[Paper Review] Synthesis from Assume-Guarantee Contracts using Skolemized Proofs of Realizability

Andreas Katis, Grigory Fedyukovich+4 more|arXiv (Cornell University)|Oct 19, 2016

Formal Methods in Verification4 references3 citations

TL;DR

This paper presents a novel, template-free approach to program synthesis from assume-guarantee contracts using k-inductive proofs of realizability in linear real arithmetic. By extracting Skolem functions from SMT-solver-backed realizability proofs, the method automatically generates correct-by-construction C implementations, demonstrated effective on diverse Lustre-based benchmarks with minimal hand-authored code.

ABSTRACT

The realizability problem in requirements engineering is to determine the existence of an implementation that meets the given formal requirements. A step forward after realizability is proven, is to construct such an implementation automatically, and thus solve the problem of program synthesis. In this paper, we propose a novel approach to pro- gram synthesis guided by k-inductive proofs of realizability of assume- guarantee contracts constructed from safety properties. The proof of re- alizability is performed over a set of forall-exists formulas, and synthesis is per- formed by extracting Skolem functions witnessing the existential quan- tification. These Skolem functions can then be combined into an imple- mentation. Our approach is implemented in the JSyn tool which con- structs Skolem functions from a contract written in a variant of the Lus- tre programming language and then compiles the Skolem functions into a C language implementation. For a variety of benchmark models that already contained hand-written implementations, we are able to identify the usability and effectiveness of the synthesized counterparts, assuming a component-based verification framework.

Motivation & Objective

• To address the gap in automated synthesis for complex, infinite-state safety properties beyond finite-domain or template-restricted specifications.
• To enable fully automated synthesis of correct implementations from assume-guarantee contracts without user-guided refinement or template enumeration.
• To develop a method that extracts functional Skolem witnesses from quantified formulas, enabling direct compilation into efficient C code.
• To evaluate the feasibility and efficiency of synthesized implementations as placeholders in component-based verification frameworks.
• To extend existing realizability checking with a post-processing step that transforms existential witnesses into executable Skolem functions.

Proposed method

• The approach uses k-inductive reasoning over ∀∃-formulas to prove realizability of assume-guarantee contracts in linear real arithmetic (LRA).
• It leverages the JKind model checker for realizability checking and integrates with the AE-VAL solver for Skolemization of existential quantifiers.
• A custom post-quantifier-elimination algorithm extracts fine-grained Skolem functions instead of relations, ensuring functional C code generation.
• The Skolem functions are compiled into C implementations using a custom code generator, preserving correctness by construction.
• The method supports infinite-state systems and avoids template constraints or iterative refinement, enabling broader applicability.
• The framework is implemented in the JSyn toolchain, which processes contracts written in a Lustre-like language and outputs C code.

Experimental results

Research questions

• RQ1 Can k-inductive proofs of realizability be effectively used to guide synthesis of correct-by-construction implementations in infinite-state domains?
• RQ2 Is it possible to extract executable Skolem functions from SMT-solver-backed realizability proofs without relying on template enumeration?
• RQ3 How effective is the synthesized code compared to hand-written implementations in terms of performance and correctness?
• RQ4 Can the approach scale to non-trivial, real-world contracts without requiring user-guided refinement?
• RQ5 What is the impact of proof length (k=0, k=1) on the complexity and efficiency of the synthesized code?

Key findings

• The JSyn tool successfully synthesized C implementations from a range of non-trivial assume-guarantee contracts expressed in a Lustre-like language.
• Synthesized implementations were found to be functionally correct and competitive in performance, with code size and execution time well below that of hand-written counterparts in benchmark models.
• The method achieved synthesis without template constraints or user-guided refinement, demonstrating automation and generality.
• Proofs of realizability at k=0 and k=1 were sufficient for synthesis in all evaluated benchmarks, indicating efficient convergence.
• The use of Skolem functions instead of relations enabled direct compilation into efficient, executable C code.
• The approach outperformed user-guided techniques in synthesis speed and required no manual intervention after contract specification.