Formally Verified Deployed Software Systems: Lessons Learned from Real-World Applications

Core Concepts

Formal verification techniques have been successfully applied to develop and deploy real-world software systems across various domains, providing valuable lessons on the practicality and limitations of formal methods in industry.

Abstract

The article surveys a range of formally verified and deployed software systems, examining the technologies used, the verification approaches applied, the results obtained, and the lessons learned. Key findings include:

Formal verification has been applied to develop and deploy systems in diverse domains such as compilers, operating systems, cryptographic libraries, and aerospace applications, demonstrating the practicality of the approach.

The verification approaches used include axiomatic semantics, abstract interpretation, model checking, theorem proving, and refinement-based methods like B and Event-B. The choice of approach depends on the properties to be verified and the characteristics of the system.

Formally verified systems have achieved properties such as functional correctness, security, memory safety, and timing/resource constraints. However, the effort required can be substantial, ranging from less than a year to over 250 person-years.

Maintaining a realistic view of verification is important, as specifications may be incomplete and hypotheses can be violated. Verification is an iterative process, not a one-shot solution.

Verifying the entire verification toolchain, including compilers and execution environments, is a significant challenge. Bootstrapping the verification process is an active area of research.

The survey provides a factual basis to discuss the practicality and limitations of formal verification in industry, highlighting both the successes and the remaining challenges.

Stats

The CompCert compiler is formally verified to preserve the semantics of the source C program in the generated assembly code.
The CakeML compiler is formally verified to preserve the semantics of the source CakeML program in the generated machine code.
The seL4 microkernel is formally verified to satisfy functional correctness and security properties.
The HACL* cryptographic library is formally verified to satisfy security, functional correctness, and memory safety properties.

Quotes

"Formal verification has been applied to develop and deploy systems in diverse domains such as compilers, operating systems, cryptographic libraries, and aerospace applications, demonstrating the practicality of the approach."
"Maintaining a realistic view of verification is important, as specifications may be incomplete and hypotheses can be violated. Verification is an iterative process, not a one-shot solution."
"Verifying the entire verification toolchain, including compilers and execution environments, is a significant challenge. Bootstrapping the verification process is an active area of research."

Key Insights Distilled From

Lessons from Formally Verified Deployed Software Systems (Extended version)

by Li Huang,Sop... at arxiv.org 04-01-2024

https://arxiv.org/pdf/2301.02206.pdf

Deeper Inquiries

How can formal verification be better integrated into mainstream software development processes to improve adoption?

Formal verification can be better integrated into mainstream software development processes by addressing several key aspects:

Tool Integration: Integrate formal verification tools with popular Integrated Development Environments (IDEs) to make them more accessible to developers. This can include plugins or extensions that allow developers to easily run verification checks within their familiar development environment.

Training and Education: Provide training and educational resources to developers on formal verification techniques and tools. This can help demystify the process and make developers more comfortable with incorporating verification into their workflow.

Automation: Automate parts of the verification process to reduce the manual effort required. This can involve automating the generation of verification conditions or the extraction of properties from code.

Standardization: Establish industry standards for formal verification practices and tools. This can help create a common framework that developers can follow and ensure consistency in verification processes across different projects.

Collaboration: Encourage collaboration between academia and industry to bridge the gap between research advancements in formal verification and practical implementation in software development projects.

By addressing these aspects, formal verification can become more seamlessly integrated into mainstream software development processes, leading to improved adoption and increased reliability of software systems.

How can formal verification be more accessible and cost-effective for a wider range of software projects by addressing key technical and organizational challenges?

To make formal verification more accessible and cost-effective for a wider range of software projects, the following challenges need to be addressed:

Tool Complexity: Simplify formal verification tools and make them more user-friendly. This can involve creating intuitive interfaces, providing detailed documentation, and offering tutorials to guide users through the verification process.

Scalability: Develop scalable verification techniques that can handle larger and more complex software systems. This can involve optimizing algorithms, improving tool performance, and parallelizing verification processes.

Interoperability: Ensure that formal verification tools can easily integrate with existing development tools and workflows. This can involve standardizing interfaces and data formats to facilitate seamless integration.

Resource Constraints: Address resource constraints such as time, expertise, and computational resources required for formal verification. This can involve providing training and support to developers, optimizing verification processes, and leveraging cloud computing resources for scalability.

Organizational Support: Create a culture within organizations that values and prioritizes formal verification as an essential part of the software development lifecycle. This can involve providing incentives, resources, and support for teams to adopt formal verification practices.

By addressing these challenges, formal verification can become more accessible and cost-effective for a wider range of software projects, leading to improved software quality and reliability.

How can formal verification be combined with other software engineering practices, such as testing and runtime monitoring, to provide a more comprehensive approach to ensuring software correctness?

Formal verification can be combined with other software engineering practices to create a more comprehensive approach to ensuring software correctness:

Testing: Formal verification can complement testing by providing mathematical guarantees of correctness that testing alone cannot achieve. By combining formal verification with testing, developers can have more confidence in the reliability of their software.

Runtime Monitoring: Runtime monitoring can be used to complement formal verification by providing continuous checks on the system's behavior during execution. This can help detect errors or violations of properties that were not captured during the verification process.

Model Checking: Model checking can be used in conjunction with formal verification to exhaustively explore the state space of a system and verify properties against all possible states. This can help uncover subtle errors that may not be caught by traditional verification techniques.

Static Analysis: Static analysis techniques can be integrated with formal verification to perform automated checks on the codebase for potential issues such as security vulnerabilities, code smells, or performance bottlenecks. This can help improve the overall quality of the software.

Continuous Integration: Incorporating formal verification into the continuous integration pipeline can ensure that verification checks are run automatically whenever changes are made to the codebase. This can help catch errors early in the development process and prevent them from propagating to later stages.

By combining formal verification with these complementary software engineering practices, developers can create a robust and comprehensive approach to ensuring software correctness throughout the development lifecycle.