[Paper Review] Abstract I/O Specification

Willem Penninckx, Amin Timany+1 more|arXiv (Cornell University)|Jan 29, 2019

Petri Nets in System Modeling2 references4 citations

TL;DR

This paper proposes an enhanced specification framework for abstract I/O behavior in programs by embedding Petri nets into separation logic using assertions as places, enabling modular verification of I/O actions that combine memory manipulation and I/O. It introduces constrained, incremental prophecy variables to handle non-deterministic input and supports equivalence reasoning on I/O specifications, with formal verification in Iris/Coq and integration into VeriFast.

ABSTRACT

We recently proposed an approach for the specification and modular formal verification of the interactive (I/O) behavior of programs, based on an embedding of Petri nets into separation logic. While this approach is scalable and modular in terms of the I/O APIs available to a program, enables composing low-level I/O actions into high-level ones, and enables a convenient verification experience, it does not support high-level I/O actions that involve memory manipulation as well as low-level I/O (such as buffered I/O), or that are in fact "virtual I/O" actions that are implemented purely through memory manipulation. Furthermore, it does not allow rewriting an I/O specification into an equivalent one. In this paper, we propose a refined approach that does have these properties. The essential insight is to fix the set of places of the Petri net to be the set of separation logic assertions, thus making available the full power of separation logic for abstractly stating an arbitrary operation's specification in Petri net form, for composing operations into an I/O specification, and for equivalence reasoning on I/O specifications. Our refinement resolves the issue of the justification of the choice of Petri nets over other formalisms such as general state transition systems, in that it "refines them away" into the more essential constructs of separating conjunction and abstract nested triples. To enable a convenient treatment of input operations, we propose the use of prophecy variables to eliminate their non-determinism. We illustrate the approach through a number of example programs, including one where subroutines specified and verified using I/O specifications run as threads communicating through shared memory. The theory and examples of the paper have been machine-checked using the Iris library for program verification in the Coq proof assistant.

Motivation & Objective

• To address the lack of modular, compositional verification techniques for interactive I/O behavior in imperative programs.
• To enable specification and verification of high-level I/O actions that combine memory manipulation and I/O, such as buffered I/O or ByteArrayOutputStream.
• To support rewriting and equivalence reasoning on I/O specifications, which was not possible in prior Petri net-based approaches.
• To integrate non-deterministic input operations into the specification framework using prophecy variables, eliminating non-determinism in a modular way.
• To provide a foundation for verifying concurrent programs with I/O behavior, such as thread communication via shared-memory channels.

Proposed method

• Fix the set of Petri net places to be separation logic assertions, enabling full use of separation logic for specifying I/O behavior.
• Use separating conjunction and abstract nested triples to express I/O specifications without explicit reference to Petri nets, refining the formalism into core logical constructs.
• Introduce constrained, incremental prophecy variables to model non-deterministic input operations as deterministic, stateful actions with predictable outcomes.
• Define transition predicates (e.g., send_, receive_) that relate pre- and postconditions via shared invariants and fractional ownership of ghost state.
• Use a shared invariant to track the state of multiple threads and the contents of a communication channel, ensuring consistency across concurrent operations.
• Machine-check the theory and examples using the Iris library in Coq, and validate the approach with C and Java examples in VeriFast.

Experimental results

Research questions

• RQ1 How can I/O specifications be made modular and composable when they involve both memory manipulation and low-level I/O operations?
• RQ2 Can equivalence reasoning on I/O specifications be supported in a separation logic framework, and if so, how?
• RQ3 How can non-deterministic input operations be formally modeled and verified in a way that preserves modularity and compositional reasoning?
• RQ4 Can the use of Petri nets in I/O specification be refined into a more foundational logic-based formalism without losing expressiveness?
• RQ5 How can concurrent programs with I/O behavior, such as thread communication via shared memory, be verified using this framework?

Key findings

• The proposed framework enables the specification and verification of I/O actions that mix memory manipulation and I/O, such as Java’s ByteArrayOutputStream, which were not expressible in prior approaches.
• The use of separation logic assertions as Petri net places allows full compositional reasoning and equivalence checking on I/O specifications.
• Constrained, incremental prophecy variables successfully eliminate non-determinism in input operations while preserving modularity and enabling verification.
• The framework supports modular verification of concurrent programs, such as a chat server with multiple threads communicating via shared-memory channels.
• The theory and examples have been formally verified in Coq using the Iris library, and the approach has been successfully integrated into the VeriFast verifier for C and Java.