V’ | eq | mtxv(M, V) | = | V | @ (| M | ~) cmb |vsep(V, V’)| : Real if frameOrt(s(|V|))=frameOrt(s(|V’|)) • Safety Policy: op frameSafe : Pgm -> Bool eq frameSafe(Pgm ; Var := Value) = |Pgm[Value]| :: FrameSafe and frameSafe(Pgm) partiality

16. Evaluation and Scaling • Tested it on mutant programs • Discovered all the mutants • Tested it on larger synthetic programs • NAIF programs are compact: we did not find large real programs • Certified 1000 SLOC in • 2.2 seconds without caching • 1.3 seconds with caching eq frameSafe(Pgm ; Var := Value) = |Pgm[Value]| :: FrameSafe and frameSafe(Pgm) • Current implementation runs in O(n^2) • Pgm[Value] is linear, so1 + 2 + … + (n –1)steps • The problem: backwards traversal of the program • Can be O(n): forwards traversal and environments

17. Why not types?(like in MDS, ML) • Better ask: Why types? • Algebraic approach is elegant, efficient, modular • Inconvenient • changes/specializes the language by adding types • Intractable • Type inference in presence of equations • Execution overhead • Additional method calls (some compilers can optimize this) • Limiting: rejects pObs := mtxv(mEarth, pObs); • Cannot calculate the geometric mean of an array temp := temp * x[i]; // what’s the type of temp?

18. Future and Current Work • Reimplement frame certification linearly • Measurement Unit certification • Do not add meters and seconds! • Simple and expandable Abstract Domain: sorts BUnit Unit . subsorts BUnit < Unit . op nil : -> Unit . ops kg m s : -> BUnit . op Newton : -> Unit . op _^_ : Unit Int -> Unit [prec 10] . op __ : Unit Unit -> Unit [assoc comm prec 15] . vars U U' : Unit . vars N M : Int . eq U nil = U . eq nil ^ N = nil . eq U ^ 0 = nil . eq U ^ 1 = U . eq U U = U ^ 2 . eq U (U ^ N) = U ^ (N + 1) . eq (U ^ N) (U ^ M) = U ^ (N + M) . eq (U U') ^ N = (U ^ N) (U' ^ N) . eq (U ^ N) ^ M = U ^ (N * M) . eq Newton = kg m s ^ -2 . AC matching

19. Future and Current Work • Measurement Unit certification • Programming language: BC • “for” and “while” loops, “if_then_else” • Function definitions (can be recursive) • Arrays; no pointers, no objects • Complex abstraction semantics • Stacks and sets of environments • Symbolic abstract, domain-specific execution • Programming language specific policies • Memory safety, deadlocks/dataraces, division by 0 • Combine with Runtime Verification • Prove statically what is tractable, monitor the rest