2017: VERIFIED SYSTEMS

Eddie Kohler

- Research seminar in computer systems
- Relatively informal
- Different topic each time
- We read papers
- We complete a couple assignments
- We do research
- We learn together

- Learn currently hot topics in systems research and important past research
- Learn how to read research papers
- Learn how to do research
- Prepare for graduate school and other lifelong learning

- Ground your research knowledge in real skills

- A major outcome for this course is your final research project
- A great project could be accepted for publication to a workshop or research conference—but whether it is is up to you
- Group projects are OK
- Many projects will involve implementation (or, this time, proving)
- A good research survey is also acceptable

- Read papers before they are discussed in class
- Each paper will be accompanied by a short survey question you should answer before class

- Present at least one paper
- Engage actively in class discussion
- Attendance matters

- Complete assignments
- Project

- Systems that have been formally verified correct
- Systems whose purpose is formally verifying other systems
- Verification techniques and tricks

- Systems that have been formally verified correct
- Systems whose purpose is formally verifying other systems
- Verification techniques and tricks
- Rant

- Theory of verification
- Category theory
- Predicative vs. impredicative mathematics
- Respectable

- Individual verified systems: l4, CompCert, CertiKOS, Ironclad Apps, IronFleet, …
- Verification frameworks: Coq, Dafny, NuPRL, Verdi, TLA+, SAT solvers, …
- Digressions: SAT optimizations, constraint solvers, …

- An interactive theorem prover developed in France
- Based on the Calculus of (co)Inductive Constructions
- A small, proven-correct core plus layers of libraries
- A functional programming language with an advanced type system, including dependent types
- Allows extraction of working, efficient code!
- Basis of some of the most impressive software projects ever, especially CompCert

- An interactive theorem prover developed in France
- Based on the Calculus of (co)Inductive Constructions
- A small, proven-correct core plus layers of libraries
- A functional programming language with an advanced type system, including dependent types
- Allows extraction of working, efficient code!
- Basis of some of the most impressive software projects ever, especially CompCert
**An incredible pain in the ass**

*A well-typed program is a proof of a proposition; the proposition proved is the program’s type*- The program is a
*witness*certifying the existence of a proof - The Curry–Howard correspondence

- Example: Let’s prove that an integer exists
`Definition AnIntegerExists : nat.`

- The type of this program will be
`nat`

, the type of nonnegative integers in Coq (part of the standard library) - If we can produce an integer, we’ll have proved the lemma
- Our goal: “
`AnIntegerExists is defined.`

”

- An elegant example: truth and falsity
- Library Coq.Init.Logic

- If proofs are types, then limitations in your type system limit what you can prove
- Simple type systems are limited to simple existence arguments
- That’s why Coq has a complicated type system!
- Coq’s type system can express ideas as complicated as “this compiler correctly translates C to assembly language”

- The world is full of truths, many of which Coq already knows in libraries, but finding out the terms in which it knows those truths is tiresome; you find yourself proving trivial truths again and again
- Its users can be insane math people or arrogant
- It is super complicated and that’s OK to admit

*seL4: Formal Verification of an OS Kernel*(presented by Eddie)- More Coq, and our first assignment